Overview

overview

10

Static

static

3

b92fbfb145...a7.exe

windows7-x64

10

b92fbfb145...a7.exe

windows10-2004-x64

Analysis

  • max time kernel
    34s
  • max time network
    35s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/03/2025, 19:36 UTC

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    b92fbfb1456ffbbda1a668cba58533a7.exe

  • Size

    592KB

  • MD5

    b92fbfb1456ffbbda1a668cba58533a7

  • SHA1

    75bb0aebf4e0f239c3abb7604c1485a74b33e0c3

  • SHA256

    9ac72c52d01edd78f0012ecdd15ca8c839830c68b77681325dd11cda309eda85

  • SHA512

    71a5e7ca9df812a1fceede8218addedc2a8fce4bf92e6bb5f2ce5ae27aaf3c7825833bdc0b5b38453c4b79c041fff33ebbcda090c6664d25ad569fdb3fa2d9dc

  • SSDEEP

    12288:z/gp50g7ZeK50g73tl4dkKkpGrMY9UN0f1NSBqkhHo5zNteTgTJ74xWw:Up5F7AK5F79JpXWE+pmYygT+w

Score
10/10
redlinesectopratcheatdiscoveryinfostealerratspywaretrojan

Malware Config

Extracted

Family

redline

Botnet

cheat

C2

45.137.22.249:55615

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • Redline family
    redline
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

    trojanratsectoprat
  • SectopRAT payload 1 IoCs
  • Sectoprat family
    sectoprat
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b92fbfb1456ffbbda1a668cba58533a7.exe
    "C:\Users\Admin\AppData\Local\Temp\b92fbfb1456ffbbda1a668cba58533a7.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3940
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
        PID:2256
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        2⤵
          PID:3848
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4952

      Network

      • flag-us
        DNS
        tse1.mm.bing.net
        Remote address:
        8.8.8.8:53
        Request
        tse1.mm.bing.net
        IN A
        Response
        tse1.mm.bing.net
        IN CNAME
        mm-mm.bing.net.trafficmanager.net
        mm-mm.bing.net.trafficmanager.net
        IN CNAME
        ax-0001.ax-msedge.net
        ax-0001.ax-msedge.net
        IN A
        150.171.28.10
        ax-0001.ax-msedge.net
        IN A
        150.171.27.10
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239340418580_1XZDKNXCHEXKE96NH&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        Remote address:
        150.171.28.10:443
        Request
        GET /th?id=OADD2.10239340418580_1XZDKNXCHEXKE96NH&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 659067
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 54252C9EEB1B4E04B045E76B309E7591 Ref B: FRA31EDGE0813 Ref C: 2025-03-07T19:36:19Z
        date: Fri, 07 Mar 2025 19:36:19 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301291_1H8FN9XYY8JWTIM5Q&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        Remote address:
        150.171.28.10:443
        Request
        GET /th?id=OADD2.10239317301291_1H8FN9XYY8JWTIM5Q&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 666447
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: A34F532050764FD8B8356D59E9F77634 Ref B: FRA31EDGE0813 Ref C: 2025-03-07T19:36:19Z
        date: Fri, 07 Mar 2025 19:36:19 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239339388104_1WOMQSFLGSNQV3AH1&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        Remote address:
        150.171.28.10:443
        Request
        GET /th?id=OADD2.10239339388104_1WOMQSFLGSNQV3AH1&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 768566
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 34E4AA8B336B4F37B01098746ED53EE8 Ref B: FRA31EDGE0813 Ref C: 2025-03-07T19:36:19Z
        date: Fri, 07 Mar 2025 19:36:19 GMT
      • flag-us
        DNS
        g.bing.com
        Remote address:
        8.8.8.8:53
        Request
        g.bing.com
        IN A
        Response
        g.bing.com
        IN CNAME
        g-bing-com.ax-0001.ax-msedge.net
        g-bing-com.ax-0001.ax-msedge.net
        IN CNAME
        ax-0001.ax-msedge.net
        ax-0001.ax-msedge.net
        IN A
        150.171.27.10
        ax-0001.ax-msedge.net
        IN A
        150.171.28.10
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0ff17aaea3694756a643b792e4557ffd&localId=w:ACAD5A90-4107-E38E-00E6-534476E14A0E&deviceId=6966575318233235&anid=
        Remote address:
        150.171.27.10:443
        Request
        GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0ff17aaea3694756a643b792e4557ffd&localId=w:ACAD5A90-4107-E38E-00E6-534476E14A0E&deviceId=6966575318233235&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        set-cookie: MUID=2BE54F0FA82B686A392A5AA7A9A06954; domain=.bing.com; expires=Wed, 01-Apr-2026 19:36:19 GMT; path=/; SameSite=None; Secure; Priority=High;
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 233C6B33B97C453F8AA2F65107DD8A23 Ref B: FRA31EDGE0412 Ref C: 2025-03-07T19:36:19Z
        date: Fri, 07 Mar 2025 19:36:19 GMT
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=0ff17aaea3694756a643b792e4557ffd&localId=w:ACAD5A90-4107-E38E-00E6-534476E14A0E&deviceId=6966575318233235&anid=
        Remote address:
        150.171.27.10:443
        Request
        GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=0ff17aaea3694756a643b792e4557ffd&localId=w:ACAD5A90-4107-E38E-00E6-534476E14A0E&deviceId=6966575318233235&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=2BE54F0FA82B686A392A5AA7A9A06954
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        set-cookie: MSPTC=zDzCFByViFXrH_YCKzit3RPWaQob_Ig3YsW2-IoM4G8; domain=.bing.com; expires=Wed, 01-Apr-2026 19:36:19 GMT; path=/; Partitioned; secure; SameSite=None
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 8D296BEC2A6A4E3EAFE729C964529D05 Ref B: FRA31EDGE0412 Ref C: 2025-03-07T19:36:19Z
        date: Fri, 07 Mar 2025 19:36:19 GMT
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0ff17aaea3694756a643b792e4557ffd&localId=w:ACAD5A90-4107-E38E-00E6-534476E14A0E&deviceId=6966575318233235&anid=
        Remote address:
        150.171.27.10:443
        Request
        GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0ff17aaea3694756a643b792e4557ffd&localId=w:ACAD5A90-4107-E38E-00E6-534476E14A0E&deviceId=6966575318233235&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=2BE54F0FA82B686A392A5AA7A9A06954; MSPTC=zDzCFByViFXrH_YCKzit3RPWaQob_Ig3YsW2-IoM4G8
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 2F7C0F03414446F4BDC8B01D53B7C427 Ref B: FRA31EDGE0412 Ref C: 2025-03-07T19:36:19Z
        date: Fri, 07 Mar 2025 19:36:19 GMT
      • flag-nl
        POST
        http://45.137.22.249:55615/
        RegSvcs.exe
        Remote address:
        45.137.22.249:55615
        Request
        POST / HTTP/1.1
        Content-Type: text/xml; charset=utf-8
        SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"
        Host: 45.137.22.249:55615
        Content-Length: 137
        Expect: 100-continue
        Accept-Encoding: gzip, deflate
        Connection: Keep-Alive
        Response
        HTTP/1.1 200 OK
        Content-Length: 212
        Content-Type: text/xml; charset=utf-8
        Server: Microsoft-HTTPAPI/2.0
        Date: Fri, 07 Mar 2025 19:36:36 GMT
      • flag-nl
        POST
        http://45.137.22.249:55615/
        RegSvcs.exe
        Remote address:
        45.137.22.249:55615
        Request
        POST / HTTP/1.1
        Content-Type: text/xml; charset=utf-8
        SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"
        Host: 45.137.22.249:55615
        Content-Length: 144
        Expect: 100-continue
        Accept-Encoding: gzip, deflate
        Response
        HTTP/1.1 200 OK
        Content-Length: 4744
        Content-Type: text/xml; charset=utf-8
        Server: Microsoft-HTTPAPI/2.0
        Date: Fri, 07 Mar 2025 19:36:41 GMT
      • flag-nl
        POST
        http://45.137.22.249:55615/
        RegSvcs.exe
        Remote address:
        45.137.22.249:55615
        Request
        POST / HTTP/1.1
        Content-Type: text/xml; charset=utf-8
        SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"
        Host: 45.137.22.249:55615
        Content-Length: 2019096
        Expect: 100-continue
        Accept-Encoding: gzip, deflate
        Response
        HTTP/1.1 200 OK
        Content-Length: 147
        Content-Type: text/xml; charset=utf-8
        Server: Microsoft-HTTPAPI/2.0
        Date: Fri, 07 Mar 2025 19:36:45 GMT
      • flag-nl
        POST
        http://45.137.22.249:55615/
        RegSvcs.exe
        Remote address:
        45.137.22.249:55615
        Request
        POST / HTTP/1.1
        Content-Type: text/xml; charset=utf-8
        SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"
        Host: 45.137.22.249:55615
        Content-Length: 2019088
        Expect: 100-continue
        Accept-Encoding: gzip, deflate
        Response
        HTTP/1.1 200 OK
        Content-Length: 261
        Content-Type: text/xml; charset=utf-8
        Server: Microsoft-HTTPAPI/2.0
        Date: Fri, 07 Mar 2025 19:36:47 GMT
      • flag-us
        DNS
        api.ip.sb
        RegSvcs.exe
        Remote address:
        8.8.8.8:53
        Request
        api.ip.sb
        IN A
        Response
        api.ip.sb
        IN CNAME
        api.ip.sb.cdn.cloudflare.net
        api.ip.sb.cdn.cloudflare.net
        IN A
        104.26.12.31
        api.ip.sb.cdn.cloudflare.net
        IN A
        104.26.13.31
        api.ip.sb.cdn.cloudflare.net
        IN A
        172.67.75.172
      • flag-us
        GET
        https://api.ip.sb/geoip
        RegSvcs.exe
        Remote address:
        104.26.12.31:443
        Request
        GET /geoip HTTP/1.1
        Host: api.ip.sb
        Connection: Keep-Alive
        Response
        HTTP/1.1 200 OK
        Date: Fri, 07 Mar 2025 19:36:41 GMT
        Content-Type: application/json; charset=utf-8
        Transfer-Encoding: chunked
        Connection: keep-alive
        vary: Accept-Encoding
        Cache-Control: no-cache
        access-control-allow-origin: *
        cf-cache-status: DYNAMIC
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=n7vWGYJ2rniqLCi2I0xt0UZMt%2FfNT097oEtPz%2F8cGO1%2BesAj4GLcL47PsIqaPRJNblSjZ4PbqZlaCPZcO7UwdMDrwZzpaQeZfWdhEZm3mbAlZsNyW0q76y8SFA%3D%3D"}],"group":"cf-nel","max_age":604800}
        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
        Server: cloudflare
        CF-RAY: 91cc8b0b8aadb466-LHR
        alt-svc: h3=":443"; ma=86400
        server-timing: cfL4;desc="?proto=TCP&rtt=46373&min_rtt=42557&rtt_var=19590&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2964&recv_bytes=357&delivery_rate=63470&cwnd=252&unsent_bytes=0&cid=9052b78f429384f7&ts=199&x=0"
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239353388073_1SY37RLMEXBSAP5P1&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        Remote address:
        150.171.28.10:443
        Request
        GET /th?id=OADD2.10239353388073_1SY37RLMEXBSAP5P1&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 641224
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 63620DAE9B354B3D9C7F4A0EEC06A1DD Ref B: FRA31EDGE0213 Ref C: 2025-03-07T19:36:50Z
        date: Fri, 07 Mar 2025 19:36:49 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239339388224_1CNCLDFOO6A6DWYFX&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        Remote address:
        150.171.28.10:443
        Request
        GET /th?id=OADD2.10239339388224_1CNCLDFOO6A6DWYFX&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 674070
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 176F2FB6528B4AB3A03835DD6BE575F4 Ref B: FRA31EDGE0213 Ref C: 2025-03-07T19:36:50Z
        date: Fri, 07 Mar 2025 19:36:49 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239360608910_1R4TEUG1LRQY39K7S&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        Remote address:
        150.171.28.10:443
        Request
        GET /th?id=OADD2.10239360608910_1R4TEUG1LRQY39K7S&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 594481
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 79ED4A48CA1144C0A8B8E5CF3ED0EB29 Ref B: FRA31EDGE0213 Ref C: 2025-03-07T19:36:50Z
        date: Fri, 07 Mar 2025 19:36:49 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239339388225_1B60QSS9I6SIVS5TS&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        Remote address:
        150.171.28.10:443
        Request
        GET /th?id=OADD2.10239339388225_1B60QSS9I6SIVS5TS&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 543571
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 3F4B2FF09FDA4ACBB47154B5E15F6709 Ref B: FRA31EDGE0213 Ref C: 2025-03-07T19:36:50Z
        date: Fri, 07 Mar 2025 19:36:49 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239360608909_1XWUMGMD2M0J0LDVR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        Remote address:
        150.171.28.10:443
        Request
        GET /th?id=OADD2.10239360608909_1XWUMGMD2M0J0LDVR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 663065
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: FC50B91C4C3A4654B5E4FF0DFA6049FD Ref B: FRA31EDGE0213 Ref C: 2025-03-07T19:36:50Z
        date: Fri, 07 Mar 2025 19:36:49 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239353388079_1I03GNWN380ZGL8MJ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        Remote address:
        150.171.28.10:443
        Request
        GET /th?id=OADD2.10239353388079_1I03GNWN380ZGL8MJ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 745212
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 94B418FF873341D0B5FB68AD0C1F3DFF Ref B: FRA31EDGE0213 Ref C: 2025-03-07T19:36:50Z
        date: Fri, 07 Mar 2025 19:36:50 GMT
      • 150.171.28.10:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         6.9kB
         15
        13
      • 150.171.28.10:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         6.9kB
         15
        13
      • 150.171.28.10:443
        https://tse1.mm.bing.net/th?id=OADD2.10239339388104_1WOMQSFLGSNQV3AH1&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        tls, http2
        74.3kB
         2.2MB
         1591
        1588

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239340418580_1XZDKNXCHEXKE96NH&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301291_1H8FN9XYY8JWTIM5Q&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239339388104_1WOMQSFLGSNQV3AH1&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

        HTTP Response

        200

        HTTP Response

        200

        HTTP Response

        200
      • 150.171.27.10:443
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0ff17aaea3694756a643b792e4557ffd&localId=w:ACAD5A90-4107-E38E-00E6-534476E14A0E&deviceId=6966575318233235&anid=
        tls, http2
        2.0kB
         9.4kB
         21
        19

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0ff17aaea3694756a643b792e4557ffd&localId=w:ACAD5A90-4107-E38E-00E6-534476E14A0E&deviceId=6966575318233235&anid=

        HTTP Response

        204

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=0ff17aaea3694756a643b792e4557ffd&localId=w:ACAD5A90-4107-E38E-00E6-534476E14A0E&deviceId=6966575318233235&anid=

        HTTP Response

        204

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0ff17aaea3694756a643b792e4557ffd&localId=w:ACAD5A90-4107-E38E-00E6-534476E14A0E&deviceId=6966575318233235&anid=

        HTTP Response

        204
      • 45.137.22.249:55615
        http://45.137.22.249:55615/
        http
        RegSvcs.exe
        4.2MB
         42.7kB
         3021
        890

        HTTP Request

        POST http://45.137.22.249:55615/

        HTTP Response

        200

        HTTP Request

        POST http://45.137.22.249:55615/

        HTTP Response

        200

        HTTP Request

        POST http://45.137.22.249:55615/

        HTTP Response

        200

        HTTP Request

        POST http://45.137.22.249:55615/

        HTTP Response

        200
      • 104.26.12.31:443
        https://api.ip.sb/geoip
        tls, http
        RegSvcs.exe
        713 B
         4.7kB
         8
        8

        HTTP Request

        GET https://api.ip.sb/geoip

        HTTP Response

        200
      • 150.171.28.10:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         6.9kB
         15
        13
      • 150.171.28.10:443
        https://tse1.mm.bing.net/th?id=OADD2.10239353388079_1I03GNWN380ZGL8MJ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        tls, http2
        174.6kB
         4.0MB
         2911
        2905

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239353388073_1SY37RLMEXBSAP5P1&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239339388224_1CNCLDFOO6A6DWYFX&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239360608910_1R4TEUG1LRQY39K7S&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239339388225_1B60QSS9I6SIVS5TS&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239360608909_1XWUMGMD2M0J0LDVR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

        HTTP Response

        200

        HTTP Response

        200

        HTTP Response

        200

        HTTP Response

        200

        HTTP Response

        200

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239353388079_1I03GNWN380ZGL8MJ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

        HTTP Response

        200
      • 150.171.28.10:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         6.9kB
         15
        13
      • 150.171.28.10:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         6.9kB
         15
        13
      • 150.171.28.10:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         6.9kB
         15
        13
      • 8.8.8.8:53
        tse1.mm.bing.net
        dns
        62 B
         170 B
         1
        1

        DNS Request

        tse1.mm.bing.net

        DNS Response

        150.171.28.10
        150.171.27.10

      • 8.8.8.8:53
        g.bing.com
        dns
        56 B
         148 B
         1
        1

        DNS Request

        g.bing.com

        DNS Response

        150.171.27.10
        150.171.28.10

      • 8.8.8.8:53
        api.ip.sb
        dns
        RegSvcs.exe
        55 B
         145 B
         1
        1

        DNS Request

        api.ip.sb

        DNS Response

        104.26.12.31
        104.26.13.31
        172.67.75.172

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\tmp2288.tmp
        Filesize

        40KB

        MD5

        a182561a527f929489bf4b8f74f65cd7

        SHA1

        8cd6866594759711ea1836e86a5b7ca64ee8911f

        SHA256

        42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

        SHA512

        9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\tmp22AD.tmp
        Filesize

        114KB

        MD5

        af4d3825d4098bd9c66faf64e20acdc8

        SHA1

        e205b61bd6e5f4d44bc36339fe3c207e52ee2f01

        SHA256

        095484268f554458404ca64d5c9f7b99abe0dbb1a75e056184047dc836f2e484

        SHA512

        71b4b99614e28a85925033f95d90e7c43f958b2284f7d7605d2ea896330efa9bba8b6d9550f62829daec3cf452e95c964ddb30cd9c7850bfa41a988792132e78

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\tmp22C9.tmp
        Filesize

        48KB

        MD5

        349e6eb110e34a08924d92f6b334801d

        SHA1

        bdfb289daff51890cc71697b6322aa4b35ec9169

        SHA256

        c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

        SHA512

        2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\tmp22CF.tmp
        Filesize

        20KB

        MD5

        49693267e0adbcd119f9f5e02adf3a80

        SHA1

        3ba3d7f89b8ad195ca82c92737e960e1f2b349df

        SHA256

        d76e7512e496b7c8d9fcd3010a55e2e566881dc6dacaf0343652a4915d47829f

        SHA512

        b4b9fcecf8d277bb0ccbb25e08f3559e3fc519d85d8761d8ad5bca983d04eb55a20d3b742b15b9b31a7c9187da40ad5c48baa7a54664cae4c40aa253165cbaa2

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\tmp22F4.tmp
        Filesize

        116KB

        MD5

        f70aa3fa04f0536280f872ad17973c3d

        SHA1

        50a7b889329a92de1b272d0ecf5fce87395d3123

        SHA256

        8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

        SHA512

        30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\tmp2310.tmp
        Filesize

        96KB

        MD5

        40f3eb83cc9d4cdb0ad82bd5ff2fb824

        SHA1

        d6582ba879235049134fa9a351ca8f0f785d8835

        SHA256

        cdd772b00ae53d4050150552b67028b7344bb1d345bceb495151cc969c27a0a0

        SHA512

        cdd4dbf0b1ba73464cd7c5008dc05458862e5f608e336b53638a14965becd4781cdea595fd6bd18d0bf402dccffd719da292a6ce67d359527b4691dc6d6d4cc2

        Download Submit

      • memory/3940-8-0x00000000057B0000-0x00000000057CE000-memory.dmp

        Filesize

        120KB

        Download

      • memory/3940-6-0x0000000004A20000-0x0000000004A2A000-memory.dmp

        Filesize

        40KB

        Download

      • memory/3940-0-0x000000007486E000-0x000000007486F000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3940-9-0x00000000062A0000-0x00000000062B8000-memory.dmp

        Filesize

        96KB

        Download

      • memory/3940-10-0x000000007486E000-0x000000007486F000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3940-11-0x0000000074860000-0x0000000075010000-memory.dmp

        Filesize

        7.7MB

        Download

      • memory/3940-12-0x0000000005DF0000-0x0000000005E52000-memory.dmp

        Filesize

        392KB

        Download

      • memory/3940-7-0x0000000006300000-0x0000000006376000-memory.dmp

        Filesize

        472KB

        Download

      • memory/3940-15-0x0000000074860000-0x0000000075010000-memory.dmp

        Filesize

        7.7MB

        Download

      • memory/3940-1-0x0000000000050000-0x00000000000EA000-memory.dmp

        Filesize

        616KB

        Download

      • memory/3940-2-0x0000000004E50000-0x00000000053F4000-memory.dmp

        Filesize

        5.6MB

        Download

      • memory/3940-3-0x0000000004980000-0x0000000004A12000-memory.dmp

        Filesize

        584KB

        Download

      • memory/3940-4-0x0000000004AC0000-0x0000000004B5C000-memory.dmp

        Filesize

        624KB

        Download

      • memory/3940-5-0x0000000074860000-0x0000000075010000-memory.dmp

        Filesize

        7.7MB

        Download

      • memory/4952-13-0x0000000000400000-0x000000000041E000-memory.dmp

        Filesize

        120KB

        Download

      • memory/4952-18-0x0000000004F60000-0x0000000004F72000-memory.dmp

        Filesize

        72KB

        Download

      • memory/4952-23-0x00000000062C0000-0x0000000006482000-memory.dmp

        Filesize

        1.8MB

        Download

      • memory/4952-24-0x00000000069C0000-0x0000000006EEC000-memory.dmp

        Filesize

        5.2MB

        Download

      • memory/4952-21-0x0000000005000000-0x000000000504C000-memory.dmp

        Filesize

        304KB

        Download

      • memory/4952-20-0x0000000074860000-0x0000000075010000-memory.dmp

        Filesize

        7.7MB

        Download

      • memory/4952-19-0x0000000004FC0000-0x0000000004FFC000-memory.dmp

        Filesize

        240KB

        Download

      • memory/4952-22-0x0000000005260000-0x000000000536A000-memory.dmp

        Filesize

        1.0MB

        Download

      • memory/4952-17-0x0000000005540000-0x0000000005B58000-memory.dmp

        Filesize

        6.1MB

        Download

      • memory/4952-16-0x0000000074860000-0x0000000075010000-memory.dmp

        Filesize

        7.7MB

        Download

      • memory/4952-179-0x0000000006490000-0x00000000064F6000-memory.dmp

        Filesize

        408KB

        Download

      • memory/4952-192-0x0000000074860000-0x0000000075010000-memory.dmp

        Filesize

        7.7MB

        Download

      • memory/4952-193-0x0000000074860000-0x0000000075010000-memory.dmp

        Filesize

        7.7MB

        Download

      • memory/4952-195-0x0000000074860000-0x0000000075010000-memory.dmp

        Filesize

        7.7MB

        Download

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.