Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

3

Static

static

3

3f38a6b5ce...ee.exe

windows7-x64

3

3f38a6b5ce...ee.exe

windows10-2004-x64

3

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/01/2024, 22:45 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3f38a6b5ce1c06bc66177c5148c2d9ee.exe

  • Size

    1.8MB

  • MD5

    3f38a6b5ce1c06bc66177c5148c2d9ee

  • SHA1

    5ad2ed9b4679bb22f8fc97a55660e92aa2d610b4

  • SHA256

    16a536b0f7df09e7a942c506ed76f35c2eec0f8bfb5681aeb1504b990ffffc71

  • SHA512

    73f57b7c06acd2c7a26655233c5880c8172b160a4282424e674894c6513478e4bfac08b604b16fa517f84225c987a93f08dba65c6728a57500694bfbb76b1c46

  • SSDEEP

    24576:RxYhRHr3bcNSmL7+ldhtyq9tAehagxm+SF+H+4MOqlUbBN7arJ3O3:RxYhRLLcomO/yutA2xm+x+4glqBNY3S

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3f38a6b5ce1c06bc66177c5148c2d9ee.exe
    "C:\Users\Admin\AppData\Local\Temp\3f38a6b5ce1c06bc66177c5148c2d9ee.exe"
    1⤵
      PID:3052
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 192
        2⤵
        • Program crash
        PID:3368
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 3052 -ip 3052
      1⤵
        PID:2592

      Network

      • flag-us
        DNS
        g.bing.com
        Remote address:
        8.8.8.8:53
        Request
        g.bing.com
        IN A
        Response
        g.bing.com
        IN CNAME
        g-bing-com.a-0001.a-msedge.net
        g-bing-com.a-0001.a-msedge.net
        IN CNAME
        dual-a-0001.a-msedge.net
        dual-a-0001.a-msedge.net
        IN A
        204.79.197.200
        dual-a-0001.a-msedge.net
        IN A
        13.107.21.200
      • flag-us
        DNS
        g.bing.com
        Remote address:
        8.8.8.8:53
        Request
        g.bing.com
        IN A
      • flag-us
        DNS
        208.194.73.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        208.194.73.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        208.194.73.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        208.194.73.20.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        69.31.126.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        69.31.126.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        69.31.126.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        69.31.126.40.in-addr.arpa
        IN PTR
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=36f49617f89a4c93b73a35e565775fb1&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid=
        Remote address:
        204.79.197.200:443
        Request
        GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=36f49617f89a4c93b73a35e565775fb1&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        set-cookie: MUID=0934D9CC791D6BAB20BBCA3778FD6A9D; domain=.bing.com; expires=Mon, 27-Jan-2025 22:45:33 GMT; path=/; SameSite=None; Secure; Priority=High;
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: A6D45662A3D24267A26FD2BB81EB405F Ref B: LON04EDGE1205 Ref C: 2024-01-03T22:45:33Z
        date: Wed, 03 Jan 2024 22:45:33 GMT
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=36f49617f89a4c93b73a35e565775fb1&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid=
        Remote address:
        204.79.197.200:443
        Request
        GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=36f49617f89a4c93b73a35e565775fb1&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=0934D9CC791D6BAB20BBCA3778FD6A9D
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        set-cookie: MSPTC=-RjJDjhKkCuF5Fu53LAuPX2yTAOrA5C5YwdbJHC4Z8U; domain=.bing.com; expires=Mon, 27-Jan-2025 22:45:35 GMT; path=/; Partitioned; secure; SameSite=None
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: EE3A153AA15D43DFADF2A9F72BD32A3A Ref B: LON04EDGE1205 Ref C: 2024-01-03T22:45:35Z
        date: Wed, 03 Jan 2024 22:45:35 GMT
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=36f49617f89a4c93b73a35e565775fb1&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid=
        Remote address:
        204.79.197.200:443
        Request
        GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=36f49617f89a4c93b73a35e565775fb1&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=0934D9CC791D6BAB20BBCA3778FD6A9D; MSPTC=-RjJDjhKkCuF5Fu53LAuPX2yTAOrA5C5YwdbJHC4Z8U
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: C140FDC81E06421DA3DA4BB9A288FD1B Ref B: LON04EDGE1205 Ref C: 2024-01-03T22:45:39Z
        date: Wed, 03 Jan 2024 22:45:39 GMT
      • flag-us
        DNS
        200.197.79.204.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        200.197.79.204.in-addr.arpa
        IN PTR
        Response
        200.197.79.204.in-addr.arpa
        IN PTR
        a-0001a-msedgenet
      • flag-us
        DNS
        194.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        194.178.17.96.in-addr.arpa
        IN PTR
        Response
        194.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-194deploystaticakamaitechnologiescom
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        9.228.82.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        9.228.82.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        86.23.85.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        86.23.85.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        195.233.44.23.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        195.233.44.23.in-addr.arpa
        IN PTR
        Response
        195.233.44.23.in-addr.arpa
        IN PTR
        a23-44-233-195deploystaticakamaitechnologiescom
      • flag-us
        DNS
        59.128.231.4.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        59.128.231.4.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        16.234.44.23.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        16.234.44.23.in-addr.arpa
        IN PTR
        Response
        16.234.44.23.in-addr.arpa
        IN PTR
        a23-44-234-16deploystaticakamaitechnologiescom
      • flag-us
        DNS
        198.187.3.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        198.187.3.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        146.78.124.51.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        146.78.124.51.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        146.78.124.51.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        146.78.124.51.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        183.1.37.23.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        183.1.37.23.in-addr.arpa
        IN PTR
        Response
        183.1.37.23.in-addr.arpa
        IN PTR
        a23-37-1-183deploystaticakamaitechnologiescom
      • flag-us
        DNS
        119.110.54.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        119.110.54.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        240.221.184.93.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        240.221.184.93.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        217.135.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        217.135.221.88.in-addr.arpa
        IN PTR
        Response
        217.135.221.88.in-addr.arpa
        IN PTR
        a88-221-135-217deploystaticakamaitechnologiescom
      • flag-us
        DNS
        176.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        176.178.17.96.in-addr.arpa
        IN PTR
        Response
        176.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-176deploystaticakamaitechnologiescom
      • flag-us
        DNS
        176.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        176.178.17.96.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        50.134.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        50.134.221.88.in-addr.arpa
        IN PTR
        Response
        50.134.221.88.in-addr.arpa
        IN PTR
        a88-221-134-50deploystaticakamaitechnologiescom
      • flag-us
        DNS
        0.204.248.87.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        0.204.248.87.in-addr.arpa
        IN PTR
        Response
        0.204.248.87.in-addr.arpa
        IN PTR
        https-87-248-204-0lhrllnwnet
      • flag-us
        DNS
        0.204.248.87.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        0.204.248.87.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        43.58.199.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        43.58.199.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        43.58.199.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        43.58.199.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        174.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        174.178.17.96.in-addr.arpa
        IN PTR
        Response
        174.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-174deploystaticakamaitechnologiescom
      • flag-us
        DNS
        174.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        174.178.17.96.in-addr.arpa
        IN PTR
        Response
        174.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-174deploystaticakamaitechnologiescom
      • flag-us
        DNS
        18.134.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        18.134.221.88.in-addr.arpa
        IN PTR
        Response
        18.134.221.88.in-addr.arpa
        IN PTR
        a88-221-134-18deploystaticakamaitechnologiescom
      • flag-us
        DNS
        18.134.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        18.134.221.88.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        tse1.mm.bing.net
        Remote address:
        8.8.8.8:53
        Request
        tse1.mm.bing.net
        IN A
        Response
        tse1.mm.bing.net
        IN CNAME
        mm-mm.bing.net.trafficmanager.net
        mm-mm.bing.net.trafficmanager.net
        IN CNAME
        dual-a-0001.a-msedge.net
        dual-a-0001.a-msedge.net
        IN A
        204.79.197.200
        dual-a-0001.a-msedge.net
        IN A
        13.107.21.200
      • flag-us
        DNS
        tse1.mm.bing.net
        Remote address:
        8.8.8.8:53
        Request
        tse1.mm.bing.net
        IN A
        Response
        tse1.mm.bing.net
        IN CNAME
        mm-mm.bing.net.trafficmanager.net
        mm-mm.bing.net.trafficmanager.net
        IN CNAME
        dual-a-0001.a-msedge.net
        dual-a-0001.a-msedge.net
        IN A
        204.79.197.200
        dual-a-0001.a-msedge.net
        IN A
        13.107.21.200
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301582_1MLHFWTHBIK9NA4JB&pid=21.2&w=1080&h=1920&c=4
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317301582_1MLHFWTHBIK9NA4JB&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 473067
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: DAD24CB981034081862AE11EC2F552D0 Ref B: LON04EDGE0906 Ref C: 2024-01-03T22:47:06Z
        date: Wed, 03 Jan 2024 22:47:05 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301173_11CL6NTG6CSIMT5HR&pid=21.2&w=1920&h=1080&c=4
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317301173_11CL6NTG6CSIMT5HR&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 541009
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: FEED5C330E4A45F9B6DB0D8D7924F76F Ref B: LON04EDGE0906 Ref C: 2024-01-03T22:47:07Z
        date: Wed, 03 Jan 2024 22:47:06 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301202_1RQN0RMZHNRAOB7W6&pid=21.2&w=1920&h=1080&c=4
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317301202_1RQN0RMZHNRAOB7W6&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 173648
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 6BEE203204DD4E189FDA2C55A6CBFEFA Ref B: LON04EDGE0906 Ref C: 2024-01-03T22:47:07Z
        date: Wed, 03 Jan 2024 22:47:06 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301611_1E01O38L32FSSHIRP&pid=21.2&w=1080&h=1920&c=4
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317301611_1E01O38L32FSSHIRP&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 206157
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 46CCB8789E6A4B779E5DD0F4748530A9 Ref B: LON04EDGE0906 Ref C: 2024-01-03T22:47:07Z
        date: Wed, 03 Jan 2024 22:47:06 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317300914_1CZ3WZGN4XC0X7SDC&pid=21.2&w=1920&h=1080&c=4
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317300914_1CZ3WZGN4XC0X7SDC&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301347_122FD5KJ6L2T045SX&pid=21.2&w=1080&h=1920&c=4
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317301347_122FD5KJ6L2T045SX&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      • flag-us
        DNS
        178.223.142.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        178.223.142.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        178.223.142.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        178.223.142.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        64.134.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        64.134.221.88.in-addr.arpa
        IN PTR
        Response
        64.134.221.88.in-addr.arpa
        IN PTR
        a88-221-134-64deploystaticakamaitechnologiescom
      • flag-us
        DNS
        64.134.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        64.134.221.88.in-addr.arpa
        IN PTR
        Response
        64.134.221.88.in-addr.arpa
        IN PTR
        a88-221-134-64deploystaticakamaitechnologiescom
      • flag-us
        DNS
        67.112.168.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        67.112.168.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        67.112.168.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        67.112.168.52.in-addr.arpa
        IN PTR
        Response
      • 204.79.197.200:443
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=36f49617f89a4c93b73a35e565775fb1&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid=
        tls, http2
        3.0kB
         10.4kB
         27
        19

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=36f49617f89a4c93b73a35e565775fb1&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid=

        HTTP Response

        204

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=36f49617f89a4c93b73a35e565775fb1&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid=

        HTTP Response

        204

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=36f49617f89a4c93b73a35e565775fb1&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid=

        HTTP Response

        204
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.8kB
         8.2kB
         18
        13
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.6kB
         8.7kB
         18
        14
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.8kB
         8.2kB
         18
        13
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.3kB
         658 B
         12
        8
      • 204.79.197.200:443
        https://tse1.mm.bing.net/th?id=OADD2.10239317301347_122FD5KJ6L2T045SX&pid=21.2&w=1080&h=1920&c=4
        tls, http2
        80.3kB
         2.3MB
         1659
        1650

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301582_1MLHFWTHBIK9NA4JB&pid=21.2&w=1080&h=1920&c=4

        HTTP Response

        200

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301173_11CL6NTG6CSIMT5HR&pid=21.2&w=1920&h=1080&c=4

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301202_1RQN0RMZHNRAOB7W6&pid=21.2&w=1920&h=1080&c=4

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301611_1E01O38L32FSSHIRP&pid=21.2&w=1080&h=1920&c=4

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317300914_1CZ3WZGN4XC0X7SDC&pid=21.2&w=1920&h=1080&c=4

        HTTP Response

        200

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301347_122FD5KJ6L2T045SX&pid=21.2&w=1080&h=1920&c=4

        HTTP Response

        200

        HTTP Response

        200
      • 8.8.8.8:53
        g.bing.com
        dns
        112 B
         158 B
         2
        1

        DNS Request

        g.bing.com

        DNS Request

        g.bing.com

        DNS Response

        204.79.197.200
        13.107.21.200

      • 8.8.8.8:53
        208.194.73.20.in-addr.arpa
        dns
        144 B
         158 B
         2
        1

        DNS Request

        208.194.73.20.in-addr.arpa

        DNS Request

        208.194.73.20.in-addr.arpa

      • 8.8.8.8:53
        69.31.126.40.in-addr.arpa
        dns
        142 B
         157 B
         2
        1

        DNS Request

        69.31.126.40.in-addr.arpa

        DNS Request

        69.31.126.40.in-addr.arpa

      • 8.8.8.8:53
        200.197.79.204.in-addr.arpa
        dns
        73 B
         106 B
         1
        1

        DNS Request

        200.197.79.204.in-addr.arpa

      • 8.8.8.8:53
        194.178.17.96.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        194.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
         144 B
         1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        9.228.82.20.in-addr.arpa
        dns
        70 B
         156 B
         1
        1

        DNS Request

        9.228.82.20.in-addr.arpa

      • 8.8.8.8:53
        86.23.85.13.in-addr.arpa
        dns
        70 B
         144 B
         1
        1

        DNS Request

        86.23.85.13.in-addr.arpa

      • 8.8.8.8:53
        195.233.44.23.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        195.233.44.23.in-addr.arpa

      • 8.8.8.8:53
        59.128.231.4.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        59.128.231.4.in-addr.arpa

      • 8.8.8.8:53
        16.234.44.23.in-addr.arpa
        dns
        71 B
         135 B
         1
        1

        DNS Request

        16.234.44.23.in-addr.arpa

      • 8.8.8.8:53
        198.187.3.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        198.187.3.20.in-addr.arpa

      • 8.8.8.8:53
        146.78.124.51.in-addr.arpa
        dns
        144 B
         158 B
         2
        1

        DNS Request

        146.78.124.51.in-addr.arpa

        DNS Request

        146.78.124.51.in-addr.arpa

      • 8.8.8.8:53
        183.1.37.23.in-addr.arpa
        dns
        70 B
         133 B
         1
        1

        DNS Request

        183.1.37.23.in-addr.arpa

      • 8.8.8.8:53
        119.110.54.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        119.110.54.20.in-addr.arpa

      • 8.8.8.8:53
        240.221.184.93.in-addr.arpa
        dns
        73 B
         144 B
         1
        1

        DNS Request

        240.221.184.93.in-addr.arpa

      • 8.8.8.8:53
        217.135.221.88.in-addr.arpa
        dns
        73 B
         139 B
         1
        1

        DNS Request

        217.135.221.88.in-addr.arpa

      • 8.8.8.8:53
        176.178.17.96.in-addr.arpa
        dns
        144 B
         137 B
         2
        1

        DNS Request

        176.178.17.96.in-addr.arpa

        DNS Request

        176.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        50.134.221.88.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        50.134.221.88.in-addr.arpa

      • 8.8.8.8:53
        0.204.248.87.in-addr.arpa
        dns
        142 B
         116 B
         2
        1

        DNS Request

        0.204.248.87.in-addr.arpa

        DNS Request

        0.204.248.87.in-addr.arpa

      • 8.8.8.8:53
        43.58.199.20.in-addr.arpa
        dns
        142 B
         314 B
         2
        2

        DNS Request

        43.58.199.20.in-addr.arpa

        DNS Request

        43.58.199.20.in-addr.arpa

      • 8.8.8.8:53
        174.178.17.96.in-addr.arpa
        dns
        144 B
         274 B
         2
        2

        DNS Request

        174.178.17.96.in-addr.arpa

        DNS Request

        174.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        18.134.221.88.in-addr.arpa
        dns
        144 B
         137 B
         2
        1

        DNS Request

        18.134.221.88.in-addr.arpa

        DNS Request

        18.134.221.88.in-addr.arpa

      • 8.8.8.8:53
        tse1.mm.bing.net
        dns
        124 B
         346 B
         2
        2

        DNS Request

        tse1.mm.bing.net

        DNS Request

        tse1.mm.bing.net

        DNS Response

        204.79.197.200
        13.107.21.200

        DNS Response

        204.79.197.200
        13.107.21.200

      • 8.8.8.8:53
        64.134.221.88.in-addr.arpa
        dns
        144 B
         274 B
         2
        2

        DNS Request

        64.134.221.88.in-addr.arpa

        DNS Request

        64.134.221.88.in-addr.arpa

      • 8.8.8.8:53
        178.223.142.52.in-addr.arpa
        dns
        146 B
         294 B
         2
        2

        DNS Request

        178.223.142.52.in-addr.arpa

        DNS Request

        178.223.142.52.in-addr.arpa

      • 8.8.8.8:53
        67.112.168.52.in-addr.arpa
        dns
        144 B
         292 B
         2
        2

        DNS Request

        67.112.168.52.in-addr.arpa

        DNS Request

        67.112.168.52.in-addr.arpa

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/3052-0-0x0000000000400000-0x00000000005D7000-memory.dmp

        Filesize

        1.8MB

        Download

      • memory/3052-1-0x0000000000400000-0x00000000005D7000-memory.dmp

        Filesize

        1.8MB

        Download

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.