9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51

Analysis

max time kernel
150s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05/05/2024, 02:02 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
Size

61KB
MD5

6e6dc34e7f5c5b888538e0c2a0975733
SHA1

2e617c436517a26b4dc2c3b8643dc3918d355b76
SHA256

9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51
SHA512

02f4144e3278c8287de980c243fba0fff04b003c3b9c662b53830f470829a9a99737cd78710ad909c5b544aeb87c9f7c851ea52242e62d12f6d6cd05e84890e4
SSDEEP

768:67Blpf/FAK65euBT37CPKK0SjHm0CAbLg++PJHJzIWD+dVdCYgck5sIZFlzc3/Sw:67Zf/FAxTWY1++PJHJXA/OsIZfzc3/QE

Score

9^/10

ransomware upx

Malware Config

Signatures

Renames multiple (5202) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/4312-0-0x0000000000400000-0x000000000040B000-memory.dmp	UPX
behavioral2/files/0x000d000000023b2e-2.dat	UPX
behavioral2/files/0x0009000000022970-6.dat	UPX
behavioral2/memory/4312-1824-0x0000000000400000-0x000000000040B000-memory.dmp	UPX

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4312-0-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x000d000000023b2e-2.dat	upx
behavioral2/files/0x0009000000022970-6.dat	upx
behavioral2/memory/4312-1824-0x0000000000400000-0x000000000040B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Configuration.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-file-l2-1-0.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Integration\SPPRedist.msi.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Trial-ppd.xrm-ms.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-core-file-l1-2-0.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-runtime-l1-1-0.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-pl.xrm-ms.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-100.png.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp6-ul-phn.xrm-ms.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL026.XML.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-private-l1-1-0.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jre-1.8\bin\jp2native.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\messages_zh_CN.properties.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jre-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\fre\StartMenu_Win7.wmv.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-phn.xrm-ms.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\v8_context_snapshot.bin.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-libraryloader-l1-1-0.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.wordmui.msi.16.en-us.xml.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul-oob.xrm-ms.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.XDocument.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jre-1.8\legal\jdk\joni.md.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-string-l1-1-0.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Data.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jdk-1.8\include\jvmti.h.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WordInterProviderRanker.bin.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-100.png.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2Fluent.White.png.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\tr\System.Windows.Forms.Design.resources.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\pkcs11cryptotoken.md.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jre-1.8\lib\deploy\splash_11@2x-lic.gif.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription1-ppd.xrm-ms.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-180.png.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest2-ul-oob.xrm-ms.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_OEM_Perp-ul-phn.xrm-ms.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Contracts.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\ReachFramework.resources.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Google\Chrome\Application\123.0.6312.106\chrome.exe.sig.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jdk-1.8\legal\jdk\xerces.md.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jre-1.8\bin\dt_socket.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN027.XML.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.ONENOTE.16.1033.hxn.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\zh-CN\msipc.dll.mui.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OneNote\SendToOneNoteNames.gpd.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\tipresx.dll.mui.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Console.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\System.Windows.Forms.resources.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ru\PresentationUI.resources.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\fonts\LucidaBrightRegular.ttf.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\rsod\proofing.msi.16.en-us.boot.tree.dat.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_kor.xml.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Linq.Queryable.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\api-ms-win-crt-runtime-l1-1-0.dll.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp2-pl.xrm-ms.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_Trial-pl.xrm-ms.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE.tmp	9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe

C:\Users\Admin\AppData\Local\Temp\9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe
"C:\Users\Admin\AppData\Local\Temp\9364194f2f5a01d3a465abbaa851c06966919f3da8e28184caadd949acf22f51.exe"
1⤵
- Drops file in Program Files directory
PID:4312

Network

DNS

241.150.49.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

241.150.49.20.in-addr.arpa

IN PTR

Response
DNS

172.210.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.210.232.199.in-addr.arpa

IN PTR

Response
DNS

17.160.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

17.160.190.20.in-addr.arpa

IN PTR

Response
GET

https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90

Remote address:

23.62.61.97:443

Request

GET /th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
host: www.bing.com
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-type: image/png
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QWthbWFp
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
content-length: 1107
date: Sun, 05 May 2024 02:02:29 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.5d3d3e17.1714874549.a9f2bb5
DNS

88.156.103.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

88.156.103.20.in-addr.arpa

IN PTR

Response
DNS

88.156.103.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

88.156.103.20.in-addr.arpa

IN PTR
DNS

97.61.62.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

97.61.62.23.in-addr.arpa

IN PTR

Response

97.61.62.23.in-addr.arpa

IN PTR

a23-62-61-97deploystaticakamaitechnologiescom
DNS

97.61.62.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

97.61.62.23.in-addr.arpa

IN PTR
DNS

104.219.191.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

104.219.191.52.in-addr.arpa

IN PTR

Response
DNS

103.169.127.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

103.169.127.40.in-addr.arpa

IN PTR

Response
DNS

198.187.3.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

198.187.3.20.in-addr.arpa

IN PTR

Response
DNS

142.53.16.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

142.53.16.96.in-addr.arpa

IN PTR

Response

142.53.16.96.in-addr.arpa

IN PTR

a96-16-53-142deploystaticakamaitechnologiescom
DNS

240.221.184.93.in-addr.arpa

Remote address:

8.8.8.8:53

Request

240.221.184.93.in-addr.arpa

IN PTR

Response
DNS

55.36.223.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

55.36.223.20.in-addr.arpa

IN PTR

Response
DNS

48.251.17.2.in-addr.arpa

Remote address:

8.8.8.8:53

Request

48.251.17.2.in-addr.arpa

IN PTR

Response

48.251.17.2.in-addr.arpa

IN PTR

a2-17-251-48deploystaticakamaitechnologiescom
DNS

48.229.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

48.229.111.52.in-addr.arpa

IN PTR

Response
DNS

tse1.mm.bing.net

Remote address:

8.8.8.8:53

Request

tse1.mm.bing.net

IN A

Response

tse1.mm.bing.net

IN CNAME

mm-mm.bing.net.trafficmanager.net

mm-mm.bing.net.trafficmanager.net

IN CNAME

dual-a-0001.a-msedge.net

dual-a-0001.a-msedge.net

IN A

204.79.197.200

dual-a-0001.a-msedge.net

IN A

13.107.21.200
GET

https://tse1.mm.bing.net/th?id=OADD2.10239340783933_1QOIM48UV8MGOV4SU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239340783933_1QOIM48UV8MGOV4SU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 468637
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: C190D3A307C84F938128A3052D4FE192 Ref B: LON04EDGE1115 Ref C: 2024-05-05T02:04:07Z
date: Sun, 05 May 2024 02:04:07 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239340783932_1JCHO8JLBZ4TPAX49&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239340783932_1JCHO8JLBZ4TPAX49&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 638730
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 8286F53B575A4F7194C6317198D72FC6 Ref B: LON04EDGE1115 Ref C: 2024-05-05T02:04:07Z
date: Sun, 05 May 2024 02:04:07 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239351692210_1AKNUXTAY2T0XUMCR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239351692210_1AKNUXTAY2T0XUMCR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 555746
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 5BEA6DCDFCA04F33992231B56267F846 Ref B: LON04EDGE1115 Ref C: 2024-05-05T02:04:07Z
date: Sun, 05 May 2024 02:04:07 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239351692215_1UJ4FAL91XLA7HB15&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239351692215_1UJ4FAL91XLA7HB15&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 449656
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: F9667CD3741A4E3DAFA3CDA58DD9D98E Ref B: LON04EDGE1115 Ref C: 2024-05-05T02:04:07Z
date: Sun, 05 May 2024 02:04:07 GMT

23.62.61.97:443

https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90

tls, http2

1.4kB
6.3kB
16
11

HTTP Request

GET https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90

HTTP Response

200
204.79.197.200:443

tse1.mm.bing.net

tls, http2

1.2kB
8.1kB
16
14
204.79.197.200:443

https://tse1.mm.bing.net/th?id=OADD2.10239351692215_1UJ4FAL91XLA7HB15&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

tls, http2

77.5kB
2.2MB
1601
1597

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239340783933_1QOIM48UV8MGOV4SU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239340783932_1JCHO8JLBZ4TPAX49&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239351692210_1AKNUXTAY2T0XUMCR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239351692215_1UJ4FAL91XLA7HB15&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Response

200
204.79.197.200:443

tse1.mm.bing.net

tls, http2

1.2kB
8.1kB
16
14
204.79.197.200:443

tse1.mm.bing.net

tls, http2

1.2kB
8.1kB
16
14

8.8.8.8:53

241.150.49.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

241.150.49.20.in-addr.arpa
8.8.8.8:53

172.210.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.210.232.199.in-addr.arpa
8.8.8.8:53

17.160.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

17.160.190.20.in-addr.arpa
8.8.8.8:53

88.156.103.20.in-addr.arpa

dns

144 B
158 B
2
1

DNS Request

88.156.103.20.in-addr.arpa

DNS Request

88.156.103.20.in-addr.arpa
8.8.8.8:53

97.61.62.23.in-addr.arpa

dns

140 B
133 B
2
1

DNS Request

97.61.62.23.in-addr.arpa

DNS Request

97.61.62.23.in-addr.arpa
8.8.8.8:53

104.219.191.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

104.219.191.52.in-addr.arpa
8.8.8.8:53

103.169.127.40.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

103.169.127.40.in-addr.arpa
8.8.8.8:53

198.187.3.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

198.187.3.20.in-addr.arpa
8.8.8.8:53

142.53.16.96.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

142.53.16.96.in-addr.arpa
8.8.8.8:53

240.221.184.93.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

240.221.184.93.in-addr.arpa
8.8.8.8:53

55.36.223.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

55.36.223.20.in-addr.arpa
8.8.8.8:53

48.251.17.2.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

48.251.17.2.in-addr.arpa
8.8.8.8:53

48.229.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

48.229.111.52.in-addr.arpa
8.8.8.8:53

tse1.mm.bing.net

dns

62 B
173 B
1
1

DNS Request

tse1.mm.bing.net

DNS Response

204.79.197.200

13.107.21.200

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3726321484-1950364574-433157660-1000\desktop.ini.tmp

Filesize
61KB

MD5
e99290516681035d0a51cc06181ce394

SHA1
a374d127024692636aeffada228f7d5f29127978

SHA256
ae4824022dbbd9cfa02f8e90ac9840ed26b7b94c5f4613e5f14827c4ecb652f8

SHA512
86a8901b90681d430633a63b3444d19be1ff05fdec7d6c81c5f4329cb92c03e16be4536dd03a402df3ab3de7a9c3bfb719f7d6b216b2ea4b833a49b5914906f0

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
160KB

MD5
e63027b5b46a775518ce0c57c317d5ed

SHA1
de122cfed92843fc4d621e4c68a356bdc6e3d621

SHA256
4f9691b0d01f6e8ef79d5b390557497120133d9bca6c29e22949a96e29307346

SHA512
6c1a87d365edf077b1218b6d30c63bd9112a2c6ef548d4f6eff8916c07bedecc446260aff54db2932953d3a1942dc5191ab98133c5858d26d8efde60ce7382cb

Download Submit
memory/4312-0-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/4312-1824-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Response

HTTP Response

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Response

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.