Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

1

Static

static

1

474db9b63b...9.html

windows7-x64

1

474db9b63b...9.html

windows10-2004-x64

1

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/01/2024, 22:16 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    474db9b63bcf0f1b62202e0155f13829.html

  • Size

    44KB

  • MD5

    474db9b63bcf0f1b62202e0155f13829

  • SHA1

    da80a9f7344fca1565b60e1618ab144cb409404b

  • SHA256

    8b231842409fe8479be08347e621495a2891bbb30c69141478f0db624ac5564a

  • SHA512

    880bd84a8c4a96c75afccaeaf9b5247438fa5ae81c9e730333f8865672135185433bc3fc39fd05a74155c5cbbe2bef8ec6e9844c8cf9ca0db957835b41f09956

  • SSDEEP

    768:mwS0l/sGVLsk8ejW4mTNn2obQelgKP8UMXLbk:mZJtNQelgKf

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 51 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\474db9b63bcf0f1b62202e0155f13829.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3940
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3940 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1340

Network

  • flag-us
    DNS
    www.rsvme.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.rsvme.com
    IN A
    Response
    www.rsvme.com
    IN CNAME
    rsvme.com
    rsvme.com
    IN A
    206.132.28.42
  • flag-us
    DNS
    zagevqsoii.biz
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    zagevqsoii.biz
    IN A
    Response
  • flag-us
    DNS
    208.194.73.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    208.194.73.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    49.179.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    49.179.17.96.in-addr.arpa
    IN PTR
    Response
    49.179.17.96.in-addr.arpa
    IN PTR
    a96-17-179-49deploystaticakamaitechnologiescom
  • flag-us
    DNS
    4.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    4.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    241.154.82.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.154.82.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    241.154.82.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.154.82.20.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    241.154.82.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.154.82.20.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    114.110.16.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    114.110.16.96.in-addr.arpa
    IN PTR
    Response
    114.110.16.96.in-addr.arpa
    IN PTR
    a96-16-110-114deploystaticakamaitechnologiescom
  • flag-us
    DNS
    114.110.16.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    114.110.16.96.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    43.58.199.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.58.199.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    43.58.199.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.58.199.20.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    183.59.114.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    183.59.114.20.in-addr.arpa
    IN PTR
    Response
  • GET
    https://ieonline.microsoft.com/ie/known_providers_download_v1.xml
    Request
    GET /ie/known_providers_download_v1.xml HTTP/2.0
    host: ieonline.microsoft.com
    accept: */*
    accept-language: en-US
    ua-cpu: AMD64
    accept-encoding: gzip, deflate
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
    if-modified-since: Thu, 20 Feb 2020 01:30:24 GMT
    cookie: _EDGE_V=1; MUID=0B6295915EED66101C5B867E5F566773; MUIDB=0B6295915EED66101C5B867E5F566773
    Response
    HTTP/2.0 304
    cache-control: private
    set-cookie: _EDGE_S=SID=067A2C7A89C96D210E9A3F8488EE6C09; domain=.microsoft.com; path=/; HttpOnly
    set-cookie: MUIDB=0B6295915EED66101C5B867E5F566773; expires=Thu, 30-Jan-2025 22:16:40 GMT; path=/; HttpOnly
    x-eventid: 6599d14858094012971660e523c3cdb6
    useragentreductionoptout: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 936D511CF1414496AAAA805EC9B273FA Ref B: LON04EDGE0713 Ref C: 2024-01-06T22:16:40Z
    date: Sat, 06 Jan 2024 22:16:40 GMT
  • flag-us
    GET
    https://www.bing.com/favicon.ico
    iexplore.exe
    Remote address:
    92.123.128.142:443
    Request
    GET /favicon.ico HTTP/2.0
    host: www.bing.com
    accept: */*
    ua-cpu: AMD64
    accept-encoding: gzip, deflate
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
    Response
    HTTP/2.0 200
    cache-control: public, max-age=15552000
    content-length: 4286
    content-type: image/x-icon
    last-modified: Mon, 01 Jan 1601 00:00:00 GMT
    x-eventid: 64806c1cfc524c2a9161828833259d63
    useragentreductionoptout: A7kgTC5xdZ2WIVGZEfb1hUoNuvjzOZX3VIV/BA6C18kQOOF50Q0D3oWoAm49k3BQImkujKILc7JmPysWk3CSjwUAAACMeyJvcmlnaW4iOiJodHRwczovL3d3dy5iaW5nLmNvbTo0NDMiLCJmZWF0dXJlIjoiU2VuZEZ1bGxVc2VyQWdlbnRBZnRlclJlZHVjdGlvbiIsImV4cGlyeSI6MTY4NDg4NjM5OSwiaXNTdWJkb21haW4iOnRydWUsImlzVGhpcmRQYXJ0eSI6dHJ1ZX0=
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: FF6B84664449452B9E519FEEB22884D3 Ref B: PAR02EDGE0812 Ref C: 2023-06-09T12:52:57Z
    date: Sat, 06 Jan 2024 22:16:41 GMT
    alt-svc: h3=":443"; ma=93600
    x-cdn-traceid: 0.8e777b5c.1704579401.8ec484fc
  • flag-us
    DNS
    200.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.197.79.204.in-addr.arpa
    IN PTR
    Response
    200.197.79.204.in-addr.arpa
    IN PTR
    a-0001a-msedgenet
  • flag-us
    DNS
    2.136.104.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    2.136.104.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    142.128.123.92.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    142.128.123.92.in-addr.arpa
    IN PTR
    Response
    142.128.123.92.in-addr.arpa
    IN PTR
    a92-123-128-142deploystaticakamaitechnologiescom
  • flag-us
    DNS
    41.110.16.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    41.110.16.96.in-addr.arpa
    IN PTR
    Response
    41.110.16.96.in-addr.arpa
    IN PTR
    a96-16-110-41deploystaticakamaitechnologiescom
  • flag-us
    DNS
    198.187.3.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    161.19.199.152.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    161.19.199.152.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    183.1.37.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    183.1.37.23.in-addr.arpa
    IN PTR
    Response
    183.1.37.23.in-addr.arpa
    IN PTR
    a23-37-1-183deploystaticakamaitechnologiescom
  • flag-us
    DNS
    217.135.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.135.221.88.in-addr.arpa
    IN PTR
    Response
    217.135.221.88.in-addr.arpa
    IN PTR
    a88-221-135-217deploystaticakamaitechnologiescom
  • flag-us
    DNS
    119.110.54.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    119.110.54.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    68.179.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    68.179.17.96.in-addr.arpa
    IN PTR
    Response
    68.179.17.96.in-addr.arpa
    IN PTR
    a96-17-179-68deploystaticakamaitechnologiescom
  • flag-us
    DNS
    68.179.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    68.179.17.96.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    68.179.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    68.179.17.96.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    68.179.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    68.179.17.96.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    32.134.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    32.134.221.88.in-addr.arpa
    IN PTR
    Response
    32.134.221.88.in-addr.arpa
    IN PTR
    a88-221-134-32deploystaticakamaitechnologiescom
  • flag-us
    DNS
    32.134.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    32.134.221.88.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    32.134.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    32.134.221.88.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    18.134.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.134.221.88.in-addr.arpa
    IN PTR
    Response
    18.134.221.88.in-addr.arpa
    IN PTR
    a88-221-134-18deploystaticakamaitechnologiescom
  • flag-us
    DNS
    18.134.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.134.221.88.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    45.179.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    45.179.17.96.in-addr.arpa
    IN PTR
    Response
    45.179.17.96.in-addr.arpa
    IN PTR
    a96-17-179-45deploystaticakamaitechnologiescom
  • flag-us
    DNS
    45.179.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    45.179.17.96.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    48.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    48.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    48.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    48.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    55.179.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    55.179.17.96.in-addr.arpa
    IN PTR
    Response
    55.179.17.96.in-addr.arpa
    IN PTR
    a96-17-179-55deploystaticakamaitechnologiescom
  • flag-us
    DNS
    55.179.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    55.179.17.96.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    55.179.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    55.179.17.96.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    dual-a-0001.a-msedge.net
    dual-a-0001.a-msedge.net
    IN A
    204.79.197.200
    dual-a-0001.a-msedge.net
    IN A
    13.107.21.200
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317300991_1FMEZ62360OCLMCN3&pid=21.2&w=1920&h=1080&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317300991_1FMEZ62360OCLMCN3&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 265850
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: E567CDCD01354C9D88F5DBB24B196010 Ref B: LON04EDGE0816 Ref C: 2024-01-06T22:18:16Z
    date: Sat, 06 Jan 2024 22:18:15 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301242_1SRW05UUR0YI3F1X9&pid=21.2&w=1920&h=1080&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301242_1SRW05UUR0YI3F1X9&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 244362
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 35929D982F3E4B83966B463B92B397BF Ref B: LON04EDGE0816 Ref C: 2024-01-06T22:18:16Z
    date: Sat, 06 Jan 2024 22:18:15 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301651_1F1H60KU4IQQHGWIG&pid=21.2&w=1080&h=1920&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301651_1F1H60KU4IQQHGWIG&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 433791
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 3858C3E115194A1EB4B4D86057CFCD79 Ref B: LON04EDGE0816 Ref C: 2024-01-06T22:18:16Z
    date: Sat, 06 Jan 2024 22:18:15 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301424_1QV7T9E0YAU5JUTLU&pid=21.2&w=1080&h=1920&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301424_1QV7T9E0YAU5JUTLU&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 448456
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: FE931663605E45599496FEE1B4CECC46 Ref B: LON04EDGE0816 Ref C: 2024-01-06T22:18:16Z
    date: Sat, 06 Jan 2024 22:18:15 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301218_1B7RSJ3ZTR7CQSX5W&pid=21.2&w=1920&h=1080&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301218_1B7RSJ3ZTR7CQSX5W&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 570479
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: E3B82D7C6420431496DF7A8318277C3C Ref B: LON04EDGE0816 Ref C: 2024-01-06T22:18:16Z
    date: Sat, 06 Jan 2024 22:18:16 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301627_1W86XP38C3HTKT30H&pid=21.2&w=1080&h=1920&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301627_1W86XP38C3HTKT30H&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 518294
    content-type: image/jpeg
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: C230F13496924B6CA132F779CB4E4FD9 Ref B: LON04EDGE0816 Ref C: 2024-01-06T22:18:20Z
    date: Sat, 06 Jan 2024 22:18:20 GMT
  • flag-us
    DNS
    27.178.89.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    27.178.89.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    27.178.89.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    27.178.89.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    0.205.248.87.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.205.248.87.in-addr.arpa
    IN PTR
    Response
    0.205.248.87.in-addr.arpa
    IN PTR
    https-87-248-205-0lgwllnwnet
  • flag-us
    DNS
    0.205.248.87.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.205.248.87.in-addr.arpa
    IN PTR
  • 206.132.28.42:80
    www.rsvme.com
    IEXPLORE.EXE
    156 B
     3
  • 206.132.28.42:80
    www.rsvme.com
    IEXPLORE.EXE
    156 B
     3
  • 206.132.28.42:80
    www.rsvme.com
    IEXPLORE.EXE
    156 B
     3
  • 206.132.28.42:80
    www.rsvme.com
    IEXPLORE.EXE
    156 B
     3
  • 206.132.28.42:80
    www.rsvme.com
    IEXPLORE.EXE
    156 B
     3
  • 206.132.28.42:80
    www.rsvme.com
    IEXPLORE.EXE
    156 B
     3
  • 206.132.28.42:80
    www.rsvme.com
    IEXPLORE.EXE
    156 B
     3
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls, http2
    iexplore.exe
    1.3kB
     8.3kB
     18
    15
  • 92.123.128.142:443
    www.bing.com
    tls, http2
    iexplore.exe
    1.2kB
     4.9kB
     15
    13
  • 92.123.128.142:443
    https://www.bing.com/favicon.ico
    tls, http2
    iexplore.exe
    1.6kB
     10.1kB
     22
    20

    HTTP Request

    GET https://www.bing.com/favicon.ico

    HTTP Response

    200
  • 206.132.28.42:80
    www.rsvme.com
    IEXPLORE.EXE
    156 B
     3
  • 206.132.28.42:80
    www.rsvme.com
    IEXPLORE.EXE
    156 B
     3
  • 206.132.28.42:80
    www.rsvme.com
    IEXPLORE.EXE
    156 B
     3
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.5kB
     8.2kB
     18
    13
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.5kB
     8.2kB
     18
    13
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.7kB
     8.4kB
     20
    15
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.8kB
     8.7kB
     20
    15
  • 204.79.197.200:443
    https://tse1.mm.bing.net/th?id=OADD2.10239317301627_1W86XP38C3HTKT30H&pid=21.2&w=1080&h=1920&c=4
    tls, http2
    93.3kB
     2.6MB
     1909
    1901

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317300991_1FMEZ62360OCLMCN3&pid=21.2&w=1920&h=1080&c=4

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301242_1SRW05UUR0YI3F1X9&pid=21.2&w=1920&h=1080&c=4

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301651_1F1H60KU4IQQHGWIG&pid=21.2&w=1080&h=1920&c=4

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301424_1QV7T9E0YAU5JUTLU&pid=21.2&w=1080&h=1920&c=4

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301218_1B7RSJ3ZTR7CQSX5W&pid=21.2&w=1920&h=1080&c=4

    HTTP Response

    200

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301627_1W86XP38C3HTKT30H&pid=21.2&w=1080&h=1920&c=4

    HTTP Response

    200

    HTTP Response

    200
  • 87.248.205.0:80
  • 8.8.8.8:53
    www.rsvme.com
    dns
    IEXPLORE.EXE
    59 B
     89 B
     1
    1

    DNS Request

    www.rsvme.com

    DNS Response

    206.132.28.42

  • 8.8.8.8:53
    zagevqsoii.biz
    dns
    IEXPLORE.EXE
    60 B
     122 B
     1
    1

    DNS Request

    zagevqsoii.biz

  • 8.8.8.8:53
    208.194.73.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    208.194.73.20.in-addr.arpa

  • 8.8.8.8:53
    49.179.17.96.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    49.179.17.96.in-addr.arpa

  • 8.8.8.8:53
    4.159.190.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    4.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    292 B
     144 B
     4
    1

    DNS Request

    95.221.229.192.in-addr.arpa

    DNS Request

    95.221.229.192.in-addr.arpa

    DNS Request

    95.221.229.192.in-addr.arpa

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    241.154.82.20.in-addr.arpa
    dns
    216 B
     158 B
     3
    1

    DNS Request

    241.154.82.20.in-addr.arpa

    DNS Request

    241.154.82.20.in-addr.arpa

    DNS Request

    241.154.82.20.in-addr.arpa

  • 8.8.8.8:53
    114.110.16.96.in-addr.arpa
    dns
    144 B
     137 B
     2
    1

    DNS Request

    114.110.16.96.in-addr.arpa

    DNS Request

    114.110.16.96.in-addr.arpa

  • 8.8.8.8:53
    43.58.199.20.in-addr.arpa
    dns
    142 B
     157 B
     2
    1

    DNS Request

    43.58.199.20.in-addr.arpa

    DNS Request

    43.58.199.20.in-addr.arpa

  • 8.8.8.8:53
    183.59.114.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    183.59.114.20.in-addr.arpa

  • 8.8.8.8:53
    200.197.79.204.in-addr.arpa
    dns
    73 B
     106 B
     1
    1

    DNS Request

    200.197.79.204.in-addr.arpa

  • 8.8.8.8:53
    2.136.104.51.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    2.136.104.51.in-addr.arpa

  • 8.8.8.8:53
    142.128.123.92.in-addr.arpa
    dns
    73 B
     139 B
     1
    1

    DNS Request

    142.128.123.92.in-addr.arpa

  • 8.8.8.8:53
    41.110.16.96.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    41.110.16.96.in-addr.arpa

  • 8.8.8.8:53
    198.187.3.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    198.187.3.20.in-addr.arpa

  • 8.8.8.8:53
    161.19.199.152.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    161.19.199.152.in-addr.arpa

  • 8.8.8.8:53
    183.1.37.23.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    183.1.37.23.in-addr.arpa

  • 8.8.8.8:53
    217.135.221.88.in-addr.arpa
    dns
    73 B
     139 B
     1
    1

    DNS Request

    217.135.221.88.in-addr.arpa

  • 8.8.8.8:53
    119.110.54.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    119.110.54.20.in-addr.arpa

  • 8.8.8.8:53
    68.179.17.96.in-addr.arpa
    dns
    284 B
     135 B
     4
    1

    DNS Request

    68.179.17.96.in-addr.arpa

    DNS Request

    68.179.17.96.in-addr.arpa

    DNS Request

    68.179.17.96.in-addr.arpa

    DNS Request

    68.179.17.96.in-addr.arpa

  • 8.8.8.8:53
    32.134.221.88.in-addr.arpa
    dns
    216 B
     137 B
     3
    1

    DNS Request

    32.134.221.88.in-addr.arpa

    DNS Request

    32.134.221.88.in-addr.arpa

    DNS Request

    32.134.221.88.in-addr.arpa

  • 8.8.8.8:53
    18.134.221.88.in-addr.arpa
    dns
    144 B
     137 B
     2
    1

    DNS Request

    18.134.221.88.in-addr.arpa

    DNS Request

    18.134.221.88.in-addr.arpa

  • 8.8.8.8:53
    45.179.17.96.in-addr.arpa
    dns
    142 B
     135 B
     2
    1

    DNS Request

    45.179.17.96.in-addr.arpa

    DNS Request

    45.179.17.96.in-addr.arpa

  • 8.8.8.8:53
    48.229.111.52.in-addr.arpa
    dns
    144 B
     316 B
     2
    2

    DNS Request

    48.229.111.52.in-addr.arpa

    DNS Request

    48.229.111.52.in-addr.arpa

  • 8.8.8.8:53
    55.179.17.96.in-addr.arpa
    dns
    213 B
     135 B
     3
    1

    DNS Request

    55.179.17.96.in-addr.arpa

    DNS Request

    55.179.17.96.in-addr.arpa

    DNS Request

    55.179.17.96.in-addr.arpa

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    124 B
     173 B
     2
    1

    DNS Request

    tse1.mm.bing.net

    DNS Request

    tse1.mm.bing.net

    DNS Response

    204.79.197.200
    13.107.21.200

  • 8.8.8.8:53
    27.178.89.13.in-addr.arpa
    dns
    142 B
     290 B
     2
    2

    DNS Request

    27.178.89.13.in-addr.arpa

    DNS Request

    27.178.89.13.in-addr.arpa

  • 8.8.8.8:53
    0.205.248.87.in-addr.arpa
    dns
    142 B
     116 B
     2
    1

    DNS Request

    0.205.248.87.in-addr.arpa

    DNS Request

    0.205.248.87.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
    Filesize

    4KB

    MD5

    da597791be3b6e732f0bc8b20e38ee62

    SHA1

    1125c45d285c360542027d7554a5c442288974de

    SHA256

    5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

    SHA512

    d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verCCB6.tmp
    Filesize

    15KB

    MD5

    1a545d0052b581fbb2ab4c52133846bc

    SHA1

    62f3266a9b9925cd6d98658b92adec673cbe3dd3

    SHA256

    557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

    SHA512

    bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8D1Z5HG5\suggestions[1].en-US
    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.