Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

3

0f6b0cdfd7...AS.exe

windows7-x64

9

0f6b0cdfd7...AS.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    103s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/05/2024, 08:39 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0f6b0cdfd75de5ce1ef0033f33927c90_NEAS.exe

  • Size

    94KB

  • MD5

    0f6b0cdfd75de5ce1ef0033f33927c90

  • SHA1

    0f1448173c314568057bfb5122c4c75a5aa89eae

  • SHA256

    baac325da47990be5587a28c731d85a952e31efa6ac5c6c7b264e709769a8f6a

  • SHA512

    3b462fd5bf6dc7ce7f67ff93e19717cb02037724e307a43f0b49c42f13187fc04b384a85837cffc6e71ed3801870f7311f8baa3189941beb12ea86d445132382

  • SSDEEP

    1536:W7ZhA7pApMaxB4b0CYJ97lEVqNR7Yge+eJG/x/OfFpsJOfFpsJagM16:6e7WpMaxeb0CYJ97lEYNR73e+eKZOfFE

Score
9/10
ransomware

Malware Config

Signatures

  • Renames multiple (4863) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0f6b0cdfd75de5ce1ef0033f33927c90_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\0f6b0cdfd75de5ce1ef0033f33927c90_NEAS.exe"
    1⤵
    • Drops file in Program Files directory
    PID:3516

Network

  • flag-us
    DNS
    217.106.137.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.106.137.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    77.190.18.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    77.190.18.2.in-addr.arpa
    IN PTR
    Response
    77.190.18.2.in-addr.arpa
    IN PTR
    a2-18-190-77deploystaticakamaitechnologiescom
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
    Response
    g.bing.com
    IN CNAME
    g-bing-com.dual-a-0034.a-msedge.net
    g-bing-com.dual-a-0034.a-msedge.net
    IN CNAME
    dual-a-0034.a-msedge.net
    dual-a-0034.a-msedge.net
    IN A
    204.79.197.237
    dual-a-0034.a-msedge.net
    IN A
    13.107.21.237
  • flag-us
    GET
    https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8lTWujR5rTGUAIRVExc8uXDVUCUwcYim1MT8ZnMTolfrAHnOCsMxJLyq6r3vdWTY51YkZiLttZJW0vREFVNOXAKoDpoFpHeSVCw8mFGCkvTg9XT5s4mgXeN8ozTZxFy2aTYixHkeOaNBnoT9VvfwZeXS8ctm7zPid_GG5TdTIAlngtrKN%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Da11394b5d6011c002b94f297fcb6ae1c&TIME=20240419T082702Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:514E7E71-4CE0-645C-5005-1E4EAC1BBA78&deviceId=6896200266421081&muid=514E7E714CE0645C50051E4EAC1BBA78
    Remote address:
    204.79.197.237:443
    Request
    GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8lTWujR5rTGUAIRVExc8uXDVUCUwcYim1MT8ZnMTolfrAHnOCsMxJLyq6r3vdWTY51YkZiLttZJW0vREFVNOXAKoDpoFpHeSVCw8mFGCkvTg9XT5s4mgXeN8ozTZxFy2aTYixHkeOaNBnoT9VvfwZeXS8ctm7zPid_GG5TdTIAlngtrKN%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Da11394b5d6011c002b94f297fcb6ae1c&TIME=20240419T082702Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:514E7E71-4CE0-645C-5005-1E4EAC1BBA78&deviceId=6896200266421081&muid=514E7E714CE0645C50051E4EAC1BBA78 HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MUID=3684653F62A16DE42C007147631A6C7D; domain=.bing.com; expires=Sun, 01-Jun-2025 08:39:41 GMT; path=/; SameSite=None; Secure; Priority=High;
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 5399EB24B61247CF9D0FDF1EFE522E8E Ref B: LON04EDGE0811 Ref C: 2024-05-07T08:39:41Z
    date: Tue, 07 May 2024 08:39:41 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8lTWujR5rTGUAIRVExc8uXDVUCUwcYim1MT8ZnMTolfrAHnOCsMxJLyq6r3vdWTY51YkZiLttZJW0vREFVNOXAKoDpoFpHeSVCw8mFGCkvTg9XT5s4mgXeN8ozTZxFy2aTYixHkeOaNBnoT9VvfwZeXS8ctm7zPid_GG5TdTIAlngtrKN%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Da11394b5d6011c002b94f297fcb6ae1c&TIME=20240419T082702Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:514E7E71-4CE0-645C-5005-1E4EAC1BBA78&deviceId=6896200266421081&muid=514E7E714CE0645C50051E4EAC1BBA78
    Remote address:
    204.79.197.237:443
    Request
    GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8lTWujR5rTGUAIRVExc8uXDVUCUwcYim1MT8ZnMTolfrAHnOCsMxJLyq6r3vdWTY51YkZiLttZJW0vREFVNOXAKoDpoFpHeSVCw8mFGCkvTg9XT5s4mgXeN8ozTZxFy2aTYixHkeOaNBnoT9VvfwZeXS8ctm7zPid_GG5TdTIAlngtrKN%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Da11394b5d6011c002b94f297fcb6ae1c&TIME=20240419T082702Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:514E7E71-4CE0-645C-5005-1E4EAC1BBA78&deviceId=6896200266421081&muid=514E7E714CE0645C50051E4EAC1BBA78 HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=3684653F62A16DE42C007147631A6C7D; _EDGE_S=SID=1AE3E05241E16A681216F42A402A6B11
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MSPTC=nYxcOheZFTNylDRfm-pTjuGyMlhS1qsTIXLqv6gDisA; domain=.bing.com; expires=Sun, 01-Jun-2025 08:39:41 GMT; path=/; Partitioned; secure; SameSite=None
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: AF894731B2514013BBA78A78FE4351D0 Ref B: LON04EDGE0811 Ref C: 2024-05-07T08:39:41Z
    date: Tue, 07 May 2024 08:39:41 GMT
  • flag-gb
    GET
    https://www.bing.com/aes/c.gif?RG=10720b82ba0f4911bce902f0b570717c&med=10&PubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240419T082702Z&adUnitId=11730597&localId=w:514E7E71-4CE0-645C-5005-1E4EAC1BBA78&deviceId=6896200266421081
    Remote address:
    23.73.138.17:443
    Request
    GET /aes/c.gif?RG=10720b82ba0f4911bce902f0b570717c&med=10&PubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240419T082702Z&adUnitId=11730597&localId=w:514E7E71-4CE0-645C-5005-1E4EAC1BBA78&deviceId=6896200266421081 HTTP/2.0
    host: www.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=3684653F62A16DE42C007147631A6C7D
    Response
    HTTP/2.0 200
    cache-control: private,no-store
    pragma: no-cache
    vary: Origin
    p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 85EADE4383B04657821A3DA51F4818C1 Ref B: LTSEDGE1916 Ref C: 2024-05-07T08:39:41Z
    content-length: 0
    date: Tue, 07 May 2024 08:39:41 GMT
    set-cookie: _EDGE_S=SID=1AE3E05241E16A681216F42A402A6B11; path=/; httponly; domain=bing.com
    set-cookie: MUIDB=3684653F62A16DE42C007147631A6C7D; path=/; httponly; expires=Sun, 01-Jun-2025 08:39:41 GMT
    alt-svc: h3=":443"; ma=93600
    x-cdn-traceid: 0.0d8a4917.1715071181.194548d5
  • flag-us
    DNS
    73.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    237.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    237.197.79.204.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    17.138.73.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    17.138.73.23.in-addr.arpa
    IN PTR
    Response
    17.138.73.23.in-addr.arpa
    IN PTR
    a23-73-138-17deploystaticakamaitechnologiescom
  • flag-gb
    GET
    https://www.bing.com/th?id=OADD2.10239355179391_1LFCMSFC5TYGHD1FP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
    Remote address:
    23.73.138.17:443
    Request
    GET /th?id=OADD2.10239355179391_1LFCMSFC5TYGHD1FP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
    host: www.bing.com
    accept: */*
    cookie: MUID=3684653F62A16DE42C007147631A6C7D; _EDGE_S=SID=1AE3E05241E16A681216F42A402A6B11; MSPTC=nYxcOheZFTNylDRfm-pTjuGyMlhS1qsTIXLqv6gDisA; MUIDB=3684653F62A16DE42C007147631A6C7D
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-type: image/png
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QWthbWFp
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    content-length: 1463
    date: Tue, 07 May 2024 08:39:42 GMT
    alt-svc: h3=":443"; ma=93600
    x-cdn-traceid: 0.0d8a4917.1715071182.19454cbb
  • flag-us
    DNS
    205.47.74.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    205.47.74.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    154.239.44.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    154.239.44.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    157.123.68.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    157.123.68.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    56.126.166.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    56.126.166.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    43.58.199.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.58.199.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    48.251.17.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    48.251.17.2.in-addr.arpa
    IN PTR
    Response
    48.251.17.2.in-addr.arpa
    IN PTR
    a2-17-251-48deploystaticakamaitechnologiescom
  • flag-us
    DNS
    13.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.227.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    dual-a-0001.a-msedge.net
    dual-a-0001.a-msedge.net
    IN A
    204.79.197.200
    dual-a-0001.a-msedge.net
    IN A
    13.107.21.200
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239360931612_153L2SVWUYAQUME4E&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239360931612_153L2SVWUYAQUME4E&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 659775
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: AB845A3BE9E54889B4356174C09D4225 Ref B: LON04EDGE0611 Ref C: 2024-05-07T08:41:21Z
    date: Tue, 07 May 2024 08:41:21 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239360931611_1SOG5TNNJKE1WH1R0&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239360931611_1SOG5TNNJKE1WH1R0&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 621794
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 82918447DBA547EDB076C8DECD2AE133 Ref B: LON04EDGE0611 Ref C: 2024-05-07T08:41:21Z
    date: Tue, 07 May 2024 08:41:21 GMT
  • flag-us
    DNS
    200.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.197.79.204.in-addr.arpa
    IN PTR
    Response
    200.197.79.204.in-addr.arpa
    IN PTR
    a-0001a-msedgenet
  • 204.79.197.237:443
    https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8lTWujR5rTGUAIRVExc8uXDVUCUwcYim1MT8ZnMTolfrAHnOCsMxJLyq6r3vdWTY51YkZiLttZJW0vREFVNOXAKoDpoFpHeSVCw8mFGCkvTg9XT5s4mgXeN8ozTZxFy2aTYixHkeOaNBnoT9VvfwZeXS8ctm7zPid_GG5TdTIAlngtrKN%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Da11394b5d6011c002b94f297fcb6ae1c&TIME=20240419T082702Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:514E7E71-4CE0-645C-5005-1E4EAC1BBA78&deviceId=6896200266421081&muid=514E7E714CE0645C50051E4EAC1BBA78
    tls, http2
    2.5kB
     9.0kB
     19
    16

    HTTP Request

    GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8lTWujR5rTGUAIRVExc8uXDVUCUwcYim1MT8ZnMTolfrAHnOCsMxJLyq6r3vdWTY51YkZiLttZJW0vREFVNOXAKoDpoFpHeSVCw8mFGCkvTg9XT5s4mgXeN8ozTZxFy2aTYixHkeOaNBnoT9VvfwZeXS8ctm7zPid_GG5TdTIAlngtrKN%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Da11394b5d6011c002b94f297fcb6ae1c&TIME=20240419T082702Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:514E7E71-4CE0-645C-5005-1E4EAC1BBA78&deviceId=6896200266421081&muid=514E7E714CE0645C50051E4EAC1BBA78

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8lTWujR5rTGUAIRVExc8uXDVUCUwcYim1MT8ZnMTolfrAHnOCsMxJLyq6r3vdWTY51YkZiLttZJW0vREFVNOXAKoDpoFpHeSVCw8mFGCkvTg9XT5s4mgXeN8ozTZxFy2aTYixHkeOaNBnoT9VvfwZeXS8ctm7zPid_GG5TdTIAlngtrKN%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3Da11394b5d6011c002b94f297fcb6ae1c&TIME=20240419T082702Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:514E7E71-4CE0-645C-5005-1E4EAC1BBA78&deviceId=6896200266421081&muid=514E7E714CE0645C50051E4EAC1BBA78

    HTTP Response

    204
  • 23.73.138.17:443
    https://www.bing.com/aes/c.gif?RG=10720b82ba0f4911bce902f0b570717c&med=10&PubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240419T082702Z&adUnitId=11730597&localId=w:514E7E71-4CE0-645C-5005-1E4EAC1BBA78&deviceId=6896200266421081
    tls, http2
    1.4kB
     5.3kB
     16
    10

    HTTP Request

    GET https://www.bing.com/aes/c.gif?RG=10720b82ba0f4911bce902f0b570717c&med=10&PubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240419T082702Z&adUnitId=11730597&localId=w:514E7E71-4CE0-645C-5005-1E4EAC1BBA78&deviceId=6896200266421081

    HTTP Response

    200
  • 23.73.138.17:443
    https://www.bing.com/th?id=OADD2.10239355179391_1LFCMSFC5TYGHD1FP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
    tls, http2
    1.6kB
     6.7kB
     17
    12

    HTTP Request

    GET https://www.bing.com/th?id=OADD2.10239355179391_1LFCMSFC5TYGHD1FP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90

    HTTP Response

    200
  • 204.79.197.200:443
    https://tse1.mm.bing.net/th?id=OADD2.10239360931611_1SOG5TNNJKE1WH1R0&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    tls, http2
    48.5kB
     1.3MB
     979
    975

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239360931612_153L2SVWUYAQUME4E&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239360931611_1SOG5TNNJKE1WH1R0&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Response

    200
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     8.1kB
     16
    14
  • 8.8.8.8:53
    217.106.137.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    217.106.137.52.in-addr.arpa

  • 8.8.8.8:53
    77.190.18.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    77.190.18.2.in-addr.arpa

  • 8.8.8.8:53
    g.bing.com
    dns
    56 B
     151 B
     1
    1

    DNS Request

    g.bing.com

    DNS Response

    204.79.197.237
    13.107.21.237

  • 8.8.8.8:53
    73.159.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    73.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    237.197.79.204.in-addr.arpa
    dns
    73 B
     143 B
     1
    1

    DNS Request

    237.197.79.204.in-addr.arpa

  • 8.8.8.8:53
    17.138.73.23.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    17.138.73.23.in-addr.arpa

  • 8.8.8.8:53
    205.47.74.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    205.47.74.20.in-addr.arpa

  • 8.8.8.8:53
    154.239.44.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    154.239.44.20.in-addr.arpa

  • 8.8.8.8:53
    157.123.68.40.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    157.123.68.40.in-addr.arpa

  • 8.8.8.8:53
    56.126.166.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    56.126.166.20.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    43.58.199.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    43.58.199.20.in-addr.arpa

  • 8.8.8.8:53
    48.251.17.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    48.251.17.2.in-addr.arpa

  • 8.8.8.8:53
    13.227.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    13.227.111.52.in-addr.arpa

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    62 B
     173 B
     1
    1

    DNS Request

    tse1.mm.bing.net

    DNS Response

    204.79.197.200
    13.107.21.200

  • 8.8.8.8:53
    200.197.79.204.in-addr.arpa
    dns
    73 B
     106 B
     1
    1

    DNS Request

    200.197.79.204.in-addr.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-877519540-908060166-1852957295-1000\desktop.ini.tmp
    Filesize

    95KB

    MD5

    91f6aaf2401843725f48ef598ef08f2f

    SHA1

    621e72129f9574f45a911a255a8bd4254aa288b3

    SHA256

    f129c1f0cf2f6914da8e490f6556f0ed56fb190412eb8689445a1daf26b940fa

    SHA512

    a9979808c5aa37c435348d8c77b90951ff05f96d23bc6464e9602599763b9e16a5693999a4e2501b6eee49027200949c01b819019cebf74d03f96ca386196474

    Download Submit

  • C:\Program Files\7-Zip\7-zip.dll.exe
    Filesize

    194KB

    MD5

    3c4f953f91f722aeaf362d8d497dc74d

    SHA1

    dc4d419dde8e2aaadb73716d0afd9da259766a2b

    SHA256

    f69f3eae74da6bae701bfcd7238c446b83ca03c7aa022de80d4ffb5455c0cd59

    SHA512

    f1cbc81b0e601c33e9c7453b1cbbbd136d07b98a688184f681bf649164856cf876a26879c49c25478f375b2449e2ba4d049a180fbe40354f942a8f35529ff4c6

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.