Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    139s
  • max time network
    107s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/05/2024, 13:27 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0e392f291da6999d5879828d731ebcbef8b2ad7b3ca77d6e7308de3f817311fc.exe

  • Size

    260KB

  • MD5

    5fae0d85fea444f720fe41b6162ef232

  • SHA1

    b472b3f53be0ab9856317fac8eb7f06aee300730

  • SHA256

    0e392f291da6999d5879828d731ebcbef8b2ad7b3ca77d6e7308de3f817311fc

  • SHA512

    dddc03e6cf1cab20c93a3fd953ddb2e26f0e6f4c85ffa1ce71f8c202f593e367e6ebc3c41085b26d3ca3f8f52716695bdacb443d81689ef2544a44d5d760e201

  • SSDEEP

    3072:Ss0qv0Db3ercHXtcQJR2X8dsLNhv+Vybtif3lql/v3U2eQkl+iyyuoeOWCpUxF:Eqv0Db3R3tzJRWvMNqNU2Tliyyuoen

Score
10/10
redlinezgrat5637482599discoveryinfostealerratspywarestealer

Malware Config

Extracted

Family

redline

Botnet

5637482599

C2

https://pastebin.com/raw/NgsUAPya

Signatures

  • Detect ZGRat V1 1 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0e392f291da6999d5879828d731ebcbef8b2ad7b3ca77d6e7308de3f817311fc.exe
    "C:\Users\Admin\AppData\Local\Temp\0e392f291da6999d5879828d731ebcbef8b2ad7b3ca77d6e7308de3f817311fc.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3620
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2988

Network

  • flag-us
    DNS
    13.86.106.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.86.106.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    pastebin.com
    RegAsm.exe
    Remote address:
    8.8.8.8:53
    Request
    pastebin.com
    IN A
    Response
    pastebin.com
    IN A
    172.67.19.24
    pastebin.com
    IN A
    104.20.3.235
    pastebin.com
    IN A
    104.20.4.235
  • flag-us
    GET
    https://pastebin.com/raw/NgsUAPya
    RegAsm.exe
    Remote address:
    172.67.19.24:443
    Request
    GET /raw/NgsUAPya HTTP/1.1
    Host: pastebin.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Mon, 06 May 2024 13:27:49 GMT
    Content-Type: text/plain; charset=utf-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    x-frame-options: DENY
    x-content-type-options: nosniff
    x-xss-protection: 1;mode=block
    cache-control: public, max-age=1801
    CF-Cache-Status: HIT
    Age: 1242
    Last-Modified: Mon, 06 May 2024 13:07:07 GMT
    Server: cloudflare
    CF-RAY: 87f94f56786c79c8-LHR
  • flag-us
    DNS
    aifiller.sbs
    RegAsm.exe
    Remote address:
    8.8.8.8:53
    Request
    aifiller.sbs
    IN A
    Response
    aifiller.sbs
    IN A
    116.203.6.63
  • flag-us
    DNS
    24.19.67.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    24.19.67.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    138.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    138.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    63.6.203.116.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    63.6.203.116.in-addr.arpa
    IN PTR
    Response
    63.6.203.116.in-addr.arpa
    IN PTR
    static636203116clients your-serverde
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
    Response
    g.bing.com
    IN CNAME
    g-bing-com.dual-a-0034.a-msedge.net
    g-bing-com.dual-a-0034.a-msedge.net
    IN CNAME
    dual-a-0034.a-msedge.net
    dual-a-0034.a-msedge.net
    IN A
    204.79.197.237
    dual-a-0034.a-msedge.net
    IN A
    13.107.21.237
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=97d629aab3ff490381d5cdf628fc4152&localId=w:5128B8A4-055F-6043-9311-1EEEFB4045B4&deviceId=6825828473859725&anid=
    Remote address:
    204.79.197.237:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=97d629aab3ff490381d5cdf628fc4152&localId=w:5128B8A4-055F-6043-9311-1EEEFB4045B4&deviceId=6825828473859725&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MUID=3943ADE0815A63F6119FB997807D6203; domain=.bing.com; expires=Sat, 31-May-2025 13:27:52 GMT; path=/; SameSite=None; Secure; Priority=High;
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 719FB49C9BFF490F8313D17DA523DE4B Ref B: LON04EDGE0722 Ref C: 2024-05-06T13:27:52Z
    date: Mon, 06 May 2024 13:27:51 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=97d629aab3ff490381d5cdf628fc4152&localId=w:5128B8A4-055F-6043-9311-1EEEFB4045B4&deviceId=6825828473859725&anid=
    Remote address:
    204.79.197.237:443
    Request
    GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=97d629aab3ff490381d5cdf628fc4152&localId=w:5128B8A4-055F-6043-9311-1EEEFB4045B4&deviceId=6825828473859725&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=3943ADE0815A63F6119FB997807D6203
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MSPTC=-wIvhbaYH3RDiqi_ebt2H4xmiF5v2h0lHyarQti-vNg; domain=.bing.com; expires=Sat, 31-May-2025 13:27:52 GMT; path=/; Partitioned; secure; SameSite=None
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: E86162188A314938AC3088078E11CD36 Ref B: LON04EDGE0722 Ref C: 2024-05-06T13:27:52Z
    date: Mon, 06 May 2024 13:27:52 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=97d629aab3ff490381d5cdf628fc4152&localId=w:5128B8A4-055F-6043-9311-1EEEFB4045B4&deviceId=6825828473859725&anid=
    Remote address:
    204.79.197.237:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=97d629aab3ff490381d5cdf628fc4152&localId=w:5128B8A4-055F-6043-9311-1EEEFB4045B4&deviceId=6825828473859725&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=3943ADE0815A63F6119FB997807D6203; MSPTC=-wIvhbaYH3RDiqi_ebt2H4xmiF5v2h0lHyarQti-vNg
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: FD0148E4798441638384DAC95183F75B Ref B: LON04EDGE0722 Ref C: 2024-05-06T13:27:53Z
    date: Mon, 06 May 2024 13:27:52 GMT
  • flag-us
    DNS
    237.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    237.197.79.204.in-addr.arpa
    IN PTR
    Response
  • flag-nl
    GET
    https://www.bing.com/th?id=OADD2.10239355179391_1LFCMSFC5TYGHD1FP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
    Remote address:
    23.62.61.155:443
    Request
    GET /th?id=OADD2.10239355179391_1LFCMSFC5TYGHD1FP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
    host: www.bing.com
    accept: */*
    cookie: MUID=3943ADE0815A63F6119FB997807D6203; MSPTC=-wIvhbaYH3RDiqi_ebt2H4xmiF5v2h0lHyarQti-vNg
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-type: image/png
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    content-length: 1463
    date: Mon, 06 May 2024 13:27:55 GMT
    alt-svc: h3=":443"; ma=93600
    x-cdn-traceid: 0.973d3e17.1715002075.2857c8d7
  • flag-us
    DNS
    155.61.62.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    155.61.62.23.in-addr.arpa
    IN PTR
    Response
    155.61.62.23.in-addr.arpa
    IN PTR
    a23-62-61-155deploystaticakamaitechnologiescom
  • flag-us
    DNS
    26.35.223.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    26.35.223.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    232.168.11.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    232.168.11.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    232.168.11.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    232.168.11.51.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    232.168.11.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    232.168.11.51.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    232.168.11.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    232.168.11.51.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    183.59.114.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    183.59.114.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    171.39.242.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    171.39.242.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    139.53.16.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    139.53.16.96.in-addr.arpa
    IN PTR
    Response
    139.53.16.96.in-addr.arpa
    IN PTR
    a96-16-53-139deploystaticakamaitechnologiescom
  • flag-us
    DNS
    240.221.184.93.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.221.184.93.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    240.221.184.93.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.221.184.93.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    48.251.17.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    48.251.17.2.in-addr.arpa
    IN PTR
    Response
    48.251.17.2.in-addr.arpa
    IN PTR
    a2-17-251-48deploystaticakamaitechnologiescom
  • flag-us
    DNS
    43.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    dual-a-0001.a-msedge.net
    dual-a-0001.a-msedge.net
    IN A
    204.79.197.200
    dual-a-0001.a-msedge.net
    IN A
    13.107.21.200
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239360931609_1JAA48IJSET6WWQHH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239360931609_1JAA48IJSET6WWQHH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 430689
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: C9734FCB7EBE4F5980205D4BF5498397 Ref B: LON04EDGE0822 Ref C: 2024-05-06T13:29:33Z
    date: Mon, 06 May 2024 13:29:32 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239351692210_1AKNUXTAY2T0XUMCR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239351692210_1AKNUXTAY2T0XUMCR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 449656
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: F8564E001B3A46338E2D0DDFD594F7F3 Ref B: LON04EDGE0822 Ref C: 2024-05-06T13:29:33Z
    date: Mon, 06 May 2024 13:29:32 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239351692215_1UJ4FAL91XLA7HB15&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239351692215_1UJ4FAL91XLA7HB15&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 415458
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: AC70E3B8017A47699E0DC65769F72E4A Ref B: LON04EDGE0822 Ref C: 2024-05-06T13:29:33Z
    date: Mon, 06 May 2024 13:29:32 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239360931610_110BPTPDN41GIXK2B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239360931610_110BPTPDN41GIXK2B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 468637
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 1C681A4808D5409F90036B98E30722E6 Ref B: LON04EDGE0822 Ref C: 2024-05-06T13:29:33Z
    date: Mon, 06 May 2024 13:29:32 GMT
  • flag-us
    DNS
    200.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.197.79.204.in-addr.arpa
    IN PTR
    Response
    200.197.79.204.in-addr.arpa
    IN PTR
    a-0001a-msedgenet
  • 172.67.19.24:443
    https://pastebin.com/raw/NgsUAPya
    tls, http
    RegAsm.exe
    772 B
     5.7kB
     9
    9

    HTTP Request

    GET https://pastebin.com/raw/NgsUAPya

    HTTP Response

    200
  • 116.203.6.63:443
    aifiller.sbs
    https
    RegAsm.exe
    1.4MB
     25.2kB
     1010
    404
  • 204.79.197.237:443
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=97d629aab3ff490381d5cdf628fc4152&localId=w:5128B8A4-055F-6043-9311-1EEEFB4045B4&deviceId=6825828473859725&anid=
    tls, http2
    2.2kB
     10.9kB
     24
    21

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=97d629aab3ff490381d5cdf628fc4152&localId=w:5128B8A4-055F-6043-9311-1EEEFB4045B4&deviceId=6825828473859725&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=97d629aab3ff490381d5cdf628fc4152&localId=w:5128B8A4-055F-6043-9311-1EEEFB4045B4&deviceId=6825828473859725&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=97d629aab3ff490381d5cdf628fc4152&localId=w:5128B8A4-055F-6043-9311-1EEEFB4045B4&deviceId=6825828473859725&anid=

    HTTP Response

    204
  • 23.62.61.155:443
    https://www.bing.com/th?id=OADD2.10239355179391_1LFCMSFC5TYGHD1FP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
    tls, http2
    1.5kB
     6.7kB
     17
    12

    HTTP Request

    GET https://www.bing.com/th?id=OADD2.10239355179391_1LFCMSFC5TYGHD1FP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90

    HTTP Response

    200
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.3kB
     8.1kB
     17
    14
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.3kB
     8.1kB
     17
    14
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.3kB
     8.1kB
     17
    14
  • 204.79.197.200:443
    https://tse1.mm.bing.net/th?id=OADD2.10239360931610_110BPTPDN41GIXK2B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    tls, http2
    66.6kB
     1.8MB
     1346
    1337

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239360931609_1JAA48IJSET6WWQHH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239351692210_1AKNUXTAY2T0XUMCR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239351692215_1UJ4FAL91XLA7HB15&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239360931610_110BPTPDN41GIXK2B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200
  • 8.8.8.8:53
    13.86.106.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    13.86.106.20.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    pastebin.com
    dns
    RegAsm.exe
    58 B
     106 B
     1
    1

    DNS Request

    pastebin.com

    DNS Response

    172.67.19.24
    104.20.3.235
    104.20.4.235

  • 8.8.8.8:53
    aifiller.sbs
    dns
    RegAsm.exe
    58 B
     74 B
     1
    1

    DNS Request

    aifiller.sbs

    DNS Response

    116.203.6.63

  • 8.8.8.8:53
    24.19.67.172.in-addr.arpa
    dns
    71 B
     133 B
     1
    1

    DNS Request

    24.19.67.172.in-addr.arpa

  • 8.8.8.8:53
    138.32.126.40.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    138.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    63.6.203.116.in-addr.arpa
    dns
    71 B
     127 B
     1
    1

    DNS Request

    63.6.203.116.in-addr.arpa

  • 8.8.8.8:53
    g.bing.com
    dns
    56 B
     151 B
     1
    1

    DNS Request

    g.bing.com

    DNS Response

    204.79.197.237
    13.107.21.237

  • 8.8.8.8:53
    237.197.79.204.in-addr.arpa
    dns
    73 B
     143 B
     1
    1

    DNS Request

    237.197.79.204.in-addr.arpa

  • 8.8.8.8:53
    155.61.62.23.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    155.61.62.23.in-addr.arpa

  • 8.8.8.8:53
    26.35.223.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    26.35.223.20.in-addr.arpa

  • 8.8.8.8:53
    232.168.11.51.in-addr.arpa
    dns
    288 B
     158 B
     4
    1

    DNS Request

    232.168.11.51.in-addr.arpa

    DNS Request

    232.168.11.51.in-addr.arpa

    DNS Request

    232.168.11.51.in-addr.arpa

    DNS Request

    232.168.11.51.in-addr.arpa

  • 8.8.8.8:53
    183.59.114.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    183.59.114.20.in-addr.arpa

  • 8.8.8.8:53
    171.39.242.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    171.39.242.20.in-addr.arpa

  • 8.8.8.8:53
    139.53.16.96.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    139.53.16.96.in-addr.arpa

  • 8.8.8.8:53
    240.221.184.93.in-addr.arpa
    dns
    146 B
     144 B
     2
    1

    DNS Request

    240.221.184.93.in-addr.arpa

    DNS Request

    240.221.184.93.in-addr.arpa

  • 8.8.8.8:53
    48.251.17.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    48.251.17.2.in-addr.arpa

  • 8.8.8.8:53
    43.229.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    43.229.111.52.in-addr.arpa

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    62 B
     173 B
     1
    1

    DNS Request

    tse1.mm.bing.net

    DNS Response

    204.79.197.200
    13.107.21.200

  • 8.8.8.8:53
    200.197.79.204.in-addr.arpa
    dns
    73 B
     106 B
     1
    1

    DNS Request

    200.197.79.204.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2988-14-0x0000000074AD0000-0x0000000075280000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/2988-15-0x0000000006460000-0x000000000649C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/2988-4-0x0000000000400000-0x0000000000422000-memory.dmp

    Filesize

    136KB

    Download

  • memory/2988-25-0x0000000074AD0000-0x0000000075280000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/2988-23-0x0000000006BC0000-0x0000000006C10000-memory.dmp

    Filesize

    320KB

    Download

  • memory/2988-8-0x0000000005100000-0x0000000005166000-memory.dmp

    Filesize

    408KB

    Download

  • memory/2988-10-0x0000000074AD0000-0x0000000075280000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/2988-11-0x0000000005BF0000-0x0000000006208000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/2988-12-0x0000000005670000-0x0000000005682000-memory.dmp

    Filesize

    72KB

    Download

  • memory/2988-16-0x00000000064A0000-0x00000000064EC000-memory.dmp

    Filesize

    304KB

    Download

  • memory/2988-22-0x0000000006A70000-0x0000000006A8E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2988-21-0x0000000006AD0000-0x0000000006B46000-memory.dmp

    Filesize

    472KB

    Download

  • memory/2988-13-0x00000000057A0000-0x00000000058AA000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/2988-17-0x00000000067E0000-0x00000000069A2000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/2988-18-0x0000000006EE0000-0x000000000740C000-memory.dmp

    Filesize

    5.2MB

    Download

  • memory/2988-19-0x00000000079C0000-0x0000000007F64000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/2988-20-0x00000000069B0000-0x0000000006A42000-memory.dmp

    Filesize

    584KB

    Download

  • memory/3620-0-0x0000000074ADE000-0x0000000074ADF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3620-1-0x0000000000470000-0x00000000004B4000-memory.dmp

    Filesize

    272KB

    Download

  • memory/3620-9-0x0000000074AD0000-0x0000000075280000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/3620-6-0x0000000074AD0000-0x0000000075280000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/3620-26-0x0000000074AD0000-0x0000000075280000-memory.dmp

    Filesize

    7.7MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.