Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

007f485b70...18.exe

windows7-x64

10

007f485b70...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/04/2024, 09:44 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    007f485b70277dc3d8a978edfd561241_JaffaCakes118.exe

  • Size

    5.5MB

  • MD5

    007f485b70277dc3d8a978edfd561241

  • SHA1

    462d813115a1435ab9235ad4f02d1df2660ab847

  • SHA256

    330721800674398e1a450deb059418e7dd7758eec2aeccfa1fe054eeb0850e4a

  • SHA512

    3b8139a4375561d8979e2aa25b4fc21eedea74f909e0909c38647d4ca84d15e8ee435377f1714f910914107306da9c9adc0e6316d287ed3808796ab3dec59e28

  • SSDEEP

    98304:OoskEEoskE0oskEeoskEkoskEWoskE4oskE0oskEYoskEC:X

Score
10/10
evasionpersistenceransomwaretrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 12 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 6 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 6 IoCs
    evasion
  • UAC bypass 3 TTPs 6 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 6 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Drops file in Drivers directory 24 IoCs
  • Sets file execution options in registry 2 TTPs 64 IoCs
    persistence
  • Executes dropped EXE 30 IoCs
  • Loads dropped DLL 18 IoCs
  • Adds Run key to start application 2 TTPs 24 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 6 IoCs
    evasiontrojan
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 64 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 39 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 6 IoCs
    ransomware
  • Drops file in Windows directory 64 IoCs
  • Modifies Control Panel 64 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 12 IoCs
    adwarespyware
  • Modifies registry class 51 IoCs
  • Runs ping.exe 1 TTPs 34 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 31 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 12 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\007f485b70277dc3d8a978edfd561241_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\007f485b70277dc3d8a978edfd561241_JaffaCakes118.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • UAC bypass
    • Disables RegEdit via registry modification
    • Drops file in Drivers directory
    • Sets file execution options in registry
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Drops file in Windows directory
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:3892
    • C:\Windows\Fonts\Admin 26 - 4 - 2024\smss.exe
      "C:\Windows\Fonts\Admin 26 - 4 - 2024\smss.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • UAC bypass
      • Disables RegEdit via registry modification
      • Drops file in Drivers directory
      • Sets file execution options in registry
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • Drops autorun.inf file
      • Drops file in System32 directory
      • Sets desktop wallpaper using registry
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1676
      • C:\Windows\Fonts\Admin 26 - 4 - 2024\smss.exe
        "C:\Windows\Fonts\Admin 26 - 4 - 2024\smss.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:4732
      • C:\Windows\Fonts\Admin 26 - 4 - 2024\Gaara.exe
        "C:\Windows\Fonts\Admin 26 - 4 - 2024\Gaara.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • UAC bypass
        • Disables RegEdit via registry modification
        • Drops file in Drivers directory
        • Sets file execution options in registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops desktop.ini file(s)
        • Enumerates connected drives
        • Drops autorun.inf file
        • Drops file in System32 directory
        • Sets desktop wallpaper using registry
        • Drops file in Windows directory
        • Modifies Control Panel
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:2008
        • C:\Windows\Fonts\Admin 26 - 4 - 2024\smss.exe
          "C:\Windows\Fonts\Admin 26 - 4 - 2024\smss.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:3856
        • C:\Windows\Fonts\Admin 26 - 4 - 2024\Gaara.exe
          "C:\Windows\Fonts\Admin 26 - 4 - 2024\Gaara.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:4812
        • C:\Windows\Fonts\Admin 26 - 4 - 2024\csrss.exe
          "C:\Windows\Fonts\Admin 26 - 4 - 2024\csrss.exe"
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visibility of file extensions in Explorer
          • Modifies visiblity of hidden/system files in Explorer
          • UAC bypass
          • Disables RegEdit via registry modification
          • Drops file in Drivers directory
          • Sets file execution options in registry
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Checks whether UAC is enabled
          • Drops desktop.ini file(s)
          • Enumerates connected drives
          • Drops autorun.inf file
          • Drops file in System32 directory
          • Sets desktop wallpaper using registry
          • Drops file in Windows directory
          • Modifies Control Panel
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:4316
          • C:\Windows\Fonts\Admin 26 - 4 - 2024\smss.exe
            "C:\Windows\Fonts\Admin 26 - 4 - 2024\smss.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            PID:5096
          • C:\Windows\Fonts\Admin 26 - 4 - 2024\Gaara.exe
            "C:\Windows\Fonts\Admin 26 - 4 - 2024\Gaara.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            PID:3844
          • C:\Windows\Fonts\Admin 26 - 4 - 2024\csrss.exe
            "C:\Windows\Fonts\Admin 26 - 4 - 2024\csrss.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            PID:5052
          • C:\Windows\SysWOW64\drivers\Kazekage.exe
            C:\Windows\system32\drivers\Kazekage.exe
            5⤵
            • Modifies WinLogon for persistence
            • Modifies visibility of file extensions in Explorer
            • Modifies visiblity of hidden/system files in Explorer
            • UAC bypass
            • Disables RegEdit via registry modification
            • Drops file in Drivers directory
            • Sets file execution options in registry
            • Executes dropped EXE
            • Adds Run key to start application
            • Checks whether UAC is enabled
            • Drops desktop.ini file(s)
            • Enumerates connected drives
            • Drops autorun.inf file
            • Drops file in System32 directory
            • Sets desktop wallpaper using registry
            • Drops file in Windows directory
            • Modifies Control Panel
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:3232
            • C:\Windows\Fonts\Admin 26 - 4 - 2024\smss.exe
              "C:\Windows\Fonts\Admin 26 - 4 - 2024\smss.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:1696
            • C:\Windows\Fonts\Admin 26 - 4 - 2024\Gaara.exe
              "C:\Windows\Fonts\Admin 26 - 4 - 2024\Gaara.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:856
            • C:\Windows\Fonts\Admin 26 - 4 - 2024\csrss.exe
              "C:\Windows\Fonts\Admin 26 - 4 - 2024\csrss.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              PID:2524
            • C:\Windows\SysWOW64\drivers\Kazekage.exe
              C:\Windows\system32\drivers\Kazekage.exe
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:1928
            • C:\Windows\SysWOW64\drivers\system32.exe
              C:\Windows\system32\drivers\system32.exe
              6⤵
              • Modifies WinLogon for persistence
              • Modifies visibility of file extensions in Explorer
              • Modifies visiblity of hidden/system files in Explorer
              • UAC bypass
              • Disables RegEdit via registry modification
              • Drops file in Drivers directory
              • Sets file execution options in registry
              • Executes dropped EXE
              • Adds Run key to start application
              • Checks whether UAC is enabled
              • Drops desktop.ini file(s)
              • Enumerates connected drives
              • Drops autorun.inf file
              • Drops file in System32 directory
              • Sets desktop wallpaper using registry
              • Drops file in Windows directory
              • Modifies Control Panel
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:4032
              • C:\Windows\Fonts\Admin 26 - 4 - 2024\smss.exe
                "C:\Windows\Fonts\Admin 26 - 4 - 2024\smss.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:1388
              • C:\Windows\Fonts\Admin 26 - 4 - 2024\Gaara.exe
                "C:\Windows\Fonts\Admin 26 - 4 - 2024\Gaara.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:2840
              • C:\Windows\Fonts\Admin 26 - 4 - 2024\csrss.exe
                "C:\Windows\Fonts\Admin 26 - 4 - 2024\csrss.exe"
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                PID:5040
              • C:\Windows\SysWOW64\drivers\Kazekage.exe
                C:\Windows\system32\drivers\Kazekage.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4772
              • C:\Windows\SysWOW64\drivers\system32.exe
                C:\Windows\system32\drivers\system32.exe
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4676
              • C:\Windows\SysWOW64\ping.exe
                ping -a -l www.rasasayang.com.my 65500
                7⤵
                • Runs ping.exe
                PID:876
              • C:\Windows\SysWOW64\ping.exe
                ping -a -l www.duniasex.com 65500
                7⤵
                • Runs ping.exe
                PID:1904
              • C:\Windows\SysWOW64\ping.exe
                ping -a -l www.rasasayang.com.my 65500
                7⤵
                • Runs ping.exe
                PID:4112
              • C:\Windows\SysWOW64\ping.exe
                ping -a -l www.duniasex.com 65500
                7⤵
                • Runs ping.exe
                PID:3644
              • C:\Windows\SysWOW64\ping.exe
                ping -a -l www.rasasayang.com.my 65500
                7⤵
                • Runs ping.exe
                PID:3204
              • C:\Windows\SysWOW64\ping.exe
                ping -a -l www.duniasex.com 65500
                7⤵
                • Runs ping.exe
                PID:1612
            • C:\Windows\SysWOW64\ping.exe
              ping -a -l www.rasasayang.com.my 65500
              6⤵
              • Runs ping.exe
              PID:732
            • C:\Windows\SysWOW64\ping.exe
              ping -a -l www.duniasex.com 65500
              6⤵
              • Runs ping.exe
              PID:3388
            • C:\Windows\SysWOW64\ping.exe
              ping -a -l www.rasasayang.com.my 65500
              6⤵
              • Runs ping.exe
              PID:1216
            • C:\Windows\SysWOW64\ping.exe
              ping -a -l www.duniasex.com 65500
              6⤵
              • Runs ping.exe
              PID:2436
            • C:\Windows\SysWOW64\ping.exe
              ping -a -l www.rasasayang.com.my 65500
              6⤵
              • Runs ping.exe
              PID:4848
            • C:\Windows\SysWOW64\ping.exe
              ping -a -l www.duniasex.com 65500
              6⤵
              • Runs ping.exe
              PID:3576
          • C:\Windows\SysWOW64\drivers\system32.exe
            C:\Windows\system32\drivers\system32.exe
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:4144
          • C:\Windows\SysWOW64\ping.exe
            ping -a -l www.rasasayang.com.my 65500
            5⤵
            • Runs ping.exe
            PID:3444
          • C:\Windows\SysWOW64\ping.exe
            ping -a -l www.duniasex.com 65500
            5⤵
            • Runs ping.exe
            PID:4448
          • C:\Windows\SysWOW64\ping.exe
            ping -a -l www.rasasayang.com.my 65500
            5⤵
            • Runs ping.exe
            PID:4916
          • C:\Windows\SysWOW64\ping.exe
            ping -a -l www.duniasex.com 65500
            5⤵
            • Runs ping.exe
            PID:340
          • C:\Windows\SysWOW64\ping.exe
            ping -a -l www.rasasayang.com.my 65500
            5⤵
            • Runs ping.exe
            PID:1528
          • C:\Windows\SysWOW64\ping.exe
            ping -a -l www.duniasex.com 65500
            5⤵
            • Runs ping.exe
            PID:944
        • C:\Windows\SysWOW64\drivers\Kazekage.exe
          C:\Windows\system32\drivers\Kazekage.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:3536
        • C:\Windows\SysWOW64\drivers\system32.exe
          C:\Windows\system32\drivers\system32.exe
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:448
        • C:\Windows\SysWOW64\ping.exe
          ping -a -l www.rasasayang.com.my 65500
          4⤵
          • Runs ping.exe
          PID:4024
        • C:\Windows\SysWOW64\ping.exe
          ping -a -l www.duniasex.com 65500
          4⤵
          • Runs ping.exe
          PID:4044
        • C:\Windows\SysWOW64\ping.exe
          ping -a -l www.rasasayang.com.my 65500
          4⤵
          • Runs ping.exe
          PID:3568
        • C:\Windows\SysWOW64\ping.exe
          ping -a -l www.duniasex.com 65500
          4⤵
          • Runs ping.exe
          PID:3668
        • C:\Windows\SysWOW64\ping.exe
          ping -a -l www.rasasayang.com.my 65500
          4⤵
          • Runs ping.exe
          PID:4648
        • C:\Windows\SysWOW64\ping.exe
          ping -a -l www.duniasex.com 65500
          4⤵
          • Runs ping.exe
          PID:2588
      • C:\Windows\Fonts\Admin 26 - 4 - 2024\csrss.exe
        "C:\Windows\Fonts\Admin 26 - 4 - 2024\csrss.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetWindowsHookEx
        PID:4656
      • C:\Windows\SysWOW64\drivers\Kazekage.exe
        C:\Windows\system32\drivers\Kazekage.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:4528
      • C:\Windows\SysWOW64\drivers\system32.exe
        C:\Windows\system32\drivers\system32.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:2928
      • C:\Windows\SysWOW64\ping.exe
        ping -a -l www.rasasayang.com.my 65500
        3⤵
        • Runs ping.exe
        PID:1088
      • C:\Windows\SysWOW64\ping.exe
        ping -a -l www.duniasex.com 65500
        3⤵
        • Runs ping.exe
        PID:1076
      • C:\Windows\SysWOW64\ping.exe
        ping -a -l www.rasasayang.com.my 65500
        3⤵
        • Runs ping.exe
        PID:1904
      • C:\Windows\SysWOW64\ping.exe
        ping -a -l www.duniasex.com 65500
        3⤵
        • Runs ping.exe
        PID:380
    • C:\Windows\Fonts\Admin 26 - 4 - 2024\Gaara.exe
      "C:\Windows\Fonts\Admin 26 - 4 - 2024\Gaara.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:3952
    • C:\Windows\Fonts\Admin 26 - 4 - 2024\csrss.exe
      "C:\Windows\Fonts\Admin 26 - 4 - 2024\csrss.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:3388
    • C:\Windows\SysWOW64\drivers\Kazekage.exe
      C:\Windows\system32\drivers\Kazekage.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:3856
    • C:\Windows\SysWOW64\drivers\system32.exe
      C:\Windows\system32\drivers\system32.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:2656
    • C:\Windows\SysWOW64\ping.exe
      ping -a -l www.rasasayang.com.my 65500
      2⤵
      • Runs ping.exe
      PID:2624
    • C:\Windows\SysWOW64\ping.exe
      ping -a -l www.duniasex.com 65500
      2⤵
      • Runs ping.exe
      PID:4844
    • C:\Windows\SysWOW64\ping.exe
      ping -a -l www.rasasayang.com.my 65500
      2⤵
      • Runs ping.exe
      PID:5108
    • C:\Windows\SysWOW64\ping.exe
      ping -a -l www.duniasex.com 65500
      2⤵
      • Runs ping.exe
      PID:748
    • C:\Windows\SysWOW64\ping.exe
      ping -a -l www.rasasayang.com.my 65500
      2⤵
      • Runs ping.exe
      PID:640
    • C:\Windows\SysWOW64\ping.exe
      ping -a -l www.duniasex.com 65500
      2⤵
      • Runs ping.exe
      PID:3204
  • C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
    1⤵
      PID:3844

    Network

    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
      Response
      8.8.8.8.in-addr.arpa
      IN PTR
      dnsgoogle
    • flag-us
      DNS
      133.190.18.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      133.190.18.2.in-addr.arpa
      IN PTR
      Response
      133.190.18.2.in-addr.arpa
      IN PTR
      a2-18-190-133deploystaticakamaitechnologiescom
    • flag-us
      DNS
      g.bing.com
      Remote address:
      8.8.8.8:53
      Request
      g.bing.com
      IN A
      Response
      g.bing.com
      IN CNAME
      g-bing-com.dual-a-0034.a-msedge.net
      g-bing-com.dual-a-0034.a-msedge.net
      IN CNAME
      dual-a-0034.a-msedge.net
      dual-a-0034.a-msedge.net
      IN A
      204.79.197.237
      dual-a-0034.a-msedge.net
      IN A
      13.107.21.237
    • flag-us
      GET
      https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=31a598282be04684bffc758e78ea3bc6&localId=w:FEA8F19F-01BE-DA76-49B1-72C0C15A5E1B&deviceId=6825832441142904&anid=
      Remote address:
      204.79.197.237:443
      Request
      GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=31a598282be04684bffc758e78ea3bc6&localId=w:FEA8F19F-01BE-DA76-49B1-72C0C15A5E1B&deviceId=6825832441142904&anid= HTTP/2.0
      host: g.bing.com
      accept-encoding: gzip, deflate
      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
      Response
      HTTP/2.0 204
      cache-control: no-cache, must-revalidate
      pragma: no-cache
      expires: Fri, 01 Jan 1990 00:00:00 GMT
      set-cookie: MUID=3A13FCE5E71067D91013E888E6F0662B; domain=.bing.com; expires=Wed, 21-May-2025 09:44:13 GMT; path=/; SameSite=None; Secure; Priority=High;
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      access-control-allow-origin: *
      x-cache: CONFIG_NOCACHE
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 4AC0FB01FCFD448CAE5311C5A5368519 Ref B: LON04EDGE1222 Ref C: 2024-04-26T09:44:13Z
      date: Fri, 26 Apr 2024 09:44:12 GMT
    • flag-us
      GET
      https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=31a598282be04684bffc758e78ea3bc6&localId=w:FEA8F19F-01BE-DA76-49B1-72C0C15A5E1B&deviceId=6825832441142904&anid=
      Remote address:
      204.79.197.237:443
      Request
      GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=31a598282be04684bffc758e78ea3bc6&localId=w:FEA8F19F-01BE-DA76-49B1-72C0C15A5E1B&deviceId=6825832441142904&anid= HTTP/2.0
      host: g.bing.com
      accept-encoding: gzip, deflate
      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
      cookie: MUID=3A13FCE5E71067D91013E888E6F0662B
      Response
      HTTP/2.0 204
      cache-control: no-cache, must-revalidate
      pragma: no-cache
      expires: Fri, 01 Jan 1990 00:00:00 GMT
      set-cookie: MSPTC=j92Tk40R9XXE0iC50-9RwzcdWP5M1wl5qxo94EmaDYI; domain=.bing.com; expires=Wed, 21-May-2025 09:44:13 GMT; path=/; Partitioned; secure; SameSite=None
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      access-control-allow-origin: *
      x-cache: CONFIG_NOCACHE
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 03CAC871D1DF4A72BD17DB76F13B2B8B Ref B: LON04EDGE1222 Ref C: 2024-04-26T09:44:13Z
      date: Fri, 26 Apr 2024 09:44:13 GMT
    • flag-us
      GET
      https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=31a598282be04684bffc758e78ea3bc6&localId=w:FEA8F19F-01BE-DA76-49B1-72C0C15A5E1B&deviceId=6825832441142904&anid=
      Remote address:
      204.79.197.237:443
      Request
      GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=31a598282be04684bffc758e78ea3bc6&localId=w:FEA8F19F-01BE-DA76-49B1-72C0C15A5E1B&deviceId=6825832441142904&anid= HTTP/2.0
      host: g.bing.com
      accept-encoding: gzip, deflate
      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
      cookie: MUID=3A13FCE5E71067D91013E888E6F0662B; MSPTC=j92Tk40R9XXE0iC50-9RwzcdWP5M1wl5qxo94EmaDYI
      Response
      HTTP/2.0 204
      cache-control: no-cache, must-revalidate
      pragma: no-cache
      expires: Fri, 01 Jan 1990 00:00:00 GMT
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      access-control-allow-origin: *
      x-cache: CONFIG_NOCACHE
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: FAACEA7DC1B74446B5FED6019A06670A Ref B: LON04EDGE1222 Ref C: 2024-04-26T09:44:13Z
      date: Fri, 26 Apr 2024 09:44:13 GMT
    • flag-us
      DNS
      9.228.82.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      9.228.82.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      154.239.44.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      154.239.44.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      237.197.79.204.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      237.197.79.204.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      206.221.208.4.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      206.221.208.4.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      21.114.53.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      21.114.53.23.in-addr.arpa
      IN PTR
      Response
      21.114.53.23.in-addr.arpa
      IN PTR
      a23-53-114-21deploystaticakamaitechnologiescom
    • flag-us
      DNS
      26.165.165.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      26.165.165.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      57.169.31.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      57.169.31.20.in-addr.arpa
      IN PTR
      Response
    • flag-nl
      GET
      https://www.bing.com/th?id=OADD2.10239381793954_1BHQ1BWFG78XLZOQQ&pid=21.2&c=16&roil=0.0049&roit=0&roir=0.9951&roib=1&w=24&h=24&dynsize=1&qlt=90
      Remote address:
      23.62.61.194:443
      Request
      GET /th?id=OADD2.10239381793954_1BHQ1BWFG78XLZOQQ&pid=21.2&c=16&roil=0.0049&roit=0&roir=0.9951&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
      host: www.bing.com
      accept: */*
      cookie: MUID=3A13FCE5E71067D91013E888E6F0662B; MSPTC=j92Tk40R9XXE0iC50-9RwzcdWP5M1wl5qxo94EmaDYI
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-type: image/png
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      content-length: 1299
      date: Fri, 26 Apr 2024 09:44:26 GMT
      alt-svc: h3=":443"; ma=93600
      x-cdn-traceid: 0.be3d3e17.1714124666.a59e97e
    • flag-us
      DNS
      194.61.62.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      194.61.62.23.in-addr.arpa
      IN PTR
      Response
      194.61.62.23.in-addr.arpa
      IN PTR
      a23-62-61-194deploystaticakamaitechnologiescom
    • flag-us
      DNS
      196.249.167.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      196.249.167.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      18.31.95.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      18.31.95.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      153.97.55.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      153.97.55.23.in-addr.arpa
      IN PTR
      Response
      153.97.55.23.in-addr.arpa
      IN PTR
      a23-55-97-153deploystaticakamaitechnologiescom
    • flag-us
      DNS
      119.110.54.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      119.110.54.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      119.110.54.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      119.110.54.20.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      119.110.54.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      119.110.54.20.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      15.164.165.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      15.164.165.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      65.139.73.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      65.139.73.23.in-addr.arpa
      IN PTR
      Response
      65.139.73.23.in-addr.arpa
      IN PTR
      a23-73-139-65deploystaticakamaitechnologiescom
    • flag-us
      DNS
      65.139.73.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      65.139.73.23.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      147.190.18.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      147.190.18.2.in-addr.arpa
      IN PTR
      Response
      147.190.18.2.in-addr.arpa
      IN PTR
      a2-18-190-147deploystaticakamaitechnologiescom
    • flag-us
      DNS
      147.190.18.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      147.190.18.2.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      220.255.0.0.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      220.255.0.0.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      220.255.0.0.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      220.255.0.0.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.210.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.210.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      14.251.17.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      14.251.17.2.in-addr.arpa
      IN PTR
      Response
      14.251.17.2.in-addr.arpa
      IN PTR
      a2-17-251-14deploystaticakamaitechnologiescom
    • flag-us
      DNS
      220.255.0.0.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      220.255.0.0.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      220.255.0.0.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      220.255.0.0.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      21.236.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      21.236.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      tse1.mm.bing.net
      Remote address:
      8.8.8.8:53
      Request
      tse1.mm.bing.net
      IN A
      Response
      tse1.mm.bing.net
      IN CNAME
      mm-mm.bing.net.trafficmanager.net
      mm-mm.bing.net.trafficmanager.net
      IN CNAME
      dual-a-0001.a-msedge.net
      dual-a-0001.a-msedge.net
      IN A
      204.79.197.200
      dual-a-0001.a-msedge.net
      IN A
      13.107.21.200
    • flag-us
      DNS
      tse1.mm.bing.net
      Remote address:
      8.8.8.8:53
      Request
      tse1.mm.bing.net
      IN A
      Response
      tse1.mm.bing.net
      IN CNAME
      mm-mm.bing.net.trafficmanager.net
      mm-mm.bing.net.trafficmanager.net
      IN CNAME
      dual-a-0001.a-msedge.net
      dual-a-0001.a-msedge.net
      IN A
      204.79.197.200
      dual-a-0001.a-msedge.net
      IN A
      13.107.21.200
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239340783932_1JCHO8JLBZ4TPAX49&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239340783932_1JCHO8JLBZ4TPAX49&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 638730
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 7729098E4D9D4C47A5EFAD58CA40D2D7 Ref B: LON04EDGE1211 Ref C: 2024-04-26T09:45:50Z
      date: Fri, 26 Apr 2024 09:45:50 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239340783933_1QOIM48UV8MGOV4SU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239340783933_1QOIM48UV8MGOV4SU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 430689
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 56718438A7B248DC88F4F676B0E37FF2 Ref B: LON04EDGE1211 Ref C: 2024-04-26T09:45:50Z
      date: Fri, 26 Apr 2024 09:45:50 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239360931610_110BPTPDN41GIXK2B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239360931610_110BPTPDN41GIXK2B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 555746
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 1436594069124DA89600170F01446C06 Ref B: LON04EDGE1211 Ref C: 2024-04-26T09:45:50Z
      date: Fri, 26 Apr 2024 09:45:50 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239360931609_1JAA48IJSET6WWQHH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239360931609_1JAA48IJSET6WWQHH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 415458
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: ECC4A7F3EC8D4814B4F5BF1080BF4241 Ref B: LON04EDGE1211 Ref C: 2024-04-26T09:45:50Z
      date: Fri, 26 Apr 2024 09:45:50 GMT
    • flag-us
      DNS
      88.156.103.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      88.156.103.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      88.156.103.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      88.156.103.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      220.255.0.0.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      220.255.0.0.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      220.255.0.0.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      220.255.0.0.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      220.255.0.0.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      220.255.0.0.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      220.255.0.0.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      220.255.0.0.in-addr.arpa
      IN PTR
      Response
    • 204.79.197.237:443
      https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=31a598282be04684bffc758e78ea3bc6&localId=w:FEA8F19F-01BE-DA76-49B1-72C0C15A5E1B&deviceId=6825832441142904&anid=
      tls, http2
      2.0kB
       9.3kB
       22
      17

      HTTP Request

      GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=31a598282be04684bffc758e78ea3bc6&localId=w:FEA8F19F-01BE-DA76-49B1-72C0C15A5E1B&deviceId=6825832441142904&anid=

      HTTP Response

      204

      HTTP Request

      GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=31a598282be04684bffc758e78ea3bc6&localId=w:FEA8F19F-01BE-DA76-49B1-72C0C15A5E1B&deviceId=6825832441142904&anid=

      HTTP Response

      204

      HTTP Request

      GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=31a598282be04684bffc758e78ea3bc6&localId=w:FEA8F19F-01BE-DA76-49B1-72C0C15A5E1B&deviceId=6825832441142904&anid=

      HTTP Response

      204
    • 23.62.61.194:443
      https://www.bing.com/th?id=OADD2.10239381793954_1BHQ1BWFG78XLZOQQ&pid=21.2&c=16&roil=0.0049&roit=0&roir=0.9951&roib=1&w=24&h=24&dynsize=1&qlt=90
      tls, http2
      1.6kB
       7.9kB
       18
      13

      HTTP Request

      GET https://www.bing.com/th?id=OADD2.10239381793954_1BHQ1BWFG78XLZOQQ&pid=21.2&c=16&roil=0.0049&roit=0&roir=0.9951&roib=1&w=24&h=24&dynsize=1&qlt=90

      HTTP Response

      200
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls, http2
      1.7kB
       8.0kB
       17
      11
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls, http2
      1.2kB
       8.1kB
       16
      14
    • 204.79.197.200:443
      https://tse1.mm.bing.net/th?id=OADD2.10239360931609_1JAA48IJSET6WWQHH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
      tls, http2
      75.0kB
       2.1MB
       1560
      1551

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239340783932_1JCHO8JLBZ4TPAX49&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239340783933_1QOIM48UV8MGOV4SU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239360931610_110BPTPDN41GIXK2B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239360931609_1JAA48IJSET6WWQHH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

      HTTP Response

      200

      HTTP Response

      200

      HTTP Response

      200

      HTTP Response

      200
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls, http2
      1.7kB
       8.0kB
       17
      11
    • 8.8.8.8:53
      8.8.8.8.in-addr.arpa
      dns
      66 B
       90 B
       1
      1

      DNS Request

      8.8.8.8.in-addr.arpa

    • 8.8.8.8:53
      133.190.18.2.in-addr.arpa
      dns
      71 B
       135 B
       1
      1

      DNS Request

      133.190.18.2.in-addr.arpa

    • 8.8.8.8:53
      g.bing.com
      dns
      56 B
       151 B
       1
      1

      DNS Request

      g.bing.com

      DNS Response

      204.79.197.237
      13.107.21.237

    • 8.8.8.8:53
      9.228.82.20.in-addr.arpa
      dns
      70 B
       156 B
       1
      1

      DNS Request

      9.228.82.20.in-addr.arpa

    • 8.8.8.8:53
      154.239.44.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      154.239.44.20.in-addr.arpa

    • 8.8.8.8:53
      237.197.79.204.in-addr.arpa
      dns
      73 B
       143 B
       1
      1

      DNS Request

      237.197.79.204.in-addr.arpa

    • 8.8.8.8:53
      206.221.208.4.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      206.221.208.4.in-addr.arpa

    • 8.8.8.8:53
      21.114.53.23.in-addr.arpa
      dns
      71 B
       135 B
       1
      1

      DNS Request

      21.114.53.23.in-addr.arpa

    • 8.8.8.8:53
      26.165.165.52.in-addr.arpa
      dns
      72 B
       146 B
       1
      1

      DNS Request

      26.165.165.52.in-addr.arpa

    • 8.8.8.8:53
      57.169.31.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      57.169.31.20.in-addr.arpa

    • 8.8.8.8:53
      194.61.62.23.in-addr.arpa
      dns
      71 B
       135 B
       1
      1

      DNS Request

      194.61.62.23.in-addr.arpa

    • 8.8.8.8:53
      196.249.167.52.in-addr.arpa
      dns
      73 B
       147 B
       1
      1

      DNS Request

      196.249.167.52.in-addr.arpa

    • 8.8.8.8:53
      18.31.95.13.in-addr.arpa
      dns
      70 B
       144 B
       1
      1

      DNS Request

      18.31.95.13.in-addr.arpa

    • 8.8.8.8:53
      153.97.55.23.in-addr.arpa
      dns
      71 B
       135 B
       1
      1

      DNS Request

      153.97.55.23.in-addr.arpa

    • 8.8.8.8:53
      119.110.54.20.in-addr.arpa
      dns
      216 B
       158 B
       3
      1

      DNS Request

      119.110.54.20.in-addr.arpa

      DNS Request

      119.110.54.20.in-addr.arpa

      DNS Request

      119.110.54.20.in-addr.arpa

    • 8.8.8.8:53
      15.164.165.52.in-addr.arpa
      dns
      72 B
       146 B
       1
      1

      DNS Request

      15.164.165.52.in-addr.arpa

    • 8.8.8.8:53
      65.139.73.23.in-addr.arpa
      dns
      142 B
       135 B
       2
      1

      DNS Request

      65.139.73.23.in-addr.arpa

      DNS Request

      65.139.73.23.in-addr.arpa

    • 8.8.8.8:53
      147.190.18.2.in-addr.arpa
      dns
      142 B
       135 B
       2
      1

      DNS Request

      147.190.18.2.in-addr.arpa

      DNS Request

      147.190.18.2.in-addr.arpa

    • 8.8.8.8:53
      220.255.0.0.in-addr.arpa
      dns
      70 B
       138 B
       1
      1

      DNS Request

      220.255.0.0.in-addr.arpa

    • 8.8.8.8:53
      220.255.0.0.in-addr.arpa
      dns
      70 B
       138 B
       1
      1

      DNS Request

      220.255.0.0.in-addr.arpa

    • 8.8.8.8:53
      172.210.232.199.in-addr.arpa
      dns
      74 B
       128 B
       1
      1

      DNS Request

      172.210.232.199.in-addr.arpa

    • 8.8.8.8:53
      14.251.17.2.in-addr.arpa
      dns
      70 B
       133 B
       1
      1

      DNS Request

      14.251.17.2.in-addr.arpa

    • 8.8.8.8:53
      220.255.0.0.in-addr.arpa
      dns
      140 B
       138 B
       2
      1

      DNS Request

      220.255.0.0.in-addr.arpa

      DNS Request

      220.255.0.0.in-addr.arpa

    • 8.8.8.8:53
      21.236.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      21.236.111.52.in-addr.arpa

    • 8.8.8.8:53
      tse1.mm.bing.net
      dns
      124 B
       346 B
       2
      2

      DNS Request

      tse1.mm.bing.net

      DNS Request

      tse1.mm.bing.net

      DNS Response

      204.79.197.200
      13.107.21.200

      DNS Response

      204.79.197.200
      13.107.21.200

    • 8.8.8.8:53
      88.156.103.20.in-addr.arpa
      dns
      144 B
       316 B
       2
      2

      DNS Request

      88.156.103.20.in-addr.arpa

      DNS Request

      88.156.103.20.in-addr.arpa

    • 8.8.8.8:53
      220.255.0.0.in-addr.arpa
      dns
      140 B
       276 B
       2
      2

      DNS Request

      220.255.0.0.in-addr.arpa

      DNS Request

      220.255.0.0.in-addr.arpa

    • 8.8.8.8:53
      220.255.0.0.in-addr.arpa
      dns
      140 B
       276 B
       2
      2

      DNS Request

      220.255.0.0.in-addr.arpa

      DNS Request

      220.255.0.0.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Replication Through Removable Media

    1
    T1091

    Execution

    Persistence

    Boot or Logon Autostart Execution

    3
    T1547

    Registry Run Keys / Startup Folder

    2
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Privilege Escalation

    Abuse Elevation Control Mechanism

    1
    T1548

    Bypass User Account Control

    1
    T1548.002

    Boot or Logon Autostart Execution

    3
    T1547

    Registry Run Keys / Startup Folder

    2
    T1547.001

    Winlogon Helper DLL

    1
    T1547.004

    Defense Evasion

    Abuse Elevation Control Mechanism

    1
    T1548

    Bypass User Account Control

    1
    T1548.002

    Hide Artifacts

    2
    T1564

    Hidden Files and Directories

    2
    T1564.001

    Impair Defenses

    1
    T1562

    Disable or Modify Tools

    1
    T1562.001

    Modify Registry

    9
    T1112

    Credential Access

    Discovery

    Peripheral Device Discovery

    1
    T1120

    Query Registry

    1
    T1012

    Remote System Discovery

    1
    T1018

    System Information Discovery

    2
    T1082

    Lateral Movement

    Replication Through Removable Media

    1
    T1091

    Collection

    Command and Control

    Exfiltration

    Impact

    Defacement

    1
    T1491

    Inhibit System Recovery

    1
    T1490

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Admin Games\Readme.txt
      Filesize

      736B

      MD5

      bb5d6abdf8d0948ac6895ce7fdfbc151

      SHA1

      9266b7a247a4685892197194d2b9b86c8f6dddbd

      SHA256

      5db2e0915b5464d32e83484f8ae5e3c73d2c78f238fde5f58f9b40dbb5322de8

      SHA512

      878444760e8df878d65bb62b4798177e168eb099def58ad3634f4348e96705c83f74324f9fa358f0eff389991976698a233ca53e9b72034ae11c86d42322a76c

      Download Submit

    • C:\Autorun.inf
      Filesize

      196B

      MD5

      1564dfe69ffed40950e5cb644e0894d1

      SHA1

      201b6f7a01cc49bb698bea6d4945a082ed454ce4

      SHA256

      be114a2dbcc08540b314b01882aa836a772a883322a77b67aab31233e26dc184

      SHA512

      72df187e39674b657974392cfa268e71ef86dc101ebd2303896381ca56d3c05aa9db3f0ab7d0e428d7436e0108c8f19e94c2013814d30b0b95a23a6b9e341097

      Download Submit

    • C:\Windows\Fonts\Admin 26 - 4 - 2024\Gaara.exe
      Filesize

      5.5MB

      MD5

      d15dc02c21c381e5bf360fb07b007771

      SHA1

      e421b671f67bbf98a3f263d4b0aebcf52913d288

      SHA256

      d1fce81166786d47cf8a1a9bcfe0530d0a1f4216df2de0e95b9433cba645da5e

      SHA512

      24223404360077af81d77129d3886cf0fd265aec0854941d0b562ee2df071ef5ef3c67b407fb490ac324a84e99fd53aa1f650754c93690ad291c46b0120974e6

      Download Submit

    • C:\Windows\Fonts\Admin 26 - 4 - 2024\csrss.exe
      Filesize

      5.5MB

      MD5

      8cc926a6c9c6c396247abd3916117841

      SHA1

      f4c8b4a043366884636dac0d14b56d2531f1f2ce

      SHA256

      6386455967bed176030d4e0bd2575363343f8c17a2817195be53bedc612d44d7

      SHA512

      6fabdde87e0120d46b09f418c52969493daadeda935b628322ab3f63e48b6cf99dffd035d9858dbab9b104e281ade887a792ee7cc3b5e339bd8c82cb11d1302b

      Download Submit

    • C:\Windows\Fonts\Admin 26 - 4 - 2024\csrss.exe
      Filesize

      5.5MB

      MD5

      2b9434595587e20b2c4e93b5d4453a13

      SHA1

      7c3fd5b0af424c5a6e14aea22fda4a3e19134eb5

      SHA256

      5d01cca1f9b34f00ea0386d1774e4beb2455541226257517aa388aadcdd7a916

      SHA512

      7a47cde74ef11fc2bdb19983c02360bfa7cfc7632bf11fb9c70f0307957ee580c1f99be023ae43efb0d56a13fb37950f2679d3663256de9435a9fd6b5586bd8d

      Download Submit

    • C:\Windows\Fonts\Admin 26 - 4 - 2024\smss.exe
      Filesize

      5.5MB

      MD5

      4103384af49c7008745a41422138e355

      SHA1

      c4200bb89607fb32efe1b67e70ee9b7cf4985317

      SHA256

      1092c08d6ce0554c760edced6c3a0f271192b447c5810024d07297956ec0cade

      SHA512

      53f088e0dc23d7dd65db92ff85bcce2c86912f130ca7ec438341240691df305c6ebf8f524a8a2acbdcb350b944bcb695cc43193e20b21467f8beb8dc47586156

      Download Submit

    • C:\Windows\Fonts\The Kazekage.jpg
      Filesize

      1.4MB

      MD5

      d6b05020d4a0ec2a3a8b687099e335df

      SHA1

      df239d830ebcd1cde5c68c46a7b76dad49d415f4

      SHA256

      9824b98dab6af65a9e84c2ea40e9df948f9766ce2096e81feecad7db8dd6080a

      SHA512

      78fd360faa4d34f5732056d6e9ad7b9930964441c69cf24535845d397de92179553b9377a25649c01eb5ac7d547c29cc964e69ede7f2af9fc677508a99251fff

      Download Submit

    • C:\Windows\Fonts\The Kazekage.jpg
      Filesize

      1.3MB

      MD5

      d971efdda959b5ec87c6bb6bb2c6f350

      SHA1

      f05962526cb25a1ea5e176265e235443eba4ec70

      SHA256

      9a72d90064de8ee12ca1cd99511f5f682314cb4bde1b2884f6dad6d0c74a252d

      SHA512

      bc78144c2fa562f7b8eab80be69f7ed148d48d600d72d98c018649fb19fceb4600bbae723e5eb36c410026e7940180e2eb2d4715bb660f35e813b4cc257758ef

      Download Submit

    • C:\Windows\SysWOW64\26-4-2024.exe
      Filesize

      5.5MB

      MD5

      007f485b70277dc3d8a978edfd561241

      SHA1

      462d813115a1435ab9235ad4f02d1df2660ab847

      SHA256

      330721800674398e1a450deb059418e7dd7758eec2aeccfa1fe054eeb0850e4a

      SHA512

      3b8139a4375561d8979e2aa25b4fc21eedea74f909e0909c38647d4ca84d15e8ee435377f1714f910914107306da9c9adc0e6316d287ed3808796ab3dec59e28

      Download Submit

    • C:\Windows\SysWOW64\26-4-2024.exe
      Filesize

      3.6MB

      MD5

      bc552a660422bb3904e9d695955aaad3

      SHA1

      95b0d7ad83d8dbbab437bfb93de5ae4a8371c629

      SHA256

      9d2397793f3e5246cca5b9b7b4505b060be47ffaa15bd7e7e2ed467a2745867c

      SHA512

      c36a79165fdb34ea17f942a72164baffccdd637e2a1439e5a9e7d692c763aa2e50a6623c3c641c9b27530846dc5371d0287ae71ec5a9315c0972fb4880aeb658

      Download Submit

    • C:\Windows\SysWOW64\Desktop.ini
      Filesize

      65B

      MD5

      64acfa7e03b01f48294cf30d201a0026

      SHA1

      10facd995b38a095f30b4a800fa454c0bcbf8438

      SHA256

      ba8159d865d106e7b4d0043007a63d1541e1de455dc8d7ff0edd3013bd425c62

      SHA512

      65a9b2e639de74a2a7faa83463a03f5f5b526495e3c793ec1e144c422ed0b842dd304cd5ff4f8aec3d76d826507030c5916f70a231429cea636ec2d8ab43931a

      Download Submit

    • C:\Windows\SysWOW64\drivers\Kazekage.exe
      Filesize

      5.5MB

      MD5

      3e8d0d07c4e6868a9261bf75c8aaffac

      SHA1

      4e3dddd6e458d2c6fad85df7251ba5e7473a9068

      SHA256

      3e09b9eb168262ad90abc1dce9d06848e7804a52f7a1e32be5e5f4b36296d0b4

      SHA512

      17070199f845bc879853dfaeed4afad703bcb2b11e9ab9af8b731012ba7428d89e5d73654b527910c1f57a3eb6f445462afda963050adf3cfbfcf9d6ed7084ec

      Download Submit

    • C:\Windows\SysWOW64\drivers\Kazekage.exe
      Filesize

      4.8MB

      MD5

      8c175b82618202fa6ea58b20063c4e95

      SHA1

      a8daf2417746e8cc8c466e5ba533a2ab0bbc4c8c

      SHA256

      23efe3e7a5d2ac6f03c38a57a84b482dcdc282df5bd5b7145196e46646fd3ebb

      SHA512

      29d771777ffa8b1c1005a00f0f05f6621a4417de2db5611c26d08af8de1d0b105465a39659f157b21eefe62b828627f33d54275e9a41098c79c34156a24abbda

      Download Submit

    • C:\Windows\SysWOW64\drivers\Kazekage.exe
      Filesize

      2.2MB

      MD5

      16cbd7c82be91d7d75f1b517522cdfac

      SHA1

      08606e6499697b67cd891d0f7603fc74e0de682b

      SHA256

      cdd30a9e6500ce294b812572d5dfbf50441e0b7dd8fc398711f89d4092ac8b00

      SHA512

      d8435797ecb0d8d551c18da00b520a57cec836a9a5f2bf1a330660a6168d31615dc0e6b1c106d1145da088d083843be4229ad29236591d74e4f04c275cec3ba9

      Download Submit

    • C:\Windows\SysWOW64\drivers\system32.exe
      Filesize

      5.5MB

      MD5

      29be54f740f6c2eafcd0afb6b723ce00

      SHA1

      eae3255dd335e299a27531e6a0f6f37dd01dc044

      SHA256

      0cc49ab54e944087f9f9849c53d8d8006d65c400d969934a8f810b76050343d8

      SHA512

      229f251bc46484800c2ae88a3c0145f048e3b3ade160253e252e1cb0d8577fc79306789ee9c31eecfa98e2a3a24b95270f8d4ec5847c3d326aada26bd364ad71

      Download Submit

    • C:\Windows\SysWOW64\drivers\system32.exe
      Filesize

      4.5MB

      MD5

      d3181f3e809511b7b5c176286f34592e

      SHA1

      5e32d3feedd482abec04fab2741c6b6c167fa1f5

      SHA256

      2a7eeb90c4b5f4966e56c121000f9d6a88be02454c4c5d05f29f144def114e58

      SHA512

      f3ff6c5f09ac8a968ec34976900695b14515f1fdb8987c101a8d1075a24cc3b9e8b58fa84eff4f003b4fd9a2106924b172847a65ed2403014f5944322b8e5a62

      Download Submit

    • C:\Windows\SysWOW64\drivers\system32.exe
      Filesize

      5.5MB

      MD5

      d2b79d9714eb8d8bcc7b2ebc9efba745

      SHA1

      25fd087dfe0ee55d0a99ab70b15546d2ba5ba77f

      SHA256

      ba18943af192a194f0d24922bf7ea90c9e2b5e043529eec85f4a150ad2c3ac45

      SHA512

      591dd60e5565cf43a8d658d0104770a99b83712ae450c47fb81dda48bec67b60dad775e56272f509179a2ea87e01add5b05325cc2a86f45c3669bed10fc29018

      Download Submit

    • C:\Windows\System\msvbvm60.dll
      Filesize

      1.4MB

      MD5

      25f62c02619174b35851b0e0455b3d94

      SHA1

      4e8ee85157f1769f6e3f61c0acbe59072209da71

      SHA256

      898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

      SHA512

      f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

      Download Submit

    • memory/448-253-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/856-197-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/1388-228-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/1676-939-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/1676-34-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/1696-189-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/1928-204-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/1928-202-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/2008-78-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/2008-940-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/2524-196-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/2656-273-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/2840-231-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/2928-261-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/3232-164-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/3388-267-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/3536-250-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/3844-157-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/3856-270-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/3856-111-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/3892-0-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/3892-938-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/3952-264-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/4032-209-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/4144-247-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/4316-941-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/4316-121-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/4528-258-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/4676-241-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/4676-238-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/4732-75-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/4732-71-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/4772-237-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/4812-117-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/5040-234-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/5052-160-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    • memory/5096-153-0x0000000000400000-0x0000000000424396-memory.dmp

      Filesize

      144KB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.