Overview

overview

7

Static

static

3

11880711c8...18.exe

windows7-x64

7

11880711c8...18.exe

windows10-2004-x64

7

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ow.dll

windows7-x64

3

$PLUGINSDI...ow.dll

windows10-2004-x64

3

$R2/CrashRpt1403.dll

windows7-x64

1

$R2/CrashRpt1403.dll

windows10-2004-x64

1

$R2/CrashS...03.exe

windows7-x64

1

$R2/CrashS...03.exe

windows10-2004-x64

1

$R2/GAME.exe

windows7-x64

1

$R2/GAME.exe

windows10-2004-x64

1

$R2/SDL2.dll

windows7-x64

1

$R2/SDL2.dll

windows10-2004-x64

1

$R2/SDL2_ttf.dll

windows7-x64

1

$R2/SDL2_ttf.dll

windows10-2004-x64

1

$R2/WOL/PATCHW32.dll

windows7-x64

3

$R2/WOL/PATCHW32.dll

windows10-2004-x64

3

$R2/WOL/REGISTER.exe

windows7-x64

1

$R2/WOL/REGISTER.exe

windows10-2004-x64

1

$R2/WOL/WOLAPI.dll

windows7-x64

1

$R2/WOL/WOLAPI.dll

windows10-2004-x64

1

$R2/WOL/WO...er.dll

windows7-x64

1

$R2/WOL/WO...er.dll

windows10-2004-x64

1

$R2/WOL/unins000.exe

windows7-x64

7

$R2/WOL/unins000.exe

windows10-2004-x64

7

$R2/ddraw.dll

windows7-x64

1

$R2/ddraw.dll

windows10-2004-x64

3

$R2/libfreetype-6.dll

windows7-x64

3

$R2/libfreetype-6.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    143s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/05/2024, 04:47 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    $R2/libfreetype-6.dll

  • Size

    490KB

  • MD5

    309daab1ca02fbbc030a90804033ee27

  • SHA1

    83878a49d8254b871acf1bec3fe9a9e24cdfdfcf

  • SHA256

    32f4ee8d26cd8b8c9eabd382d590dfae2e7e12f7c6376a30a9e3fb4013de2cd0

  • SHA512

    2d5c3981b14eabcd2c2e88736140e8ffd312b1863e79c44b1339fe0f9eb95208e5ca93df1afbde0f9d742d2d9765f3d47f622d4e09bb3eb6069eb1244abcc112

  • SSDEEP

    12288:id8ZXXXMpZ2dRNRDA9Qr5hn5e1j9R6d2sefEWmg:C8ZXXXMzSbDA9Qr5h5e964sTZg

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$R2\libfreetype-6.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3028
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\$R2\libfreetype-6.dll,#1
      2⤵
        PID:2732
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 604
          3⤵
          • Program crash
          PID:3944
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2732 -ip 2732
      1⤵
        PID:4080

      Network

      • flag-us
        DNS
        217.106.137.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        217.106.137.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        g.bing.com
        Remote address:
        8.8.8.8:53
        Request
        g.bing.com
        IN A
        Response
        g.bing.com
        IN CNAME
        g-bing-com.dual-a-0034.a-msedge.net
        g-bing-com.dual-a-0034.a-msedge.net
        IN CNAME
        dual-a-0034.a-msedge.net
        dual-a-0034.a-msedge.net
        IN A
        204.79.197.237
        dual-a-0034.a-msedge.net
        IN A
        13.107.21.237
      • flag-us
        GET
        https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8-EzFYfBL_ziViZfvv8PB_zVUCUzOE7exioKyqbF4H2PGeoWqi3rfuZ9NJh0LZEUG32aqx1FqNRTs_WgdD5cCl0XNEwpJNrQuXNOeYkSZ-WlZt7L6_RATO2R-ZIbkyuyxtJTHJgJhaV1i39VeCYMz6RwEziigoMSA5lx0V-YhKcnbTvbH%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Da1cd838879f318822fbfe5a3caeb6fd0&TIME=20240426T135952Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038&muid=416143B6C3858B3296EFB62827C91949
        Remote address:
        204.79.197.237:443
        Request
        GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8-EzFYfBL_ziViZfvv8PB_zVUCUzOE7exioKyqbF4H2PGeoWqi3rfuZ9NJh0LZEUG32aqx1FqNRTs_WgdD5cCl0XNEwpJNrQuXNOeYkSZ-WlZt7L6_RATO2R-ZIbkyuyxtJTHJgJhaV1i39VeCYMz6RwEziigoMSA5lx0V-YhKcnbTvbH%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Da1cd838879f318822fbfe5a3caeb6fd0&TIME=20240426T135952Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038&muid=416143B6C3858B3296EFB62827C91949 HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        set-cookie: MUID=026B591B85626A4339B04D6E84826BB5; domain=.bing.com; expires=Thu, 29-May-2025 04:48:03 GMT; path=/; SameSite=None; Secure; Priority=High;
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 8657577CDF844B5196032A1D6112251C Ref B: LON04EDGE1120 Ref C: 2024-05-04T04:48:03Z
        date: Sat, 04 May 2024 04:48:02 GMT
      • flag-us
        GET
        https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8-EzFYfBL_ziViZfvv8PB_zVUCUzOE7exioKyqbF4H2PGeoWqi3rfuZ9NJh0LZEUG32aqx1FqNRTs_WgdD5cCl0XNEwpJNrQuXNOeYkSZ-WlZt7L6_RATO2R-ZIbkyuyxtJTHJgJhaV1i39VeCYMz6RwEziigoMSA5lx0V-YhKcnbTvbH%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Da1cd838879f318822fbfe5a3caeb6fd0&TIME=20240426T135952Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038&muid=416143B6C3858B3296EFB62827C91949
        Remote address:
        204.79.197.237:443
        Request
        GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8-EzFYfBL_ziViZfvv8PB_zVUCUzOE7exioKyqbF4H2PGeoWqi3rfuZ9NJh0LZEUG32aqx1FqNRTs_WgdD5cCl0XNEwpJNrQuXNOeYkSZ-WlZt7L6_RATO2R-ZIbkyuyxtJTHJgJhaV1i39VeCYMz6RwEziigoMSA5lx0V-YhKcnbTvbH%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Da1cd838879f318822fbfe5a3caeb6fd0&TIME=20240426T135952Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038&muid=416143B6C3858B3296EFB62827C91949 HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=026B591B85626A4339B04D6E84826BB5; _EDGE_S=SID=3408AE688CFA66181210BA1D8D3A67C7
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        set-cookie: MSPTC=ht-eWLxZZTt6-3AqDAX8RGItbpI2tLG3ua2wotv5h04; domain=.bing.com; expires=Thu, 29-May-2025 04:48:03 GMT; path=/; Partitioned; secure; SameSite=None
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 89D00383150648999FD4E73AAA5D5884 Ref B: LON04EDGE1120 Ref C: 2024-05-04T04:48:03Z
        date: Sat, 04 May 2024 04:48:03 GMT
      • flag-us
        DNS
        79.190.18.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        79.190.18.2.in-addr.arpa
        IN PTR
        Response
        79.190.18.2.in-addr.arpa
        IN PTR
        a2-18-190-79deploystaticakamaitechnologiescom
      • flag-nl
        GET
        https://www.bing.com/aes/c.gif?RG=dd708208a3ba4b05b85b2bb61bfeb447&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T135952Z&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038
        Remote address:
        23.62.61.194:443
        Request
        GET /aes/c.gif?RG=dd708208a3ba4b05b85b2bb61bfeb447&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T135952Z&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038 HTTP/2.0
        host: www.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=026B591B85626A4339B04D6E84826BB5
        Response
        HTTP/2.0 200
        cache-control: private,no-store
        pragma: no-cache
        vary: Origin
        p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: BB4FA81B6C6A4CA6A4B754140A7103A8 Ref B: DUS30EDGE0314 Ref C: 2024-05-04T04:48:03Z
        content-length: 0
        date: Sat, 04 May 2024 04:48:03 GMT
        set-cookie: _EDGE_S=SID=3408AE688CFA66181210BA1D8D3A67C7; path=/; httponly; domain=bing.com
        set-cookie: MUIDB=026B591B85626A4339B04D6E84826BB5; path=/; httponly; expires=Thu, 29-May-2025 04:48:03 GMT
        alt-svc: h3=":443"; ma=93600
        x-cdn-traceid: 0.be3d3e17.1714798083.162bf9bd
      • flag-us
        DNS
        237.197.79.204.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        237.197.79.204.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        17.160.190.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        17.160.190.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        194.61.62.23.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        194.61.62.23.in-addr.arpa
        IN PTR
        Response
        194.61.62.23.in-addr.arpa
        IN PTR
        a23-62-61-194deploystaticakamaitechnologiescom
      • flag-us
        DNS
        232.168.11.51.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        232.168.11.51.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        88.156.103.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        88.156.103.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        50.23.12.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        50.23.12.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        198.187.3.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        198.187.3.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        205.47.74.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        205.47.74.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        14.227.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        14.227.111.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        240.221.184.93.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        240.221.184.93.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        tse1.mm.bing.net
        Remote address:
        8.8.8.8:53
        Request
        tse1.mm.bing.net
        IN A
        Response
        tse1.mm.bing.net
        IN CNAME
        mm-mm.bing.net.trafficmanager.net
        mm-mm.bing.net.trafficmanager.net
        IN CNAME
        dual-a-0001.a-msedge.net
        dual-a-0001.a-msedge.net
        IN A
        204.79.197.200
        dual-a-0001.a-msedge.net
        IN A
        13.107.21.200
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239370255172_1LGH0N1M3BEVIZPTE&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239370255172_1LGH0N1M3BEVIZPTE&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 496166
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: C73F2C7D0DF449CCA4160285CA231A05 Ref B: LON04EDGE0616 Ref C: 2024-05-04T04:49:45Z
        date: Sat, 04 May 2024 04:49:44 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239370255173_1DU5CK10FBZ5UERKJ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239370255173_1DU5CK10FBZ5UERKJ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 583094
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 318A0616F5724A338B7D798428A9EFCF Ref B: LON04EDGE0616 Ref C: 2024-05-04T04:49:45Z
        date: Sat, 04 May 2024 04:49:44 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239351691769_17S178H4I11J3APXJ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239351691769_17S178H4I11J3APXJ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 565422
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 4751F536DCCE480FADF1FF45AD93CBFA Ref B: LON04EDGE0616 Ref C: 2024-05-04T04:49:45Z
        date: Sat, 04 May 2024 04:49:44 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239351691770_1IUJHOACLFVRNOEKH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239351691770_1IUJHOACLFVRNOEKH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 496229
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: A1FBFB5BDF7D4D19A8FE458D79FE4F4F Ref B: LON04EDGE0616 Ref C: 2024-05-04T04:49:45Z
        date: Sat, 04 May 2024 04:49:44 GMT
      • flag-us
        DNS
        8.173.189.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        8.173.189.20.in-addr.arpa
        IN PTR
        Response
      • 204.79.197.237:443
        https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8-EzFYfBL_ziViZfvv8PB_zVUCUzOE7exioKyqbF4H2PGeoWqi3rfuZ9NJh0LZEUG32aqx1FqNRTs_WgdD5cCl0XNEwpJNrQuXNOeYkSZ-WlZt7L6_RATO2R-ZIbkyuyxtJTHJgJhaV1i39VeCYMz6RwEziigoMSA5lx0V-YhKcnbTvbH%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Da1cd838879f318822fbfe5a3caeb6fd0&TIME=20240426T135952Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038&muid=416143B6C3858B3296EFB62827C91949
        tls, http2
        2.5kB
         9.0kB
         19
        17

        HTTP Request

        GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8-EzFYfBL_ziViZfvv8PB_zVUCUzOE7exioKyqbF4H2PGeoWqi3rfuZ9NJh0LZEUG32aqx1FqNRTs_WgdD5cCl0XNEwpJNrQuXNOeYkSZ-WlZt7L6_RATO2R-ZIbkyuyxtJTHJgJhaV1i39VeCYMz6RwEziigoMSA5lx0V-YhKcnbTvbH%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Da1cd838879f318822fbfe5a3caeb6fd0&TIME=20240426T135952Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038&muid=416143B6C3858B3296EFB62827C91949

        HTTP Response

        204

        HTTP Request

        GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8-EzFYfBL_ziViZfvv8PB_zVUCUzOE7exioKyqbF4H2PGeoWqi3rfuZ9NJh0LZEUG32aqx1FqNRTs_WgdD5cCl0XNEwpJNrQuXNOeYkSZ-WlZt7L6_RATO2R-ZIbkyuyxtJTHJgJhaV1i39VeCYMz6RwEziigoMSA5lx0V-YhKcnbTvbH%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Da1cd838879f318822fbfe5a3caeb6fd0&TIME=20240426T135952Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038&muid=416143B6C3858B3296EFB62827C91949

        HTTP Response

        204
      • 23.62.61.194:443
        https://www.bing.com/aes/c.gif?RG=dd708208a3ba4b05b85b2bb61bfeb447&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T135952Z&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038
        tls, http2
        1.5kB
         5.4kB
         17
        12

        HTTP Request

        GET https://www.bing.com/aes/c.gif?RG=dd708208a3ba4b05b85b2bb61bfeb447&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T135952Z&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038

        HTTP Response

        200
      • 204.79.197.200:443
        https://tse1.mm.bing.net/th?id=OADD2.10239351691770_1IUJHOACLFVRNOEKH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        tls, http2
        78.8kB
         2.2MB
         1621
        1617

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239370255172_1LGH0N1M3BEVIZPTE&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239370255173_1DU5CK10FBZ5UERKJ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239351691769_17S178H4I11J3APXJ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239351691770_1IUJHOACLFVRNOEKH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

        HTTP Response

        200

        HTTP Response

        200

        HTTP Response

        200

        HTTP Response

        200
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         8.1kB
         16
        14
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         8.1kB
         16
        14
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         8.1kB
         16
        14
      • 8.8.8.8:53
        217.106.137.52.in-addr.arpa
        dns
        73 B
         147 B
         1
        1

        DNS Request

        217.106.137.52.in-addr.arpa

      • 8.8.8.8:53
        g.bing.com
        dns
        56 B
         151 B
         1
        1

        DNS Request

        g.bing.com

        DNS Response

        204.79.197.237
        13.107.21.237

      • 8.8.8.8:53
        79.190.18.2.in-addr.arpa
        dns
        70 B
         133 B
         1
        1

        DNS Request

        79.190.18.2.in-addr.arpa

      • 8.8.8.8:53
        237.197.79.204.in-addr.arpa
        dns
        73 B
         143 B
         1
        1

        DNS Request

        237.197.79.204.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
         144 B
         1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        17.160.190.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        17.160.190.20.in-addr.arpa

      • 8.8.8.8:53
        194.61.62.23.in-addr.arpa
        dns
        71 B
         135 B
         1
        1

        DNS Request

        194.61.62.23.in-addr.arpa

      • 8.8.8.8:53
        232.168.11.51.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        232.168.11.51.in-addr.arpa

      • 8.8.8.8:53
        88.156.103.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        88.156.103.20.in-addr.arpa

      • 8.8.8.8:53
        50.23.12.20.in-addr.arpa
        dns
        70 B
         156 B
         1
        1

        DNS Request

        50.23.12.20.in-addr.arpa

      • 8.8.8.8:53
        198.187.3.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        198.187.3.20.in-addr.arpa

      • 8.8.8.8:53
        205.47.74.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        205.47.74.20.in-addr.arpa

      • 8.8.8.8:53
        14.227.111.52.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        14.227.111.52.in-addr.arpa

      • 8.8.8.8:53
        240.221.184.93.in-addr.arpa
        dns
        73 B
         144 B
         1
        1

        DNS Request

        240.221.184.93.in-addr.arpa

      • 8.8.8.8:53
        tse1.mm.bing.net
        dns
        62 B
         173 B
         1
        1

        DNS Request

        tse1.mm.bing.net

        DNS Response

        204.79.197.200
        13.107.21.200

      • 8.8.8.8:53
        8.173.189.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        8.173.189.20.in-addr.arpa

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2732-1-0x0000000062E80000-0x0000000062EA6000-memory.dmp

        Filesize

        152KB

        Download

      • memory/2732-0-0x000000006CD00000-0x000000006CD81000-memory.dmp

        Filesize

        516KB

        Download

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.