Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

Cumacean.exe

windows7-x64

10

Cumacean.exe

windows10-2004-x64

10

$PLUGINSDI...er.dll

windows7-x64

1

$PLUGINSDI...er.dll

windows10-2004-x64

1

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/05/2024, 07:38 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Cumacean.exe

  • Size

    234KB

  • MD5

    d9ad627096015371e1d4db92375bc6ff

  • SHA1

    c625bbef9ca680e05e6d426ef1417086d059cd94

  • SHA256

    1f7f8fa2a0d1850a1753edd61fc2ddfd67031a15b65929469c044dc8c751de03

  • SHA512

    9573885810921efacaa924e48069cd04adbc0f1003a94318734233a570c495d91f6e1dc6ab02e078ebd17cdceb1a616636f6799dc737aae281e9cd4681df6aa3

  • SSDEEP

    6144:Ek62PBHbekcwi+GGKPNYLsJbRGryWCP3fI/C:BpaGgvfRRGrK4a

Score
10/10
guloaderdownloader

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 6 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Cumacean.exe
    "C:\Users\Admin\AppData\Local\Temp\Cumacean.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:3740
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
      "C:\Users\Admin\AppData\Local\Temp\Cumacean.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:1120

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    58.55.71.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.55.71.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    133.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    232.168.11.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    232.168.11.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    103.169.127.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    103.169.127.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    171.39.242.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    171.39.242.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    139.53.16.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    139.53.16.96.in-addr.arpa
    IN PTR
    Response
    139.53.16.96.in-addr.arpa
    IN PTR
    a96-16-53-139deploystaticakamaitechnologiescom
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
    Response
    g.bing.com
    IN CNAME
    g-bing-com.dual-a-0034.a-msedge.net
    g-bing-com.dual-a-0034.a-msedge.net
    IN CNAME
    dual-a-0034.a-msedge.net
    dual-a-0034.a-msedge.net
    IN A
    204.79.197.237
    dual-a-0034.a-msedge.net
    IN A
    13.107.21.237
  • flag-us
    GET
    https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De85PpwDA6DewK9GIKtbOBPIDVUCUzGHIdv6AZBsYe70whjd3oyQaHB1Eg1l4xLZAyXmqhrxJbRYsZF8EL5l3OhdXa4wkBoB_bWQqD9y2O2GQLIN2GO7LqQOvTQf8DqYlJbCOZmyGWVy8XE8YZJeeJmhwE4Cj07FSpm_ChrjXm8_7YFQ73-%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D4bdf233fac641953e7a2451405bee865&TIME=20240510T073959Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:ADDDFB3E-F7AA-0DA8-A496-4D397794E5DF&deviceId=6896200621815266&muid=ADDDFB3EF7AA0DA8A4964D397794E5DF
    Remote address:
    204.79.197.237:443
    Request
    GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De85PpwDA6DewK9GIKtbOBPIDVUCUzGHIdv6AZBsYe70whjd3oyQaHB1Eg1l4xLZAyXmqhrxJbRYsZF8EL5l3OhdXa4wkBoB_bWQqD9y2O2GQLIN2GO7LqQOvTQf8DqYlJbCOZmyGWVy8XE8YZJeeJmhwE4Cj07FSpm_ChrjXm8_7YFQ73-%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D4bdf233fac641953e7a2451405bee865&TIME=20240510T073959Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:ADDDFB3E-F7AA-0DA8-A496-4D397794E5DF&deviceId=6896200621815266&muid=ADDDFB3EF7AA0DA8A4964D397794E5DF HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MUID=3EA90CD88D106CA61C9B18A38CF06D99; domain=.bing.com; expires=Wed, 04-Jun-2025 07:40:01 GMT; path=/; SameSite=None; Secure; Priority=High;
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 7C2998935906499CAA7BD8F17545E51E Ref B: LON04EDGE1205 Ref C: 2024-05-10T07:40:01Z
    date: Fri, 10 May 2024 07:40:00 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De85PpwDA6DewK9GIKtbOBPIDVUCUzGHIdv6AZBsYe70whjd3oyQaHB1Eg1l4xLZAyXmqhrxJbRYsZF8EL5l3OhdXa4wkBoB_bWQqD9y2O2GQLIN2GO7LqQOvTQf8DqYlJbCOZmyGWVy8XE8YZJeeJmhwE4Cj07FSpm_ChrjXm8_7YFQ73-%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D4bdf233fac641953e7a2451405bee865&TIME=20240510T073959Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:ADDDFB3E-F7AA-0DA8-A496-4D397794E5DF&deviceId=6896200621815266&muid=ADDDFB3EF7AA0DA8A4964D397794E5DF
    Remote address:
    204.79.197.237:443
    Request
    GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De85PpwDA6DewK9GIKtbOBPIDVUCUzGHIdv6AZBsYe70whjd3oyQaHB1Eg1l4xLZAyXmqhrxJbRYsZF8EL5l3OhdXa4wkBoB_bWQqD9y2O2GQLIN2GO7LqQOvTQf8DqYlJbCOZmyGWVy8XE8YZJeeJmhwE4Cj07FSpm_ChrjXm8_7YFQ73-%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D4bdf233fac641953e7a2451405bee865&TIME=20240510T073959Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:ADDDFB3E-F7AA-0DA8-A496-4D397794E5DF&deviceId=6896200621815266&muid=ADDDFB3EF7AA0DA8A4964D397794E5DF HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=3EA90CD88D106CA61C9B18A38CF06D99; _EDGE_S=SID=24B113257AA362802348075E7BA56323
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MSPTC=uk3YIC0WxPDc66E28qjVmEM_v9Ly90T9EUOmO3bntB4; domain=.bing.com; expires=Wed, 04-Jun-2025 07:40:01 GMT; path=/; Partitioned; secure; SameSite=None
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: A66A0174F59043A0985E5047D60CF72A Ref B: LON04EDGE1205 Ref C: 2024-05-10T07:40:01Z
    date: Fri, 10 May 2024 07:40:01 GMT
  • flag-be
    GET
    https://www.bing.com/aes/c.gif?RG=08c44d779ef6485f9d9346f446316ae2&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240510T073959Z&adUnitId=11730597&localId=w:ADDDFB3E-F7AA-0DA8-A496-4D397794E5DF&deviceId=6896200621815266
    Remote address:
    2.17.107.130:443
    Request
    GET /aes/c.gif?RG=08c44d779ef6485f9d9346f446316ae2&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240510T073959Z&adUnitId=11730597&localId=w:ADDDFB3E-F7AA-0DA8-A496-4D397794E5DF&deviceId=6896200621815266 HTTP/2.0
    host: www.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=3EA90CD88D106CA61C9B18A38CF06D99
    Response
    HTTP/2.0 200
    cache-control: private,no-store
    pragma: no-cache
    vary: Origin
    p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: EAB32E2DE7844AE8B2498D4E3010B237 Ref B: LON212050702031 Ref C: 2024-05-10T07:40:01Z
    content-length: 0
    date: Fri, 10 May 2024 07:40:01 GMT
    set-cookie: _EDGE_S=SID=24B113257AA362802348075E7BA56323; path=/; httponly; domain=bing.com
    set-cookie: MUIDB=3EA90CD88D106CA61C9B18A38CF06D99; path=/; httponly; expires=Wed, 04-Jun-2025 07:40:01 GMT
    alt-svc: h3=":443"; ma=93600
    x-cdn-traceid: 0.7e6b1102.1715326801.4eb9bfc
  • flag-us
    DNS
    73.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-be
    GET
    https://www.bing.com/th?id=OADD2.10239355179391_1LFCMSFC5TYGHD1FP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
    Remote address:
    2.17.107.130:443
    Request
    GET /th?id=OADD2.10239355179391_1LFCMSFC5TYGHD1FP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
    host: www.bing.com
    accept: */*
    cookie: MUID=3EA90CD88D106CA61C9B18A38CF06D99; _EDGE_S=SID=24B113257AA362802348075E7BA56323; MSPTC=uk3YIC0WxPDc66E28qjVmEM_v9Ly90T9EUOmO3bntB4; MUIDB=3EA90CD88D106CA61C9B18A38CF06D99
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-type: image/png
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QWthbWFp
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    content-length: 1463
    date: Fri, 10 May 2024 07:40:02 GMT
    alt-svc: h3=":443"; ma=93600
    x-cdn-traceid: 0.7e6b1102.1715326802.4eb9f4f
  • flag-us
    DNS
    237.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    237.197.79.204.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    88.156.103.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.156.103.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    130.107.17.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    130.107.17.2.in-addr.arpa
    IN PTR
    Response
    130.107.17.2.in-addr.arpa
    IN PTR
    a2-17-107-130deploystaticakamaitechnologiescom
  • flag-us
    DNS
    19.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    19.229.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    dual-a-0001.a-msedge.net
    dual-a-0001.a-msedge.net
    IN A
    204.79.197.200
    dual-a-0001.a-msedge.net
    IN A
    13.107.21.200
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239381705589_1UZ6HI7DU1RQLXLFR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239381705589_1UZ6HI7DU1RQLXLFR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 499516
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 04A859EF1AFE42A096F9CA457B7122CE Ref B: LON04EDGE1010 Ref C: 2024-05-10T07:40:35Z
    date: Fri, 10 May 2024 07:40:35 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239381705588_1WA9C34P2B6OXP331&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239381705588_1WA9C34P2B6OXP331&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 382817
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 850BEF90E6C4452A955FBE5F5748D445 Ref B: LON04EDGE1010 Ref C: 2024-05-10T07:40:35Z
    date: Fri, 10 May 2024 07:40:35 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239381702592_1OT5ET7HCG1M9EIRY&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239381702592_1OT5ET7HCG1M9EIRY&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 476246
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: C236BED966A84BC8A4DED317DA107042 Ref B: LON04EDGE1010 Ref C: 2024-05-10T07:40:35Z
    date: Fri, 10 May 2024 07:40:35 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239381702593_1BLW9LYE0FMIB48EX&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239381702593_1BLW9LYE0FMIB48EX&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 464243
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 5F5A19FACB7D4E5EBD8BF7A4B6A6A719 Ref B: LON04EDGE1010 Ref C: 2024-05-10T07:40:35Z
    date: Fri, 10 May 2024 07:40:35 GMT
  • flag-us
    DNS
    26.35.223.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    26.35.223.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    200.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.197.79.204.in-addr.arpa
    IN PTR
    Response
    200.197.79.204.in-addr.arpa
    IN PTR
    a-0001a-msedgenet
  • 172.93.220.118:80
    msbuild.exe
    156 B
     3
  • 172.93.220.118:80
    msbuild.exe
    156 B
     3
  • 172.93.220.118:80
    msbuild.exe
    156 B
     3
  • 172.93.220.118:80
    msbuild.exe
    156 B
     3
  • 172.93.220.118:80
    msbuild.exe
    156 B
     3
  • 172.93.220.118:80
    msbuild.exe
    156 B
     3
  • 172.93.220.118:80
    msbuild.exe
    156 B
     3
  • 172.93.220.118:80
    msbuild.exe
    156 B
     3
  • 172.93.220.118:80
    msbuild.exe
    156 B
     3
  • 204.79.197.237:443
    https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De85PpwDA6DewK9GIKtbOBPIDVUCUzGHIdv6AZBsYe70whjd3oyQaHB1Eg1l4xLZAyXmqhrxJbRYsZF8EL5l3OhdXa4wkBoB_bWQqD9y2O2GQLIN2GO7LqQOvTQf8DqYlJbCOZmyGWVy8XE8YZJeeJmhwE4Cj07FSpm_ChrjXm8_7YFQ73-%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D4bdf233fac641953e7a2451405bee865&TIME=20240510T073959Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:ADDDFB3E-F7AA-0DA8-A496-4D397794E5DF&deviceId=6896200621815266&muid=ADDDFB3EF7AA0DA8A4964D397794E5DF
    tls, http2
    2.5kB
     9.0kB
     19
    16

    HTTP Request

    GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De85PpwDA6DewK9GIKtbOBPIDVUCUzGHIdv6AZBsYe70whjd3oyQaHB1Eg1l4xLZAyXmqhrxJbRYsZF8EL5l3OhdXa4wkBoB_bWQqD9y2O2GQLIN2GO7LqQOvTQf8DqYlJbCOZmyGWVy8XE8YZJeeJmhwE4Cj07FSpm_ChrjXm8_7YFQ73-%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D4bdf233fac641953e7a2451405bee865&TIME=20240510T073959Z&CID=530628298&EID=530628298&tids=15000&adUnitId=11730597&localId=w:ADDDFB3E-F7AA-0DA8-A496-4D397794E5DF&deviceId=6896200621815266&muid=ADDDFB3EF7AA0DA8A4964D397794E5DF

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De85PpwDA6DewK9GIKtbOBPIDVUCUzGHIdv6AZBsYe70whjd3oyQaHB1Eg1l4xLZAyXmqhrxJbRYsZF8EL5l3OhdXa4wkBoB_bWQqD9y2O2GQLIN2GO7LqQOvTQf8DqYlJbCOZmyGWVy8XE8YZJeeJmhwE4Cj07FSpm_ChrjXm8_7YFQ73-%26u%3DbXN4Ym94JTNhJTJmJTJmZ2FtZSUyZiUzZnByb2R1Y3RJZCUzZDlOMEg2MktaM0JYViUyNm9jaWQlM2RpbnBfcm1jX3hib19zdGFydF9UUHRpdGxlX2VuZ2FnZQ%26rlid%3D4bdf233fac641953e7a2451405bee865&TIME=20240510T073959Z&CID=530628298&EID=&tids=15000&adUnitId=11730597&localId=w:ADDDFB3E-F7AA-0DA8-A496-4D397794E5DF&deviceId=6896200621815266&muid=ADDDFB3EF7AA0DA8A4964D397794E5DF

    HTTP Response

    204
  • 2.17.107.130:443
    https://www.bing.com/aes/c.gif?RG=08c44d779ef6485f9d9346f446316ae2&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240510T073959Z&adUnitId=11730597&localId=w:ADDDFB3E-F7AA-0DA8-A496-4D397794E5DF&deviceId=6896200621815266
    tls, http2
    1.4kB
     5.3kB
     15
    10

    HTTP Request

    GET https://www.bing.com/aes/c.gif?RG=08c44d779ef6485f9d9346f446316ae2&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240510T073959Z&adUnitId=11730597&localId=w:ADDDFB3E-F7AA-0DA8-A496-4D397794E5DF&deviceId=6896200621815266

    HTTP Response

    200
  • 2.17.107.130:443
    https://www.bing.com/th?id=OADD2.10239355179391_1LFCMSFC5TYGHD1FP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
    tls, http2
    1.7kB
     6.8kB
     18
    13

    HTTP Request

    GET https://www.bing.com/th?id=OADD2.10239355179391_1LFCMSFC5TYGHD1FP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90

    HTTP Response

    200
  • 172.93.220.118:80
    msbuild.exe
    156 B
     3
  • 172.93.220.118:80
    msbuild.exe
    156 B
     3
  • 172.93.220.118:80
    msbuild.exe
    156 B
     3
  • 172.93.220.118:80
    msbuild.exe
    156 B
     3
  • 172.93.220.118:80
    msbuild.exe
    156 B
     3
  • 172.93.220.118:80
    msbuild.exe
    156 B
     3
  • 172.93.220.118:80
    msbuild.exe
    156 B
     3
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     8.1kB
     16
    14
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     8.1kB
     16
    14
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     8.1kB
     16
    14
  • 204.79.197.200:443
    https://tse1.mm.bing.net/th?id=OADD2.10239381702593_1BLW9LYE0FMIB48EX&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    tls, http2
    66.2kB
     1.9MB
     1386
    1382

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239381705589_1UZ6HI7DU1RQLXLFR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239381705588_1WA9C34P2B6OXP331&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239381702592_1OT5ET7HCG1M9EIRY&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239381702593_1BLW9LYE0FMIB48EX&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200
  • 172.93.220.118:80
    msbuild.exe
    156 B
     3
  • 172.93.220.118:80
    msbuild.exe
    156 B
     3
  • 172.93.220.118:80
    msbuild.exe
    156 B
     3
  • 172.93.220.118:80
    msbuild.exe
    156 B
     3
  • 172.93.220.118:80
    msbuild.exe
    156 B
     3
  • 172.93.220.118:80
    msbuild.exe
    156 B
     3
  • 172.93.220.118:80
    msbuild.exe
    156 B
     3
  • 172.93.220.118:80
    msbuild.exe
    156 B
     3
  • 172.93.220.118:80
    msbuild.exe
    156 B
     3
  • 172.93.220.118:80
    msbuild.exe
    104 B
     2
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    58.55.71.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    58.55.71.13.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    133.32.126.40.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    133.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    232.168.11.51.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    232.168.11.51.in-addr.arpa

  • 8.8.8.8:53
    103.169.127.40.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    103.169.127.40.in-addr.arpa

  • 8.8.8.8:53
    171.39.242.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    171.39.242.20.in-addr.arpa

  • 8.8.8.8:53
    139.53.16.96.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    139.53.16.96.in-addr.arpa

  • 8.8.8.8:53
    g.bing.com
    dns
    56 B
     151 B
     1
    1

    DNS Request

    g.bing.com

    DNS Response

    204.79.197.237
    13.107.21.237

  • 8.8.8.8:53
    73.159.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    73.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    237.197.79.204.in-addr.arpa
    dns
    73 B
     143 B
     1
    1

    DNS Request

    237.197.79.204.in-addr.arpa

  • 8.8.8.8:53
    88.156.103.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    88.156.103.20.in-addr.arpa

  • 8.8.8.8:53
    130.107.17.2.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    130.107.17.2.in-addr.arpa

  • 8.8.8.8:53
    19.229.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    19.229.111.52.in-addr.arpa

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    62 B
     173 B
     1
    1

    DNS Request

    tse1.mm.bing.net

    DNS Response

    204.79.197.200
    13.107.21.200

  • 8.8.8.8:53
    26.35.223.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    26.35.223.20.in-addr.arpa

  • 8.8.8.8:53
    200.197.79.204.in-addr.arpa
    dns
    73 B
     106 B
     1
    1

    DNS Request

    200.197.79.204.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsb3CBC.tmp\System.dll
    Filesize

    11KB

    MD5

    55f18cafe28167995629fdeae4f07bdf

    SHA1

    a6bd9310f4408c86149993d1e8833d35dd16bb23

    SHA256

    e32b35cde7c6e2c967445de92884684db7fda506ea52b9aaa74c1a33dd2fdfe6

    SHA512

    113e7a9e1958bea6a045a7120adf6c667880b9b1d90ff7790e2004f3954f9358a5e44ceb6be0c3b32ff8e6a06878a0f22be7206d0b5a6c5392ca30b8c3bff8ce

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\nsb3CBC.tmp\nsDialogs.dll
    Filesize

    9KB

    MD5

    f294cfefcf2f306696944427ef551de5

    SHA1

    6ae91bc7706e0dc0e882f2648277ffc9437a5f8b

    SHA256

    b170d492cedc29719d27092c29ae1c71bc0b4d9c7df5707b44ac748bc394967f

    SHA512

    da8b57a3b9256aa6f5e8a33399eea9fb154f9463dfcb297b67419f540049cca9450ce81fe5d3dffad3d8708f300c9453d64add8e81e8dd48b6bae0f1053f116e

    Download Submit

  • memory/1120-21-0x0000000000F00000-0x0000000002F0C000-memory.dmp

    Filesize

    32.0MB

    Download

  • memory/1120-23-0x0000000072C30000-0x0000000073E84000-memory.dmp

    Filesize

    18.3MB

    Download

  • memory/1120-25-0x0000000000F00000-0x0000000002F0C000-memory.dmp

    Filesize

    32.0MB

    Download

  • memory/3740-18-0x0000000005660000-0x000000000766C000-memory.dmp

    Filesize

    32.0MB

    Download

  • memory/3740-19-0x00000000777A1000-0x00000000778C1000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/3740-20-0x0000000073E95000-0x0000000073E96000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3740-22-0x0000000005660000-0x000000000766C000-memory.dmp

    Filesize

    32.0MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.