Overview

overview

10

Static

static

10

3c7b097b31...0f.exe

windows7-x64

8

3c7b097b31...0f.exe

windows10-2004-x64

8

3c8a6c6cde...86.exe

windows7-x64

10

3c8a6c6cde...86.exe

windows10-2004-x64

10

3ca3e4676b...f1.exe

windows7-x64

10

3ca3e4676b...f1.exe

windows10-2004-x64

10

3cb47c4bbe...c1.exe

windows7-x64

10

3cb47c4bbe...c1.exe

windows10-2004-x64

10

3d18edb3bf...ff.exe

windows7-x64

1

3d18edb3bf...ff.exe

windows10-2004-x64

3d1ee6caf0...b4.exe

windows7-x64

10

3d1ee6caf0...b4.exe

windows10-2004-x64

10

3d2f05086d...0c.exe

windows7-x64

10

3d2f05086d...0c.exe

windows10-2004-x64

10

3d81f411b0...ba.exe

windows7-x64

10

3d81f411b0...ba.exe

windows10-2004-x64

10

3d90976d58...8c.exe

windows7-x64

10

3d90976d58...8c.exe

windows10-2004-x64

10

3d97ea72c5...9e.exe

windows7-x64

10

3d97ea72c5...9e.exe

windows10-2004-x64

10

3dd452b939...18.exe

windows7-x64

3

3dd452b939...18.exe

windows10-2004-x64

3

3dfc71cfc4...bd.exe

windows7-x64

10

3dfc71cfc4...bd.exe

windows10-2004-x64

10

3e435c9ff2...57.exe

windows7-x64

10

3e435c9ff2...57.exe

windows10-2004-x64

10

3e624f48a8...2b.exe

windows7-x64

1

3e624f48a8...2b.exe

windows10-2004-x64

4

3e8acfab95...cc.exe

windows7-x64

10

3e8acfab95...cc.exe

windows10-2004-x64

10

3e9a136b97...9d.exe

windows7-x64

10

3e9a136b97...9d.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    161s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/03/2025, 06:09 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3c7b097b31ed5df2ce6313dddd86da0f.exe

  • Size

    37KB

  • MD5

    3c7b097b31ed5df2ce6313dddd86da0f

  • SHA1

    56831f20af7c89fb3c5e3cefa70e5e6b2a98131e

  • SHA256

    de21a0b40b5f1cff271d2fe33518fac7c34382670bb0dc412363fc15f88e5ea7

  • SHA512

    83a1fa6e3929ec00eab0a347dff6671f57229423067301f317d6edfde58b66624b6dc673d51fbfb8b84168dd4a11e5e1ebc99cd08f0155214404078fce6ab0f4

  • SSDEEP

    384:mLuf7WpgibTjpPu7w9qyMTczHPes2A7rbrAF+rMRTyN/0L+EcoinblneHQM3epzk:PqNN9ZMTczWtAbrM+rMRa8NujGt

Score
8/10
defense_evasiondiscoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 1 IoCs
    defense_evasion
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3c7b097b31ed5df2ce6313dddd86da0f.exe
    "C:\Users\Admin\AppData\Local\Temp\3c7b097b31ed5df2ce6313dddd86da0f.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4016
    • C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\3c7b097b31ed5df2ce6313dddd86da0f.exe" "3c7b097b31ed5df2ce6313dddd86da0f.exe" ENABLE
      2⤵
      • Modifies Windows Firewall
      • Event Triggered Execution: Netsh Helper DLL
      • System Location Discovery: System Language Discovery
      PID:5712

Network

  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
    Response
    g.bing.com
    IN CNAME
    g-bing-com.ax-0001.ax-msedge.net
    g-bing-com.ax-0001.ax-msedge.net
    IN CNAME
    ax-0001.ax-msedge.net
    ax-0001.ax-msedge.net
    IN A
    150.171.27.10
    ax-0001.ax-msedge.net
    IN A
    150.171.28.10
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=5a9933ae7ff14fc185dac24044f2537a&localId=w:4ACC00A0-1788-710F-65CA-E695752A695C&deviceId=6896216935924576&anid=
    Remote address:
    150.171.27.10:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=5a9933ae7ff14fc185dac24044f2537a&localId=w:4ACC00A0-1788-710F-65CA-E695752A695C&deviceId=6896216935924576&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MUID=1D2D55C624F16A392577407125116B64; domain=.bing.com; expires=Thu, 16-Apr-2026 06:14:28 GMT; path=/; SameSite=None; Secure; Priority=High;
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: A600EE49DB98464ABDE47355D05CA04C Ref B: LON04EDGE1013 Ref C: 2025-03-22T06:14:28Z
    date: Sat, 22 Mar 2025 06:14:27 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=5a9933ae7ff14fc185dac24044f2537a&localId=w:4ACC00A0-1788-710F-65CA-E695752A695C&deviceId=6896216935924576&anid=
    Remote address:
    150.171.27.10:443
    Request
    GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=5a9933ae7ff14fc185dac24044f2537a&localId=w:4ACC00A0-1788-710F-65CA-E695752A695C&deviceId=6896216935924576&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=1D2D55C624F16A392577407125116B64
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MSPTC=0mTG-u8n0LWlDcweWBfhek17aSy4xY1TRSSxjpumpe4; domain=.bing.com; expires=Thu, 16-Apr-2026 06:14:28 GMT; path=/; Partitioned; secure; SameSite=None
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: CDDAB2354ABF4F32813A000D60A165B0 Ref B: LON04EDGE1013 Ref C: 2025-03-22T06:14:28Z
    date: Sat, 22 Mar 2025 06:14:27 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=5a9933ae7ff14fc185dac24044f2537a&localId=w:4ACC00A0-1788-710F-65CA-E695752A695C&deviceId=6896216935924576&anid=
    Remote address:
    150.171.27.10:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=5a9933ae7ff14fc185dac24044f2537a&localId=w:4ACC00A0-1788-710F-65CA-E695752A695C&deviceId=6896216935924576&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=1D2D55C624F16A392577407125116B64; MSPTC=0mTG-u8n0LWlDcweWBfhek17aSy4xY1TRSSxjpumpe4
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 380F19133DF04F038B96CBC265AC036A Ref B: LON04EDGE1013 Ref C: 2025-03-22T06:14:29Z
    date: Sat, 22 Mar 2025 06:14:29 GMT
  • flag-us
    DNS
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    Remote address:
    8.8.8.8:53
    Request
    score-fears.gl.at.ply.gg
    IN A
    Response
    score-fears.gl.at.ply.gg
    IN A
    147.185.221.27
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    ax-0001.ax-msedge.net
    ax-0001.ax-msedge.net
    IN A
    150.171.27.10
    ax-0001.ax-msedge.net
    IN A
    150.171.28.10
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239360264545_1QMDV0ZFDT4MYHVM6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239360264545_1QMDV0ZFDT4MYHVM6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 449789
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 1579F36471DA43978D77A2580F32AE20 Ref B: LON04EDGE0921 Ref C: 2025-03-22T06:15:14Z
    date: Sat, 22 Mar 2025 06:15:13 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239339388129_199HS4001G3EH5S78&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239339388129_199HS4001G3EH5S78&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 845518
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: F1C1B7F50B35424ABB50A47E99DA6870 Ref B: LON04EDGE0921 Ref C: 2025-03-22T06:15:14Z
    date: Sat, 22 Mar 2025 06:15:13 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239339388130_1LUEK7XGBN2FMZI35&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239339388130_1LUEK7XGBN2FMZI35&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 940465
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 666DA51B736B43CCB0544B7537326C3B Ref B: LON04EDGE0921 Ref C: 2025-03-22T06:15:14Z
    date: Sat, 22 Mar 2025 06:15:13 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239354491532_17IT0YRW2RNM8C8YH&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239354491532_17IT0YRW2RNM8C8YH&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 838075
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: ADC94AE4AB874F308CBE2924F7453A63 Ref B: LON04EDGE0921 Ref C: 2025-03-22T06:15:14Z
    date: Sat, 22 Mar 2025 06:15:13 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239354491534_1O3M85NN5LRG0CPTI&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239354491534_1O3M85NN5LRG0CPTI&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 500116
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: B8C8B2B7B9ED45FEB388C27DA76D190B Ref B: LON04EDGE0921 Ref C: 2025-03-22T06:15:14Z
    date: Sat, 22 Mar 2025 06:15:13 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239360264546_1VIJ7TSH89LPKUMDM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239360264546_1VIJ7TSH89LPKUMDM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 675736
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 6C85FD2761E442C991AEF4CAA7600359 Ref B: LON04EDGE0921 Ref C: 2025-03-22T06:15:17Z
    date: Sat, 22 Mar 2025 06:15:16 GMT
  • flag-us
    DNS
    c.pki.goog
    Remote address:
    8.8.8.8:53
    Request
    c.pki.goog
    IN A
    Response
    c.pki.goog
    IN CNAME
    pki-goog.l.google.com
    pki-goog.l.google.com
    IN A
    142.250.180.3
  • flag-gb
    GET
    http://c.pki.goog/r/r1.crl
    Remote address:
    142.250.180.3:80
    Request
    GET /r/r1.crl HTTP/1.1
    Cache-Control: max-age = 3000
    Connection: Keep-Alive
    Accept: */*
    If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: c.pki.goog
    Response
    HTTP/1.1 304 Not Modified
    Date: Sat, 22 Mar 2025 05:59:32 GMT
    Expires: Sat, 22 Mar 2025 06:49:32 GMT
    Age: 1005
    Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
    Cache-Control: public, max-age=3000
    Vary: Accept-Encoding
  • 150.171.27.10:443
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=5a9933ae7ff14fc185dac24044f2537a&localId=w:4ACC00A0-1788-710F-65CA-E695752A695C&deviceId=6896216935924576&anid=
    tls, http2
    3.0kB
     9.6kB
     26
    18

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=5a9933ae7ff14fc185dac24044f2537a&localId=w:4ACC00A0-1788-710F-65CA-E695752A695C&deviceId=6896216935924576&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=5a9933ae7ff14fc185dac24044f2537a&localId=w:4ACC00A0-1788-710F-65CA-E695752A695C&deviceId=6896216935924576&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=5a9933ae7ff14fc185dac24044f2537a&localId=w:4ACC00A0-1788-710F-65CA-E695752A695C&deviceId=6896216935924576&anid=

    HTTP Response

    204
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    912 B
     264 B
     7
    6
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    3.3kB
     276 B
     14
    6
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.4kB
     276 B
     11
    6
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.3kB
     276 B
     8
    6
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.4kB
     316 B
     11
    7
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.2kB
     276 B
     11
    6
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.6kB
     212 B
     11
    5
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.1kB
     276 B
     9
    6
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.7kB
     7.0kB
     18
    14
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.7kB
     7.0kB
     19
    14
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.7kB
     7.0kB
     18
    14
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.7kB
     7.0kB
     18
    14
  • 150.171.27.10:443
    https://tse1.mm.bing.net/th?id=OADD2.10239360264546_1VIJ7TSH89LPKUMDM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    tls, http2
    151.2kB
     4.4MB
     3203
    3195

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239360264545_1QMDV0ZFDT4MYHVM6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239339388129_199HS4001G3EH5S78&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239339388130_1LUEK7XGBN2FMZI35&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239354491532_17IT0YRW2RNM8C8YH&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239354491534_1O3M85NN5LRG0CPTI&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239360264546_1VIJ7TSH89LPKUMDM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Response

    200
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.3kB
     276 B
     9
    6
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.1kB
     276 B
     9
    6
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.3kB
     276 B
     8
    6
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.3kB
     276 B
     8
    6
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.5kB
     276 B
     9
    6
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.3kB
     276 B
     8
    6
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.4kB
     276 B
     8
    6
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.3kB
     328 B
     8
    7
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.3kB
     276 B
     8
    6
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.6kB
     276 B
     9
    6
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.3kB
     276 B
     8
    6
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.3kB
     276 B
     8
    6
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.3kB
     276 B
     8
    6
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.3kB
     276 B
     8
    6
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.3kB
     276 B
     8
    6
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.3kB
     276 B
     8
    6
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.3kB
     276 B
     8
    6
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.3kB
     276 B
     8
    6
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.5kB
     276 B
     9
    6
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.3kB
     276 B
     8
    6
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.3kB
     276 B
     8
    6
  • 142.250.180.3:80
    http://c.pki.goog/r/r1.crl
    http
    384 B
     355 B
     4
    3

    HTTP Request

    GET http://c.pki.goog/r/r1.crl

    HTTP Response

    304
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.3kB
     276 B
     8
    6
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.4kB
     212 B
     10
    5
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.4kB
     276 B
     9
    6
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.7kB
     212 B
     10
    5
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.4kB
     276 B
     9
    6
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.5kB
     276 B
     9
    6
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.3kB
     212 B
     8
    5
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.3kB
     276 B
     8
    6
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.4kB
     276 B
     10
    6
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.4kB
     276 B
     10
    6
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    1.3kB
     276 B
     8
    6
  • 147.185.221.27:6905
    score-fears.gl.at.ply.gg
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    290 B
     52 B
     3
    1
  • 8.8.8.8:53
    g.bing.com
    dns
    56 B
     148 B
     1
    1

    DNS Request

    g.bing.com

    DNS Response

    150.171.27.10
    150.171.28.10

  • 8.8.8.8:53
    score-fears.gl.at.ply.gg
    dns
    3c7b097b31ed5df2ce6313dddd86da0f.exe
    70 B
     86 B
     1
    1

    DNS Request

    score-fears.gl.at.ply.gg

    DNS Response

    147.185.221.27

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    186 B
     170 B
     3
    1

    DNS Request

    tse1.mm.bing.net

    DNS Request

    tse1.mm.bing.net

    DNS Request

    tse1.mm.bing.net

    DNS Response

    150.171.27.10
    150.171.28.10

  • 8.8.8.8:53
    c.pki.goog
    dns
    56 B
     107 B
     1
    1

    DNS Request

    c.pki.goog

    DNS Response

    142.250.180.3

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4016-0-0x0000000074672000-0x0000000074673000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4016-1-0x0000000074670000-0x0000000074C21000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/4016-2-0x0000000074670000-0x0000000074C21000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/4016-3-0x0000000074672000-0x0000000074673000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4016-4-0x0000000074670000-0x0000000074C21000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/4016-5-0x0000000074670000-0x0000000074C21000-memory.dmp

    Filesize

    5.7MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.