Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
1046d15d49c6...a7.rar
windows7-x64
346d15d49c6...a7.rar
windows10-2004-x64
3Resident E...er.exe
windows7-x64
1Resident E...er.exe
windows10-2004-x64
1dinput8.dll
windows7-x64
1dinput8.dll
windows10-2004-x64
5游侠网�...��.url
windows7-x64
1游侠网�...��.url
windows10-2004-x64
1游侠网�...��.url
windows7-x64
1游侠网�...��.url
windows10-2004-x64
1Analysis
-
max time kernel
123s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2023, 16:35 UTC
Behavioral task
behavioral1
Sample
46d15d49c641f1a0645fbd011449ac4ae40f9c9b627e4544427d57650a8909a7.rar
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
46d15d49c641f1a0645fbd011449ac4ae40f9c9b627e4544427d57650a8909a7.rar
Resource
win10v2004-20231130-en
Behavioral task
behavioral3
Sample
Resident Evil 4 v1.0-v20230921 Plus 36 Trainer.exe
Resource
win7-20231023-en
Behavioral task
behavioral4
Sample
Resident Evil 4 v1.0-v20230921 Plus 36 Trainer.exe
Resource
win10v2004-20231127-en
Behavioral task
behavioral5
Sample
dinput8.dll
Resource
win7-20231201-en
Behavioral task
behavioral6
Sample
dinput8.dll
Resource
win10v2004-20231130-en
Behavioral task
behavioral7
Sample
游侠网最新单机游戏.url
Resource
win7-20231020-en
Behavioral task
behavioral8
Sample
游侠网最新单机游戏.url
Resource
win10v2004-20231127-en
Behavioral task
behavioral9
Sample
游侠网热门MOD补丁.url
Resource
win7-20231023-en
Behavioral task
behavioral10
Sample
游侠网热门MOD补丁.url
Resource
win10v2004-20231127-en
General
-
Target
游侠网热门MOD补丁.url
-
Size
183B
-
MD5
1240cb2f6fdcd17b166496bd17f72cb6
-
SHA1
2c4e10cb34c961bd93b977f138a2b04a0fde54d0
-
SHA256
b309f388ad3192343d775f071c46d20e2c7cfff64e757c20071f164eb46be0e5
-
SHA512
3723249fb3b771aa4b2fb17d535b2aee241dcd16091c90ec55993c1821f1b29f919406ae012b8ce7bf446616acd401cd4ccedbbff254d6b90f1027364c16e690
Malware Config
Signatures
Processes
Network
-
Remote address:8.8.8.8:53Request140.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request186.85.100.95.in-addr.arpaIN PTRResponse186.85.100.95.in-addr.arpaIN PTRa95-100-85-186deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.a-0001.a-msedge.netg-bing-com.a-0001.a-msedge.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=44de1dd47d0a4b4a94266aa2368be0ca&localId=w:98470707-4D7A-9B5E-D19D-B989235A330A&deviceId=6825826206357472&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=44de1dd47d0a4b4a94266aa2368be0ca&localId=w:98470707-4D7A-9B5E-D19D-B989235A330A&deviceId=6825826206357472&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=0DEF532FE2F2604529F540F3E33261A3; domain=.bing.com; expires=Fri, 27-Dec-2024 16:35:44 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: D3AC2F0273AA4AE9A0DC5047DE2AE3D0 Ref B: DUS30EDGE0306 Ref C: 2023-12-03T16:35:44Z
date: Sun, 03 Dec 2023 16:35:43 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=44de1dd47d0a4b4a94266aa2368be0ca&localId=w:98470707-4D7A-9B5E-D19D-B989235A330A&deviceId=6825826206357472&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=44de1dd47d0a4b4a94266aa2368be0ca&localId=w:98470707-4D7A-9B5E-D19D-B989235A330A&deviceId=6825826206357472&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=0DEF532FE2F2604529F540F3E33261A3
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 407B66C4113D4D87AE5B633D5CF0DC79 Ref B: DUS30EDGE0306 Ref C: 2023-12-03T16:35:44Z
date: Sun, 03 Dec 2023 16:35:44 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=44de1dd47d0a4b4a94266aa2368be0ca&localId=w:98470707-4D7A-9B5E-D19D-B989235A330A&deviceId=6825826206357472&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=44de1dd47d0a4b4a94266aa2368be0ca&localId=w:98470707-4D7A-9B5E-D19D-B989235A330A&deviceId=6825826206357472&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=0DEF532FE2F2604529F540F3E33261A3
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 57904AEB8C0647239ED3371E4B92C663 Ref B: DUS30EDGE0306 Ref C: 2023-12-03T16:35:44Z
date: Sun, 03 Dec 2023 16:35:44 GMT
-
Remote address:8.8.8.8:53Request9.228.82.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request200.197.79.204.in-addr.arpaIN PTRResponse200.197.79.204.in-addr.arpaIN PTRa-0001a-msedgenet
-
Remote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301651_1F1H60KU4IQQHGWIG&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301651_1F1H60KU4IQQHGWIG&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 437121
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: D10A11ABC33844C7AA2F1CDAB52BA6F1 Ref B: BRU30EDGE0616 Ref C: 2023-12-03T16:35:45Z
date: Sun, 03 Dec 2023 16:35:44 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301242_1SRW05UUR0YI3F1X9&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301242_1SRW05UUR0YI3F1X9&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 399396
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 99E6C08077844C9896E831AF1EB52435 Ref B: BRU30EDGE0616 Ref C: 2023-12-03T16:35:45Z
date: Sun, 03 Dec 2023 16:35:44 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301611_1E01O38L32FSSHIRP&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301611_1E01O38L32FSSHIRP&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 411186
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 2CFA455FC94A4F9F8C203E5AD86F607E Ref B: BRU30EDGE0616 Ref C: 2023-12-03T16:35:45Z
date: Sun, 03 Dec 2023 16:35:44 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301202_1RQN0RMZHNRAOB7W6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301202_1RQN0RMZHNRAOB7W6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 352234
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 70D18F23BAED4EA8ACAF5589B7531EA9 Ref B: BRU30EDGE0616 Ref C: 2023-12-03T16:35:45Z
date: Sun, 03 Dec 2023 16:35:44 GMT
-
Remote address:8.8.8.8:53Request226.173.246.72.in-addr.arpaIN PTRResponse226.173.246.72.in-addr.arpaIN PTRa72-246-173-226deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request241.154.82.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request50.23.12.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request56.126.166.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request27.90.33.23.in-addr.arpaIN PTRResponse27.90.33.23.in-addr.arpaIN PTRa23-33-90-27deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request193.78.101.95.in-addr.arpaIN PTRResponse193.78.101.95.in-addr.arpaIN PTRa95-101-78-193deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request29.243.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request209.143.182.52.in-addr.arpaIN PTRResponse
-
204.79.197.200:443https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=44de1dd47d0a4b4a94266aa2368be0ca&localId=w:98470707-4D7A-9B5E-D19D-B989235A330A&deviceId=6825826206357472&anid=tls, http21.9kB 9.3kB 21 19
HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=44de1dd47d0a4b4a94266aa2368be0ca&localId=w:98470707-4D7A-9B5E-D19D-B989235A330A&deviceId=6825826206357472&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=44de1dd47d0a4b4a94266aa2368be0ca&localId=w:98470707-4D7A-9B5E-D19D-B989235A330A&deviceId=6825826206357472&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=44de1dd47d0a4b4a94266aa2368be0ca&localId=w:98470707-4D7A-9B5E-D19D-B989235A330A&deviceId=6825826206357472&anid=HTTP Response
204 -
1.2kB 8.3kB 16 14
-
204.79.197.200:443https://tse1.mm.bing.net/th?id=OADD2.10239317301202_1RQN0RMZHNRAOB7W6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90tls, http260.5kB 1.7MB 1219 1216
HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301651_1F1H60KU4IQQHGWIG&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301242_1SRW05UUR0YI3F1X9&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301611_1E01O38L32FSSHIRP&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301202_1RQN0RMZHNRAOB7W6&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200 -
1.2kB 8.2kB 16 13
-
1.2kB 8.3kB 16 14
-
72 B 158 B 1 1
DNS Request
140.32.126.40.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
186.85.100.95.in-addr.arpa
-
56 B 158 B 1 1
DNS Request
g.bing.com
DNS Response
204.79.197.20013.107.21.200
-
70 B 156 B 1 1
DNS Request
9.228.82.20.in-addr.arpa
-
73 B 106 B 1 1
DNS Request
200.197.79.204.in-addr.arpa
-
62 B 173 B 1 1
DNS Request
tse1.mm.bing.net
DNS Response
204.79.197.20013.107.21.200
-
73 B 139 B 1 1
DNS Request
226.173.246.72.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
241.154.82.20.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
50.23.12.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
56.126.166.20.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
27.90.33.23.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
193.78.101.95.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
29.243.111.52.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
209.143.182.52.in-addr.arpa