Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

2f4f27acfa...18.exe

windows7-x64

10

2f4f27acfa...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    142s
  • max time network
    107s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/05/2024, 13:21 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2f4f27acfae56f146ba7393a8fc887f0_JaffaCakes118.exe

  • Size

    221KB

  • MD5

    2f4f27acfae56f146ba7393a8fc887f0

  • SHA1

    566da5138de6eb3b8b861e34d97257b7aec7694e

  • SHA256

    a013e5b6e43bc4750717d163538acbdbba5723d3a558824a8858242284be2881

  • SHA512

    9e7df640fc6dbdd1fc6d7b266a2a5d44ec244fc82bf717649a5d527b69a141dffc409cd82835463e5a6f5c24a95ed248fc2068cd2eb90655bc18ff39de4d0c3e

  • SSDEEP

    3072:1hr+qQIVD6v5T8m5bIEyrVJJ3DgKLZXTRncOLPiKTyRGcpSO2PfT:1hKqLVD2wrF3DHVXTJcOLPioWDu

Score
10/10
azorultinfostealertrojan

Malware Config

Extracted

Family

azorult

C2

http://gtfurobertopol.org/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2f4f27acfae56f146ba7393a8fc887f0_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\2f4f27acfae56f146ba7393a8fc887f0_JaffaCakes118.exe"
    1⤵
      PID:3828
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3828 -s 1380
        2⤵
        • Program crash
        PID:976
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3828 -ip 3828
      1⤵
        PID:3092

      Network

      • flag-us
        DNS
        g.bing.com
        Remote address:
        8.8.8.8:53
        Request
        g.bing.com
        IN A
        Response
        g.bing.com
        IN CNAME
        g-bing-com.dual-a-0034.a-msedge.net
        g-bing-com.dual-a-0034.a-msedge.net
        IN CNAME
        dual-a-0034.a-msedge.net
        dual-a-0034.a-msedge.net
        IN A
        204.79.197.237
        dual-a-0034.a-msedge.net
        IN A
        13.107.21.237
      • flag-us
        GET
        https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De80ydgclGCA02PaeRDLid-xDVUCUyZO_GkXx3JUma5QKTDzpGGaEpuJMn7jYk-aMoqP9jEZZIMpOU94w297qd5EOBpXhLz6Vk_SvqZt3FZZSYEpXVBxwuQjUi6mY_0YZ57sK5PUSkyBWrHs3rTX_xINCQWHzS2bRU0yPdIYgTvSiwYCcwI%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D8be18068810d1e9e1426e64331032712&TIME=20240426T134647Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:3EBA0D95-A493-0C63-5584-F13F751694E4&deviceId=6966564702259644&muid=3EBA0D95A4930C635584F13F751694E4
        Remote address:
        204.79.197.237:443
        Request
        GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De80ydgclGCA02PaeRDLid-xDVUCUyZO_GkXx3JUma5QKTDzpGGaEpuJMn7jYk-aMoqP9jEZZIMpOU94w297qd5EOBpXhLz6Vk_SvqZt3FZZSYEpXVBxwuQjUi6mY_0YZ57sK5PUSkyBWrHs3rTX_xINCQWHzS2bRU0yPdIYgTvSiwYCcwI%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D8be18068810d1e9e1426e64331032712&TIME=20240426T134647Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:3EBA0D95-A493-0C63-5584-F13F751694E4&deviceId=6966564702259644&muid=3EBA0D95A4930C635584F13F751694E4 HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        set-cookie: MUID=2CA0622ABC56688A37617651BD71697A; domain=.bing.com; expires=Wed, 04-Jun-2025 13:23:39 GMT; path=/; SameSite=None; Secure; Priority=High;
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: BFEEC43B8217464B96CCA0B17F187ACF Ref B: LON04EDGE0712 Ref C: 2024-05-10T13:23:39Z
        date: Fri, 10 May 2024 13:23:38 GMT
      • flag-us
        GET
        https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De80ydgclGCA02PaeRDLid-xDVUCUyZO_GkXx3JUma5QKTDzpGGaEpuJMn7jYk-aMoqP9jEZZIMpOU94w297qd5EOBpXhLz6Vk_SvqZt3FZZSYEpXVBxwuQjUi6mY_0YZ57sK5PUSkyBWrHs3rTX_xINCQWHzS2bRU0yPdIYgTvSiwYCcwI%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D8be18068810d1e9e1426e64331032712&TIME=20240426T134647Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:3EBA0D95-A493-0C63-5584-F13F751694E4&deviceId=6966564702259644&muid=3EBA0D95A4930C635584F13F751694E4
        Remote address:
        204.79.197.237:443
        Request
        GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De80ydgclGCA02PaeRDLid-xDVUCUyZO_GkXx3JUma5QKTDzpGGaEpuJMn7jYk-aMoqP9jEZZIMpOU94w297qd5EOBpXhLz6Vk_SvqZt3FZZSYEpXVBxwuQjUi6mY_0YZ57sK5PUSkyBWrHs3rTX_xINCQWHzS2bRU0yPdIYgTvSiwYCcwI%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D8be18068810d1e9e1426e64331032712&TIME=20240426T134647Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:3EBA0D95-A493-0C63-5584-F13F751694E4&deviceId=6966564702259644&muid=3EBA0D95A4930C635584F13F751694E4 HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=2CA0622ABC56688A37617651BD71697A; _EDGE_S=SID=1D95F0D57F3462A304CAE4AE7E976378
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        set-cookie: MSPTC=B6lSushSfIdh-HZSgOGgMFxUmYjU2vt_kiI2l14njAU; domain=.bing.com; expires=Wed, 04-Jun-2025 13:23:39 GMT; path=/; Partitioned; secure; SameSite=None
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 309C1C4EAAFA47D7ADAE5BDA28B433B4 Ref B: LON04EDGE0712 Ref C: 2024-05-10T13:23:39Z
        date: Fri, 10 May 2024 13:23:39 GMT
      • flag-us
        DNS
        237.197.79.204.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        237.197.79.204.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        77.190.18.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        77.190.18.2.in-addr.arpa
        IN PTR
        Response
        77.190.18.2.in-addr.arpa
        IN PTR
        a2-18-190-77deploystaticakamaitechnologiescom
      • flag-us
        DNS
        13.86.106.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        13.86.106.20.in-addr.arpa
        IN PTR
        Response
      • flag-be
        GET
        https://www.bing.com/aes/c.gif?RG=38ccf3c3534247f1bc41d63a16b4717e&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T134647Z&adUnitId=11730597&localId=w:3EBA0D95-A493-0C63-5584-F13F751694E4&deviceId=6966564702259644
        Remote address:
        88.221.83.217:443
        Request
        GET /aes/c.gif?RG=38ccf3c3534247f1bc41d63a16b4717e&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T134647Z&adUnitId=11730597&localId=w:3EBA0D95-A493-0C63-5584-F13F751694E4&deviceId=6966564702259644 HTTP/2.0
        host: www.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=2CA0622ABC56688A37617651BD71697A
        Response
        HTTP/2.0 200
        cache-control: private,no-store
        pragma: no-cache
        vary: Origin
        p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 670C0A7188874E7CB16A383CD6A40C0E Ref B: AMS04EDGE2014 Ref C: 2024-05-10T13:23:39Z
        content-length: 0
        date: Fri, 10 May 2024 13:23:39 GMT
        set-cookie: _EDGE_S=SID=1D95F0D57F3462A304CAE4AE7E976378; path=/; httponly; domain=bing.com
        set-cookie: MUIDB=2CA0622ABC56688A37617651BD71697A; path=/; httponly; expires=Wed, 04-Jun-2025 13:23:39 GMT
        alt-svc: h3=":443"; ma=93600
        x-cdn-traceid: 0.d553dd58.1715347419.a4c0c6e
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        gtfurobertopol.org
        2f4f27acfae56f146ba7393a8fc887f0_JaffaCakes118.exe
        Remote address:
        8.8.8.8:53
        Request
        gtfurobertopol.org
        IN A
        Response
      • flag-us
        DNS
        gtfurobertopol.org
        2f4f27acfae56f146ba7393a8fc887f0_JaffaCakes118.exe
        Remote address:
        8.8.8.8:53
        Request
        gtfurobertopol.org
        IN A
        Response
      • flag-us
        DNS
        20.160.190.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        20.160.190.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        217.83.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        217.83.221.88.in-addr.arpa
        IN PTR
        Response
        217.83.221.88.in-addr.arpa
        IN PTR
        a88-221-83-217deploystaticakamaitechnologiescom
      • flag-us
        DNS
        138.201.86.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        138.201.86.20.in-addr.arpa
        IN PTR
        Response
      • flag-be
        GET
        https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
        Remote address:
        88.221.83.192:443
        Request
        GET /th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
        host: www.bing.com
        accept: */*
        cookie: MUID=2CA0622ABC56688A37617651BD71697A; _EDGE_S=SID=1D95F0D57F3462A304CAE4AE7E976378; MSPTC=B6lSushSfIdh-HZSgOGgMFxUmYjU2vt_kiI2l14njAU; MUIDB=2CA0622ABC56688A37617651BD71697A
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-type: image/png
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        content-length: 1107
        date: Fri, 10 May 2024 13:23:41 GMT
        alt-svc: h3=":443"; ma=93600
        x-cdn-traceid: 0.bc53dd58.1715347421.89401c9
      • flag-us
        DNS
        192.83.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        192.83.221.88.in-addr.arpa
        IN PTR
        Response
        192.83.221.88.in-addr.arpa
        IN PTR
        a88-221-83-192deploystaticakamaitechnologiescom
      • flag-us
        DNS
        133.211.185.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        133.211.185.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        50.23.12.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        50.23.12.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        15.164.165.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        15.164.165.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        24.121.18.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        24.121.18.2.in-addr.arpa
        IN PTR
        Response
        24.121.18.2.in-addr.arpa
        IN PTR
        a2-18-121-24deploystaticakamaitechnologiescom
      • flag-us
        DNS
        205.47.74.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        205.47.74.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        172.210.232.199.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        172.210.232.199.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        tse1.mm.bing.net
        Remote address:
        8.8.8.8:53
        Request
        tse1.mm.bing.net
        IN A
        Response
        tse1.mm.bing.net
        IN CNAME
        mm-mm.bing.net.trafficmanager.net
        mm-mm.bing.net.trafficmanager.net
        IN CNAME
        dual-a-0001.a-msedge.net
        dual-a-0001.a-msedge.net
        IN A
        204.79.197.200
        dual-a-0001.a-msedge.net
        IN A
        13.107.21.200
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239381705589_1UZ6HI7DU1RQLXLFR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239381705589_1UZ6HI7DU1RQLXLFR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 499516
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: DC7FE5C04C2C41FD82558053ED1C28CC Ref B: LON04EDGE0616 Ref C: 2024-05-10T13:25:19Z
        date: Fri, 10 May 2024 13:25:18 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239381705588_1WA9C34P2B6OXP331&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239381705588_1WA9C34P2B6OXP331&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 476246
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 26D4D942D58748C19CC540C1A339A3EF Ref B: LON04EDGE0616 Ref C: 2024-05-10T13:25:19Z
        date: Fri, 10 May 2024 13:25:18 GMT
      • flag-us
        DNS
        26.35.223.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        26.35.223.20.in-addr.arpa
        IN PTR
        Response
      • 204.79.197.237:443
        https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De80ydgclGCA02PaeRDLid-xDVUCUyZO_GkXx3JUma5QKTDzpGGaEpuJMn7jYk-aMoqP9jEZZIMpOU94w297qd5EOBpXhLz6Vk_SvqZt3FZZSYEpXVBxwuQjUi6mY_0YZ57sK5PUSkyBWrHs3rTX_xINCQWHzS2bRU0yPdIYgTvSiwYCcwI%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D8be18068810d1e9e1426e64331032712&TIME=20240426T134647Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:3EBA0D95-A493-0C63-5584-F13F751694E4&deviceId=6966564702259644&muid=3EBA0D95A4930C635584F13F751694E4
        tls, http2
        2.5kB
         9.0kB
         20
        17

        HTTP Request

        GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De80ydgclGCA02PaeRDLid-xDVUCUyZO_GkXx3JUma5QKTDzpGGaEpuJMn7jYk-aMoqP9jEZZIMpOU94w297qd5EOBpXhLz6Vk_SvqZt3FZZSYEpXVBxwuQjUi6mY_0YZ57sK5PUSkyBWrHs3rTX_xINCQWHzS2bRU0yPdIYgTvSiwYCcwI%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D8be18068810d1e9e1426e64331032712&TIME=20240426T134647Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:3EBA0D95-A493-0C63-5584-F13F751694E4&deviceId=6966564702259644&muid=3EBA0D95A4930C635584F13F751694E4

        HTTP Response

        204

        HTTP Request

        GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De80ydgclGCA02PaeRDLid-xDVUCUyZO_GkXx3JUma5QKTDzpGGaEpuJMn7jYk-aMoqP9jEZZIMpOU94w297qd5EOBpXhLz6Vk_SvqZt3FZZSYEpXVBxwuQjUi6mY_0YZ57sK5PUSkyBWrHs3rTX_xINCQWHzS2bRU0yPdIYgTvSiwYCcwI%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D8be18068810d1e9e1426e64331032712&TIME=20240426T134647Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:3EBA0D95-A493-0C63-5584-F13F751694E4&deviceId=6966564702259644&muid=3EBA0D95A4930C635584F13F751694E4

        HTTP Response

        204
      • 88.221.83.217:443
        https://www.bing.com/aes/c.gif?RG=38ccf3c3534247f1bc41d63a16b4717e&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T134647Z&adUnitId=11730597&localId=w:3EBA0D95-A493-0C63-5584-F13F751694E4&deviceId=6966564702259644
        tls, http2
        1.5kB
         5.4kB
         17
        12

        HTTP Request

        GET https://www.bing.com/aes/c.gif?RG=38ccf3c3534247f1bc41d63a16b4717e&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T134647Z&adUnitId=11730597&localId=w:3EBA0D95-A493-0C63-5584-F13F751694E4&deviceId=6966564702259644

        HTTP Response

        200
      • 88.221.83.192:443
        https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
        tls, http2
        1.7kB
         6.4kB
         18
        13

        HTTP Request

        GET https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90

        HTTP Response

        200
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         8.1kB
         16
        13
      • 204.79.197.200:443
        https://tse1.mm.bing.net/th?id=OADD2.10239381705588_1WA9C34P2B6OXP331&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        tls, http2
        35.0kB
         1.0MB
         742
        739

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239381705589_1UZ6HI7DU1RQLXLFR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239381705588_1WA9C34P2B6OXP331&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

        HTTP Response

        200

        HTTP Response

        200
      • 8.8.8.8:53
        g.bing.com
        dns
        56 B
         151 B
         1
        1

        DNS Request

        g.bing.com

        DNS Response

        204.79.197.237
        13.107.21.237

      • 8.8.8.8:53
        237.197.79.204.in-addr.arpa
        dns
        73 B
         143 B
         1
        1

        DNS Request

        237.197.79.204.in-addr.arpa

      • 8.8.8.8:53
        77.190.18.2.in-addr.arpa
        dns
        70 B
         133 B
         1
        1

        DNS Request

        77.190.18.2.in-addr.arpa

      • 8.8.8.8:53
        13.86.106.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        13.86.106.20.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
         144 B
         1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        gtfurobertopol.org
        dns
        2f4f27acfae56f146ba7393a8fc887f0_JaffaCakes118.exe
        64 B
         146 B
         1
        1

        DNS Request

        gtfurobertopol.org

      • 8.8.8.8:53
        gtfurobertopol.org
        dns
        2f4f27acfae56f146ba7393a8fc887f0_JaffaCakes118.exe
        64 B
         146 B
         1
        1

        DNS Request

        gtfurobertopol.org

      • 8.8.8.8:53
        20.160.190.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        20.160.190.20.in-addr.arpa

      • 8.8.8.8:53
        217.83.221.88.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        217.83.221.88.in-addr.arpa

      • 8.8.8.8:53
        138.201.86.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        138.201.86.20.in-addr.arpa

      • 8.8.8.8:53
        192.83.221.88.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        192.83.221.88.in-addr.arpa

      • 8.8.8.8:53
        133.211.185.52.in-addr.arpa
        dns
        73 B
         147 B
         1
        1

        DNS Request

        133.211.185.52.in-addr.arpa

      • 8.8.8.8:53
        50.23.12.20.in-addr.arpa
        dns
        70 B
         156 B
         1
        1

        DNS Request

        50.23.12.20.in-addr.arpa

      • 8.8.8.8:53
        15.164.165.52.in-addr.arpa
        dns
        72 B
         146 B
         1
        1

        DNS Request

        15.164.165.52.in-addr.arpa

      • 8.8.8.8:53
        24.121.18.2.in-addr.arpa
        dns
        70 B
         133 B
         1
        1

        DNS Request

        24.121.18.2.in-addr.arpa

      • 8.8.8.8:53
        205.47.74.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        205.47.74.20.in-addr.arpa

      • 8.8.8.8:53
        172.210.232.199.in-addr.arpa
        dns
        74 B
         128 B
         1
        1

        DNS Request

        172.210.232.199.in-addr.arpa

      • 8.8.8.8:53
        tse1.mm.bing.net
        dns
        62 B
         173 B
         1
        1

        DNS Request

        tse1.mm.bing.net

        DNS Response

        204.79.197.200
        13.107.21.200

      • 8.8.8.8:53
        26.35.223.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        26.35.223.20.in-addr.arpa

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/3828-2-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/3828-1-0x0000000000980000-0x0000000000A80000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/3828-4-0x0000000000400000-0x0000000000420000-memory.dmp

        Filesize

        128KB

        Download

      • memory/3828-3-0x0000000000400000-0x0000000000920000-memory.dmp

        Filesize

        5.1MB

        Download

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.