Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

a4e72afcbb...18.exe

windows7-x64

7

a4e72afcbb...18.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    139s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/08/2024, 01:44 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    a4e72afcbba0a33b9c835a5c9cd3dd61_JaffaCakes118.exe

  • Size

    252KB

  • MD5

    a4e72afcbba0a33b9c835a5c9cd3dd61

  • SHA1

    514efb73c73ae22c03e7f5cb6c8fc93f9ef1734d

  • SHA256

    e325ec0017ada8944dab98b5960f0611c8daa9a73a9382530ed946e39516c42e

  • SHA512

    518421208f9f3a939b4b164a1aaae546b7eeebe3d3b9007af9858f2e2f2d105e2dd5afdcdd49a41dd6c704aa7888322b7f41c9cdd659ce1691021a1533b02781

  • SSDEEP

    6144:91OgDPdkBAFZWjadD4sUAsUGvsLMeYxMk+Mcm71pq2hdm:91OgLdaC8xiK1pVdm

Score
7/10
adwarediscoveryspywarestealer

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NSIS installer 4 IoCs
    installer
  • Modifies registry class 63 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\a4e72afcbba0a33b9c835a5c9cd3dd61_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\a4e72afcbba0a33b9c835a5c9cd3dd61_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3648
    • C:\Users\Admin\AppData\Local\Temp\7zS2BFD.tmp\setup.exe
      .\setup.exe /s
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • System policy modification
      PID:4384
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4372,i,3239535018877284530,3457823197501312703,262144 --variations-seed-version --mojo-platform-channel-handle=1036 /prefetch:8
    1⤵
      PID:3884

    Network

    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
      Response
      8.8.8.8.in-addr.arpa
      IN PTR
      dnsgoogle
    • flag-us
      DNS
      232.168.11.51.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      232.168.11.51.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      g.bing.com
      Remote address:
      8.8.8.8:53
      Request
      g.bing.com
      IN A
      Response
      g.bing.com
      IN CNAME
      g-bing-com.dual-a-0034.a-msedge.net
      g-bing-com.dual-a-0034.a-msedge.net
      IN CNAME
      dual-a-0034.a-msedge.net
      dual-a-0034.a-msedge.net
      IN A
      204.79.197.237
      dual-a-0034.a-msedge.net
      IN A
      13.107.21.237
    • flag-us
      DNS
      g.bing.com
      Remote address:
      8.8.8.8:53
      Request
      g.bing.com
      IN A
    • flag-us
      DNS
      73.144.22.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      73.144.22.2.in-addr.arpa
      IN PTR
      Response
      73.144.22.2.in-addr.arpa
      IN PTR
      a2-22-144-73deploystaticakamaitechnologiescom
    • flag-us
      GET
      https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=224b1bec452d40ba878fa3331e9fa55c&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid=
      Remote address:
      204.79.197.237:443
      Request
      GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=224b1bec452d40ba878fa3331e9fa55c&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid= HTTP/2.0
      host: g.bing.com
      accept-encoding: gzip, deflate
      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
      Response
      HTTP/2.0 204
      cache-control: no-cache, must-revalidate
      pragma: no-cache
      expires: Fri, 01 Jan 1990 00:00:00 GMT
      set-cookie: MUID=3DF44E2249F26F31332C5AFD48126E06; domain=.bing.com; expires=Fri, 12-Sep-2025 01:45:18 GMT; path=/; SameSite=None; Secure; Priority=High;
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      access-control-allow-origin: *
      x-cache: CONFIG_NOCACHE
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: F7AF3B366ED6405C8DF03076AE537C7F Ref B: LON04EDGE1218 Ref C: 2024-08-18T01:45:18Z
      date: Sun, 18 Aug 2024 01:45:18 GMT
    • flag-us
      GET
      https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=224b1bec452d40ba878fa3331e9fa55c&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid=
      Remote address:
      204.79.197.237:443
      Request
      GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=224b1bec452d40ba878fa3331e9fa55c&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid= HTTP/2.0
      host: g.bing.com
      accept-encoding: gzip, deflate
      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
      cookie: MUID=3DF44E2249F26F31332C5AFD48126E06
      Response
      HTTP/2.0 204
      cache-control: no-cache, must-revalidate
      pragma: no-cache
      expires: Fri, 01 Jan 1990 00:00:00 GMT
      set-cookie: MSPTC=wum8Nwn65AbMcHQ9pKnuRliJhRO57QKmY6OyGutP4lY; domain=.bing.com; expires=Fri, 12-Sep-2025 01:45:19 GMT; path=/; Partitioned; secure; SameSite=None
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      access-control-allow-origin: *
      x-cache: CONFIG_NOCACHE
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 7848103C533047CB95B12B5AFDC4DA8D Ref B: LON04EDGE1218 Ref C: 2024-08-18T01:45:19Z
      date: Sun, 18 Aug 2024 01:45:19 GMT
    • flag-us
      GET
      https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=224b1bec452d40ba878fa3331e9fa55c&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid=
      Remote address:
      204.79.197.237:443
      Request
      GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=224b1bec452d40ba878fa3331e9fa55c&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid= HTTP/2.0
      host: g.bing.com
      accept-encoding: gzip, deflate
      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
      cookie: MUID=3DF44E2249F26F31332C5AFD48126E06; MSPTC=wum8Nwn65AbMcHQ9pKnuRliJhRO57QKmY6OyGutP4lY
      Response
      HTTP/2.0 204
      cache-control: no-cache, must-revalidate
      pragma: no-cache
      expires: Fri, 01 Jan 1990 00:00:00 GMT
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      access-control-allow-origin: *
      x-cache: CONFIG_NOCACHE
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: DA69B1B3D571421EA9A543FE48189F72 Ref B: LON04EDGE1218 Ref C: 2024-08-18T01:45:19Z
      date: Sun, 18 Aug 2024 01:45:19 GMT
    • flag-us
      DNS
      133.32.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      133.32.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      237.197.79.204.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      237.197.79.204.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      237.197.79.204.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      237.197.79.204.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      237.197.79.204.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      237.197.79.204.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      43.58.199.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      43.58.199.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      43.58.199.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      43.58.199.20.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      104.219.191.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      104.219.191.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      28.118.140.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      28.118.140.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      183.59.114.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      183.59.114.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      198.187.3.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      198.187.3.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      50.23.12.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      50.23.12.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.214.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.214.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      11.227.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      11.227.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      81.144.22.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      81.144.22.2.in-addr.arpa
      IN PTR
      Response
      81.144.22.2.in-addr.arpa
      IN PTR
      a2-22-144-81deploystaticakamaitechnologiescom
    • flag-us
      DNS
      26.35.223.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      26.35.223.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      tse1.mm.bing.net
      Remote address:
      8.8.8.8:53
      Request
      tse1.mm.bing.net
      IN A
      Response
      tse1.mm.bing.net
      IN CNAME
      mm-mm.bing.net.trafficmanager.net
      mm-mm.bing.net.trafficmanager.net
      IN CNAME
      ax-0001.ax-msedge.net
      ax-0001.ax-msedge.net
      IN A
      150.171.28.10
      ax-0001.ax-msedge.net
      IN A
      150.171.27.10
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239340418538_115TEFRTVWJF1SFIA&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
      Remote address:
      150.171.28.10:443
      Request
      GET /th?id=OADD2.10239340418538_115TEFRTVWJF1SFIA&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 693178
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 3AFAAD36264A4D03BCCFFBCE1BE65685 Ref B: LON04EDGE0806 Ref C: 2024-08-18T01:46:54Z
      date: Sun, 18 Aug 2024 01:46:53 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239340418537_1WA44EQA64JN0VKE0&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
      Remote address:
      150.171.28.10:443
      Request
      GET /th?id=OADD2.10239340418537_1WA44EQA64JN0VKE0&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 578826
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: A5309A13B461403B8790183A691DC7F2 Ref B: LON04EDGE0806 Ref C: 2024-08-18T01:46:54Z
      date: Sun, 18 Aug 2024 01:46:53 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239339388126_1L4W1T5VFYTHU9QO3&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
      Remote address:
      150.171.28.10:443
      Request
      GET /th?id=OADD2.10239339388126_1L4W1T5VFYTHU9QO3&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239339388125_1VMOONLDU1IFR4WEP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
      Remote address:
      150.171.28.10:443
      Request
      GET /th?id=OADD2.10239339388125_1VMOONLDU1IFR4WEP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239317301246_1WJH3TXXVOGBRWUGS&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
      Remote address:
      150.171.28.10:443
      Request
      GET /th?id=OADD2.10239317301246_1WJH3TXXVOGBRWUGS&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    • flag-us
      DNS
      10.28.171.150.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      10.28.171.150.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      10.28.171.150.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      10.28.171.150.in-addr.arpa
      IN PTR
    • 204.79.197.237:443
      https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=224b1bec452d40ba878fa3331e9fa55c&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid=
      tls, http2
      2.9kB
       10.5kB
       27
      22

      HTTP Request

      GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=224b1bec452d40ba878fa3331e9fa55c&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid=

      HTTP Response

      204

      HTTP Request

      GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=224b1bec452d40ba878fa3331e9fa55c&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid=

      HTTP Response

      204

      HTTP Request

      GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=224b1bec452d40ba878fa3331e9fa55c&localId=w:C1C7FDA1-57D8-3617-175E-F6F87939E990&deviceId=6755468654767491&anid=

      HTTP Response

      204
    • 150.171.28.10:443
      tse1.mm.bing.net
      tls, http2
      1.5kB
       6.8kB
       16
      11
    • 150.171.28.10:443
      https://tse1.mm.bing.net/th?id=OADD2.10239317301246_1WJH3TXXVOGBRWUGS&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
      tls, http2
      24.8kB
       588.4kB
       447
      440

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239340418538_115TEFRTVWJF1SFIA&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239340418537_1WA44EQA64JN0VKE0&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239339388126_1L4W1T5VFYTHU9QO3&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239339388125_1VMOONLDU1IFR4WEP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239317301246_1WJH3TXXVOGBRWUGS&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

      HTTP Response

      200

      HTTP Response

      200
    • 150.171.28.10:443
      tse1.mm.bing.net
      tls, http2
      1.5kB
       6.9kB
       16
      12
    • 150.171.28.10:443
      tse1.mm.bing.net
      tls, http2
      1.1kB
       6.9kB
       14
      13
    • 150.171.28.10:443
      tse1.mm.bing.net
      tls, http2
      1.1kB
       6.9kB
       14
      13
    • 8.8.8.8:53
      8.8.8.8.in-addr.arpa
      dns
      66 B
       90 B
       1
      1

      DNS Request

      8.8.8.8.in-addr.arpa

    • 8.8.8.8:53
      232.168.11.51.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      232.168.11.51.in-addr.arpa

    • 8.8.8.8:53
      g.bing.com
      dns
      112 B
       151 B
       2
      1

      DNS Request

      g.bing.com

      DNS Request

      g.bing.com

      DNS Response

      204.79.197.237
      13.107.21.237

    • 8.8.8.8:53
      73.144.22.2.in-addr.arpa
      dns
      70 B
       133 B
       1
      1

      DNS Request

      73.144.22.2.in-addr.arpa

    • 8.8.8.8:53
      133.32.126.40.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      133.32.126.40.in-addr.arpa

    • 8.8.8.8:53
      237.197.79.204.in-addr.arpa
      dns
      219 B
       143 B
       3
      1

      DNS Request

      237.197.79.204.in-addr.arpa

      DNS Request

      237.197.79.204.in-addr.arpa

      DNS Request

      237.197.79.204.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      219 B
       144 B
       3
      1

      DNS Request

      95.221.229.192.in-addr.arpa

      DNS Request

      95.221.229.192.in-addr.arpa

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      43.58.199.20.in-addr.arpa
      dns
      142 B
       157 B
       2
      1

      DNS Request

      43.58.199.20.in-addr.arpa

      DNS Request

      43.58.199.20.in-addr.arpa

    • 8.8.8.8:53
      104.219.191.52.in-addr.arpa
      dns
      73 B
       147 B
       1
      1

      DNS Request

      104.219.191.52.in-addr.arpa

    • 8.8.8.8:53
      28.118.140.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      28.118.140.52.in-addr.arpa

    • 8.8.8.8:53
      183.59.114.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      183.59.114.20.in-addr.arpa

    • 8.8.8.8:53
      198.187.3.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      198.187.3.20.in-addr.arpa

    • 8.8.8.8:53
      50.23.12.20.in-addr.arpa
      dns
      70 B
       156 B
       1
      1

      DNS Request

      50.23.12.20.in-addr.arpa

    • 8.8.8.8:53
      172.214.232.199.in-addr.arpa
      dns
      74 B
       128 B
       1
      1

      DNS Request

      172.214.232.199.in-addr.arpa

    • 8.8.8.8:53
      11.227.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      11.227.111.52.in-addr.arpa

    • 8.8.8.8:53
      81.144.22.2.in-addr.arpa
      dns
      70 B
       133 B
       1
      1

      DNS Request

      81.144.22.2.in-addr.arpa

    • 8.8.8.8:53
      26.35.223.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      26.35.223.20.in-addr.arpa

    • 8.8.8.8:53
      tse1.mm.bing.net
      dns
      62 B
       170 B
       1
      1

      DNS Request

      tse1.mm.bing.net

      DNS Response

      150.171.28.10
      150.171.27.10

    • 8.8.8.8:53
      10.28.171.150.in-addr.arpa
      dns
      144 B
       158 B
       2
      1

      DNS Request

      10.28.171.150.in-addr.arpa

      DNS Request

      10.28.171.150.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\wxDfast\uninstall.exe
      Filesize

      46KB

      MD5

      8be20144dbd200c6de0c9430ed9280cf

      SHA1

      b81e3aacaaedd66ef0896acabc6983c94758e2b4

      SHA256

      634557ab79a29fe800721bc5f146a9b86799b72eb6755e821492f85ca66818a6

      SHA512

      fd7db954002be6332c8c6f4500fc38c1d5286022bb56f21b97567e837ee3d5a3c6db08cabcd2ffe405e7180918d6bb0b57b330703a9d045851901d01115ff94e

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\7zS2BFD.tmp\503528b488533@503528b48856c.info\bootstrap.js
      Filesize

      2KB

      MD5

      b9165e81934c746e3a33afc6bde86143

      SHA1

      ce38f37d26d5fa6309f4d42cbf470bc4a884b100

      SHA256

      3edbe3448cc74e7862db06fb08a8250c044a6aadbbea35a365560080eaaa3624

      SHA512

      fab8731e561554bf3ac4a32950a4111d3bca7d9223727ed6eccca598777bd697606a11f658eae3d28f6dae16faf40fda7387d0e25cd8f3cb750c871f77178bc8

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\7zS2BFD.tmp\503528b488533@503528b48856c.info\chrome.manifest
      Filesize

      116B

      MD5

      2a4716be09fd70eea38dca92f81578c0

      SHA1

      41000f978afede7715d28a9396ce6ddb40d83aef

      SHA256

      7ca4468d8c949729b59abfc9106587df7158e1f8c07fbbdbc8d31cef4434510b

      SHA512

      24349f5875b621a1148aa33b04333cd30a92f98768b7f91fe3b4516fe7d6f0c63003b48c747437a24998debdbd53b97e74445af909fe08e2da5271b5b0e78285

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\7zS2BFD.tmp\503528b488533@503528b48856c.info\content\bg.js
      Filesize

      8KB

      MD5

      b93a5742ff2f7d3725ce388a2ee66466

      SHA1

      fb56b1d563f4885e6af8849e30d8e3f4ffe5d0c5

      SHA256

      43343af7a318d429ba4c236ceb6f773d0c5b2414697178d0fcfd8242793c6b19

      SHA512

      9f62f0c9e79a423905087a8471ce16d43bb5ed93fe3780967896c49302dce29b1b85417a67afc0d72cb3f3a6338ea39670b9af2f96fcff8b4ca1b84671fdbe47

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\7zS2BFD.tmp\503528b488533@503528b48856c.info\content\zy.xul
      Filesize

      225B

      MD5

      47b58cafae456d4a1719dca040e12c1f

      SHA1

      8e29a74ae06be70ffa63d32291a16879a023c90e

      SHA256

      34ffbfcee7e2495a23cd7cd24ff7675b728d31e1a1024ec9cefb9cfac0a6b333

      SHA512

      08d598eeed5e09f12044695a9ab900e8d27263a5c973b2307d6fab8126402cbb534557d8f14ce29c64bbefbfd55ceb290ad18559f52337323e2e22d2a1475636

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\7zS2BFD.tmp\503528b488533@503528b48856c.info\install.rdf
      Filesize

      714B

      MD5

      c5e93e58b92ace85dbb42bd81073b5a9

      SHA1

      11793f2dd606c988da6bc23ca1040f698e8316c0

      SHA256

      6417c25408208ce362a8e5302d56f2c2ee44359b20b6f2c4a66a7a27879a1590

      SHA512

      0919f142fe85822ecd1a5c2ef89fddcd5c9d9fcd5e09cc9101768b3ef721700987cacfc46d1c584649f09ba22399f551369820c55a3107e502f37c9558dc45d6

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\7zS2BFD.tmp\background.html
      Filesize

      4KB

      MD5

      9e6abef3f4aa4695e296087a6c4ee38f

      SHA1

      609b45b728bc5bbc33979c93abe3ce3e32371b3c

      SHA256

      274f12a599da3dbbdf1b9953282b456c048b10da68f2211c56d747ad1a6b6878

      SHA512

      d4fa1f703dc0ad33d43b89d80d00342148e264a0fffb909b71a7363421ee4ed4a83ac9dd51550e1bf27483a40d6b96d5dc42e0edcec8f1206cc3d0a57049e8cf

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\7zS2BFD.tmp\bhoclass.dll
      Filesize

      139KB

      MD5

      4b35f6c1f932f52fa9901fbc47b432df

      SHA1

      8e842bf068b04f36475a3bf86c5ea6a9839bbb5e

      SHA256

      2b4d643a8a14f060bf3885f872b36e5e1fe1e777ad94783ba9593487c8e1f196

      SHA512

      8716b9a8e46933bf29348254a68d1a21392bdbbe3b4d5010e55fe638d02cc04eb685e424d440f7c5b58ffbca82e5772dd95bef73fa831595c2ae9599f3b05a99

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\7zS2BFD.tmp\content.js
      Filesize

      385B

      MD5

      024402c9b5ac2c9813e7d8293baf8c7e

      SHA1

      1f0b838048be3a8636139cdf1fb426f3922e5df9

      SHA256

      7ff5672cd7782997d4fbd4cecefe866b36ecfdbd0b07e5fb317a7d4353fd026d

      SHA512

      f15ab5215bb953a4585646e56b09275657491755b7c51ba370b1ec099b0b907cfb5149fc8dcae7d83f7bc6d30af9a0df97ca0f071ffd77a23d0ce930f4aa31a5

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\7zS2BFD.tmp\pekphkjihkedkobdibbdiphlpjkfachb.crx
      Filesize

      3KB

      MD5

      df04de5fe175142d0ac02d97e1b3c263

      SHA1

      7f622fa8ae8401c80ff71305f244fd1ddfa894b9

      SHA256

      80896fb0ebe0f189f976900723f47886250c5edbdd0583c4e25ee1ca21f34cb1

      SHA512

      5a5d3e2645d583789365ceb011c0e56631fe6d596f19d04352edca37442a303d3bb06689f730cb009849d7d6bde981aaae0dca30df7c69210f8b182f0ed3c2ba

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\7zS2BFD.tmp\settings.ini
      Filesize

      656B

      MD5

      6b076e729aacc42deae8a8cfa173b0df

      SHA1

      a83c9f23acbde8977b358c7dca166fe685714215

      SHA256

      ed9a77d8cab763b7b7e879c94e3cbc95f84263311cfec9098b4e1dd8004f2221

      SHA512

      618dfe3f20121eea4aa4e1423a5c7c49f0e094925966a508f943cd90df8d62d9a8359ec2d557b15bd8e0c39b2e7189401fe672b277461c90d7bca45d50b0a20d

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\7zS2BFD.tmp\setup.exe
      Filesize

      61KB

      MD5

      16ef6e914973925977cdc5ef6b8b2565

      SHA1

      4815da2815975b33f5dc94d482e6dbc02588afa6

      SHA256

      6b9a2b64b90799f1d50458dc38fb4e9e13a8abb37210c8f5d9eeedae84c6912f

      SHA512

      c74f0e17878c4598b626edb5e75e7ee098b71c0c26454ba709e2ea438517670ce11abf7d909470e6c935a21d0413c0d14b29960af9bd6a423e3261789a35b059

      Download Submit

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.