Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

dridex

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/12/2023, 15:12 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3a4747ca0698e215af7c9a51184634fb9422cec1a65f10ddf4a4d437fca86c44.exe

  • Size

    7.0MB

  • MD5

    eb0eba98a87b2da1449e4b655a93083f

  • SHA1

    e997e17e73a702d5be7eaea87331400b6668a542

  • SHA256

    3a4747ca0698e215af7c9a51184634fb9422cec1a65f10ddf4a4d437fca86c44

  • SHA512

    0ec0c98220e546c17c1174b38e24909f3d72ae5d360c5d3a866d232d6eb7aeee72560c186709647ec083c8530a6819e12a84e84c55bfb25e8bcb3f6f387e0ad3

  • SSDEEP

    196608:Wxm5Z7xPjWtYOkdHWd1V3GaO4TwWHvzASW8P7Bzj:d7RjWtfj95dLASWyzj

Score
7/10
discovery

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 63 IoCs
  • Runs net.exe
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a4747ca0698e215af7c9a51184634fb9422cec1a65f10ddf4a4d437fca86c44.exe
    "C:\Users\Admin\AppData\Local\Temp\3a4747ca0698e215af7c9a51184634fb9422cec1a65f10ddf4a4d437fca86c44.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Users\Admin\AppData\Local\Temp\is-OSMAL.tmp\3a4747ca0698e215af7c9a51184634fb9422cec1a65f10ddf4a4d437fca86c44.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-OSMAL.tmp\3a4747ca0698e215af7c9a51184634fb9422cec1a65f10ddf4a4d437fca86c44.tmp" /SL5="$601DA,7089240,121856,C:\Users\Admin\AppData\Local\Temp\3a4747ca0698e215af7c9a51184634fb9422cec1a65f10ddf4a4d437fca86c44.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3800
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Query
        3⤵
          PID:1628
        • C:\Program Files (x86)\numGIF\numgif.exe
          "C:\Program Files (x86)\numGIF\numgif.exe" -i
          3⤵
          • Executes dropped EXE
          PID:3820
        • C:\Program Files (x86)\numGIF\numgif.exe
          "C:\Program Files (x86)\numGIF\numgif.exe" -s
          3⤵
          • Executes dropped EXE
          PID:2988
        • C:\Windows\SysWOW64\net.exe
          "C:\Windows\system32\net.exe" helpmsg 12
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4256
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 helpmsg 12
            4⤵
              PID:4532

      Network

      • flag-us
        DNS
        19.53.126.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        19.53.126.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        194.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        194.178.17.96.in-addr.arpa
        IN PTR
        Response
        194.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-194deploystaticakamaitechnologiescom
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        9.228.82.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        9.228.82.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        195.233.44.23.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        195.233.44.23.in-addr.arpa
        IN PTR
        Response
        195.233.44.23.in-addr.arpa
        IN PTR
        a23-44-233-195deploystaticakamaitechnologiescom
      • flag-us
        DNS
        88.156.103.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        88.156.103.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        g.bing.com
        Remote address:
        8.8.8.8:53
        Request
        g.bing.com
        IN A
        Response
        g.bing.com
        IN CNAME
        g-bing-com.a-0001.a-msedge.net
        g-bing-com.a-0001.a-msedge.net
        IN CNAME
        dual-a-0001.a-msedge.net
        dual-a-0001.a-msedge.net
        IN A
        204.79.197.200
        dual-a-0001.a-msedge.net
        IN A
        13.107.21.200
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=bcbb8f4ef115421f80ba1d9d12532185&localId=w:5DA71B07-9A86-3028-7BAC-0A2B03A6FF03&deviceId=6896189400010801&anid=
        Remote address:
        204.79.197.200:443
        Request
        GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=bcbb8f4ef115421f80ba1d9d12532185&localId=w:5DA71B07-9A86-3028-7BAC-0A2B03A6FF03&deviceId=6896189400010801&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        set-cookie: MUID=0F5AB417F916699E1702A7F2F8F6680A; domain=.bing.com; expires=Sun, 05-Jan-2025 15:13:00 GMT; path=/; SameSite=None; Secure; Priority=High;
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 5503CD84B14F46808426BF8C5D66BCB7 Ref B: LON04EDGE1219 Ref C: 2023-12-12T15:12:59Z
        date: Tue, 12 Dec 2023 15:12:59 GMT
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=bcbb8f4ef115421f80ba1d9d12532185&localId=w:5DA71B07-9A86-3028-7BAC-0A2B03A6FF03&deviceId=6896189400010801&anid=
        Remote address:
        204.79.197.200:443
        Request
        GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=bcbb8f4ef115421f80ba1d9d12532185&localId=w:5DA71B07-9A86-3028-7BAC-0A2B03A6FF03&deviceId=6896189400010801&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=0F5AB417F916699E1702A7F2F8F6680A
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 80373250A8A74C729C96F50DE1C862F8 Ref B: LON04EDGE1219 Ref C: 2023-12-12T15:13:00Z
        date: Tue, 12 Dec 2023 15:12:59 GMT
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=bcbb8f4ef115421f80ba1d9d12532185&localId=w:5DA71B07-9A86-3028-7BAC-0A2B03A6FF03&deviceId=6896189400010801&anid=
        Remote address:
        204.79.197.200:443
        Request
        GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=bcbb8f4ef115421f80ba1d9d12532185&localId=w:5DA71B07-9A86-3028-7BAC-0A2B03A6FF03&deviceId=6896189400010801&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=0F5AB417F916699E1702A7F2F8F6680A
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 843DB105E75C4B958EBFE73863F3ADBF Ref B: LON04EDGE1219 Ref C: 2023-12-12T15:13:00Z
        date: Tue, 12 Dec 2023 15:12:59 GMT
      • flag-us
        DNS
        158.240.127.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        158.240.127.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        200.197.79.204.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        200.197.79.204.in-addr.arpa
        IN PTR
        Response
        200.197.79.204.in-addr.arpa
        IN PTR
        a-0001a-msedgenet
      • flag-us
        DNS
        tse1.mm.bing.net
        Remote address:
        8.8.8.8:53
        Request
        tse1.mm.bing.net
        IN A
        Response
        tse1.mm.bing.net
        IN CNAME
        mm-mm.bing.net.trafficmanager.net
        mm-mm.bing.net.trafficmanager.net
        IN CNAME
        dual-a-0001.a-msedge.net
        dual-a-0001.a-msedge.net
        IN A
        204.79.197.200
        dual-a-0001.a-msedge.net
        IN A
        13.107.21.200
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301065_19TESU14MC7PCJXY2&pid=21.2&w=1920&h=1080&c=4
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317301065_19TESU14MC7PCJXY2&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 254682
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: C02A88CEEE5D40D9BB8498B926FE2C22 Ref B: LON04EDGE1205 Ref C: 2023-12-12T15:13:05Z
        date: Tue, 12 Dec 2023 15:13:04 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301012_1DT3SPQ6H8PJS90JX&pid=21.2&w=1920&h=1080&c=4
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317301012_1DT3SPQ6H8PJS90JX&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 219323
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 764A81F383DD49368A652F9872CB2D0C Ref B: LON04EDGE1205 Ref C: 2023-12-12T15:13:05Z
        date: Tue, 12 Dec 2023 15:13:04 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301498_17NQSSF7P234KKL2V&pid=21.2&w=1080&h=1920&c=4
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317301498_17NQSSF7P234KKL2V&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 223007
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 84FE6DD8D2704D2BACBA208E9D012B66 Ref B: LON04EDGE1205 Ref C: 2023-12-12T15:13:05Z
        date: Tue, 12 Dec 2023 15:13:04 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301445_16HJFWLBQS1NE7H3N&pid=21.2&w=1080&h=1920&c=4
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317301445_16HJFWLBQS1NE7H3N&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 226020
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 85D9B1FC35704293B219FB590E7FFAB1 Ref B: LON04EDGE1205 Ref C: 2023-12-12T15:13:05Z
        date: Tue, 12 Dec 2023 15:13:04 GMT
      • flag-us
        DNS
        26.165.165.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        26.165.165.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        171.39.242.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        171.39.242.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        18.134.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        18.134.221.88.in-addr.arpa
        IN PTR
        Response
        18.134.221.88.in-addr.arpa
        IN PTR
        a88-221-134-18deploystaticakamaitechnologiescom
      • flag-us
        DNS
        26.35.223.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        26.35.223.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        205.47.74.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        205.47.74.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        137.71.105.51.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        137.71.105.51.in-addr.arpa
        IN PTR
        Response
      • flag-ru
        DNS
        dtedugs.info
        numgif.exe
        Remote address:
        152.89.198.214:53
        Request
        dtedugs.info
        IN A
        Response
        dtedugs.info
        IN A
        185.196.8.22
      • flag-us
        GET
        http://dtedugs.info/click/?counter=de7ef49b2c006853fb386b78600ff31230fb1905c311578eaae3c7edb62dde24353e1d9a943e9d15038842974dbc1dbaf7a1439f518166429e289d5b86953e226c55f676647fc2813369d184da325a508cd202f915ce
        numgif.exe
        Remote address:
        185.196.8.22:80
        Request
        GET /click/?counter=de7ef49b2c006853fb386b78600ff31230fb1905c311578eaae3c7edb62dde24353e1d9a943e9d15038842974dbc1dbaf7a1439f518166429e289d5b86953e226c55f676647fc2813369d184da325a508cd202f915ce HTTP/1.1
        Host: dtedugs.info
        User-Agent: Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US)
        Response
        HTTP/1.1 200 OK
        Server: nginx/1.20.1
        Date: Tue, 12 Dec 2023 15:15:03 GMT
        Content-Type: text/html; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: keep-alive
        X-Powered-By: PHP/7.4.33
      • flag-us
        DNS
        214.198.89.152.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        214.198.89.152.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        22.8.196.185.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        22.8.196.185.in-addr.arpa
        IN PTR
        Response
        22.8.196.185.in-addr.arpa
        IN PTR
        g3fmytasteoftodaycom
      • 204.79.197.200:443
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=bcbb8f4ef115421f80ba1d9d12532185&localId=w:5DA71B07-9A86-3028-7BAC-0A2B03A6FF03&deviceId=6896189400010801&anid=
        tls, http2
        1.9kB
         9.3kB
         22
        19

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=bcbb8f4ef115421f80ba1d9d12532185&localId=w:5DA71B07-9A86-3028-7BAC-0A2B03A6FF03&deviceId=6896189400010801&anid=

        HTTP Response

        204

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=bcbb8f4ef115421f80ba1d9d12532185&localId=w:5DA71B07-9A86-3028-7BAC-0A2B03A6FF03&deviceId=6896189400010801&anid=

        HTTP Response

        204

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=bcbb8f4ef115421f80ba1d9d12532185&localId=w:5DA71B07-9A86-3028-7BAC-0A2B03A6FF03&deviceId=6896189400010801&anid=

        HTTP Response

        204
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         8.2kB
         16
        13
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         8.3kB
         16
        14
      • 204.79.197.200:443
        https://tse1.mm.bing.net/th?id=OADD2.10239317301445_16HJFWLBQS1NE7H3N&pid=21.2&w=1080&h=1920&c=4
        tls, http2
        33.4kB
         963.1kB
         704
        702

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301065_19TESU14MC7PCJXY2&pid=21.2&w=1920&h=1080&c=4

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301012_1DT3SPQ6H8PJS90JX&pid=21.2&w=1920&h=1080&c=4

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301498_17NQSSF7P234KKL2V&pid=21.2&w=1080&h=1920&c=4

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301445_16HJFWLBQS1NE7H3N&pid=21.2&w=1080&h=1920&c=4

        HTTP Response

        200

        HTTP Response

        200

        HTTP Response

        200

        HTTP Response

        200
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         8.3kB
         16
        14
      • 185.196.8.22:80
        http://dtedugs.info/click/?counter=de7ef49b2c006853fb386b78600ff31230fb1905c311578eaae3c7edb62dde24353e1d9a943e9d15038842974dbc1dbaf7a1439f518166429e289d5b86953e226c55f676647fc2813369d184da325a508cd202f915ce
        http
        numgif.exe
        480 B
         352 B
         4
        3

        HTTP Request

        GET http://dtedugs.info/click/?counter=de7ef49b2c006853fb386b78600ff31230fb1905c311578eaae3c7edb62dde24353e1d9a943e9d15038842974dbc1dbaf7a1439f518166429e289d5b86953e226c55f676647fc2813369d184da325a508cd202f915ce

        HTTP Response

        200
      • 8.8.8.8:53
        19.53.126.40.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        19.53.126.40.in-addr.arpa

      • 8.8.8.8:53
        194.178.17.96.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        194.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
         144 B
         1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        9.228.82.20.in-addr.arpa
        dns
        70 B
         156 B
         1
        1

        DNS Request

        9.228.82.20.in-addr.arpa

      • 8.8.8.8:53
        195.233.44.23.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        195.233.44.23.in-addr.arpa

      • 8.8.8.8:53
        88.156.103.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        88.156.103.20.in-addr.arpa

      • 8.8.8.8:53
        g.bing.com
        dns
        56 B
         158 B
         1
        1

        DNS Request

        g.bing.com

        DNS Response

        204.79.197.200
        13.107.21.200

      • 8.8.8.8:53
        158.240.127.40.in-addr.arpa
        dns
        73 B
         147 B
         1
        1

        DNS Request

        158.240.127.40.in-addr.arpa

      • 8.8.8.8:53
        200.197.79.204.in-addr.arpa
        dns
        73 B
         106 B
         1
        1

        DNS Request

        200.197.79.204.in-addr.arpa

      • 8.8.8.8:53
        tse1.mm.bing.net
        dns
        62 B
         173 B
         1
        1

        DNS Request

        tse1.mm.bing.net

        DNS Response

        204.79.197.200
        13.107.21.200

      • 8.8.8.8:53
        26.165.165.52.in-addr.arpa
        dns
        72 B
         146 B
         1
        1

        DNS Request

        26.165.165.52.in-addr.arpa

      • 8.8.8.8:53
        171.39.242.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        171.39.242.20.in-addr.arpa

      • 8.8.8.8:53
        18.134.221.88.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        18.134.221.88.in-addr.arpa

      • 8.8.8.8:53
        26.35.223.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        26.35.223.20.in-addr.arpa

      • 8.8.8.8:53
        205.47.74.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        205.47.74.20.in-addr.arpa

      • 8.8.8.8:53
        137.71.105.51.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        137.71.105.51.in-addr.arpa

      • 152.89.198.214:53
        dtedugs.info
        dns
        numgif.exe
        58 B
         86 B
         1
        1

        DNS Request

        dtedugs.info

        DNS Response

        185.196.8.22

      • 8.8.8.8:53
        214.198.89.152.in-addr.arpa
        dns
        73 B
         127 B
         1
        1

        DNS Request

        214.198.89.152.in-addr.arpa

      • 8.8.8.8:53
        22.8.196.185.in-addr.arpa
        dns
        71 B
         107 B
         1
        1

        DNS Request

        22.8.196.185.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\numGIF\numgif.exe
        Filesize

        2.0MB

        MD5

        e4a8032541379455f84bccfe4920d9da

        SHA1

        ab9ed80023a2c08705234d5057a4cab860d87a2b

        SHA256

        45b27c8d70b72412f6d1f3b5e08262318d1e87490bb31c4f29975e0f87e192af

        SHA512

        72468e314b80bb9b4ab658676e7f8a19062cf2c3af0fb29b06c56924d2718319669d7f8cc37959072d376aa0e4119fea6674697021816b6ce5ce1c1f7c05e03f

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\is-2MKLA.tmp\_isetup\_iscrypt.dll
        Filesize

        2KB

        MD5

        a69559718ab506675e907fe49deb71e9

        SHA1

        bc8f404ffdb1960b50c12ff9413c893b56f2e36f

        SHA256

        2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

        SHA512

        e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\is-2MKLA.tmp\_isetup\_isdecmp.dll
        Filesize

        19KB

        MD5

        3adaa386b671c2df3bae5b39dc093008

        SHA1

        067cf95fbdb922d81db58432c46930f86d23dded

        SHA256

        71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38

        SHA512

        bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\is-OSMAL.tmp\3a4747ca0698e215af7c9a51184634fb9422cec1a65f10ddf4a4d437fca86c44.tmp
        Filesize

        687KB

        MD5

        f448d7f4b76e5c9c3a4eaff16a8b9b73

        SHA1

        31808f1ffa84c954376975b7cdb0007e6b762488

        SHA256

        7233b85eb0f8b3aa5cae3811d727aa8742fec4d1091c120a0fe15006f424cc49

        SHA512

        f8197458cd2764c0b852dac34f9bf361110a7dc86903024a97c7bcd3f77b148342bf45e3c2b60f6af8198ae3b83938dbaad5e007d71a0f88006f3a0618cf36f4

        Download Submit

      • memory/1712-158-0x0000000000400000-0x0000000000425000-memory.dmp

        Filesize

        148KB

        Download

      • memory/1712-0-0x0000000000400000-0x0000000000425000-memory.dmp

        Filesize

        148KB

        Download

      • memory/2988-186-0x0000000000400000-0x00000000005F7000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2988-189-0x0000000000400000-0x00000000005F7000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2988-206-0x0000000000400000-0x00000000005F7000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2988-202-0x0000000000400000-0x00000000005F7000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2988-157-0x0000000000400000-0x00000000005F7000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2988-199-0x0000000000400000-0x00000000005F7000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2988-159-0x0000000000400000-0x00000000005F7000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2988-196-0x0000000000400000-0x00000000005F7000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2988-161-0x0000000000400000-0x00000000005F7000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2988-193-0x0000000000400000-0x00000000005F7000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2988-165-0x0000000000400000-0x00000000005F7000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2988-167-0x0000000000400000-0x00000000005F7000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2988-170-0x0000000000400000-0x00000000005F7000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2988-173-0x0000000000400000-0x00000000005F7000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2988-176-0x0000000000400000-0x00000000005F7000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2988-179-0x00000000006F0000-0x000000000078E000-memory.dmp

        Filesize

        632KB

        Download

      • memory/2988-180-0x0000000000400000-0x00000000005F7000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/2988-183-0x00000000006F0000-0x000000000078E000-memory.dmp

        Filesize

        632KB

        Download

      • memory/2988-191-0x00000000006F0000-0x000000000078E000-memory.dmp

        Filesize

        632KB

        Download

      • memory/3800-6-0x0000000002240000-0x0000000002241000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3800-163-0x0000000002240000-0x0000000002241000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3800-160-0x0000000000400000-0x00000000004BC000-memory.dmp

        Filesize

        752KB

        Download

      • memory/3820-151-0x0000000000400000-0x00000000005F7000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/3820-150-0x0000000000400000-0x00000000005F7000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/3820-154-0x0000000000400000-0x00000000005F7000-memory.dmp

        Filesize

        2.0MB

        Download

      • memory/3820-152-0x0000000000400000-0x00000000005F7000-memory.dmp

        Filesize

        2.0MB

        Download

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.