Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

GamePingBooster.zip

windows10-2004-x64

1

GamePingBo...se.dll

windows10-2004-x64

1

GamePingBo...uf.dll

windows10-2004-x64

1

GamePingBo...op.dll

windows10-2004-x64

1

GamePingBo...up.exe

windows10-2004-x64

10

GamePingBo...en.dll

windows10-2004-x64

1

GamePingBo...te.dll

windows10-2004-x64

1

GamePingBo...ry.dll

windows10-2004-x64

1

GamePingBo...fe.dll

windows10-2004-x64

1

GamePingBo...on.dll

windows10-2004-x64

1

GamePingBo...ty.dll

windows10-2004-x64

1

GamePingBo...lt.zip

windows10-2004-x64

1

settings.json

windows10-2004-x64

3

GamePingBo...rs.zip

windows10-2004-x64

1

win10/arm6...rv.sys

windows10-2004-x64

1

win10/x64/...rv.sys

windows10-2004-x64

1

win10/x64/...rv.sys

windows10-2004-x64

1

win10/x86/...rv.sys

windows10-2004-x64

1

win10/x86/...rv.sys

windows10-2004-x64

1

x64/AdguardNetLib.dll

windows10-2004-x64

1

x64/AdguardNetReg.exe

windows10-2004-x64

1

x64/adgvpn...rv.sys

windows10-2004-x64

1

x64/adgvpn...rv.sys

windows10-2004-x64

1

x86/AdguardNetLib.dll

windows10-2004-x64

1

x86/AdguardNetReg.exe

windows10-2004-x64

1

x86/adgvpn...rv.sys

windows10-2004-x64

1

x86/adgvpn...rv.sys

windows10-2004-x64

1

GamePingBo...un.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    125s
  • max time network
    177s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/04/2024, 19:55 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    x86/adgvpnnetworktdidrv.sys

  • Size

    62KB

  • MD5

    88f2e941419818af7a7dcf333e396615

  • SHA1

    7d53a0ea22b060e5c83fe2504964d9b3a7a1cf63

  • SHA256

    548611a82d21227a782967be05e91727112c7aad955a1b15f412795b9735eb92

  • SHA512

    1ef593f310ead31c45797c02bfd0a9f9e8e9dcd4f86aaec0aadf57e71426bfa6309f2fa3fee703044fe759c6b88e6bbf6ed220e7d4959e75be36fc1311ab882c

  • SSDEEP

    1536:RupPPXnT+O0qjS9xRFHXVpaZJXRsd9zvg:kpPfCAjS9xRVqZJXRW9c

Score
1/10

Malware Config

Signatures

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\x86\adgvpnnetworktdidrv.sys
    1⤵
      PID:4016
      • C:\Users\Admin\AppData\Local\Temp\x86\adgvpnnetworktdidrv.sys
        C:\Users\Admin\AppData\Local\Temp\x86\adgvpnnetworktdidrv.sys
        2⤵
          PID:3064

      Network

      • flag-us
        DNS
        tse1.mm.bing.net
        Remote address:
        8.8.8.8:53
        Request
        tse1.mm.bing.net
        IN A
        Response
        tse1.mm.bing.net
        IN CNAME
        mm-mm.bing.net.trafficmanager.net
        mm-mm.bing.net.trafficmanager.net
        IN CNAME
        dual-a-0001.a-msedge.net
        dual-a-0001.a-msedge.net
        IN A
        204.79.197.200
        dual-a-0001.a-msedge.net
        IN A
        13.107.21.200
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239362113785_1BQQBFJAZTSP82CQ9&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239362113785_1BQQBFJAZTSP82CQ9&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 700590
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 5066BEC6DD294BF89630262F8758D20F Ref B: LON04EDGE0611 Ref C: 2024-04-18T19:56:50Z
        date: Thu, 18 Apr 2024 19:56:49 GMT
      • flag-us
        DNS
        8.8.8.8.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        8.8.8.8.in-addr.arpa
        IN PTR
        Response
        8.8.8.8.in-addr.arpa
        IN PTR
        dnsgoogle
      • flag-us
        DNS
        64.159.190.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        64.159.190.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        249.197.17.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        249.197.17.2.in-addr.arpa
        IN PTR
        Response
        249.197.17.2.in-addr.arpa
        IN PTR
        a2-17-197-249deploystaticakamaitechnologiescom
      • flag-us
        DNS
        200.197.79.204.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        200.197.79.204.in-addr.arpa
        IN PTR
        Response
        200.197.79.204.in-addr.arpa
        IN PTR
        a-0001a-msedgenet
      • flag-us
        DNS
        9.228.82.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        9.228.82.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        103.169.127.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        103.169.127.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        18.31.95.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        18.31.95.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        config.edge.skype.com
        Remote address:
        8.8.8.8:53
        Request
        config.edge.skype.com
        IN A
        Response
        config.edge.skype.com
        IN CNAME
        config.edge.skype.com.trafficmanager.net
        config.edge.skype.com.trafficmanager.net
        IN CNAME
        l-0007.config.skype.com
        l-0007.config.skype.com
        IN CNAME
        config-edge-skype.l-0007.l-msedge.net
        config-edge-skype.l-0007.l-msedge.net
        IN CNAME
        l-0007.l-msedge.net
        l-0007.l-msedge.net
        IN A
        13.107.42.16
      • flag-us
        DNS
        g.bing.com
        Remote address:
        8.8.8.8:53
        Request
        g.bing.com
        IN A
        Response
        g.bing.com
        IN CNAME
        g-bing-com.dual-a-0034.a-msedge.net
        g-bing-com.dual-a-0034.a-msedge.net
        IN CNAME
        dual-a-0034.a-msedge.net
        dual-a-0034.a-msedge.net
        IN A
        204.79.197.237
        dual-a-0034.a-msedge.net
        IN A
        13.107.21.237
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=e945e18079034ea4b3fdae906d609363&localId=w:85A6E0B8-9F32-4971-7E29-E0DEDD0017CA&deviceId=6755467521974275&anid=
        Remote address:
        204.79.197.237:443
        Request
        GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=e945e18079034ea4b3fdae906d609363&localId=w:85A6E0B8-9F32-4971-7E29-E0DEDD0017CA&deviceId=6755467521974275&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        set-cookie: MUID=07A94082B1496F63315F54E7B06E6E6F; domain=.bing.com; expires=Tue, 13-May-2025 19:57:11 GMT; path=/; SameSite=None; Secure; Priority=High;
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 147006126DB2406988741534F3E3D705 Ref B: LON04EDGE0718 Ref C: 2024-04-18T19:57:11Z
        date: Thu, 18 Apr 2024 19:57:10 GMT
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=e945e18079034ea4b3fdae906d609363&localId=w:85A6E0B8-9F32-4971-7E29-E0DEDD0017CA&deviceId=6755467521974275&anid=
        Remote address:
        204.79.197.237:443
        Request
        GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=e945e18079034ea4b3fdae906d609363&localId=w:85A6E0B8-9F32-4971-7E29-E0DEDD0017CA&deviceId=6755467521974275&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=07A94082B1496F63315F54E7B06E6E6F
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        set-cookie: MSPTC=XIDdjZrKB4Q-5ItmOmGq9CDQa68c5w8_mJLUKmLYydw; domain=.bing.com; expires=Tue, 13-May-2025 19:57:12 GMT; path=/; Partitioned; secure; SameSite=None
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 1463CDCFDEBF4F2E818EBDC6E9F39C88 Ref B: LON04EDGE0718 Ref C: 2024-04-18T19:57:12Z
        date: Thu, 18 Apr 2024 19:57:12 GMT
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=e945e18079034ea4b3fdae906d609363&localId=w:85A6E0B8-9F32-4971-7E29-E0DEDD0017CA&deviceId=6755467521974275&anid=
        Remote address:
        204.79.197.237:443
        Request
        GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=e945e18079034ea4b3fdae906d609363&localId=w:85A6E0B8-9F32-4971-7E29-E0DEDD0017CA&deviceId=6755467521974275&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=07A94082B1496F63315F54E7B06E6E6F; MSPTC=XIDdjZrKB4Q-5ItmOmGq9CDQa68c5w8_mJLUKmLYydw
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 07849A3449914CFD9AB6D9428FB2BD04 Ref B: LON04EDGE0718 Ref C: 2024-04-18T19:57:12Z
        date: Thu, 18 Apr 2024 19:57:12 GMT
      • flag-us
        DNS
        134.71.91.104.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        134.71.91.104.in-addr.arpa
        IN PTR
        Response
        134.71.91.104.in-addr.arpa
        IN PTR
        a104-91-71-134deploystaticakamaitechnologiescom
      • flag-us
        DNS
        21.114.53.23.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        21.114.53.23.in-addr.arpa
        IN PTR
        Response
        21.114.53.23.in-addr.arpa
        IN PTR
        a23-53-114-21deploystaticakamaitechnologiescom
      • flag-us
        DNS
        237.197.79.204.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        237.197.79.204.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        241.154.82.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        241.154.82.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        168.117.168.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        168.117.168.52.in-addr.arpa
        IN PTR
        Response
      • 204.79.197.200:443
        https://tse1.mm.bing.net/th?id=OADD2.10239362113785_1BQQBFJAZTSP82CQ9&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        tls, http2
        25.5kB
         732.6kB
         538
        536

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239362113785_1BQQBFJAZTSP82CQ9&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

        HTTP Response

        200
      • 204.79.197.237:443
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=e945e18079034ea4b3fdae906d609363&localId=w:85A6E0B8-9F32-4971-7E29-E0DEDD0017CA&deviceId=6755467521974275&anid=
        tls, http2
        2.0kB
         9.2kB
         22
        19

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=e945e18079034ea4b3fdae906d609363&localId=w:85A6E0B8-9F32-4971-7E29-E0DEDD0017CA&deviceId=6755467521974275&anid=

        HTTP Response

        204

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=e945e18079034ea4b3fdae906d609363&localId=w:85A6E0B8-9F32-4971-7E29-E0DEDD0017CA&deviceId=6755467521974275&anid=

        HTTP Response

        204

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=e945e18079034ea4b3fdae906d609363&localId=w:85A6E0B8-9F32-4971-7E29-E0DEDD0017CA&deviceId=6755467521974275&anid=

        HTTP Response

        204
      • 8.8.8.8:53
        tse1.mm.bing.net
        dns
        62 B
         173 B
         1
        1

        DNS Request

        tse1.mm.bing.net

        DNS Response

        204.79.197.200
        13.107.21.200

      • 8.8.8.8:53
        8.8.8.8.in-addr.arpa
        dns
        66 B
         90 B
         1
        1

        DNS Request

        8.8.8.8.in-addr.arpa

      • 8.8.8.8:53
        64.159.190.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        64.159.190.20.in-addr.arpa

      • 8.8.8.8:53
        249.197.17.2.in-addr.arpa
        dns
        71 B
         135 B
         1
        1

        DNS Request

        249.197.17.2.in-addr.arpa

      • 8.8.8.8:53
        200.197.79.204.in-addr.arpa
        dns
        73 B
         106 B
         1
        1

        DNS Request

        200.197.79.204.in-addr.arpa

      • 8.8.8.8:53
        9.228.82.20.in-addr.arpa
        dns
        70 B
         156 B
         1
        1

        DNS Request

        9.228.82.20.in-addr.arpa

      • 8.8.8.8:53
        103.169.127.40.in-addr.arpa
        dns
        73 B
         147 B
         1
        1

        DNS Request

        103.169.127.40.in-addr.arpa

      • 8.8.8.8:53
        18.31.95.13.in-addr.arpa
        dns
        137 B
         371 B
         2
        2

        DNS Request

        18.31.95.13.in-addr.arpa

        DNS Request

        config.edge.skype.com

        DNS Response

        13.107.42.16

      • 8.8.8.8:53
        g.bing.com
        dns
        56 B
         151 B
         1
        1

        DNS Request

        g.bing.com

        DNS Response

        204.79.197.237
        13.107.21.237

      • 8.8.8.8:53
        134.71.91.104.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        134.71.91.104.in-addr.arpa

      • 8.8.8.8:53
        21.114.53.23.in-addr.arpa
        dns
        71 B
         135 B
         1
        1

        DNS Request

        21.114.53.23.in-addr.arpa

      • 8.8.8.8:53
        237.197.79.204.in-addr.arpa
        dns
        73 B
         143 B
         1
        1

        DNS Request

        237.197.79.204.in-addr.arpa

      • 8.8.8.8:53
        241.154.82.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        241.154.82.20.in-addr.arpa

      • 8.8.8.8:53
        168.117.168.52.in-addr.arpa
        dns
        73 B
         147 B
         1
        1

        DNS Request

        168.117.168.52.in-addr.arpa

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/3064-0-0x0000000000010000-0x000000000001D280-memory.dmp

        Filesize

        52KB

        Download

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.