Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/10/2024, 04:49 UTC

General

  • Target

    3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe

  • Size

    1.4MB

  • MD5

    0d951819064a22a5f28d902b6d3f9980

  • SHA1

    51784b4e39d23a59f0fad33344bdee4b68f7eb52

  • SHA256

    3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1

  • SHA512

    b92f36521d78326bde3492a43a883eeb524465d3c70263f6d4a9900a3dd96504e569056f99455da6699dd93cee37d915b2f4f07a005b981b8848dbe53ebe45a6

  • SSDEEP

    24576:ru6J3xO0c+JY5UZ+XCHkGso6Fa720W4njUprvVcC1f2o5RRfgdWYZ:Fo0c++OCokGs9Fa+rd1f26RNYZ

Malware Config

Extracted

Family

netwire

C2

Wealthy2019.com.strangled.net:20190

wealthyme.ddns.net:20190

Attributes
  • activex_autorun

    false

  • copy_executable

    true

  • delete_original

    false

  • host_id

    sunshineslisa

  • install_path

    %AppData%\Imgburn\Host.exe

  • keylogger_dir

    %AppData%\Logs\Imgburn\

  • lock_executable

    false

  • offline_keylogger

    true

  • password

    sucess

  • registry_autorun

    false

  • use_mutex

    false

Extracted

Family

warzonerat

C2

wealth.warzonedns.com:5202

Signatures

  • NetWire RAT payload 13 IoCs
  • Netwire

    Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzone RAT payload 4 IoCs
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • AutoIT Executable 7 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 18 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe
    "C:\Users\Admin\AppData\Local\Temp\3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2800
    • C:\Users\Admin\AppData\Roaming\Blasthost.exe
      "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2184
      • C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe
        "C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4320
    • C:\Users\Admin\AppData\Local\Temp\3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe
      "C:\Users\Admin\AppData\Local\Temp\3d9b97fc66f29b2bf05e4eeae5ca125693f641c737f66be8f5f27487996d3af1N.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1868
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4596
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:1448
  • C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
    C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5016
    • C:\Users\Admin\AppData\Roaming\Blasthost.exe
      "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
      2⤵
      • Executes dropped EXE
      PID:3800
    • C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
      "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1600
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4472
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:3036
  • C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
    C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3972
    • C:\Users\Admin\AppData\Roaming\Blasthost.exe
      "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
      2⤵
      • Executes dropped EXE
      PID:5116
    • C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
      "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3376
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4524
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:5076
  • C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
    C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4640
    • C:\Users\Admin\AppData\Roaming\Blasthost.exe
      "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
      2⤵
      • Executes dropped EXE
      PID:4584
    • C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
      "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2700
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2344
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:4000

Network

  • flag-us
    DNS
    217.106.137.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.106.137.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Host.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
    Response
    g.bing.com
    IN CNAME
    g-bing-com.ax-0001.ax-msedge.net
    g-bing-com.ax-0001.ax-msedge.net
    IN CNAME
    ax-0001.ax-msedge.net
    ax-0001.ax-msedge.net
    IN A
    150.171.28.10
    ax-0001.ax-msedge.net
    IN A
    150.171.27.10
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=3cd87ed0c77c45bd84ad1db5f9cdf702&localId=w:47999119-06B9-CF8D-8780-3C81959A9B6E&deviceId=6755476188931877&anid=
    Remote address:
    150.171.28.10:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=3cd87ed0c77c45bd84ad1db5f9cdf702&localId=w:47999119-06B9-CF8D-8780-3C81959A9B6E&deviceId=6755476188931877&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MUID=025F9BBC9212616A2F288EA093236045; domain=.bing.com; expires=Wed, 12-Nov-2025 04:49:52 GMT; path=/; SameSite=None; Secure; Priority=High;
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: D62C32E2375240FC8EF84A03E1727925 Ref B: LON601060102040 Ref C: 2024-10-18T04:49:52Z
    date: Fri, 18 Oct 2024 04:49:51 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=3cd87ed0c77c45bd84ad1db5f9cdf702&localId=w:47999119-06B9-CF8D-8780-3C81959A9B6E&deviceId=6755476188931877&anid=
    Remote address:
    150.171.28.10:443
    Request
    GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=3cd87ed0c77c45bd84ad1db5f9cdf702&localId=w:47999119-06B9-CF8D-8780-3C81959A9B6E&deviceId=6755476188931877&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=025F9BBC9212616A2F288EA093236045
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MSPTC=QjTLwUqu1ZRk9vwLjqoSPF2FMbszwi5DtDPgugE8s9U; domain=.bing.com; expires=Wed, 12-Nov-2025 04:49:52 GMT; path=/; Partitioned; secure; SameSite=None
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 39B34624CBA94B32AD95D9D9C5C07801 Ref B: LON601060102040 Ref C: 2024-10-18T04:49:52Z
    date: Fri, 18 Oct 2024 04:49:51 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=3cd87ed0c77c45bd84ad1db5f9cdf702&localId=w:47999119-06B9-CF8D-8780-3C81959A9B6E&deviceId=6755476188931877&anid=
    Remote address:
    150.171.28.10:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=3cd87ed0c77c45bd84ad1db5f9cdf702&localId=w:47999119-06B9-CF8D-8780-3C81959A9B6E&deviceId=6755476188931877&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=025F9BBC9212616A2F288EA093236045; MSPTC=QjTLwUqu1ZRk9vwLjqoSPF2FMbszwi5DtDPgugE8s9U
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 14D3729047CC4381AFA0B7C97AB9B60D Ref B: LON601060102040 Ref C: 2024-10-18T04:49:52Z
    date: Fri, 18 Oct 2024 04:49:51 GMT
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    72.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    72.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    26.35.223.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    26.35.223.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Host.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Host.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Host.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Host.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Host.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Host.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    212.20.149.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    212.20.149.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Host.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Host.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Host.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Host.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Host.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Host.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    88.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.210.23.2.in-addr.arpa
    IN PTR
    Response
    88.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-88deploystaticakamaitechnologiescom
  • flag-us
    DNS
    wealthyme.ddns.net
    Host.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Host.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Host.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Host.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    19.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    19.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Host.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Host.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Host.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    ax-0001.ax-msedge.net
    ax-0001.ax-msedge.net
    IN A
    150.171.27.10
    ax-0001.ax-msedge.net
    IN A
    150.171.28.10
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    ax-0001.ax-msedge.net
    ax-0001.ax-msedge.net
    IN A
    150.171.28.10
    ax-0001.ax-msedge.net
    IN A
    150.171.27.10
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239398629744_18YK2WB1TP6K8QRMK&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239398629744_18YK2WB1TP6K8QRMK&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 435129
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 9CC8787A24FF4F37ABAC46840D29D162 Ref B: LON601060101060 Ref C: 2024-10-18T04:51:30Z
    date: Fri, 18 Oct 2024 04:51:30 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301192_1O6NEWTZHCNXAKIDN&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239317301192_1O6NEWTZHCNXAKIDN&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 357673
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: DB38B4DD536E4CE29D1AB27B50A77412 Ref B: LON601060101060 Ref C: 2024-10-18T04:51:30Z
    date: Fri, 18 Oct 2024 04:51:30 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239340418540_1UQTKN6JO04LNXB5Q&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239340418540_1UQTKN6JO04LNXB5Q&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 676162
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 648B810F340249D68F626602437FC91C Ref B: LON601060101060 Ref C: 2024-10-18T04:51:30Z
    date: Fri, 18 Oct 2024 04:51:30 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239398629743_1TH437YUI5ZNDOHAL&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239398629743_1TH437YUI5ZNDOHAL&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 470956
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 04F66258531046459D1177E2C8DACD7F Ref B: LON601060101060 Ref C: 2024-10-18T04:51:30Z
    date: Fri, 18 Oct 2024 04:51:30 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239340418539_1KFG8UNZE5MUR2Y24&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239340418539_1KFG8UNZE5MUR2Y24&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 577346
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: EFDFC616C46B49E782B3E303D199B1EB Ref B: LON601060101060 Ref C: 2024-10-18T04:51:30Z
    date: Fri, 18 Oct 2024 04:51:30 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301601_1XLI7BR2VR1H1YJXB&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239317301601_1XLI7BR2VR1H1YJXB&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 331612
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 2E66888B6A1A463CA8E25FE237DCB28E Ref B: LON601060101060 Ref C: 2024-10-18T04:51:31Z
    date: Fri, 18 Oct 2024 04:51:31 GMT
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Host.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    58.99.105.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.99.105.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    58.99.105.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.99.105.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    10.27.171.150.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    10.27.171.150.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    10.27.171.150.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    10.27.171.150.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Host.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Host.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Host.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Host.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Host.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Host.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Host.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    Wealthy2019.com.strangled.net
    Host.exe
    Remote address:
    8.8.8.8:53
    Request
    Wealthy2019.com.strangled.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealthyme.ddns.net
    Host.exe
    Remote address:
    8.8.8.8:53
    Request
    wealthyme.ddns.net
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • flag-us
    DNS
    wealth.warzonedns.com
    RtDCpl64.exe
    Remote address:
    8.8.8.8:53
    Request
    wealth.warzonedns.com
    IN A
    Response
  • 150.171.28.10:443
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=3cd87ed0c77c45bd84ad1db5f9cdf702&localId=w:47999119-06B9-CF8D-8780-3C81959A9B6E&deviceId=6755476188931877&anid=
    tls, http2
    2.0kB
    9.4kB
    21
    19

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=3cd87ed0c77c45bd84ad1db5f9cdf702&localId=w:47999119-06B9-CF8D-8780-3C81959A9B6E&deviceId=6755476188931877&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=3cd87ed0c77c45bd84ad1db5f9cdf702&localId=w:47999119-06B9-CF8D-8780-3C81959A9B6E&deviceId=6755476188931877&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=3cd87ed0c77c45bd84ad1db5f9cdf702&localId=w:47999119-06B9-CF8D-8780-3C81959A9B6E&deviceId=6755476188931877&anid=

    HTTP Response

    204
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
    6.9kB
    15
    12
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
    6.9kB
    15
    13
  • 150.171.27.10:443
    https://tse1.mm.bing.net/th?id=OADD2.10239317301601_1XLI7BR2VR1H1YJXB&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    tls, http2
    103.9kB
    3.0MB
    2164
    2161

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239398629744_18YK2WB1TP6K8QRMK&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301192_1O6NEWTZHCNXAKIDN&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239340418540_1UQTKN6JO04LNXB5Q&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239398629743_1TH437YUI5ZNDOHAL&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239340418539_1KFG8UNZE5MUR2Y24&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301601_1XLI7BR2VR1H1YJXB&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Response

    200
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
    6.9kB
    15
    13
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
    6.9kB
    15
    13
  • 8.8.8.8:53
    217.106.137.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    217.106.137.52.in-addr.arpa

  • 8.8.8.8:53
    Wealthy2019.com.strangled.net
    dns
    Host.exe
    75 B
    134 B
    1
    1

    DNS Request

    Wealthy2019.com.strangled.net

  • 8.8.8.8:53
    g.bing.com
    dns
    56 B
    148 B
    1
    1

    DNS Request

    g.bing.com

    DNS Response

    150.171.28.10
    150.171.27.10

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    72.32.126.40.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    72.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    26.35.223.20.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    26.35.223.20.in-addr.arpa

  • 8.8.8.8:53
    wealthyme.ddns.net
    dns
    Host.exe
    64 B
    124 B
    1
    1

    DNS Request

    wealthyme.ddns.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    Wealthy2019.com.strangled.net
    dns
    Host.exe
    75 B
    134 B
    1
    1

    DNS Request

    Wealthy2019.com.strangled.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    wealthyme.ddns.net
    dns
    Host.exe
    64 B
    124 B
    1
    1

    DNS Request

    wealthyme.ddns.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    Wealthy2019.com.strangled.net
    dns
    Host.exe
    75 B
    134 B
    1
    1

    DNS Request

    Wealthy2019.com.strangled.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    wealthyme.ddns.net
    dns
    Host.exe
    64 B
    124 B
    1
    1

    DNS Request

    wealthyme.ddns.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    Wealthy2019.com.strangled.net
    dns
    Host.exe
    75 B
    134 B
    1
    1

    DNS Request

    Wealthy2019.com.strangled.net

  • 8.8.8.8:53
    212.20.149.52.in-addr.arpa
    dns
    72 B
    146 B
    1
    1

    DNS Request

    212.20.149.52.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
    144 B
    1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    wealthyme.ddns.net
    dns
    Host.exe
    64 B
    124 B
    1
    1

    DNS Request

    wealthyme.ddns.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    Wealthy2019.com.strangled.net
    dns
    Host.exe
    75 B
    134 B
    1
    1

    DNS Request

    Wealthy2019.com.strangled.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    wealthyme.ddns.net
    dns
    Host.exe
    64 B
    124 B
    1
    1

    DNS Request

    wealthyme.ddns.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    Wealthy2019.com.strangled.net
    dns
    Host.exe
    75 B
    134 B
    1
    1

    DNS Request

    Wealthy2019.com.strangled.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    wealthyme.ddns.net
    dns
    Host.exe
    64 B
    124 B
    1
    1

    DNS Request

    wealthyme.ddns.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    Wealthy2019.com.strangled.net
    dns
    Host.exe
    75 B
    134 B
    1
    1

    DNS Request

    Wealthy2019.com.strangled.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    88.210.23.2.in-addr.arpa
    dns
    70 B
    133 B
    1
    1

    DNS Request

    88.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    wealthyme.ddns.net
    dns
    Host.exe
    64 B
    124 B
    1
    1

    DNS Request

    wealthyme.ddns.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    Wealthy2019.com.strangled.net
    dns
    Host.exe
    75 B
    134 B
    1
    1

    DNS Request

    Wealthy2019.com.strangled.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    wealthyme.ddns.net
    dns
    Host.exe
    64 B
    124 B
    1
    1

    DNS Request

    wealthyme.ddns.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    Wealthy2019.com.strangled.net
    dns
    Host.exe
    75 B
    134 B
    1
    1

    DNS Request

    Wealthy2019.com.strangled.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    19.229.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    19.229.111.52.in-addr.arpa

  • 8.8.8.8:53
    wealthyme.ddns.net
    dns
    Host.exe
    64 B
    124 B
    1
    1

    DNS Request

    wealthyme.ddns.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    134 B
    280 B
    2
    2

    DNS Request

    wealth.warzonedns.com

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    Wealthy2019.com.strangled.net
    dns
    Host.exe
    75 B
    134 B
    1
    1

    DNS Request

    Wealthy2019.com.strangled.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    wealthyme.ddns.net
    dns
    Host.exe
    64 B
    124 B
    1
    1

    DNS Request

    wealthyme.ddns.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    134 B
    280 B
    2
    2

    DNS Request

    wealth.warzonedns.com

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    124 B
    340 B
    2
    2

    DNS Request

    tse1.mm.bing.net

    DNS Request

    tse1.mm.bing.net

    DNS Response

    150.171.27.10
    150.171.28.10

    DNS Response

    150.171.28.10
    150.171.27.10

  • 8.8.8.8:53
    Wealthy2019.com.strangled.net
    dns
    Host.exe
    75 B
    134 B
    1
    1

    DNS Request

    Wealthy2019.com.strangled.net

  • 8.8.8.8:53
    58.99.105.20.in-addr.arpa
    dns
    142 B
    314 B
    2
    2

    DNS Request

    58.99.105.20.in-addr.arpa

    DNS Request

    58.99.105.20.in-addr.arpa

  • 8.8.8.8:53
    10.27.171.150.in-addr.arpa
    dns
    144 B
    316 B
    2
    2

    DNS Request

    10.27.171.150.in-addr.arpa

    DNS Request

    10.27.171.150.in-addr.arpa

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    wealthyme.ddns.net
    dns
    Host.exe
    64 B
    124 B
    1
    1

    DNS Request

    wealthyme.ddns.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    134 B
    280 B
    2
    2

    DNS Request

    wealth.warzonedns.com

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    Wealthy2019.com.strangled.net
    dns
    Host.exe
    75 B
    134 B
    1
    1

    DNS Request

    Wealthy2019.com.strangled.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    wealthyme.ddns.net
    dns
    Host.exe
    64 B
    124 B
    1
    1

    DNS Request

    wealthyme.ddns.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    Wealthy2019.com.strangled.net
    dns
    Host.exe
    75 B
    134 B
    1
    1

    DNS Request

    Wealthy2019.com.strangled.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    wealthyme.ddns.net
    dns
    Host.exe
    64 B
    124 B
    1
    1

    DNS Request

    wealthyme.ddns.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    Wealthy2019.com.strangled.net
    dns
    Host.exe
    75 B
    134 B
    1
    1

    DNS Request

    Wealthy2019.com.strangled.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    wealthyme.ddns.net
    dns
    Host.exe
    64 B
    124 B
    1
    1

    DNS Request

    wealthyme.ddns.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    Wealthy2019.com.strangled.net
    dns
    Host.exe
    75 B
    134 B
    1
    1

    DNS Request

    Wealthy2019.com.strangled.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    67 B
    140 B
    1
    1

    DNS Request

    wealth.warzonedns.com

  • 8.8.8.8:53
    wealthyme.ddns.net
    dns
    Host.exe
    64 B
    124 B
    1
    1

    DNS Request

    wealthyme.ddns.net

  • 8.8.8.8:53
    wealth.warzonedns.com
    dns
    RtDCpl64.exe
    134 B
    280 B
    2
    2

    DNS Request

    wealth.warzonedns.com

    DNS Request

    wealth.warzonedns.com

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Blasthost.exe

    Filesize

    132KB

    MD5

    6087bf6af59b9c531f2c9bb421d5e902

    SHA1

    8bc0f1596c986179b82585c703bacae6d2a00316

    SHA256

    3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c

    SHA512

    c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292

  • C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe

    Filesize

    1.4MB

    MD5

    f243f0808e8040b5321e35e1810ef698

    SHA1

    586d7745ae6ba5d51a7fc709bb5df0077c058091

    SHA256

    51abfd3fb4642544b024b1895a28c6f84930aade2e21f20c1dcbfe0ed032f19f

    SHA512

    200e6d26594069b3b8273ab77329b763eb5fdcc4449e3914138fdadc8702f29143e18917338eed5d2a3eae722d2a2cc265529361d77d082f462af0ed0882cab8

  • memory/1600-47-0x0000000000410000-0x000000000042D000-memory.dmp

    Filesize

    116KB

  • memory/1600-39-0x0000000000410000-0x000000000042D000-memory.dmp

    Filesize

    116KB

  • memory/1868-15-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/1868-23-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/2184-12-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/2800-14-0x0000000004840000-0x0000000004841000-memory.dmp

    Filesize

    4KB

  • memory/2800-25-0x0000000000E80000-0x0000000000FEB000-memory.dmp

    Filesize

    1.4MB

  • memory/2800-0-0x0000000000E80000-0x0000000000FEB000-memory.dmp

    Filesize

    1.4MB

  • memory/3800-53-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/3972-75-0x0000000000790000-0x00000000008FB000-memory.dmp

    Filesize

    1.4MB

  • memory/4320-52-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/4320-28-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/4472-49-0x0000000001150000-0x0000000001151000-memory.dmp

    Filesize

    4KB

  • memory/4524-76-0x00000000001F0000-0x00000000001F1000-memory.dmp

    Filesize

    4KB

  • memory/4596-26-0x0000000001260000-0x0000000001261000-memory.dmp

    Filesize

    4KB

  • memory/4640-107-0x0000000000790000-0x00000000008FB000-memory.dmp

    Filesize

    1.4MB

  • memory/5016-48-0x0000000000790000-0x00000000008FB000-memory.dmp

    Filesize

    1.4MB

  • memory/5016-30-0x0000000000790000-0x00000000008FB000-memory.dmp

    Filesize

    1.4MB

  • memory/5116-80-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.