Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
1mobiunlock...06.zip
windows7-x64
1mobiunlock...06.zip
windows10-2004-x64
1mobiunlock...06.exe
windows7-x64
7mobiunlock...06.exe
windows10-2004-x64
6$TEMP/down...ad.ini
windows7-x64
1$TEMP/down...ad.ini
windows10-2004-x64
1$TEMP/down...ch.ini
windows7-x64
1$TEMP/down...ch.ini
windows10-2004-x64
1$TEMP/down...er.exe
windows7-x64
1$TEMP/down...er.exe
windows10-2004-x64
1$TEMP/down...ch.ini
windows7-x64
1$TEMP/down...ch.ini
windows10-2004-x64
1$TEMP/down...an.ini
windows7-x64
1$TEMP/down...an.ini
windows10-2004-x64
1$TEMP/down...re.ini
windows7-x64
1$TEMP/down...re.ini
windows10-2004-x64
1$TEMP/down...an.ini
windows7-x64
1$TEMP/down...an.ini
windows10-2004-x64
1$TEMP/down...se.ini
windows7-x64
1$TEMP/down...se.ini
windows10-2004-x64
1$TEMP/down...an.ini
windows7-x64
1$TEMP/down...an.ini
windows10-2004-x64
1$TEMP/down...or.ini
windows7-x64
1$TEMP/down...or.ini
windows10-2004-x64
1$TEMP/down...se.ini
windows7-x64
1$TEMP/down...se.ini
windows10-2004-x64
1$TEMP/down...sh.ini
windows7-x64
1$TEMP/down...sh.ini
windows10-2004-x64
1$TEMP/down...ig.ini
windows7-x64
1$TEMP/down...ig.ini
windows10-2004-x64
1$TEMP/down...g2.ini
windows7-x64
1$TEMP/down...g2.ini
windows10-2004-x64
1Analysis
-
max time kernel
171s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19/03/2024, 19:36 UTC
Static task
static1
Behavioral task
behavioral1
Sample
mobiunlock_installerB_20230717.716906.zip
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
mobiunlock_installerB_20230717.716906.zip
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
mobiunlock_installerB_20230717.716906.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
mobiunlock_installerB_20230717.716906.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$TEMP/downloader_easeus/1.0.0/9trialB/ChineseTrad.ini
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
$TEMP/downloader_easeus/1.0.0/9trialB/ChineseTrad.ini
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
$TEMP/downloader_easeus/1.0.0/9trialB/Dutch.ini
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$TEMP/downloader_easeus/1.0.0/9trialB/Dutch.ini
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
$TEMP/downloader_easeus/1.0.0/9trialB/EDownloader.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$TEMP/downloader_easeus/1.0.0/9trialB/EDownloader.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
$TEMP/downloader_easeus/1.0.0/9trialB/French.ini
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
$TEMP/downloader_easeus/1.0.0/9trialB/French.ini
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
$TEMP/downloader_easeus/1.0.0/9trialB/German.ini
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
$TEMP/downloader_easeus/1.0.0/9trialB/German.ini
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
$TEMP/downloader_easeus/1.0.0/9trialB/InitConfigure.ini
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$TEMP/downloader_easeus/1.0.0/9trialB/InitConfigure.ini
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
$TEMP/downloader_easeus/1.0.0/9trialB/Italian.ini
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
$TEMP/downloader_easeus/1.0.0/9trialB/Italian.ini
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
$TEMP/downloader_easeus/1.0.0/9trialB/Japanese.ini
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
$TEMP/downloader_easeus/1.0.0/9trialB/Japanese.ini
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
$TEMP/downloader_easeus/1.0.0/9trialB/Korean.ini
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
$TEMP/downloader_easeus/1.0.0/9trialB/Korean.ini
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
$TEMP/downloader_easeus/1.0.0/9trialB/LanguageTransfor.ini
Resource
win7-20240220-en
Behavioral task
behavioral24
Sample
$TEMP/downloader_easeus/1.0.0/9trialB/LanguageTransfor.ini
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
$TEMP/downloader_easeus/1.0.0/9trialB/Portuguese.ini
Resource
win7-20240215-en
Behavioral task
behavioral26
Sample
$TEMP/downloader_easeus/1.0.0/9trialB/Portuguese.ini
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
$TEMP/downloader_easeus/1.0.0/9trialB/Spanish.ini
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
$TEMP/downloader_easeus/1.0.0/9trialB/Spanish.ini
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
$TEMP/downloader_easeus/1.0.0/9trialB/aliyun/AliyunConfig.ini
Resource
win7-20240221-en
Behavioral task
behavioral30
Sample
$TEMP/downloader_easeus/1.0.0/9trialB/aliyun/AliyunConfig.ini
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
$TEMP/downloader_easeus/1.0.0/9trialB/aliyun/AliyunConfig2.ini
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
$TEMP/downloader_easeus/1.0.0/9trialB/aliyun/AliyunConfig2.ini
Resource
win10v2004-20240226-en
General
-
Target
$TEMP/downloader_easeus/1.0.0/9trialB/Portuguese.ini
-
Size
2KB
-
MD5
c3ea736bd199658dc57a27cc7330a613
-
SHA1
ff3851228b143cc91053ac718cb92efc1cf5e531
-
SHA256
a70a6ea122c8995ccb985d8f736375433a51fa9f69d86598359b8bdd38e776b9
-
SHA512
36a171d7c5bda8068a835e7eeee47c83e1c8427386d793b2095a3fcd138cfca9816661c3c010c62bb37cdf4cec270fb2f8c3ed1f6c3f55859e8bb13f0186844e
Malware Config
Signatures
Processes
-
C:\Windows\system32\NOTEPAD.EXEC:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\$TEMP\downloader_easeus\1.0.0\9trialB\Portuguese.ini1⤵PID:5016
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2280,i,8281149332300504990,9122875031903898779,262144 --variations-seed-version /prefetch:81⤵PID:3108
Network
-
Remote address:8.8.8.8:53Request29.243.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request23.177.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request180.178.17.96.in-addr.arpaIN PTRResponse180.178.17.96.in-addr.arpaIN PTRa96-17-178-180deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request57.169.31.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request9.228.82.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request9.228.82.20.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request103.169.127.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request15.164.165.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request41.110.16.96.in-addr.arpaIN PTRResponse41.110.16.96.in-addr.arpaIN PTRa96-16-110-41deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request149.220.183.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request149.220.183.52.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request140.71.91.104.in-addr.arpaIN PTRResponse140.71.91.104.in-addr.arpaIN PTRa104-91-71-140deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request183.1.37.23.in-addr.arpaIN PTRResponse183.1.37.23.in-addr.arpaIN PTRa23-37-1-183deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request119.110.54.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request10.179.17.96.in-addr.arpaIN PTRResponse10.179.17.96.in-addr.arpaIN PTRa96-17-179-10deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request134.71.91.104.in-addr.arpaIN PTRResponse134.71.91.104.in-addr.arpaIN PTRa104-91-71-134deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request161.178.17.96.in-addr.arpaIN PTRResponse161.178.17.96.in-addr.arpaIN PTRa96-17-178-161deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request30.179.17.96.in-addr.arpaIN PTRResponse30.179.17.96.in-addr.arpaIN PTRa96-17-179-30deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request31.179.17.96.in-addr.arpaIN PTRResponse31.179.17.96.in-addr.arpaIN PTRa96-17-179-31deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request31.179.17.96.in-addr.arpaIN PTRResponse31.179.17.96.in-addr.arpaIN PTRa96-17-179-31deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request43.58.199.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
Remote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239339388219_1FDWCXC4JZ4Y4X0E5&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239339388219_1FDWCXC4JZ4Y4X0E5&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 392841
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: ECFB659F1ECE42C3BFA2F2EF7349FF5F Ref B: LON04EDGE1208 Ref C: 2024-03-19T19:39:43Z
date: Tue, 19 Mar 2024 19:39:42 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239340418596_1ZW2YDLAK01V77NJD&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239340418596_1ZW2YDLAK01V77NJD&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 505075
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 7E7B9A1E8D744D0EB17263DA1BE5EE42 Ref B: LON04EDGE1208 Ref C: 2024-03-19T19:39:43Z
date: Tue, 19 Mar 2024 19:39:42 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317300932_1F3XVYLI2C551DUEM&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317300932_1F3XVYLI2C551DUEM&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 423228
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 24857A6DEF7E4105B0B3CCB7166699EB Ref B: LON04EDGE1208 Ref C: 2024-03-19T19:39:43Z
date: Tue, 19 Mar 2024 19:39:42 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239339388218_1O3WHZ2CB2LK678IN&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239339388218_1O3WHZ2CB2LK678IN&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239340418595_19TRV8HP5YIGTZD3I&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239340418595_19TRV8HP5YIGTZD3I&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
-
Remote address:8.8.8.8:53Request200.197.79.204.in-addr.arpaIN PTRResponse200.197.79.204.in-addr.arpaIN PTRa-0001a-msedgenet
-
Remote address:8.8.8.8:53Request200.197.79.204.in-addr.arpaIN PTRResponse200.197.79.204.in-addr.arpaIN PTRa-0001a-msedgenet
-
Remote address:8.8.8.8:53Request28.179.17.96.in-addr.arpaIN PTRResponse28.179.17.96.in-addr.arpaIN PTRa96-17-179-28deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request28.179.17.96.in-addr.arpaIN PTR
-
46 B 40 B 1 1
-
204.79.197.200:443https://tse1.mm.bing.net/th?id=OADD2.10239340418595_19TRV8HP5YIGTZD3I&pid=21.2&w=1920&h=1080&c=4tls, http212.6kB 285.4kB 219 212
HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239339388219_1FDWCXC4JZ4Y4X0E5&pid=21.2&w=1080&h=1920&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239340418596_1ZW2YDLAK01V77NJD&pid=21.2&w=1080&h=1920&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317300932_1F3XVYLI2C551DUEM&pid=21.2&w=1920&h=1080&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239339388218_1O3WHZ2CB2LK678IN&pid=21.2&w=1920&h=1080&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239340418595_19TRV8HP5YIGTZD3I&pid=21.2&w=1920&h=1080&c=4HTTP Response
200HTTP Response
200HTTP Response
200 -
1.5kB 8.1kB 17 13
-
1.3kB 8.5kB 17 14
-
72 B 158 B 1 1
DNS Request
29.243.111.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
23.177.190.20.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
180.178.17.96.in-addr.arpa
-
146 B 159 B 2 1
DNS Request
228.249.119.40.in-addr.arpa
DNS Request
228.249.119.40.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
57.169.31.20.in-addr.arpa
-
140 B 156 B 2 1
DNS Request
9.228.82.20.in-addr.arpa
DNS Request
9.228.82.20.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
103.169.127.40.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
15.164.165.52.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
41.110.16.96.in-addr.arpa
-
146 B 147 B 2 1
DNS Request
149.220.183.52.in-addr.arpa
DNS Request
149.220.183.52.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
140.71.91.104.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
58.55.71.13.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
183.1.37.23.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
119.110.54.20.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
10.179.17.96.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
134.71.91.104.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
161.178.17.96.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
30.179.17.96.in-addr.arpa
-
142 B 270 B 2 2
DNS Request
31.179.17.96.in-addr.arpa
DNS Request
31.179.17.96.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
43.58.199.20.in-addr.arpa
-
124 B 346 B 2 2
DNS Request
tse1.mm.bing.net
DNS Request
tse1.mm.bing.net
DNS Response
204.79.197.20013.107.21.200
DNS Response
204.79.197.20013.107.21.200
-
146 B 212 B 2 2
DNS Request
200.197.79.204.in-addr.arpa
DNS Request
200.197.79.204.in-addr.arpa
-
142 B 135 B 2 1
DNS Request
28.179.17.96.in-addr.arpa
DNS Request
28.179.17.96.in-addr.arpa