Overview

overview

10

Static

static

3

35c135016a...ef.exe

windows10-2004-x64

10

3ab23a3036...c6.exe

windows10-2004-x64

10

3b8cd7306b...71.exe

windows10-2004-x64

10

3ea65c50a2...63.exe

windows7-x64

3

3ea65c50a2...63.exe

windows10-2004-x64

10

51c9916d6f...bf.exe

windows10-2004-x64

10

53cf9b6e16...08.exe

windows10-2004-x64

10

64792ffeec...35.exe

windows10-2004-x64

10

71d1420ff1...80.exe

windows10-2004-x64

10

7a08e2a624...2b.exe

windows10-2004-x64

10

7dbf05d83f...65.exe

windows7-x64

3

7dbf05d83f...65.exe

windows10-2004-x64

10

7f80787d38...fd.exe

windows10-2004-x64

10

9176ff0f1c...21.exe

windows10-2004-x64

10

babd836631...1d.exe

windows10-2004-x64

10

cbd8058875...48.exe

windows7-x64

3

cbd8058875...48.exe

windows10-2004-x64

10

d134576ca7...48.exe

windows10-2004-x64

10

da09729d57...e8.exe

windows10-2004-x64

10

dcfab037f7...a0.exe

windows10-2004-x64

10

eca60134d9...3f.exe

windows10-2004-x64

10

f16db96028...f1.exe

windows10-2004-x64

10

f5957f382e...6a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2024, 14:29 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f16db96028a7afeb1141a5506032310d36b0354cd63f796d585fdd9cd3b2c8f1.exe

  • Size

    920KB

  • MD5

    0bba6c5a8b9979a2241f1450ba08acac

  • SHA1

    823b3a858ce440a6b30ca707db2a28ef5596fdff

  • SHA256

    f16db96028a7afeb1141a5506032310d36b0354cd63f796d585fdd9cd3b2c8f1

  • SHA512

    8d23fc817ef2cb576610036221c22b4b7ab5697dad617de7bc6f656619e9764f9f126db0e02a2a79d7a55d2bdcca68477f77660d789d9676d7750aaa0692167c

  • SSDEEP

    12288:+Mr9y90+HbQau2ZVqMaLa1SZpRgJf+X+dPWgI8Fitq2UudtD79LEN6nt1S:7ydcoVY8SZp6JfRPHvFujZwN6na

Score
10/10
healerredlinelampdropperevasioninfostealerpersistencetrojan

Malware Config

Extracted

Family

redline

Botnet

lamp

C2

77.91.68.56:19071

Attributes
  • auth_value

    ee1df63bcdbe3de70f52810d94eaff7d

Signatures

  • Detects Healer an antivirus disabler dropper 1 IoCs
  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f16db96028a7afeb1141a5506032310d36b0354cd63f796d585fdd9cd3b2c8f1.exe
    "C:\Users\Admin\AppData\Local\Temp\f16db96028a7afeb1141a5506032310d36b0354cd63f796d585fdd9cd3b2c8f1.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3260
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2293620.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2293620.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2776
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y1680674.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y1680674.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3908
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k3968565.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k3968565.exe
          4⤵
          • Modifies Windows Defender Real-time Protection settings
          • Executes dropped EXE
          • Windows security modification
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4416
        • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7023074.exe
          C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7023074.exe
          4⤵
          • Executes dropped EXE
          PID:1324

Network

  • flag-us
    DNS
    217.106.137.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.106.137.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    0.204.248.87.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.204.248.87.in-addr.arpa
    IN PTR
    Response
    0.204.248.87.in-addr.arpa
    IN PTR
    https-87-248-204-0lhrllnwnet
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
    Response
    g.bing.com
    IN CNAME
    g-bing-com.dual-a-0034.a-msedge.net
    g-bing-com.dual-a-0034.a-msedge.net
    IN CNAME
    dual-a-0034.a-msedge.net
    dual-a-0034.a-msedge.net
    IN A
    204.79.197.237
    dual-a-0034.a-msedge.net
    IN A
    13.107.21.237
  • flag-us
    GET
    https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8Xb8a9N4kceONWdGOBx8MfDVUCUzxlNkLycRqxJ5CAWUSir6Z6OMYjcEyBQJv33ZKgadMYSrKKgDtr6KYNbnb5JOb5ZPrOXb_yO8kCYt6cooxoOQIgqpfroc5nn-Cnkxk5v27eubtjyG1PZ-wgqsrLb6Gn-Nk5U-V5uEayQN8AY_aXOBe%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D02784dcd3a761c628ebe2be694534bad&TIME=20240426T133809Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:3EBA0D95-A493-0C63-5584-F13F751694E4&deviceId=6966564702259644&muid=3EBA0D95A4930C635584F13F751694E4
    Remote address:
    204.79.197.237:443
    Request
    GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8Xb8a9N4kceONWdGOBx8MfDVUCUzxlNkLycRqxJ5CAWUSir6Z6OMYjcEyBQJv33ZKgadMYSrKKgDtr6KYNbnb5JOb5ZPrOXb_yO8kCYt6cooxoOQIgqpfroc5nn-Cnkxk5v27eubtjyG1PZ-wgqsrLb6Gn-Nk5U-V5uEayQN8AY_aXOBe%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D02784dcd3a761c628ebe2be694534bad&TIME=20240426T133809Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:3EBA0D95-A493-0C63-5584-F13F751694E4&deviceId=6966564702259644&muid=3EBA0D95A4930C635584F13F751694E4 HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MUID=137F2F827F606E302ABA3BF87E806F1E; domain=.bing.com; expires=Tue, 03-Jun-2025 14:29:34 GMT; path=/; SameSite=None; Secure; Priority=High;
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: B89DDD9BDF7E48B9A5EF2D03961C37B9 Ref B: LON04EDGE1214 Ref C: 2024-05-09T14:29:34Z
    date: Thu, 09 May 2024 14:29:33 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8Xb8a9N4kceONWdGOBx8MfDVUCUzxlNkLycRqxJ5CAWUSir6Z6OMYjcEyBQJv33ZKgadMYSrKKgDtr6KYNbnb5JOb5ZPrOXb_yO8kCYt6cooxoOQIgqpfroc5nn-Cnkxk5v27eubtjyG1PZ-wgqsrLb6Gn-Nk5U-V5uEayQN8AY_aXOBe%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D02784dcd3a761c628ebe2be694534bad&TIME=20240426T133809Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:3EBA0D95-A493-0C63-5584-F13F751694E4&deviceId=6966564702259644&muid=3EBA0D95A4930C635584F13F751694E4
    Remote address:
    204.79.197.237:443
    Request
    GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8Xb8a9N4kceONWdGOBx8MfDVUCUzxlNkLycRqxJ5CAWUSir6Z6OMYjcEyBQJv33ZKgadMYSrKKgDtr6KYNbnb5JOb5ZPrOXb_yO8kCYt6cooxoOQIgqpfroc5nn-Cnkxk5v27eubtjyG1PZ-wgqsrLb6Gn-Nk5U-V5uEayQN8AY_aXOBe%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D02784dcd3a761c628ebe2be694534bad&TIME=20240426T133809Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:3EBA0D95-A493-0C63-5584-F13F751694E4&deviceId=6966564702259644&muid=3EBA0D95A4930C635584F13F751694E4 HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=137F2F827F606E302ABA3BF87E806F1E; _EDGE_S=SID=2563DABFF344646A34CACEC5F242651C
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MSPTC=XhFy94XhlEitDav1I4QhSlP9Xqm5XIqv5TEQpSMD7jU; domain=.bing.com; expires=Tue, 03-Jun-2025 14:29:34 GMT; path=/; Partitioned; secure; SameSite=None
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 77C3907C792C4A75BDB9E1FA114F2F11 Ref B: LON04EDGE1214 Ref C: 2024-05-09T14:29:34Z
    date: Thu, 09 May 2024 14:29:34 GMT
  • flag-us
    DNS
    237.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    237.197.79.204.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    136.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    136.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-be
    GET
    https://www.bing.com/aes/c.gif?RG=a68ecbe8c991437291419f48752d7caa&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T133809Z&adUnitId=11730597&localId=w:3EBA0D95-A493-0C63-5584-F13F751694E4&deviceId=6966564702259644
    Remote address:
    88.221.83.192:443
    Request
    GET /aes/c.gif?RG=a68ecbe8c991437291419f48752d7caa&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T133809Z&adUnitId=11730597&localId=w:3EBA0D95-A493-0C63-5584-F13F751694E4&deviceId=6966564702259644 HTTP/2.0
    host: www.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=137F2F827F606E302ABA3BF87E806F1E
    Response
    HTTP/2.0 200
    cache-control: private,no-store
    pragma: no-cache
    vary: Origin
    p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 57139939C06B4D99944E03B6D9FED129 Ref B: LON212050719027 Ref C: 2024-05-09T14:29:34Z
    content-length: 0
    date: Thu, 09 May 2024 14:29:34 GMT
    set-cookie: _EDGE_S=SID=2563DABFF344646A34CACEC5F242651C; path=/; httponly; domain=bing.com
    set-cookie: MUIDB=137F2F827F606E302ABA3BF87E806F1E; path=/; httponly; expires=Tue, 03-Jun-2025 14:29:34 GMT
    alt-svc: h3=":443"; ma=93600
    x-cdn-traceid: 0.bc53dd58.1715264974.2e6e62f
  • flag-us
    DNS
    192.83.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    192.83.221.88.in-addr.arpa
    IN PTR
    Response
    192.83.221.88.in-addr.arpa
    IN PTR
    a88-221-83-192deploystaticakamaitechnologiescom
  • flag-be
    GET
    https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
    Remote address:
    88.221.83.192:443
    Request
    GET /th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
    host: www.bing.com
    accept: */*
    cookie: MUID=137F2F827F606E302ABA3BF87E806F1E; _EDGE_S=SID=2563DABFF344646A34CACEC5F242651C; MSPTC=XhFy94XhlEitDav1I4QhSlP9Xqm5XIqv5TEQpSMD7jU; MUIDB=137F2F827F606E302ABA3BF87E806F1E
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-type: image/png
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    content-length: 1107
    date: Thu, 09 May 2024 14:29:35 GMT
    alt-svc: h3=":443"; ma=93600
    x-cdn-traceid: 0.bc53dd58.1715264975.2e6eac5
  • flag-us
    DNS
    26.35.223.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    26.35.223.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    26.165.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    26.165.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    217.135.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.135.221.88.in-addr.arpa
    IN PTR
    Response
    217.135.221.88.in-addr.arpa
    IN PTR
    a88-221-135-217deploystaticakamaitechnologiescom
  • flag-us
    DNS
    133.211.185.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.211.185.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    dual-a-0001.a-msedge.net
    dual-a-0001.a-msedge.net
    IN A
    204.79.197.200
    dual-a-0001.a-msedge.net
    IN A
    13.107.21.200
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239360931611_1SOG5TNNJKE1WH1R0&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239360931611_1SOG5TNNJKE1WH1R0&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 621794
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 26585DC91F5940468AFAD5E5E9E278AE Ref B: LON04EDGE0916 Ref C: 2024-05-09T14:31:14Z
    date: Thu, 09 May 2024 14:31:14 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239340783933_1QOIM48UV8MGOV4SU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239340783933_1QOIM48UV8MGOV4SU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 638730
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 546ACA184DBF46B88641B71AB06DA1C3 Ref B: LON04EDGE0916 Ref C: 2024-05-09T14:31:14Z
    date: Thu, 09 May 2024 14:31:14 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239360931612_153L2SVWUYAQUME4E&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239360931612_153L2SVWUYAQUME4E&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 659775
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: BD8E7BB5C7B04D81ACDC87911756E3E5 Ref B: LON04EDGE0916 Ref C: 2024-05-09T14:31:14Z
    date: Thu, 09 May 2024 14:31:14 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239340783932_1JCHO8JLBZ4TPAX49&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239340783932_1JCHO8JLBZ4TPAX49&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 555746
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 93A459EC453C4EBFACE880B7E76F6CAF Ref B: LON04EDGE0916 Ref C: 2024-05-09T14:31:14Z
    date: Thu, 09 May 2024 14:31:14 GMT
  • flag-us
    DNS
    88.156.103.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.156.103.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    88.156.103.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.156.103.20.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    200.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.197.79.204.in-addr.arpa
    IN PTR
    Response
    200.197.79.204.in-addr.arpa
    IN PTR
    a-0001a-msedgenet
  • flag-us
    DNS
    104.193.132.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    104.193.132.51.in-addr.arpa
    IN PTR
    Response
  • 204.79.197.237:443
    https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8Xb8a9N4kceONWdGOBx8MfDVUCUzxlNkLycRqxJ5CAWUSir6Z6OMYjcEyBQJv33ZKgadMYSrKKgDtr6KYNbnb5JOb5ZPrOXb_yO8kCYt6cooxoOQIgqpfroc5nn-Cnkxk5v27eubtjyG1PZ-wgqsrLb6Gn-Nk5U-V5uEayQN8AY_aXOBe%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D02784dcd3a761c628ebe2be694534bad&TIME=20240426T133809Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:3EBA0D95-A493-0C63-5584-F13F751694E4&deviceId=6966564702259644&muid=3EBA0D95A4930C635584F13F751694E4
    tls, http2
    2.5kB
     9.0kB
     20
    16

    HTTP Request

    GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8Xb8a9N4kceONWdGOBx8MfDVUCUzxlNkLycRqxJ5CAWUSir6Z6OMYjcEyBQJv33ZKgadMYSrKKgDtr6KYNbnb5JOb5ZPrOXb_yO8kCYt6cooxoOQIgqpfroc5nn-Cnkxk5v27eubtjyG1PZ-wgqsrLb6Gn-Nk5U-V5uEayQN8AY_aXOBe%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D02784dcd3a761c628ebe2be694534bad&TIME=20240426T133809Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:3EBA0D95-A493-0C63-5584-F13F751694E4&deviceId=6966564702259644&muid=3EBA0D95A4930C635584F13F751694E4

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8Xb8a9N4kceONWdGOBx8MfDVUCUzxlNkLycRqxJ5CAWUSir6Z6OMYjcEyBQJv33ZKgadMYSrKKgDtr6KYNbnb5JOb5ZPrOXb_yO8kCYt6cooxoOQIgqpfroc5nn-Cnkxk5v27eubtjyG1PZ-wgqsrLb6Gn-Nk5U-V5uEayQN8AY_aXOBe%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D02784dcd3a761c628ebe2be694534bad&TIME=20240426T133809Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:3EBA0D95-A493-0C63-5584-F13F751694E4&deviceId=6966564702259644&muid=3EBA0D95A4930C635584F13F751694E4

    HTTP Response

    204
  • 88.221.83.192:443
    https://www.bing.com/aes/c.gif?RG=a68ecbe8c991437291419f48752d7caa&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T133809Z&adUnitId=11730597&localId=w:3EBA0D95-A493-0C63-5584-F13F751694E4&deviceId=6966564702259644
    tls, http2
    1.5kB
     5.4kB
     17
    12

    HTTP Request

    GET https://www.bing.com/aes/c.gif?RG=a68ecbe8c991437291419f48752d7caa&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T133809Z&adUnitId=11730597&localId=w:3EBA0D95-A493-0C63-5584-F13F751694E4&deviceId=6966564702259644

    HTTP Response

    200
  • 88.221.83.192:443
    https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
    tls, http2
    1.7kB
     6.4kB
     18
    13

    HTTP Request

    GET https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90

    HTTP Response

    200
  • 77.91.68.56:19071
    l7023074.exe
    260 B
     5
  • 77.91.68.56:19071
    l7023074.exe
    260 B
     5
  • 77.91.68.56:19071
    l7023074.exe
    260 B
     5
  • 77.91.68.56:19071
    l7023074.exe
    260 B
     5
  • 204.79.197.200:443
    https://tse1.mm.bing.net/th?id=OADD2.10239340783932_1JCHO8JLBZ4TPAX49&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    tls, http2
    94.5kB
     2.6MB
     1871
    1867

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239360931611_1SOG5TNNJKE1WH1R0&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239340783933_1QOIM48UV8MGOV4SU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239360931612_153L2SVWUYAQUME4E&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239340783932_1JCHO8JLBZ4TPAX49&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     8.1kB
     16
    14
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     8.1kB
     16
    14
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     8.1kB
     16
    14
  • 77.91.68.56:19071
    l7023074.exe
    260 B
     5
  • 77.91.68.56:19071
    l7023074.exe
    208 B
     4
  • 8.8.8.8:53
    217.106.137.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    217.106.137.52.in-addr.arpa

  • 8.8.8.8:53
    0.204.248.87.in-addr.arpa
    dns
    71 B
     116 B
     1
    1

    DNS Request

    0.204.248.87.in-addr.arpa

  • 8.8.8.8:53
    g.bing.com
    dns
    56 B
     151 B
     1
    1

    DNS Request

    g.bing.com

    DNS Response

    204.79.197.237
    13.107.21.237

  • 8.8.8.8:53
    237.197.79.204.in-addr.arpa
    dns
    73 B
     143 B
     1
    1

    DNS Request

    237.197.79.204.in-addr.arpa

  • 8.8.8.8:53
    136.32.126.40.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    136.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    192.83.221.88.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    192.83.221.88.in-addr.arpa

  • 8.8.8.8:53
    26.35.223.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    26.35.223.20.in-addr.arpa

  • 8.8.8.8:53
    26.165.165.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    26.165.165.52.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    217.135.221.88.in-addr.arpa
    dns
    73 B
     139 B
     1
    1

    DNS Request

    217.135.221.88.in-addr.arpa

  • 8.8.8.8:53
    133.211.185.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    133.211.185.52.in-addr.arpa

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    62 B
     173 B
     1
    1

    DNS Request

    tse1.mm.bing.net

    DNS Response

    204.79.197.200
    13.107.21.200

  • 8.8.8.8:53
    88.156.103.20.in-addr.arpa
    dns
    144 B
     158 B
     2
    1

    DNS Request

    88.156.103.20.in-addr.arpa

    DNS Request

    88.156.103.20.in-addr.arpa

  • 8.8.8.8:53
    200.197.79.204.in-addr.arpa
    dns
    73 B
     106 B
     1
    1

    DNS Request

    200.197.79.204.in-addr.arpa

  • 8.8.8.8:53
    104.193.132.51.in-addr.arpa
    dns
    73 B
     159 B
     1
    1

    DNS Request

    104.193.132.51.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\System.dll.log
    Filesize

    226B

    MD5

    916851e072fbabc4796d8916c5131092

    SHA1

    d48a602229a690c512d5fdaf4c8d77547a88e7a2

    SHA256

    7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

    SHA512

    07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y2293620.exe
    Filesize

    765KB

    MD5

    18e389e79f96cbe2d759c734d3e49e78

    SHA1

    50cb298fd91a90ebf2bac3bde37b6d77cca4267d

    SHA256

    48fd34f5c8037fad88d01fc9863612f020fbc15409efca49d40f7e91639d33ff

    SHA512

    ac4e859905944e6b2e868207279aa880aeb6fd0ad2aa962f59f7c89285b7c99be54a35166df5d64174bcea5f718e4e4a277e0d39d568093033d1903dc4610b79

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\y1680674.exe
    Filesize

    582KB

    MD5

    68067bec765ac70f1c242f4c4046c282

    SHA1

    ff713e405ab12cde47cbaf932cf1cb87e557c956

    SHA256

    2bd9ad30ef9ab2fc56a38f9487a2466f5f4d031f2bbb4d3e44668958433bc79a

    SHA512

    d8d04c652650d26d12caeadbbd2dea80ac31c039f79a415035ad40f4fea08fd2ef07ea01a7b3d03ef8518dc8df8b135bd035a144e9b50d391c1da5e755922016

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\k3968565.exe
    Filesize

    294KB

    MD5

    8da17d71715c495fb0be1adf72311636

    SHA1

    87f0490b70f70fd36e00bb7d2d7ff279119296fd

    SHA256

    5c02f1c047f26359ace7383a60bec2b7f4cc68c8948007e12f8a7757d6b309d2

    SHA512

    3db56898bdee039a7d1fd374852a564e39ea97469a72203e0d3e0c18862a90475f51390c617f05d0a04f9531e0b785e625549caea0f484063029c25ab2c59b93

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\l7023074.exe
    Filesize

    491KB

    MD5

    01e3487170c4d9d1da491a231157e6fd

    SHA1

    12d851baae91313bcae4da1d254cf5a8a8a424a1

    SHA256

    952c7cdd3f35e9c7ff35b78ac3bcf2e3fd6be449a8d017f515b1262c3697fbb6

    SHA512

    f98cd58a23a26f76196bb95849a2d0eb435e10702f5bf1d0d17f8cfbc0eeb94f3be6e1da1780eca081215a87c30f40270ba0ab2b5f9b777910b104e1a29785a9

    Download Submit

  • memory/1324-45-0x0000000005010000-0x0000000005628000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/1324-35-0x0000000002010000-0x000000000209C000-memory.dmp

    Filesize

    560KB

    Download

  • memory/1324-44-0x0000000002530000-0x0000000002536000-memory.dmp

    Filesize

    24KB

    Download

  • memory/1324-42-0x0000000002010000-0x000000000209C000-memory.dmp

    Filesize

    560KB

    Download

  • memory/1324-46-0x0000000004A80000-0x0000000004B8A000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/1324-47-0x0000000004BB0000-0x0000000004BC2000-memory.dmp

    Filesize

    72KB

    Download

  • memory/1324-48-0x0000000004BD0000-0x0000000004C0C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/1324-49-0x0000000004C40000-0x0000000004C8C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/4416-29-0x0000000002300000-0x0000000002301000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4416-28-0x0000000000680000-0x00000000006BE000-memory.dmp

    Filesize

    248KB

    Download

  • memory/4416-22-0x0000000000680000-0x00000000006BE000-memory.dmp

    Filesize

    248KB

    Download

  • memory/4416-21-0x0000000000401000-0x0000000000404000-memory.dmp

    Filesize

    12KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.