Analysis
-
max time kernel
1794s -
max time network
1795s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
02/05/2024, 02:08 UTC
General
-
Target
a ton of ya/ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe
-
Size
63KB
-
MD5
222c2d239f4c8a1d73c736c9cc712807
-
SHA1
c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
-
SHA256
ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
-
SHA512
1f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
-
SSDEEP
1536:tJc/5q1qoR5PDdAZcIED4VuCkbFybjQ9f0jQRmONww+W:7c/iqoJekbFEQ9W+mONP+W
Score
10/10
Malware Config
Extracted
Family
xworm
C2
127.0.0.1:23638
209.25.140.1:5525:23638
bring-recorder.gl.at.ply.gg:23638
action-yesterday.gl.at.ply.gg:23638
147.185.221.19:23638
then-wheel.gl.at.ply.gg::23638
then-wheel.gl.at.ply.gg:23638
teen-modes.gl.at.ply.gg:23638
Attributes
-
Install_directory
%LocalAppData%
-
install_file
uwumonster.exe
Signatures
-
Detect Xworm Payload 2 IoCs
-
Xworm
Xworm is a remote access trojan written in C#.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Drops startup file 2 IoCs
-
Executes dropped EXE 30 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 32 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\a ton of ya\ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe"C:\Users\Admin\AppData\Local\Temp\a ton of ya\ya - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy - Copy -.exe"1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "uwumonster" /tr "C:\Users\Admin\AppData\Local\uwumonster.exe"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\uwumonster.exeC:\Users\Admin\AppData\Local\uwumonster.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
-
DNS183.142.211.20.in-addr.arpaRemote address:8.8.8.8:53Request183.142.211.20.in-addr.arpaIN PTRResponse -
DNSg.bing.comRemote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.dual-a-0034.a-msedge.netg-bing-com.dual-a-0034.a-msedge.netIN CNAMEdual-a-0034.a-msedge.netdual-a-0034.a-msedge.netIN A204.79.197.237dual-a-0034.a-msedge.netIN A13.107.21.237
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=3b826b5fcd624711a3f9e5c9bed89359&localId=w:5128B8A4-055F-6043-9311-1EEEFB4045B4&deviceId=6825828473859725&anid=Remote address:204.79.197.237:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=3b826b5fcd624711a3f9e5c9bed89359&localId=w:5128B8A4-055F-6043-9311-1EEEFB4045B4&deviceId=6825828473859725&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
ResponseHTTP/2.0 204
cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=2235B3882BA467E31A47A7FB2A1F667A; domain=.bing.com; expires=Tue, 27-May-2025 07:13:10 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: B667E4D0AEE24591ADCDEE9944B939C2 Ref B: LON04EDGE0821 Ref C: 2024-05-02T07:13:10Z
date: Thu, 02 May 2024 07:13:09 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=3b826b5fcd624711a3f9e5c9bed89359&localId=w:5128B8A4-055F-6043-9311-1EEEFB4045B4&deviceId=6825828473859725&anid=Remote address:204.79.197.237:443RequestGET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=3b826b5fcd624711a3f9e5c9bed89359&localId=w:5128B8A4-055F-6043-9311-1EEEFB4045B4&deviceId=6825828473859725&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=2235B3882BA467E31A47A7FB2A1F667A
ResponseHTTP/2.0 204
cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=scKVkSPAUYTbdStCOgRrjNdoj9e-_8BQV2JjyRXLitY; domain=.bing.com; expires=Tue, 27-May-2025 07:13:10 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: C9E33FEB6AD449DA9855844347E7C06B Ref B: LON04EDGE0821 Ref C: 2024-05-02T07:13:10Z
date: Thu, 02 May 2024 07:13:09 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=3b826b5fcd624711a3f9e5c9bed89359&localId=w:5128B8A4-055F-6043-9311-1EEEFB4045B4&deviceId=6825828473859725&anid=Remote address:204.79.197.237:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=3b826b5fcd624711a3f9e5c9bed89359&localId=w:5128B8A4-055F-6043-9311-1EEEFB4045B4&deviceId=6825828473859725&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=2235B3882BA467E31A47A7FB2A1F667A; MSPTC=scKVkSPAUYTbdStCOgRrjNdoj9e-_8BQV2JjyRXLitY
ResponseHTTP/2.0 204
cache-control: no-cache, must-revalidate
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: C0A7FA6E04CF438E95DBD8C37A9163A2 Ref B: LON04EDGE0821 Ref C: 2024-05-02T07:13:10Z
date: Thu, 02 May 2024 07:13:09 GMT
-
DNS237.197.79.204.in-addr.arpaRemote address:8.8.8.8:53Request237.197.79.204.in-addr.arpaIN PTRResponse
-
DNS79.190.18.2.in-addr.arpaRemote address:8.8.8.8:53Request79.190.18.2.in-addr.arpaIN PTRResponse79.190.18.2.in-addr.arpaIN PTRa2-18-190-79deploystaticakamaitechnologiescom
-
GEThttps://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90Remote address:23.62.61.72:443RequestGET /th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
host: www.bing.com
accept: */*
cookie: MUID=2235B3882BA467E31A47A7FB2A1F667A; MSPTC=scKVkSPAUYTbdStCOgRrjNdoj9e-_8BQV2JjyRXLitY
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-type: image/png
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
content-length: 1107
date: Thu, 02 May 2024 07:13:11 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.443d3e17.1714633991.be16bfe
-
DNS205.47.74.20.in-addr.arpaRemote address:8.8.8.8:53Request205.47.74.20.in-addr.arpaIN PTRResponse
-
DNS205.47.74.20.in-addr.arpaRemote address:8.8.8.8:53Request205.47.74.20.in-addr.arpaIN PTR
-
DNS23.159.190.20.in-addr.arpaRemote address:8.8.8.8:53Request23.159.190.20.in-addr.arpaIN PTRResponse
-
DNS23.159.190.20.in-addr.arpaRemote address:8.8.8.8:53Request23.159.190.20.in-addr.arpaIN PTR
-
DNS72.61.62.23.in-addr.arpaRemote address:8.8.8.8:53Request72.61.62.23.in-addr.arpaIN PTRResponse72.61.62.23.in-addr.arpaIN PTRa23-62-61-72deploystaticakamaitechnologiescom
-
DNS72.61.62.23.in-addr.arpaRemote address:8.8.8.8:53Request72.61.62.23.in-addr.arpaIN PTR
-
DNSbring-recorder.gl.at.ply.ggRemote address:8.8.8.8:53Requestbring-recorder.gl.at.ply.ggIN AResponsebring-recorder.gl.at.ply.ggIN A147.185.221.19
-
DNS26.165.165.52.in-addr.arpaRemote address:8.8.8.8:53Request26.165.165.52.in-addr.arpaIN PTRResponse
-
DNS15.164.165.52.in-addr.arpaRemote address:8.8.8.8:53Request15.164.165.52.in-addr.arpaIN PTRResponse
-
DNS172.210.232.199.in-addr.arpaRemote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
DNSaction-yesterday.gl.at.ply.ggRemote address:8.8.8.8:53Requestaction-yesterday.gl.at.ply.ggIN AResponseaction-yesterday.gl.at.ply.ggIN A147.185.221.19
-
DNS43.58.199.20.in-addr.arpaRemote address:8.8.8.8:53Request43.58.199.20.in-addr.arpaIN PTRResponse
-
DNS34.251.17.2.in-addr.arpaRemote address:8.8.8.8:53Request34.251.17.2.in-addr.arpaIN PTRResponse34.251.17.2.in-addr.arpaIN PTRa2-17-251-34deploystaticakamaitechnologiescom
-
DNSthen-wheel.gl.at.ply.ggRemote address:8.8.8.8:53Requestthen-wheel.gl.at.ply.ggIN AResponsethen-wheel.gl.at.ply.ggIN A147.185.221.19
-
DNS22.236.111.52.in-addr.arpaRemote address:8.8.8.8:53Request22.236.111.52.in-addr.arpaIN PTRResponse
-
DNStse1.mm.bing.netRemote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239370255172_1LGH0N1M3BEVIZPTE&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239370255172_1LGH0N1M3BEVIZPTE&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 565422
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: CBA1CC6E8CC34D0B88DC7B800AEB845C Ref B: LON04EDGE1218 Ref C: 2024-05-02T07:14:49Z
date: Thu, 02 May 2024 07:14:48 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239360313430_12K7UVO7ZVIINTRIE&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239360313430_12K7UVO7ZVIINTRIE&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 442324
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: E69322E416F842F8BE1B8AB0EA665BC4 Ref B: LON04EDGE1218 Ref C: 2024-05-02T07:14:49Z
date: Thu, 02 May 2024 07:14:48 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239370255173_1DU5CK10FBZ5UERKJ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239370255173_1DU5CK10FBZ5UERKJ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 583094
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 15A104518CF34F47BC38F64E34073835 Ref B: LON04EDGE1218 Ref C: 2024-05-02T07:14:49Z
date: Thu, 02 May 2024 07:14:48 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239360313429_1X5GXWWD8KTODKAD6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239360313429_1X5GXWWD8KTODKAD6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 394521
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 6F02C306FF144A9F8DDFFE3825702E23 Ref B: LON04EDGE1218 Ref C: 2024-05-02T07:14:49Z
date: Thu, 02 May 2024 07:14:48 GMT
-
DNS200.197.79.204.in-addr.arpaRemote address:8.8.8.8:53Request200.197.79.204.in-addr.arpaIN PTRResponse200.197.79.204.in-addr.arpaIN PTRa-0001a-msedgenet
-
DNS253.15.104.51.in-addr.arpaRemote address:8.8.8.8:53Request253.15.104.51.in-addr.arpaIN PTRResponse
-
DNSteen-modes.gl.at.ply.ggRemote address:8.8.8.8:53Requestteen-modes.gl.at.ply.ggIN AResponseteen-modes.gl.at.ply.ggIN A147.185.221.19
-
DNSteen-modes.gl.at.ply.ggRemote address:8.8.8.8:53Requestteen-modes.gl.at.ply.ggIN AResponseteen-modes.gl.at.ply.ggIN A147.185.221.19
-
DNSaction-yesterday.gl.at.ply.ggRemote address:8.8.8.8:53Requestaction-yesterday.gl.at.ply.ggIN AResponseaction-yesterday.gl.at.ply.ggIN A147.185.221.19
-
DNSbring-recorder.gl.at.ply.ggRemote address:8.8.8.8:53Requestbring-recorder.gl.at.ply.ggIN AResponsebring-recorder.gl.at.ply.ggIN A147.185.221.19
-
DNSthen-wheel.gl.at.ply.ggRemote address:8.8.8.8:53Requestthen-wheel.gl.at.ply.ggIN AResponsethen-wheel.gl.at.ply.ggIN A147.185.221.19
-
DNSteen-modes.gl.at.ply.ggRemote address:8.8.8.8:53Requestteen-modes.gl.at.ply.ggIN AResponseteen-modes.gl.at.ply.ggIN A147.185.221.19
-
DNSbring-recorder.gl.at.ply.ggRemote address:8.8.8.8:53Requestbring-recorder.gl.at.ply.ggIN AResponsebring-recorder.gl.at.ply.ggIN A147.185.221.19
-
DNSthen-wheel.gl.at.ply.ggRemote address:8.8.8.8:53Requestthen-wheel.gl.at.ply.ggIN AResponsethen-wheel.gl.at.ply.ggIN A147.185.221.19
-
DNSthen-wheel.gl.at.ply.ggRemote address:8.8.8.8:53Requestthen-wheel.gl.at.ply.ggIN AResponsethen-wheel.gl.at.ply.ggIN A147.185.221.19
-
DNSbring-recorder.gl.at.ply.ggRemote address:8.8.8.8:53Requestbring-recorder.gl.at.ply.ggIN AResponsebring-recorder.gl.at.ply.ggIN A147.185.221.19
-
DNSaction-yesterday.gl.at.ply.ggRemote address:8.8.8.8:53Requestaction-yesterday.gl.at.ply.ggIN AResponseaction-yesterday.gl.at.ply.ggIN A147.185.221.19
-
DNSteen-modes.gl.at.ply.ggRemote address:8.8.8.8:53Requestteen-modes.gl.at.ply.ggIN AResponseteen-modes.gl.at.ply.ggIN A147.185.221.19
-
DNSbring-recorder.gl.at.ply.ggRemote address:8.8.8.8:53Requestbring-recorder.gl.at.ply.ggIN AResponsebring-recorder.gl.at.ply.ggIN A147.185.221.19
-
DNSaction-yesterday.gl.at.ply.ggRemote address:8.8.8.8:53Requestaction-yesterday.gl.at.ply.ggIN AResponseaction-yesterday.gl.at.ply.ggIN A147.185.221.19
-
DNSteen-modes.gl.at.ply.ggRemote address:8.8.8.8:53Requestteen-modes.gl.at.ply.ggIN AResponseteen-modes.gl.at.ply.ggIN A147.185.221.19
-
DNSthen-wheel.gl.at.ply.ggRemote address:8.8.8.8:53Requestthen-wheel.gl.at.ply.ggIN AResponsethen-wheel.gl.at.ply.ggIN A147.185.221.19
-
DNSteen-modes.gl.at.ply.ggRemote address:8.8.8.8:53Requestteen-modes.gl.at.ply.ggIN AResponseteen-modes.gl.at.ply.ggIN A147.185.221.19
-
DNSbring-recorder.gl.at.ply.ggRemote address:8.8.8.8:53Requestbring-recorder.gl.at.ply.ggIN AResponsebring-recorder.gl.at.ply.ggIN A147.185.221.19
-
DNSaction-yesterday.gl.at.ply.ggRemote address:8.8.8.8:53Requestaction-yesterday.gl.at.ply.ggIN AResponseaction-yesterday.gl.at.ply.ggIN A147.185.221.19
-
204.79.197.237:443https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=3b826b5fcd624711a3f9e5c9bed89359&localId=w:5128B8A4-055F-6043-9311-1EEEFB4045B4&deviceId=6825828473859725&anid=tls, http2
HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=3b826b5fcd624711a3f9e5c9bed89359&localId=w:5128B8A4-055F-6043-9311-1EEEFB4045B4&deviceId=6825828473859725&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=3b826b5fcd624711a3f9e5c9bed89359&localId=w:5128B8A4-055F-6043-9311-1EEEFB4045B4&deviceId=6825828473859725&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=3b826b5fcd624711a3f9e5c9bed89359&localId=w:5128B8A4-055F-6043-9311-1EEEFB4045B4&deviceId=6825828473859725&anid=HTTP Response
204 -
23.62.61.72:443https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90tls, http2
HTTP Request
GET https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90HTTP Response
200 -
147.185.221.19:23638bring-recorder.gl.at.ply.gg
-
147.185.221.19:23638action-yesterday.gl.at.ply.gg
-
147.185.221.19:23638then-wheel.gl.at.ply.gg
-
147.185.221.19:23638then-wheel.gl.at.ply.gg
-
204.79.197.200:443https://tse1.mm.bing.net/th?id=OADD2.10239360313429_1X5GXWWD8KTODKAD6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90tls, http2
HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239370255172_1LGH0N1M3BEVIZPTE&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239360313430_12K7UVO7ZVIINTRIE&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239370255173_1DU5CK10FBZ5UERKJ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239360313429_1X5GXWWD8KTODKAD6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200 -
204.79.197.200:443tse1.mm.bing.nettls, http2
-
204.79.197.200:443tse1.mm.bing.nettls, http2
-
204.79.197.200:443tse1.mm.bing.nettls, http2
-
147.185.221.19:23638then-wheel.gl.at.ply.gg
-
127.0.0.1:23638 -
147.185.221.19:23638teen-modes.gl.at.ply.gg
-
147.185.221.19:23638teen-modes.gl.at.ply.gg
-
147.185.221.19:23638teen-modes.gl.at.ply.gg
-
147.185.221.19:23638teen-modes.gl.at.ply.gg
-
147.185.221.19:23638teen-modes.gl.at.ply.gg
-
147.185.221.19:23638teen-modes.gl.at.ply.gg
-
147.185.221.19:23638teen-modes.gl.at.ply.gg
-
147.185.221.19:23638action-yesterday.gl.at.ply.gg
-
147.185.221.19:23638action-yesterday.gl.at.ply.gg
-
147.185.221.19:23638action-yesterday.gl.at.ply.gg
-
147.185.221.19:23638action-yesterday.gl.at.ply.gg
-
127.0.0.1:23638
-
147.185.221.19:23638bring-recorder.gl.at.ply.gg
-
147.185.221.19:23638bring-recorder.gl.at.ply.gg
-
147.185.221.19:23638then-wheel.gl.at.ply.gg
-
147.185.221.19:23638then-wheel.gl.at.ply.gg
-
127.0.0.1:23638
-
147.185.221.19:23638then-wheel.gl.at.ply.gg
-
147.185.221.19:23638teen-modes.gl.at.ply.gg
-
127.0.0.1:23638
-
147.185.221.19:23638teen-modes.gl.at.ply.gg
-
147.185.221.19:23638teen-modes.gl.at.ply.gg
-
147.185.221.19:23638teen-modes.gl.at.ply.gg
-
127.0.0.1:23638
-
147.185.221.19:23638bring-recorder.gl.at.ply.gg
-
147.185.221.19:23638then-wheel.gl.at.ply.gg
-
127.0.0.1:23638
-
147.185.221.19:23638then-wheel.gl.at.ply.gg
-
147.185.221.19:23638then-wheel.gl.at.ply.gg
-
147.185.221.19:23638then-wheel.gl.at.ply.gg
-
147.185.221.19:23638then-wheel.gl.at.ply.gg
-
147.185.221.19:23638bring-recorder.gl.at.ply.gg
-
147.185.221.19:23638bring-recorder.gl.at.ply.gg
-
147.185.221.19:23638bring-recorder.gl.at.ply.gg
-
147.185.221.19:23638bring-recorder.gl.at.ply.gg
-
147.185.221.19:23638bring-recorder.gl.at.ply.gg
-
147.185.221.19:23638action-yesterday.gl.at.ply.gg
-
147.185.221.19:23638action-yesterday.gl.at.ply.gg
-
147.185.221.19:23638teen-modes.gl.at.ply.gg
-
147.185.221.19:23638teen-modes.gl.at.ply.gg
-
147.185.221.19:23638teen-modes.gl.at.ply.gg
-
147.185.221.19:23638bring-recorder.gl.at.ply.gg
-
147.185.221.19:23638bring-recorder.gl.at.ply.gg
-
147.185.221.19:23638bring-recorder.gl.at.ply.gg
-
127.0.0.1:23638
-
147.185.221.19:23638bring-recorder.gl.at.ply.gg
-
147.185.221.19:23638bring-recorder.gl.at.ply.gg
-
147.185.221.19:23638bring-recorder.gl.at.ply.gg
-
147.185.221.19:23638action-yesterday.gl.at.ply.gg
-
147.185.221.19:23638action-yesterday.gl.at.ply.gg
-
147.185.221.19:23638teen-modes.gl.at.ply.gg
-
147.185.221.19:23638teen-modes.gl.at.ply.gg
-
147.185.221.19:23638then-wheel.gl.at.ply.gg
-
147.185.221.19:23638teen-modes.gl.at.ply.gg
-
147.185.221.19:23638teen-modes.gl.at.ply.gg
-
147.185.221.19:23638teen-modes.gl.at.ply.gg
-
147.185.221.19:23638bring-recorder.gl.at.ply.gg
-
147.185.221.19:23638bring-recorder.gl.at.ply.gg
-
147.185.221.19:23638action-yesterday.gl.at.ply.gg
-
147.185.221.19:23638action-yesterday.gl.at.ply.gg
-
147.185.221.19:23638action-yesterday.gl.at.ply.gg
-
147.185.221.19:23638action-yesterday.gl.at.ply.gg
-
8.8.8.8:53183.142.211.20.in-addr.arpadns
DNS Request
183.142.211.20.in-addr.arpa
-
8.8.8.8:53g.bing.comdns
DNS Request
g.bing.com
DNS Response
204.79.197.23713.107.21.237
-
8.8.8.8:53237.197.79.204.in-addr.arpadns
DNS Request
237.197.79.204.in-addr.arpa
-
8.8.8.8:5379.190.18.2.in-addr.arpadns
DNS Request
79.190.18.2.in-addr.arpa
-
8.8.8.8:5323.159.190.20.in-addr.arpadns
DNS Request
23.159.190.20.in-addr.arpa
DNS Request
23.159.190.20.in-addr.arpa
-
8.8.8.8:53205.47.74.20.in-addr.arpadns
DNS Request
205.47.74.20.in-addr.arpa
DNS Request
205.47.74.20.in-addr.arpa
-
8.8.8.8:5372.61.62.23.in-addr.arpadns
DNS Request
72.61.62.23.in-addr.arpa
DNS Request
72.61.62.23.in-addr.arpa
-
8.8.8.8:53bring-recorder.gl.at.ply.ggdns
DNS Request
bring-recorder.gl.at.ply.gg
DNS Response
147.185.221.19
-
8.8.8.8:5326.165.165.52.in-addr.arpadns
DNS Request
26.165.165.52.in-addr.arpa
-
8.8.8.8:5315.164.165.52.in-addr.arpadns
DNS Request
15.164.165.52.in-addr.arpa
-
8.8.8.8:53172.210.232.199.in-addr.arpadns
DNS Request
172.210.232.199.in-addr.arpa
-
8.8.8.8:53action-yesterday.gl.at.ply.ggdns
DNS Request
action-yesterday.gl.at.ply.gg
DNS Response
147.185.221.19
-
8.8.8.8:5343.58.199.20.in-addr.arpadns
DNS Request
43.58.199.20.in-addr.arpa
-
8.8.8.8:5334.251.17.2.in-addr.arpadns
DNS Request
34.251.17.2.in-addr.arpa
-
8.8.8.8:53then-wheel.gl.at.ply.ggdns
DNS Request
then-wheel.gl.at.ply.gg
DNS Response
147.185.221.19
-
8.8.8.8:5322.236.111.52.in-addr.arpadns
DNS Request
22.236.111.52.in-addr.arpa
-
8.8.8.8:53tse1.mm.bing.netdns
DNS Request
tse1.mm.bing.net
DNS Response
204.79.197.20013.107.21.200
-
8.8.8.8:53200.197.79.204.in-addr.arpadns
DNS Request
200.197.79.204.in-addr.arpa
-
8.8.8.8:53253.15.104.51.in-addr.arpadns
DNS Request
253.15.104.51.in-addr.arpa
-
8.8.8.8:53teen-modes.gl.at.ply.ggdns
DNS Request
teen-modes.gl.at.ply.gg
DNS Response
147.185.221.19
-
8.8.8.8:53teen-modes.gl.at.ply.ggdns
DNS Request
teen-modes.gl.at.ply.gg
DNS Response
147.185.221.19
-
8.8.8.8:53action-yesterday.gl.at.ply.ggdns
DNS Request
action-yesterday.gl.at.ply.gg
DNS Response
147.185.221.19
-
8.8.8.8:53bring-recorder.gl.at.ply.ggdns
DNS Request
bring-recorder.gl.at.ply.gg
DNS Response
147.185.221.19
-
8.8.8.8:53then-wheel.gl.at.ply.ggdns
DNS Request
then-wheel.gl.at.ply.gg
DNS Response
147.185.221.19
-
8.8.8.8:53teen-modes.gl.at.ply.ggdns
DNS Request
teen-modes.gl.at.ply.gg
DNS Response
147.185.221.19
-
8.8.8.8:53bring-recorder.gl.at.ply.ggdns
DNS Request
bring-recorder.gl.at.ply.gg
DNS Response
147.185.221.19
-
8.8.8.8:53then-wheel.gl.at.ply.ggdns
DNS Request
then-wheel.gl.at.ply.gg
DNS Response
147.185.221.19
-
8.8.8.8:53then-wheel.gl.at.ply.ggdns
DNS Request
then-wheel.gl.at.ply.gg
DNS Response
147.185.221.19
-
8.8.8.8:53bring-recorder.gl.at.ply.ggdns
DNS Request
bring-recorder.gl.at.ply.gg
DNS Response
147.185.221.19
-
8.8.8.8:53action-yesterday.gl.at.ply.ggdns
DNS Request
action-yesterday.gl.at.ply.gg
DNS Response
147.185.221.19
-
8.8.8.8:53teen-modes.gl.at.ply.ggdns
DNS Request
teen-modes.gl.at.ply.gg
DNS Response
147.185.221.19
-
8.8.8.8:53bring-recorder.gl.at.ply.ggdns
DNS Request
bring-recorder.gl.at.ply.gg
DNS Response
147.185.221.19
-
8.8.8.8:53action-yesterday.gl.at.ply.ggdns
DNS Request
action-yesterday.gl.at.ply.gg
DNS Response
147.185.221.19
-
8.8.8.8:53teen-modes.gl.at.ply.ggdns
DNS Request
teen-modes.gl.at.ply.gg
DNS Response
147.185.221.19
-
8.8.8.8:53then-wheel.gl.at.ply.ggdns
DNS Request
then-wheel.gl.at.ply.gg
DNS Response
147.185.221.19
-
8.8.8.8:53teen-modes.gl.at.ply.ggdns
DNS Request
teen-modes.gl.at.ply.gg
DNS Response
147.185.221.19
-
8.8.8.8:53bring-recorder.gl.at.ply.ggdns
DNS Request
bring-recorder.gl.at.ply.gg
DNS Response
147.185.221.19
-
8.8.8.8:53action-yesterday.gl.at.ply.ggdns
DNS Request
action-yesterday.gl.at.ply.gg
DNS Response
147.185.221.19
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
Filesize
63KB
MD5222c2d239f4c8a1d73c736c9cc712807
SHA1c3aa61bd6f8cc640bcfa74c40d9283c9c08c7b3c
SHA256ff43049677c57277f12a1d97f02af3029d7b75b5ad40303a28f1b0452997969d
SHA5121f2fea85e45e93916306c234b916d6b4b200dac9656e44f4555f825dd8677cb5e927bd5e7a74bf2fb2f6972a3e6e2d294a6104add162ba3d53a0e6cfedef6a02
-
Filesize
8KB
-
Filesize
88KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB