Overview

overview

10

Static

static

10

Setup (1).exe

windows7-x64

1

Setup (1).exe

windows10-2004-x64

1

Setup (10).exe

windows7-x64

1

Setup (10).exe

windows10-2004-x64

1

Setup (11).exe

windows7-x64

1

Setup (11).exe

windows10-2004-x64

1

Setup (12).exe

windows7-x64

1

Setup (12).exe

windows10-2004-x64

1

Setup (13).exe

windows7-x64

1

Setup (13).exe

windows10-2004-x64

1

Setup (14).exe

windows7-x64

1

Setup (14).exe

windows10-2004-x64

1

Setup (15).exe

windows7-x64

1

Setup (15).exe

windows10-2004-x64

1

Setup (16).exe

windows7-x64

1

Setup (16).exe

windows10-2004-x64

1

Setup (17).exe

windows7-x64

1

Setup (17).exe

windows10-2004-x64

1

Setup (18).exe

windows7-x64

1

Setup (18).exe

windows10-2004-x64

1

Setup (19).exe

windows7-x64

1

Setup (19).exe

windows10-2004-x64

1

Setup (2).exe

windows7-x64

1

Setup (2).exe

windows10-2004-x64

1

Setup (20).exe

windows7-x64

1

Setup (20).exe

windows10-2004-x64

1

Setup (21).exe

windows7-x64

1

Setup (21).exe

windows10-2004-x64

1

Setup (22).exe

windows7-x64

1

Setup (22).exe

windows10-2004-x64

1

Setup (23).exe

windows7-x64

1

Setup (23).exe

windows10-2004-x64

1

Resubmissions

15/10/2024, 15:36 UTC

241015-s1zlzasdkc 10

01/07/2024, 18:32 UTC

240701-w6yteawhmq 10

01/07/2024, 14:52 UTC

240701-r82wmaxdnd 10

01/07/2024, 14:52 UTC

240701-r8syqa1dpp 10

11/03/2024, 21:22 UTC

240311-z8dsssgg58 10

01/09/2021, 13:18 UTC

210901-5bmxjspa5s 10

01/09/2021, 13:04 UTC

210901-te4btfspqa 10

01/09/2021, 05:12 UTC

210901-4wnkwm1p3j 10

31/08/2021, 21:47 UTC

210831-41rp97dma2 10

Analysis

  • max time kernel
    134s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/07/2024, 14:52 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Setup (19).exe

  • Size

    631KB

  • MD5

    cb927513ff8ebff4dd52a47f7e42f934

  • SHA1

    0de47c02a8adc4940a6c18621b4e4a619641d029

  • SHA256

    fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f

  • SHA512

    988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c

  • SSDEEP

    12288:0qtavSvIGmVujfIzEQlzlmgGak6H3lP3XJik0YhBhrj05:0qsVrYyl876j0KDrj05

Score
1/10

Malware Config

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup (19).exe
    "C:\Users\Admin\AppData\Local\Temp\Setup (19).exe"
    1⤵
      PID:464
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4472,i,7869973516895866428,11647313872437892197,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:8
      1⤵
        PID:4976

      Network

      • flag-us
        DNS
        241.150.49.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        241.150.49.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        203.107.17.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        203.107.17.2.in-addr.arpa
        IN PTR
        Response
        203.107.17.2.in-addr.arpa
        IN PTR
        a2-17-107-203deploystaticakamaitechnologiescom
      • flag-us
        DNS
        g.bing.com
        Remote address:
        8.8.8.8:53
        Request
        g.bing.com
        IN A
        Response
        g.bing.com
        IN CNAME
        g-bing-com.dual-a-0034.a-msedge.net
        g-bing-com.dual-a-0034.a-msedge.net
        IN CNAME
        dual-a-0034.a-msedge.net
        dual-a-0034.a-msedge.net
        IN A
        13.107.21.237
        dual-a-0034.a-msedge.net
        IN A
        204.79.197.237
      • flag-us
        GET
        https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8ngJn8OhNw7dstVmY8-M37zVUCUydmbmYipy1sQEiynOR_EncIXG3rnrst7D2z1Sg5Jwf16EaCf6229A7TK_macPdnHK7R15Bz2c8jmPlmzVCw52oX5cDgywL2BfpTYg_umDMRhWqJtpYidIkGydZO4ilTNUEYwWlIPjRJBOQrcadnKyR%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZm9uZWRyaXZlLmxpdmUuY29tJTJmJTNmb2NpZCUzZGNtbTA3YjdkbnU0%26rlid%3D95ab6cafbb551c3a17610ac76e777707&TIME=20240611T225302Z&CID=531098720&EID=531098720&tids=15000&adUnitId=11730597&localId=w:8CE4F47C-62C1-CBA1-6083-4AA98427395E&deviceId=6825835407638640&muid=8CE4F47C62C1CBA160834AA98427395E
        Remote address:
        13.107.21.237:443
        Request
        GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8ngJn8OhNw7dstVmY8-M37zVUCUydmbmYipy1sQEiynOR_EncIXG3rnrst7D2z1Sg5Jwf16EaCf6229A7TK_macPdnHK7R15Bz2c8jmPlmzVCw52oX5cDgywL2BfpTYg_umDMRhWqJtpYidIkGydZO4ilTNUEYwWlIPjRJBOQrcadnKyR%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZm9uZWRyaXZlLmxpdmUuY29tJTJmJTNmb2NpZCUzZGNtbTA3YjdkbnU0%26rlid%3D95ab6cafbb551c3a17610ac76e777707&TIME=20240611T225302Z&CID=531098720&EID=531098720&tids=15000&adUnitId=11730597&localId=w:8CE4F47C-62C1-CBA1-6083-4AA98427395E&deviceId=6825835407638640&muid=8CE4F47C62C1CBA160834AA98427395E HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        set-cookie: MUID=26190AB740B568EE0CF61E18410E690A; domain=.bing.com; expires=Sat, 26-Jul-2025 14:52:43 GMT; path=/; SameSite=None; Secure; Priority=High;
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 23EC035E5AA5432789A2390348995C8A Ref B: LON04EDGE0815 Ref C: 2024-07-01T14:52:43Z
        date: Mon, 01 Jul 2024 14:52:43 GMT
      • flag-us
        GET
        https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8ngJn8OhNw7dstVmY8-M37zVUCUydmbmYipy1sQEiynOR_EncIXG3rnrst7D2z1Sg5Jwf16EaCf6229A7TK_macPdnHK7R15Bz2c8jmPlmzVCw52oX5cDgywL2BfpTYg_umDMRhWqJtpYidIkGydZO4ilTNUEYwWlIPjRJBOQrcadnKyR%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZm9uZWRyaXZlLmxpdmUuY29tJTJmJTNmb2NpZCUzZGNtbTA3YjdkbnU0%26rlid%3D95ab6cafbb551c3a17610ac76e777707&TIME=20240611T225302Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:8CE4F47C-62C1-CBA1-6083-4AA98427395E&deviceId=6825835407638640&muid=8CE4F47C62C1CBA160834AA98427395E
        Remote address:
        13.107.21.237:443
        Request
        GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8ngJn8OhNw7dstVmY8-M37zVUCUydmbmYipy1sQEiynOR_EncIXG3rnrst7D2z1Sg5Jwf16EaCf6229A7TK_macPdnHK7R15Bz2c8jmPlmzVCw52oX5cDgywL2BfpTYg_umDMRhWqJtpYidIkGydZO4ilTNUEYwWlIPjRJBOQrcadnKyR%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZm9uZWRyaXZlLmxpdmUuY29tJTJmJTNmb2NpZCUzZGNtbTA3YjdkbnU0%26rlid%3D95ab6cafbb551c3a17610ac76e777707&TIME=20240611T225302Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:8CE4F47C-62C1-CBA1-6083-4AA98427395E&deviceId=6825835407638640&muid=8CE4F47C62C1CBA160834AA98427395E HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=26190AB740B568EE0CF61E18410E690A; _EDGE_S=SID=23BBCCC7723E697615C4D868733868F6
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        set-cookie: MSPTC=Lz6kF7lFrZ0BTApcCVuYlc47OejbVpbi6CEjDaL6XUg; domain=.bing.com; expires=Sat, 26-Jul-2025 14:52:43 GMT; path=/; Partitioned; secure; SameSite=None
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 069F7E0709DC4B0ABBA8090CD9DF35D1 Ref B: LON04EDGE0815 Ref C: 2024-07-01T14:52:43Z
        date: Mon, 01 Jul 2024 14:52:43 GMT
      • flag-be
        GET
        https://www.bing.com/aes/c.gif?RG=e9d4a8df801741d29d7bc7d387147b7c&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240611T225302Z&adUnitId=11730597&localId=w:8CE4F47C-62C1-CBA1-6083-4AA98427395E&deviceId=6825835407638640
        Remote address:
        2.17.107.99:443
        Request
        GET /aes/c.gif?RG=e9d4a8df801741d29d7bc7d387147b7c&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240611T225302Z&adUnitId=11730597&localId=w:8CE4F47C-62C1-CBA1-6083-4AA98427395E&deviceId=6825835407638640 HTTP/2.0
        host: www.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=26190AB740B568EE0CF61E18410E690A
        Response
        HTTP/2.0 200
        cache-control: private,no-store
        pragma: no-cache
        vary: Origin
        p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 39B7F8EACBBC4DD4B1A50C97B5DF8E85 Ref B: LON212050702019 Ref C: 2024-07-01T14:52:43Z
        content-length: 0
        date: Mon, 01 Jul 2024 14:52:43 GMT
        set-cookie: _EDGE_S=SID=23BBCCC7723E697615C4D868733868F6; path=/; httponly; domain=bing.com
        set-cookie: MUIDB=26190AB740B568EE0CF61E18410E690A; path=/; httponly; expires=Sat, 26-Jul-2025 14:52:43 GMT
        alt-svc: h3=":443"; ma=93600
        x-cdn-traceid: 0.5f6b1102.1719845563.1013f89
      • flag-us
        DNS
        148.177.190.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        148.177.190.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        99.107.17.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        99.107.17.2.in-addr.arpa
        IN PTR
        Response
        99.107.17.2.in-addr.arpa
        IN PTR
        a2-17-107-99deploystaticakamaitechnologiescom
      • flag-us
        DNS
        209.205.72.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        209.205.72.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        50.23.12.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        50.23.12.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        56.126.166.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        56.126.166.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        31.251.17.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        31.251.17.2.in-addr.arpa
        IN PTR
        Response
        31.251.17.2.in-addr.arpa
        IN PTR
        a2-17-251-31deploystaticakamaitechnologiescom
      • flag-us
        DNS
        wfsdragon.ru
        Setup (19).exe
        Remote address:
        8.8.8.8:53
        Request
        wfsdragon.ru
        IN A
        Response
        wfsdragon.ru
        IN A
        172.67.133.215
        wfsdragon.ru
        IN A
        104.21.5.208
      • flag-us
        GET
        http://wfsdragon.ru/api/setStats.php
        Setup (19).exe
        Remote address:
        172.67.133.215:80
        Request
        GET /api/setStats.php HTTP/1.1
        Connection: Keep-Alive
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
        Host: wfsdragon.ru
        Response
        HTTP/1.1 404 Not Found
        Date: Mon, 01 Jul 2024 14:53:26 GMT
        Content-Type: text/html; charset=iso-8859-1
        Transfer-Encoding: chunked
        Connection: keep-alive
        CF-Cache-Status: DYNAMIC
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EwYDySrSorVUykAtRMtkzPki4EAIOE4iSzl8FRVpAOlcJHv%2FyDW%2F%2FMyVJM9PHUN9FVfvyJVfZjowACHuWL8%2BZbTXMl%2FR0yyLhbhdedl8L7%2BtRMqXtHOgFZmN%2F%2BvrTpA%3D"}],"group":"cf-nel","max_age":604800}
        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        Server: cloudflare
        CF-RAY: 89c739bfbb34778f-LHR
        alt-svc: h3=":443"; ma=86400
      • flag-us
        DNS
        215.133.67.172.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        215.133.67.172.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        30.243.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        30.243.111.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        88.210.23.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        88.210.23.2.in-addr.arpa
        IN PTR
        Response
        88.210.23.2.in-addr.arpa
        IN PTR
        a2-23-210-88deploystaticakamaitechnologiescom
      • flag-us
        DNS
        205.47.74.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        205.47.74.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        43.58.199.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        43.58.199.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        tse1.mm.bing.net
        Remote address:
        8.8.8.8:53
        Request
        tse1.mm.bing.net
        IN A
        Response
        tse1.mm.bing.net
        IN CNAME
        mm-mm.bing.net.trafficmanager.net
        mm-mm.bing.net.trafficmanager.net
        IN CNAME
        ax-0001.ax-msedge.net
        ax-0001.ax-msedge.net
        IN A
        150.171.28.10
        ax-0001.ax-msedge.net
        IN A
        150.171.27.10
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239370255189_1E7XE0SO5A57SENIS&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        Remote address:
        150.171.28.10:443
        Request
        GET /th?id=OADD2.10239370255189_1E7XE0SO5A57SENIS&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 634564
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: A5E0650F8AC14B6297B9BA463A36A92B Ref B: LON04EDGE1220 Ref C: 2024-07-01T14:54:22Z
        date: Mon, 01 Jul 2024 14:54:22 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239370639702_1LY06F7YB2ZF9D3G5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        Remote address:
        150.171.28.10:443
        Request
        GET /th?id=OADD2.10239370639702_1LY06F7YB2ZF9D3G5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 664406
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 2A0D2642CFE5428F9351F61F68D35FC4 Ref B: LON04EDGE1220 Ref C: 2024-07-01T14:54:22Z
        date: Mon, 01 Jul 2024 14:54:22 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239370639703_1XZVEAKL3PD7EZGL4&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        Remote address:
        150.171.28.10:443
        Request
        GET /th?id=OADD2.10239370639703_1XZVEAKL3PD7EZGL4&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 637660
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 9DB9D1C6FCC643BBBE9A663ACE3D0BC0 Ref B: LON04EDGE1220 Ref C: 2024-07-01T14:54:22Z
        date: Mon, 01 Jul 2024 14:54:22 GMT
      • flag-us
        DNS
        10.28.171.150.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        10.28.171.150.in-addr.arpa
        IN PTR
        Response
      • 13.107.21.237:443
        https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8ngJn8OhNw7dstVmY8-M37zVUCUydmbmYipy1sQEiynOR_EncIXG3rnrst7D2z1Sg5Jwf16EaCf6229A7TK_macPdnHK7R15Bz2c8jmPlmzVCw52oX5cDgywL2BfpTYg_umDMRhWqJtpYidIkGydZO4ilTNUEYwWlIPjRJBOQrcadnKyR%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZm9uZWRyaXZlLmxpdmUuY29tJTJmJTNmb2NpZCUzZGNtbTA3YjdkbnU0%26rlid%3D95ab6cafbb551c3a17610ac76e777707&TIME=20240611T225302Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:8CE4F47C-62C1-CBA1-6083-4AA98427395E&deviceId=6825835407638640&muid=8CE4F47C62C1CBA160834AA98427395E
        tls, http2
        2.4kB
         9.1kB
         19
        17

        HTTP Request

        GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8ngJn8OhNw7dstVmY8-M37zVUCUydmbmYipy1sQEiynOR_EncIXG3rnrst7D2z1Sg5Jwf16EaCf6229A7TK_macPdnHK7R15Bz2c8jmPlmzVCw52oX5cDgywL2BfpTYg_umDMRhWqJtpYidIkGydZO4ilTNUEYwWlIPjRJBOQrcadnKyR%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZm9uZWRyaXZlLmxpdmUuY29tJTJmJTNmb2NpZCUzZGNtbTA3YjdkbnU0%26rlid%3D95ab6cafbb551c3a17610ac76e777707&TIME=20240611T225302Z&CID=531098720&EID=531098720&tids=15000&adUnitId=11730597&localId=w:8CE4F47C-62C1-CBA1-6083-4AA98427395E&deviceId=6825835407638640&muid=8CE4F47C62C1CBA160834AA98427395E

        HTTP Response

        204

        HTTP Request

        GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8ngJn8OhNw7dstVmY8-M37zVUCUydmbmYipy1sQEiynOR_EncIXG3rnrst7D2z1Sg5Jwf16EaCf6229A7TK_macPdnHK7R15Bz2c8jmPlmzVCw52oX5cDgywL2BfpTYg_umDMRhWqJtpYidIkGydZO4ilTNUEYwWlIPjRJBOQrcadnKyR%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZm9uZWRyaXZlLmxpdmUuY29tJTJmJTNmb2NpZCUzZGNtbTA3YjdkbnU0%26rlid%3D95ab6cafbb551c3a17610ac76e777707&TIME=20240611T225302Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:8CE4F47C-62C1-CBA1-6083-4AA98427395E&deviceId=6825835407638640&muid=8CE4F47C62C1CBA160834AA98427395E

        HTTP Response

        204
      • 2.17.107.99:443
        https://www.bing.com/aes/c.gif?RG=e9d4a8df801741d29d7bc7d387147b7c&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240611T225302Z&adUnitId=11730597&localId=w:8CE4F47C-62C1-CBA1-6083-4AA98427395E&deviceId=6825835407638640
        tls, http2
        1.4kB
         5.3kB
         16
        13

        HTTP Request

        GET https://www.bing.com/aes/c.gif?RG=e9d4a8df801741d29d7bc7d387147b7c&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240611T225302Z&adUnitId=11730597&localId=w:8CE4F47C-62C1-CBA1-6083-4AA98427395E&deviceId=6825835407638640

        HTTP Response

        200
      • 37.0.8.235:80
        Setup (19).exe
        260 B
         5
      • 37.0.11.8:80
        Setup (19).exe
        260 B
         5
      • 172.67.133.215:80
        http://wfsdragon.ru/api/setStats.php
        http
        Setup (19).exe
        483 B
         2.0kB
         6
        5

        HTTP Request

        GET http://wfsdragon.ru/api/setStats.php

        HTTP Response

        404
      • 37.0.10.236:80
        Setup (19).exe
        260 B
         5
      • 150.171.28.10:443
        https://tse1.mm.bing.net/th?id=OADD2.10239370639703_1XZVEAKL3PD7EZGL4&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        tls, http2
        74.3kB
         2.0MB
         1467
        1465

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239370255189_1E7XE0SO5A57SENIS&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239370639702_1LY06F7YB2ZF9D3G5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239370639703_1XZVEAKL3PD7EZGL4&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

        HTTP Response

        200

        HTTP Response

        200

        HTTP Response

        200
      • 150.171.28.10:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         6.9kB
         15
        13
      • 150.171.28.10:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         6.9kB
         15
        13
      • 8.8.8.8:53
        241.150.49.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        241.150.49.20.in-addr.arpa

      • 8.8.8.8:53
        203.107.17.2.in-addr.arpa
        dns
        71 B
         135 B
         1
        1

        DNS Request

        203.107.17.2.in-addr.arpa

      • 8.8.8.8:53
        g.bing.com
        dns
        56 B
         151 B
         1
        1

        DNS Request

        g.bing.com

        DNS Response

        13.107.21.237
        204.79.197.237

      • 8.8.8.8:53
        148.177.190.20.in-addr.arpa
        dns
        73 B
         159 B
         1
        1

        DNS Request

        148.177.190.20.in-addr.arpa

      • 8.8.8.8:53
        99.107.17.2.in-addr.arpa
        dns
        70 B
         133 B
         1
        1

        DNS Request

        99.107.17.2.in-addr.arpa

      • 8.8.8.8:53
        209.205.72.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        209.205.72.20.in-addr.arpa

      • 8.8.8.8:53
        50.23.12.20.in-addr.arpa
        dns
        70 B
         156 B
         1
        1

        DNS Request

        50.23.12.20.in-addr.arpa

      • 8.8.8.8:53
        56.126.166.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        56.126.166.20.in-addr.arpa

      • 8.8.8.8:53
        31.251.17.2.in-addr.arpa
        dns
        70 B
         133 B
         1
        1

        DNS Request

        31.251.17.2.in-addr.arpa

      • 8.8.8.8:53
        wfsdragon.ru
        dns
        Setup (19).exe
        58 B
         90 B
         1
        1

        DNS Request

        wfsdragon.ru

        DNS Response

        172.67.133.215
        104.21.5.208

      • 8.8.8.8:53
        215.133.67.172.in-addr.arpa
        dns
        73 B
         135 B
         1
        1

        DNS Request

        215.133.67.172.in-addr.arpa

      • 8.8.8.8:53
        30.243.111.52.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        30.243.111.52.in-addr.arpa

      • 8.8.8.8:53
        88.210.23.2.in-addr.arpa
        dns
        70 B
         133 B
         1
        1

        DNS Request

        88.210.23.2.in-addr.arpa

      • 8.8.8.8:53
        205.47.74.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        205.47.74.20.in-addr.arpa

      • 8.8.8.8:53
        43.58.199.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        43.58.199.20.in-addr.arpa

      • 8.8.8.8:53
        tse1.mm.bing.net
        dns
        62 B
         170 B
         1
        1

        DNS Request

        tse1.mm.bing.net

        DNS Response

        150.171.28.10
        150.171.27.10

      • 8.8.8.8:53
        10.28.171.150.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        10.28.171.150.in-addr.arpa

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.