Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2024, 07:57 UTC
Static task
static1
Behavioral task
behavioral1
Sample
66be67e9c66f030ce04ca36be14d3049_JaffaCakes118.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
66be67e9c66f030ce04ca36be14d3049_JaffaCakes118.html
Resource
win10v2004-20240709-en
General
-
Target
66be67e9c66f030ce04ca36be14d3049_JaffaCakes118.html
-
Size
10KB
-
MD5
66be67e9c66f030ce04ca36be14d3049
-
SHA1
e3d5e8e60ad22fb42209ccd146eb2c80c8f413c4
-
SHA256
55df67d563dcd5cdfc39b379f372b14d3fa44c5f0108c01f7323b57b9446b8b7
-
SHA512
79ebd1125612d7c837df4b5a9882ba664f8806a2c67a7e7829e9cced1004a1b384ce3311c4991f660ca86b50be9079fd8fe75129ba3ceb8650d033a866ab2967
-
SSDEEP
192:csz7uVAYS/IqBJ0IaRX9/cZ1JxV0PHb76f:c5VAY8IqScoHS
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3024 msedge.exe 3024 msedge.exe 4060 msedge.exe 4060 msedge.exe 4224 identity_helper.exe 4224 identity_helper.exe 3280 msedge.exe 3280 msedge.exe 3280 msedge.exe 3280 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe 4060 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4060 wrote to memory of 3484 4060 msedge.exe 84 PID 4060 wrote to memory of 3484 4060 msedge.exe 84 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 2672 4060 msedge.exe 85 PID 4060 wrote to memory of 3024 4060 msedge.exe 86 PID 4060 wrote to memory of 3024 4060 msedge.exe 86 PID 4060 wrote to memory of 4132 4060 msedge.exe 87 PID 4060 wrote to memory of 4132 4060 msedge.exe 87 PID 4060 wrote to memory of 4132 4060 msedge.exe 87 PID 4060 wrote to memory of 4132 4060 msedge.exe 87 PID 4060 wrote to memory of 4132 4060 msedge.exe 87 PID 4060 wrote to memory of 4132 4060 msedge.exe 87 PID 4060 wrote to memory of 4132 4060 msedge.exe 87 PID 4060 wrote to memory of 4132 4060 msedge.exe 87 PID 4060 wrote to memory of 4132 4060 msedge.exe 87 PID 4060 wrote to memory of 4132 4060 msedge.exe 87 PID 4060 wrote to memory of 4132 4060 msedge.exe 87 PID 4060 wrote to memory of 4132 4060 msedge.exe 87 PID 4060 wrote to memory of 4132 4060 msedge.exe 87 PID 4060 wrote to memory of 4132 4060 msedge.exe 87 PID 4060 wrote to memory of 4132 4060 msedge.exe 87 PID 4060 wrote to memory of 4132 4060 msedge.exe 87 PID 4060 wrote to memory of 4132 4060 msedge.exe 87 PID 4060 wrote to memory of 4132 4060 msedge.exe 87 PID 4060 wrote to memory of 4132 4060 msedge.exe 87 PID 4060 wrote to memory of 4132 4060 msedge.exe 87
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\66be67e9c66f030ce04ca36be14d3049_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaed4b46f8,0x7ffaed4b4708,0x7ffaed4b47182⤵PID:3484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,16177178148694663008,13931641378983010233,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:22⤵PID:2672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,16177178148694663008,13931641378983010233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3024
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,16177178148694663008,13931641378983010233,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:82⤵PID:4132
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16177178148694663008,13931641378983010233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:12⤵PID:220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16177178148694663008,13931641378983010233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:12⤵PID:1332
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,16177178148694663008,13931641378983010233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:82⤵PID:1860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,16177178148694663008,13931641378983010233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4224
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16177178148694663008,13931641378983010233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:12⤵PID:2412
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16177178148694663008,13931641378983010233,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:12⤵PID:4940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16177178148694663008,13931641378983010233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:12⤵PID:4204
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,16177178148694663008,13931641378983010233,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:12⤵PID:2152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,16177178148694663008,13931641378983010233,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4884 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3280
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5068
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1892
Network
-
Remote address:8.8.8.8:53Requestanalytics.hosting24.comIN AResponse
-
Remote address:8.8.8.8:53Requestcounters.gigya.comIN AResponse
-
Remote address:8.8.8.8:53Requestfc01.deviantart.netIN AResponsefc01.deviantart.netIN A52.42.208.254fc01.deviantart.netIN A35.167.78.243fc01.deviantart.netIN A34.210.28.49
-
GEThttp://fc01.deviantart.net/fs47/f/2009/249/a/c/Red_and_Black_Vista_Wallpaper_by_Treber.jpgmsedge.exeRemote address:52.42.208.254:80RequestGET /fs47/f/2009/249/a/c/Red_and_Black_Vista_Wallpaper_by_Treber.jpg HTTP/1.1
Host: fc01.deviantart.net
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
ResponseHTTP/1.1 301 Moved Permanently
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Server: nginx
Location: http://orig01.deviantart.net/2350/f/2009/249/a/c/red_and_black_vista_wallpaper_by_treber.jpg
-
Remote address:8.8.8.8:53Request232.168.11.51.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestorig01.deviantart.netIN AResponseorig01.deviantart.netIN A35.82.205.34orig01.deviantart.netIN A44.227.131.187orig01.deviantart.netIN A35.165.234.29
-
GEThttp://orig01.deviantart.net/2350/f/2009/249/a/c/red_and_black_vista_wallpaper_by_treber.jpgmsedge.exeRemote address:35.82.205.34:80RequestGET /2350/f/2009/249/a/c/red_and_black_vista_wallpaper_by_treber.jpg HTTP/1.1
Host: orig01.deviantart.net
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67
DNT: 1
Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
ResponseHTTP/1.1 404 Not Found
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Connection: keep-alive
Server: da-redirector/0.5.2
-
Remote address:8.8.8.8:53Request72.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request254.208.42.52.in-addr.arpaIN PTRResponse254.208.42.52.in-addr.arpaIN PTRec2-52-42-208-254 us-west-2compute amazonawscom
-
Remote address:8.8.8.8:53Request34.205.82.35.in-addr.arpaIN PTRResponse34.205.82.35.in-addr.arpaIN PTRec2-35-82-205-34 us-west-2compute amazonawscom
-
Remote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.dual-a-0034.a-msedge.netg-bing-com.dual-a-0034.a-msedge.netIN CNAMEdual-a-0034.a-msedge.netdual-a-0034.a-msedge.netIN A13.107.21.237dual-a-0034.a-msedge.netIN A204.79.197.237
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d79f33a08af04eb9a8c6139440752014&localId=w:2199DD2E-A1D9-6377-4DC2-EDD793B3B417&deviceId=6825836757717110&anid=Remote address:13.107.21.237:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d79f33a08af04eb9a8c6139440752014&localId=w:2199DD2E-A1D9-6377-4DC2-EDD793B3B417&deviceId=6825836757717110&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=1AFC70E04349624F2B676425426E633E; domain=.bing.com; expires=Sun, 17-Aug-2025 08:34:54 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 2306113B8E0A4D018D8364D3D1EE8527 Ref B: LON04EDGE0717 Ref C: 2024-07-23T08:34:54Z
date: Tue, 23 Jul 2024 08:34:53 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=d79f33a08af04eb9a8c6139440752014&localId=w:2199DD2E-A1D9-6377-4DC2-EDD793B3B417&deviceId=6825836757717110&anid=Remote address:13.107.21.237:443RequestGET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=d79f33a08af04eb9a8c6139440752014&localId=w:2199DD2E-A1D9-6377-4DC2-EDD793B3B417&deviceId=6825836757717110&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=1AFC70E04349624F2B676425426E633E
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=Vz5FlvfE8i-eBKq8Qh6Iukm1inyN8N6_m9ahG3nXIBU; domain=.bing.com; expires=Sun, 17-Aug-2025 08:34:54 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 488C912D0BE2483F83C837C4FE0CFEE7 Ref B: LON04EDGE0717 Ref C: 2024-07-23T08:34:54Z
date: Tue, 23 Jul 2024 08:34:53 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d79f33a08af04eb9a8c6139440752014&localId=w:2199DD2E-A1D9-6377-4DC2-EDD793B3B417&deviceId=6825836757717110&anid=Remote address:13.107.21.237:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d79f33a08af04eb9a8c6139440752014&localId=w:2199DD2E-A1D9-6377-4DC2-EDD793B3B417&deviceId=6825836757717110&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=1AFC70E04349624F2B676425426E633E; MSPTC=Vz5FlvfE8i-eBKq8Qh6Iukm1inyN8N6_m9ahG3nXIBU
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: DC928CDAC914495A8752E5DA81C63218 Ref B: LON04EDGE0717 Ref C: 2024-07-23T08:34:54Z
date: Tue, 23 Jul 2024 08:34:53 GMT
-
Remote address:8.8.8.8:53Request237.21.107.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request183.142.211.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request88.156.103.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request86.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request15.164.165.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request43.58.199.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request13.227.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEax-0001.ax-msedge.netax-0001.ax-msedge.netIN A150.171.27.10ax-0001.ax-msedge.netIN A150.171.28.10
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239339388076_1CAHLDDSFY1W1C3WI&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239339388076_1CAHLDDSFY1W1C3WI&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 533864
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 71F5110E087649D9816097B974D1C9FD Ref B: LON04EDGE0910 Ref C: 2024-07-23T08:36:33Z
date: Tue, 23 Jul 2024 08:36:32 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239339388077_10U0VXNEQZUZPGX5K&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239339388077_10U0VXNEQZUZPGX5K&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 446428
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: DF6CDA09FDB04008AAAFE005818A125A Ref B: LON04EDGE0910 Ref C: 2024-07-23T08:36:33Z
date: Tue, 23 Jul 2024 08:36:32 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239359666015_129MHZWWLTLOFKV34&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239359666015_129MHZWWLTLOFKV34&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 381097
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: DDD74193EBC246D89D6C6685CE47B142 Ref B: LON04EDGE0910 Ref C: 2024-07-23T08:36:33Z
date: Tue, 23 Jul 2024 08:36:32 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301142_11TUY2FDIIUV7WQCS&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239317301142_11TUY2FDIIUV7WQCS&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 482418
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: E50951E0169B432581F0DD124EC3F31C Ref B: LON04EDGE0910 Ref C: 2024-07-23T08:36:33Z
date: Tue, 23 Jul 2024 08:36:32 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239359666014_184L10ZBQ5IURAGOY&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239359666014_184L10ZBQ5IURAGOY&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 425397
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 295F1E09D3AC4A71B82C09AEBC051167 Ref B: LON04EDGE0910 Ref C: 2024-07-23T08:36:33Z
date: Tue, 23 Jul 2024 08:36:32 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301551_1UO3JMUZBU5945BZN&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239317301551_1UO3JMUZBU5945BZN&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 509035
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 4F9DE9A978494D979AAE37AFC157D469 Ref B: LON04EDGE0910 Ref C: 2024-07-23T08:36:33Z
date: Tue, 23 Jul 2024 08:36:32 GMT
-
Remote address:8.8.8.8:53Request10.27.171.150.in-addr.arpaIN PTRResponse
-
52.42.208.254:80http://fc01.deviantart.net/fs47/f/2009/249/a/c/Red_and_Black_Vista_Wallpaper_by_Treber.jpghttpmsedge.exe735 B 686 B 7 6
HTTP Request
GET http://fc01.deviantart.net/fs47/f/2009/249/a/c/Red_and_Black_Vista_Wallpaper_by_Treber.jpgHTTP Response
301 -
236 B 184 B 5 4
-
35.82.205.34:80http://orig01.deviantart.net/2350/f/2009/249/a/c/red_and_black_vista_wallpaper_by_treber.jpghttpmsedge.exe737 B 439 B 7 6
HTTP Request
GET http://orig01.deviantart.net/2350/f/2009/249/a/c/red_and_black_vista_wallpaper_by_treber.jpgHTTP Response
404 -
13.107.21.237:443https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d79f33a08af04eb9a8c6139440752014&localId=w:2199DD2E-A1D9-6377-4DC2-EDD793B3B417&deviceId=6825836757717110&anid=tls, http22.0kB 9.3kB 21 18
HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d79f33a08af04eb9a8c6139440752014&localId=w:2199DD2E-A1D9-6377-4DC2-EDD793B3B417&deviceId=6825836757717110&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=d79f33a08af04eb9a8c6139440752014&localId=w:2199DD2E-A1D9-6377-4DC2-EDD793B3B417&deviceId=6825836757717110&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d79f33a08af04eb9a8c6139440752014&localId=w:2199DD2E-A1D9-6377-4DC2-EDD793B3B417&deviceId=6825836757717110&anid=HTTP Response
204 -
1.2kB 6.9kB 15 13
-
1.2kB 6.9kB 15 13
-
1.2kB 6.9kB 15 13
-
1.2kB 6.9kB 15 13
-
150.171.27.10:443https://tse1.mm.bing.net/th?id=OADD2.10239317301551_1UO3JMUZBU5945BZN&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90tls, http2108.9kB 2.9MB 2116 2109
HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239339388076_1CAHLDDSFY1W1C3WI&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239339388077_10U0VXNEQZUZPGX5K&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239359666015_129MHZWWLTLOFKV34&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301142_11TUY2FDIIUV7WQCS&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239359666014_184L10ZBQ5IURAGOY&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301551_1UO3JMUZBU5945BZN&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Response
200
-
69 B 124 B 1 1
DNS Request
analytics.hosting24.com
-
64 B 148 B 1 1
DNS Request
counters.gigya.com
-
65 B 113 B 1 1
DNS Request
fc01.deviantart.net
DNS Response
52.42.208.25435.167.78.24334.210.28.49
-
72 B 158 B 1 1
DNS Request
232.168.11.51.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
67 B 115 B 1 1
DNS Request
orig01.deviantart.net
DNS Response
35.82.205.3444.227.131.18735.165.234.29
-
71 B 157 B 1 1
DNS Request
72.32.126.40.in-addr.arpa
-
72 B 135 B 1 1
DNS Request
254.208.42.52.in-addr.arpa
-
71 B 133 B 1 1
DNS Request
34.205.82.35.in-addr.arpa
-
56 B 151 B 1 1
DNS Request
g.bing.com
DNS Response
13.107.21.237204.79.197.237
-
72 B 158 B 1 1
DNS Request
237.21.107.13.in-addr.arpa
-
73 B 159 B 1 1
DNS Request
183.142.211.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
88.156.103.20.in-addr.arpa
-
448 B 7
-
72 B 158 B 1 1
DNS Request
154.239.44.20.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
97.17.167.52.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
86.23.85.13.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
15.164.165.52.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
43.58.199.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
13.227.111.52.in-addr.arpa
-
62 B 170 B 1 1
DNS Request
tse1.mm.bing.net
DNS Response
150.171.27.10150.171.28.10
-
72 B 158 B 1 1
DNS Request
10.27.171.150.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD5584971c8ba88c824fd51a05dddb45a98
SHA1b7c9489b4427652a9cdd754d1c1b6ac4034be421
SHA256e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307
SHA5125dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726
-
Filesize
152B
MD5b28ef7d9f6d74f055cc49876767c886c
SHA1d6b3267f36c340979f8fc3e012fdd02c468740bf
SHA256fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37
SHA512491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75
-
Filesize
5KB
MD5f60befa2c66e039afef194500dd4d6cd
SHA145fff643a4d75e8391006a776de20c3c5a30d4ae
SHA2560f883215bc6d338382eeb8c6669cce7e13707afe0ded9576fb8097adb7f1e5f6
SHA5123b0d36b390c077587c7028f6cb59463b17d1be139e63526161d653d5c247a85c4324635effc3d4cbb81df8cf9157267f74e673e69d1798ea567378535525080c
-
Filesize
6KB
MD5752cd9cd58b86be614bd004a9f0c5f01
SHA18ffa02ab16ea53908e5656e9a1279f28fd8a3243
SHA256666cb7b5d948413be750ddf83043ca6aaaa135df17b4e5a34945070c2e3b2531
SHA512f9f0815d819fd85c74d9eabe5ccb76c7a4e5c546141b12d5869e06f87fa70da0fd1fb960cf0494478559f9b0c2fca8f385e5f79ca4307e5fdd64a312d88cc075
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD51686194f48b419eb3d0f2783fa292a06
SHA1f53e380d62c709ba2de9cb3480c1559d7ad50b59
SHA256f8abd0b7235d58f1d3b08a8ad05428e5f401fe6180d45a282e9018fafcc63b31
SHA51241e72e7c17aa49e46327415a20c924f4ac4fa97e70e4082c641dc9f6a7b6bcdacaa83e332506cb8c2d27ba1636919f25445d25b3b226628feeae3ca0aab35f00