Overview

overview

10

Static

static

3

16fd6d298d...00.exe

windows7-x64

10

16fd6d298d...00.exe

windows10-2004-x64

10

Resubmissions

26/03/2025, 03:45 UTC

250326-ebgszazqv5 10

26/03/2025, 03:31 UTC

250326-d3csnawzhz 10

Analysis

  • max time kernel
    105s
  • max time network
    139s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/03/2025, 03:31 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    16fd6d298d5601766ee8fd0e0164898436f9cad9ac79927a14af387166aac100.exe

  • Size

    631KB

  • MD5

    485d4375ab8e346f7889e737df009764

  • SHA1

    93cc3d5ec9b1052e68185c42f22fe7bd55b055db

  • SHA256

    16fd6d298d5601766ee8fd0e0164898436f9cad9ac79927a14af387166aac100

  • SHA512

    d436975a98bbd80210839297d03243f7f9facc87cb5c143ea2d28c62769539502f665661efbbb29d283c376f5e04f223778594e2fcd6ac1e3add38882e8cec9b

  • SSDEEP

    12288:wyjvOn6nzxBZY8ZdLFgxfNH1aae0W8oUYrYB9QdTa7UL:Zj2n6n3qId5CaaeqoUTTQ5aQL

Score
10/10
formbookbs03discoveryexecutionratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

bs03

Decoy

aindirectiveteam.info

itchen-remodeling-up.world

avadacasino21.buzz

urumsbicard.net

ental-care-2762127.fyi

raveline.tech

camtech.online

leartec.health

odkacasino-333.buzz

oans-credits-73480.bond

ubstrate360.xyz

dalang.click

on66my.xyz

elegilgh.run

wlf.dev

ex-in-wien.net

riminal-mischief.cfd

0ns.pro

klopcy.xyz

ssetexcelstrongmanageroot.xyz

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Formbook family
    formbook
  • Formbook payload 2 IoCs
    rat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\16fd6d298d5601766ee8fd0e0164898436f9cad9ac79927a14af387166aac100.exe
    "C:\Users\Admin\AppData\Local\Temp\16fd6d298d5601766ee8fd0e0164898436f9cad9ac79927a14af387166aac100.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4156
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\16fd6d298d5601766ee8fd0e0164898436f9cad9ac79927a14af387166aac100.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3812
    • C:\Users\Admin\AppData\Local\Temp\16fd6d298d5601766ee8fd0e0164898436f9cad9ac79927a14af387166aac100.exe
      "C:\Users\Admin\AppData\Local\Temp\16fd6d298d5601766ee8fd0e0164898436f9cad9ac79927a14af387166aac100.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4004

Network

  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
    Response
    g.bing.com
    IN CNAME
    g-bing-com.ax-0001.ax-msedge.net
    g-bing-com.ax-0001.ax-msedge.net
    IN CNAME
    ax-0001.ax-msedge.net
    ax-0001.ax-msedge.net
    IN A
    150.171.27.10
    ax-0001.ax-msedge.net
    IN A
    150.171.28.10
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0bd368c67e674c559ae971030adfb070&localId=w:403FACAB-733C-BF36-6CC4-779B6FC22DC3&deviceId=6825849396577622&anid=
    Remote address:
    150.171.27.10:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0bd368c67e674c559ae971030adfb070&localId=w:403FACAB-733C-BF36-6CC4-779B6FC22DC3&deviceId=6825849396577622&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MUID=267409B0A99665AD33FA1C0BA82D6479; domain=.bing.com; expires=Mon, 20-Apr-2026 03:31:42 GMT; path=/; SameSite=None; Secure; Priority=High;
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 7696A16FFAB74B27BBB15B33FC34CC8F Ref B: LON04EDGE0822 Ref C: 2025-03-26T03:31:42Z
    date: Wed, 26 Mar 2025 03:31:41 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=0bd368c67e674c559ae971030adfb070&localId=w:403FACAB-733C-BF36-6CC4-779B6FC22DC3&deviceId=6825849396577622&anid=
    Remote address:
    150.171.27.10:443
    Request
    GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=0bd368c67e674c559ae971030adfb070&localId=w:403FACAB-733C-BF36-6CC4-779B6FC22DC3&deviceId=6825849396577622&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=267409B0A99665AD33FA1C0BA82D6479
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MSPTC=J2Tu4nRnk7WvcQcx5fHavjHxFxC7UlQ37cKlQWQQSQ4; domain=.bing.com; expires=Mon, 20-Apr-2026 03:31:42 GMT; path=/; Partitioned; secure; SameSite=None
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 3338D08CB4DF494A9F9699993C78BFD6 Ref B: LON04EDGE0822 Ref C: 2025-03-26T03:31:42Z
    date: Wed, 26 Mar 2025 03:31:41 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0bd368c67e674c559ae971030adfb070&localId=w:403FACAB-733C-BF36-6CC4-779B6FC22DC3&deviceId=6825849396577622&anid=
    Remote address:
    150.171.27.10:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0bd368c67e674c559ae971030adfb070&localId=w:403FACAB-733C-BF36-6CC4-779B6FC22DC3&deviceId=6825849396577622&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=267409B0A99665AD33FA1C0BA82D6479; MSPTC=J2Tu4nRnk7WvcQcx5fHavjHxFxC7UlQ37cKlQWQQSQ4
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 318866D20FAD41C4968DB3E17AE2B578 Ref B: LON04EDGE0822 Ref C: 2025-03-26T03:31:42Z
    date: Wed, 26 Mar 2025 03:31:41 GMT
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    ax-0001.ax-msedge.net
    ax-0001.ax-msedge.net
    IN A
    150.171.27.10
    ax-0001.ax-msedge.net
    IN A
    150.171.28.10
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239360526658_1O3WYEZK6VX7G9BK6&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239360526658_1O3WYEZK6VX7G9BK6&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 586035
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 52BCC06F38064CBCA5B2DFE4EEED0074 Ref B: LON04EDGE0609 Ref C: 2025-03-26T03:32:16Z
    date: Wed, 26 Mar 2025 03:32:16 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239360526659_1DEB5NSYP58G2E8T3&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239360526659_1DEB5NSYP58G2E8T3&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 529279
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 9B282B85803B4ED1907FFFFC09A47350 Ref B: LON04EDGE0609 Ref C: 2025-03-26T03:32:16Z
    date: Wed, 26 Mar 2025 03:32:16 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239354418797_1DICTY2QIH6AGNHVC&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239354418797_1DICTY2QIH6AGNHVC&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 550329
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 18474255FA6C4BFCB7905716F877A522 Ref B: LON04EDGE0609 Ref C: 2025-03-26T03:32:16Z
    date: Wed, 26 Mar 2025 03:32:16 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239354418798_1JO9319RHF3SDD3SE&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239354418798_1JO9319RHF3SDD3SE&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 818413
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 3CC0743131254F4F9D763DAEEAE18866 Ref B: LON04EDGE0609 Ref C: 2025-03-26T03:32:16Z
    date: Wed, 26 Mar 2025 03:32:16 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239340418541_1R6VGP5QQCA6F4RQL&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239340418541_1R6VGP5QQCA6F4RQL&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 855873
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: A35BC4E858134F1A9632BF648C494784 Ref B: LON04EDGE0609 Ref C: 2025-03-26T03:32:16Z
    date: Wed, 26 Mar 2025 03:32:16 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239340418542_1M27CNBNVY6AXHL84&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.27.10:443
    Request
    GET /th?id=OADD2.10239340418542_1M27CNBNVY6AXHL84&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 550977
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: B35DC62523C9457E8C3FE16F742D9397 Ref B: LON04EDGE0609 Ref C: 2025-03-26T03:32:17Z
    date: Wed, 26 Mar 2025 03:32:16 GMT
  • flag-us
    DNS
    c.pki.goog
    Remote address:
    8.8.8.8:53
    Request
    c.pki.goog
    IN A
    Response
    c.pki.goog
    IN CNAME
    pki-goog.l.google.com
    pki-goog.l.google.com
    IN A
    142.250.179.227
  • flag-gb
    GET
    http://c.pki.goog/r/r1.crl
    Remote address:
    142.250.179.227:80
    Request
    GET /r/r1.crl HTTP/1.1
    Cache-Control: max-age = 3000
    Connection: Keep-Alive
    Accept: */*
    If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: c.pki.goog
    Response
    HTTP/1.1 304 Not Modified
    Date: Wed, 26 Mar 2025 03:19:52 GMT
    Expires: Wed, 26 Mar 2025 04:09:52 GMT
    Age: 770
    Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
    Cache-Control: public, max-age=3000
    Vary: Accept-Encoding
  • 150.171.27.10:443
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0bd368c67e674c559ae971030adfb070&localId=w:403FACAB-733C-BF36-6CC4-779B6FC22DC3&deviceId=6825849396577622&anid=
    tls, http2
    2.0kB
     9.4kB
     22
    19

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0bd368c67e674c559ae971030adfb070&localId=w:403FACAB-733C-BF36-6CC4-779B6FC22DC3&deviceId=6825849396577622&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=0bd368c67e674c559ae971030adfb070&localId=w:403FACAB-733C-BF36-6CC4-779B6FC22DC3&deviceId=6825849396577622&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=0bd368c67e674c559ae971030adfb070&localId=w:403FACAB-733C-BF36-6CC4-779B6FC22DC3&deviceId=6825849396577622&anid=

    HTTP Response

    204
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     6.9kB
     15
    13
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     6.9kB
     15
    13
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     6.9kB
     15
    13
  • 150.171.27.10:443
    https://tse1.mm.bing.net/th?id=OADD2.10239340418542_1M27CNBNVY6AXHL84&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    tls, http2
    152.5kB
     4.0MB
     2918
    2909

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239360526658_1O3WYEZK6VX7G9BK6&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239360526659_1DEB5NSYP58G2E8T3&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239354418797_1DICTY2QIH6AGNHVC&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239354418798_1JO9319RHF3SDD3SE&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239340418541_1R6VGP5QQCA6F4RQL&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239340418542_1M27CNBNVY6AXHL84&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Response

    200
  • 150.171.27.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     6.9kB
     15
    13
  • 142.250.179.227:80
    http://c.pki.goog/r/r1.crl
    http
    476 B
     394 B
     6
    4

    HTTP Request

    GET http://c.pki.goog/r/r1.crl

    HTTP Response

    304
  • 8.8.8.8:53
    g.bing.com
    dns
    56 B
     148 B
     1
    1

    DNS Request

    g.bing.com

    DNS Response

    150.171.27.10
    150.171.28.10

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    62 B
     170 B
     1
    1

    DNS Request

    tse1.mm.bing.net

    DNS Response

    150.171.27.10
    150.171.28.10

  • 8.8.8.8:53
    c.pki.goog
    dns
    56 B
     107 B
     1
    1

    DNS Request

    c.pki.goog

    DNS Response

    142.250.179.227

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iv0luj1z.2eb.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • memory/3812-51-0x0000000007F20000-0x000000000859A000-memory.dmp

    Filesize

    6.5MB

    Download

  • memory/3812-50-0x00000000751D0000-0x0000000075980000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/3812-62-0x00000000751D0000-0x0000000075980000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/3812-59-0x0000000007BC0000-0x0000000007BC8000-memory.dmp

    Filesize

    32KB

    Download

  • memory/3812-58-0x0000000007BE0000-0x0000000007BFA000-memory.dmp

    Filesize

    104KB

    Download

  • memory/3812-57-0x0000000007AE0000-0x0000000007AF4000-memory.dmp

    Filesize

    80KB

    Download

  • memory/3812-56-0x0000000007AD0000-0x0000000007ADE000-memory.dmp

    Filesize

    56KB

    Download

  • memory/3812-55-0x0000000007AA0000-0x0000000007AB1000-memory.dmp

    Filesize

    68KB

    Download

  • memory/3812-54-0x0000000007B20000-0x0000000007BB6000-memory.dmp

    Filesize

    600KB

    Download

  • memory/3812-53-0x0000000007910000-0x000000000791A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/3812-52-0x00000000078A0000-0x00000000078BA000-memory.dmp

    Filesize

    104KB

    Download

  • memory/3812-21-0x00000000057D0000-0x0000000005836000-memory.dmp

    Filesize

    408KB

    Download

  • memory/3812-46-0x0000000006AF0000-0x0000000006B0E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/3812-15-0x00000000751DE000-0x00000000751DF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3812-16-0x0000000002C50000-0x0000000002C86000-memory.dmp

    Filesize

    216KB

    Download

  • memory/3812-17-0x00000000751D0000-0x0000000075980000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/3812-18-0x00000000751D0000-0x0000000075980000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/3812-47-0x00000000751D0000-0x0000000075980000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/3812-20-0x00000000055B0000-0x00000000055D2000-memory.dmp

    Filesize

    136KB

    Download

  • memory/3812-22-0x0000000005F40000-0x0000000005FA6000-memory.dmp

    Filesize

    408KB

    Download

  • memory/3812-49-0x00000000751D0000-0x0000000075980000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/3812-32-0x00000000060B0000-0x0000000006404000-memory.dmp

    Filesize

    3.3MB

    Download

  • memory/3812-19-0x00000000058A0000-0x0000000005EC8000-memory.dmp

    Filesize

    6.2MB

    Download

  • memory/3812-33-0x0000000006580000-0x000000000659E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/3812-34-0x00000000065C0000-0x000000000660C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/3812-35-0x0000000006AB0000-0x0000000006AE2000-memory.dmp

    Filesize

    200KB

    Download

  • memory/3812-36-0x0000000070FF0000-0x000000007103C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/3812-48-0x00000000077F0000-0x0000000007893000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4004-11-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/4004-63-0x00000000010C0000-0x000000000140A000-memory.dmp

    Filesize

    3.3MB

    Download

  • memory/4004-14-0x00000000010C0000-0x000000000140A000-memory.dmp

    Filesize

    3.3MB

    Download

  • memory/4156-8-0x0000000075150000-0x0000000075900000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/4156-0-0x000000007515E000-0x000000007515F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4156-2-0x00000000053C0000-0x0000000005964000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/4156-13-0x0000000075150000-0x0000000075900000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/4156-9-0x00000000068E0000-0x000000000695A000-memory.dmp

    Filesize

    488KB

    Download

  • memory/4156-10-0x0000000008DB0000-0x0000000008E4C000-memory.dmp

    Filesize

    624KB

    Download

  • memory/4156-7-0x000000007515E000-0x000000007515F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4156-6-0x0000000004F00000-0x0000000004F18000-memory.dmp

    Filesize

    96KB

    Download

  • memory/4156-5-0x0000000075150000-0x0000000075900000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/4156-4-0x0000000004C70000-0x0000000004C7A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/4156-3-0x0000000004CE0000-0x0000000004D72000-memory.dmp

    Filesize

    584KB

    Download

  • memory/4156-1-0x00000000001E0000-0x0000000000284000-memory.dmp

    Filesize

    656KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.