Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
1!ŞetUp_92...ot.dll
windows7-x64
1!ŞetUp_92...ot.dll
windows10-2004-x64
1!ŞetUp_92...ee.dll
windows7-x64
1!ŞetUp_92...ee.dll
windows10-2004-x64
1!ŞetUp_92...up.exe
windows7-x64
10!ŞetUp_92...up.exe
windows10-2004-x64
10!ŞetUp_92...se.dll
windows7-x64
1!ŞetUp_92...se.dll
windows10-2004-x64
1!ŞetUp_92...-0.dll
windows10-2004-x64
1!ŞetUp_92...-0.dll
windows10-2004-x64
1!ŞetUp_92...-0.dll
windows10-2004-x64
1!ŞetUp_92...-0.dll
windows10-2004-x64
1!ŞetUp_92...-0.dll
windows10-2004-x64
1acdbase.dll
windows7-x64
1acdbase.dll
windows10-2004-x64
1api-ms-win...-0.dll
windows10-2004-x64
1api-ms-win...-0.dll
windows10-2004-x64
1api-ms-win...-0.dll
windows10-2004-x64
1api-ms-win...-0.dll
windows10-2004-x64
1api-ms-win...-0.dll
windows10-2004-x64
1api-ms-win...-0.dll
windows10-2004-x64
1api-ms-win...-0.dll
windows10-2004-x64
1api-ms-win...-0.dll
windows10-2004-x64
1assured.doc
windows7-x64
1assured.doc
windows10-2004-x64
1ezcd.exe
windows7-x64
10ezcd.exe
windows10-2004-x64
10libmmd.dll
windows7-x64
1libmmd.dll
windows10-2004-x64
1vcruntime140.dll
windows7-x64
1vcruntime140.dll
windows10-2004-x64
1!ŞetUp_92...-0.dll
windows10-2004-x64
1Analysis
-
max time kernel
93s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2024, 01:03 UTC
Static task
static1
Behavioral task
behavioral1
Sample
!ŞetUp_92517--#PaSꞨKḙy#$$/AbRoot.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
!ŞetUp_92517--#PaSꞨKḙy#$$/AbRoot.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
!ŞetUp_92517--#PaSꞨKḙy#$$/AdTree.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
!ŞetUp_92517--#PaSꞨKḙy#$$/AdTree.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
!ŞetUp_92517--#PaSꞨKḙy#$$/Setup.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
!ŞetUp_92517--#PaSꞨKḙy#$$/Setup.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
!ŞetUp_92517--#PaSꞨKḙy#$$/acdbase.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
!ŞetUp_92517--#PaSꞨKḙy#$$/acdbase.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
!ŞetUp_92517--#PaSꞨKḙy#$$/api-ms-win-crt-convert-l1-1-0.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral10
Sample
!ŞetUp_92517--#PaSꞨKḙy#$$/api-ms-win-crt-environment-l1-1-0.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
!ŞetUp_92517--#PaSꞨKḙy#$$/api-ms-win-crt-heap-l1-1-0.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral12
Sample
!ŞetUp_92517--#PaSꞨKḙy#$$/api-ms-win-crt-runtime-l1-1-0.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
!ŞetUp_92517--#PaSꞨKḙy#$$/api-ms-win-crt-stdio-l1-1-0.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral14
Sample
acdbase.dll
Resource
win7-20240708-en
Behavioral task
behavioral15
Sample
acdbase.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral16
Sample
api-ms-win-crt-convert-l1-1-0.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
api-ms-win-crt-environment-l1-1-0.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral18
Sample
api-ms-win-crt-heap-l1-1-0.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
api-ms-win-crt-runtime-l1-1-0.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral20
Sample
api-ms-win-crt-stdio-l1-1-0.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
api-ms-win-crt-string-l1-1-0.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral22
Sample
api-ms-win-crt-time-l1-1-0.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
api-ms-win-crt-utility-l1-1-0.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral24
Sample
assured.doc
Resource
win7-20240704-en
Behavioral task
behavioral25
Sample
assured.doc
Resource
win10v2004-20240709-en
Behavioral task
behavioral26
Sample
ezcd.exe
Resource
win7-20240704-en
Behavioral task
behavioral27
Sample
ezcd.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral28
Sample
libmmd.dll
Resource
win7-20240704-en
Behavioral task
behavioral29
Sample
libmmd.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral30
Sample
vcruntime140.dll
Resource
win7-20240705-en
Behavioral task
behavioral31
Sample
vcruntime140.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral32
Sample
!ŞetUp_92517--#PaSꞨKḙy#$$/api-ms-win-crt-string-l1-1-0.dll
Resource
win10v2004-20240709-en
General
-
Target
acdbase.dll
-
Size
2.9MB
-
MD5
dace23695dcfa0f7309b65366ac75bc0
-
SHA1
c5b1bad2dec36852fae90f81f0dbd00518479c01
-
SHA256
cf8b85beeff99b13d06ed15c79e555ab74e30dfa1491a36c4332f54ed09887e4
-
SHA512
0e1e5fc158fb39c3c3c7733226cb846407cd01ca1c49800fb7668134ebef129ab43030f2768a8b149b5ba9a18b2d1b0f8bf23d1a8de487a482e9268e0b679bbb
-
SSDEEP
49152:yQzvI/48LzIpH2aTZ70W6pVLOVicH+4T7snimYvtgbgwvWgfFv5COWaUsz7XapvL:yrIpHGpVL7nimatSgSWhOWaUsz7XapvL
Malware Config
Signatures
Processes
Network
-
Remote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.dual-a-0034.a-msedge.netg-bing-com.dual-a-0034.a-msedge.netIN CNAMEdual-a-0034.a-msedge.netdual-a-0034.a-msedge.netIN A13.107.21.237dual-a-0034.a-msedge.netIN A204.79.197.237
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=7b432bc62f6c418487e45ff331f61049&localId=w:7644E81C-AD49-10CC-B943-5E44723BEB42&deviceId=6896204247012457&anid=Remote address:13.107.21.237:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=7b432bc62f6c418487e45ff331f61049&localId=w:7644E81C-AD49-10CC-B943-5E44723BEB42&deviceId=6896204247012457&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=0AE02D6074D36471295639D97533656A; domain=.bing.com; expires=Tue, 05-Aug-2025 01:04:16 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 4E3EDE74D4714A5C895F67D1083B726D Ref B: LON04EDGE1008 Ref C: 2024-07-11T01:04:16Z
date: Thu, 11 Jul 2024 01:04:16 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=7b432bc62f6c418487e45ff331f61049&localId=w:7644E81C-AD49-10CC-B943-5E44723BEB42&deviceId=6896204247012457&anid=Remote address:13.107.21.237:443RequestGET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=7b432bc62f6c418487e45ff331f61049&localId=w:7644E81C-AD49-10CC-B943-5E44723BEB42&deviceId=6896204247012457&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=0AE02D6074D36471295639D97533656A
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=TgMhdUx3e61IW63xagF3NavC93YaR61PZ1pRHEktST0; domain=.bing.com; expires=Tue, 05-Aug-2025 01:04:17 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: FC44B2E59DB342D09A2B5961DA6500E5 Ref B: LON04EDGE1008 Ref C: 2024-07-11T01:04:17Z
date: Thu, 11 Jul 2024 01:04:16 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=7b432bc62f6c418487e45ff331f61049&localId=w:7644E81C-AD49-10CC-B943-5E44723BEB42&deviceId=6896204247012457&anid=Remote address:13.107.21.237:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=7b432bc62f6c418487e45ff331f61049&localId=w:7644E81C-AD49-10CC-B943-5E44723BEB42&deviceId=6896204247012457&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=0AE02D6074D36471295639D97533656A; MSPTC=TgMhdUx3e61IW63xagF3NavC93YaR61PZ1pRHEktST0
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 0FEECB5914D64E21B485EDF1C33342BD Ref B: LON04EDGE1008 Ref C: 2024-07-11T01:04:17Z
date: Thu, 11 Jul 2024 01:04:16 GMT
-
Remote address:8.8.8.8:53Request73.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request237.21.107.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request103.169.127.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request81.144.22.2.in-addr.arpaIN PTRResponse81.144.22.2.in-addr.arpaIN PTRa2-22-144-81deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request11.227.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request11.227.111.52.in-addr.arpaIN PTR
-
13.107.21.237:443https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=7b432bc62f6c418487e45ff331f61049&localId=w:7644E81C-AD49-10CC-B943-5E44723BEB42&deviceId=6896204247012457&anid=tls, http22.0kB 9.3kB 22 19
HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=7b432bc62f6c418487e45ff331f61049&localId=w:7644E81C-AD49-10CC-B943-5E44723BEB42&deviceId=6896204247012457&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=7b432bc62f6c418487e45ff331f61049&localId=w:7644E81C-AD49-10CC-B943-5E44723BEB42&deviceId=6896204247012457&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=7b432bc62f6c418487e45ff331f61049&localId=w:7644E81C-AD49-10CC-B943-5E44723BEB42&deviceId=6896204247012457&anid=HTTP Response
204
-
56 B 151 B 1 1
DNS Request
g.bing.com
DNS Response
13.107.21.237204.79.197.237
-
72 B 158 B 1 1
DNS Request
73.159.190.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
237.21.107.13.in-addr.arpa
-
73 B 147 B 1 1
DNS Request
103.169.127.40.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
171.39.242.20.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
81.144.22.2.in-addr.arpa
-
144 B 158 B 2 1
DNS Request
11.227.111.52.in-addr.arpa
DNS Request
11.227.111.52.in-addr.arpa