Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

0987f8c064...a6.exe

windows7-x64

7

0987f8c064...a6.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    143s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 01:07 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0987f8c064ae1df6179b1fea805d90a6.exe

  • Size

    319KB

  • MD5

    0987f8c064ae1df6179b1fea805d90a6

  • SHA1

    244cdc00af7a48fe0be4021e57c5efa8edfcbf06

  • SHA256

    3843f978c4fa1c2678fcc485917d4e3365f0c02b35dfe6e7f80c820d877f526e

  • SHA512

    5bd3d02c0f7954fce60d7bbd9226531ca3a249d3fb34da46d253fa5796091a4857682bb0a7f667ff7c63809b785db3dd0a3539220dcc193b539c3185205fb3e9

  • SSDEEP

    6144:91OgDPdkBAFZWjadD4sPj/9/f2BrxFk4mfH1fN1+6Psasl1S8HsOKLE6:91OgLdag/1f2BVF6tL+DHsOD6

Score
7/10
adwarediscoveryspywarestealer

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • NSIS installer 4 IoCs
    installer
  • Modifies registry class 63 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\0987f8c064ae1df6179b1fea805d90a6.exe
    "C:\Users\Admin\AppData\Local\Temp\0987f8c064ae1df6179b1fea805d90a6.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2516
    • C:\Users\Admin\AppData\Local\Temp\7zS6B8B.tmp\setup.exe
      .\setup.exe /s
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • Modifies registry class
      • System policy modification
      PID:2316

Network

  • flag-us
    DNS
    59.128.231.4.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    59.128.231.4.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    240.221.184.93.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.221.184.93.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
    Response
    g.bing.com
    IN CNAME
    g-bing-com.a-0001.a-msedge.net
    g-bing-com.a-0001.a-msedge.net
    IN CNAME
    dual-a-0001.a-msedge.net
    dual-a-0001.a-msedge.net
    IN A
    204.79.197.200
    dual-a-0001.a-msedge.net
    IN A
    13.107.21.200
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=7394f9dc6f4b4479a2b19a68a24ed5b1&localId=w:09BE301F-AF04-8909-0529-ADD134954281&deviceId=6896190259413427&anid=
    Remote address:
    204.79.197.200:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=7394f9dc6f4b4479a2b19a68a24ed5b1&localId=w:09BE301F-AF04-8909-0529-ADD134954281&deviceId=6896190259413427&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MUID=0E22F3B8697B69A200DCE040689B6861; domain=.bing.com; expires=Fri, 24-Jan-2025 01:00:50 GMT; path=/; SameSite=None; Secure; Priority=High;
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 9FB3A2C7FB9847CDBC6126BE6656E96D Ref B: LON04EDGE1119 Ref C: 2023-12-31T01:00:50Z
    date: Sun, 31 Dec 2023 01:00:49 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=7394f9dc6f4b4479a2b19a68a24ed5b1&localId=w:09BE301F-AF04-8909-0529-ADD134954281&deviceId=6896190259413427&anid=
    Remote address:
    204.79.197.200:443
    Request
    GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=7394f9dc6f4b4479a2b19a68a24ed5b1&localId=w:09BE301F-AF04-8909-0529-ADD134954281&deviceId=6896190259413427&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=0E22F3B8697B69A200DCE040689B6861
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MSPTC=lTaIAoTi_LNHIdO4qSVOwTwhIDuzT0CwHpFuk3q3OEk; domain=.bing.com; expires=Fri, 24-Jan-2025 01:00:50 GMT; path=/; Partitioned; secure; SameSite=None
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 1BF9D0F2BBE141828F01903F123B426A Ref B: LON04EDGE1119 Ref C: 2023-12-31T01:00:50Z
    date: Sun, 31 Dec 2023 01:00:49 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=7394f9dc6f4b4479a2b19a68a24ed5b1&localId=w:09BE301F-AF04-8909-0529-ADD134954281&deviceId=6896190259413427&anid=
    Remote address:
    204.79.197.200:443
    Request
    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=7394f9dc6f4b4479a2b19a68a24ed5b1&localId=w:09BE301F-AF04-8909-0529-ADD134954281&deviceId=6896190259413427&anid= HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=0E22F3B8697B69A200DCE040689B6861; MSPTC=lTaIAoTi_LNHIdO4qSVOwTwhIDuzT0CwHpFuk3q3OEk
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 967015A002234C0294484C5E16A1A4D0 Ref B: LON04EDGE1119 Ref C: 2023-12-31T01:00:50Z
    date: Sun, 31 Dec 2023 01:00:49 GMT
  • flag-us
    DNS
    200.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.197.79.204.in-addr.arpa
    IN PTR
    Response
    200.197.79.204.in-addr.arpa
    IN PTR
    a-0001a-msedgenet
  • flag-us
    DNS
    23.181.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    23.181.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    9.228.82.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    9.228.82.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    26.35.223.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    26.35.223.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    26.35.223.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    26.35.223.20.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    26.35.223.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    26.35.223.20.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    41.110.16.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    41.110.16.96.in-addr.arpa
    IN PTR
    Response
    41.110.16.96.in-addr.arpa
    IN PTR
    a96-16-110-41deploystaticakamaitechnologiescom
  • flag-us
    DNS
    81.171.91.138.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    81.171.91.138.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    103.169.127.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    103.169.127.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    2.136.104.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    2.136.104.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    2.136.104.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    2.136.104.51.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    43.58.199.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.58.199.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    dual-a-0001.a-msedge.net
    dual-a-0001.a-msedge.net
    IN A
    204.79.197.200
    dual-a-0001.a-msedge.net
    IN A
    13.107.21.200
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301314_15NH4Q4MRESFVC85L&pid=21.2&w=1920&h=1080&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301314_15NH4Q4MRESFVC85L&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 456198
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 8CF7DD4E55AB4C019926BD451E20E4CE Ref B: LON04EDGE0711 Ref C: 2023-12-31T01:01:31Z
    date: Sun, 31 Dec 2023 01:01:31 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301723_1VP0V0AJHJH9BAT7S&pid=21.2&w=1080&h=1920&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301723_1VP0V0AJHJH9BAT7S&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 483318
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 0EA030B60BE34EB9AC51F5203F70E62C Ref B: LON04EDGE0711 Ref C: 2023-12-31T01:01:32Z
    date: Sun, 31 Dec 2023 01:01:31 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301430_1ADJRC7M3M5FNTXFH&pid=21.2&w=1080&h=1920&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301430_1ADJRC7M3M5FNTXFH&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 208652
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 0B2633BFC4CF4A7BBED19FE677059985 Ref B: LON04EDGE0711 Ref C: 2023-12-31T01:01:32Z
    date: Sun, 31 Dec 2023 01:01:31 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317300997_10EXBSPGG8PT2UMNG&pid=21.2&w=1920&h=1080&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317300997_10EXBSPGG8PT2UMNG&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 256677
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 47D3B8F0CB1F4E77ACF0114B85B1943F Ref B: LON04EDGE0711 Ref C: 2023-12-31T01:01:32Z
    date: Sun, 31 Dec 2023 01:01:32 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301325_1YMIRALDGCWA4284D&pid=21.2&w=1920&h=1080&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301325_1YMIRALDGCWA4284D&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 149126
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 3080B088549E480CA7186102B50B8AD8 Ref B: LON04EDGE0711 Ref C: 2023-12-31T01:01:32Z
    date: Sun, 31 Dec 2023 01:01:32 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301734_1HIK8LLAATSP6A8ZA&pid=21.2&w=1080&h=1920&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301734_1HIK8LLAATSP6A8ZA&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 170119
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: E59C5560A29740E5BBDADF906C32398D Ref B: LON04EDGE0711 Ref C: 2023-12-31T01:01:32Z
    date: Sun, 31 Dec 2023 01:01:32 GMT
  • flag-us
    DNS
    194.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    194.178.17.96.in-addr.arpa
    IN PTR
    Response
    194.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-194deploystaticakamaitechnologiescom
  • flag-us
    DNS
    194.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    194.178.17.96.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    119.110.54.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    119.110.54.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    43.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    0.204.248.87.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.204.248.87.in-addr.arpa
    IN PTR
    Response
    0.204.248.87.in-addr.arpa
    IN PTR
    https-87-248-204-0lhrllnwnet
  • flag-us
    DNS
    0.204.248.87.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.204.248.87.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    0.204.248.87.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.204.248.87.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    169.117.168.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    169.117.168.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    169.117.168.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    169.117.168.52.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    169.117.168.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    169.117.168.52.in-addr.arpa
    IN PTR
  • 204.79.197.200:443
    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=7394f9dc6f4b4479a2b19a68a24ed5b1&localId=w:09BE301F-AF04-8909-0529-ADD134954281&deviceId=6896190259413427&anid=
    tls, http2
    2.0kB
     9.4kB
     22
    19

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=7394f9dc6f4b4479a2b19a68a24ed5b1&localId=w:09BE301F-AF04-8909-0529-ADD134954281&deviceId=6896190259413427&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=7394f9dc6f4b4479a2b19a68a24ed5b1&localId=w:09BE301F-AF04-8909-0529-ADD134954281&deviceId=6896190259413427&anid=

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=7394f9dc6f4b4479a2b19a68a24ed5b1&localId=w:09BE301F-AF04-8909-0529-ADD134954281&deviceId=6896190259413427&anid=

    HTTP Response

    204
  • 52.142.223.178:80
    52 B
     1
  • 204.79.197.200:443
    https://tse1.mm.bing.net/th?id=OADD2.10239317301734_1HIK8LLAATSP6A8ZA&pid=21.2&w=1080&h=1920&c=4
    tls, http2
    74.7kB
     1.9MB
     1379
    1373

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301314_15NH4Q4MRESFVC85L&pid=21.2&w=1920&h=1080&c=4

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301723_1VP0V0AJHJH9BAT7S&pid=21.2&w=1080&h=1920&c=4

    HTTP Response

    200

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301430_1ADJRC7M3M5FNTXFH&pid=21.2&w=1080&h=1920&c=4

    HTTP Response

    200

    HTTP Response

    200

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317300997_10EXBSPGG8PT2UMNG&pid=21.2&w=1920&h=1080&c=4

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301325_1YMIRALDGCWA4284D&pid=21.2&w=1920&h=1080&c=4

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301734_1HIK8LLAATSP6A8ZA&pid=21.2&w=1080&h=1920&c=4

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.7kB
     8.2kB
     18
    13
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.5kB
     8.5kB
     16
    12
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.3kB
     658 B
     12
    8
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.6kB
     8.7kB
     18
    14
  • 8.8.8.8:53
    59.128.231.4.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    59.128.231.4.in-addr.arpa

  • 8.8.8.8:53
    240.221.184.93.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    240.221.184.93.in-addr.arpa

  • 8.8.8.8:53
    g.bing.com
    dns
    56 B
     158 B
     1
    1

    DNS Request

    g.bing.com

    DNS Response

    204.79.197.200
    13.107.21.200

  • 8.8.8.8:53
    200.197.79.204.in-addr.arpa
    dns
    73 B
     106 B
     1
    1

    DNS Request

    200.197.79.204.in-addr.arpa

  • 8.8.8.8:53
    23.181.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    23.181.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    9.228.82.20.in-addr.arpa
    dns
    70 B
     156 B
     1
    1

    DNS Request

    9.228.82.20.in-addr.arpa

  • 8.8.8.8:53
    26.35.223.20.in-addr.arpa
    dns
    213 B
     157 B
     3
    1

    DNS Request

    26.35.223.20.in-addr.arpa

    DNS Request

    26.35.223.20.in-addr.arpa

    DNS Request

    26.35.223.20.in-addr.arpa

  • 8.8.8.8:53
    41.110.16.96.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    41.110.16.96.in-addr.arpa

  • 8.8.8.8:53
    81.171.91.138.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    81.171.91.138.in-addr.arpa

  • 8.8.8.8:53
    103.169.127.40.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    103.169.127.40.in-addr.arpa

  • 8.8.8.8:53
    2.136.104.51.in-addr.arpa
    dns
    142 B
     157 B
     2
    1

    DNS Request

    2.136.104.51.in-addr.arpa

    DNS Request

    2.136.104.51.in-addr.arpa

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    142 B
     145 B
     2
    1

    DNS Request

    206.23.85.13.in-addr.arpa

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    43.58.199.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    43.58.199.20.in-addr.arpa

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    62 B
     173 B
     1
    1

    DNS Request

    tse1.mm.bing.net

    DNS Response

    204.79.197.200
    13.107.21.200

  • 8.8.8.8:53
    194.178.17.96.in-addr.arpa
    dns
    144 B
     137 B
     2
    1

    DNS Request

    194.178.17.96.in-addr.arpa

    DNS Request

    194.178.17.96.in-addr.arpa

  • 8.8.8.8:53
    119.110.54.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    119.110.54.20.in-addr.arpa

  • 8.8.8.8:53
    43.229.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    43.229.111.52.in-addr.arpa

  • 8.8.8.8:53
    0.204.248.87.in-addr.arpa
    dns
    213 B
     116 B
     3
    1

    DNS Request

    0.204.248.87.in-addr.arpa

    DNS Request

    0.204.248.87.in-addr.arpa

    DNS Request

    0.204.248.87.in-addr.arpa

  • 8.8.8.8:53
    169.117.168.52.in-addr.arpa
    dns
    219 B
     147 B
     3
    1

    DNS Request

    169.117.168.52.in-addr.arpa

    DNS Request

    169.117.168.52.in-addr.arpa

    DNS Request

    169.117.168.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\wxDfast\uninstall.exe
    Filesize

    46KB

    MD5

    2628f4240552cc3b2ba04ee51078ae0c

    SHA1

    5b0cca662149240d1fd4354beac1338e97e334ea

    SHA256

    03c965d0bd9827a978ef4080139533573aa800c9803599c0ce91da48506ad8f6

    SHA512

    6ecfcc97126373e82f1edab47020979d7706fc2be39ca792e8f30595133cd762cd4a65a246bee9180713e40e61efa373ecfb5eb72501ee18b38f13e32e61793b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7zS6B8B.tmp\4ff420cc5d599@4ff420cc5d5d2.info\chrome.manifest
    Filesize

    114B

    MD5

    9019106d3128c0ae6f54f1578eccb848

    SHA1

    21ccded1bfa4a6906a767529488b98257b39a069

    SHA256

    e1452fb716c270fe3da9396dc69af25d6ed5c0a842890b984b4ef1669a7cef60

    SHA512

    68c3538715f0b089b2adba02af648efad0cd8916ccf3fb26a447b3987206ce36ec9eca3c4c35b5643c366019924efbb4ba69674eeeee301dcac2f73c13009447

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7zS6B8B.tmp\4ff420cc5d599@4ff420cc5d5d2.info\content\indexeddb.js
    Filesize

    1KB

    MD5

    d180154787ad45e53337c0edbab1f3c4

    SHA1

    ee5555d4fa12a1dd15cb415923d287d168791fed

    SHA256

    b5dc85dd0ad25f666348e2e424b624484e6b80e06fdeab61bbc8155fa8653cdd

    SHA512

    c6be4ab8536ab52d5c606396d33cbeacee1ea7355a16d50a4df6e063c84ff4892b6b33a6f90db0a8f03593343b503746952d77fce210db9a891c3cf1e90785f4

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7zS6B8B.tmp\4ff420cc5d599@4ff420cc5d5d2.info\content\jquery.js
    Filesize

    91KB

    MD5

    4bab8348a52d17428f684ad1ec3a427e

    SHA1

    56c912a8c8561070aee7b9808c5f3b2abec40063

    SHA256

    3739b485ac39b157caa066b883e4d9d3f74c50beff0b86cd8a24ce407b179a23

    SHA512

    a693069c66d8316d73a3c01ed9e6a4553c9b92d98b294f0e170cc9f9f5502c814255f5f92b93aeb07e0d6fe4613f9a1d511e1bfd965634f04e6cf18f191a7480

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7zS6B8B.tmp\4ff420cc5d599@4ff420cc5d5d2.info\content\jsext.js
    Filesize

    6KB

    MD5

    2c373f06c4c38b26ca458b8bf713a090

    SHA1

    86cb69b259e935c8c31ccd8e028dc7db5ac7f816

    SHA256

    5900fd5ea9abef9882459b847175a9349a0d4f3cf00fac4336167ad4c49eb81c

    SHA512

    fddcaf9ac0e1d5ecd51299546c3cf8428e52513c4d40ce5c4552139d10102a454a5b1bcc0e842184be886041886b820a0f4b82422aa97429f6ecdb3c0284b695

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7zS6B8B.tmp\4ff420cc5d599@4ff420cc5d5d2.info\content\lsdb.js
    Filesize

    1KB

    MD5

    91ac4b09428003959d6c76e086fcd8ea

    SHA1

    7a8b6e59d190ea4b58eff4d6cfbd291de7cb34bc

    SHA256

    686b292388757c1d1b9c5b0503012a762d3f20352af66c49ad1b074ca9229f94

    SHA512

    85bdd47e2bfb25d669196b675e55896cdd7713f872bcf187cf5fb6575cc0ae38b4a925bd982d38c01610617675708c2743d2e0571f4c5fa7a116c4a272892a3b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7zS6B8B.tmp\4ff420cc5d599@4ff420cc5d5d2.info\content\prfdb.js
    Filesize

    1KB

    MD5

    3617b4465103970ff81a1229d6aae0ee

    SHA1

    bdf7d737c22c0afb1f452b0b62fd4e966395c85f

    SHA256

    cc3fe8dd900f23ba95421115995b1c42639bc1c4eb49c5233410a7cf40065e32

    SHA512

    7af5ffc03f901e0d75e1d04ceb29257fc5674482699253f5952c929743cdea3d8515355fb49925fb8bb0322256429e643896bc3bc6431cb3c403fc1a72464991

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7zS6B8B.tmp\4ff420cc5d599@4ff420cc5d5d2.info\content\sqlite.js
    Filesize

    1KB

    MD5

    f888ad982995d2993f2198cf965a2779

    SHA1

    7032fb551679d6d2e3c6bba5a3a5f5f5af2bc28c

    SHA256

    9237e8ffff281a12323db5b9662804278af0589544904d86e781f4678ed9c2db

    SHA512

    33b93d975c2f639f62ce4871a547d291b6a841a421a47fac90404e3a9860843b5e2cdab71e5320669eb3d467d191dcad330cdc383f328acd599354b3d3b35326

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7zS6B8B.tmp\4ff420cc5d599@4ff420cc5d5d2.info\content\wx.xul
    Filesize

    228B

    MD5

    7a8e613355800b0b8066c1a3aae98738

    SHA1

    86c2410ce83e7b7884765acc70e0d68fb5310d06

    SHA256

    719113409ba141256b72b6ae7353f5d1cb6afa0374ea54cbccb6040de7dd3df4

    SHA512

    544db0a229dad79bdc78937708c9924a67f904f3abdb94835de7b82933c93be5cc942283948ddb80a0c1ddc3f74d7f8c8c9437907a3aeb2cedf16d8bda605eb9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7zS6B8B.tmp\4ff420cc5d599@4ff420cc5d5d2.info\install.rdf
    Filesize

    677B

    MD5

    ede69675cff37c38de4fa89ba814f94e

    SHA1

    f19c3cf7c1e46637a02a76c862284ab5c492b0d5

    SHA256

    c0eae6e84b5735e67cb05ffd5f5fd104fce282f8408df6c5f98e1ddd21140b27

    SHA512

    f5be792c92434ebff8ab258a8fb10bd61f8d979f8ebb2912c1dcc364fd9dd0fe2d05632e4bedbf5a75873a3066c32e9ff3a9cb0fa02855c57f58a9015200b64e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7zS6B8B.tmp\background.html
    Filesize

    5KB

    MD5

    edefced42e595f7bc78c32d69418660e

    SHA1

    ef1e348cdfb7818023dc0d702c91fe3251d8267a

    SHA256

    b10f86eeb71af806283942b6ef98d8747913dfb59d5c0b153fb4f2b0d54c02b1

    SHA512

    cefe3f2aaa58f089331b61151ae0715836b99cddedefc23b6913c51f8acea62fb89504c9257192f090977f6e47901d3e1b0735c80547f7f2572e43ae9c835ada

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7zS6B8B.tmp\bhoclass.dll
    Filesize

    137KB

    MD5

    ac13c733379328f86568f6e514c2f7f8

    SHA1

    338901240fedcef4e3892fd4c723c89154f4de05

    SHA256

    7bf09b5c2a9b6348227199c1b3951b57907ca6a5c215a04ad8d5e43232f5b562

    SHA512

    35f69a82694a2ea4268a3dde7940af6bd1c87a32d93a72723464f90e4e818805be9e80872469d1cc29150a9aac872fc78613a584baa1327dfa8478c2de5672c4

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7zS6B8B.tmp\content.js
    Filesize

    386B

    MD5

    7dc9098267587238fc54ff2c3d3bf050

    SHA1

    4f27c02db689c3b84c54263c1c9f4b6238c075a9

    SHA256

    169098e8d397215ded425388e12673b9ca6f0524178bf154116f8843f8aa26fe

    SHA512

    e0d958210b5c30c5b03f9e967b405e04df895ccbbb888df9fcf422889f3b48982b22d1a6ab40ca561b45a87dca9a7567bbf4945958ae9b255bed822acf55a9d9

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7zS6B8B.tmp\dfkigbjomfcobanbbibhaiflbcpijcpb.crx
    Filesize

    24KB

    MD5

    6b6a1033e96f7170ebb28d0bd0673d02

    SHA1

    8838be72153e04f80e28eff6173acf10d905b7a2

    SHA256

    087a84edfdebbda7866e6642d6f6c2ef447df9eac2e0ba9e81bd8d3c2c495de3

    SHA512

    82c5fc8994e79ea4017283d85cda8d244c84ed05f459ac0a186a42ad84029d65cb973bdb3862662f67b4fd3484ff7d1b08403fcf9c28e181c1404b2df993da34

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7zS6B8B.tmp\settings.ini
    Filesize

    599B

    MD5

    f3b88f2077d812b2667169490df8cf3b

    SHA1

    f2d1b1e9daf66081be8c7088265d6d8401dc4788

    SHA256

    c8c80c0f8264f9663b873e74f5aa006665ae2c7354e39a961b32055c6d525884

    SHA512

    a496c3da7c126fe5cfa1e14a1a2e23b60491a2d841fd40673ea24534e4ea75dc2027aeb2b3cf95776dac3a3b7e535e88066734fd395c97b0cbd02aa3547d780d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\7zS6B8B.tmp\setup.exe
    Filesize

    61KB

    MD5

    201d2311011ffdf6c762fd46cdeb52ab

    SHA1

    65c474ca42a337745e288be0e21f43ceaafd5efe

    SHA256

    15c0e4fd6091cda70fa308ea5ee956996f6eb23d24e44700bd5c74bf111cf2aa

    SHA512

    235d70114f391d9e7a319d94bdfc49665d147723379de7487ef76cfc968f7faa3191153b32ba1ab466caeeeeef4852381529a168c3acca9a8d5a26dfe0436f6b

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.