Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

brain.exe

windows7-x64

10

brain.exe

windows10-2004-x64

10

Resubmissions

26/02/2025, 22:29 UTC

250226-2epdjsvygx 10

26/02/2025, 21:48 UTC

250226-1nyg5stzdt 10

21/02/2025, 20:45 UTC

250221-zjsweszqar 10

Analysis

  • max time kernel
    727s
  • max time network
    696s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/02/2025, 22:29 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    brain.exe

  • Size

    147KB

  • MD5

    448f1796fe8de02194b21c0715e0a5f6

  • SHA1

    935c0b39837319fda571aa800b67d997b79c3198

  • SHA256

    eb82946fa0de261e92f8f60aa878c9fef9ebb34fdababa66995403b110118b12

  • SHA512

    0b93b2c881b1351ff688089abf12bbfcff279c5d6ca8733d6d821c83148d73c85cfedf5ab5bc02c2145970124b518551db3a9fc701d8084f01009ae20f71a831

  • SSDEEP

    3072:l6glyuxE4GsUPnliByocWep0yjEJ3hDRMK89nB2:l6gDBGpvEByocWeebbMjV4

Score
10/10
braincipherdefense_evasiondiscoveryransomwarespywarestealer

Malware Config

Extracted

Path

C:\sYMY1N6ah.README.txt

Family

braincipher

Ransom Note
*** Welcome to Brain Cipher Ransomware! *** Dear managers! If you're reading this, it means your systems have been hacked and encrypted and your data stolen. *** The most proper way to safely recover your data is through our support. We can recover your systems within 4-6 hours. In order for it to be successful, you must follow a few points: 1.Don't go to the police, etc. 2.Do not attempt to recover data on your own. 3.Do not take the help of third-party data recovery companies. In most cases, they are scammers who will pay us a ransom and take a for themselves. *** If you violate any 1 of these points, we will refuse to cooperate with you!!! 3 steps to data recovery: 1. Download and install Tor Browser (https://www.torproject.org/download/) 2. Go to our support page: http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion 3. Enter your encryption ID: M8AL5cWJEU5CnMMPwCdt4x9NVn0ZY2uNtIgnKwkDJwdPbnanVROYFzGmgUCImexTGDmINYgSZXdlhM7D199lNMb294TGY2 Email to support: brain.support@cyberfear.com
Emails

brain.support@cyberfear.com

URLs

http://mybmtbgd7aprdnw2ekxht5qap5daam2wch25coqerrq2zdioanob34ad.onion

Signatures

  • Brain Cipher

    Ransomware family based on Lockbit that was first observed in June 2024.

    ransomwarebraincipher
  • Braincipher family
    braincipher
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: RenamesItself 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 31 IoCs
  • Suspicious use of SendNotifyMessage 28 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\brain.exe
    "C:\Users\Admin\AppData\Local\Temp\brain.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4852
    • C:\ProgramData\D88D.tmp
      "C:\ProgramData\D88D.tmp"
      2⤵
      • Checks computer location settings
      • Deletes itself
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: RenamesItself
      • Suspicious use of WriteProcessMemory
      PID:3588
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\D88D.tmp >> NUL
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1168
  • C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\PushEnable.mpa"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:3140
  • C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\PushEnable.mpa"
    1⤵
      PID:4992
    • C:\Program Files\VideoLAN\VLC\vlc.exe
      "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\PushEnable.mpa"
      1⤵
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2872
    • C:\Program Files\VideoLAN\VLC\vlc.exe
      "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RequestUnprotect.mpa"
      1⤵
        PID:3400

      Network

      • flag-us
        DNS
        tse1.mm.bing.net
        Remote address:
        8.8.8.8:53
        Request
        tse1.mm.bing.net
        IN A
        Response
        tse1.mm.bing.net
        IN CNAME
        mm-mm.bing.net.trafficmanager.net
        mm-mm.bing.net.trafficmanager.net
        IN CNAME
        ax-0001.ax-msedge.net
        ax-0001.ax-msedge.net
        IN A
        150.171.28.10
        ax-0001.ax-msedge.net
        IN A
        150.171.27.10
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239340418566_1KUOCUMD7VRU52NBF&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        Remote address:
        150.171.28.10:443
        Request
        GET /th?id=OADD2.10239340418566_1KUOCUMD7VRU52NBF&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 344530
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: FE6AFAD712AC4CE2B182A2B10D59EE80 Ref B: FRA31EDGE0711 Ref C: 2025-02-26T22:30:04Z
        date: Wed, 26 Feb 2025 22:30:04 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239340418565_1OUCQO7VP7RV95UTY&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        Remote address:
        150.171.28.10:443
        Request
        GET /th?id=OADD2.10239340418565_1OUCQO7VP7RV95UTY&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 436830
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 9CDAD6D01EF94702B21D5AF1D4F0CAFC Ref B: FRA31EDGE0711 Ref C: 2025-02-26T22:30:04Z
        date: Wed, 26 Feb 2025 22:30:04 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239340418545_11VT5XTZM3TEDIRSP&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        Remote address:
        150.171.28.10:443
        Request
        GET /th?id=OADD2.10239340418545_11VT5XTZM3TEDIRSP&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 663266
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: DC2246B834A44765964C51EECBB511E4 Ref B: FRA31EDGE0214 Ref C: 2025-02-26T22:30:33Z
        date: Wed, 26 Feb 2025 22:30:32 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239356744296_15VBZP2MRT6FYDL3E&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        Remote address:
        150.171.28.10:443
        Request
        GET /th?id=OADD2.10239356744296_15VBZP2MRT6FYDL3E&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 675918
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: FA2C94434B244A1EBB6FE3CB09B83604 Ref B: FRA31EDGE0214 Ref C: 2025-02-26T22:30:33Z
        date: Wed, 26 Feb 2025 22:30:32 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239356742545_1KNYU9T4JPR3SHFV1&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        Remote address:
        150.171.28.10:443
        Request
        GET /th?id=OADD2.10239356742545_1KNYU9T4JPR3SHFV1&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 581101
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: E1747362C2EF4E41B8EF026BD44A8980 Ref B: FRA31EDGE0214 Ref C: 2025-02-26T22:30:33Z
        date: Wed, 26 Feb 2025 22:30:32 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301592_19S8DNJJK87B8889G&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        Remote address:
        150.171.28.10:443
        Request
        GET /th?id=OADD2.10239317301592_19S8DNJJK87B8889G&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 880886
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: EE0D90B38B0E419FAD01F0E20F1556CB Ref B: FRA31EDGE0214 Ref C: 2025-02-26T22:30:33Z
        date: Wed, 26 Feb 2025 22:30:32 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301183_1Q7FZ9HQ4P9RCH5CO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        Remote address:
        150.171.28.10:443
        Request
        GET /th?id=OADD2.10239317301183_1Q7FZ9HQ4P9RCH5CO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 706813
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 553BE911A0D24BE9853AD85ED4705FE6 Ref B: FRA31EDGE0214 Ref C: 2025-02-26T22:30:33Z
        date: Wed, 26 Feb 2025 22:30:32 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239340418546_1PNT9LCA42P8D0DO5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        Remote address:
        150.171.28.10:443
        Request
        GET /th?id=OADD2.10239340418546_1PNT9LCA42P8D0DO5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 635249
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: DF39E3B4C7C84FF88E69FF9ED1AC06C7 Ref B: FRA31EDGE0214 Ref C: 2025-02-26T22:30:37Z
        date: Wed, 26 Feb 2025 22:30:37 GMT
      • flag-us
        DNS
        update.videolan.org
        vlc.exe
        Remote address:
        8.8.8.8:53
        Request
        update.videolan.org
        IN A
        Response
        update.videolan.org
        IN A
        213.36.253.119
      • flag-fr
        GET
        http://update.videolan.org/vlc/status-win-x64
        vlc.exe
        Remote address:
        213.36.253.119:80
        Request
        GET /vlc/status-win-x64 HTTP/1.1
        Host: update.videolan.org
        Accept: */*
        Accept-Language: en_US
        User-Agent: VLC/3.0.20 LibVLC/3.0.20
        Range: bytes=0-
        Response
        HTTP/1.1 206 Partial Content
        Server: nginx/1.25.4
        Date: Wed, 26 Feb 2025 22:31:16 GMT
        Content-Type: application/octet-stream
        Content-Length: 528
        Connection: keep-alive
        Last-Modified: Thu, 02 Nov 2023 00:26:19 GMT
        ETag: "6542ecab-210"
        Content-Range: bytes 0-527/528
        X-Clacks-Overhead: GNU Terry Pratchett
        Strict-Transport-Security: max-age=31536000
      • flag-fr
        GET
        http://update.videolan.org/vlc/status-win-x64.asc
        vlc.exe
        Remote address:
        213.36.253.119:80
        Request
        GET /vlc/status-win-x64.asc HTTP/1.1
        Host: update.videolan.org
        Accept: */*
        Accept-Language: en_US
        User-Agent: VLC/3.0.20 LibVLC/3.0.20
        Range: bytes=0-
        Response
        HTTP/1.1 206 Partial Content
        Server: nginx/1.25.4
        Date: Wed, 26 Feb 2025 22:31:16 GMT
        Content-Type: application/octet-stream
        Content-Length: 195
        Connection: keep-alive
        Last-Modified: Thu, 02 Nov 2023 00:26:19 GMT
        ETag: "6542ecab-c3"
        Content-Range: bytes 0-194/195
        X-Clacks-Overhead: GNU Terry Pratchett
        Strict-Transport-Security: max-age=31536000
      • flag-gb
        GET
        https://www.bing.com/th?id=OADD2.10239414284817_1UVYYSBXC4CID8KBL&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=48&h=48&dynsize=1&qlt=90
        Remote address:
        92.123.128.135:443
        Request
        GET /th?id=OADD2.10239414284817_1UVYYSBXC4CID8KBL&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=48&h=48&dynsize=1&qlt=90 HTTP/2.0
        host: www.bing.com
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-type: image/jpeg
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QWthbWFp"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        content-length: 1981
        date: Wed, 26 Feb 2025 22:40:06 GMT
        alt-svc: h3=":443"; ma=93600
        x-cdn-traceid: 0.8b777b5c.1740609606.e9be43d
      • 150.171.28.10:443
        https://tse1.mm.bing.net/th?id=OADD2.10239340418565_1OUCQO7VP7RV95UTY&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        tls, http2
        28.5kB
         815.1kB
         601
        596

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239340418566_1KUOCUMD7VRU52NBF&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239340418565_1OUCQO7VP7RV95UTY&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

        HTTP Response

        200

        HTTP Response

        200
      • 150.171.28.10:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         6.9kB
         15
        13
      • 150.171.28.10:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         6.9kB
         15
        13
      • 150.171.28.10:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         6.9kB
         15
        13
      • 150.171.28.10:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         6.9kB
         15
        13
      • 150.171.28.10:443
        https://tse1.mm.bing.net/th?id=OADD2.10239340418546_1PNT9LCA42P8D0DO5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        tls, http2
        148.3kB
         4.3MB
         3163
        3154

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239340418545_11VT5XTZM3TEDIRSP&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239356744296_15VBZP2MRT6FYDL3E&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239356742545_1KNYU9T4JPR3SHFV1&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301592_19S8DNJJK87B8889G&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301183_1Q7FZ9HQ4P9RCH5CO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

        HTTP Response

        200

        HTTP Response

        200

        HTTP Response

        200

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239340418546_1PNT9LCA42P8D0DO5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

        HTTP Response

        200

        HTTP Response

        200

        HTTP Response

        200
      • 150.171.28.10:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         6.9kB
         15
        11
      • 213.36.253.119:80
        http://update.videolan.org/vlc/status-win-x64
        http
        vlc.exe
        385 B
         1.1kB
         5
        4

        HTTP Request

        GET http://update.videolan.org/vlc/status-win-x64

        HTTP Response

        206
      • 213.36.253.119:80
        http://update.videolan.org/vlc/status-win-x64.asc
        http
        vlc.exe
        389 B
         727 B
         5
        4

        HTTP Request

        GET http://update.videolan.org/vlc/status-win-x64.asc

        HTTP Response

        206
      • 92.123.128.135:443
        https://www.bing.com/th?id=OADD2.10239414284817_1UVYYSBXC4CID8KBL&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=48&h=48&dynsize=1&qlt=90
        tls, http2
        1.5kB
         7.3kB
         18
        14

        HTTP Request

        GET https://www.bing.com/th?id=OADD2.10239414284817_1UVYYSBXC4CID8KBL&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=48&h=48&dynsize=1&qlt=90

        HTTP Response

        200
      • 8.8.8.8:53
        tse1.mm.bing.net
        dns
        62 B
         170 B
         1
        1

        DNS Request

        tse1.mm.bing.net

        DNS Response

        150.171.28.10
        150.171.27.10

      • 8.8.8.8:53
        update.videolan.org
        dns
        vlc.exe
        65 B
         81 B
         1
        1

        DNS Request

        update.videolan.org

        DNS Response

        213.36.253.119

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\$Recycle.Bin\S-1-5-21-1294999112-580688058-1763548717-1000\AAAAAAAAAAA
        Filesize

        129B

        MD5

        b4bc7308ebaeec6e1254b6c0a5169929

        SHA1

        ec2cd2df2ab8149ce649576f4bc466feaaf5d85f

        SHA256

        894132627e16c8db50da1f92ba14bb67bb6b9e9db9f704edab363a521628032f

        SHA512

        2b9d37d0671ee48b0198ec08ac19fe86aba6b6c25639c84b09bcc56309d3280ef5783c09ecd9f96c581e3d0eeba73a9bff46755b3aa64b6d5df20862e3eda426

        Download Submit

      • C:\ProgramData\D88D.tmp
        Filesize

        14KB

        MD5

        294e9f64cb1642dd89229fff0592856b

        SHA1

        97b148c27f3da29ba7b18d6aee8a0db9102f47c9

        SHA256

        917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2

        SHA512

        b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf

        Download Submit

      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\f320adc4-3786-4397-9df7-d98fd563b504.down_data
        Filesize

        144KB

        MD5

        fe5e517b2fd335739390f6d18286f56c

        SHA1

        ab734536b4fefa07643e4b4d2aa8ef97b27d833b

        SHA256

        e2839e99e893283d7671e206269386568b3ceb475a36d30616d499b35395b562

        SHA512

        8cacf25c546ab44f34c2f1fc371a33c12e4d0194fb5b89b12b8e3e6c8c83449e42212386dff2c08b6edd400d83b90004e14701979ae41f3f6af5835394b2fff3

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\EEEEEEEEE
        Filesize

        147KB

        MD5

        9ba07338397807a91db98cb49c984cad

        SHA1

        24ec4d75cf9e10089a30e893db261870652bc9a7

        SHA256

        ca8d37ba0674a89ffbebdba368a7b4a7c067ee40e65453ca9551e31b6615c040

        SHA512

        1e9758110e265e89c7f2859b2e6c4e3d1f5b8397183b3c1ff867e272370ed9cef1a1d660c8ebbdc78d8e03db01307d4786bdbc326ae1a82f0dc18309a64ff2b8

        Download Submit

      • C:\Users\Admin\AppData\Roaming\vlc\ml.xspf
        Filesize

        304B

        MD5

        781602441469750c3219c8c38b515ed4

        SHA1

        e885acd1cbd0b897ebcedbb145bef1c330f80595

        SHA256

        81970dbe581373d14fbd451ac4b3f96e5f69b79645f1ee1ca715cff3af0bf20d

        SHA512

        2b0a1717d96edb47bdf0ffeb250a5ec11f7d0638d3e0a62fbe48c064379b473ca88ffbececb32a72129d06c040b107834f1004ccda5f0f35b8c3588034786461

        Download Submit

      • C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
        Filesize

        530B

        MD5

        c6e4ba2d784238b69123182b12561932

        SHA1

        e71bdbf0b7a8fe8a45131005a91d45f2aa0827a0

        SHA256

        275fa5d142f817c039c040851d94c28e7547238b15afd56205265834b8f76321

        SHA512

        1fda9df2afc442f481f44977e07d9a4c9ed0c20ea4c0f57ce51e250593a0471618bc01d0721d65fb761e9094c3d5b8379ec17c70cfaac04c8e9417fe46c2b15a

        Download Submit

      • C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.fe2872
        Filesize

        572B

        MD5

        070812496ad172598e3d1ba2bdd2a301

        SHA1

        2027de0c3b38fb46a831160c4a21e530077be71f

        SHA256

        4f69d4065a49d257c65d84bfdfb9418684abc3b46cd7c5e9cf63bb5692187750

        SHA512

        d1131f3b405d0f3d6fc9a8d891ae4b73bbf6c65d8ac00393b1aa7efe072468c99f64ee8d1a964b8576e6911d4923a28cd3ba2f690503f63ae2de1f341c010be6

        Download Submit

      • C:\Users\Admin\AppData\Roaming\vlc\vlcrc
        Filesize

        94KB

        MD5

        7b37c4f352a44c8246bf685258f75045

        SHA1

        817dacb245334f10de0297e69c98b4c9470f083e

        SHA256

        ec45f6e952b43eddc214dba703cf7f31398f3c9f535aad37f42237c56b9b778e

        SHA512

        1e8d675b3c6c9ba257b616da268cac7f1c7a9db12ffb831ed5f8d43c0887d711c197ebc9daf735e3da9a0355bf21c2b29a2fb38a46482a2c5c8cd5628fea4c02

        Download Submit

      • C:\sYMY1N6ah.README.txt
        Filesize

        1KB

        MD5

        deb2e0756d331362d57ad9fe408c4ff3

        SHA1

        870865aad7c7cccafbca0c1f50f7eecaedbd4bf1

        SHA256

        1ddacee1d25936970279557169037a335b362f86c3797ded625d68077bd0145c

        SHA512

        e218624d2704517a358df0dfb794116bbeed3ad81daae8c07d5d969e61e7936ed043911008f4816d663de373fd23515219c8038dd22e5838af7df1678a0134a6

        Download Submit

      • F:\$RECYCLE.BIN\S-1-5-21-1294999112-580688058-1763548717-1000\DDDDDDDDDDD
        Filesize

        129B

        MD5

        9a9a583719dfd38ed55279119c3554b8

        SHA1

        313c0abaf0d3fe822245b2e7d76993393d7e2fe2

        SHA256

        9af6b512765ed7eacb2699e21b3a3a7133f2978a7040dbcea5cb72b88c49b7e9

        SHA512

        0f6816b37e52d8f5c439c4a4ffd6140b1bd66aba77bafae1be2bb3ba1aca5e43551a527b2ec4e1c579d6892c62c196c7fc5d89ba8aa2f7a2a7d5378b9861b7e8

        Download Submit

      • memory/2872-2899-0x00007FFB93FC0000-0x00007FFB94276000-memory.dmp

        Filesize

        2.7MB

        Download

      • memory/2872-2900-0x00007FFB93CB0000-0x00007FFB93DBE000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2872-2897-0x00007FF7F7A80000-0x00007FF7F7B78000-memory.dmp

        Filesize

        992KB

        Download

      • memory/2872-2898-0x00007FFBA8C40000-0x00007FFBA8C74000-memory.dmp

        Filesize

        208KB

        Download

      • memory/3140-2860-0x00007FFBA0520000-0x00007FFBA0554000-memory.dmp

        Filesize

        208KB

        Download

      • memory/3140-2846-0x00007FFB9F2E0000-0x00007FFB9F2F1000-memory.dmp

        Filesize

        68KB

        Download

      • memory/3140-2862-0x00007FFB92F10000-0x00007FFB93FC0000-memory.dmp

        Filesize

        16.7MB

        Download

      • memory/3140-2859-0x00007FF7F7A80000-0x00007FF7F7B78000-memory.dmp

        Filesize

        992KB

        Download

      • memory/3140-2861-0x00007FFB93FC0000-0x00007FFB94276000-memory.dmp

        Filesize

        2.7MB

        Download

      • memory/3140-2841-0x00007FFB92F10000-0x00007FFB93FC0000-memory.dmp

        Filesize

        16.7MB

        Download

      • memory/3140-2830-0x00007FF7F7A80000-0x00007FF7F7B78000-memory.dmp

        Filesize

        992KB

        Download

      • memory/3140-2843-0x00007FFBA00D0000-0x00007FFBA00F1000-memory.dmp

        Filesize

        132KB

        Download

      • memory/3140-2842-0x00007FFB9B730000-0x00007FFB9B771000-memory.dmp

        Filesize

        260KB

        Download

      • memory/3140-2844-0x00007FFBA0350000-0x00007FFBA0368000-memory.dmp

        Filesize

        96KB

        Download

      • memory/3140-2836-0x00007FFBA45B0000-0x00007FFBA45C7000-memory.dmp

        Filesize

        92KB

        Download

      • memory/3140-2832-0x00007FFB93FC0000-0x00007FFB94276000-memory.dmp

        Filesize

        2.7MB

        Download

      • memory/3140-2837-0x00007FFBA4560000-0x00007FFBA4571000-memory.dmp

        Filesize

        68KB

        Download

      • memory/3140-2835-0x00007FFBA4660000-0x00007FFBA4671000-memory.dmp

        Filesize

        68KB

        Download

      • memory/3140-2840-0x00007FFB95210000-0x00007FFB9541B000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/3140-2834-0x00007FFBA4D20000-0x00007FFBA4D37000-memory.dmp

        Filesize

        92KB

        Download

      • memory/3140-2833-0x00007FFBA54D0000-0x00007FFBA54E8000-memory.dmp

        Filesize

        96KB

        Download

      • memory/3140-2831-0x00007FFBA0520000-0x00007FFBA0554000-memory.dmp

        Filesize

        208KB

        Download

      • memory/3140-2839-0x00007FFBA0370000-0x00007FFBA0381000-memory.dmp

        Filesize

        68KB

        Download

      • memory/3140-2838-0x00007FFBA2BE0000-0x00007FFBA2BFD000-memory.dmp

        Filesize

        116KB

        Download

      • memory/3140-2848-0x00007FFB92900000-0x00007FFB9295C000-memory.dmp

        Filesize

        368KB

        Download

      • memory/3140-2847-0x00007FFB9F2C0000-0x00007FFB9F2D1000-memory.dmp

        Filesize

        68KB

        Download

      • memory/3140-2849-0x000002422CE30000-0x000002422CFB0000-memory.dmp

        Filesize

        1.5MB

        Download

      • memory/3140-2845-0x00007FFB9FDD0000-0x00007FFB9FDE1000-memory.dmp

        Filesize

        68KB

        Download

      • memory/3400-2887-0x00007FFBA4660000-0x00007FFBA4671000-memory.dmp

        Filesize

        68KB

        Download

      • memory/3400-2882-0x00007FF7F7A80000-0x00007FF7F7B78000-memory.dmp

        Filesize

        992KB

        Download

      • memory/3400-2883-0x00007FFBA8C40000-0x00007FFBA8C74000-memory.dmp

        Filesize

        208KB

        Download

      • memory/3400-2884-0x00007FFB93FC0000-0x00007FFB94276000-memory.dmp

        Filesize

        2.7MB

        Download

      • memory/3400-2885-0x00007FFBA54D0000-0x00007FFBA54E8000-memory.dmp

        Filesize

        96KB

        Download

      • memory/3400-2886-0x00007FFBA4D20000-0x00007FFBA4D37000-memory.dmp

        Filesize

        92KB

        Download

      • memory/3588-2777-0x000000007FE40000-0x000000007FE41000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3588-2778-0x000000007FE20000-0x000000007FE21000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3588-2779-0x000000007FDC0000-0x000000007FDC1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3588-2810-0x000000007FE00000-0x000000007FE01000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3588-2809-0x000000007FDE0000-0x000000007FDE1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4852-2780-0x0000000001620000-0x0000000001630000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4852-2776-0x0000000001620000-0x0000000001630000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4852-1-0x0000000001620000-0x0000000001630000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4852-2771-0x0000000001620000-0x0000000001630000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4852-2-0x0000000001620000-0x0000000001630000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4852-0-0x0000000001620000-0x0000000001630000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4992-2820-0x00007FF7F7A80000-0x00007FF7F7B78000-memory.dmp

        Filesize

        992KB

        Download

      • memory/4992-2821-0x00007FFBA0520000-0x00007FFBA0554000-memory.dmp

        Filesize

        208KB

        Download

      • memory/4992-2822-0x00007FFB93FC0000-0x00007FFB94276000-memory.dmp

        Filesize

        2.7MB

        Download

      • memory/4992-2829-0x00007FFBA4660000-0x00007FFBA4671000-memory.dmp

        Filesize

        68KB

        Download

      • memory/4992-2828-0x00007FFBA4D20000-0x00007FFBA4D37000-memory.dmp

        Filesize

        92KB

        Download

      • memory/4992-2827-0x00007FFBA54D0000-0x00007FFBA54E8000-memory.dmp

        Filesize

        96KB

        Download

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.