Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

cc73927b93...18.exe

windows7-x64

10

cc73927b93...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/08/2024, 08:03 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    cc73927b9372a0a40fb462cc667f745c_JaffaCakes118.exe

  • Size

    1.2MB

  • MD5

    cc73927b9372a0a40fb462cc667f745c

  • SHA1

    88cd72442546b015abc46037a596cf90641dae34

  • SHA256

    d10a60c9c3a85ddbb70c6828bf9a8f2708e3c53036d8a084537a246466c1ce68

  • SHA512

    e7b70725a80f4d6e67b10866791b3d8fa65360c62cabd690d2874f795fbbecceed2126e408a77f371e3017eb775d5240b673525635828820a7cfb8bd43910c89

  • SSDEEP

    24576:/64MVThRn8gVC/zRK1fHa6/0xXeCxg0FBjf6K80sr:/64MTcgVCb4566/0OSg0FBjI0

Score
10/10
ardamaxdefense_evasiondiscoverykeyloggerpersistencestealer

Malware Config

Signatures

  • Ardamax

    A keylogger first seen in 2013.

    keyloggerstealerardamax
  • Ardamax main executable 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cc73927b9372a0a40fb462cc667f745c_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\cc73927b9372a0a40fb462cc667f745c_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:776
    • C:\Windows\SysWOW64\AWLQSO\VJC.exe
      "C:\Windows\system32\AWLQSO\VJC.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1744
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c del C:\Windows\SysWOW64\AWLQSO\VJC.exe > nul
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3664
    • C:\Program Files\Java\jre-1.8\bin\javaw.exe
      "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\OmegleSpy.jar"
      2⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2060
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4460,i,1330210614411927383,9239043499051775691,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:8
    1⤵
      PID:1228

    Network

    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
      Response
      8.8.8.8.in-addr.arpa
      IN PTR
      dnsgoogle
    • flag-us
      DNS
      13.86.106.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      13.86.106.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      g.bing.com
      Remote address:
      8.8.8.8:53
      Request
      g.bing.com
      IN A
      Response
      g.bing.com
      IN CNAME
      g-bing-com.ax-0001.ax-msedge.net
      g-bing-com.ax-0001.ax-msedge.net
      IN CNAME
      ax-0001.ax-msedge.net
      ax-0001.ax-msedge.net
      IN A
      150.171.28.10
      ax-0001.ax-msedge.net
      IN A
      150.171.27.10
    • flag-us
      GET
      https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=056215322d924dd19e4a8c62dbc55c2f&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid=
      Remote address:
      150.171.28.10:443
      Request
      GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=056215322d924dd19e4a8c62dbc55c2f&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid= HTTP/2.0
      host: g.bing.com
      accept-encoding: gzip, deflate
      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
      Response
      HTTP/2.0 204
      cache-control: no-cache, must-revalidate
      pragma: no-cache
      expires: Fri, 01 Jan 1990 00:00:00 GMT
      set-cookie: MUID=293DC04BD2D46F8C3544D4A7D3F36E5C; domain=.bing.com; expires=Thu, 25-Sep-2025 08:03:11 GMT; path=/; SameSite=None; Secure; Priority=High;
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      access-control-allow-origin: *
      x-cache: CONFIG_NOCACHE
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: FCA0D71859844543977EC25859FC00E7 Ref B: LON04EDGE0714 Ref C: 2024-08-31T08:03:11Z
      date: Sat, 31 Aug 2024 08:03:10 GMT
    • flag-us
      GET
      https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=056215322d924dd19e4a8c62dbc55c2f&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid=
      Remote address:
      150.171.28.10:443
      Request
      GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=056215322d924dd19e4a8c62dbc55c2f&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid= HTTP/2.0
      host: g.bing.com
      accept-encoding: gzip, deflate
      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
      cookie: MUID=293DC04BD2D46F8C3544D4A7D3F36E5C
      Response
      HTTP/2.0 204
      cache-control: no-cache, must-revalidate
      pragma: no-cache
      expires: Fri, 01 Jan 1990 00:00:00 GMT
      set-cookie: MSPTC=Sk_i8zwS7yrZ-Z2hfEeBDvhKbCKGoEHSK4NidjpepdA; domain=.bing.com; expires=Thu, 25-Sep-2025 08:03:11 GMT; path=/; Partitioned; secure; SameSite=None
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      access-control-allow-origin: *
      x-cache: CONFIG_NOCACHE
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 1D520AC65A9246E49440C56CAD6FDE80 Ref B: LON04EDGE0714 Ref C: 2024-08-31T08:03:11Z
      date: Sat, 31 Aug 2024 08:03:10 GMT
    • flag-us
      GET
      https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=056215322d924dd19e4a8c62dbc55c2f&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid=
      Remote address:
      150.171.28.10:443
      Request
      GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=056215322d924dd19e4a8c62dbc55c2f&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid= HTTP/2.0
      host: g.bing.com
      accept-encoding: gzip, deflate
      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
      cookie: MUID=293DC04BD2D46F8C3544D4A7D3F36E5C; MSPTC=Sk_i8zwS7yrZ-Z2hfEeBDvhKbCKGoEHSK4NidjpepdA
      Response
      HTTP/2.0 204
      cache-control: no-cache, must-revalidate
      pragma: no-cache
      expires: Fri, 01 Jan 1990 00:00:00 GMT
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      access-control-allow-origin: *
      x-cache: CONFIG_NOCACHE
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 454534538DF64DCABD417714B0A84C86 Ref B: LON04EDGE0714 Ref C: 2024-08-31T08:03:11Z
      date: Sat, 31 Aug 2024 08:03:10 GMT
    • flag-us
      DNS
      76.32.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      76.32.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.214.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.214.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      cardassia.omegle.com
      javaw.exe
      Remote address:
      8.8.8.8:53
      Request
      cardassia.omegle.com
      IN A
      Response
    • flag-us
      DNS
      55.36.223.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      55.36.223.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      58.55.71.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      58.55.71.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      cardassia.omegle.com
      javaw.exe
      Remote address:
      8.8.8.8:53
      Request
      cardassia.omegle.com
      IN A
      Response
    • flag-us
      DNS
      149.220.183.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      149.220.183.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      cardassia.omegle.com
      javaw.exe
      Remote address:
      8.8.8.8:53
      Request
      cardassia.omegle.com
      IN A
      Response
    • flag-us
      DNS
      18.31.95.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      18.31.95.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      157.123.68.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      157.123.68.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      65.139.73.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      65.139.73.23.in-addr.arpa
      IN PTR
      Response
      65.139.73.23.in-addr.arpa
      IN PTR
      a23-73-139-65deploystaticakamaitechnologiescom
    • flag-us
      DNS
      cardassia.omegle.com
      javaw.exe
      Remote address:
      8.8.8.8:53
      Request
      cardassia.omegle.com
      IN A
      Response
    • flag-us
      DNS
      cardassia.omegle.com
      javaw.exe
      Remote address:
      8.8.8.8:53
      Request
      cardassia.omegle.com
      IN A
      Response
    • flag-us
      DNS
      48.229.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      48.229.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      cardassia.omegle.com
      javaw.exe
      Remote address:
      8.8.8.8:53
      Request
      cardassia.omegle.com
      IN A
      Response
    • flag-us
      DNS
      cardassia.omegle.com
      javaw.exe
      Remote address:
      8.8.8.8:53
      Request
      cardassia.omegle.com
      IN A
      Response
    • flag-us
      DNS
      73.144.22.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      73.144.22.2.in-addr.arpa
      IN PTR
      Response
      73.144.22.2.in-addr.arpa
      IN PTR
      a2-22-144-73deploystaticakamaitechnologiescom
    • flag-us
      DNS
      205.47.74.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      205.47.74.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      cardassia.omegle.com
      javaw.exe
      Remote address:
      8.8.8.8:53
      Request
      cardassia.omegle.com
      IN A
      Response
    • flag-us
      DNS
      cardassia.omegle.com
      javaw.exe
      Remote address:
      8.8.8.8:53
      Request
      cardassia.omegle.com
      IN A
      Response
    • flag-us
      DNS
      cardassia.omegle.com
      javaw.exe
      Remote address:
      8.8.8.8:53
      Request
      cardassia.omegle.com
      IN A
      Response
    • flag-us
      DNS
      tse1.mm.bing.net
      Remote address:
      8.8.8.8:53
      Request
      tse1.mm.bing.net
      IN A
      Response
      tse1.mm.bing.net
      IN CNAME
      mm-mm.bing.net.trafficmanager.net
      mm-mm.bing.net.trafficmanager.net
      IN CNAME
      ax-0001.ax-msedge.net
      ax-0001.ax-msedge.net
      IN A
      150.171.28.10
      ax-0001.ax-msedge.net
      IN A
      150.171.27.10
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239340418575_1DFGQU5CLQUV7W36O&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
      Remote address:
      150.171.28.10:443
      Request
      GET /th?id=OADD2.10239340418575_1DFGQU5CLQUV7W36O&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 666327
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 226EF0BC80924D30AD167ED72E94E9C7 Ref B: LON04EDGE0707 Ref C: 2024-08-31T08:04:51Z
      date: Sat, 31 Aug 2024 08:04:51 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239360284735_1J9G8ZRD0Q7KNETKQ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
      Remote address:
      150.171.28.10:443
      Request
      GET /th?id=OADD2.10239360284735_1J9G8ZRD0Q7KNETKQ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 468734
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 40DB811A7DF242FE9E04FB7C4E0A8922 Ref B: LON04EDGE0707 Ref C: 2024-08-31T08:04:51Z
      date: Sat, 31 Aug 2024 08:04:51 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239317301142_11TUY2FDIIUV7WQCS&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
      Remote address:
      150.171.28.10:443
      Request
      GET /th?id=OADD2.10239317301142_11TUY2FDIIUV7WQCS&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 482418
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 16600B9AC1D14F4BB6625994F7044B02 Ref B: LON04EDGE0707 Ref C: 2024-08-31T08:04:51Z
      date: Sat, 31 Aug 2024 08:04:51 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239360284736_11427X8L96F0YA4AW&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
      Remote address:
      150.171.28.10:443
      Request
      GET /th?id=OADD2.10239360284736_11427X8L96F0YA4AW&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 679182
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 9876F1B3F0E84F438FA686502C39E50E Ref B: LON04EDGE0707 Ref C: 2024-08-31T08:04:51Z
      date: Sat, 31 Aug 2024 08:04:51 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239317301551_1UO3JMUZBU5945BZN&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
      Remote address:
      150.171.28.10:443
      Request
      GET /th?id=OADD2.10239317301551_1UO3JMUZBU5945BZN&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 509035
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 8779CBA1A4304B5B989BA598B791AAB0 Ref B: LON04EDGE0707 Ref C: 2024-08-31T08:04:51Z
      date: Sat, 31 Aug 2024 08:04:51 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239340418576_1P0LP58U9FRUO4PCP&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
      Remote address:
      150.171.28.10:443
      Request
      GET /th?id=OADD2.10239340418576_1P0LP58U9FRUO4PCP&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 468841
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 08D3CAAC567A47E5B0BC3EF453D11DBD Ref B: LON04EDGE0707 Ref C: 2024-08-31T08:04:53Z
      date: Sat, 31 Aug 2024 08:04:52 GMT
    • flag-us
      DNS
      cardassia.omegle.com
      javaw.exe
      Remote address:
      8.8.8.8:53
      Request
      cardassia.omegle.com
      IN A
      Response
    • flag-us
      DNS
      3.173.189.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      3.173.189.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      cardassia.omegle.com
      javaw.exe
      Remote address:
      8.8.8.8:53
      Request
      cardassia.omegle.com
      IN A
      Response
    • flag-us
      DNS
      cardassia.omegle.com
      javaw.exe
      Remote address:
      8.8.8.8:53
      Request
      cardassia.omegle.com
      IN A
      Response
    • flag-us
      DNS
      cardassia.omegle.com
      javaw.exe
      Remote address:
      8.8.8.8:53
      Request
      cardassia.omegle.com
      IN A
      Response
    • flag-us
      DNS
      cardassia.omegle.com
      javaw.exe
      Remote address:
      8.8.8.8:53
      Request
      cardassia.omegle.com
      IN A
      Response
    • 150.171.28.10:443
      https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=056215322d924dd19e4a8c62dbc55c2f&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid=
      tls, http2
      2.0kB
       9.3kB
       22
      18

      HTTP Request

      GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=056215322d924dd19e4a8c62dbc55c2f&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid=

      HTTP Response

      204

      HTTP Request

      GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=056215322d924dd19e4a8c62dbc55c2f&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid=

      HTTP Response

      204

      HTTP Request

      GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=056215322d924dd19e4a8c62dbc55c2f&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid=

      HTTP Response

      204
    • 150.171.28.10:443
      tse1.mm.bing.net
      tls, http2
      1.4kB
       6.8kB
       15
      10
    • 150.171.28.10:443
      tse1.mm.bing.net
      tls, http2
      1.2kB
       6.9kB
       15
      12
    • 150.171.28.10:443
      https://tse1.mm.bing.net/th?id=OADD2.10239340418576_1P0LP58U9FRUO4PCP&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
      tls, http2
      117.7kB
       3.4MB
       2511
      2503

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239340418575_1DFGQU5CLQUV7W36O&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239360284735_1J9G8ZRD0Q7KNETKQ&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239317301142_11TUY2FDIIUV7WQCS&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239360284736_11427X8L96F0YA4AW&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239317301551_1UO3JMUZBU5945BZN&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

      HTTP Response

      200

      HTTP Response

      200

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239340418576_1P0LP58U9FRUO4PCP&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

      HTTP Response

      200

      HTTP Response

      200

      HTTP Response

      200

      HTTP Response

      200
    • 150.171.28.10:443
      tse1.mm.bing.net
      tls, http2
      1.2kB
       6.9kB
       15
      12
    • 150.171.28.10:443
      tse1.mm.bing.net
      tls, http2
      1.2kB
       6.9kB
       15
      12
    • 8.8.8.8:53
      8.8.8.8.in-addr.arpa
      dns
      66 B
       90 B
       1
      1

      DNS Request

      8.8.8.8.in-addr.arpa

    • 8.8.8.8:53
      13.86.106.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      13.86.106.20.in-addr.arpa

    • 8.8.8.8:53
      g.bing.com
      dns
      56 B
       148 B
       1
      1

      DNS Request

      g.bing.com

      DNS Response

      150.171.28.10
      150.171.27.10

    • 8.8.8.8:53
      76.32.126.40.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      76.32.126.40.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      172.214.232.199.in-addr.arpa
      dns
      74 B
       128 B
       1
      1

      DNS Request

      172.214.232.199.in-addr.arpa

    • 8.8.8.8:53
      cardassia.omegle.com
      dns
      javaw.exe
      66 B
       125 B
       1
      1

      DNS Request

      cardassia.omegle.com

    • 8.8.8.8:53
      55.36.223.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      55.36.223.20.in-addr.arpa

    • 8.8.8.8:53
      58.55.71.13.in-addr.arpa
      dns
      70 B
       144 B
       1
      1

      DNS Request

      58.55.71.13.in-addr.arpa

    • 8.8.8.8:53
      cardassia.omegle.com
      dns
      javaw.exe
      66 B
       125 B
       1
      1

      DNS Request

      cardassia.omegle.com

    • 8.8.8.8:53
      149.220.183.52.in-addr.arpa
      dns
      73 B
       147 B
       1
      1

      DNS Request

      149.220.183.52.in-addr.arpa

    • 8.8.8.8:53
      cardassia.omegle.com
      dns
      javaw.exe
      66 B
       125 B
       1
      1

      DNS Request

      cardassia.omegle.com

    • 8.8.8.8:53
      18.31.95.13.in-addr.arpa
      dns
      70 B
       144 B
       1
      1

      DNS Request

      18.31.95.13.in-addr.arpa

    • 8.8.8.8:53
      157.123.68.40.in-addr.arpa
      dns
      72 B
       146 B
       1
      1

      DNS Request

      157.123.68.40.in-addr.arpa

    • 8.8.8.8:53
      65.139.73.23.in-addr.arpa
      dns
      71 B
       135 B
       1
      1

      DNS Request

      65.139.73.23.in-addr.arpa

    • 8.8.8.8:53
      cardassia.omegle.com
      dns
      javaw.exe
      66 B
       125 B
       1
      1

      DNS Request

      cardassia.omegle.com

    • 8.8.8.8:53
      cardassia.omegle.com
      dns
      javaw.exe
      66 B
       125 B
       1
      1

      DNS Request

      cardassia.omegle.com

    • 8.8.8.8:53
      48.229.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      48.229.111.52.in-addr.arpa

    • 8.8.8.8:53
      cardassia.omegle.com
      dns
      javaw.exe
      66 B
       125 B
       1
      1

      DNS Request

      cardassia.omegle.com

    • 8.8.8.8:53
      cardassia.omegle.com
      dns
      javaw.exe
      66 B
       125 B
       1
      1

      DNS Request

      cardassia.omegle.com

    • 8.8.8.8:53
      73.144.22.2.in-addr.arpa
      dns
      70 B
       133 B
       1
      1

      DNS Request

      73.144.22.2.in-addr.arpa

    • 8.8.8.8:53
      205.47.74.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      205.47.74.20.in-addr.arpa

    • 8.8.8.8:53
      cardassia.omegle.com
      dns
      javaw.exe
      66 B
       125 B
       1
      1

      DNS Request

      cardassia.omegle.com

    • 8.8.8.8:53
      cardassia.omegle.com
      dns
      javaw.exe
      66 B
       125 B
       1
      1

      DNS Request

      cardassia.omegle.com

    • 8.8.8.8:53
      cardassia.omegle.com
      dns
      javaw.exe
      66 B
       125 B
       1
      1

      DNS Request

      cardassia.omegle.com

    • 8.8.8.8:53
      tse1.mm.bing.net
      dns
      62 B
       170 B
       1
      1

      DNS Request

      tse1.mm.bing.net

      DNS Response

      150.171.28.10
      150.171.27.10

    • 8.8.8.8:53
      cardassia.omegle.com
      dns
      javaw.exe
      66 B
       125 B
       1
      1

      DNS Request

      cardassia.omegle.com

    • 8.8.8.8:53
      3.173.189.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      3.173.189.20.in-addr.arpa

    • 8.8.8.8:53
      cardassia.omegle.com
      dns
      javaw.exe
      66 B
       125 B
       1
      1

      DNS Request

      cardassia.omegle.com

    • 8.8.8.8:53
      cardassia.omegle.com
      dns
      javaw.exe
      66 B
       125 B
       1
      1

      DNS Request

      cardassia.omegle.com

    • 8.8.8.8:53
      cardassia.omegle.com
      dns
      javaw.exe
      66 B
       125 B
       1
      1

      DNS Request

      cardassia.omegle.com

    • 8.8.8.8:53
      cardassia.omegle.com
      dns
      javaw.exe
      66 B
       125 B
       1
      1

      DNS Request

      cardassia.omegle.com

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\OmegleSpy.jar
      Filesize

      53KB

      MD5

      df99738c75892cd61c73436a40882513

      SHA1

      1d421455c0221ede29fa59f6c5cc81154bd8df88

      SHA256

      c488e22d6bd206e45fbbfee465dfad370c9fbe48901bbd687ddd3e56bb8a05c3

      SHA512

      627caaa792f72777d156d4195eaf22d1916b09b6105452995a297748012de4e84167f15a53ec49250c043b233242b8fc02f1004bfcb5970ab85b0ee59a5aea2d

      Download Submit

    • C:\Windows\SysWOW64\AWLQSO\AKV.exe
      Filesize

      456KB

      MD5

      51507d91d43683b9c4b8fafeb4d888f8

      SHA1

      ead2f68338da7af4720378cd46133589fc9405ba

      SHA256

      71b3aecefd36e4855a369019ac5871c544d39f8889d23cd455466a24cdecce6b

      SHA512

      a5a7ff3f8ffb72719b7e2c9dc2719c99ea32bd68994918ea027c0d7d54cfe0c80bfd34486dd8d3cdd390376bc4c8d1f7d97de4b98b7d39a3e10c3e2682c07d1c

      Download Submit

    • C:\Windows\SysWOW64\AWLQSO\VJC.001
      Filesize

      61KB

      MD5

      383d5f5d4240d590e7dec3f7312a4ac7

      SHA1

      f6bcade8d37afb80cf52a89b3e84683f4643fbce

      SHA256

      7e87f6817b17a75106d34ce9884c40ddfb381bf8f2013930916498d1df0a6422

      SHA512

      e652c41ec95d653940b869426bc2cbd8e5b3159110ffaab7d623e23eebe1f34ca65be6a9a9cdcd5f41aec7567469d6b4d6362d24ae92267cddb8940e1265806a

      Download Submit

    • C:\Windows\SysWOW64\AWLQSO\VJC.002
      Filesize

      43KB

      MD5

      93df156c4bd9d7341f4c4a4847616a69

      SHA1

      c7663b32c3c8e247bc16b51aff87b45484652dc1

      SHA256

      e55b6eabf0f99b90bd4cf3777c25813bded7b6fc5c9955188c8aa5224d299c3e

      SHA512

      ed2e98c5fd1f0d49e5bac8baa515d489c89f8d42772ae05e4b7a32da8f06d511adad27867034ca0865beae9f78223e95c7d0f826154fc663f2fab9bd61e36e35

      Download Submit

    • C:\Windows\SysWOW64\AWLQSO\VJC.004
      Filesize

      1KB

      MD5

      a908578a1ef4262bc34d73bd4d3c8add

      SHA1

      71cc819eda85714ba507da80ce62263db4163dcc

      SHA256

      c3c0253fd6bdfc03620e1b61299003c4791f517fb58ce4d235bdf929181e9193

      SHA512

      401e2c798ff9b5992814a2259f98e2388f83e2cc7e40a07e9ee7e9e813de056e38b79779f687a8e4322689694d920f2684982b96e93edee3d18abc34e708ed57

      Download Submit

    • C:\Windows\SysWOW64\AWLQSO\VJC.exe
      Filesize

      1.7MB

      MD5

      3cd29c0df98a7aeb69a9692843ca3edb

      SHA1

      7c86aea093f1979d18901bd1b89a2b02a60ac3e2

      SHA256

      5a37cd66508fa3fc85ae547de3498e709bd45167cb57f5e9b271dc3a1cb71a32

      SHA512

      e78f3206b1878e8db1766d4038a375bbebcbcdb8d1b0a0cb9b0dc72c54881392b9c27e2864ad9118702da58f203f13e0ad5d230980ad1ef2370391a2c4acffc9

      Download Submit

    • memory/1744-18-0x0000000000770000-0x0000000000771000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1744-83-0x0000000000770000-0x0000000000771000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2060-35-0x000001A9802F0000-0x000001A9802F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2060-40-0x000001A9802F0000-0x000001A9802F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2060-49-0x000001A9802F0000-0x000001A9802F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2060-62-0x000001A9802F0000-0x000001A9802F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2060-69-0x000001A9802F0000-0x000001A9802F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2060-76-0x000001A9802F0000-0x000001A9802F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2060-23-0x000001A981AC0000-0x000001A981D30000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2060-84-0x000001A9802F0000-0x000001A9802F1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2060-85-0x000001A981AC0000-0x000001A981D30000-memory.dmp

      Filesize

      2.4MB

      Download

    • memory/2060-151-0x000001A9802F0000-0x000001A9802F1000-memory.dmp

      Filesize

      4KB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.