Analysis
-
max time kernel
102s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20250410-en -
resource tags
arch:x64arch:x86image:win10v2004-20250410-enlocale:en-usos:windows10-2004-x64system -
submitted
11/04/2025, 05:27 UTC
Static task
static1
Behavioral task
behavioral1
Sample
2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe
Resource
win10v2004-20250410-en
General
-
Target
2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe
-
Size
86KB
-
MD5
ef14d6ddb61187f3e21d84634d8a1be5
-
SHA1
9ba13927d59b16b15ecc8ad8a697bc62347459b3
-
SHA256
b072a614b15541b1fed03986cf88b2fa369169f11dededf2ac41f9ce422cae0e
-
SHA512
6c615c61673076c001b7ba493ac9fddc3f5eb53a9282bddffdd129064400d2e74b9c613d19cfdd95535ed45283e81acc7fdf9c19b78026191ab03bdc798a6fab
-
SSDEEP
1536:jvHJ5hiBMAMnL+by+PGuMsrQLOJgY8ZZP8LHD4XWaNH71dLdG1iiFM2iG2es4C:jvHJ/iBMAqeyXBsrQLOJgY8Zp8LHD4Xl
Malware Config
Extracted
C:\PerfLogs\How To Restore Your Files.txt
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/blog/da83db34f2e0c077f7b064e6556f127c0a91d7ae21f3855f0e7279ce14d5f406/
http://wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd.onion/
http://vq3zf757tzpwhs7bulnr43d2rfg5fkvvfkhee2zhhzievuxrbnarmgqd.onion/3fbf8f220dae00bb6bb8539b9c6c86c4bf5c58ccf651542e3363dd131239edd6
Signatures
-
Babuk Locker
RaaS first seen in 2021 initially called Vasa Locker.
-
Babuk family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (191) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3027557611-1484967174-339164627-1000\Control Panel\International\Geo\Nation 2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe File opened (read-only) \??\X: 2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe File opened (read-only) \??\V: 2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe File opened (read-only) \??\B: 2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe File opened (read-only) \??\Q: 2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe File opened (read-only) \??\U: 2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe File opened (read-only) \??\A: 2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe File opened (read-only) \??\L: 2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe File opened (read-only) \??\Z: 2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe File opened (read-only) \??\M: 2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe File opened (read-only) \??\W: 2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe File opened (read-only) \??\E: 2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe File opened (read-only) \??\R: 2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe File opened (read-only) \??\S: 2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe File opened (read-only) \??\K: 2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe File opened (read-only) \??\T: 2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe File opened (read-only) \??\I: 2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe File opened (read-only) \??\J: 2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe File opened (read-only) \??\N: 2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe File opened (read-only) \??\H: 2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe File opened (read-only) \??\Y: 2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe File opened (read-only) \??\O: 2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe File opened (read-only) \??\P: 2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe -
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3088 vssadmin.exe 4160 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3360 2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe 3360 2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 5836 vssvc.exe Token: SeRestorePrivilege 5836 vssvc.exe Token: SeAuditPrivilege 5836 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3360 wrote to memory of 4116 3360 2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe 85 PID 3360 wrote to memory of 4116 3360 2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe 85 PID 4116 wrote to memory of 3088 4116 cmd.exe 89 PID 4116 wrote to memory of 3088 4116 cmd.exe 89 PID 3360 wrote to memory of 3704 3360 2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe 91 PID 3360 wrote to memory of 3704 3360 2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe 91 PID 3704 wrote to memory of 4160 3704 cmd.exe 94 PID 3704 wrote to memory of 4160 3704 cmd.exe 94 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe"C:\Users\Admin\AppData\Local\Temp\2025-04-11_ef14d6ddb61187f3e21d84634d8a1be5_babuk_destroyer_elex.exe"1⤵
- Checks computer location settings
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3088
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:4160
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5836
Network
-
Remote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.ax-0001.ax-msedge.netg-bing-com.ax-0001.ax-msedge.netIN CNAMEax-0001.ax-msedge.netax-0001.ax-msedge.netIN A150.171.27.10ax-0001.ax-msedge.netIN A150.171.28.10
-
GEThttps://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8vCDEjisXLDoOGkh0KBEIczVUCUyOkFWbJDWgySrFdouAGVlEVf0CAVzkwJ5LuhsxrvFWSD_svpQ_MuD6-b5xyuMpbv1TSdkx807dbAmXg668JXMyqOSVXmWHaXNzM7zjKHNXIdkw3P_-7WdvLw9g1O1upy4aWz9JLsY9lD0JYH4Q5sJA%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZmZyZWUtb2ZmaWNlLW9ubGluZS1mb3ItdGhlLXdlYiUzZm9jaWQlM2RjbW01enF4NmxxMA%26rlid%3Dac4e8f1b84851648220ee8e3ad63f87d&TIME=20250410T202853Z&CID=531098720&EID=531098720&tids=15000&adUnitId=11730597&localId=w:B300B431-3D5B-FF4A-B00C-11B10EFBCA8F&deviceId=6896214310665433&muid=B300B4313D5BFF4AB00C11B10EFBCA8FRemote address:150.171.27.10:443RequestGET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8vCDEjisXLDoOGkh0KBEIczVUCUyOkFWbJDWgySrFdouAGVlEVf0CAVzkwJ5LuhsxrvFWSD_svpQ_MuD6-b5xyuMpbv1TSdkx807dbAmXg668JXMyqOSVXmWHaXNzM7zjKHNXIdkw3P_-7WdvLw9g1O1upy4aWz9JLsY9lD0JYH4Q5sJA%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZmZyZWUtb2ZmaWNlLW9ubGluZS1mb3ItdGhlLXdlYiUzZm9jaWQlM2RjbW01enF4NmxxMA%26rlid%3Dac4e8f1b84851648220ee8e3ad63f87d&TIME=20250410T202853Z&CID=531098720&EID=531098720&tids=15000&adUnitId=11730597&localId=w:B300B431-3D5B-FF4A-B00C-11B10EFBCA8F&deviceId=6896214310665433&muid=B300B4313D5BFF4AB00C11B10EFBCA8F HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=07A175A1C94E6B231614606AC8AE6AC8; domain=.bing.com; expires=Wed, 06-May-2026 05:27:29 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 10D748D66939447FB3F21E8CFE4B6180 Ref B: LON04EDGE1020 Ref C: 2025-04-11T05:27:29Z
date: Fri, 11 Apr 2025 05:27:28 GMT
-
GEThttps://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8vCDEjisXLDoOGkh0KBEIczVUCUyOkFWbJDWgySrFdouAGVlEVf0CAVzkwJ5LuhsxrvFWSD_svpQ_MuD6-b5xyuMpbv1TSdkx807dbAmXg668JXMyqOSVXmWHaXNzM7zjKHNXIdkw3P_-7WdvLw9g1O1upy4aWz9JLsY9lD0JYH4Q5sJA%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZmZyZWUtb2ZmaWNlLW9ubGluZS1mb3ItdGhlLXdlYiUzZm9jaWQlM2RjbW01enF4NmxxMA%26rlid%3Dac4e8f1b84851648220ee8e3ad63f87d&TIME=20250410T202853Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:B300B431-3D5B-FF4A-B00C-11B10EFBCA8F&deviceId=6896214310665433&muid=B300B4313D5BFF4AB00C11B10EFBCA8FRemote address:150.171.27.10:443RequestGET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8vCDEjisXLDoOGkh0KBEIczVUCUyOkFWbJDWgySrFdouAGVlEVf0CAVzkwJ5LuhsxrvFWSD_svpQ_MuD6-b5xyuMpbv1TSdkx807dbAmXg668JXMyqOSVXmWHaXNzM7zjKHNXIdkw3P_-7WdvLw9g1O1upy4aWz9JLsY9lD0JYH4Q5sJA%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZmZyZWUtb2ZmaWNlLW9ubGluZS1mb3ItdGhlLXdlYiUzZm9jaWQlM2RjbW01enF4NmxxMA%26rlid%3Dac4e8f1b84851648220ee8e3ad63f87d&TIME=20250410T202853Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:B300B431-3D5B-FF4A-B00C-11B10EFBCA8F&deviceId=6896214310665433&muid=B300B4313D5BFF4AB00C11B10EFBCA8F HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=07A175A1C94E6B231614606AC8AE6AC8; _EDGE_S=SID=137DA8266325681F22ABBDED629E690E
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=YTj7injpTuMZXwUlRFcH-yNDlnDYahpkWwRkAUz3wws; domain=.bing.com; expires=Wed, 06-May-2026 05:27:29 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 2BAD57BEE4534AE183B3FCC2BC1EFFF2 Ref B: LON04EDGE1020 Ref C: 2025-04-11T05:27:29Z
date: Fri, 11 Apr 2025 05:27:28 GMT
-
GEThttps://www.bing.com/aes/c.gif?RG=a4ef1a21696f4f29825f287da49246b0&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20250410T202853Z&adUnitId=11730597&localId=w:B300B431-3D5B-FF4A-B00C-11B10EFBCA8F&deviceId=6896214310665433Remote address:95.101.143.177:443RequestGET /aes/c.gif?RG=a4ef1a21696f4f29825f287da49246b0&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20250410T202853Z&adUnitId=11730597&localId=w:B300B431-3D5B-FF4A-B00C-11B10EFBCA8F&deviceId=6896214310665433 HTTP/2.0
host: www.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=07A175A1C94E6B231614606AC8AE6AC8
ResponseHTTP/2.0 200
pragma: no-cache
vary: Origin
p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 1AE9BD066F9F4F45BA807285EF346DF8 Ref B: LON04EDGE0817 Ref C: 2025-04-11T05:27:29Z
content-length: 0
date: Fri, 11 Apr 2025 05:27:29 GMT
set-cookie: _EDGE_S=SID=137DA8266325681F22ABBDED629E690E; path=/; httponly; domain=bing.com
set-cookie: MUIDB=07A175A1C94E6B231614606AC8AE6AC8; path=/; httponly; expires=Wed, 06-May-2026 05:27:29 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.bc8f655f.1744349249.1c9e1e47
-
Remote address:8.8.8.8:53Requestc.pki.googIN AResponsec.pki.googIN CNAMEpki-goog.l.google.compki-goog.l.google.comIN A142.250.179.227
-
Remote address:142.250.179.227:80RequestGET /r/r1.crl HTTP/1.1
Cache-Control: max-age = 3000
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Thu, 03 Apr 2025 14:18:00 GMT
User-Agent: Microsoft-CryptoAPI/10.0
Host: c.pki.goog
ResponseHTTP/1.1 304 Not Modified
Expires: Fri, 11 Apr 2025 05:40:35 GMT
Age: 2274
Last-Modified: Thu, 03 Apr 2025 14:18:00 GMT
Cache-Control: public, max-age=3000
Vary: Accept-Encoding
-
150.171.27.10:443https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8vCDEjisXLDoOGkh0KBEIczVUCUyOkFWbJDWgySrFdouAGVlEVf0CAVzkwJ5LuhsxrvFWSD_svpQ_MuD6-b5xyuMpbv1TSdkx807dbAmXg668JXMyqOSVXmWHaXNzM7zjKHNXIdkw3P_-7WdvLw9g1O1upy4aWz9JLsY9lD0JYH4Q5sJA%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZmZyZWUtb2ZmaWNlLW9ubGluZS1mb3ItdGhlLXdlYiUzZm9jaWQlM2RjbW01enF4NmxxMA%26rlid%3Dac4e8f1b84851648220ee8e3ad63f87d&TIME=20250410T202853Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:B300B431-3D5B-FF4A-B00C-11B10EFBCA8F&deviceId=6896214310665433&muid=B300B4313D5BFF4AB00C11B10EFBCA8Ftls, http22.5kB 9.2kB 19 17
HTTP Request
GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8vCDEjisXLDoOGkh0KBEIczVUCUyOkFWbJDWgySrFdouAGVlEVf0CAVzkwJ5LuhsxrvFWSD_svpQ_MuD6-b5xyuMpbv1TSdkx807dbAmXg668JXMyqOSVXmWHaXNzM7zjKHNXIdkw3P_-7WdvLw9g1O1upy4aWz9JLsY9lD0JYH4Q5sJA%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZmZyZWUtb2ZmaWNlLW9ubGluZS1mb3ItdGhlLXdlYiUzZm9jaWQlM2RjbW01enF4NmxxMA%26rlid%3Dac4e8f1b84851648220ee8e3ad63f87d&TIME=20250410T202853Z&CID=531098720&EID=531098720&tids=15000&adUnitId=11730597&localId=w:B300B431-3D5B-FF4A-B00C-11B10EFBCA8F&deviceId=6896214310665433&muid=B300B4313D5BFF4AB00C11B10EFBCA8FHTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8vCDEjisXLDoOGkh0KBEIczVUCUyOkFWbJDWgySrFdouAGVlEVf0CAVzkwJ5LuhsxrvFWSD_svpQ_MuD6-b5xyuMpbv1TSdkx807dbAmXg668JXMyqOSVXmWHaXNzM7zjKHNXIdkw3P_-7WdvLw9g1O1upy4aWz9JLsY9lD0JYH4Q5sJA%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZmZyZWUtb2ZmaWNlLW9ubGluZS1mb3ItdGhlLXdlYiUzZm9jaWQlM2RjbW01enF4NmxxMA%26rlid%3Dac4e8f1b84851648220ee8e3ad63f87d&TIME=20250410T202853Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:B300B431-3D5B-FF4A-B00C-11B10EFBCA8F&deviceId=6896214310665433&muid=B300B4313D5BFF4AB00C11B10EFBCA8FHTTP Response
204 -
95.101.143.177:443https://www.bing.com/aes/c.gif?RG=a4ef1a21696f4f29825f287da49246b0&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20250410T202853Z&adUnitId=11730597&localId=w:B300B431-3D5B-FF4A-B00C-11B10EFBCA8F&deviceId=6896214310665433tls, http21.4kB 5.4kB 16 12
HTTP Request
GET https://www.bing.com/aes/c.gif?RG=a4ef1a21696f4f29825f287da49246b0&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20250410T202853Z&adUnitId=11730597&localId=w:B300B431-3D5B-FF4A-B00C-11B10EFBCA8F&deviceId=6896214310665433HTTP Response
200 -
752 B 819 B 12 14
HTTP Request
GET http://c.pki.goog/r/r1.crlHTTP Response
304
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5165cb7536738d30a7ab5d8740f0d5c82
SHA1e7c713f922758e9d5c23ea6ffdcd467e14cd558f
SHA256b2868664ac8e06a5c33b650d24342f6094d0452c481b41bcdbf39ebde572f3b2
SHA512ec800e9e28dec8ddce9ddba03a90795cef22947860eb896ad5fbf24215737c38228fc207adc97270584874f0ce66e5c1fffea51fc2393c7fe56b52bf536467ce