Overview

overview

3

Static

static

1

sitepub_be...ass.js

windows7-x64

3

sitepub_be...ass.js

windows10-2004-x64

3

sitepub_be...ss.ps1

windows7-x64

3

sitepub_be...ss.ps1

windows10-2004-x64

3

sitepub_be...rts.js

windows7-x64

3

sitepub_be...rts.js

windows10-2004-x64

3

sitepub_be...ion.js

windows7-x64

3

sitepub_be...ion.js

windows10-2004-x64

3

sitepub_be...min.js

windows7-x64

3

sitepub_be...min.js

windows10-2004-x64

3

sitepub_be...ery.js

windows7-x64

3

sitepub_be...ery.js

windows10-2004-x64

3

sitepub_be...tip.js

windows7-x64

3

sitepub_be...tip.js

windows10-2004-x64

3

sitepub_be...box.js

windows7-x64

3

sitepub_be...box.js

windows10-2004-x64

3

sitepub_be...F-8.js

windows7-x64

3

sitepub_be...F-8.js

windows10-2004-x64

3

sitepub_be...r.html

windows7-x64

1

sitepub_be...r.html

windows10-2004-x64

1

sitepub_be...e.html

windows7-x64

1

sitepub_be...e.html

windows10-2004-x64

1

sitepub_be...t.html

windows7-x64

1

sitepub_be...t.html

windows10-2004-x64

1

sitepub_be...e.html

windows7-x64

1

sitepub_be...e.html

windows10-2004-x64

1

sitepub_be...x.html

windows7-x64

1

sitepub_be...x.html

windows10-2004-x64

1

sitepub_be...x.html

windows7-x64

1

sitepub_be...x.html

windows10-2004-x64

1

sitepub_be...m.html

windows7-x64

1

sitepub_be...m.html

windows10-2004-x64

1

Analysis

  • max time kernel
    139s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/06/2024, 03:58 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    sitepub_beta_1.0/admin/includes/soft.class.ps1

  • Size

    29KB

  • MD5

    03c992f1df92ead0d68fc640d5c7c6e8

  • SHA1

    fb7f2fa9e3999d3f676fb9e8fd17ca620bd84c04

  • SHA256

    d0bac0a10b3ef1a1475e532ae194fd168184cb25db716711a5fc73b6bc8a8880

  • SHA512

    d168592d90361322b7b7a1ae889f5fafd27e59018542c324fca45603f61997285384f6b9ba93d7860e20cf1c703ec5a8465982b839827462294264c1944d6d4f

  • SSDEEP

    192:7zGQq3L7eXK6znPJuGGC/2BOW3iGfr8EZYREw6p48TeKqEB9ZFE7F4z3KlPJuRLJ:7zzk6zbmgxYVz5Lmjz1/qtrz04D//

Score
3/10
execution

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\sitepub_beta_1.0\admin\includes\soft.class.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1668

Network

  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
    Response
    g.bing.com
    IN CNAME
    g-bing-com.dual-a-0034.a-msedge.net
    g-bing-com.dual-a-0034.a-msedge.net
    IN CNAME
    dual-a-0034.a-msedge.net
    dual-a-0034.a-msedge.net
    IN A
    13.107.21.237
    dual-a-0034.a-msedge.net
    IN A
    204.79.197.237
  • flag-us
    GET
    https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De82xyhWKeHi5TqTWVg85uj2DVUCUyJLi8VnIfKXDiHh4gt-64hydnoSG8OWSLCcZjMUPODtwf7ZdEMKIwAeqyFD7Uc4IkPJ7QTkBWATtDuC6J0zvsB2fTAQlZAe3DX_IP-eZFb8q7rkUrc4NxJ9Qm59G76THJ5bIrNHrsN-82jMAcf-wha%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZm1pY3Jvc29mdC0zNjUtYmFzaWMtZmFxcyUzZk9DSUQlM2RjbW1sdWMyOWxxOQ%26rlid%3D09da252c7046143dbe644344a7e47664&TIME=20240611T230319Z&CID=531098720&EID=531098720&tids=15000&adUnitId=11730597&localId=w:12D800F8-5EB4-CAF1-6CA7-FE64B9B0CF8B&deviceId=6825835407611525&muid=12D800F85EB4CAF16CA7FE64B9B0CF8B
    Remote address:
    13.107.21.237:443
    Request
    GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De82xyhWKeHi5TqTWVg85uj2DVUCUyJLi8VnIfKXDiHh4gt-64hydnoSG8OWSLCcZjMUPODtwf7ZdEMKIwAeqyFD7Uc4IkPJ7QTkBWATtDuC6J0zvsB2fTAQlZAe3DX_IP-eZFb8q7rkUrc4NxJ9Qm59G76THJ5bIrNHrsN-82jMAcf-wha%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZm1pY3Jvc29mdC0zNjUtYmFzaWMtZmFxcyUzZk9DSUQlM2RjbW1sdWMyOWxxOQ%26rlid%3D09da252c7046143dbe644344a7e47664&TIME=20240611T230319Z&CID=531098720&EID=531098720&tids=15000&adUnitId=11730597&localId=w:12D800F8-5EB4-CAF1-6CA7-FE64B9B0CF8B&deviceId=6825835407611525&muid=12D800F85EB4CAF16CA7FE64B9B0CF8B HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MUID=22F9149214EC6EFA2DA30036150C6FD6; domain=.bing.com; expires=Tue, 15-Jul-2025 03:58:39 GMT; path=/; SameSite=None; Secure; Priority=High;
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 8F658D1D1A0644F19AA2055DC8F1A4D9 Ref B: LON04EDGE1220 Ref C: 2024-06-20T03:58:39Z
    date: Thu, 20 Jun 2024 03:58:39 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De82xyhWKeHi5TqTWVg85uj2DVUCUyJLi8VnIfKXDiHh4gt-64hydnoSG8OWSLCcZjMUPODtwf7ZdEMKIwAeqyFD7Uc4IkPJ7QTkBWATtDuC6J0zvsB2fTAQlZAe3DX_IP-eZFb8q7rkUrc4NxJ9Qm59G76THJ5bIrNHrsN-82jMAcf-wha%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZm1pY3Jvc29mdC0zNjUtYmFzaWMtZmFxcyUzZk9DSUQlM2RjbW1sdWMyOWxxOQ%26rlid%3D09da252c7046143dbe644344a7e47664&TIME=20240611T230319Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:12D800F8-5EB4-CAF1-6CA7-FE64B9B0CF8B&deviceId=6825835407611525&muid=12D800F85EB4CAF16CA7FE64B9B0CF8B
    Remote address:
    13.107.21.237:443
    Request
    GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De82xyhWKeHi5TqTWVg85uj2DVUCUyJLi8VnIfKXDiHh4gt-64hydnoSG8OWSLCcZjMUPODtwf7ZdEMKIwAeqyFD7Uc4IkPJ7QTkBWATtDuC6J0zvsB2fTAQlZAe3DX_IP-eZFb8q7rkUrc4NxJ9Qm59G76THJ5bIrNHrsN-82jMAcf-wha%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZm1pY3Jvc29mdC0zNjUtYmFzaWMtZmFxcyUzZk9DSUQlM2RjbW1sdWMyOWxxOQ%26rlid%3D09da252c7046143dbe644344a7e47664&TIME=20240611T230319Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:12D800F8-5EB4-CAF1-6CA7-FE64B9B0CF8B&deviceId=6825835407611525&muid=12D800F85EB4CAF16CA7FE64B9B0CF8B HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=22F9149214EC6EFA2DA30036150C6FD6; _EDGE_S=SID=1ABB68F38DEF6E050FEE7C578C2F6F06
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MSPTC=vPDKlKtuI9v0DFsISnaxwlh5X-5TN8FFp27yZpmCjtc; domain=.bing.com; expires=Tue, 15-Jul-2025 03:58:40 GMT; path=/; Partitioned; secure; SameSite=None
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 1E8761AC02A74EC2AA06BF209792E5FD Ref B: LON04EDGE1220 Ref C: 2024-06-20T03:58:40Z
    date: Thu, 20 Jun 2024 03:58:40 GMT
  • flag-us
    DNS
    183.142.211.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    183.142.211.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    73.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    237.21.107.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    237.21.107.13.in-addr.arpa
    IN PTR
    Response
  • flag-nl
    GET
    https://www.bing.com/aes/c.gif?RG=3685eae219d04711837b0cb138f2e682&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240611T230319Z&adUnitId=11730597&localId=w:12D800F8-5EB4-CAF1-6CA7-FE64B9B0CF8B&deviceId=6825835407611525
    Remote address:
    23.62.61.97:443
    Request
    GET /aes/c.gif?RG=3685eae219d04711837b0cb138f2e682&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240611T230319Z&adUnitId=11730597&localId=w:12D800F8-5EB4-CAF1-6CA7-FE64B9B0CF8B&deviceId=6825835407611525 HTTP/2.0
    host: www.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=22F9149214EC6EFA2DA30036150C6FD6
    Response
    HTTP/2.0 200
    cache-control: private,no-store
    pragma: no-cache
    vary: Origin
    p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: C4F631A021BD4DBA946C10D12EE45574 Ref B: DUS30EDGE0417 Ref C: 2024-06-20T03:58:40Z
    content-length: 0
    date: Thu, 20 Jun 2024 03:58:40 GMT
    set-cookie: _EDGE_S=SID=1ABB68F38DEF6E050FEE7C578C2F6F06; path=/; httponly; domain=bing.com
    set-cookie: MUIDB=22F9149214EC6EFA2DA30036150C6FD6; path=/; httponly; expires=Tue, 15-Jul-2025 03:58:40 GMT
    alt-svc: h3=":443"; ma=93600
    x-cdn-traceid: 0.5d3d3e17.1718855920.64ab8a1
  • flag-us
    DNS
    55.36.223.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    55.36.223.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    97.61.62.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.61.62.23.in-addr.arpa
    IN PTR
    Response
    97.61.62.23.in-addr.arpa
    IN PTR
    a23-62-61-97deploystaticakamaitechnologiescom
  • flag-us
    DNS
    196.249.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    196.249.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    157.123.68.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    157.123.68.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    56.126.166.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    56.126.166.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    82.90.14.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    82.90.14.23.in-addr.arpa
    IN PTR
    Response
    82.90.14.23.in-addr.arpa
    IN PTR
    a23-14-90-82deploystaticakamaitechnologiescom
  • flag-us
    DNS
    23.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    23.236.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    ax-0001.ax-msedge.net
    ax-0001.ax-msedge.net
    IN A
    150.171.27.10
    ax-0001.ax-msedge.net
    IN A
    150.171.28.10
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239371372355_1WLRVFTZ079W9XPFC&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239371372355_1WLRVFTZ079W9XPFC&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 381531
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: DB9141A7313C48CCAA96CFA8046AD80D Ref B: LON04EDGE1111 Ref C: 2024-06-20T04:00:18Z
    date: Thu, 20 Jun 2024 04:00:17 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239371372356_1N2G93XRLJ1Y5GWC9&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239371372356_1N2G93XRLJ1Y5GWC9&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 329579
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 493C6973E7724F67892AFFDD9AA153E5 Ref B: LON04EDGE1111 Ref C: 2024-06-20T04:00:18Z
    date: Thu, 20 Jun 2024 04:00:17 GMT
  • flag-us
    DNS
    10.27.171.150.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    10.27.171.150.in-addr.arpa
    IN PTR
    Response
  • 13.107.21.237:443
    https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De82xyhWKeHi5TqTWVg85uj2DVUCUyJLi8VnIfKXDiHh4gt-64hydnoSG8OWSLCcZjMUPODtwf7ZdEMKIwAeqyFD7Uc4IkPJ7QTkBWATtDuC6J0zvsB2fTAQlZAe3DX_IP-eZFb8q7rkUrc4NxJ9Qm59G76THJ5bIrNHrsN-82jMAcf-wha%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZm1pY3Jvc29mdC0zNjUtYmFzaWMtZmFxcyUzZk9DSUQlM2RjbW1sdWMyOWxxOQ%26rlid%3D09da252c7046143dbe644344a7e47664&TIME=20240611T230319Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:12D800F8-5EB4-CAF1-6CA7-FE64B9B0CF8B&deviceId=6825835407611525&muid=12D800F85EB4CAF16CA7FE64B9B0CF8B
    tls, http2
    2.5kB
     9.1kB
     19
    17

    HTTP Request

    GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De82xyhWKeHi5TqTWVg85uj2DVUCUyJLi8VnIfKXDiHh4gt-64hydnoSG8OWSLCcZjMUPODtwf7ZdEMKIwAeqyFD7Uc4IkPJ7QTkBWATtDuC6J0zvsB2fTAQlZAe3DX_IP-eZFb8q7rkUrc4NxJ9Qm59G76THJ5bIrNHrsN-82jMAcf-wha%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZm1pY3Jvc29mdC0zNjUtYmFzaWMtZmFxcyUzZk9DSUQlM2RjbW1sdWMyOWxxOQ%26rlid%3D09da252c7046143dbe644344a7e47664&TIME=20240611T230319Z&CID=531098720&EID=531098720&tids=15000&adUnitId=11730597&localId=w:12D800F8-5EB4-CAF1-6CA7-FE64B9B0CF8B&deviceId=6825835407611525&muid=12D800F85EB4CAF16CA7FE64B9B0CF8B

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De82xyhWKeHi5TqTWVg85uj2DVUCUyJLi8VnIfKXDiHh4gt-64hydnoSG8OWSLCcZjMUPODtwf7ZdEMKIwAeqyFD7Uc4IkPJ7QTkBWATtDuC6J0zvsB2fTAQlZAe3DX_IP-eZFb8q7rkUrc4NxJ9Qm59G76THJ5bIrNHrsN-82jMAcf-wha%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZm1pY3Jvc29mdC0zNjUtYmFzaWMtZmFxcyUzZk9DSUQlM2RjbW1sdWMyOWxxOQ%26rlid%3D09da252c7046143dbe644344a7e47664&TIME=20240611T230319Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:12D800F8-5EB4-CAF1-6CA7-FE64B9B0CF8B&deviceId=6825835407611525&muid=12D800F85EB4CAF16CA7FE64B9B0CF8B

    HTTP Response

    204
  • 23.62.61.97:443
    https://www.bing.com/aes/c.gif?RG=3685eae219d04711837b0cb138f2e682&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240611T230319Z&adUnitId=11730597&localId=w:12D800F8-5EB4-CAF1-6CA7-FE64B9B0CF8B&deviceId=6825835407611525
    tls, http2
    1.5kB
     5.4kB
     17
    12

    HTTP Request

    GET https://www.bing.com/aes/c.gif?RG=3685eae219d04711837b0cb138f2e682&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240611T230319Z&adUnitId=11730597&localId=w:12D800F8-5EB4-CAF1-6CA7-FE64B9B0CF8B&deviceId=6825835407611525

    HTTP Response

    200
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     6.9kB
     15
    13
  • 150.171.27.10:443
    https://tse1.mm.bing.net/th?id=OADD2.10239371372356_1N2G93XRLJ1Y5GWC9&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    tls, http2
    25.8kB
     742.3kB
     543
    541

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239371372355_1WLRVFTZ079W9XPFC&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239371372356_1N2G93XRLJ1Y5GWC9&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Response

    200
  • 8.8.8.8:53
    g.bing.com
    dns
    56 B
     151 B
     1
    1

    DNS Request

    g.bing.com

    DNS Response

    13.107.21.237
    204.79.197.237

  • 8.8.8.8:53
    183.142.211.20.in-addr.arpa
    dns
    73 B
     159 B
     1
    1

    DNS Request

    183.142.211.20.in-addr.arpa

  • 8.8.8.8:53
    73.159.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    73.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    237.21.107.13.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    237.21.107.13.in-addr.arpa

  • 8.8.8.8:53
    55.36.223.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    55.36.223.20.in-addr.arpa

  • 8.8.8.8:53
    97.61.62.23.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    97.61.62.23.in-addr.arpa

  • 8.8.8.8:53
    196.249.167.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    196.249.167.52.in-addr.arpa

  • 8.8.8.8:53
    56.126.166.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    56.126.166.20.in-addr.arpa

  • 8.8.8.8:53
    157.123.68.40.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    157.123.68.40.in-addr.arpa

  • 8.8.8.8:53
    82.90.14.23.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    82.90.14.23.in-addr.arpa

  • 8.8.8.8:53
    23.236.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    23.236.111.52.in-addr.arpa

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    62 B
     170 B
     1
    1

    DNS Request

    tse1.mm.bing.net

    DNS Response

    150.171.27.10
    150.171.28.10

  • 8.8.8.8:53
    10.27.171.150.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    10.27.171.150.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t1ijgdoo.bsl.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • memory/1668-0-0x00007FF8D9D53000-0x00007FF8D9D55000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1668-1-0x0000028588E30000-0x0000028588E52000-memory.dmp

    Filesize

    136KB

    Download

  • memory/1668-11-0x00007FF8D9D50000-0x00007FF8DA811000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/1668-12-0x00007FF8D9D50000-0x00007FF8DA811000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/1668-13-0x00007FF8D9D50000-0x00007FF8DA811000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/1668-16-0x00007FF8D9D50000-0x00007FF8DA811000-memory.dmp

    Filesize

    10.8MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.