Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
25/12/2023, 13:17 UTC
General
-
Target
211da615bc1c5bda63e8ed3caecaf68b.exe
-
Size
501KB
-
MD5
211da615bc1c5bda63e8ed3caecaf68b
-
SHA1
818ee48249335fc10b8b6fc42fca35bb66e9a95a
-
SHA256
0a8b4703517118f05483c8d7f3416130f1e8cb5e512fd4a756c2fb4ada2cd43f
-
SHA512
39cf4441d480647eb23f0744a86b5e2af62850da9d44ac096613ce1a085a7ed720b6903a4c909a7bb1f8277e4c5274e30ddff894eb3595cbeafa0a1cac71aabd
-
SSDEEP
12288:vRjPijdsbNjk1gl0cDdvC1wG1/fKyXzaVY0A5:vVmd4jBxvI1/fKyXzr0
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Program crash 18 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies system certificate store 2 TTPs 5 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\211da615bc1c5bda63e8ed3caecaf68b.exe"C:\Users\Admin\AppData\Local\Temp\211da615bc1c5bda63e8ed3caecaf68b.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\211da615bc1c5bda63e8ed3caecaf68b.exeC:\Users\Admin\AppData\Local\Temp\211da615bc1c5bda63e8ed3caecaf68b.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\211da615bc1c5bda63e8ed3caecaf68b.exe" /TN xWvB9PLxff3d /F3⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c schtasks.exe /Query /XML /TN xWvB9PLxff3d > C:\Users\Admin\AppData\Local\Temp\ticSmcL0.xml3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Query /XML /TN xWvB9PLxff3d4⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 6163⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 6483⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 6563⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 7603⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 7803⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 8363⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 14563⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 18603⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 19243⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 19283⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 18683⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 21563⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 19763⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 20963⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 19243⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 19803⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 20043⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4604 -s 6483⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4604 -ip 46041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4604 -ip 46041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4604 -ip 46041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4604 -ip 46041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4604 -ip 46041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4604 -ip 46041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4604 -ip 46041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 4604 -ip 46041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4604 -ip 46041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4604 -ip 46041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4604 -ip 46041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4604 -ip 46041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4604 -ip 46041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 4604 -ip 46041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4604 -ip 46041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4604 -ip 46041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4604 -ip 46041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4604 -ip 46041⤵
Network
-
DNS16.53.126.40.in-addr.arpaRemote address:8.8.8.8:53Request16.53.126.40.in-addr.arpaIN PTRResponse -
DNS158.240.127.40.in-addr.arpaRemote address:8.8.8.8:53Request158.240.127.40.in-addr.arpaIN PTRResponse
-
DNS40.134.221.88.in-addr.arpaRemote address:8.8.8.8:53Request40.134.221.88.in-addr.arpaIN PTRResponse40.134.221.88.in-addr.arpaIN PTRa88-221-134-40deploystaticakamaitechnologiescom
-
DNSg.bing.comRemote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.a-0001.a-msedge.netg-bing-com.a-0001.a-msedge.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ee171670f85e4071ac6dabbc1984d2bd&localId=w:5CCFAF18-3F96-093A-F0B7-3C3E79A9C582&deviceId=6966554353444491&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ee171670f85e4071ac6dabbc1984d2bd&localId=w:5CCFAF18-3F96-093A-F0B7-3C3E79A9C582&deviceId=6966554353444491&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
ResponseHTTP/2.0 204
cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=2E1A8F1CE41E62EA09419CEEE5FE6340; domain=.bing.com; expires=Sat, 18-Jan-2025 13:18:34 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: F0BD114A5FF740369221491896604AF4 Ref B: LON04EDGE1222 Ref C: 2023-12-25T13:18:34Z
date: Mon, 25 Dec 2023 13:18:34 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=ee171670f85e4071ac6dabbc1984d2bd&localId=w:5CCFAF18-3F96-093A-F0B7-3C3E79A9C582&deviceId=6966554353444491&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=ee171670f85e4071ac6dabbc1984d2bd&localId=w:5CCFAF18-3F96-093A-F0B7-3C3E79A9C582&deviceId=6966554353444491&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=2E1A8F1CE41E62EA09419CEEE5FE6340
ResponseHTTP/2.0 204
cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=pIICuDuTJxpFd5UNi8THwG4y960DgRr2WLhE_I1cukc; domain=.bing.com; expires=Sat, 18-Jan-2025 13:18:34 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 946152B4810548E19A2C27B48B225B99 Ref B: LON04EDGE1222 Ref C: 2023-12-25T13:18:34Z
date: Mon, 25 Dec 2023 13:18:34 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ee171670f85e4071ac6dabbc1984d2bd&localId=w:5CCFAF18-3F96-093A-F0B7-3C3E79A9C582&deviceId=6966554353444491&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ee171670f85e4071ac6dabbc1984d2bd&localId=w:5CCFAF18-3F96-093A-F0B7-3C3E79A9C582&deviceId=6966554353444491&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=2E1A8F1CE41E62EA09419CEEE5FE6340; MSPTC=pIICuDuTJxpFd5UNi8THwG4y960DgRr2WLhE_I1cukc
ResponseHTTP/2.0 204
cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 6FA12F36541045AD8DF500B2E382A4C3 Ref B: LON04EDGE1222 Ref C: 2023-12-25T13:18:34Z
date: Mon, 25 Dec 2023 13:18:34 GMT
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTR
-
DNS200.197.79.204.in-addr.arpaRemote address:8.8.8.8:53Request200.197.79.204.in-addr.arpaIN PTRResponse200.197.79.204.in-addr.arpaIN PTRa-0001a-msedgenet
-
DNS200.197.79.204.in-addr.arpaRemote address:8.8.8.8:53Request200.197.79.204.in-addr.arpaIN PTR
-
DNS241.154.82.20.in-addr.arpaRemote address:8.8.8.8:53Request241.154.82.20.in-addr.arpaIN PTRResponse
-
DNS57.169.31.20.in-addr.arpaRemote address:8.8.8.8:53Request57.169.31.20.in-addr.arpaIN PTRResponse
-
DNS41.110.16.96.in-addr.arpaRemote address:8.8.8.8:53Request41.110.16.96.in-addr.arpaIN PTRResponse41.110.16.96.in-addr.arpaIN PTRa96-16-110-41deploystaticakamaitechnologiescom
-
DNS81.171.91.138.in-addr.arpaRemote address:8.8.8.8:53Request81.171.91.138.in-addr.arpaIN PTRResponse
-
DNS81.171.91.138.in-addr.arpaRemote address:8.8.8.8:53Request81.171.91.138.in-addr.arpaIN PTR
-
DNSpastebin.comRemote address:8.8.8.8:53Requestpastebin.comIN AResponsepastebin.comIN A104.20.67.143pastebin.comIN A172.67.34.170pastebin.comIN A104.20.68.143
-
DNSpastebin.comRemote address:8.8.8.8:53Requestpastebin.comIN A
-
DNS143.67.20.104.in-addr.arpaRemote address:8.8.8.8:53Request143.67.20.104.in-addr.arpaIN PTRResponse
-
DNS143.67.20.104.in-addr.arpaRemote address:8.8.8.8:53Request143.67.20.104.in-addr.arpaIN PTR
-
DNS143.67.20.104.in-addr.arpaRemote address:8.8.8.8:53Request143.67.20.104.in-addr.arpaIN PTR
-
DNS143.67.20.104.in-addr.arpaRemote address:8.8.8.8:53Request143.67.20.104.in-addr.arpaIN PTR
-
DNS143.67.20.104.in-addr.arpaRemote address:8.8.8.8:53Request143.67.20.104.in-addr.arpaIN PTR
-
DNScutit.orgRemote address:8.8.8.8:53Requestcutit.orgIN AResponsecutit.orgIN A64.91.240.248
-
GEThttps://cutit.org/oxgBRRemote address:64.91.240.248:443RequestGET /oxgBR HTTP/1.1
User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; pt-br; MZ608 Build/7.7.1-141-7-FLEM-UMTS-LA) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
Host: cutit.org
Cache-Control: no-cache
ResponseHTTP/1.1 302 Moved Temporarily
Date: Mon, 25 Dec 2023 13:19:20 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9
X-Powered-By: PHP/5.4.16
Connection: close
Cache-Control: no-cache
Pragma: no-cache
Location: http://ww1.cutit.org/oxgBR?usid=25&utid=4408218896
Content-Length: 0
Content-Type: text/html; charset=UTF-8
-
DNS248.240.91.64.in-addr.arpaRemote address:8.8.8.8:53Request248.240.91.64.in-addr.arpaIN PTRResponse248.240.91.64.in-addr.arpaIN PTRcrocodile parklogiccom
-
DNS248.240.91.64.in-addr.arpaRemote address:8.8.8.8:53Request248.240.91.64.in-addr.arpaIN PTR
-
DNS50.23.12.20.in-addr.arpaRemote address:8.8.8.8:53Request50.23.12.20.in-addr.arpaIN PTRResponse
-
DNS18.31.95.13.in-addr.arpaRemote address:8.8.8.8:53Request18.31.95.13.in-addr.arpaIN PTRResponse
-
DNS32.169.19.2.in-addr.arpaRemote address:8.8.8.8:53Request32.169.19.2.in-addr.arpaIN PTRResponse32.169.19.2.in-addr.arpaIN PTRa2-19-169-32deploystaticakamaitechnologiescom
-
DNS32.169.19.2.in-addr.arpaRemote address:8.8.8.8:53Request32.169.19.2.in-addr.arpaIN PTR
-
DNS146.78.124.51.in-addr.arpaRemote address:8.8.8.8:53Request146.78.124.51.in-addr.arpaIN PTRResponse
-
DNS146.78.124.51.in-addr.arpaRemote address:8.8.8.8:53Request146.78.124.51.in-addr.arpaIN PTR
-
DNS18.134.221.88.in-addr.arpaRemote address:8.8.8.8:53Request18.134.221.88.in-addr.arpaIN PTRResponse18.134.221.88.in-addr.arpaIN PTRa88-221-134-18deploystaticakamaitechnologiescom
-
DNS18.134.221.88.in-addr.arpaRemote address:8.8.8.8:53Request18.134.221.88.in-addr.arpaIN PTR
-
DNS193.179.17.96.in-addr.arpaRemote address:8.8.8.8:53Request193.179.17.96.in-addr.arpaIN PTRResponse193.179.17.96.in-addr.arpaIN PTRa96-17-179-193deploystaticakamaitechnologiescom
-
DNSww1.cutit.orgRemote address:8.8.8.8:53Requestww1.cutit.orgIN AResponseww1.cutit.orgIN CNAMEsedoparking.comsedoparking.comIN A64.190.63.136
-
DNSww1.cutit.orgRemote address:8.8.8.8:53Requestww1.cutit.orgIN A
-
DNSww1.cutit.orgRemote address:8.8.8.8:53Requestww1.cutit.orgIN A
-
GEThttp://ww1.cutit.org/oxgBR?usid=25&utid=4408218896Remote address:64.190.63.136:80RequestGET /oxgBR?usid=25&utid=4408218896 HTTP/1.1
User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; pt-br; MZ608 Build/7.7.1-141-7-FLEM-UMTS-LA) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
Cache-Control: no-cache
Host: ww1.cutit.org
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
date: Mon, 25 Dec 2023 13:19:23 GMT
content-type: text/html; charset=UTF-8
transfer-encoding: chunked
vary: Accept-Encoding
x-powered-by: PHP/8.1.17
expires: Mon, 26 Jul 1997 05:00:00 GMT
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
pragma: no-cache
x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANnylWw2vLY4hUn9w06zQKbhKBfvjFUCsdFlb6TdQhxb9RXWXuI4t31c+o8fYOv/s8q1LGPga3DE1L/tHU4LENMCAwEAAQ==_ZTTetwnwT9D/3Z0BneXbNkh5oKVz1FDxVxPwzTSYxXnFw2OHiL2gM+4SIrdr6FO4hL3N73IGPM/PDVxPEmYkPA==
last-modified: Mon, 25 Dec 2023 13:19:23 GMT
x-cache-miss-from: parking-56c7b4c6cb-77z4s
server: NginX
-
DNStse1.mm.bing.netRemote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
DNStse1.mm.bing.netRemote address:8.8.8.8:53Requesttse1.mm.bing.netIN A
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301524_1QHZ48X3FA5D7O1LG&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301524_1QHZ48X3FA5D7O1LG&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 130407
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: D7806BC34E3E49B4AFA33998E568DD66 Ref B: LON04EDGE1215 Ref C: 2023-12-25T13:19:24Z
date: Mon, 25 Dec 2023 13:19:24 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301644_1VM6W540D06LTCJ4J&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301644_1VM6W540D06LTCJ4J&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 300283
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: CC9A6E450D1247F486C7B97B41BB1737 Ref B: LON04EDGE1215 Ref C: 2023-12-25T13:19:24Z
date: Mon, 25 Dec 2023 13:19:24 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301246_1WJH3TXXVOGBRWUGS&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301246_1WJH3TXXVOGBRWUGS&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 628594
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: CE82C36CF6BE4765BAD4895DA3300DB3 Ref B: LON04EDGE1215 Ref C: 2023-12-25T13:19:25Z
date: Mon, 25 Dec 2023 13:19:25 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301091_17CAP65GDSQMFV4JE&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301091_17CAP65GDSQMFV4JE&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 163903
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 45658C71507F42D1BA5CA067ABDAB42F Ref B: LON04EDGE1215 Ref C: 2023-12-25T13:19:25Z
date: Mon, 25 Dec 2023 13:19:25 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301235_1HF3YV71T1KJCXDY3&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301235_1HF3YV71T1KJCXDY3&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 358514
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: F0F82BC381E7482285D93783742522D2 Ref B: LON04EDGE1215 Ref C: 2023-12-25T13:19:25Z
date: Mon, 25 Dec 2023 13:19:25 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301655_1DZQZV6Z7ZOAU893W&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301655_1DZQZV6Z7ZOAU893W&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 605112
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 2B83C96271F64539B78028195BABB343 Ref B: LON04EDGE1215 Ref C: 2023-12-25T13:20:00Z
date: Mon, 25 Dec 2023 13:20:00 GMT
-
DNS88.156.103.20.in-addr.arpaRemote address:8.8.8.8:53Request88.156.103.20.in-addr.arpaIN PTRResponse
-
DNS88.156.103.20.in-addr.arpaRemote address:8.8.8.8:53Request88.156.103.20.in-addr.arpaIN PTRResponse
-
DNS79.121.231.20.in-addr.arpaRemote address:8.8.8.8:53Request79.121.231.20.in-addr.arpaIN PTRResponse
-
DNS79.121.231.20.in-addr.arpaRemote address:8.8.8.8:53Request79.121.231.20.in-addr.arpaIN PTRResponse
-
DNS136.63.190.64.in-addr.arpaRemote address:8.8.8.8:53Request136.63.190.64.in-addr.arpaIN PTRResponse
-
DNS136.63.190.64.in-addr.arpaRemote address:8.8.8.8:53Request136.63.190.64.in-addr.arpaIN PTRResponse
-
DNS9.134.221.88.in-addr.arpaRemote address:8.8.8.8:53Request9.134.221.88.in-addr.arpaIN PTRResponse9.134.221.88.in-addr.arpaIN PTRa88-221-134-9deploystaticakamaitechnologiescom
-
DNS9.134.221.88.in-addr.arpaRemote address:8.8.8.8:53Request9.134.221.88.in-addr.arpaIN PTRResponse9.134.221.88.in-addr.arpaIN PTRa88-221-134-9deploystaticakamaitechnologiescom
-
DNS14.227.111.52.in-addr.arpaRemote address:8.8.8.8:53Request14.227.111.52.in-addr.arpaIN PTRResponse
-
DNS14.227.111.52.in-addr.arpaRemote address:8.8.8.8:53Request14.227.111.52.in-addr.arpaIN PTR
-
DNS14.227.111.52.in-addr.arpaRemote address:8.8.8.8:53Request14.227.111.52.in-addr.arpaIN PTR
-
DNS14.227.111.52.in-addr.arpaRemote address:8.8.8.8:53Request14.227.111.52.in-addr.arpaIN PTR
-
DNS100.5.17.2.in-addr.arpaRemote address:8.8.8.8:53Request100.5.17.2.in-addr.arpaIN PTRResponse100.5.17.2.in-addr.arpaIN PTRa2-17-5-100deploystaticakamaitechnologiescom
-
DNS100.5.17.2.in-addr.arpaRemote address:8.8.8.8:53Request100.5.17.2.in-addr.arpaIN PTR
-
DNS119.110.54.20.in-addr.arpaRemote address:8.8.8.8:53Request119.110.54.20.in-addr.arpaIN PTRResponse
-
DNS119.110.54.20.in-addr.arpaRemote address:8.8.8.8:53Request119.110.54.20.in-addr.arpaIN PTRResponse
-
DNS56.134.221.88.in-addr.arpaRemote address:8.8.8.8:53Request56.134.221.88.in-addr.arpaIN PTRResponse56.134.221.88.in-addr.arpaIN PTRa88-221-134-56deploystaticakamaitechnologiescom
-
DNS56.134.221.88.in-addr.arpaRemote address:8.8.8.8:53Request56.134.221.88.in-addr.arpaIN PTRResponse56.134.221.88.in-addr.arpaIN PTRa88-221-134-56deploystaticakamaitechnologiescom
-
DNS8.179.89.13.in-addr.arpaRemote address:8.8.8.8:53Request8.179.89.13.in-addr.arpaIN PTRResponse
-
DNS8.179.89.13.in-addr.arpaRemote address:8.8.8.8:53Request8.179.89.13.in-addr.arpaIN PTRResponse
-
DNS43.134.221.88.in-addr.arpaRemote address:8.8.8.8:53Request43.134.221.88.in-addr.arpaIN PTRResponse43.134.221.88.in-addr.arpaIN PTRa88-221-134-43deploystaticakamaitechnologiescom
-
DNS43.134.221.88.in-addr.arpaRemote address:8.8.8.8:53Request43.134.221.88.in-addr.arpaIN PTR
-
52.142.223.178:80 -
204.79.197.200:443https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ee171670f85e4071ac6dabbc1984d2bd&localId=w:5CCFAF18-3F96-093A-F0B7-3C3E79A9C582&deviceId=6966554353444491&anid=tls, http2
HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ee171670f85e4071ac6dabbc1984d2bd&localId=w:5CCFAF18-3F96-093A-F0B7-3C3E79A9C582&deviceId=6966554353444491&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=ee171670f85e4071ac6dabbc1984d2bd&localId=w:5CCFAF18-3F96-093A-F0B7-3C3E79A9C582&deviceId=6966554353444491&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ee171670f85e4071ac6dabbc1984d2bd&localId=w:5CCFAF18-3F96-093A-F0B7-3C3E79A9C582&deviceId=6966554353444491&anid=HTTP Response
204 -
104.20.67.143:443pastebin.com
-
64.91.240.248:443https://cutit.org/oxgBRtls, http
HTTP Request
GET https://cutit.org/oxgBRHTTP Response
302 -
64.190.63.136:80http://ww1.cutit.org/oxgBR?usid=25&utid=4408218896http
HTTP Request
GET http://ww1.cutit.org/oxgBR?usid=25&utid=4408218896HTTP Response
200 -
204.79.197.200:443https://tse1.mm.bing.net/th?id=OADD2.10239317301655_1DZQZV6Z7ZOAU893W&pid=21.2&w=1080&h=1920&c=4tls, http2
HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301524_1QHZ48X3FA5D7O1LG&pid=21.2&w=1080&h=1920&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301644_1VM6W540D06LTCJ4J&pid=21.2&w=1080&h=1920&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301246_1WJH3TXXVOGBRWUGS&pid=21.2&w=1920&h=1080&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301091_17CAP65GDSQMFV4JE&pid=21.2&w=1920&h=1080&c=4HTTP Response
200HTTP Response
200HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301235_1HF3YV71T1KJCXDY3&pid=21.2&w=1920&h=1080&c=4HTTP Response
200HTTP Response
200HTTP Response
200HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301655_1DZQZV6Z7ZOAU893W&pid=21.2&w=1080&h=1920&c=4HTTP Response
200 -
204.79.197.200:443tse1.mm.bing.nettls, http2
-
204.79.197.200:443tse1.mm.bing.nettls, http2
-
204.79.197.200:443tse1.mm.bing.nettls, http2
-
8.8.8.8:5316.53.126.40.in-addr.arpadns
DNS Request
16.53.126.40.in-addr.arpa
-
8.8.8.8:53158.240.127.40.in-addr.arpadns
DNS Request
158.240.127.40.in-addr.arpa
-
8.8.8.8:5340.134.221.88.in-addr.arpadns
DNS Request
40.134.221.88.in-addr.arpa
-
8.8.8.8:53g.bing.comdns
DNS Request
g.bing.com
DNS Response
204.79.197.20013.107.21.200
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:53200.197.79.204.in-addr.arpadns
DNS Request
200.197.79.204.in-addr.arpa
DNS Request
200.197.79.204.in-addr.arpa
-
8.8.8.8:53241.154.82.20.in-addr.arpadns
DNS Request
241.154.82.20.in-addr.arpa
-
8.8.8.8:5357.169.31.20.in-addr.arpadns
DNS Request
57.169.31.20.in-addr.arpa
-
8.8.8.8:5341.110.16.96.in-addr.arpadns
DNS Request
41.110.16.96.in-addr.arpa
-
8.8.8.8:5381.171.91.138.in-addr.arpadns
DNS Request
81.171.91.138.in-addr.arpa
DNS Request
81.171.91.138.in-addr.arpa
-
8.8.8.8:53pastebin.comdns
DNS Request
pastebin.com
DNS Request
pastebin.com
DNS Response
104.20.67.143172.67.34.170104.20.68.143
-
8.8.8.8:53143.67.20.104.in-addr.arpadns
DNS Request
143.67.20.104.in-addr.arpa
DNS Request
143.67.20.104.in-addr.arpa
DNS Request
143.67.20.104.in-addr.arpa
DNS Request
143.67.20.104.in-addr.arpa
DNS Request
143.67.20.104.in-addr.arpa
-
8.8.8.8:53cutit.orgdns
DNS Request
cutit.org
DNS Response
64.91.240.248
-
8.8.8.8:53248.240.91.64.in-addr.arpadns
DNS Request
248.240.91.64.in-addr.arpa
DNS Request
248.240.91.64.in-addr.arpa
-
8.8.8.8:5350.23.12.20.in-addr.arpadns
DNS Request
50.23.12.20.in-addr.arpa
-
8.8.8.8:5318.31.95.13.in-addr.arpadns
DNS Request
18.31.95.13.in-addr.arpa
-
8.8.8.8:5332.169.19.2.in-addr.arpadns
DNS Request
32.169.19.2.in-addr.arpa
DNS Request
32.169.19.2.in-addr.arpa
-
8.8.8.8:53146.78.124.51.in-addr.arpadns
DNS Request
146.78.124.51.in-addr.arpa
DNS Request
146.78.124.51.in-addr.arpa
-
8.8.8.8:5318.134.221.88.in-addr.arpadns
DNS Request
18.134.221.88.in-addr.arpa
DNS Request
18.134.221.88.in-addr.arpa
-
8.8.8.8:53193.179.17.96.in-addr.arpadns
DNS Request
193.179.17.96.in-addr.arpa
-
8.8.8.8:53ww1.cutit.orgdns
DNS Request
ww1.cutit.org
DNS Request
ww1.cutit.org
DNS Request
ww1.cutit.org
DNS Response
64.190.63.136
-
8.8.8.8:53tse1.mm.bing.netdns
DNS Request
tse1.mm.bing.net
DNS Request
tse1.mm.bing.net
DNS Response
204.79.197.20013.107.21.200
-
8.8.8.8:5388.156.103.20.in-addr.arpadns
DNS Request
88.156.103.20.in-addr.arpa
DNS Request
88.156.103.20.in-addr.arpa
-
8.8.8.8:5379.121.231.20.in-addr.arpadns
DNS Request
79.121.231.20.in-addr.arpa
DNS Request
79.121.231.20.in-addr.arpa
-
8.8.8.8:53136.63.190.64.in-addr.arpadns
DNS Request
136.63.190.64.in-addr.arpa
DNS Request
136.63.190.64.in-addr.arpa
-
8.8.8.8:539.134.221.88.in-addr.arpadns
DNS Request
9.134.221.88.in-addr.arpa
DNS Request
9.134.221.88.in-addr.arpa
-
8.8.8.8:5314.227.111.52.in-addr.arpadns
DNS Request
14.227.111.52.in-addr.arpa
DNS Request
14.227.111.52.in-addr.arpa
DNS Request
14.227.111.52.in-addr.arpa
DNS Request
14.227.111.52.in-addr.arpa
-
8.8.8.8:53100.5.17.2.in-addr.arpadns
DNS Request
100.5.17.2.in-addr.arpa
DNS Request
100.5.17.2.in-addr.arpa
-
8.8.8.8:53119.110.54.20.in-addr.arpadns
DNS Request
119.110.54.20.in-addr.arpa
DNS Request
119.110.54.20.in-addr.arpa
-
8.8.8.8:5356.134.221.88.in-addr.arpadns
DNS Request
56.134.221.88.in-addr.arpa
DNS Request
56.134.221.88.in-addr.arpa
-
8.8.8.8:538.179.89.13.in-addr.arpadns
DNS Request
8.179.89.13.in-addr.arpa
DNS Request
8.179.89.13.in-addr.arpa
-
8.8.8.8:5343.134.221.88.in-addr.arpadns
DNS Request
43.134.221.88.in-addr.arpa
DNS Request
43.134.221.88.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.4MB
-
Filesize
428KB
-
Filesize
504KB
-
Filesize
428KB
-
Filesize
504KB
-
Filesize
428KB
-
Filesize
2.4MB
-
Filesize
364KB
-
Filesize
2.4MB