Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

07ebb70eb0...5f.exe

windows7-x64

3

07ebb70eb0...5f.exe

windows10-2004-x64

10

0b4bb67302...ca.exe

windows10-2004-x64

9

0fbb8ff4cb...49.exe

windows10-2004-x64

10

108e20eafa...c7.exe

windows7-x64

3

108e20eafa...c7.exe

windows10-2004-x64

10

1522207077...0f.exe

windows10-2004-x64

10

23fcf9bc69...25.exe

windows10-2004-x64

10

2ca9135451...23.exe

windows7-x64

3

2ca9135451...23.exe

windows10-2004-x64

10

42f53acaac...33.exe

windows10-2004-x64

10

45af188d23...c0.exe

windows10-2004-x64

10

82fa18f52c...32.exe

windows7-x64

3

82fa18f52c...32.exe

windows10-2004-x64

10

8672d19897...4f.exe

windows10-2004-x64

10

8ceedf9abd...f7.exe

windows10-2004-x64

10

99cc81196c...15.exe

windows7-x64

3

99cc81196c...15.exe

windows10-2004-x64

10

a2aa61942b...83.exe

windows7-x64

3

a2aa61942b...83.exe

windows10-2004-x64

10

c467adbd48...9e.exe

windows10-2004-x64

10

f7dfe59831...a0.exe

windows10-2004-x64

10

fc29a80a1c...7d.exe

windows10-2004-x64

10

fdc14a13fe...6d.exe

windows7-x64

fdc14a13fe...6d.exe

windows10-2004-x64

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/05/2024, 10:00 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    42f53acaac143c0dc23d3b1f603e96b42301e6fe138cc5cbee3f2db8f619ba33.exe

  • Size

    316KB

  • MD5

    f4ab419fe0ec588cd73be7d2453fd89f

  • SHA1

    d16b306445962fa9457bac9871813321fd43d0cc

  • SHA256

    42f53acaac143c0dc23d3b1f603e96b42301e6fe138cc5cbee3f2db8f619ba33

  • SHA512

    85b8e503ad455cc21cbf225f3b15e8596b1718068a902c7250761697f215eee8447196b6ad5a719c3957e461ad8e8ca5b416f94491f318bd82121b6c3313c64d

  • SSDEEP

    6144:Kny+bnr+tp0yN90QEn6vZrMgX3eYK41E8OBURKaJ+c:ZMrly909mN3rKWOmEakc

Score
10/10
redlinedebroevasioninfostealerpersistencetrojan

Malware Config

Extracted

Family

redline

Botnet

debro

C2

185.161.248.75:4132

Attributes
  • auth_value

    18c2c191aebfde5d1787ec8d805a01a8

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\42f53acaac143c0dc23d3b1f603e96b42301e6fe138cc5cbee3f2db8f619ba33.exe
    "C:\Users\Admin\AppData\Local\Temp\42f53acaac143c0dc23d3b1f603e96b42301e6fe138cc5cbee3f2db8f619ba33.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:3260
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\k0950715.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\k0950715.exe
      2⤵
      • Modifies Windows Defender Real-time Protection settings
      • Executes dropped EXE
      • Windows security modification
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2292
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l9855743.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l9855743.exe
      2⤵
      • Executes dropped EXE
      PID:1800

Network

  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    77.190.18.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    77.190.18.2.in-addr.arpa
    IN PTR
    Response
    77.190.18.2.in-addr.arpa
    IN PTR
    a2-18-190-77deploystaticakamaitechnologiescom
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
    Response
    g.bing.com
    IN CNAME
    g-bing-com.dual-a-0034.a-msedge.net
    g-bing-com.dual-a-0034.a-msedge.net
    IN CNAME
    dual-a-0034.a-msedge.net
    dual-a-0034.a-msedge.net
    IN A
    204.79.197.237
    dual-a-0034.a-msedge.net
    IN A
    13.107.21.237
  • flag-us
    GET
    https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8zjwuZz-GKb4O1UdGgG973zVUCUzbtxkLGtjeepRHT2eYr8EXaPUp8Hp4sdlCk8TflZTjdQfzBKbVQJFfnRbdF0VVdeU9ynqU46TzflVE5aMPOLsy7tVim4n2w95lfrXzJPu6tPSP-7RouaNartZjbeCISgIvUZzINssrTmNDBaj7lhFO%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D9972c90b239618a31e3aaf2091708c7c&TIME=20240426T135829Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038&muid=416143B6C3858B3296EFB62827C91949
    Remote address:
    204.79.197.237:443
    Request
    GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8zjwuZz-GKb4O1UdGgG973zVUCUzbtxkLGtjeepRHT2eYr8EXaPUp8Hp4sdlCk8TflZTjdQfzBKbVQJFfnRbdF0VVdeU9ynqU46TzflVE5aMPOLsy7tVim4n2w95lfrXzJPu6tPSP-7RouaNartZjbeCISgIvUZzINssrTmNDBaj7lhFO%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D9972c90b239618a31e3aaf2091708c7c&TIME=20240426T135829Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038&muid=416143B6C3858B3296EFB62827C91949 HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MUID=1F91EEA3DAE968371139FADDDB0969FA; domain=.bing.com; expires=Sat, 07-Jun-2025 10:01:07 GMT; path=/; SameSite=None; Secure; Priority=High;
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: F81641BAA99F42BEBF80D75611CA9357 Ref B: LON04EDGE1111 Ref C: 2024-05-13T10:01:07Z
    date: Mon, 13 May 2024 10:01:07 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8zjwuZz-GKb4O1UdGgG973zVUCUzbtxkLGtjeepRHT2eYr8EXaPUp8Hp4sdlCk8TflZTjdQfzBKbVQJFfnRbdF0VVdeU9ynqU46TzflVE5aMPOLsy7tVim4n2w95lfrXzJPu6tPSP-7RouaNartZjbeCISgIvUZzINssrTmNDBaj7lhFO%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D9972c90b239618a31e3aaf2091708c7c&TIME=20240426T135829Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038&muid=416143B6C3858B3296EFB62827C91949
    Remote address:
    204.79.197.237:443
    Request
    GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8zjwuZz-GKb4O1UdGgG973zVUCUzbtxkLGtjeepRHT2eYr8EXaPUp8Hp4sdlCk8TflZTjdQfzBKbVQJFfnRbdF0VVdeU9ynqU46TzflVE5aMPOLsy7tVim4n2w95lfrXzJPu6tPSP-7RouaNartZjbeCISgIvUZzINssrTmNDBaj7lhFO%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D9972c90b239618a31e3aaf2091708c7c&TIME=20240426T135829Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038&muid=416143B6C3858B3296EFB62827C91949 HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=1F91EEA3DAE968371139FADDDB0969FA; _EDGE_S=SID=21768187A2A56E73356F95F9A3A36FFD
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MSPTC=Uq-tlgcfyyzuHuw9JUpBDkrGG24OEC9pxXeyzox1vLk; domain=.bing.com; expires=Sat, 07-Jun-2025 10:01:08 GMT; path=/; Partitioned; secure; SameSite=None
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 03E6CB3FED0640A3B23536F1FB8024AA Ref B: LON04EDGE1111 Ref C: 2024-05-13T10:01:08Z
    date: Mon, 13 May 2024 10:01:07 GMT
  • flag-be
    GET
    https://www.bing.com/aes/c.gif?RG=0a018e8082d94d07ad552b0327603ad3&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T135829Z&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038
    Remote address:
    88.221.83.251:443
    Request
    GET /aes/c.gif?RG=0a018e8082d94d07ad552b0327603ad3&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T135829Z&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038 HTTP/2.0
    host: www.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=1F91EEA3DAE968371139FADDDB0969FA
    Response
    HTTP/2.0 200
    cache-control: private,no-store
    pragma: no-cache
    vary: Origin
    p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 3AB60F70EED643C89150765E60A49BB7 Ref B: LON212050702035 Ref C: 2024-05-13T10:01:08Z
    content-length: 0
    date: Mon, 13 May 2024 10:01:08 GMT
    set-cookie: _EDGE_S=SID=21768187A2A56E73356F95F9A3A36FFD; path=/; httponly; domain=bing.com
    set-cookie: MUIDB=1F91EEA3DAE968371139FADDDB0969FA; path=/; httponly; expires=Sat, 07-Jun-2025 10:01:08 GMT
    alt-svc: h3=":443"; ma=93600
    x-cdn-traceid: 0.f753dd58.1715594468.c7bf15e
  • flag-us
    DNS
    237.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    237.197.79.204.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    133.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    251.83.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    251.83.221.88.in-addr.arpa
    IN PTR
    Response
    251.83.221.88.in-addr.arpa
    IN PTR
    a88-221-83-251deploystaticakamaitechnologiescom
  • flag-be
    GET
    https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
    Remote address:
    88.221.83.251:443
    Request
    GET /th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
    host: www.bing.com
    accept: */*
    cookie: MUID=1F91EEA3DAE968371139FADDDB0969FA; _EDGE_S=SID=21768187A2A56E73356F95F9A3A36FFD; MSPTC=Uq-tlgcfyyzuHuw9JUpBDkrGG24OEC9pxXeyzox1vLk; MUIDB=1F91EEA3DAE968371139FADDDB0969FA
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-type: image/png
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    content-length: 1107
    date: Mon, 13 May 2024 10:01:09 GMT
    alt-svc: h3=":443"; ma=93600
    x-cdn-traceid: 0.f753dd58.1715594469.c7bf5e0
  • flag-us
    DNS
    26.35.223.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    26.35.223.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    86.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    86.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    133.211.185.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.211.185.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    79.190.18.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    79.190.18.2.in-addr.arpa
    IN PTR
    Response
    79.190.18.2.in-addr.arpa
    IN PTR
    a2-18-190-79deploystaticakamaitechnologiescom
  • flag-us
    DNS
    205.47.74.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    205.47.74.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    19.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    19.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    dual-a-0001.a-msedge.net
    dual-a-0001.a-msedge.net
    IN A
    204.79.197.200
    dual-a-0001.a-msedge.net
    IN A
    13.107.21.200
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239381705588_1WA9C34P2B6OXP331&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239381705588_1WA9C34P2B6OXP331&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 476246
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 5955627A4C124CDD93575D43B9B3340B Ref B: LON04EDGE0607 Ref C: 2024-05-13T10:02:47Z
    date: Mon, 13 May 2024 10:02:46 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239381705589_1UZ6HI7DU1RQLXLFR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239381705589_1UZ6HI7DU1RQLXLFR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 464243
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 50ABF200C8C9423F9A9C8AC59B9F5EC5 Ref B: LON04EDGE0607 Ref C: 2024-05-13T10:02:47Z
    date: Mon, 13 May 2024 10:02:46 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239381702593_1BLW9LYE0FMIB48EX&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239381702593_1BLW9LYE0FMIB48EX&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 499516
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 3C785381D97340C1874EC95C42087DC2 Ref B: LON04EDGE0607 Ref C: 2024-05-13T10:02:47Z
    date: Mon, 13 May 2024 10:02:46 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239381702592_1OT5ET7HCG1M9EIRY&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239381702592_1OT5ET7HCG1M9EIRY&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 382817
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 20DA0ADBD848459796B6D734EF9A7119 Ref B: LON04EDGE0607 Ref C: 2024-05-13T10:02:47Z
    date: Mon, 13 May 2024 10:02:46 GMT
  • flag-us
    DNS
    200.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.197.79.204.in-addr.arpa
    IN PTR
    Response
    200.197.79.204.in-addr.arpa
    IN PTR
    a-0001a-msedgenet
  • flag-us
    DNS
    25.73.42.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    25.73.42.20.in-addr.arpa
    IN PTR
    Response
  • 204.79.197.237:443
    https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8zjwuZz-GKb4O1UdGgG973zVUCUzbtxkLGtjeepRHT2eYr8EXaPUp8Hp4sdlCk8TflZTjdQfzBKbVQJFfnRbdF0VVdeU9ynqU46TzflVE5aMPOLsy7tVim4n2w95lfrXzJPu6tPSP-7RouaNartZjbeCISgIvUZzINssrTmNDBaj7lhFO%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D9972c90b239618a31e3aaf2091708c7c&TIME=20240426T135829Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038&muid=416143B6C3858B3296EFB62827C91949
    tls, http2
    2.5kB
     9.0kB
     20
    17

    HTTP Request

    GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8zjwuZz-GKb4O1UdGgG973zVUCUzbtxkLGtjeepRHT2eYr8EXaPUp8Hp4sdlCk8TflZTjdQfzBKbVQJFfnRbdF0VVdeU9ynqU46TzflVE5aMPOLsy7tVim4n2w95lfrXzJPu6tPSP-7RouaNartZjbeCISgIvUZzINssrTmNDBaj7lhFO%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D9972c90b239618a31e3aaf2091708c7c&TIME=20240426T135829Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038&muid=416143B6C3858B3296EFB62827C91949

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8zjwuZz-GKb4O1UdGgG973zVUCUzbtxkLGtjeepRHT2eYr8EXaPUp8Hp4sdlCk8TflZTjdQfzBKbVQJFfnRbdF0VVdeU9ynqU46TzflVE5aMPOLsy7tVim4n2w95lfrXzJPu6tPSP-7RouaNartZjbeCISgIvUZzINssrTmNDBaj7lhFO%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D9972c90b239618a31e3aaf2091708c7c&TIME=20240426T135829Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038&muid=416143B6C3858B3296EFB62827C91949

    HTTP Response

    204
  • 88.221.83.251:443
    https://www.bing.com/aes/c.gif?RG=0a018e8082d94d07ad552b0327603ad3&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T135829Z&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038
    tls, http2
    1.4kB
     5.3kB
     16
    11

    HTTP Request

    GET https://www.bing.com/aes/c.gif?RG=0a018e8082d94d07ad552b0327603ad3&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240426T135829Z&adUnitId=11730597&localId=w:416143B6-C385-8B32-96EF-B62827C91949&deviceId=6825828828137038

    HTTP Response

    200
  • 88.221.83.251:443
    https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
    tls, http2
    1.6kB
     6.3kB
     16
    12

    HTTP Request

    GET https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90

    HTTP Response

    200
  • 185.161.248.75:4132
    l9855743.exe
    260 B
     5
  • 185.161.248.75:4132
    l9855743.exe
    260 B
     5
  • 185.161.248.75:4132
    l9855743.exe
    260 B
     5
  • 185.161.248.75:4132
    l9855743.exe
    260 B
     5
  • 204.79.197.200:443
    https://tse1.mm.bing.net/th?id=OADD2.10239381702592_1OT5ET7HCG1M9EIRY&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    tls, http2
    66.7kB
     1.9MB
     1382
    1379

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239381705588_1WA9C34P2B6OXP331&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239381705589_1UZ6HI7DU1RQLXLFR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239381702593_1BLW9LYE0FMIB48EX&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239381702592_1OT5ET7HCG1M9EIRY&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     8.1kB
     16
    13
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     8.1kB
     16
    14
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     8.1kB
     16
    14
  • 185.161.248.75:4132
    l9855743.exe
    260 B
     5
  • 185.161.248.75:4132
    l9855743.exe
    208 B
     4
  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    77.190.18.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    77.190.18.2.in-addr.arpa

  • 8.8.8.8:53
    g.bing.com
    dns
    56 B
     151 B
     1
    1

    DNS Request

    g.bing.com

    DNS Response

    204.79.197.237
    13.107.21.237

  • 8.8.8.8:53
    237.197.79.204.in-addr.arpa
    dns
    73 B
     143 B
     1
    1

    DNS Request

    237.197.79.204.in-addr.arpa

  • 8.8.8.8:53
    133.32.126.40.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    133.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    251.83.221.88.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    251.83.221.88.in-addr.arpa

  • 8.8.8.8:53
    26.35.223.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    26.35.223.20.in-addr.arpa

  • 8.8.8.8:53
    86.23.85.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    86.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    133.211.185.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    133.211.185.52.in-addr.arpa

  • 8.8.8.8:53
    79.190.18.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    79.190.18.2.in-addr.arpa

  • 8.8.8.8:53
    205.47.74.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    205.47.74.20.in-addr.arpa

  • 8.8.8.8:53
    19.229.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    19.229.111.52.in-addr.arpa

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    62 B
     173 B
     1
    1

    DNS Request

    tse1.mm.bing.net

    DNS Response

    204.79.197.200
    13.107.21.200

  • 8.8.8.8:53
    200.197.79.204.in-addr.arpa
    dns
    73 B
     106 B
     1
    1

    DNS Request

    200.197.79.204.in-addr.arpa

  • 8.8.8.8:53
    25.73.42.20.in-addr.arpa
    dns
    70 B
     156 B
     1
    1

    DNS Request

    25.73.42.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\k0950715.exe
    Filesize

    184KB

    MD5

    d4c640fb500618ad6c9fc5fe7d3e784d

    SHA1

    850df0880e1685ce709b44afbbb365cab4f0fec4

    SHA256

    a511ae2083565f7f66afa9902f2d6aaa5bdf56c8a148609bfe949880a74ff44b

    SHA512

    a28a51e937a11c9d72f7450b86469609d972a1e65c176bf92a47922eaf9cf72d3a49f0d40702f6f22bfd3f2c9f9e36edfefecdd263e1d49f3546f44d4817cecd

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\l9855743.exe
    Filesize

    168KB

    MD5

    d95e337166edfc9070272b1b284ae733

    SHA1

    cc9282eea85cf1cfa305cda699867e9e07f662ce

    SHA256

    a0bef41172510834fbb36bfca0eb621ff221b5c515b61f5865c702bc1ff63afd

    SHA512

    9fe79ffca70870a86974f2daae544785cdbfe98ddbd0d9299ce9ad93e99e2035355b1d095f4ce2fb27933f9a51b6179112a1420ca2c97a14911ec0aa4710bd7d

    Download Submit

  • memory/1800-56-0x0000000074420000-0x00000000744CB000-memory.dmp

    Filesize

    684KB

    Download

  • memory/1800-50-0x000000000A3E0000-0x000000000A9F8000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/1800-51-0x0000000009ED0000-0x0000000009FDA000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/1800-52-0x0000000009E00000-0x0000000009E12000-memory.dmp

    Filesize

    72KB

    Download

  • memory/1800-55-0x0000000004370000-0x00000000043BC000-memory.dmp

    Filesize

    304KB

    Download

  • memory/1800-54-0x0000000009E60000-0x0000000009E9C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/1800-53-0x0000000074420000-0x00000000744CB000-memory.dmp

    Filesize

    684KB

    Download

  • memory/1800-47-0x0000000000060000-0x000000000008E000-memory.dmp

    Filesize

    184KB

    Download

  • memory/1800-48-0x0000000074420000-0x00000000744CB000-memory.dmp

    Filesize

    684KB

    Download

  • memory/1800-49-0x00000000006D0000-0x00000000006D6000-memory.dmp

    Filesize

    24KB

    Download

  • memory/2292-36-0x0000000005090000-0x00000000050A6000-memory.dmp

    Filesize

    88KB

    Download

  • memory/2292-43-0x0000000074470000-0x0000000074C20000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/2292-26-0x0000000005090000-0x00000000050A6000-memory.dmp

    Filesize

    88KB

    Download

  • memory/2292-24-0x0000000005090000-0x00000000050A6000-memory.dmp

    Filesize

    88KB

    Download

  • memory/2292-13-0x0000000005090000-0x00000000050A6000-memory.dmp

    Filesize

    88KB

    Download

  • memory/2292-38-0x0000000005090000-0x00000000050A6000-memory.dmp

    Filesize

    88KB

    Download

  • memory/2292-22-0x0000000005090000-0x00000000050A6000-memory.dmp

    Filesize

    88KB

    Download

  • memory/2292-20-0x0000000005090000-0x00000000050A6000-memory.dmp

    Filesize

    88KB

    Download

  • memory/2292-18-0x0000000005090000-0x00000000050A6000-memory.dmp

    Filesize

    88KB

    Download

  • memory/2292-16-0x0000000005090000-0x00000000050A6000-memory.dmp

    Filesize

    88KB

    Download

  • memory/2292-12-0x0000000074470000-0x0000000074C20000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/2292-28-0x0000000005090000-0x00000000050A6000-memory.dmp

    Filesize

    88KB

    Download

  • memory/2292-30-0x0000000005090000-0x00000000050A6000-memory.dmp

    Filesize

    88KB

    Download

  • memory/2292-32-0x0000000005090000-0x00000000050A6000-memory.dmp

    Filesize

    88KB

    Download

  • memory/2292-35-0x0000000005090000-0x00000000050A6000-memory.dmp

    Filesize

    88KB

    Download

  • memory/2292-41-0x0000000074470000-0x0000000074C20000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/2292-40-0x0000000005090000-0x00000000050A6000-memory.dmp

    Filesize

    88KB

    Download

  • memory/2292-14-0x0000000005090000-0x00000000050A6000-memory.dmp

    Filesize

    88KB

    Download

  • memory/2292-10-0x0000000004A80000-0x0000000005024000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/2292-11-0x0000000005090000-0x00000000050AC000-memory.dmp

    Filesize

    112KB

    Download

  • memory/2292-9-0x0000000074470000-0x0000000074C20000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/2292-8-0x0000000002510000-0x000000000252E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2292-7-0x000000007447E000-0x000000007447F000-memory.dmp

    Filesize

    4KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.