Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

7

082abd50bc...72.exe

windows10-2004-x64

10

0a70b4612b...f6.exe

windows10-2004-x64

10

136b546d35...01.exe

windows10-2004-x64

10

1ec8ce9ace...96.exe

windows10-2004-x64

10

28e73a1086...9a.exe

windows7-x64

7

28e73a1086...9a.exe

windows10-2004-x64

7

3a5fd7dfde...92.exe

windows10-2004-x64

10

56dbfb10e0...5d.exe

windows10-2004-x64

10

5f7c9e83d8...c5.exe

windows7-x64

3

5f7c9e83d8...c5.exe

windows10-2004-x64

10

660944c2e2...12.exe

windows10-2004-x64

10

6b061fa476...e8.exe

windows10-2004-x64

10

795a49ee81...4a.exe

windows10-2004-x64

10

7d1f6eeb31...ef.exe

windows10-2004-x64

10

80f298c436...94.exe

windows10-2004-x64

10

85555569bb...4d.exe

windows10-2004-x64

10

bd2cad4003...26.exe

windows10-2004-x64

10

c429566ed4...39.exe

windows10-2004-x64

10

c47b15f967...7d.exe

windows10-2004-x64

10

ce9f75c073...16.exe

windows10-2004-x64

10

cfdc6cd562...d3.exe

windows10-2004-x64

10

eb81f341bc...da.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/05/2024, 13:08 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    80f298c436aec6fc79755a500c4350e1d63215b9088f36710903936de3cedc94.exe

  • Size

    389KB

  • MD5

    2ade2eca7ef3588a241faa5eb9c4edc5

  • SHA1

    0cb3f7a34bbd6fc353cf75997ca96974255f6243

  • SHA256

    80f298c436aec6fc79755a500c4350e1d63215b9088f36710903936de3cedc94

  • SHA512

    6a180e614bebf77a83ab8efeaec6ac20d4b7ceef19b01610b8f19f325e5fe37c5cdea4a88d858bfee0e7d5574da41867d738d2b0b526830e73e5ff8c2693991a

  • SSDEEP

    12288:0Mrpy90UHPXysVcfTOgBYCNLVbx2oXQSvd:tybv1G7NzHVESvd

Score
10/10
amadeyhealerredlinelandedropperevasioninfostealerpersistencetrojan

Malware Config

Extracted

Family

amadey

Version

3.86

C2

http://77.91.68.61

Attributes
  • install_dir

    925e7e99c5

  • install_file

    pdates.exe

  • strings_key

    ada76b8b0e1f6892ee93c20ab8946117

  • url_paths

    /rock/index.php

rc4.plain
1
006700e5a2ab05704bbb0c589b88924d

Extracted

Family

redline

Botnet

lande

C2

77.91.124.84:19071

Attributes
  • auth_value

    9fa41701c47df37786234f3373f21208

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Detects Healer an antivirus disabler dropper 2 IoCs
  • Healer

    Healer an antivirus disabler dropper.

    dropperhealer
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 2 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Windows security modification 2 TTPs 1 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\80f298c436aec6fc79755a500c4350e1d63215b9088f36710903936de3cedc94.exe
    "C:\Users\Admin\AppData\Local\Temp\80f298c436aec6fc79755a500c4350e1d63215b9088f36710903936de3cedc94.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2380
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0096760.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0096760.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:1860
      • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3294115.exe
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3294115.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:420
        • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
          "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2268
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F
            5⤵
            • Creates scheduled task(s)
            PID:4960
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3208
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              6⤵
                PID:3636
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "pdates.exe" /P "Admin:N"
                6⤵
                  PID:3640
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "pdates.exe" /P "Admin:R" /E
                  6⤵
                    PID:4936
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                    6⤵
                      PID:5076
                    • C:\Windows\SysWOW64\cacls.exe
                      CACLS "..\925e7e99c5" /P "Admin:N"
                      6⤵
                        PID:3316
                      • C:\Windows\SysWOW64\cacls.exe
                        CACLS "..\925e7e99c5" /P "Admin:R" /E
                        6⤵
                          PID:3720
                  • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4606134.exe
                    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4606134.exe
                    3⤵
                    • Modifies Windows Defender Real-time Protection settings
                    • Executes dropped EXE
                    • Windows security modification
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1968
                • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j6935570.exe
                  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j6935570.exe
                  2⤵
                  • Executes dropped EXE
                  PID:3228
              • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                1⤵
                • Executes dropped EXE
                PID:4740
              • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                1⤵
                • Executes dropped EXE
                PID:1056
              • C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe
                1⤵
                • Executes dropped EXE
                PID:4960

              Network

              • flag-us
                DNS
                g.bing.com
                Remote address:
                8.8.8.8:53
                Request
                g.bing.com
                IN A
                Response
                g.bing.com
                IN CNAME
                g-bing-com.dual-a-0034.a-msedge.net
                g-bing-com.dual-a-0034.a-msedge.net
                IN CNAME
                dual-a-0034.a-msedge.net
                dual-a-0034.a-msedge.net
                IN A
                204.79.197.237
                dual-a-0034.a-msedge.net
                IN A
                13.107.21.237
              • flag-us
                GET
                https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8CBUdLNHYYbfm7P0Y7pKKWDVUCUw6zrTpNAwTxYHD_w6Rh8vOJDDB00I-Pn7yQFPDK-x7PCRjJ37AZYawQ33dloQQbx2CwgArhJnI5i0kDIQiw2WDbYqNFLaMYcr3On640HqJO4oIYPR8RW0KQpQDM3THUca_Tp3xzbNyZ-nIZ1EUNAxK%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZmNvbGxlZ2Utc3R1ZGVudC1wcmljaW5nJTNmb2NpZCUzZGNtbWZ1NndpMTY0%26rlid%3D66fe90a503a212b0da00f69e58f415a3&TIME=20240508T110110Z&CID=531098720&EID=531098720&tids=15000&adUnitId=11730597&localId=w:D54583D0-B3DA-17FF-A437-0685003AFE48&deviceId=6966565253439182&muid=D54583D0B3DA17FFA4370685003AFE48
                Remote address:
                204.79.197.237:443
                Request
                GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8CBUdLNHYYbfm7P0Y7pKKWDVUCUw6zrTpNAwTxYHD_w6Rh8vOJDDB00I-Pn7yQFPDK-x7PCRjJ37AZYawQ33dloQQbx2CwgArhJnI5i0kDIQiw2WDbYqNFLaMYcr3On640HqJO4oIYPR8RW0KQpQDM3THUca_Tp3xzbNyZ-nIZ1EUNAxK%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZmNvbGxlZ2Utc3R1ZGVudC1wcmljaW5nJTNmb2NpZCUzZGNtbWZ1NndpMTY0%26rlid%3D66fe90a503a212b0da00f69e58f415a3&TIME=20240508T110110Z&CID=531098720&EID=531098720&tids=15000&adUnitId=11730597&localId=w:D54583D0-B3DA-17FF-A437-0685003AFE48&deviceId=6966565253439182&muid=D54583D0B3DA17FFA4370685003AFE48 HTTP/2.0
                host: g.bing.com
                accept-encoding: gzip, deflate
                user-agent: WindowsShellClient/9.0.40929.0 (Windows)
                Response
                HTTP/2.0 204
                cache-control: no-cache, must-revalidate
                pragma: no-cache
                expires: Fri, 01 Jan 1990 00:00:00 GMT
                set-cookie: MUID=14ADEBE8B1E86C863C0CFF93B0086DDF; domain=.bing.com; expires=Wed, 04-Jun-2025 13:08:35 GMT; path=/; SameSite=None; Secure; Priority=High;
                strict-transport-security: max-age=31536000; includeSubDomains; preload
                access-control-allow-origin: *
                x-cache: CONFIG_NOCACHE
                accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                x-msedge-ref: Ref A: D94DC9A933AF44E19914B7403431B769 Ref B: LON04EDGE1011 Ref C: 2024-05-10T13:08:35Z
                date: Fri, 10 May 2024 13:08:34 GMT
              • flag-us
                GET
                https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8CBUdLNHYYbfm7P0Y7pKKWDVUCUw6zrTpNAwTxYHD_w6Rh8vOJDDB00I-Pn7yQFPDK-x7PCRjJ37AZYawQ33dloQQbx2CwgArhJnI5i0kDIQiw2WDbYqNFLaMYcr3On640HqJO4oIYPR8RW0KQpQDM3THUca_Tp3xzbNyZ-nIZ1EUNAxK%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZmNvbGxlZ2Utc3R1ZGVudC1wcmljaW5nJTNmb2NpZCUzZGNtbWZ1NndpMTY0%26rlid%3D66fe90a503a212b0da00f69e58f415a3&TIME=20240508T110110Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:D54583D0-B3DA-17FF-A437-0685003AFE48&deviceId=6966565253439182&muid=D54583D0B3DA17FFA4370685003AFE48
                Remote address:
                204.79.197.237:443
                Request
                GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8CBUdLNHYYbfm7P0Y7pKKWDVUCUw6zrTpNAwTxYHD_w6Rh8vOJDDB00I-Pn7yQFPDK-x7PCRjJ37AZYawQ33dloQQbx2CwgArhJnI5i0kDIQiw2WDbYqNFLaMYcr3On640HqJO4oIYPR8RW0KQpQDM3THUca_Tp3xzbNyZ-nIZ1EUNAxK%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZmNvbGxlZ2Utc3R1ZGVudC1wcmljaW5nJTNmb2NpZCUzZGNtbWZ1NndpMTY0%26rlid%3D66fe90a503a212b0da00f69e58f415a3&TIME=20240508T110110Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:D54583D0-B3DA-17FF-A437-0685003AFE48&deviceId=6966565253439182&muid=D54583D0B3DA17FFA4370685003AFE48 HTTP/2.0
                host: g.bing.com
                accept-encoding: gzip, deflate
                user-agent: WindowsShellClient/9.0.40929.0 (Windows)
                cookie: MUID=14ADEBE8B1E86C863C0CFF93B0086DDF; _EDGE_S=SID=1D47BEDDF5A166932816AAA6F4F6676F
                Response
                HTTP/2.0 204
                cache-control: no-cache, must-revalidate
                pragma: no-cache
                expires: Fri, 01 Jan 1990 00:00:00 GMT
                set-cookie: MSPTC=MTqkHHpmuipc7R3AnjOku1L1IDWPu23dSOs3VaiHoiA; domain=.bing.com; expires=Wed, 04-Jun-2025 13:08:36 GMT; path=/; Partitioned; secure; SameSite=None
                strict-transport-security: max-age=31536000; includeSubDomains; preload
                access-control-allow-origin: *
                x-cache: CONFIG_NOCACHE
                accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                x-msedge-ref: Ref A: 9AAE9BFDF1724FAA9D907B54EA1B0EB4 Ref B: LON04EDGE1011 Ref C: 2024-05-10T13:08:36Z
                date: Fri, 10 May 2024 13:08:35 GMT
              • flag-be
                GET
                https://www.bing.com/aes/c.gif?RG=d9482cdfe46648bb808715da8e8ff266&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240508T110110Z&adUnitId=11730597&localId=w:D54583D0-B3DA-17FF-A437-0685003AFE48&deviceId=6966565253439182
                Remote address:
                88.221.83.201:443
                Request
                GET /aes/c.gif?RG=d9482cdfe46648bb808715da8e8ff266&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240508T110110Z&adUnitId=11730597&localId=w:D54583D0-B3DA-17FF-A437-0685003AFE48&deviceId=6966565253439182 HTTP/2.0
                host: www.bing.com
                accept-encoding: gzip, deflate
                user-agent: WindowsShellClient/9.0.40929.0 (Windows)
                cookie: MUID=14ADEBE8B1E86C863C0CFF93B0086DDF
                Response
                HTTP/2.0 200
                cache-control: private,no-store
                pragma: no-cache
                vary: Origin
                p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo
                accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                x-msedge-ref: Ref A: C2903307936343948A326D81F20B1ED1 Ref B: AMS04EDGE1521 Ref C: 2024-05-10T13:08:36Z
                content-length: 0
                date: Fri, 10 May 2024 13:08:36 GMT
                set-cookie: _EDGE_S=SID=1D47BEDDF5A166932816AAA6F4F6676F; path=/; httponly; domain=bing.com
                set-cookie: MUIDB=14ADEBE8B1E86C863C0CFF93B0086DDF; path=/; httponly; expires=Wed, 04-Jun-2025 13:08:36 GMT
                alt-svc: h3=":443"; ma=93600
                x-cdn-traceid: 0.c553dd58.1715346516.f4d7ca7
              • flag-us
                DNS
                8.8.8.8.in-addr.arpa
                Remote address:
                8.8.8.8:53
                Request
                8.8.8.8.in-addr.arpa
                IN PTR
                Response
                8.8.8.8.in-addr.arpa
                IN PTR
                dnsgoogle
              • flag-us
                DNS
                237.197.79.204.in-addr.arpa
                Remote address:
                8.8.8.8:53
                Request
                237.197.79.204.in-addr.arpa
                IN PTR
                Response
              • flag-us
                DNS
                79.190.18.2.in-addr.arpa
                Remote address:
                8.8.8.8:53
                Request
                79.190.18.2.in-addr.arpa
                IN PTR
                Response
                79.190.18.2.in-addr.arpa
                IN PTR
                a2-18-190-79deploystaticakamaitechnologiescom
              • flag-us
                DNS
                17.160.190.20.in-addr.arpa
                Remote address:
                8.8.8.8:53
                Request
                17.160.190.20.in-addr.arpa
                IN PTR
                Response
              • flag-us
                DNS
                17.160.190.20.in-addr.arpa
                Remote address:
                8.8.8.8:53
                Request
                17.160.190.20.in-addr.arpa
                IN PTR
              • flag-us
                DNS
                26.35.223.20.in-addr.arpa
                Remote address:
                8.8.8.8:53
                Request
                26.35.223.20.in-addr.arpa
                IN PTR
                Response
              • flag-us
                DNS
                26.35.223.20.in-addr.arpa
                Remote address:
                8.8.8.8:53
                Request
                26.35.223.20.in-addr.arpa
                IN PTR
              • flag-us
                DNS
                201.83.221.88.in-addr.arpa
                Remote address:
                8.8.8.8:53
                Request
                201.83.221.88.in-addr.arpa
                IN PTR
                Response
                201.83.221.88.in-addr.arpa
                IN PTR
                a88-221-83-201deploystaticakamaitechnologiescom
              • flag-us
                DNS
                201.83.221.88.in-addr.arpa
                Remote address:
                8.8.8.8:53
                Request
                201.83.221.88.in-addr.arpa
                IN PTR
              • flag-us
                DNS
                13.227.111.52.in-addr.arpa
                Remote address:
                8.8.8.8:53
                Request
                13.227.111.52.in-addr.arpa
                IN PTR
                Response
              • 204.79.197.237:443
                https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8CBUdLNHYYbfm7P0Y7pKKWDVUCUw6zrTpNAwTxYHD_w6Rh8vOJDDB00I-Pn7yQFPDK-x7PCRjJ37AZYawQ33dloQQbx2CwgArhJnI5i0kDIQiw2WDbYqNFLaMYcr3On640HqJO4oIYPR8RW0KQpQDM3THUca_Tp3xzbNyZ-nIZ1EUNAxK%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZmNvbGxlZ2Utc3R1ZGVudC1wcmljaW5nJTNmb2NpZCUzZGNtbWZ1NndpMTY0%26rlid%3D66fe90a503a212b0da00f69e58f415a3&TIME=20240508T110110Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:D54583D0-B3DA-17FF-A437-0685003AFE48&deviceId=6966565253439182&muid=D54583D0B3DA17FFA4370685003AFE48
                tls, http2
                2.6kB
                 9.5kB
                 20
                16

                HTTP Request

                GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8CBUdLNHYYbfm7P0Y7pKKWDVUCUw6zrTpNAwTxYHD_w6Rh8vOJDDB00I-Pn7yQFPDK-x7PCRjJ37AZYawQ33dloQQbx2CwgArhJnI5i0kDIQiw2WDbYqNFLaMYcr3On640HqJO4oIYPR8RW0KQpQDM3THUca_Tp3xzbNyZ-nIZ1EUNAxK%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZmNvbGxlZ2Utc3R1ZGVudC1wcmljaW5nJTNmb2NpZCUzZGNtbWZ1NndpMTY0%26rlid%3D66fe90a503a212b0da00f69e58f415a3&TIME=20240508T110110Z&CID=531098720&EID=531098720&tids=15000&adUnitId=11730597&localId=w:D54583D0-B3DA-17FF-A437-0685003AFE48&deviceId=6966565253439182&muid=D54583D0B3DA17FFA4370685003AFE48

                HTTP Response

                204

                HTTP Request

                GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8CBUdLNHYYbfm7P0Y7pKKWDVUCUw6zrTpNAwTxYHD_w6Rh8vOJDDB00I-Pn7yQFPDK-x7PCRjJ37AZYawQ33dloQQbx2CwgArhJnI5i0kDIQiw2WDbYqNFLaMYcr3On640HqJO4oIYPR8RW0KQpQDM3THUca_Tp3xzbNyZ-nIZ1EUNAxK%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZmNvbGxlZ2Utc3R1ZGVudC1wcmljaW5nJTNmb2NpZCUzZGNtbWZ1NndpMTY0%26rlid%3D66fe90a503a212b0da00f69e58f415a3&TIME=20240508T110110Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:D54583D0-B3DA-17FF-A437-0685003AFE48&deviceId=6966565253439182&muid=D54583D0B3DA17FFA4370685003AFE48

                HTTP Response

                204
              • 88.221.83.201:443
                https://www.bing.com/aes/c.gif?RG=d9482cdfe46648bb808715da8e8ff266&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240508T110110Z&adUnitId=11730597&localId=w:D54583D0-B3DA-17FF-A437-0685003AFE48&deviceId=6966565253439182
                tls, http2
                1.5kB
                 5.3kB
                 17
                10

                HTTP Request

                GET https://www.bing.com/aes/c.gif?RG=d9482cdfe46648bb808715da8e8ff266&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240508T110110Z&adUnitId=11730597&localId=w:D54583D0-B3DA-17FF-A437-0685003AFE48&deviceId=6966565253439182

                HTTP Response

                200
              • 77.91.68.61:80
                pdates.exe
                260 B
                 5
              • 77.91.124.84:19071
                j6935570.exe
                260 B
                 5
              • 77.91.124.84:19071
                j6935570.exe
                260 B
                 5
              • 77.91.68.61:80
                pdates.exe
                260 B
                 5
              • 77.91.124.84:19071
                j6935570.exe
                260 B
                 5
              • 77.91.68.61:80
                pdates.exe
                260 B
                 5
              • 77.91.124.84:19071
                j6935570.exe
                260 B
                 5
              • 77.91.124.84:19071
                j6935570.exe
                260 B
                 5
              • 77.91.124.84:19071
                j6935570.exe
                208 B
                 4
              • 8.8.8.8:53
                g.bing.com
                dns
                56 B
                 151 B
                 1
                1

                DNS Request

                g.bing.com

                DNS Response

                204.79.197.237
                13.107.21.237

              • 8.8.8.8:53
                8.8.8.8.in-addr.arpa
                dns
                66 B
                 90 B
                 1
                1

                DNS Request

                8.8.8.8.in-addr.arpa

              • 8.8.8.8:53
                237.197.79.204.in-addr.arpa
                dns
                73 B
                 143 B
                 1
                1

                DNS Request

                237.197.79.204.in-addr.arpa

              • 8.8.8.8:53
                79.190.18.2.in-addr.arpa
                dns
                70 B
                 133 B
                 1
                1

                DNS Request

                79.190.18.2.in-addr.arpa

              • 8.8.8.8:53
                26.35.223.20.in-addr.arpa
                dns
                142 B
                 157 B
                 2
                1

                DNS Request

                26.35.223.20.in-addr.arpa

                DNS Request

                26.35.223.20.in-addr.arpa

              • 8.8.8.8:53
                17.160.190.20.in-addr.arpa
                dns
                144 B
                 158 B
                 2
                1

                DNS Request

                17.160.190.20.in-addr.arpa

                DNS Request

                17.160.190.20.in-addr.arpa

              • 8.8.8.8:53
                201.83.221.88.in-addr.arpa
                dns
                144 B
                 137 B
                 2
                1

                DNS Request

                201.83.221.88.in-addr.arpa

                DNS Request

                201.83.221.88.in-addr.arpa

              • 8.8.8.8:53
                13.227.111.52.in-addr.arpa
                dns
                72 B
                 158 B
                 1
                1

                DNS Request

                13.227.111.52.in-addr.arpa

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\j6935570.exe
                Filesize

                174KB

                MD5

                b9b326df936041afe740e52293cd89e5

                SHA1

                91b8c4a97b2a09fdc30fadbe95eb26b64947e6cb

                SHA256

                b3f51ad219c924a14b0461a475e030dade3c4b8176376fd855c90c0300d70185

                SHA512

                d1f20bca31b33e7df3e94a1a5d194738fb968d3d637b2fd4a851ce70a1392b48218d208ac31398b52608678b934a17e9095e1653cfbbdb9b250ad56b0d0633b8

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x0096760.exe
                Filesize

                234KB

                MD5

                c44e5c1dbc033b88b23bfd9c2265aec0

                SHA1

                746ba7772a23637a08499675b52c85928ebdd364

                SHA256

                892a8cab1020cfab60d998bf5ace63d960dced1c6a4f047d910eeaf729021bb8

                SHA512

                0ae27e9cb9bed8aabf871eaab509142ecaf024f96dcd79f256388bdd1044c5ad788a4b6da7d470c9cd4871b917d27d4cb765dba398b167d00dfe3e299d45bbbf

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\g3294115.exe
                Filesize

                223KB

                MD5

                aea234064483f651010cf9d981f59fea

                SHA1

                002ad73a666d2d92d0c6d6b617e61c6fa0c5f3a6

                SHA256

                58b02c8b4bc2bf7f5f1e8e45d7c206956f188ae56b648922ca75987b999db503

                SHA512

                eae415ef55aeb1b4548c2422a72e618fce17c2c1322918d33dc6b9202a01c743a5684ba28e5d83b6cdb2b703bc12569e6bb0e87ef2decb4e8a18592e1380a434

                Download Submit

              • C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\h4606134.exe
                Filesize

                11KB

                MD5

                7e93bacbbc33e6652e147e7fe07572a0

                SHA1

                421a7167da01c8da4dc4d5234ca3dd84e319e762

                SHA256

                850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

                SHA512

                250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

                Download Submit

              • memory/1968-27-0x0000000000660000-0x000000000066A000-memory.dmp

                Filesize

                40KB

                Download

              • memory/3228-32-0x0000000000BF0000-0x0000000000C20000-memory.dmp

                Filesize

                192KB

                Download

              • memory/3228-33-0x0000000001450000-0x0000000001456000-memory.dmp

                Filesize

                24KB

                Download

              • memory/3228-34-0x000000000AFA0000-0x000000000B5B8000-memory.dmp

                Filesize

                6.1MB

                Download

              • memory/3228-35-0x000000000AA90000-0x000000000AB9A000-memory.dmp

                Filesize

                1.0MB

                Download

              • memory/3228-36-0x000000000A9A0000-0x000000000A9B2000-memory.dmp

                Filesize

                72KB

                Download

              • memory/3228-37-0x000000000AA00000-0x000000000AA3C000-memory.dmp

                Filesize

                240KB

                Download

              • memory/3228-38-0x0000000002EC0000-0x0000000002F0C000-memory.dmp

                Filesize

                304KB

                Download

              We care about your privacy.

              This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.