Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

379b9ed30d...fe.exe

windows7-x64

10

379b9ed30d...fe.exe

windows10-2004-x64

10

379b9ed30d...fe.exe

windows10-ltsc 2021-x64

10

379b9ed30d...fe.exe

windows11-21h2-x64

3

Resubmissions

29/10/2024, 12:19 UTC

241029-pg5r4atqdz 10

01/12/2021, 21:00 UTC

211201-ztqh2sbbb3 10

Analysis

  • max time kernel
    140s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/10/2024, 12:19 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    379b9ed30dee34d61d678e5f24ffcca1b8e94fdf3f49a15d95947ba6dfba2dfe.exe

  • Size

    442KB

  • MD5

    dbc8c65968ed3823a9716478dbd9d49a

  • SHA1

    0a63ad61469fa208cef9d6b1d8c3f9de5ad0a899

  • SHA256

    379b9ed30dee34d61d678e5f24ffcca1b8e94fdf3f49a15d95947ba6dfba2dfe

  • SHA512

    c44f457f6668bded436acad1b94dfab2bafcceb978aacb1f814e06eb65374a3b5f052a7c05182aa898e4fc12fa8c1743d8229c646e49689e8e2fe39b9e83f412

  • SSDEEP

    6144:TmdckoOVAQwglvkNo1cThqGhCV3YDd+DG0XYPfbW7yV1O7TC/d:TmScV4VNo1cTNha3YDd+DG0XYa701Ov

Score
10/10
redline1discoveryinfostealer

Malware Config

Extracted

Family

redline

Botnet

1

C2

45.9.20.59:46287

Attributes
  • auth_value

    ec6ada170bcec2e72f0e1f3954547f73

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 35 IoCs
  • Redline family
    redline
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\379b9ed30dee34d61d678e5f24ffcca1b8e94fdf3f49a15d95947ba6dfba2dfe.exe
    "C:\Users\Admin\AppData\Local\Temp\379b9ed30dee34d61d678e5f24ffcca1b8e94fdf3f49a15d95947ba6dfba2dfe.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:3172

Network

  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
    Response
    g.bing.com
    IN CNAME
    g-bing-com.ax-0001.ax-msedge.net
    g-bing-com.ax-0001.ax-msedge.net
    IN CNAME
    ax-0001.ax-msedge.net
    ax-0001.ax-msedge.net
    IN A
    150.171.28.10
    ax-0001.ax-msedge.net
    IN A
    150.171.27.10
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8f91d72589b94949afe448f23b7312df&localId=w:740B9CEB-14AC-B2F7-6798-137B0EC388FF&deviceId=6825841072483399&anid=
    Remote address:
    150.171.28.10:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8f91d72589b94949afe448f23b7312df&localId=w:740B9CEB-14AC-B2F7-6798-137B0EC388FF&deviceId=6825841072483399&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MUID=37F801B983B16CE20B10149E82B76D31; domain=.bing.com; expires=Sun, 23-Nov-2025 12:19:11 GMT; path=/; SameSite=None; Secure; Priority=High;
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: A61FE78A68A34C2C9AFAA68BD6ED1F01 Ref B: LON601060107034 Ref C: 2024-10-29T12:19:11Z
    date: Tue, 29 Oct 2024 12:19:11 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=8f91d72589b94949afe448f23b7312df&localId=w:740B9CEB-14AC-B2F7-6798-137B0EC388FF&deviceId=6825841072483399&anid=
    Remote address:
    150.171.28.10:443
    Request
    GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=8f91d72589b94949afe448f23b7312df&localId=w:740B9CEB-14AC-B2F7-6798-137B0EC388FF&deviceId=6825841072483399&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=37F801B983B16CE20B10149E82B76D31
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MSPTC=YlW2sjTh2-YNF-ePrPqtUR4TrQamegbUMTFGQV46gtc; domain=.bing.com; expires=Sun, 23-Nov-2025 12:19:11 GMT; path=/; Partitioned; secure; SameSite=None
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 58EB83F515944CB089AF25D7DB693C5C Ref B: LON601060107034 Ref C: 2024-10-29T12:19:11Z
    date: Tue, 29 Oct 2024 12:19:11 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8f91d72589b94949afe448f23b7312df&localId=w:740B9CEB-14AC-B2F7-6798-137B0EC388FF&deviceId=6825841072483399&anid=
    Remote address:
    150.171.28.10:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8f91d72589b94949afe448f23b7312df&localId=w:740B9CEB-14AC-B2F7-6798-137B0EC388FF&deviceId=6825841072483399&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=37F801B983B16CE20B10149E82B76D31; MSPTC=YlW2sjTh2-YNF-ePrPqtUR4TrQamegbUMTFGQV46gtc
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 25ADF289EF0A475B84B0C2DD2FAF5DA3 Ref B: LON601060107034 Ref C: 2024-10-29T12:19:11Z
    date: Tue, 29 Oct 2024 12:19:11 GMT
  • flag-us
    DNS
    88.156.103.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.156.103.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    69.190.18.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    69.190.18.2.in-addr.arpa
    IN PTR
    Response
    69.190.18.2.in-addr.arpa
    IN PTR
    a2-18-190-69deploystaticakamaitechnologiescom
  • flag-us
    DNS
    30.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    30.243.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    ax-0001.ax-msedge.net
    ax-0001.ax-msedge.net
    IN A
    150.171.27.10
    ax-0001.ax-msedge.net
    IN A
    150.171.28.10
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239360615987_16QLWX2YIZJRGGD7R&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239360615987_16QLWX2YIZJRGGD7R&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 258855
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 0ABB53C3FBAF4EACB48C141C4208489D Ref B: LON601060102023 Ref C: 2024-10-29T12:20:51Z
    date: Tue, 29 Oct 2024 12:20:51 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239398629743_1TH437YUI5ZNDOHAL&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239398629743_1TH437YUI5ZNDOHAL&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 453802
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 1EDC0A409B754F319A0ED55C3C612488 Ref B: LON601060102023 Ref C: 2024-10-29T12:20:51Z
    date: Tue, 29 Oct 2024 12:20:51 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239340418602_13EDNGC3ZL2WGZFXN&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239340418602_13EDNGC3ZL2WGZFXN&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 470956
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: F3924DE9026741C0AB9C5B9285B17F70 Ref B: LON601060102023 Ref C: 2024-10-29T12:20:51Z
    date: Tue, 29 Oct 2024 12:20:51 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239360615986_1M5N6Y5ACPFWCCI4D&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239360615986_1M5N6Y5ACPFWCCI4D&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 407830
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: CBE7B122A65149C1AD09B4D31671BA3D Ref B: LON601060102023 Ref C: 2024-10-29T12:20:51Z
    date: Tue, 29 Oct 2024 12:20:51 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239340418601_1XRLHD1YRS9ZZSDWX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239340418601_1XRLHD1YRS9ZZSDWX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 305259
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 3C9CA6BB1DB14F9AA02FD11B2254FFB7 Ref B: LON601060102023 Ref C: 2024-10-29T12:20:51Z
    date: Tue, 29 Oct 2024 12:20:51 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239398629744_18YK2WB1TP6K8QRMK&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239398629744_18YK2WB1TP6K8QRMK&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 435129
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: B1B1E45210174D13B86536C6AB02F1D6 Ref B: LON601060102023 Ref C: 2024-10-29T12:20:51Z
    date: Tue, 29 Oct 2024 12:20:51 GMT
  • flag-us
    DNS
    10.27.171.150.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    10.27.171.150.in-addr.arpa
    IN PTR
    Response
  • 150.171.28.10:443
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8f91d72589b94949afe448f23b7312df&localId=w:740B9CEB-14AC-B2F7-6798-137B0EC388FF&deviceId=6825841072483399&anid=
    tls, http2
    2.0kB
     9.4kB
     22
    19

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8f91d72589b94949afe448f23b7312df&localId=w:740B9CEB-14AC-B2F7-6798-137B0EC388FF&deviceId=6825841072483399&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=8f91d72589b94949afe448f23b7312df&localId=w:740B9CEB-14AC-B2F7-6798-137B0EC388FF&deviceId=6825841072483399&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=8f91d72589b94949afe448f23b7312df&localId=w:740B9CEB-14AC-B2F7-6798-137B0EC388FF&deviceId=6825841072483399&anid=

    HTTP Response

    204
  • 45.9.20.59:46287
    379b9ed30dee34d61d678e5f24ffcca1b8e94fdf3f49a15d95947ba6dfba2dfe.exe
    260 B
     5
  • 45.9.20.59:46287
    379b9ed30dee34d61d678e5f24ffcca1b8e94fdf3f49a15d95947ba6dfba2dfe.exe
    260 B
     5
  • 45.9.20.59:46287
    379b9ed30dee34d61d678e5f24ffcca1b8e94fdf3f49a15d95947ba6dfba2dfe.exe
    260 B
     5
  • 45.9.20.59:46287
    379b9ed30dee34d61d678e5f24ffcca1b8e94fdf3f49a15d95947ba6dfba2dfe.exe
    260 B
     5
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     6.9kB
     15
    13
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     6.9kB
     15
    13
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     6.9kB
     15
    13
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     6.9kB
     15
    13
  • 150.171.27.10:443
    https://tse1.mm.bing.net/th?id=OADD2.10239398629744_18YK2WB1TP6K8QRMK&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    tls, http2
    84.4kB
     2.4MB
     1766
    1760

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239360615987_16QLWX2YIZJRGGD7R&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239398629743_1TH437YUI5ZNDOHAL&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239340418602_13EDNGC3ZL2WGZFXN&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239360615986_1M5N6Y5ACPFWCCI4D&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239340418601_1XRLHD1YRS9ZZSDWX&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239398629744_18YK2WB1TP6K8QRMK&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Response

    200
  • 45.9.20.59:46287
    379b9ed30dee34d61d678e5f24ffcca1b8e94fdf3f49a15d95947ba6dfba2dfe.exe
    260 B
     5
  • 45.9.20.59:46287
    379b9ed30dee34d61d678e5f24ffcca1b8e94fdf3f49a15d95947ba6dfba2dfe.exe
    260 B
     5
  • 8.8.8.8:53
    209.205.72.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    209.205.72.20.in-addr.arpa

  • 8.8.8.8:53
    g.bing.com
    dns
    56 B
     148 B
     1
    1

    DNS Request

    g.bing.com

    DNS Response

    150.171.28.10
    150.171.27.10

  • 8.8.8.8:53
    88.156.103.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    88.156.103.20.in-addr.arpa

  • 8.8.8.8:53
    50.23.12.20.in-addr.arpa
    dns
    70 B
     156 B
     1
    1

    DNS Request

    50.23.12.20.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    69.190.18.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    69.190.18.2.in-addr.arpa

  • 8.8.8.8:53
    30.243.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    30.243.111.52.in-addr.arpa

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    62 B
     170 B
     1
    1

    DNS Request

    tse1.mm.bing.net

    DNS Response

    150.171.27.10
    150.171.28.10

  • 8.8.8.8:53
    10.27.171.150.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    10.27.171.150.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3172-2-0x00000000001C0000-0x00000000001F9000-memory.dmp

    Filesize

    228KB

    Download

  • memory/3172-1-0x0000000000730000-0x0000000000830000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/3172-3-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/3172-4-0x0000000000400000-0x00000000004F0000-memory.dmp

    Filesize

    960KB

    Download

  • memory/3172-5-0x00000000023A0000-0x00000000023D4000-memory.dmp

    Filesize

    208KB

    Download

  • memory/3172-6-0x0000000004CB0000-0x0000000005254000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/3172-7-0x00000000024E0000-0x0000000002512000-memory.dmp

    Filesize

    200KB

    Download

  • memory/3172-63-0x00000000024E0000-0x000000000250C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/3172-71-0x00000000024E0000-0x000000000250C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/3172-69-0x00000000024E0000-0x000000000250C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/3172-67-0x00000000024E0000-0x000000000250C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/3172-65-0x00000000024E0000-0x000000000250C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/3172-61-0x00000000024E0000-0x000000000250C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/3172-60-0x00000000024E0000-0x000000000250C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/3172-57-0x00000000024E0000-0x000000000250C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/3172-55-0x00000000024E0000-0x000000000250C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/3172-53-0x00000000024E0000-0x000000000250C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/3172-51-0x00000000024E0000-0x000000000250C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/3172-49-0x00000000024E0000-0x000000000250C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/3172-47-0x00000000024E0000-0x000000000250C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/3172-45-0x00000000024E0000-0x000000000250C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/3172-43-0x00000000024E0000-0x000000000250C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/3172-41-0x00000000024E0000-0x000000000250C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/3172-39-0x00000000024E0000-0x000000000250C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/3172-37-0x00000000024E0000-0x000000000250C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/3172-33-0x00000000024E0000-0x000000000250C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/3172-32-0x00000000024E0000-0x000000000250C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/3172-29-0x00000000024E0000-0x000000000250C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/3172-27-0x00000000024E0000-0x000000000250C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/3172-25-0x00000000024E0000-0x000000000250C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/3172-23-0x00000000024E0000-0x000000000250C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/3172-21-0x00000000024E0000-0x000000000250C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/3172-19-0x00000000024E0000-0x000000000250C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/3172-17-0x00000000024E0000-0x000000000250C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/3172-35-0x00000000024E0000-0x000000000250C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/3172-15-0x00000000024E0000-0x000000000250C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/3172-13-0x00000000024E0000-0x000000000250C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/3172-11-0x00000000024E0000-0x000000000250C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/3172-9-0x00000000024E0000-0x000000000250C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/3172-8-0x00000000024E0000-0x000000000250C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/3172-958-0x0000000005260000-0x0000000005878000-memory.dmp

    Filesize

    6.1MB

    Download

  • memory/3172-959-0x0000000004BA0000-0x0000000004BB2000-memory.dmp

    Filesize

    72KB

    Download

  • memory/3172-960-0x0000000005880000-0x000000000598A000-memory.dmp

    Filesize

    1.0MB

    Download

  • memory/3172-961-0x0000000004BE0000-0x0000000004C1C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/3172-962-0x0000000004C50000-0x0000000004C9C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/3172-963-0x0000000000730000-0x0000000000830000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/3172-964-0x00000000001C0000-0x00000000001F9000-memory.dmp

    Filesize

    228KB

    Download

  • memory/3172-965-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.