Analysis

  • max time kernel
    134s
  • resource
    win7v191014
  • submitted
    16/12/2019, 10:55 UTC

General

  • Target

    139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548.exe

  • Sample

    191216-4rcmytrrka

  • SHA256

    139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548

Malware Config

Extracted

Path

C:\Recovery\43s40i71l.info.txt

Family

sodinokibi

Ransom Note
Hello dear friend! Your files are encrypted, and, as result you can't use it. You must visit our page to get instructions about decryption process. All encrypted files have got 43s40i71l extension. Instructions into the TOR network ----------------------------- Install TOR browser from https://torproject.org/ Visit the following link: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B4D1C7A1B00D6DFF Instructions into WWW (The following link can not be in work state, if true, use TOR above): ----------------------------- Visit the following link: http://decryptor.top/B4D1C7A1B00D6DFF Page will ask you for the key, here it is: w9Autyu791gDcgvJa88bZEMg0tYQX4sIbUfcHkGQUMeWFlK6N9VP/PgmIpE3YxRM ohzlunC1jHPFBOdG8RQH5MFeSpaYJbff7dmrp0Sa/AMxs3Z58AtfTxxtpeASEXJa YSuteCc0crrZMVRrla9rHduzsA/Hxb9ZD15zLSkGZoDH1T9bcYhlDN4cX6bLJsFl Euap6XWWIQMNIXySYnG/MUylyFPkq/La2BAwmdqLsmXVntg/rRvfWEWj2WkbFHKQ dXGi3fkprUaMh6C5kiyLS8Lr4uY3pymcRlPD4Js45f88q4XXKoYdX4QiFv2Fu4pF 0GiQByslCAww57WYLXF8xDTp+cGUUIMiKVcUDXj35BgZEWo2Vwii9LstTbI0DaDL 8HpAZ5rirtV8GyQsSwjg2qtZ+FuE8AM5YQ6owC2vCGKqKG/C582gl3dBHtfP/6gv YYb5NKLnjY2hi6N8K3HJnWIqj7b7T8dWGIOmk1qnm7BlLzRumMkzXv3QTbtNH1C0 58g6J/bu6ZnlEnru6VCJE/dIz6SBxU97uzxvlS/huie2dDK1JPpzShBWA7tz3qBx 5ATFVR5uW8Na2dJ7zJeJItOPDaSHy6/tqxi5AwE36xosIIMh4ARJh+gbI4LTcdJ5 +2AmtIUf5K1SW6vatp2SJSEQqUOAjhagyVb2MxaU0MrHpTc0a2cmLJAvFe5qFnZv wp1fbuFTCNvDCLZkNXx756is/qnKsX7UbzIDFZ/tz6i54Kfr7RdLikAf3VoKfE1n 8CH4WM3RVy6w3rV6x/zQRfIk3rTprcGipbnCBLyV4kTA1G5ctaDpSj825FSTQ/gs NTNQEPFOEyZPkLiTm6eu3TxxrtL/lfMCiKx5tGuKyAYHDgQe7fO6PsBXSPbbu9o/ HbPeysq5oP0lWSVzZfFLYaAiUukw4ux0747ahw5WqF3esJPYrZQEWptLQILabRsI JEhTSiyCoJVn2pm4gk7pub+b5IIfskP5DNixAFAM6w1cAZndhgj89M9PkawMY9X+ Y/TGxatmIpdh/v4JusSEST6BTBd4WHeOd1x9QJhyyXDErIrfbl56xRZSd0nxAszP Gp+fK74qHGJ1oeJA7HBBa1ipf9pG8083
URLs

http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B4D1C7A1B00D6DFF

http://decryptor.top/B4D1C7A1B00D6DFF

Signatures

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Deletes shadow copies 2 TTPs 1 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality

  • Discovering connected drives 3 TTPs 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Drops file in Windows directory 3276 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548.exe
    "C:\Users\Admin\AppData\Local\Temp\139a7d6656feebe539b2cb94b0729602f6218f54fb5b7531b58cfe040f180548.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • Discovering connected drives
    • Drops file in Windows directory
    PID:1444
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1096
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin.exe Delete Shadows /All /Quiet
        3⤵
        • Deletes shadow copies
        PID:2024
  • C:\Windows\system32\conhost.exe
    \??\C:\Windows\system32\conhost.exe "-388722206-19565585701416385159-1724534010-776757088-167748554900424385-104918526"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2004
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:288

Network

  • 104.28.22.228:443
    lyricalduniya.com
  • 160.153.133.193:443
    theboardroomafrica.com
  • 160.153.133.193:443
    theboardroomafrica.com
  • 192.124.249.118:443
    chris-anne.com
  • 192.124.249.118:443
    chris-anne.com
  • 104.27.167.218:443
    ownidentity.com
  • 67.27.155.254:80
    http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab

    HTTP Request

    GET http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab

    HTTP Response

    200 OK
  • 146.66.65.192:443
    web865.com
  • 146.66.65.192:443
    web865.com
  • 35.225.43.3:443
    paradigmlandscape.com
  • 35.225.43.3:443
    paradigmlandscape.com
  • 104.131.13.115:443
    envomask.com
  • 45.40.144.60:443
    scentedlair.com
  • 45.40.144.60:443
    scentedlair.com
  • 195.114.26.214:443
    jlgraphisme.fr
  • 139.162.178.215:443
    andrealuchesi.it
  • 134.119.88.129:443
    mursall.de
  • 162.255.162.174:443
    metcalfe.ca
  • 144.217.72.25:443
    dentourage.com
  • 144.217.72.25:443
    dentourage.com
  • 91.185.185.169:443
    chomiksy.net
  • 104.250.105.84:443
    yayasanprimaunggul.org
  • 104.250.105.84:443
    yayasanprimaunggul.org
  • 198.50.239.84:443
    opticahubertruiz.com
  • 198.50.239.84:443
    opticahubertruiz.com
  • 193.30.110.118:443
    affligemsehondenschool.be
  • 104.223.95.207:443
    zealcon.ae
  • 66.147.244.85:443
    craftingalegacy.com
  • 151.101.130.159:443
    jimprattmediations.com
  • 151.101.130.159:443
    jimprattmediations.com
  • 185.197.130.219:443
    gosouldeep.com
  • 185.197.130.219:443
    gosouldeep.com
  • 51.15.85.234:443
    innovationgames-brabant.nl
  • 104.24.106.117:443
    pisofare.co
  • 37.60.240.219:443
    coachpreneuracademy.com
  • 37.60.240.219:443
    coachpreneuracademy.com
  • 50.87.137.220:443
    goodherbalhealth.com
  • 95.143.172.224:443
    grafikstudio-visuell.de
  • 95.143.172.224:443
    grafikstudio-visuell.de
  • 157.7.107.246:443
    advance-refle.com
  • 50.97.149.92:443
    placermonticello.com
  • 50.97.149.94:443
    www.placermonticello.com
  • 192.0.78.13:443
    amelielecompte.wordpress.com
  • 213.186.33.24:443
    bodet150ans.com
  • 185.5.53.18:443
    alnectus.com
  • 92.51.175.63:443
    strauchs-wanderlust.info
  • 92.51.175.63:443
    www.strauchs-wanderlust.info
  • 198.252.101.174:443
    khtrx.com
  • 92.222.204.59:443
    latableacrepes-meaux.fr
  • 92.222.204.59:443
    latableacrepes-meaux.fr
  • 198.54.115.43:443
    precisetemp.com
  • 198.54.115.43:443
    precisetemp.com
  • 185.76.65.44:443
    loparnille.se
  • 185.76.65.44:443
    loparnille.se
  • 94.73.147.215:443
    narca.net
  • 94.73.147.215:443
    narca.net
  • 188.213.19.167:443
    silkeight.com
  • 188.213.19.167:443
    silkeight.com
  • 46.30.58.168:443
    bescomedical.de
  • 46.30.58.168:443
    www.bescomedical.de
  • 46.30.58.168:443
    www.bescomedical.de
  • 199.79.54.244:443
    sealgrinderpt.com
  • 146.66.118.97:443
    hospitalitytrainingsolutions.co.uk
  • 146.66.118.97:443
    hospitalitytrainingsolutions.co.uk
  • 23.185.0.2:443
    fanuli.com.au
  • 23.185.0.2:443
    fanuli.com.au
  • 212.77.240.46:443
    augen-praxisklinik-rostock.de
  • 5.45.112.80:443
    trevi-vl.ru
  • 13.112.107.85:443
    kiraribeaute-nani.com
  • 13.227.209.177:80
    x.ss2.us
  • 85.128.222.169:443
    skoczynski.eu
  • 85.128.222.169:443
    skoczynski.eu
  • 77.104.145.102:443
    greatofficespaces.net
  • 77.104.145.102:443
    greatofficespaces.net
  • 141.138.169.208:443
    sytzedevries.com
  • 141.138.169.208:443
    sytzedevries.com
  • 108.167.161.213:443
    jayfurnitureco.com
  • 205.134.254.189:443
    rozmata.com
  • 104.27.159.121:443
    kenmccallum.com
  • 45.79.155.213:443
    texanscan.org
  • 83.169.37.227:443
    landgoedspica.nl
  • 74.208.236.111:443
    amorbellezaysalud.com
  • 23.227.38.32:443
    bagaholics.in
  • 23.227.38.32:443
    bagaholics.in
  • 217.160.0.66:443
    a-zpaperwork.eu
  • 93.188.2.54:443
    fla.se
  • 93.188.2.54:443
    fla.se
  • 128.0.41.75:443
    zișinoapte.ro
  • 95.170.72.149:443
    dayenne-styling.nl
  • 95.170.72.149:443
    dayenne-styling.nl
  • 162.241.218.106:443
    craftron.com
  • 176.31.247.6:443
    condormobile.fr
  • 176.31.247.6:443
    condormobile.fr
  • 51.15.159.75:443
    chainofhopeeurope.eu
  • 104.27.174.164:443
    martinipstudios.com
  • 3.234.181.234:443
    patassociation.com
  • 185.60.135.31:443
    levencovka.ru
  • 104.27.172.109:443
    bakingismyyoga.com
  • 5.134.9.160:443
    sarahspics.co.uk
  • 5.134.9.160:443
    sarahspics.co.uk
  • 51.77.137.26:443
    powershell.su
  • 193.124.179.13:443
    naukaip.ru
  • 104.18.50.115:443
    adaduga.info
  • 66.228.32.51:443
    eyedoctordallas.com
  • 66.228.32.51:443
    www.eyedoctordallas.com
  • 69.89.31.185:443
    jacquesgarcianoto.com
  • 104.31.83.80:443
    rvside.com
  • 160.153.198.141:443
    global-migrate.com
  • 160.153.198.141:443
    global-migrate.com
  • 146.66.113.232:443
    xrresources.com
  • 146.66.113.232:443
    xrresources.com
  • 198.71.233.254:443
    whoopingcrane.com
  • 198.71.233.254:443
    whoopingcrane.com
  • 67.20.76.129:443
    stanleyqualitysystems.com
  • 37.97.218.27:443
    solidhosting.nl
  • 37.97.192.166:443
    mesajjongeren.nl
  • 104.18.32.113:443
    dieetuniversiteit.nl
  • 172.104.6.240:443
    campusescalade.com
  • 212.42.180.237:443
    bluemarinefoundation.com
  • 145.239.0.194:443
    glas-kuck.de
  • 35.172.94.1:443
    ahgarage.com
  • 35.172.94.1:443
    ahgarage.com
  • 74.208.159.96:443
    yourcosmicbeing.com
  • 77.104.131.151:443
    morgansconsult.com
  • 77.104.131.151:443
    morgansconsult.com
  • 164.132.216.163:443
    gazelle-du-web.com
  • 164.132.216.163:443
    www.gazelle-du-web.com
  • 185.10.73.238:443
    paprikapod.com
  • 185.10.73.238:443
    radionistpod.com
  • 81.169.139.201:443
    donau-guides.eu
  • 13.93.50.82:443
    cardsandloyalty.com
  • 178.208.33.134:443
    belofloripa.be
  • 193.34.145.202:443
    circuit-diagramz.com
  • 10.7.0.255:137
  • 10.7.0.32:137
  • 224.0.0.252:5355
  • 224.0.0.252:5355
  • 224.0.0.252:5355
  • 224.0.0.252:5355
  • 8.8.8.8:53
    lyricalduniya.com

    DNS Request

    lyricalduniya.com

    DNS Response

    104.28.22.228
    104.28.23.228

  • 8.8.8.8:53
    theboardroomafrica.com

    DNS Request

    theboardroomafrica.com

    DNS Response

    160.153.133.193

  • 8.8.8.8:53
    craftron.com

    DNS Request

    chris-anne.com

    DNS Response

    192.124.249.118

    DNS Request

    craftron.com

    DNS Response

    162.241.218.106

  • 8.8.8.8:53
    ownidentity.com

    DNS Request

    ownidentity.com

    DNS Response

    104.27.167.218
    104.27.166.218

  • 224.0.0.252:5355
  • 224.0.0.252:5355
  • 8.8.8.8:53
    www.download.windowsupdate.com

    DNS Request

    www.download.windowsupdate.com

    DNS Response

    67.27.155.254
    67.27.153.126
    67.27.150.254
    8.253.208.112
    8.247.211.254

  • 224.0.0.252:5355
  • 224.0.0.252:5355
  • 8.8.8.8:53
    web865.com

    DNS Request

    web865.com

    DNS Response

    146.66.65.192

  • 8.8.8.8:53
    paradigmlandscape.com

    DNS Request

    paradigmlandscape.com

    DNS Response

    35.225.43.3

  • 8.8.8.8:53
    envomask.com

    DNS Request

    envomask.com

    DNS Response

    104.131.13.115

  • 8.8.8.8:53
    scentedlair.com

    DNS Request

    scentedlair.com

    DNS Response

    45.40.144.60

  • 8.8.8.8:53
    jlgraphisme.fr

    DNS Request

    jlgraphisme.fr

    DNS Response

    195.114.26.214

  • 8.8.8.8:53
    andrealuchesi.it

    DNS Request

    andrealuchesi.it

    DNS Response

    139.162.178.215

  • 8.8.8.8:53
    mursall.de

    DNS Request

    mursall.de

    DNS Response

    134.119.88.129

  • 8.8.8.8:53
    letterscan.de

    DNS Request

    letterscan.de

  • 8.8.8.8:53
    metcalfe.ca

    DNS Request

    metcalfe.ca

    DNS Response

    162.255.162.174

  • 8.8.8.8:53
    dentourage.com

    DNS Request

    dentourage.com

    DNS Response

    144.217.72.25

  • 8.8.8.8:53
    chomiksy.net

    DNS Request

    chomiksy.net

    DNS Response

    91.185.185.169

  • 8.8.8.8:53
    yayasanprimaunggul.org

    DNS Request

    yayasanprimaunggul.org

    DNS Response

    104.250.105.84

  • 8.8.8.8:53
    opticahubertruiz.com

    DNS Request

    opticahubertruiz.com

    DNS Response

    198.50.239.84

  • 8.8.8.8:53
    affligemsehondenschool.be

    DNS Request

    affligemsehondenschool.be

    DNS Response

    193.30.110.118

  • 8.8.8.8:53
    zealcon.ae

    DNS Request

    zealcon.ae

    DNS Response

    104.223.95.207

  • 8.8.8.8:53
    craftingalegacy.com

    DNS Request

    craftingalegacy.com

    DNS Response

    66.147.244.85

  • 8.8.8.8:53
    jimprattmediations.com

    DNS Request

    jimprattmediations.com

    DNS Response

    151.101.130.159

  • 8.8.8.8:53
    gosouldeep.com

    DNS Request

    gosouldeep.com

    DNS Response

    185.197.130.219

  • 8.8.8.8:53
    innovationgames-brabant.nl

    DNS Request

    innovationgames-brabant.nl

    DNS Response

    51.15.85.234

  • 8.8.8.8:53
    pisofare.co

    DNS Request

    pisofare.co

    DNS Response

    104.24.106.117
    104.24.107.117

  • 8.8.8.8:53
    coachpreneuracademy.com

    DNS Request

    coachpreneuracademy.com

    DNS Response

    37.60.240.219

  • 8.8.8.8:53
    goodherbalhealth.com

    DNS Request

    goodherbalhealth.com

    DNS Response

    50.87.137.220

  • 8.8.8.8:53
    grafikstudio-visuell.de

    DNS Request

    grafikstudio-visuell.de

    DNS Response

    95.143.172.224

  • 8.8.8.8:53
    advance-refle.com

    DNS Request

    advance-refle.com

    DNS Response

    157.7.107.246

  • 8.8.8.8:53
    placermonticello.com

    DNS Request

    placermonticello.com

    DNS Response

    50.97.149.92

  • 8.8.8.8:53
    www.placermonticello.com

    DNS Request

    www.placermonticello.com

    DNS Response

    50.97.149.94

  • 8.8.8.8:53
    amelielecompte.wordpress.com

    DNS Request

    amelielecompte.wordpress.com

    DNS Response

    192.0.78.13
    192.0.78.12

  • 8.8.8.8:53
    bodet150ans.com

    DNS Request

    bodet150ans.com

    DNS Response

    213.186.33.24

  • 8.8.8.8:53
    alnectus.com

    DNS Request

    alnectus.com

    DNS Response

    185.5.53.18

  • 8.8.8.8:53
    strauchs-wanderlust.info

    DNS Request

    strauchs-wanderlust.info

    DNS Response

    92.51.175.63

  • 8.8.8.8:53
    www.strauchs-wanderlust.info

    DNS Request

    www.strauchs-wanderlust.info

    DNS Response

    92.51.175.63

  • 8.8.8.8:53
    khtrx.com

    DNS Request

    khtrx.com

    DNS Response

    198.252.101.174

  • 8.8.8.8:53
    latableacrepes-meaux.fr

    DNS Request

    latableacrepes-meaux.fr

    DNS Response

    92.222.204.59

  • 8.8.8.8:53
    precisetemp.com

    DNS Request

    precisetemp.com

    DNS Response

    198.54.115.43

  • 8.8.8.8:53
    nicksrock.com

    DNS Request

    nicksrock.com

  • 8.8.8.8:53
    loparnille.se

    DNS Request

    loparnille.se

    DNS Response

    185.76.65.44

  • 8.8.8.8:53
    narca.net

    DNS Request

    narca.net

    DNS Response

    94.73.147.215

  • 8.8.8.8:53
    silkeight.com

    DNS Request

    silkeight.com

    DNS Response

    188.213.19.167

  • 8.8.8.8:53
    bescomedical.de

    DNS Request

    bescomedical.de

    DNS Response

    46.30.58.168

  • 8.8.8.8:53
    www.bescomedical.de

    DNS Request

    www.bescomedical.de

    DNS Response

    46.30.58.168

  • 8.8.8.8:53
    sealgrinderpt.com

    DNS Request

    sealgrinderpt.com

    DNS Response

    199.79.54.244

  • 8.8.8.8:53
    hospitalitytrainingsolutions.co.uk

    DNS Request

    hospitalitytrainingsolutions.co.uk

    DNS Response

    146.66.118.97

  • 8.8.8.8:53
    fanuli.com.au

    DNS Request

    fanuli.com.au

    DNS Response

    23.185.0.2

  • 8.8.8.8:53
    augen-praxisklinik-rostock.de

    DNS Request

    augen-praxisklinik-rostock.de

    DNS Response

    212.77.240.46

  • 8.8.8.8:53
    trevi-vl.ru

    DNS Request

    trevi-vl.ru

    DNS Response

    5.45.112.80

  • 8.8.8.8:53
    kiraribeaute-nani.com

    DNS Request

    kiraribeaute-nani.com

    DNS Response

    13.112.107.85
    54.64.166.17

  • 224.0.0.252:5355
  • 224.0.0.252:5355
  • 8.8.8.8:53
    x.ss2.us

    DNS Request

    x.ss2.us

    DNS Response

    13.227.209.177
    13.227.209.50
    13.227.209.207
    13.227.209.168

  • 8.8.8.8:53
    skoczynski.eu

    DNS Request

    skoczynski.eu

    DNS Response

    85.128.222.169

  • 8.8.8.8:53
    kellengatton.com

    DNS Request

    kellengatton.com

  • 8.8.8.8:53
    greatofficespaces.net

    DNS Request

    greatofficespaces.net

    DNS Response

    77.104.145.102

  • 8.8.8.8:53
    sytzedevries.com

    DNS Request

    sytzedevries.com

    DNS Response

    141.138.169.208

  • 8.8.8.8:53
    jayfurnitureco.com

    DNS Request

    jayfurnitureco.com

    DNS Response

    108.167.161.213

  • 8.8.8.8:53
    rozmata.com

    DNS Request

    rozmata.com

    DNS Response

    205.134.254.189

  • 8.8.8.8:53
    kenmccallum.com

    DNS Request

    kenmccallum.com

    DNS Response

    104.27.159.121
    104.27.158.121

  • 8.8.8.8:53
    texanscan.org

    DNS Request

    texanscan.org

    DNS Response

    45.79.155.213

  • 8.8.8.8:53
    landgoedspica.nl

    DNS Request

    landgoedspica.nl

    DNS Response

    83.169.37.227

  • 8.8.8.8:53
    amorbellezaysalud.com

    DNS Request

    amorbellezaysalud.com

    DNS Response

    74.208.236.111

  • 8.8.8.8:53
    bagaholics.in

    DNS Request

    bagaholics.in

    DNS Response

    23.227.38.32

  • 8.8.8.8:53
    a-zpaperwork.eu

    DNS Request

    a-zpaperwork.eu

    DNS Response

    217.160.0.66

  • 8.8.8.8:53
    fla.se

    DNS Request

    fla.se

    DNS Response

    93.188.2.54

  • 8.8.8.8:53
    xn--ziinoapte-6ld.ro

    DNS Request

    xn--ziinoapte-6ld.ro

    DNS Response

    128.0.41.75

  • 8.8.8.8:53
    dayenne-styling.nl

    DNS Request

    dayenne-styling.nl

    DNS Response

    95.170.72.149

  • 8.8.8.8:53
    condormobile.fr

    DNS Request

    condormobile.fr

    DNS Response

    176.31.247.6

  • 8.8.8.8:53
    chainofhopeeurope.eu

    DNS Request

    chainofhopeeurope.eu

    DNS Response

    51.15.159.75

  • 8.8.8.8:53
    rapid5kloan.org

    DNS Request

    rapid5kloan.org

  • 8.8.8.8:53
    martinipstudios.com

    DNS Request

    martinipstudios.com

    DNS Response

    104.27.174.164
    104.27.175.164

  • 8.8.8.8:53
    patassociation.com

    DNS Request

    patassociation.com

    DNS Response

    3.234.181.234

  • 239.255.255.250:1900
  • 8.8.8.8:53
    levencovka.ru

    DNS Request

    levencovka.ru

    DNS Response

    185.60.135.31

  • 8.8.8.8:53
    bakingismyyoga.com

    DNS Request

    bakingismyyoga.com

    DNS Response

    104.27.172.109
    104.27.173.109

  • 8.8.8.8:53
    sarahspics.co.uk

    DNS Request

    sarahspics.co.uk

    DNS Response

    5.134.9.160

  • 8.8.8.8:53
    powershell.su

    DNS Request

    powershell.su

    DNS Response

    51.77.137.26

  • 8.8.8.8:53
    naukaip.ru

    DNS Request

    naukaip.ru

    DNS Response

    193.124.179.13

  • 8.8.8.8:53
    adaduga.info

    DNS Request

    adaduga.info

    DNS Response

    104.18.50.115
    104.18.51.115

  • 8.8.8.8:53
    eyedoctordallas.com

    DNS Request

    eyedoctordallas.com

    DNS Response

    66.228.32.51

  • 8.8.8.8:53
    www.eyedoctordallas.com

    DNS Request

    www.eyedoctordallas.com

    DNS Response

    66.228.32.51

  • 8.8.8.8:53
    hinotruckwreckers.com.au

    DNS Request

    hinotruckwreckers.com.au

  • 8.8.8.8:53
    jacquesgarcianoto.com

    DNS Request

    jacquesgarcianoto.com

    DNS Response

    69.89.31.185

  • 8.8.8.8:53
    rvside.com

    DNS Request

    rvside.com

    DNS Response

    104.31.83.80
    104.31.82.80

  • 8.8.8.8:53
    global-migrate.com

    DNS Request

    global-migrate.com

    DNS Response

    160.153.198.141

  • 8.8.8.8:53
    xrresources.com

    DNS Request

    xrresources.com

    DNS Response

    146.66.113.232

  • 8.8.8.8:53
    whoopingcrane.com

    DNS Request

    whoopingcrane.com

    DNS Response

    198.71.233.254

  • 8.8.8.8:53
    stanleyqualitysystems.com

    DNS Request

    stanleyqualitysystems.com

    DNS Response

    67.20.76.129

  • 8.8.8.8:53
    solidhosting.nl

    DNS Request

    solidhosting.nl

    DNS Response

    37.97.218.27

  • 8.8.8.8:53
    mesajjongeren.nl

    DNS Request

    mesajjongeren.nl

    DNS Response

    37.97.192.166

  • 8.8.8.8:53
    dieetuniversiteit.nl

    DNS Request

    dieetuniversiteit.nl

    DNS Response

    104.18.32.113
    104.18.33.113

  • 8.8.8.8:53
    campusescalade.com

    DNS Request

    campusescalade.com

    DNS Response

    172.104.6.240

  • 8.8.8.8:53
    bluemarinefoundation.com

    DNS Request

    bluemarinefoundation.com

    DNS Response

    212.42.180.237

  • 8.8.8.8:53
    glas-kuck.de

    DNS Request

    glas-kuck.de

    DNS Response

    145.239.0.194

  • 8.8.8.8:53
    ahgarage.com

    DNS Request

    ahgarage.com

    DNS Response

    35.172.94.1
    100.24.208.97

  • 8.8.8.8:53
    yourcosmicbeing.com

    DNS Request

    yourcosmicbeing.com

    DNS Response

    74.208.159.96

  • 8.8.8.8:53
    morgansconsult.com

    DNS Request

    morgansconsult.com

    DNS Response

    77.104.131.151

  • 8.8.8.8:53
    gazelle-du-web.com

    DNS Request

    gazelle-du-web.com

    DNS Response

    164.132.216.163

  • 8.8.8.8:53
    www.gazelle-du-web.com

    DNS Request

    www.gazelle-du-web.com

    DNS Response

    164.132.216.163

  • 8.8.8.8:53
    paprikapod.com

    DNS Request

    paprikapod.com

    DNS Response

    185.10.73.238

  • 8.8.8.8:53
    radionistpod.com

    DNS Request

    radionistpod.com

    DNS Response

    185.10.73.238

  • 8.8.8.8:53
    donau-guides.eu

    DNS Request

    donau-guides.eu

    DNS Response

    81.169.139.201

  • 8.8.8.8:53
    cardsandloyalty.com

    DNS Request

    cardsandloyalty.com

    DNS Response

    13.93.50.82

  • 8.8.8.8:53
    belofloripa.be

    DNS Request

    belofloripa.be

    DNS Response

    178.208.33.134

  • 8.8.8.8:53
    circuit-diagramz.com

    DNS Request

    circuit-diagramz.com

    DNS Response

    193.34.145.202

  • 239.255.255.250:1900
  • 224.0.0.22

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.