Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    109s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/05/2024, 06:55 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f09ed1936964c63fc8dfeda5d6fab7a1699995ba6bda3b3fcebb884d640f6204.exe

  • Size

    2.3MB

  • MD5

    7165e6cb93699d6ae2e685ff6d964c77

  • SHA1

    29b287f84095f845e32021ee4ca5f3163496db71

  • SHA256

    f09ed1936964c63fc8dfeda5d6fab7a1699995ba6bda3b3fcebb884d640f6204

  • SHA512

    bf3eab42cd6a7466b23c06ee83b46564a041889bff137445999a2ab92458c51a1c507bd0df42e97e9c15739818fa526f17df0ed4038d8699d4d734ff0619dfb3

  • SSDEEP

    49152:wCHtPr/uNXysmo+uQGda9ABh7vZvlB8MRX503wxKO1CfcJeLOqoKBEZPp:Fd/cXfmo+TGd5r7xvlB8MRlKO1Cf6qoj

Score
10/10
riseproevasionstealer

Malware Config

Extracted

Family

risepro

C2

147.45.47.126:58709

Signatures

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f09ed1936964c63fc8dfeda5d6fab7a1699995ba6bda3b3fcebb884d640f6204.exe
    "C:\Users\Admin\AppData\Local\Temp\f09ed1936964c63fc8dfeda5d6fab7a1699995ba6bda3b3fcebb884d640f6204.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:3624

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    217.106.137.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.106.137.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
    Response
    g.bing.com
    IN CNAME
    g-bing-com.dual-a-0034.a-msedge.net
    g-bing-com.dual-a-0034.a-msedge.net
    IN CNAME
    dual-a-0034.a-msedge.net
    dual-a-0034.a-msedge.net
    IN A
    204.79.197.237
    dual-a-0034.a-msedge.net
    IN A
    13.107.21.237
  • flag-us
    GET
    https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8QCpwGoL7Ax0H2AqVwZ-6fzVUCUznWyM9ADww0j10NOlvfCc2EM3HhZZ7VmQ-ofuw9s_8hSXFkINdMpWZO5VPzByklFF6e79JN6GwfI0O_7xqx4gCfeZdrZi3QblV1I9uj_ZryHX7iWQunM8BVjM8csb_6yrr94ItiuP09u7lTyetNsIf%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Dbe6ad905af2710b1346cbf3ecfbdd33a&TIME=20240508T112335Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:F93159F4-8ABC-3E2B-DF73-50B998F17BEB&deviceId=6825829378917981&muid=F93159F48ABC3E2BDF7350B998F17BEB
    Remote address:
    204.79.197.237:443
    Request
    GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8QCpwGoL7Ax0H2AqVwZ-6fzVUCUznWyM9ADww0j10NOlvfCc2EM3HhZZ7VmQ-ofuw9s_8hSXFkINdMpWZO5VPzByklFF6e79JN6GwfI0O_7xqx4gCfeZdrZi3QblV1I9uj_ZryHX7iWQunM8BVjM8csb_6yrr94ItiuP09u7lTyetNsIf%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Dbe6ad905af2710b1346cbf3ecfbdd33a&TIME=20240508T112335Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:F93159F4-8ABC-3E2B-DF73-50B998F17BEB&deviceId=6825829378917981&muid=F93159F48ABC3E2BDF7350B998F17BEB HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MUID=13FC0849FC9660B9200D1CC4FDB16140; domain=.bing.com; expires=Sun, 22-Jun-2025 06:55:41 GMT; path=/; SameSite=None; Secure; Priority=High;
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: E629EF75E17C4C1186BF02FDA5FB2C3F Ref B: LON04EDGE0717 Ref C: 2024-05-28T06:55:41Z
    date: Tue, 28 May 2024 06:55:40 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8QCpwGoL7Ax0H2AqVwZ-6fzVUCUznWyM9ADww0j10NOlvfCc2EM3HhZZ7VmQ-ofuw9s_8hSXFkINdMpWZO5VPzByklFF6e79JN6GwfI0O_7xqx4gCfeZdrZi3QblV1I9uj_ZryHX7iWQunM8BVjM8csb_6yrr94ItiuP09u7lTyetNsIf%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Dbe6ad905af2710b1346cbf3ecfbdd33a&TIME=20240508T112335Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:F93159F4-8ABC-3E2B-DF73-50B998F17BEB&deviceId=6825829378917981&muid=F93159F48ABC3E2BDF7350B998F17BEB
    Remote address:
    204.79.197.237:443
    Request
    GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8QCpwGoL7Ax0H2AqVwZ-6fzVUCUznWyM9ADww0j10NOlvfCc2EM3HhZZ7VmQ-ofuw9s_8hSXFkINdMpWZO5VPzByklFF6e79JN6GwfI0O_7xqx4gCfeZdrZi3QblV1I9uj_ZryHX7iWQunM8BVjM8csb_6yrr94ItiuP09u7lTyetNsIf%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Dbe6ad905af2710b1346cbf3ecfbdd33a&TIME=20240508T112335Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:F93159F4-8ABC-3E2B-DF73-50B998F17BEB&deviceId=6825829378917981&muid=F93159F48ABC3E2BDF7350B998F17BEB HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=13FC0849FC9660B9200D1CC4FDB16140; _EDGE_S=SID=050901410D446570000115CC0CEE64A0
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MSPTC=wj0UaTNoDK4Lp83YHL2oTzsdbYgr-kkbKqkytMOXMfg; domain=.bing.com; expires=Sun, 22-Jun-2025 06:55:41 GMT; path=/; Partitioned; secure; SameSite=None
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 35E5A396A65B46B39644101F90006B14 Ref B: LON04EDGE0717 Ref C: 2024-05-28T06:55:41Z
    date: Tue, 28 May 2024 06:55:41 GMT
  • flag-nl
    GET
    https://www.bing.com/aes/c.gif?RG=ce39d1eab14f444ab5f6c56e53ae605e&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240508T112335Z&adUnitId=11730597&localId=w:F93159F4-8ABC-3E2B-DF73-50B998F17BEB&deviceId=6825829378917981
    Remote address:
    23.62.61.171:443
    Request
    GET /aes/c.gif?RG=ce39d1eab14f444ab5f6c56e53ae605e&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240508T112335Z&adUnitId=11730597&localId=w:F93159F4-8ABC-3E2B-DF73-50B998F17BEB&deviceId=6825829378917981 HTTP/2.0
    host: www.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=13FC0849FC9660B9200D1CC4FDB16140
    Response
    HTTP/2.0 200
    cache-control: private,no-store
    pragma: no-cache
    vary: Origin
    p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 0AAA8C210FAB41E3A3A35D97FFEF6D66 Ref B: DUS30EDGE0713 Ref C: 2024-05-28T06:55:41Z
    content-length: 0
    date: Tue, 28 May 2024 06:55:41 GMT
    set-cookie: _EDGE_S=SID=050901410D446570000115CC0CEE64A0; path=/; httponly; domain=bing.com
    set-cookie: MUIDB=13FC0849FC9660B9200D1CC4FDB16140; path=/; httponly; expires=Sun, 22-Jun-2025 06:55:41 GMT
    alt-svc: h3=":443"; ma=93600
    x-cdn-traceid: 0.a73d3e17.1716879341.3963e03
  • flag-us
    DNS
    2.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    2.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    237.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    237.197.79.204.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    171.61.62.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    171.61.62.23.in-addr.arpa
    IN PTR
    Response
    171.61.62.23.in-addr.arpa
    IN PTR
    a23-62-61-171deploystaticakamaitechnologiescom
  • flag-us
    DNS
    138.201.86.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    138.201.86.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    86.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    86.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    171.39.242.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    171.39.242.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    55.36.223.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    55.36.223.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    dual-a-0001.a-msedge.net
    dual-a-0001.a-msedge.net
    IN A
    204.79.197.200
    dual-a-0001.a-msedge.net
    IN A
    13.107.21.200
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239351692210_1AKNUXTAY2T0XUMCR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239351692210_1AKNUXTAY2T0XUMCR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 449656
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 05EBF04CA7F144DBAF28BEAA1FCCA54D Ref B: LON04EDGE0711 Ref C: 2024-05-28T06:57:19Z
    date: Tue, 28 May 2024 06:57:19 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239351692215_1UJ4FAL91XLA7HB15&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239351692215_1UJ4FAL91XLA7HB15&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 468637
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: FB537EA9BA334B31B531CD5918D33264 Ref B: LON04EDGE0711 Ref C: 2024-05-28T06:57:19Z
    date: Tue, 28 May 2024 06:57:19 GMT
  • flag-us
    DNS
    205.47.74.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    205.47.74.20.in-addr.arpa
    IN PTR
    Response
  • 204.79.197.237:443
    https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8QCpwGoL7Ax0H2AqVwZ-6fzVUCUznWyM9ADww0j10NOlvfCc2EM3HhZZ7VmQ-ofuw9s_8hSXFkINdMpWZO5VPzByklFF6e79JN6GwfI0O_7xqx4gCfeZdrZi3QblV1I9uj_ZryHX7iWQunM8BVjM8csb_6yrr94ItiuP09u7lTyetNsIf%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Dbe6ad905af2710b1346cbf3ecfbdd33a&TIME=20240508T112335Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:F93159F4-8ABC-3E2B-DF73-50B998F17BEB&deviceId=6825829378917981&muid=F93159F48ABC3E2BDF7350B998F17BEB
    tls, http2
    2.5kB
     9.0kB
     20
    17

    HTTP Request

    GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8QCpwGoL7Ax0H2AqVwZ-6fzVUCUznWyM9ADww0j10NOlvfCc2EM3HhZZ7VmQ-ofuw9s_8hSXFkINdMpWZO5VPzByklFF6e79JN6GwfI0O_7xqx4gCfeZdrZi3QblV1I9uj_ZryHX7iWQunM8BVjM8csb_6yrr94ItiuP09u7lTyetNsIf%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Dbe6ad905af2710b1346cbf3ecfbdd33a&TIME=20240508T112335Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:F93159F4-8ABC-3E2B-DF73-50B998F17BEB&deviceId=6825829378917981&muid=F93159F48ABC3E2BDF7350B998F17BEB

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8QCpwGoL7Ax0H2AqVwZ-6fzVUCUznWyM9ADww0j10NOlvfCc2EM3HhZZ7VmQ-ofuw9s_8hSXFkINdMpWZO5VPzByklFF6e79JN6GwfI0O_7xqx4gCfeZdrZi3QblV1I9uj_ZryHX7iWQunM8BVjM8csb_6yrr94ItiuP09u7lTyetNsIf%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Dbe6ad905af2710b1346cbf3ecfbdd33a&TIME=20240508T112335Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:F93159F4-8ABC-3E2B-DF73-50B998F17BEB&deviceId=6825829378917981&muid=F93159F48ABC3E2BDF7350B998F17BEB

    HTTP Response

    204
  • 23.62.61.171:443
    https://www.bing.com/aes/c.gif?RG=ce39d1eab14f444ab5f6c56e53ae605e&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240508T112335Z&adUnitId=11730597&localId=w:F93159F4-8ABC-3E2B-DF73-50B998F17BEB&deviceId=6825829378917981
    tls, http2
    1.4kB
     5.3kB
     16
    10

    HTTP Request

    GET https://www.bing.com/aes/c.gif?RG=ce39d1eab14f444ab5f6c56e53ae605e&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240508T112335Z&adUnitId=11730597&localId=w:F93159F4-8ABC-3E2B-DF73-50B998F17BEB&deviceId=6825829378917981

    HTTP Response

    200
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     8.1kB
     16
    14
  • 204.79.197.200:443
    https://tse1.mm.bing.net/th?id=OADD2.10239351692215_1UJ4FAL91XLA7HB15&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    tls, http2
    35.1kB
     957.9kB
     707
    704

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239351692210_1AKNUXTAY2T0XUMCR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239351692215_1UJ4FAL91XLA7HB15&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Response

    200
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    217.106.137.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    217.106.137.52.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    g.bing.com
    dns
    56 B
     151 B
     1
    1

    DNS Request

    g.bing.com

    DNS Response

    204.79.197.237
    13.107.21.237

  • 8.8.8.8:53
    2.159.190.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    2.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    237.197.79.204.in-addr.arpa
    dns
    73 B
     143 B
     1
    1

    DNS Request

    237.197.79.204.in-addr.arpa

  • 8.8.8.8:53
    171.61.62.23.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    171.61.62.23.in-addr.arpa

  • 8.8.8.8:53
    138.201.86.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    138.201.86.20.in-addr.arpa

  • 8.8.8.8:53
    86.23.85.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    86.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    171.39.242.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    171.39.242.20.in-addr.arpa

  • 8.8.8.8:53
    55.36.223.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    55.36.223.20.in-addr.arpa

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    62 B
     173 B
     1
    1

    DNS Request

    tse1.mm.bing.net

    DNS Response

    204.79.197.200
    13.107.21.200

  • 8.8.8.8:53
    205.47.74.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    205.47.74.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3624-0-0x00000000001A0000-0x00000000007A0000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3624-1-0x00000000777C4000-0x00000000777C6000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3624-2-0x00000000001A1000-0x000000000024D000-memory.dmp

    Filesize

    688KB

    Download

  • memory/3624-3-0x00000000001A0000-0x00000000007A0000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3624-4-0x00000000001A0000-0x00000000007A0000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3624-5-0x00000000001A0000-0x00000000007A0000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3624-6-0x00000000001A0000-0x00000000007A0000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3624-7-0x00000000001A0000-0x00000000007A0000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3624-8-0x00000000001A0000-0x00000000007A0000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3624-9-0x00000000001A0000-0x00000000007A0000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3624-10-0x00000000001A0000-0x00000000007A0000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3624-11-0x00000000001A0000-0x00000000007A0000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3624-12-0x00000000001A0000-0x00000000007A0000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3624-13-0x00000000001A0000-0x00000000007A0000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3624-14-0x00000000001A0000-0x00000000007A0000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3624-15-0x00000000001A0000-0x00000000007A0000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3624-16-0x00000000001A0000-0x00000000007A0000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3624-17-0x00000000001A0000-0x00000000007A0000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3624-18-0x00000000001A0000-0x00000000007A0000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3624-19-0x00000000001A0000-0x00000000007A0000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3624-20-0x00000000001A0000-0x00000000007A0000-memory.dmp

    Filesize

    6.0MB

    Download

  • memory/3624-21-0x00000000001A0000-0x00000000007A0000-memory.dmp

    Filesize

    6.0MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.