Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

1

Static

static

1

071a5cb5d9...18.dll

windows7-x64

1

071a5cb5d9...18.dll

windows10-2004-x64

1

Analysis

  • max time kernel
    139s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/06/2024, 15:06 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    071a5cb5d9413601b84553f7d7dbf9cd_JaffaCakes118.dll

  • Size

    61KB

  • MD5

    071a5cb5d9413601b84553f7d7dbf9cd

  • SHA1

    78fca0aaccfd3e656d9bef8214936b46d2c9f01b

  • SHA256

    fcd85407caad73a1bdd8b2d95ab78f8a5474d2f662d9255f1c47dede23a5ad75

  • SHA512

    d8119053bab966b846102a1981b4a9ed99e1478a0b19fd0039e944e543aae7ffe67217e73ae92f5c96a7a051ce66e2760f843745f458f47689bb158beeee403d

  • SSDEEP

    768:2nBXbBAirLK4lnwD8R/t2Yhir5Tx5SuJLibch:qZPdwDIV0H5PJ+ch

Score
1/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\071a5cb5d9413601b84553f7d7dbf9cd_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3964
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\071a5cb5d9413601b84553f7d7dbf9cd_JaffaCakes118.dll,#1
      2⤵
        PID:1576

    Network

    • flag-us
      DNS
      241.150.49.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      241.150.49.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      97.90.14.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      97.90.14.23.in-addr.arpa
      IN PTR
      Response
      97.90.14.23.in-addr.arpa
      IN PTR
      a23-14-90-97deploystaticakamaitechnologiescom
    • flag-us
      DNS
      g.bing.com
      Remote address:
      8.8.8.8:53
      Request
      g.bing.com
      IN A
      Response
      g.bing.com
      IN CNAME
      g-bing-com.dual-a-0034.a-msedge.net
      g-bing-com.dual-a-0034.a-msedge.net
      IN CNAME
      dual-a-0034.a-msedge.net
      dual-a-0034.a-msedge.net
      IN A
      13.107.21.237
      dual-a-0034.a-msedge.net
      IN A
      204.79.197.237
    • flag-us
      GET
      https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8e04JwBWLQ6pnHIgzWyj2FDVUCUy23vSMrg9AjlrrVbHama_eildBYE7LaTRg541btnqYeKoqeZBs_4OCmwsl0zi_19i4qy3le7KqUP5N9xC_X6fhT_HkGtigYGKnybERR6ytbwRkUgkiRT-yZA6sVppbiRI3DPSSAoBmnZuyZbr4inCG%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZm9uZWRyaXZlLmxpdmUuY29tJTJmJTNmb2NpZCUzZGNtbTA3YjdkbnU0%26rlid%3D7f461e5e8e8f146cdcd4783620928652&TIME=20240611T200650Z&CID=531098720&EID=531098720&tids=15000&adUnitId=11730597&localId=w:E27E96ED-1C24-B87C-D753-8842C7811920&deviceId=6825835402279670&muid=E27E96ED1C24B87CD7538842C7811920
      Remote address:
      13.107.21.237:443
      Request
      GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8e04JwBWLQ6pnHIgzWyj2FDVUCUy23vSMrg9AjlrrVbHama_eildBYE7LaTRg541btnqYeKoqeZBs_4OCmwsl0zi_19i4qy3le7KqUP5N9xC_X6fhT_HkGtigYGKnybERR6ytbwRkUgkiRT-yZA6sVppbiRI3DPSSAoBmnZuyZbr4inCG%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZm9uZWRyaXZlLmxpdmUuY29tJTJmJTNmb2NpZCUzZGNtbTA3YjdkbnU0%26rlid%3D7f461e5e8e8f146cdcd4783620928652&TIME=20240611T200650Z&CID=531098720&EID=531098720&tids=15000&adUnitId=11730597&localId=w:E27E96ED-1C24-B87C-D753-8842C7811920&deviceId=6825835402279670&muid=E27E96ED1C24B87CD7538842C7811920 HTTP/2.0
      host: g.bing.com
      accept-encoding: gzip, deflate
      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
      Response
      HTTP/2.0 204
      cache-control: no-cache, must-revalidate
      pragma: no-cache
      expires: Fri, 01 Jan 1990 00:00:00 GMT
      set-cookie: MUID=1D638BCF4C7F6F593E389F6B4D9F6EDC; domain=.bing.com; expires=Tue, 15-Jul-2025 15:06:12 GMT; path=/; SameSite=None; Secure; Priority=High;
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      access-control-allow-origin: *
      x-cache: CONFIG_NOCACHE
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 510DB10B84F04A94AB2BF47A4D9D420F Ref B: LON04EDGE1109 Ref C: 2024-06-20T15:06:12Z
      date: Thu, 20 Jun 2024 15:06:11 GMT
    • flag-us
      GET
      https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8e04JwBWLQ6pnHIgzWyj2FDVUCUy23vSMrg9AjlrrVbHama_eildBYE7LaTRg541btnqYeKoqeZBs_4OCmwsl0zi_19i4qy3le7KqUP5N9xC_X6fhT_HkGtigYGKnybERR6ytbwRkUgkiRT-yZA6sVppbiRI3DPSSAoBmnZuyZbr4inCG%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZm9uZWRyaXZlLmxpdmUuY29tJTJmJTNmb2NpZCUzZGNtbTA3YjdkbnU0%26rlid%3D7f461e5e8e8f146cdcd4783620928652&TIME=20240611T200650Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:E27E96ED-1C24-B87C-D753-8842C7811920&deviceId=6825835402279670&muid=E27E96ED1C24B87CD7538842C7811920
      Remote address:
      13.107.21.237:443
      Request
      GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8e04JwBWLQ6pnHIgzWyj2FDVUCUy23vSMrg9AjlrrVbHama_eildBYE7LaTRg541btnqYeKoqeZBs_4OCmwsl0zi_19i4qy3le7KqUP5N9xC_X6fhT_HkGtigYGKnybERR6ytbwRkUgkiRT-yZA6sVppbiRI3DPSSAoBmnZuyZbr4inCG%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZm9uZWRyaXZlLmxpdmUuY29tJTJmJTNmb2NpZCUzZGNtbTA3YjdkbnU0%26rlid%3D7f461e5e8e8f146cdcd4783620928652&TIME=20240611T200650Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:E27E96ED-1C24-B87C-D753-8842C7811920&deviceId=6825835402279670&muid=E27E96ED1C24B87CD7538842C7811920 HTTP/2.0
      host: g.bing.com
      accept-encoding: gzip, deflate
      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
      cookie: MUID=1D638BCF4C7F6F593E389F6B4D9F6EDC; _EDGE_S=SID=21D2738D3ABA6CD823BA67293B7A6DD7
      Response
      HTTP/2.0 204
      cache-control: no-cache, must-revalidate
      pragma: no-cache
      expires: Fri, 01 Jan 1990 00:00:00 GMT
      set-cookie: MSPTC=TapR3SdYSZIocmeWY9nq07tpB4q1eoZ-T_pqk2lZOQ0; domain=.bing.com; expires=Tue, 15-Jul-2025 15:06:12 GMT; path=/; Partitioned; secure; SameSite=None
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      access-control-allow-origin: *
      x-cache: CONFIG_NOCACHE
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 585F019C41EB4021B725D8763B0A6FAB Ref B: LON04EDGE1109 Ref C: 2024-06-20T15:06:12Z
      date: Thu, 20 Jun 2024 15:06:12 GMT
    • flag-nl
      GET
      https://www.bing.com/aes/c.gif?RG=da2ac46cb82042bcadbfcfd740d7cfea&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240611T200650Z&adUnitId=11730597&localId=w:E27E96ED-1C24-B87C-D753-8842C7811920&deviceId=6825835402279670
      Remote address:
      23.62.61.160:443
      Request
      GET /aes/c.gif?RG=da2ac46cb82042bcadbfcfd740d7cfea&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240611T200650Z&adUnitId=11730597&localId=w:E27E96ED-1C24-B87C-D753-8842C7811920&deviceId=6825835402279670 HTTP/2.0
      host: www.bing.com
      accept-encoding: gzip, deflate
      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
      cookie: MUID=1D638BCF4C7F6F593E389F6B4D9F6EDC
      Response
      HTTP/2.0 200
      cache-control: private,no-store
      pragma: no-cache
      vary: Origin
      p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 71D8D80EFC6C4ADAAF7CDB579E212070 Ref B: DUS30EDGE0320 Ref C: 2024-06-20T15:06:12Z
      content-length: 0
      date: Thu, 20 Jun 2024 15:06:12 GMT
      set-cookie: _EDGE_S=SID=21D2738D3ABA6CD823BA67293B7A6DD7; path=/; httponly; domain=bing.com
      set-cookie: MUIDB=1D638BCF4C7F6F593E389F6B4D9F6EDC; path=/; httponly; expires=Tue, 15-Jul-2025 15:06:12 GMT
      alt-svc: h3=":443"; ma=93600
      x-cdn-traceid: 0.9c3d3e17.1718895972.9e20f1
    • flag-us
      DNS
      76.32.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      76.32.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-nl
      GET
      https://www.bing.com/th?id=OADD2.10239373720215_1RHWT2NN92K0QRRNR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
      Remote address:
      23.62.61.160:443
      Request
      GET /th?id=OADD2.10239373720215_1RHWT2NN92K0QRRNR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
      host: www.bing.com
      accept: */*
      cookie: MUID=1D638BCF4C7F6F593E389F6B4D9F6EDC; _EDGE_S=SID=21D2738D3ABA6CD823BA67293B7A6DD7; MSPTC=TapR3SdYSZIocmeWY9nq07tpB4q1eoZ-T_pqk2lZOQ0; MUIDB=1D638BCF4C7F6F593E389F6B4D9F6EDC
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-type: image/png
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QWthbWFp"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      content-length: 1548
      date: Thu, 20 Jun 2024 15:06:13 GMT
      alt-svc: h3=":443"; ma=93600
      x-cdn-traceid: 0.9c3d3e17.1718895973.9e22e1
    • flag-us
      DNS
      160.61.62.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      160.61.62.23.in-addr.arpa
      IN PTR
      Response
      160.61.62.23.in-addr.arpa
      IN PTR
      a23-62-61-160deploystaticakamaitechnologiescom
    • flag-us
      DNS
      55.36.223.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      55.36.223.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      232.168.11.51.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      232.168.11.51.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      149.220.183.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      149.220.183.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      103.169.127.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      103.169.127.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      171.39.242.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      171.39.242.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      107.12.20.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      107.12.20.2.in-addr.arpa
      IN PTR
      Response
      107.12.20.2.in-addr.arpa
      IN PTR
      a2-20-12-107deploystaticakamaitechnologiescom
    • flag-us
      DNS
      0.205.248.87.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      0.205.248.87.in-addr.arpa
      IN PTR
      Response
      0.205.248.87.in-addr.arpa
      IN PTR
      https-87-248-205-0lgwllnwnet
    • flag-us
      DNS
      13.227.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      13.227.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      tse1.mm.bing.net
      Remote address:
      8.8.8.8:53
      Request
      tse1.mm.bing.net
      IN A
      Response
      tse1.mm.bing.net
      IN CNAME
      mm-mm.bing.net.trafficmanager.net
      mm-mm.bing.net.trafficmanager.net
      IN CNAME
      ax-0001.ax-msedge.net
      ax-0001.ax-msedge.net
      IN A
      150.171.28.10
      ax-0001.ax-msedge.net
      IN A
      150.171.27.10
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239370639329_16GDTY03HO5SY2UBG&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
      Remote address:
      150.171.28.10:443
      Request
      GET /th?id=OADD2.10239370639329_16GDTY03HO5SY2UBG&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 835660
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: EEBDB1CE42AA43D186400A396A05951F Ref B: LON04EDGE1211 Ref C: 2024-06-20T15:07:51Z
      date: Thu, 20 Jun 2024 15:07:51 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239370639330_1D80T5H13WVAODNQ8&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
      Remote address:
      150.171.28.10:443
      Request
      GET /th?id=OADD2.10239370639330_1D80T5H13WVAODNQ8&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 770657
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: FC14DCE819D7497C96AC6220B144864A Ref B: LON04EDGE1211 Ref C: 2024-06-20T15:07:51Z
      date: Thu, 20 Jun 2024 15:07:51 GMT
    • flag-us
      DNS
      205.47.74.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      205.47.74.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      10.28.171.150.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      10.28.171.150.in-addr.arpa
      IN PTR
      Response
    • 13.107.21.237:443
      https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8e04JwBWLQ6pnHIgzWyj2FDVUCUy23vSMrg9AjlrrVbHama_eildBYE7LaTRg541btnqYeKoqeZBs_4OCmwsl0zi_19i4qy3le7KqUP5N9xC_X6fhT_HkGtigYGKnybERR6ytbwRkUgkiRT-yZA6sVppbiRI3DPSSAoBmnZuyZbr4inCG%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZm9uZWRyaXZlLmxpdmUuY29tJTJmJTNmb2NpZCUzZGNtbTA3YjdkbnU0%26rlid%3D7f461e5e8e8f146cdcd4783620928652&TIME=20240611T200650Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:E27E96ED-1C24-B87C-D753-8842C7811920&deviceId=6825835402279670&muid=E27E96ED1C24B87CD7538842C7811920
      tls, http2
      2.4kB
       9.1kB
       19
      17

      HTTP Request

      GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8e04JwBWLQ6pnHIgzWyj2FDVUCUy23vSMrg9AjlrrVbHama_eildBYE7LaTRg541btnqYeKoqeZBs_4OCmwsl0zi_19i4qy3le7KqUP5N9xC_X6fhT_HkGtigYGKnybERR6ytbwRkUgkiRT-yZA6sVppbiRI3DPSSAoBmnZuyZbr4inCG%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZm9uZWRyaXZlLmxpdmUuY29tJTJmJTNmb2NpZCUzZGNtbTA3YjdkbnU0%26rlid%3D7f461e5e8e8f146cdcd4783620928652&TIME=20240611T200650Z&CID=531098720&EID=531098720&tids=15000&adUnitId=11730597&localId=w:E27E96ED-1C24-B87C-D753-8842C7811920&deviceId=6825835402279670&muid=E27E96ED1C24B87CD7538842C7811920

      HTTP Response

      204

      HTTP Request

      GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8e04JwBWLQ6pnHIgzWyj2FDVUCUy23vSMrg9AjlrrVbHama_eildBYE7LaTRg541btnqYeKoqeZBs_4OCmwsl0zi_19i4qy3le7KqUP5N9xC_X6fhT_HkGtigYGKnybERR6ytbwRkUgkiRT-yZA6sVppbiRI3DPSSAoBmnZuyZbr4inCG%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZm9uZWRyaXZlLmxpdmUuY29tJTJmJTNmb2NpZCUzZGNtbTA3YjdkbnU0%26rlid%3D7f461e5e8e8f146cdcd4783620928652&TIME=20240611T200650Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:E27E96ED-1C24-B87C-D753-8842C7811920&deviceId=6825835402279670&muid=E27E96ED1C24B87CD7538842C7811920

      HTTP Response

      204
    • 23.62.61.160:443
      https://www.bing.com/aes/c.gif?RG=da2ac46cb82042bcadbfcfd740d7cfea&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240611T200650Z&adUnitId=11730597&localId=w:E27E96ED-1C24-B87C-D753-8842C7811920&deviceId=6825835402279670
      tls, http2
      1.4kB
       5.5kB
       16
      14

      HTTP Request

      GET https://www.bing.com/aes/c.gif?RG=da2ac46cb82042bcadbfcfd740d7cfea&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240611T200650Z&adUnitId=11730597&localId=w:E27E96ED-1C24-B87C-D753-8842C7811920&deviceId=6825835402279670

      HTTP Response

      200
    • 23.62.61.160:443
      https://www.bing.com/th?id=OADD2.10239373720215_1RHWT2NN92K0QRRNR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
      tls, http2
      1.7kB
       6.9kB
       18
      15

      HTTP Request

      GET https://www.bing.com/th?id=OADD2.10239373720215_1RHWT2NN92K0QRRNR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90

      HTTP Response

      200
    • 150.171.28.10:443
      tse1.mm.bing.net
      tls, http2
      1.2kB
       6.9kB
       15
      13
    • 150.171.28.10:443
      https://tse1.mm.bing.net/th?id=OADD2.10239370639330_1D80T5H13WVAODNQ8&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
      tls, http2
      56.6kB
       1.7MB
       1211
      1207

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239370639329_16GDTY03HO5SY2UBG&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239370639330_1D80T5H13WVAODNQ8&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

      HTTP Response

      200

      HTTP Response

      200
    • 8.8.8.8:53
      241.150.49.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      241.150.49.20.in-addr.arpa

    • 8.8.8.8:53
      97.90.14.23.in-addr.arpa
      dns
      70 B
       133 B
       1
      1

      DNS Request

      97.90.14.23.in-addr.arpa

    • 8.8.8.8:53
      g.bing.com
      dns
      56 B
       151 B
       1
      1

      DNS Request

      g.bing.com

      DNS Response

      13.107.21.237
      204.79.197.237

    • 8.8.8.8:53
      76.32.126.40.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      76.32.126.40.in-addr.arpa

    • 8.8.8.8:53
      160.61.62.23.in-addr.arpa
      dns
      71 B
       135 B
       1
      1

      DNS Request

      160.61.62.23.in-addr.arpa

    • 8.8.8.8:53
      55.36.223.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      55.36.223.20.in-addr.arpa

    • 8.8.8.8:53
      149.220.183.52.in-addr.arpa
      dns
      73 B
       147 B
       1
      1

      DNS Request

      149.220.183.52.in-addr.arpa

    • 8.8.8.8:53
      232.168.11.51.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      232.168.11.51.in-addr.arpa

    • 8.8.8.8:53
      103.169.127.40.in-addr.arpa
      dns
      73 B
       147 B
       1
      1

      DNS Request

      103.169.127.40.in-addr.arpa

    • 8.8.8.8:53
      171.39.242.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      171.39.242.20.in-addr.arpa

    • 8.8.8.8:53
      107.12.20.2.in-addr.arpa
      dns
      70 B
       133 B
       1
      1

      DNS Request

      107.12.20.2.in-addr.arpa

    • 8.8.8.8:53
      0.205.248.87.in-addr.arpa
      dns
      71 B
       116 B
       1
      1

      DNS Request

      0.205.248.87.in-addr.arpa

    • 8.8.8.8:53
      13.227.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      13.227.111.52.in-addr.arpa

    • 8.8.8.8:53
      tse1.mm.bing.net
      dns
      62 B
       170 B
       1
      1

      DNS Request

      tse1.mm.bing.net

      DNS Response

      150.171.28.10
      150.171.27.10

    • 8.8.8.8:53
      205.47.74.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      205.47.74.20.in-addr.arpa

    • 8.8.8.8:53
      10.28.171.150.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      10.28.171.150.in-addr.arpa

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.