Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
183s -
max time network
190s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
29/12/2023, 21:16 UTC
General
-
Target
0439163d95fcc9dd62b91dff9dfdd2a7.exe
-
Size
2.0MB
-
MD5
0439163d95fcc9dd62b91dff9dfdd2a7
-
SHA1
f063eb563e42a842034a1cc0b3e18d947e005d80
-
SHA256
298160898f7dab88f6c6d7ca5478b8ab81b614d4ee025877a0c6017e30823893
-
SHA512
de98f6d287d747c1a717d11c1a752c98f9690c9574a096268f19cf14f6ea900adbc2fe78b15c8799f7511e8cd5621e9fd4a1d98cb5b64e918be39a8fae6e0e00
-
SSDEEP
49152:JBjdqMokrcakLz0ibq6yqhMt7RJwnOcakLz0ibq6yqh:rdqMogcakcibiqhMVqOcakcibiqh
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Program crash 18 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies system certificate store 2 TTPs 5 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0439163d95fcc9dd62b91dff9dfdd2a7.exe"C:\Users\Admin\AppData\Local\Temp\0439163d95fcc9dd62b91dff9dfdd2a7.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\0439163d95fcc9dd62b91dff9dfdd2a7.exeC:\Users\Admin\AppData\Local\Temp\0439163d95fcc9dd62b91dff9dfdd2a7.exe2⤵
- Deletes itself
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /CREATE /RL HIGHEST /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\0439163d95fcc9dd62b91dff9dfdd2a7.exe" /TN Wxpz1JCma418 /F3⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c schtasks.exe /Query /XML /TN Wxpz1JCma418 > C:\Users\Admin\AppData\Local\Temp\wTsWRa.xml3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks.exe /Query /XML /TN Wxpz1JCma4184⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 6083⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 6523⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 7363⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 6603⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 7243⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 7803⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 14643⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 19163⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 21443⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 19323⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 19763⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 19163⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 21603⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 19683⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 21683⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 19323⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 21763⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 400 -s 6643⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 400 -ip 4001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 400 -ip 4001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 400 -ip 4001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 400 -ip 4001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 400 -ip 4001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 400 -ip 4001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 400 -ip 4001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 400 -ip 4001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 400 -ip 4001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 400 -ip 4001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 400 -ip 4001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 400 -ip 4001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 400 -ip 4001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 400 -ip 4001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 400 -ip 4001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 400 -ip 4001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 400 -ip 4001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 400 -ip 4001⤵
Network
-
DNS158.240.127.40.in-addr.arpaRemote address:8.8.8.8:53Request158.240.127.40.in-addr.arpaIN PTRResponse -
DNS173.178.17.96.in-addr.arpaRemote address:8.8.8.8:53Request173.178.17.96.in-addr.arpaIN PTRResponse173.178.17.96.in-addr.arpaIN PTRa96-17-178-173deploystaticakamaitechnologiescom
-
DNS140.32.126.40.in-addr.arpaRemote address:8.8.8.8:53Request140.32.126.40.in-addr.arpaIN PTRResponse
-
DNS50.23.12.20.in-addr.arpaRemote address:8.8.8.8:53Request50.23.12.20.in-addr.arpaIN PTRResponse
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS206.23.85.13.in-addr.arpaRemote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
DNS88.156.103.20.in-addr.arpaRemote address:8.8.8.8:53Request88.156.103.20.in-addr.arpaIN PTRResponse
-
DNS241.154.82.20.in-addr.arpaRemote address:8.8.8.8:53Request241.154.82.20.in-addr.arpaIN PTRResponse
-
DNSpastebin.comRemote address:8.8.8.8:53Requestpastebin.comIN AResponsepastebin.comIN A172.67.34.170pastebin.comIN A104.20.67.143pastebin.comIN A104.20.68.143
-
DNScutit.orgRemote address:8.8.8.8:53Requestcutit.orgIN AResponsecutit.orgIN A64.91.240.248
-
GEThttps://cutit.org/oxgBRRemote address:64.91.240.248:443RequestGET /oxgBR HTTP/1.1
User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.4; pt-br; MZ608 Build/7.7.1-141-7-FLEM-UMTS-LA) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Safari/534.30
Host: cutit.org
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sat, 30 Dec 2023 01:27:19 GMT
Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9
X-Powered-By: PHP/5.4.16
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 1912
Content-Type: text/html; charset=UTF-8
-
DNS170.34.67.172.in-addr.arpaRemote address:8.8.8.8:53Request170.34.67.172.in-addr.arpaIN PTRResponse
-
DNS248.240.91.64.in-addr.arpaRemote address:8.8.8.8:53Request248.240.91.64.in-addr.arpaIN PTRResponse248.240.91.64.in-addr.arpaIN PTRcrocodile parklogiccom
-
DNS18.134.221.88.in-addr.arpaRemote address:8.8.8.8:53Request18.134.221.88.in-addr.arpaIN PTRResponse18.134.221.88.in-addr.arpaIN PTRa88-221-134-18deploystaticakamaitechnologiescom
-
DNS40.13.222.173.in-addr.arpaRemote address:8.8.8.8:53Request40.13.222.173.in-addr.arpaIN PTRResponse40.13.222.173.in-addr.arpaIN PTRa173-222-13-40deploystaticakamaitechnologiescom
-
DNS41.110.16.96.in-addr.arpaRemote address:8.8.8.8:53Request41.110.16.96.in-addr.arpaIN PTRResponse41.110.16.96.in-addr.arpaIN PTRa96-16-110-41deploystaticakamaitechnologiescom
-
DNS193.179.17.96.in-addr.arpaRemote address:8.8.8.8:53Request193.179.17.96.in-addr.arpaIN PTRResponse193.179.17.96.in-addr.arpaIN PTRa96-17-179-193deploystaticakamaitechnologiescom
-
DNS59.128.231.4.in-addr.arpaRemote address:8.8.8.8:53Request59.128.231.4.in-addr.arpaIN PTRResponse
-
DNS43.58.199.20.in-addr.arpaRemote address:8.8.8.8:53Request43.58.199.20.in-addr.arpaIN PTRResponse
-
DNS43.58.199.20.in-addr.arpaRemote address:8.8.8.8:53Request43.58.199.20.in-addr.arpaIN PTRResponse
-
DNStse1.mm.bing.netRemote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
DNStse1.mm.bing.netRemote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301699_12NV8Y4ZR4ST0I53H&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301699_12NV8Y4ZR4ST0I53H&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 332996
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 1BC9992EA65744C28DE0F5BD0C78BB57 Ref B: LON04EDGE1014 Ref C: 2023-12-30T01:27:45Z
date: Sat, 30 Dec 2023 01:27:44 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301290_1IGRZL9QG2RVKOW2C&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301290_1IGRZL9QG2RVKOW2C&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 388747
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 0C02B12137864D6AAAF00693D912DBDF Ref B: LON04EDGE1014 Ref C: 2023-12-30T01:27:45Z
date: Sat, 30 Dec 2023 01:27:44 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317300974_1FWKD3OQIJ5N50HNG&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317300974_1FWKD3OQIJ5N50HNG&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 347833
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: F9F2706AF1DE41B2B8BF5AB7FAE0C230 Ref B: LON04EDGE1014 Ref C: 2023-12-30T01:27:45Z
date: Sat, 30 Dec 2023 01:27:45 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301358_1ZPBGXJ99CUBJXGTN&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301358_1ZPBGXJ99CUBJXGTN&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 323910
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 897A9256AE9C4219881FCEBB5FF36AA4 Ref B: LON04EDGE1014 Ref C: 2023-12-30T01:27:45Z
date: Sat, 30 Dec 2023 01:27:45 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317300925_1WNJI31X17K21EZ5K&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317300925_1WNJI31X17K21EZ5K&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 327646
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 03579B4DD6D8409DA8A9B428769B2912 Ref B: LON04EDGE1014 Ref C: 2023-12-30T01:27:46Z
date: Sat, 30 Dec 2023 01:27:45 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301407_1XK9J8C92JQXSR9UG&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301407_1XK9J8C92JQXSR9UG&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 349825
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: E99563F0AD1646799BBD12A2A9714FAE Ref B: LON04EDGE1014 Ref C: 2023-12-30T01:27:48Z
date: Sat, 30 Dec 2023 01:27:47 GMT
-
DNS29.243.111.52.in-addr.arpaRemote address:8.8.8.8:53Request29.243.111.52.in-addr.arpaIN PTRResponse
-
DNS29.243.111.52.in-addr.arpaRemote address:8.8.8.8:53Request29.243.111.52.in-addr.arpaIN PTR
-
DNS104.241.123.92.in-addr.arpaRemote address:8.8.8.8:53Request104.241.123.92.in-addr.arpaIN PTRResponse104.241.123.92.in-addr.arpaIN PTRa92-123-241-104deploystaticakamaitechnologiescom
-
DNS104.241.123.92.in-addr.arpaRemote address:8.8.8.8:53Request104.241.123.92.in-addr.arpaIN PTR
-
DNS119.110.54.20.in-addr.arpaRemote address:8.8.8.8:53Request119.110.54.20.in-addr.arpaIN PTRResponse
-
DNS119.110.54.20.in-addr.arpaRemote address:8.8.8.8:53Request119.110.54.20.in-addr.arpaIN PTR
-
DNS119.110.54.20.in-addr.arpaRemote address:8.8.8.8:53Request119.110.54.20.in-addr.arpaIN PTR
-
DNS209.178.17.96.in-addr.arpaRemote address:8.8.8.8:53Request209.178.17.96.in-addr.arpaIN PTRResponse209.178.17.96.in-addr.arpaIN PTRa96-17-178-209deploystaticakamaitechnologiescom
-
DNS209.178.17.96.in-addr.arpaRemote address:8.8.8.8:53Request209.178.17.96.in-addr.arpaIN PTRResponse209.178.17.96.in-addr.arpaIN PTRa96-17-178-209deploystaticakamaitechnologiescom
-
DNS217.135.221.88.in-addr.arpaRemote address:8.8.8.8:53Request217.135.221.88.in-addr.arpaIN PTRResponse217.135.221.88.in-addr.arpaIN PTRa88-221-135-217deploystaticakamaitechnologiescom
-
DNS217.135.221.88.in-addr.arpaRemote address:8.8.8.8:53Request217.135.221.88.in-addr.arpaIN PTR
-
DNS217.135.221.88.in-addr.arpaRemote address:8.8.8.8:53Request217.135.221.88.in-addr.arpaIN PTR
-
DNS81.171.91.138.in-addr.arpaRemote address:8.8.8.8:53Request81.171.91.138.in-addr.arpaIN PTRResponse
-
DNS81.171.91.138.in-addr.arpaRemote address:8.8.8.8:53Request81.171.91.138.in-addr.arpaIN PTR
-
DNS81.171.91.138.in-addr.arpaRemote address:8.8.8.8:53Request81.171.91.138.in-addr.arpaIN PTR
-
DNS174.178.17.96.in-addr.arpaRemote address:8.8.8.8:53Request174.178.17.96.in-addr.arpaIN PTRResponse174.178.17.96.in-addr.arpaIN PTRa96-17-178-174deploystaticakamaitechnologiescom
-
DNS174.178.17.96.in-addr.arpaRemote address:8.8.8.8:53Request174.178.17.96.in-addr.arpaIN PTR
-
DNS8.179.89.13.in-addr.arpaRemote address:8.8.8.8:53Request8.179.89.13.in-addr.arpaIN PTRResponse
-
DNS8.179.89.13.in-addr.arpaRemote address:8.8.8.8:53Request8.179.89.13.in-addr.arpaIN PTR
-
DNS176.178.17.96.in-addr.arpaRemote address:8.8.8.8:53Request176.178.17.96.in-addr.arpaIN PTRResponse176.178.17.96.in-addr.arpaIN PTRa96-17-178-176deploystaticakamaitechnologiescom
-
DNS176.178.17.96.in-addr.arpaRemote address:8.8.8.8:53Request176.178.17.96.in-addr.arpaIN PTR
-
DNS0.205.248.87.in-addr.arpaRemote address:8.8.8.8:53Request0.205.248.87.in-addr.arpaIN PTRResponse0.205.248.87.in-addr.arpaIN PTRhttps-87-248-205-0lgwllnwnet
-
DNS0.205.248.87.in-addr.arpaRemote address:8.8.8.8:53Request0.205.248.87.in-addr.arpaIN PTRResponse0.205.248.87.in-addr.arpaIN PTRhttps-87-248-205-0lgwllnwnet
-
20.231.121.79:80
-
172.67.34.170:443pastebin.com
-
64.91.240.248:443https://cutit.org/oxgBRtls, http
HTTP Request
GET https://cutit.org/oxgBRHTTP Response
200 -
204.79.197.200:443tse1.mm.bing.nettls, http2
-
204.79.197.200:443tse1.mm.bing.nettls, http2
-
204.79.197.200:443tse1.mm.bing.nettls, http2
-
204.79.197.200:443https://tse1.mm.bing.net/th?id=OADD2.10239317301407_1XK9J8C92JQXSR9UG&pid=21.2&w=1080&h=1920&c=4tls, http2
HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301699_12NV8Y4ZR4ST0I53H&pid=21.2&w=1080&h=1920&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301290_1IGRZL9QG2RVKOW2C&pid=21.2&w=1920&h=1080&c=4HTTP Response
200HTTP Response
200HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317300974_1FWKD3OQIJ5N50HNG&pid=21.2&w=1920&h=1080&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301358_1ZPBGXJ99CUBJXGTN&pid=21.2&w=1080&h=1920&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317300925_1WNJI31X17K21EZ5K&pid=21.2&w=1920&h=1080&c=4HTTP Response
200HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301407_1XK9J8C92JQXSR9UG&pid=21.2&w=1080&h=1920&c=4HTTP Response
200HTTP Response
200HTTP Response
200 -
204.79.197.200:443tse1.mm.bing.nettls, http2
-
96.17.178.174:80
-
8.8.8.8:53158.240.127.40.in-addr.arpadns
DNS Request
158.240.127.40.in-addr.arpa
-
8.8.8.8:53173.178.17.96.in-addr.arpadns
DNS Request
173.178.17.96.in-addr.arpa
-
8.8.8.8:53140.32.126.40.in-addr.arpadns
DNS Request
140.32.126.40.in-addr.arpa
-
8.8.8.8:5350.23.12.20.in-addr.arpadns
DNS Request
50.23.12.20.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:53206.23.85.13.in-addr.arpadns
DNS Request
206.23.85.13.in-addr.arpa
-
8.8.8.8:5388.156.103.20.in-addr.arpadns
DNS Request
88.156.103.20.in-addr.arpa
-
8.8.8.8:53241.154.82.20.in-addr.arpadns
DNS Request
241.154.82.20.in-addr.arpa
-
8.8.8.8:53pastebin.comdns
DNS Request
pastebin.com
DNS Response
172.67.34.170104.20.67.143104.20.68.143
-
8.8.8.8:53cutit.orgdns
DNS Request
cutit.org
DNS Response
64.91.240.248
-
8.8.8.8:53170.34.67.172.in-addr.arpadns
DNS Request
170.34.67.172.in-addr.arpa
-
8.8.8.8:53248.240.91.64.in-addr.arpadns
DNS Request
248.240.91.64.in-addr.arpa
-
8.8.8.8:5318.134.221.88.in-addr.arpadns
DNS Request
18.134.221.88.in-addr.arpa
-
8.8.8.8:5340.13.222.173.in-addr.arpadns
DNS Request
40.13.222.173.in-addr.arpa
-
8.8.8.8:5341.110.16.96.in-addr.arpadns
DNS Request
41.110.16.96.in-addr.arpa
-
8.8.8.8:53193.179.17.96.in-addr.arpadns
DNS Request
193.179.17.96.in-addr.arpa
-
8.8.8.8:5359.128.231.4.in-addr.arpadns
DNS Request
59.128.231.4.in-addr.arpa
-
8.8.8.8:5343.58.199.20.in-addr.arpadns
DNS Request
43.58.199.20.in-addr.arpa
DNS Request
43.58.199.20.in-addr.arpa
-
8.8.8.8:53tse1.mm.bing.netdns
DNS Request
tse1.mm.bing.net
DNS Request
tse1.mm.bing.net
DNS Response
204.79.197.20013.107.21.200
DNS Response
204.79.197.20013.107.21.200
-
8.8.8.8:5329.243.111.52.in-addr.arpadns
DNS Request
29.243.111.52.in-addr.arpa
DNS Request
29.243.111.52.in-addr.arpa
-
8.8.8.8:53104.241.123.92.in-addr.arpadns
DNS Request
104.241.123.92.in-addr.arpa
DNS Request
104.241.123.92.in-addr.arpa
-
8.8.8.8:53119.110.54.20.in-addr.arpadns
DNS Request
119.110.54.20.in-addr.arpa
DNS Request
119.110.54.20.in-addr.arpa
DNS Request
119.110.54.20.in-addr.arpa
-
8.8.8.8:53209.178.17.96.in-addr.arpadns
DNS Request
209.178.17.96.in-addr.arpa
DNS Request
209.178.17.96.in-addr.arpa
-
8.8.8.8:53217.135.221.88.in-addr.arpadns
DNS Request
217.135.221.88.in-addr.arpa
DNS Request
217.135.221.88.in-addr.arpa
DNS Request
217.135.221.88.in-addr.arpa
-
8.8.8.8:5381.171.91.138.in-addr.arpadns
DNS Request
81.171.91.138.in-addr.arpa
DNS Request
81.171.91.138.in-addr.arpa
DNS Request
81.171.91.138.in-addr.arpa
-
8.8.8.8:53174.178.17.96.in-addr.arpadns
DNS Request
174.178.17.96.in-addr.arpa
DNS Request
174.178.17.96.in-addr.arpa
-
8.8.8.8:538.179.89.13.in-addr.arpadns
DNS Request
8.179.89.13.in-addr.arpa
DNS Request
8.179.89.13.in-addr.arpa
-
8.8.8.8:53176.178.17.96.in-addr.arpadns
DNS Request
176.178.17.96.in-addr.arpa
DNS Request
176.178.17.96.in-addr.arpa
-
8.8.8.8:530.205.248.87.in-addr.arpadns
DNS Request
0.205.248.87.in-addr.arpa
DNS Request
0.205.248.87.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
658KB
MD5c5ecf953ae04bf62da48f43549a983bb
SHA129cebba700b99c60192870efa15f2aa5401a4277
SHA256e3025912d11a58d31277b374605da31fe33eac6f7e0ab8d1e4185e5ef2da67ad
SHA5124baa9fc048bee468c73e98cf0a77f8a3401222555358bd16fff7616f443b023de5f3a444883c79b57e41e853697f8b6f0666b40d1e54c367b2772fcdc3efc6c1
-
Filesize
1KB
MD50deedb441ecda8d25abbb184de4a0ed6
SHA1c164c10f0df0c1d6fba90bf8137d045274b3ca57
SHA25612c9753c1af735705d5a703efab95cf2d0aa3a945e48f5247aae8611f17c585a
SHA512c27d87360997b52b0103e156ad01b28c485964dc5202db164d3e3de19b8235374ad157b1822e25e4a1fa76c2a6534c230a34d49e40a68ad468042f7660a58384
-
Filesize
2.4MB
-
Filesize
504KB
-
Filesize
428KB
-
Filesize
364KB
-
Filesize
2.4MB
-
Filesize
2.4MB
-
Filesize
428KB
-
Filesize
504KB
-
Filesize
428KB