Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

894fdbe41d...1a.exe

windows7-x64

10

894fdbe41d...1a.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    145s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/12/2023, 03:20 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    894fdbe41d7fa24ddb08f16ace51561a.exe

  • Size

    1.6MB

  • MD5

    894fdbe41d7fa24ddb08f16ace51561a

  • SHA1

    2b2637864e8fa547760d1b09292976e5b6dde6d5

  • SHA256

    e310cc6f7761ca6cb46dd3684a4397a0035d9818b8210fc33f2cf23e17a12df2

  • SHA512

    94bb0f2e94b65e235590ae52425dc50a605870343b0241b86b33e87945128d773fe4459202eb029ed887979dd77ea1e7389a2737da4e863c0e10390de2c8b023

  • SSDEEP

    49152:qWg8wUmZOzqiavjDUJO/WH89ctcO0ljbbQnIQGotBKqy8TJCHEGU42sn6:ZiUmZOzqiavjDUM/WH89y8bboGO

Score
7/10
collectiondiscoverypersistencespywarestealer

Malware Config

Signatures

  • Drops startup file 1 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\894fdbe41d7fa24ddb08f16ace51561a.exe
    "C:\Users\Admin\AppData\Local\Temp\894fdbe41d7fa24ddb08f16ace51561a.exe"
    1⤵
    • Drops startup file
    • Accesses Microsoft Outlook profiles
    • Adds Run key to start application
    • Drops file in System32 directory
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • outlook_office_path
    • outlook_win_path
    PID:4692
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST
      2⤵
      • Creates scheduled task(s)
      PID:1648
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST
      2⤵
      • Creates scheduled task(s)
      PID:1496
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4692 -s 1688
      2⤵
      • Program crash
      PID:2756
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
    1⤵
      PID:4988
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
      1⤵
        PID:1828
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4692 -ip 4692
        1⤵
          PID:608
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
          1⤵
            PID:3348
          • C:\Windows\System32\svchost.exe
            C:\Windows\System32\svchost.exe -k UnistackSvcGroup
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3032

          Network

          • flag-us
            DNS
            2.136.104.51.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            2.136.104.51.in-addr.arpa
            IN PTR
            Response
          • flag-us
            DNS
            180.178.17.96.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            180.178.17.96.in-addr.arpa
            IN PTR
            Response
            180.178.17.96.in-addr.arpa
            IN PTR
            a96-17-178-180deploystaticakamaitechnologiescom
          • flag-us
            DNS
            0.181.190.20.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            0.181.190.20.in-addr.arpa
            IN PTR
            Response
          • flag-us
            DNS
            95.221.229.192.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            95.221.229.192.in-addr.arpa
            IN PTR
            Response
          • flag-us
            DNS
            ipinfo.io
            894fdbe41d7fa24ddb08f16ace51561a.exe
            Remote address:
            8.8.8.8:53
            Request
            ipinfo.io
            IN A
            Response
            ipinfo.io
            IN A
            34.117.59.81
          • flag-us
            DNS
            51.132.233.193.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            51.132.233.193.in-addr.arpa
            IN PTR
            Response
          • flag-us
            DNS
            9.228.82.20.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            9.228.82.20.in-addr.arpa
            IN PTR
            Response
          • flag-us
            GET
            https://ipinfo.io/widget/demo/89.149.23.59
            894fdbe41d7fa24ddb08f16ace51561a.exe
            Remote address:
            34.117.59.81:443
            Request
            GET /widget/demo/89.149.23.59 HTTP/1.1
            Connection: Keep-Alive
            Referer: https://ipinfo.io/
            User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
            Host: ipinfo.io
            Response
            HTTP/1.1 200 OK
            access-control-allow-origin: *
            x-frame-options: SAMEORIGIN
            x-xss-protection: 1; mode=block
            x-content-type-options: nosniff
            referrer-policy: strict-origin-when-cross-origin
            content-type: application/json; charset=utf-8
            Content-Length: 961
            date: Tue, 12 Dec 2023 03:20:26 GMT
            x-envoy-upstream-service-time: 2
            strict-transport-security: max-age=2592000; includeSubDomains
            vary: Accept-Encoding
            Via: 1.1 google
            Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
          • flag-us
            DNS
            148.177.190.20.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            148.177.190.20.in-addr.arpa
            IN PTR
            Response
          • flag-us
            DNS
            81.59.117.34.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            81.59.117.34.in-addr.arpa
            IN PTR
            Response
            81.59.117.34.in-addr.arpa
            IN PTR
            815911734bcgoogleusercontentcom
          • flag-us
            DNS
            146.78.124.51.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            146.78.124.51.in-addr.arpa
            IN PTR
            Response
          • flag-us
            DNS
            41.110.16.96.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            41.110.16.96.in-addr.arpa
            IN PTR
            Response
            41.110.16.96.in-addr.arpa
            IN PTR
            a96-16-110-41deploystaticakamaitechnologiescom
          • flag-us
            DNS
            88.156.103.20.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            88.156.103.20.in-addr.arpa
            IN PTR
            Response
          • flag-us
            DNS
            103.169.127.40.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            103.169.127.40.in-addr.arpa
            IN PTR
            Response
          • flag-us
            DNS
            tse1.mm.bing.net
            Remote address:
            8.8.8.8:53
            Request
            tse1.mm.bing.net
            IN A
            Response
            tse1.mm.bing.net
            IN CNAME
            mm-mm.bing.net.trafficmanager.net
            mm-mm.bing.net.trafficmanager.net
            IN CNAME
            dual-a-0001.a-msedge.net
            dual-a-0001.a-msedge.net
            IN A
            204.79.197.200
            dual-a-0001.a-msedge.net
            IN A
            13.107.21.200
          • flag-us
            GET
            https://tse1.mm.bing.net/th?id=OADD2.10239317301243_1NFMASG3SLY79TVLK&pid=21.2&w=1920&h=1080&c=4
            Remote address:
            204.79.197.200:443
            Request
            GET /th?id=OADD2.10239317301243_1NFMASG3SLY79TVLK&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
            host: tse1.mm.bing.net
            accept: */*
            accept-encoding: gzip, deflate, br
            user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
            Response
            HTTP/2.0 200
            cache-control: public, max-age=2592000
            content-length: 359617
            content-type: image/jpeg
            x-cache: TCP_HIT
            access-control-allow-origin: *
            access-control-allow-headers: *
            access-control-allow-methods: GET, POST, OPTIONS
            timing-allow-origin: *
            report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
            nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
            accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
            x-msedge-ref: Ref A: F7632057046D4931AF8F155C28AE225C Ref B: LON04EDGE0806 Ref C: 2023-12-12T03:20:29Z
            date: Tue, 12 Dec 2023 03:20:28 GMT
          • flag-us
            GET
            https://tse1.mm.bing.net/th?id=OADD2.10239317301652_1R39G8DVE3D1IPAHO&pid=21.2&w=1080&h=1920&c=4
            Remote address:
            204.79.197.200:443
            Request
            GET /th?id=OADD2.10239317301652_1R39G8DVE3D1IPAHO&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
            host: tse1.mm.bing.net
            accept: */*
            accept-encoding: gzip, deflate, br
            user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
            Response
            HTTP/2.0 200
            cache-control: public, max-age=2592000
            content-length: 275287
            content-type: image/jpeg
            x-cache: TCP_HIT
            access-control-allow-origin: *
            access-control-allow-headers: *
            access-control-allow-methods: GET, POST, OPTIONS
            timing-allow-origin: *
            report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
            nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
            accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
            x-msedge-ref: Ref A: E096C479348047648B82A168F76E51CD Ref B: LON04EDGE0806 Ref C: 2023-12-12T03:20:29Z
            date: Tue, 12 Dec 2023 03:20:28 GMT
          • flag-us
            GET
            https://tse1.mm.bing.net/th?id=OADD2.10239317301092_1JZSJBJO319VX0DCF&pid=21.2&w=1920&h=1080&c=4
            Remote address:
            204.79.197.200:443
            Request
            GET /th?id=OADD2.10239317301092_1JZSJBJO319VX0DCF&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
            host: tse1.mm.bing.net
            accept: */*
            accept-encoding: gzip, deflate, br
            user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
            Response
            HTTP/2.0 200
            cache-control: public, max-age=2592000
            content-length: 205655
            content-type: image/jpeg
            x-cache: TCP_HIT
            access-control-allow-origin: *
            access-control-allow-headers: *
            access-control-allow-methods: GET, POST, OPTIONS
            timing-allow-origin: *
            report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
            nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
            accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
            x-msedge-ref: Ref A: 8357A882310A424EBFF63195D25F4F0B Ref B: LON04EDGE0806 Ref C: 2023-12-12T03:20:29Z
            date: Tue, 12 Dec 2023 03:20:28 GMT
          • flag-us
            GET
            https://tse1.mm.bing.net/th?id=OADD2.10239317301525_1RYZUU337MG2SWDKJ&pid=21.2&w=1080&h=1920&c=4
            Remote address:
            204.79.197.200:443
            Request
            GET /th?id=OADD2.10239317301525_1RYZUU337MG2SWDKJ&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
            host: tse1.mm.bing.net
            accept: */*
            accept-encoding: gzip, deflate, br
            user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
            Response
            HTTP/2.0 200
            cache-control: public, max-age=2592000
            content-length: 250205
            content-type: image/jpeg
            x-cache: TCP_HIT
            access-control-allow-origin: *
            access-control-allow-headers: *
            access-control-allow-methods: GET, POST, OPTIONS
            timing-allow-origin: *
            report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
            nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
            accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
            x-msedge-ref: Ref A: FDAAD5C08D864E39949666427E28CB6B Ref B: LON04EDGE0806 Ref C: 2023-12-12T03:20:29Z
            date: Tue, 12 Dec 2023 03:20:28 GMT
          • flag-us
            DNS
            200.197.79.204.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            200.197.79.204.in-addr.arpa
            IN PTR
            Response
            200.197.79.204.in-addr.arpa
            IN PTR
            a-0001a-msedgenet
          • flag-us
            DNS
            18.31.95.13.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            18.31.95.13.in-addr.arpa
            IN PTR
            Response
          • flag-us
            DNS
            104.241.123.92.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            104.241.123.92.in-addr.arpa
            IN PTR
            Response
            104.241.123.92.in-addr.arpa
            IN PTR
            a92-123-241-104deploystaticakamaitechnologiescom
          • flag-us
            DNS
            119.110.54.20.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            119.110.54.20.in-addr.arpa
            IN PTR
            Response
          • flag-us
            DNS
            217.135.221.88.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            217.135.221.88.in-addr.arpa
            IN PTR
            Response
            217.135.221.88.in-addr.arpa
            IN PTR
            a88-221-135-217deploystaticakamaitechnologiescom
          • flag-us
            DNS
            174.178.17.96.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            174.178.17.96.in-addr.arpa
            IN PTR
            Response
            174.178.17.96.in-addr.arpa
            IN PTR
            a96-17-178-174deploystaticakamaitechnologiescom
          • flag-us
            DNS
            26.35.223.20.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            26.35.223.20.in-addr.arpa
            IN PTR
            Response
          • flag-us
            DNS
            18.134.221.88.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            18.134.221.88.in-addr.arpa
            IN PTR
            Response
            18.134.221.88.in-addr.arpa
            IN PTR
            a88-221-134-18deploystaticakamaitechnologiescom
          • flag-us
            DNS
            23.236.111.52.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            23.236.111.52.in-addr.arpa
            IN PTR
            Response
          • flag-us
            DNS
            88.65.42.20.in-addr.arpa
            Remote address:
            8.8.8.8:53
            Request
            88.65.42.20.in-addr.arpa
            IN PTR
            Response
          • 193.233.132.51:50500
            894fdbe41d7fa24ddb08f16ace51561a.exe
            3.5kB
             2.0kB
             22
            16
          • 34.117.59.81:443
            https://ipinfo.io/widget/demo/89.149.23.59
            tls, http
            894fdbe41d7fa24ddb08f16ace51561a.exe
            937 B
             6.7kB
             9
            10

            HTTP Request

            GET https://ipinfo.io/widget/demo/89.149.23.59

            HTTP Response

            200
          • 204.79.197.200:443
            tse1.mm.bing.net
            tls, http2
            1.2kB
             8.3kB
             16
            14
          • 204.79.197.200:443
            https://tse1.mm.bing.net/th?id=OADD2.10239317301525_1RYZUU337MG2SWDKJ&pid=21.2&w=1080&h=1920&c=4
            tls, http2
            41.6kB
             1.1MB
             839
            837

            HTTP Request

            GET https://tse1.mm.bing.net/th?id=OADD2.10239317301243_1NFMASG3SLY79TVLK&pid=21.2&w=1920&h=1080&c=4

            HTTP Request

            GET https://tse1.mm.bing.net/th?id=OADD2.10239317301652_1R39G8DVE3D1IPAHO&pid=21.2&w=1080&h=1920&c=4

            HTTP Request

            GET https://tse1.mm.bing.net/th?id=OADD2.10239317301092_1JZSJBJO319VX0DCF&pid=21.2&w=1920&h=1080&c=4

            HTTP Request

            GET https://tse1.mm.bing.net/th?id=OADD2.10239317301525_1RYZUU337MG2SWDKJ&pid=21.2&w=1080&h=1920&c=4

            HTTP Response

            200

            HTTP Response

            200

            HTTP Response

            200

            HTTP Response

            200
          • 204.79.197.200:443
            tse1.mm.bing.net
            tls, http2
            1.2kB
             8.3kB
             16
            14
          • 204.79.197.200:443
            tse1.mm.bing.net
            tls, http2
            1.2kB
             8.3kB
             16
            14
          • 8.8.8.8:53
            2.136.104.51.in-addr.arpa
            dns
            71 B
             157 B
             1
            1

            DNS Request

            2.136.104.51.in-addr.arpa

          • 8.8.8.8:53
            180.178.17.96.in-addr.arpa
            dns
            72 B
             137 B
             1
            1

            DNS Request

            180.178.17.96.in-addr.arpa

          • 8.8.8.8:53
            0.181.190.20.in-addr.arpa
            dns
            71 B
             157 B
             1
            1

            DNS Request

            0.181.190.20.in-addr.arpa

          • 8.8.8.8:53
            95.221.229.192.in-addr.arpa
            dns
            73 B
             144 B
             1
            1

            DNS Request

            95.221.229.192.in-addr.arpa

          • 224.0.0.251:5353
            158 B
             2
          • 8.8.8.8:53
            ipinfo.io
            dns
            894fdbe41d7fa24ddb08f16ace51561a.exe
            55 B
             71 B
             1
            1

            DNS Request

            ipinfo.io

            DNS Response

            34.117.59.81

          • 8.8.8.8:53
            51.132.233.193.in-addr.arpa
            dns
            73 B
             128 B
             1
            1

            DNS Request

            51.132.233.193.in-addr.arpa

          • 8.8.8.8:53
            9.228.82.20.in-addr.arpa
            dns
            70 B
             156 B
             1
            1

            DNS Request

            9.228.82.20.in-addr.arpa

          • 8.8.8.8:53
            148.177.190.20.in-addr.arpa
            dns
            73 B
             159 B
             1
            1

            DNS Request

            148.177.190.20.in-addr.arpa

          • 8.8.8.8:53
            81.59.117.34.in-addr.arpa
            dns
            71 B
             122 B
             1
            1

            DNS Request

            81.59.117.34.in-addr.arpa

          • 8.8.8.8:53
            146.78.124.51.in-addr.arpa
            dns
            72 B
             158 B
             1
            1

            DNS Request

            146.78.124.51.in-addr.arpa

          • 8.8.8.8:53
            41.110.16.96.in-addr.arpa
            dns
            71 B
             135 B
             1
            1

            DNS Request

            41.110.16.96.in-addr.arpa

          • 8.8.8.8:53
            88.156.103.20.in-addr.arpa
            dns
            72 B
             158 B
             1
            1

            DNS Request

            88.156.103.20.in-addr.arpa

          • 8.8.8.8:53
            103.169.127.40.in-addr.arpa
            dns
            73 B
             147 B
             1
            1

            DNS Request

            103.169.127.40.in-addr.arpa

          • 8.8.8.8:53
            tse1.mm.bing.net
            dns
            62 B
             173 B
             1
            1

            DNS Request

            tse1.mm.bing.net

            DNS Response

            204.79.197.200
            13.107.21.200

          • 8.8.8.8:53
            200.197.79.204.in-addr.arpa
            dns
            73 B
             106 B
             1
            1

            DNS Request

            200.197.79.204.in-addr.arpa

          • 8.8.8.8:53
            18.31.95.13.in-addr.arpa
            dns
            70 B
             144 B
             1
            1

            DNS Request

            18.31.95.13.in-addr.arpa

          • 8.8.8.8:53
            104.241.123.92.in-addr.arpa
            dns
            73 B
             139 B
             1
            1

            DNS Request

            104.241.123.92.in-addr.arpa

          • 8.8.8.8:53
            119.110.54.20.in-addr.arpa
            dns
            72 B
             158 B
             1
            1

            DNS Request

            119.110.54.20.in-addr.arpa

          • 8.8.8.8:53
            217.135.221.88.in-addr.arpa
            dns
            73 B
             139 B
             1
            1

            DNS Request

            217.135.221.88.in-addr.arpa

          • 8.8.8.8:53
            174.178.17.96.in-addr.arpa
            dns
            72 B
             137 B
             1
            1

            DNS Request

            174.178.17.96.in-addr.arpa

          • 8.8.8.8:53
            26.35.223.20.in-addr.arpa
            dns
            71 B
             157 B
             1
            1

            DNS Request

            26.35.223.20.in-addr.arpa

          • 8.8.8.8:53
            18.134.221.88.in-addr.arpa
            dns
            72 B
             137 B
             1
            1

            DNS Request

            18.134.221.88.in-addr.arpa

          • 8.8.8.8:53
            23.236.111.52.in-addr.arpa
            dns
            72 B
             158 B
             1
            1

            DNS Request

            23.236.111.52.in-addr.arpa

          • 8.8.8.8:53
            88.65.42.20.in-addr.arpa
            dns
            70 B
             156 B
             1
            1

            DNS Request

            88.65.42.20.in-addr.arpa

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe
            Filesize

            1.6MB

            MD5

            894fdbe41d7fa24ddb08f16ace51561a

            SHA1

            2b2637864e8fa547760d1b09292976e5b6dde6d5

            SHA256

            e310cc6f7761ca6cb46dd3684a4397a0035d9818b8210fc33f2cf23e17a12df2

            SHA512

            94bb0f2e94b65e235590ae52425dc50a605870343b0241b86b33e87945128d773fe4459202eb029ed887979dd77ea1e7389a2737da4e863c0e10390de2c8b023

            Download Submit

          • C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm
            Filesize

            16KB

            MD5

            ed5a58b4fccb056d91a1cf0e73dc2998

            SHA1

            321ed46dc2a7ae134dcaec5d00f4028ee4cf5a0d

            SHA256

            13fcdc8236ad1bc3c75d373d7104762ecdeb9a000c9ec14f6ade5af80684c2e9

            SHA512

            d394036ea9bcdbdfd0b1601392644afd4ff2d0d9c7cac8f8f320c2a2653ce98817103713ce01f75b04fae02ede930030439a62988731d0fa3ca27ba28cca433a

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\grandUIACopnlDFyVX8Jg\information.txt
            Filesize

            3KB

            MD5

            b96cb7bd395a6d80dce1cf11028da492

            SHA1

            d2b38ce1168a8a17ec0ace59a98202ea0428e1f5

            SHA256

            45633baf8afe417c1a829909c845ea31d6c1211dc59d139671a000efba4a08b3

            SHA512

            0b06dbfb1999463f67859413c9f3bca7bffcf694e2b8403299822b7451cdaf2847f4fe32d6a4fc9aaae322ef49efbb7db2917323c859f1e9e7e63742a9b0b7b6

            Download Submit

          • memory/3032-116-0x00000206A1ED0000-0x00000206A1ED1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3032-118-0x00000206A1ED0000-0x00000206A1ED1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3032-109-0x00000206A1ED0000-0x00000206A1ED1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3032-110-0x00000206A1ED0000-0x00000206A1ED1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3032-111-0x00000206A1ED0000-0x00000206A1ED1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3032-112-0x00000206A1ED0000-0x00000206A1ED1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3032-113-0x00000206A1ED0000-0x00000206A1ED1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3032-114-0x00000206A1ED0000-0x00000206A1ED1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3032-115-0x00000206A1ED0000-0x00000206A1ED1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3032-92-0x0000020699940000-0x0000020699950000-memory.dmp

            Filesize

            64KB

            Download

          • memory/3032-117-0x00000206A1ED0000-0x00000206A1ED1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3032-108-0x00000206A1EA0000-0x00000206A1EA1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3032-119-0x00000206A1B00000-0x00000206A1B01000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3032-120-0x00000206A1AF0000-0x00000206A1AF1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3032-122-0x00000206A1B00000-0x00000206A1B01000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3032-125-0x00000206A1AF0000-0x00000206A1AF1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3032-128-0x00000206991E0000-0x00000206991E1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3032-76-0x0000020699840000-0x0000020699850000-memory.dmp

            Filesize

            64KB

            Download

          • memory/3032-140-0x00000206A1C20000-0x00000206A1C21000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3032-142-0x00000206A1C30000-0x00000206A1C31000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3032-143-0x00000206A1C30000-0x00000206A1C31000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3032-144-0x00000206A1D40000-0x00000206A1D41000-memory.dmp

            Filesize

            4KB

            Download

          We care about your privacy.

          This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.