Overview

overview

10

Static

static

3

tmp.exe

windows7-x64

10

tmp.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    172s
  • max time network
    189s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231025-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2023, 20:27 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    tmp.exe

  • Size

    284KB

  • MD5

    e3dc222d0a34c4b230f538a67bb7265d

  • SHA1

    d88345aef0e59341e6c4297d2685cb5f08c0aa80

  • SHA256

    a7f605d4110bba430e02c7c5240e656fb3f1dd7f02dce985e9e5677169c9de55

  • SHA512

    3d775c3c940ddd3d43fa56726ae4f8c0442a4d576cb410e60e2f010e1ff6273a2064f646c6af4a6993ff78924c329ac821811f97402d1472495c1d7a6d838797

  • SSDEEP

    6144:ukXNoFja9QXwKN1NdR7ws5lDohIiTXcnXzrCZemJPg1ZVzqH:jiFWUtXjDojODrXeIBze

Score
10/10
smokeloaderbackdoorcollectionpersistencetrojan

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://glueberry-og.cc/

http://glueberry-og.co/

http://glueberry-og.to/
rc4.i32
1
0xce2d77c4
rc4.i32
1
0x293bcc26

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4888
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:3552
  • C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    1⤵
    • Accesses Microsoft Outlook profiles
    • outlook_office_path
    • outlook_win_path
    PID:1556
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe
    1⤵
      PID:3916

    Network

    • flag-us
      DNS
      69.31.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      69.31.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      48.197.77.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      48.197.77.23.in-addr.arpa
      IN PTR
      Response
      48.197.77.23.in-addr.arpa
      IN PTR
      a23-77-197-48deploystaticakamaitechnologiescom
    • flag-us
      DNS
      241.154.82.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      241.154.82.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      146.78.124.51.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      146.78.124.51.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      183.59.114.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      183.59.114.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      198.187.3.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      198.187.3.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      26.35.223.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      26.35.223.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      198.5.85.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      198.5.85.104.in-addr.arpa
      IN PTR
      Response
      198.5.85.104.in-addr.arpa
      IN PTR
      a104-85-5-198deploystaticakamaitechnologiescom
    • flag-us
      DNS
      158.240.127.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      158.240.127.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      40.122.16.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      40.122.16.96.in-addr.arpa
      IN PTR
      Response
      40.122.16.96.in-addr.arpa
      IN PTR
      a96-16-122-40deploystaticakamaitechnologiescom
    • flag-us
      DNS
      9.228.82.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      9.228.82.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      48.229.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      48.229.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      88.156.103.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      88.156.103.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      glueberry-og.cc
      explorer.exe
      Remote address:
      8.8.8.8:53
      Request
      glueberry-og.cc
      IN A
      Response
      glueberry-og.cc
      IN A
      91.92.243.239
    • flag-bg
      POST
      http://glueberry-og.cc/
      Remote address:
      91.92.243.239:80
      Request
      POST / HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/x-www-form-urlencoded
      Accept: */*
      Referer: http://dgvsyidymduxbo.org/
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
      Content-Length: 317
      Host: glueberry-og.cc
      Response
      HTTP/1.1 404 Not Found
      Date: Tue, 07 Nov 2023 20:30:35 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Keep-Alive: timeout=5, max=100
      Connection: Keep-Alive
      Transfer-Encoding: chunked
      Content-Type: text/html; charset=utf-8
    • flag-us
      DNS
      239.243.92.91.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      239.243.92.91.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      tse1.mm.bing.net
      Remote address:
      8.8.8.8:53
      Request
      tse1.mm.bing.net
      IN A
      Response
      tse1.mm.bing.net
      IN CNAME
      mm-mm.bing.net.trafficmanager.net
      mm-mm.bing.net.trafficmanager.net
      IN CNAME
      dual-a-0001.a-msedge.net
      dual-a-0001.a-msedge.net
      IN A
      204.79.197.200
      dual-a-0001.a-msedge.net
      IN A
      13.107.21.200
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239317300974_1FWKD3OQIJ5N50HNG&pid=21.2&w=1920&h=1080&c=4
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239317300974_1FWKD3OQIJ5N50HNG&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 407668
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 302F83B3EC2D4D9DB26D1FDEACBF0716 Ref B: AMS04EDGE3211 Ref C: 2023-11-07T20:30:39Z
      date: Tue, 07 Nov 2023 20:30:38 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239317301024_1S39Y613MNXDQQG0C&pid=21.2&w=1920&h=1080&c=4
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239317301024_1S39Y613MNXDQQG0C&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 361762
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 42FC3D3C249742DB87341202984E6268 Ref B: AMS04EDGE3211 Ref C: 2023-11-07T20:30:39Z
      date: Tue, 07 Nov 2023 20:30:38 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239317301457_1V7ZJVRAXG9TQ5156&pid=21.2&w=1080&h=1920&c=4
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239317301457_1V7ZJVRAXG9TQ5156&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 347833
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 34D04044DEE7482B867D306DB165DA4F Ref B: AMS04EDGE3211 Ref C: 2023-11-07T20:30:39Z
      date: Tue, 07 Nov 2023 20:30:38 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239317301407_1XK9J8C92JQXSR9UG&pid=21.2&w=1080&h=1920&c=4
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239317301407_1XK9J8C92JQXSR9UG&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 349825
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 8AE23521B5654BCA8B576EA875E9E279 Ref B: AMS04EDGE3211 Ref C: 2023-11-07T20:30:39Z
      date: Tue, 07 Nov 2023 20:30:38 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239317300938_116Z84FUP3EYXI7L6&pid=21.2&w=1920&h=1080&c=4
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239317300938_116Z84FUP3EYXI7L6&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 422514
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 2152F2DBAE6F4855BF9825D32E255892 Ref B: AMS04EDGE3211 Ref C: 2023-11-07T20:30:39Z
      date: Tue, 07 Nov 2023 20:30:38 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239317301371_18ZL52TJ0W1845BME&pid=21.2&w=1080&h=1920&c=4
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239317301371_18ZL52TJ0W1845BME&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 461668
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 048C443EAF4749A89DCF5F6CBB1A5A63 Ref B: AMS04EDGE3211 Ref C: 2023-11-07T20:30:40Z
      date: Tue, 07 Nov 2023 20:30:40 GMT
    • flag-us
      DNS
      200.197.79.204.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      200.197.79.204.in-addr.arpa
      IN PTR
      Response
      200.197.79.204.in-addr.arpa
      IN PTR
      a-0001a-msedgenet
    • flag-bg
      POST
      http://glueberry-og.cc/
      explorer.exe
      Remote address:
      91.92.243.239:80
      Request
      POST / HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/x-www-form-urlencoded
      Accept: */*
      Referer: http://glueberry-og.cc/
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
      Content-Length: 877
      Host: glueberry-og.cc
      Response
      HTTP/1.1 404 Not Found
      Date: Tue, 07 Nov 2023 20:30:40 GMT
      Server: Apache/2.4.41 (Ubuntu)
      Content-Length: 403
      Keep-Alive: timeout=5, max=100
      Connection: Keep-Alive
      Content-Type: text/html; charset=utf-8
    • flag-us
      DNS
      55.86.100.95.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      55.86.100.95.in-addr.arpa
      IN PTR
      Response
      55.86.100.95.in-addr.arpa
      IN PTR
      a95-100-86-55deploystaticakamaitechnologiescom
    • flag-us
      DNS
      18.31.95.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      18.31.95.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      135.1.85.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      135.1.85.104.in-addr.arpa
      IN PTR
      Response
      135.1.85.104.in-addr.arpa
      IN PTR
      a104-85-1-135deploystaticakamaitechnologiescom
    • flag-us
      DNS
      131.72.42.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      131.72.42.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      119.110.54.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      119.110.54.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      126.22.238.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      126.22.238.8.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      254.23.238.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      254.23.238.8.in-addr.arpa
      IN PTR
      Response
    • 91.92.243.239:80
      http://glueberry-og.cc/
      http
      5.2kB
       256.7kB
       100
      189

      HTTP Request

      POST http://glueberry-og.cc/

      HTTP Response

      404
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls, http2
      1.2kB
       8.2kB
       16
      13
    • 204.79.197.200:443
      https://tse1.mm.bing.net/th?id=OADD2.10239317301371_18ZL52TJ0W1845BME&pid=21.2&w=1080&h=1920&c=4
      tls, http2
      95.7kB
       2.4MB
       1788
      1782

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239317300974_1FWKD3OQIJ5N50HNG&pid=21.2&w=1920&h=1080&c=4

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239317301024_1S39Y613MNXDQQG0C&pid=21.2&w=1920&h=1080&c=4

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239317301457_1V7ZJVRAXG9TQ5156&pid=21.2&w=1080&h=1920&c=4

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239317301407_1XK9J8C92JQXSR9UG&pid=21.2&w=1080&h=1920&c=4

      HTTP Response

      200

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239317300938_116Z84FUP3EYXI7L6&pid=21.2&w=1920&h=1080&c=4

      HTTP Response

      200

      HTTP Response

      200

      HTTP Response

      200

      HTTP Response

      200

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239317301371_18ZL52TJ0W1845BME&pid=21.2&w=1080&h=1920&c=4

      HTTP Response

      200
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls, http2
      1.2kB
       8.3kB
       16
      14
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls, http2
      1.2kB
       8.3kB
       16
      14
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls, http2
      1.2kB
       8.3kB
       16
      14
    • 91.92.243.239:80
      http://glueberry-og.cc/
      http
      explorer.exe
      1.4kB
       787 B
       6
      4

      HTTP Request

      POST http://glueberry-og.cc/

      HTTP Response

      404
    • 8.8.8.8:53
      69.31.126.40.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      69.31.126.40.in-addr.arpa

    • 8.8.8.8:53
      48.197.77.23.in-addr.arpa
      dns
      71 B
       135 B
       1
      1

      DNS Request

      48.197.77.23.in-addr.arpa

    • 8.8.8.8:53
      241.154.82.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      241.154.82.20.in-addr.arpa

    • 8.8.8.8:53
      146.78.124.51.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      146.78.124.51.in-addr.arpa

    • 8.8.8.8:53
      183.59.114.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      183.59.114.20.in-addr.arpa

    • 8.8.8.8:53
      198.187.3.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      198.187.3.20.in-addr.arpa

    • 8.8.8.8:53
      26.35.223.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      26.35.223.20.in-addr.arpa

    • 8.8.8.8:53
      198.5.85.104.in-addr.arpa
      dns
      71 B
       135 B
       1
      1

      DNS Request

      198.5.85.104.in-addr.arpa

    • 8.8.8.8:53
      158.240.127.40.in-addr.arpa
      dns
      73 B
       147 B
       1
      1

      DNS Request

      158.240.127.40.in-addr.arpa

    • 8.8.8.8:53
      40.122.16.96.in-addr.arpa
      dns
      71 B
       135 B
       1
      1

      DNS Request

      40.122.16.96.in-addr.arpa

    • 8.8.8.8:53
      9.228.82.20.in-addr.arpa
      dns
      70 B
       156 B
       1
      1

      DNS Request

      9.228.82.20.in-addr.arpa

    • 8.8.8.8:53
      48.229.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      48.229.111.52.in-addr.arpa

    • 8.8.8.8:53
      88.156.103.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      88.156.103.20.in-addr.arpa

    • 8.8.8.8:53
      glueberry-og.cc
      dns
      explorer.exe
      61 B
       77 B
       1
      1

      DNS Request

      glueberry-og.cc

      DNS Response

      91.92.243.239

    • 8.8.8.8:53
      239.243.92.91.in-addr.arpa
      dns
      72 B
       129 B
       1
      1

      DNS Request

      239.243.92.91.in-addr.arpa

    • 8.8.8.8:53
      tse1.mm.bing.net
      dns
      62 B
       173 B
       1
      1

      DNS Request

      tse1.mm.bing.net

      DNS Response

      204.79.197.200
      13.107.21.200

    • 8.8.8.8:53
      200.197.79.204.in-addr.arpa
      dns
      73 B
       106 B
       1
      1

      DNS Request

      200.197.79.204.in-addr.arpa

    • 8.8.8.8:53
      55.86.100.95.in-addr.arpa
      dns
      71 B
       135 B
       1
      1

      DNS Request

      55.86.100.95.in-addr.arpa

    • 8.8.8.8:53
      18.31.95.13.in-addr.arpa
      dns
      70 B
       144 B
       1
      1

      DNS Request

      18.31.95.13.in-addr.arpa

    • 8.8.8.8:53
      135.1.85.104.in-addr.arpa
      dns
      71 B
       135 B
       1
      1

      DNS Request

      135.1.85.104.in-addr.arpa

    • 8.8.8.8:53
      131.72.42.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      131.72.42.20.in-addr.arpa

    • 8.8.8.8:53
      119.110.54.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      119.110.54.20.in-addr.arpa

    • 8.8.8.8:53
      126.22.238.8.in-addr.arpa
      dns
      71 B
       125 B
       1
      1

      DNS Request

      126.22.238.8.in-addr.arpa

    • 8.8.8.8:53
      254.23.238.8.in-addr.arpa
      dns
      71 B
       125 B
       1
      1

      DNS Request

      254.23.238.8.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1556-53-0x0000000001000000-0x000000000106B000-memory.dmp

      Filesize

      428KB

      Download

    • memory/1556-28-0x0000000001000000-0x000000000106B000-memory.dmp

      Filesize

      428KB

      Download

    • memory/1556-26-0x0000000001070000-0x00000000010E5000-memory.dmp

      Filesize

      468KB

      Download

    • memory/3256-15-0x00000000015B0000-0x00000000015C6000-memory.dmp

      Filesize

      88KB

      Download

    • memory/3552-11-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

      Download

    • memory/3552-14-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

      Download

    • memory/3552-16-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

      Download

    • memory/3916-31-0x0000000000730000-0x000000000073C000-memory.dmp

      Filesize

      48KB

      Download

    • memory/3916-30-0x0000000000740000-0x0000000000747000-memory.dmp

      Filesize

      28KB

      Download

    • memory/3916-29-0x0000000000730000-0x000000000073C000-memory.dmp

      Filesize

      48KB

      Download

    • memory/4888-9-0x0000000005FA0000-0x0000000006006000-memory.dmp

      Filesize

      408KB

      Download

    • memory/4888-13-0x00000000745C0000-0x0000000074D70000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4888-0-0x00000000005F0000-0x000000000063E000-memory.dmp

      Filesize

      312KB

      Download

    • memory/4888-4-0x0000000005CA0000-0x0000000005CEA000-memory.dmp

      Filesize

      296KB

      Download

    • memory/4888-5-0x0000000005CF0000-0x0000000005D22000-memory.dmp

      Filesize

      200KB

      Download

    • memory/4888-3-0x00000000050E0000-0x00000000050F0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4888-2-0x00000000054C0000-0x0000000005A64000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/4888-8-0x0000000005F00000-0x0000000005F92000-memory.dmp

      Filesize

      584KB

      Download

    • memory/4888-7-0x0000000005D90000-0x0000000005DDC000-memory.dmp

      Filesize

      304KB

      Download

    • memory/4888-6-0x0000000005D50000-0x0000000005D82000-memory.dmp

      Filesize

      200KB

      Download

    • memory/4888-1-0x00000000745C0000-0x0000000074D70000-memory.dmp

      Filesize

      7.7MB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.