Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 00:28 UTC
Static task
static1
Behavioral task
behavioral1
Sample
21b59b8335956c5e26f0764419165900.js
Resource
win7-20231129-en
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
21b59b8335956c5e26f0764419165900.js
Resource
win10v2004-20231222-en
0 signatures
150 seconds
General
-
Target
21b59b8335956c5e26f0764419165900.js
-
Size
11KB
-
MD5
21b59b8335956c5e26f0764419165900
-
SHA1
9041a2d1309ab95d49887906ae3ed5b048abbda4
-
SHA256
234daf175bd33bf435fe1ee0e079f9c188375b08e8d0e5c783a2b23578b0ebed
-
SHA512
7c594481acdf4e57e74057d246901c3f2da6cb7ee5586ac671eaf1192c14be9f567d9bd6607c65cc095455d43d24dfd17c071f89e70046e6de43cb8065f155e9
-
SSDEEP
192:NnF39+PHBF5XlXQXQXtqvXwXcXsIBh6Mazs4TLPAuz68X8MXo+07o:dahr1AgdGgs8jMaztTLPAuz68MMv07o
Score
1/10
Malware Config
Signatures
Processes
Network
-
Remote address:8.8.8.8:53Request85.177.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request85.177.190.20.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request85.177.190.20.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request2.136.104.51.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request2.136.104.51.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request2.136.104.51.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.a-0001.a-msedge.netg-bing-com.a-0001.a-msedge.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=c107c654d6fd48519318ec56c38fee03&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=c107c654d6fd48519318ec56c38fee03&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=0D5AC8443E256D4430B5DBB83FC56CE0; domain=.bing.com; expires=Tue, 28-Jan-2025 23:44:08 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 5B2C661D124648ECBD28B7DC1266F228 Ref B: LON04EDGE1214 Ref C: 2024-01-04T23:44:08Z
date: Thu, 04 Jan 2024 23:44:07 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=c107c654d6fd48519318ec56c38fee03&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=c107c654d6fd48519318ec56c38fee03&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=0D5AC8443E256D4430B5DBB83FC56CE0
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=pIr9d5WoazHVCMC6TfxMatC9L_kd0rZ7CIkjNoa09Ug; domain=.bing.com; expires=Tue, 28-Jan-2025 23:44:08 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: D97AF9AF40A5462C8DA0FAF11FA42FFA Ref B: LON04EDGE1214 Ref C: 2024-01-04T23:44:08Z
date: Thu, 04 Jan 2024 23:44:07 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=c107c654d6fd48519318ec56c38fee03&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid=Remote address:204.79.197.200:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=c107c654d6fd48519318ec56c38fee03&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=0D5AC8443E256D4430B5DBB83FC56CE0; MSPTC=pIr9d5WoazHVCMC6TfxMatC9L_kd0rZ7CIkjNoa09Ug
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 24D5EA0F98B64C66B9FE2E9997383468 Ref B: LON04EDGE1214 Ref C: 2024-01-04T23:44:08Z
date: Thu, 04 Jan 2024 23:44:07 GMT
-
Remote address:8.8.8.8:53Request200.197.79.204.in-addr.arpaIN PTRResponse200.197.79.204.in-addr.arpaIN PTRa-0001a-msedgenet
-
Remote address:8.8.8.8:53Request180.178.17.96.in-addr.arpaIN PTRResponse180.178.17.96.in-addr.arpaIN PTRa96-17-178-180deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request55.36.223.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request9.228.82.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request26.165.165.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request158.240.127.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request41.110.16.96.in-addr.arpaIN PTRResponse41.110.16.96.in-addr.arpaIN PTRa96-16-110-41deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request18.31.95.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request134.71.91.104.in-addr.arpaIN PTRResponse134.71.91.104.in-addr.arpaIN PTRa104-91-71-134deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request134.71.91.104.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request241.154.82.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request241.154.82.20.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request100.5.17.2.in-addr.arpaIN PTRResponse100.5.17.2.in-addr.arpaIN PTRa2-17-5-100deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request100.5.17.2.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request100.5.17.2.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request119.110.54.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request196.178.17.96.in-addr.arpaIN PTRResponse196.178.17.96.in-addr.arpaIN PTRa96-17-178-196deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request88.156.103.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request211.135.221.88.in-addr.arpaIN PTRResponse211.135.221.88.in-addr.arpaIN PTRa88-221-135-211deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request19.229.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request19.229.111.52.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request19.229.111.52.in-addr.arpaIN PTR
-
Remote address:87.248.205.0:80ResponseHTTP/1.1 200 OK
Content-Type: application/octet-stream
Accept-Ranges: bytes
X-AspNetMvc-Version: 5.2
MS-CorrelationId: 9fb0dd03-f43a-4f19-8c11-e0f3347e54da
MS-RequestId: 1db8027f-adab-4265-88dc-3230e7bf3589
MS-CV: E81Us8Yu5EWKWMNW.0
Content-Disposition: attachment; filename=Microsoft.WindowsAppRuntime.1.2_2000.802.31.0_x64__8wekyb3d8bbwe.BlockMap
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
X-Powered-By: ARR/3.0
X-Powered-By: ASP.NET
X-Azure-Ref-OriginShield: Ref A: 61B43F56133B4E058034D21448232B46 Ref B: AMS231021014033 Ref C: 2023-04-10T22:33:07Z
X-MSEdge-Ref: Ref A: 4AA76B8243B5489A95679245D782BD22 Ref B: LTSEDGE0906 Ref C: 2023-04-10T22:33:07Z
X-LLID: 5af4493b6f1f2295672adc7281cf8543
Age: 318493
Date: Thu, 04 Jan 2024 23:45:42 GMT
Last-Modified: Wed, 15 Mar 2023 18:19:22 GMT
Expires: Fri, 19 Jul 2024 07:17:29 GMT
Content-Length: 26983
Connection: keep-alive
X-CID: 4
X-CCC: gb
-
Remote address:8.8.8.8:53Request0.205.248.87.in-addr.arpaIN PTRResponse0.205.248.87.in-addr.arpaIN PTRhttps-87-248-205-0lgwllnwnet
-
Remote address:8.8.8.8:53Request0.205.248.87.in-addr.arpaIN PTRResponse0.205.248.87.in-addr.arpaIN PTRhttps-87-248-205-0lgwllnwnet
-
Remote address:8.8.8.8:53Requesttse1.mm.bing.netIN A
-
204.79.197.200:443https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=c107c654d6fd48519318ec56c38fee03&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid=tls, http22.7kB 9.4kB 24 19
HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=c107c654d6fd48519318ec56c38fee03&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=c107c654d6fd48519318ec56c38fee03&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=c107c654d6fd48519318ec56c38fee03&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid=HTTP Response
204 -
-
-
-
-
-
-
-
-
46 B 40 B 1 1
-
598 B 28.9kB 13 23
HTTP Response
200 -
-
-
501 B 661 B 5 5
-
11.5kB 340.8kB 245 245
-
-
-
-
-
-
-
-
-
46 B 40 B 1 1
-
-
-
-
-
-
-
-
-
-
-
-
216 B 158 B 3 1
DNS Request
85.177.190.20.in-addr.arpa
DNS Request
85.177.190.20.in-addr.arpa
DNS Request
85.177.190.20.in-addr.arpa
-
213 B 157 B 3 1
DNS Request
2.136.104.51.in-addr.arpa
DNS Request
2.136.104.51.in-addr.arpa
DNS Request
2.136.104.51.in-addr.arpa
-
56 B 158 B 1 1
DNS Request
g.bing.com
DNS Response
204.79.197.20013.107.21.200
-
73 B 106 B 1 1
DNS Request
200.197.79.204.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
180.178.17.96.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
55.36.223.20.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
9.228.82.20.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
26.165.165.52.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
158.240.127.40.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
41.110.16.96.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
18.31.95.13.in-addr.arpa
-
144 B 158 B 2 1
DNS Request
241.154.82.20.in-addr.arpa
DNS Request
241.154.82.20.in-addr.arpa
-
144 B 137 B 2 1
DNS Request
134.71.91.104.in-addr.arpa
DNS Request
134.71.91.104.in-addr.arpa
-
207 B 131 B 3 1
DNS Request
100.5.17.2.in-addr.arpa
DNS Request
100.5.17.2.in-addr.arpa
DNS Request
100.5.17.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
119.110.54.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
88.156.103.20.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
196.178.17.96.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
211.135.221.88.in-addr.arpa
-
-
216 B 158 B 3 1
DNS Request
19.229.111.52.in-addr.arpa
DNS Request
19.229.111.52.in-addr.arpa
DNS Request
19.229.111.52.in-addr.arpa
-
-
142 B 232 B 2 2
DNS Request
0.205.248.87.in-addr.arpa
DNS Request
0.205.248.87.in-addr.arpa
-
-
-
-
62 B 1
DNS Request
tse1.mm.bing.net
-
-
-
-
-