Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 22:49 UTC
Static task
static1
Behavioral task
behavioral1
Sample
1ef652cf753aac92977c2cfea7fe08c4.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1ef652cf753aac92977c2cfea7fe08c4.exe
Resource
win10v2004-20231215-en
General
-
Target
1ef652cf753aac92977c2cfea7fe08c4.exe
-
Size
3.1MB
-
MD5
1ef652cf753aac92977c2cfea7fe08c4
-
SHA1
2c4b9cb5ae6f174c97626c02a4a122e48c43dee2
-
SHA256
6ebeb06cb2d2beddb16bfd2a4e689ac133b34e734954b694edf0aa2c3ea25ae6
-
SHA512
3ea9fdbaaf006ffe69b126e92398a779e1887865a8b555f0e39fb31c0ea8edd9d265d79318f3e2ad314dabcab46c4855688472a016c30aafb9aa02ef56870126
-
SSDEEP
49152:0itOd4k7ydepSSPIZDscC+QZKDVdfu31h:0iK4IIZYfZKDVQFh
Malware Config
Signatures
-
Blocklisted process makes network request 11 IoCs
flow pid Process 14 2444 cmd.exe 16 2444 cmd.exe 17 2444 cmd.exe 18 2444 cmd.exe 20 2444 cmd.exe 22 2444 cmd.exe 24 2444 cmd.exe 25 2444 cmd.exe 26 2444 cmd.exe 27 2444 cmd.exe 28 2444 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 1320 GetX64BTIT.exe -
Loads dropped DLL 1 IoCs
pid Process 2444 cmd.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 15 api.ipify.org 16 api.ipify.org -
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.
-
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Tasks\cms.job cmd.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 1888 notepad.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe 2444 cmd.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1888 notepad.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2444 cmd.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 2940 wrote to memory of 1888 2940 1ef652cf753aac92977c2cfea7fe08c4.exe 28 PID 1888 wrote to memory of 2444 1888 notepad.exe 29 PID 1888 wrote to memory of 2444 1888 notepad.exe 29 PID 1888 wrote to memory of 2444 1888 notepad.exe 29 PID 1888 wrote to memory of 2444 1888 notepad.exe 29 PID 1888 wrote to memory of 2444 1888 notepad.exe 29 PID 1888 wrote to memory of 2444 1888 notepad.exe 29 PID 1888 wrote to memory of 2444 1888 notepad.exe 29 PID 1888 wrote to memory of 2444 1888 notepad.exe 29 PID 1888 wrote to memory of 2444 1888 notepad.exe 29 PID 1888 wrote to memory of 2444 1888 notepad.exe 29 PID 1888 wrote to memory of 2444 1888 notepad.exe 29 PID 1888 wrote to memory of 2444 1888 notepad.exe 29 PID 1888 wrote to memory of 2444 1888 notepad.exe 29 PID 1888 wrote to memory of 2444 1888 notepad.exe 29 PID 1888 wrote to memory of 2444 1888 notepad.exe 29 PID 1888 wrote to memory of 2444 1888 notepad.exe 29 PID 1888 wrote to memory of 2444 1888 notepad.exe 29 PID 1888 wrote to memory of 2444 1888 notepad.exe 29 PID 1888 wrote to memory of 2444 1888 notepad.exe 29 PID 1888 wrote to memory of 2444 1888 notepad.exe 29 PID 1888 wrote to memory of 2444 1888 notepad.exe 29 PID 1888 wrote to memory of 2444 1888 notepad.exe 29 PID 1888 wrote to memory of 2444 1888 notepad.exe 29 PID 1888 wrote to memory of 2444 1888 notepad.exe 29 PID 1888 wrote to memory of 2444 1888 notepad.exe 29 PID 1888 wrote to memory of 2444 1888 notepad.exe 29 PID 1888 wrote to memory of 2444 1888 notepad.exe 29 PID 1888 wrote to memory of 2444 1888 notepad.exe 29 PID 1888 wrote to memory of 2444 1888 notepad.exe 29 PID 1888 wrote to memory of 2444 1888 notepad.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ef652cf753aac92977c2cfea7fe08c4.exe"C:\Users\Admin\AppData\Local\Temp\1ef652cf753aac92977c2cfea7fe08c4.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\system32\notepad.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"4⤵
- Executes dropped EXE
PID:1320
-
-
-
Network
-
Remote address:8.8.8.8:53Requesti.imgur.comIN AResponsei.imgur.comIN CNAMEipv4.imgur.map.fastly.netipv4.imgur.map.fastly.netIN A199.232.168.193
-
Remote address:8.8.8.8:53Requesti.imgur.comIN A
-
Remote address:199.232.168.193:443RequestHEAD /tc6bGvH.png HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.5
Host: i.imgur.com
ResponseHTTP/1.1 200 OK
Content-Length: 550472
Content-Type: image/png
Last-Modified: Mon, 18 Jan 2021 19:44:24 GMT
ETag: "8a0495e7d2efa7e2e0f7b66a01aaafd1"
x-amz-storage-class: STANDARD_IA
X-Amz-Cf-Pop: IAD12-P2
X-Amz-Cf-Id: lg2mQvp5BbZO2q0uV5BiUWaj2qJR-v8HcdbRA6cbzUcvtNWkzlzprw==
cache-control: public, max-age=31536000
Accept-Ranges: bytes
Date: Thu, 04 Jan 2024 18:11:50 GMT
Age: 0
X-Served-By: cache-iad-kiad7000062-IAD, cache-par-lfpg1960027-PAR
X-Cache: Miss from cloudfront, HIT, MISS
X-Cache-Hits: 1, 0
X-Timer: S1704391911.667333,VS0,VE161
Strict-Transport-Security: max-age=300
Access-Control-Allow-Methods: GET, OPTIONS
Access-Control-Allow-Origin: *
Server: cat factory 1.0
X-Content-Type-Options: nosniff
-
Remote address:199.232.168.193:443RequestGET /tc6bGvH.png HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Mon, 18 Jan 2021 19:44:24 GMT
Range: bytes=0-4707
User-Agent: Microsoft BITS/7.5
Host: i.imgur.com
ResponseHTTP/1.1 206 Partial Content
Content-Length: 4708
Content-Type: image/png
Last-Modified: Mon, 18 Jan 2021 19:44:24 GMT
ETag: "8a0495e7d2efa7e2e0f7b66a01aaafd1"
x-amz-storage-class: STANDARD_IA
X-Amz-Cf-Pop: IAD12-P2
X-Amz-Cf-Id: lg2mQvp5BbZO2q0uV5BiUWaj2qJR-v8HcdbRA6cbzUcvtNWkzlzprw==
cache-control: public, max-age=31536000
Accept-Ranges: bytes
Date: Thu, 04 Jan 2024 18:11:54 GMT
Age: 4
X-Served-By: cache-iad-kiad7000062-IAD, cache-par-lfpg1960027-PAR
X-Cache: Miss from cloudfront, HIT, HIT
X-Cache-Hits: 1, 1
X-Timer: S1704391915.956450,VS0,VE0
Strict-Transport-Security: max-age=300
Access-Control-Allow-Methods: GET, OPTIONS
Access-Control-Allow-Origin: *
Server: cat factory 1.0
X-Content-Type-Options: nosniff
Content-Range: bytes 0-4707/550472
-
Remote address:199.232.168.193:443RequestGET /tc6bGvH.png HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Mon, 18 Jan 2021 19:44:24 GMT
Range: bytes=4708-11960
User-Agent: Microsoft BITS/7.5
Host: i.imgur.com
ResponseHTTP/1.1 206 Partial Content
Content-Length: 7253
Content-Type: image/png
Last-Modified: Mon, 18 Jan 2021 19:44:24 GMT
ETag: "8a0495e7d2efa7e2e0f7b66a01aaafd1"
x-amz-storage-class: STANDARD_IA
X-Amz-Cf-Pop: IAD12-P2
X-Amz-Cf-Id: lg2mQvp5BbZO2q0uV5BiUWaj2qJR-v8HcdbRA6cbzUcvtNWkzlzprw==
cache-control: public, max-age=31536000
Accept-Ranges: bytes
Date: Thu, 04 Jan 2024 18:11:58 GMT
Age: 7
X-Served-By: cache-iad-kiad7000062-IAD, cache-par-lfpg1960027-PAR
X-Cache: Miss from cloudfront, HIT, HIT
X-Cache-Hits: 1, 2
X-Timer: S1704391918.063075,VS0,VE0
Strict-Transport-Security: max-age=300
Access-Control-Allow-Methods: GET, OPTIONS
Access-Control-Allow-Origin: *
Server: cat factory 1.0
X-Content-Type-Options: nosniff
Content-Range: bytes 4708-11960/550472
-
Remote address:199.232.168.193:443RequestGET /tc6bGvH.png HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Mon, 18 Jan 2021 19:44:24 GMT
Range: bytes=11961-22121
User-Agent: Microsoft BITS/7.5
Host: i.imgur.com
ResponseHTTP/1.1 206 Partial Content
Content-Length: 10161
Content-Type: image/png
Last-Modified: Mon, 18 Jan 2021 19:44:24 GMT
ETag: "8a0495e7d2efa7e2e0f7b66a01aaafd1"
x-amz-storage-class: STANDARD_IA
X-Amz-Cf-Pop: IAD12-P2
X-Amz-Cf-Id: lg2mQvp5BbZO2q0uV5BiUWaj2qJR-v8HcdbRA6cbzUcvtNWkzlzprw==
cache-control: public, max-age=31536000
Accept-Ranges: bytes
Date: Thu, 04 Jan 2024 18:12:00 GMT
Age: 9
X-Served-By: cache-iad-kiad7000062-IAD, cache-par-lfpg1960027-PAR
X-Cache: Miss from cloudfront, HIT, HIT
X-Cache-Hits: 1, 3
X-Timer: S1704391920.069147,VS0,VE0
Strict-Transport-Security: max-age=300
Access-Control-Allow-Methods: GET, OPTIONS
Access-Control-Allow-Origin: *
Server: cat factory 1.0
X-Content-Type-Options: nosniff
Content-Range: bytes 11961-22121/550472
-
Remote address:199.232.168.193:443RequestGET /tc6bGvH.png HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Mon, 18 Jan 2021 19:44:24 GMT
Range: bytes=22122-39501
User-Agent: Microsoft BITS/7.5
Host: i.imgur.com
ResponseHTTP/1.1 206 Partial Content
Content-Length: 17380
Content-Type: image/png
Last-Modified: Mon, 18 Jan 2021 19:44:24 GMT
ETag: "8a0495e7d2efa7e2e0f7b66a01aaafd1"
x-amz-storage-class: STANDARD_IA
X-Amz-Cf-Pop: IAD12-P2
X-Amz-Cf-Id: lg2mQvp5BbZO2q0uV5BiUWaj2qJR-v8HcdbRA6cbzUcvtNWkzlzprw==
cache-control: public, max-age=31536000
Accept-Ranges: bytes
Date: Thu, 04 Jan 2024 18:12:02 GMT
Age: 12
X-Served-By: cache-iad-kiad7000062-IAD, cache-par-lfpg1960027-PAR
X-Cache: Miss from cloudfront, HIT, HIT
X-Cache-Hits: 1, 4
X-Timer: S1704391922.379796,VS0,VE0
Strict-Transport-Security: max-age=300
Access-Control-Allow-Methods: GET, OPTIONS
Access-Control-Allow-Origin: *
Server: cat factory 1.0
X-Content-Type-Options: nosniff
Content-Range: bytes 22122-39501/550472
-
Remote address:199.232.168.193:443RequestGET /tc6bGvH.png HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Mon, 18 Jan 2021 19:44:24 GMT
Range: bytes=39502-53463
User-Agent: Microsoft BITS/7.5
Host: i.imgur.com
ResponseHTTP/1.1 206 Partial Content
Content-Length: 13962
Content-Type: image/png
Last-Modified: Mon, 18 Jan 2021 19:44:24 GMT
ETag: "8a0495e7d2efa7e2e0f7b66a01aaafd1"
x-amz-storage-class: STANDARD_IA
X-Amz-Cf-Pop: IAD12-P2
X-Amz-Cf-Id: lg2mQvp5BbZO2q0uV5BiUWaj2qJR-v8HcdbRA6cbzUcvtNWkzlzprw==
cache-control: public, max-age=31536000
Accept-Ranges: bytes
Date: Thu, 04 Jan 2024 18:12:03 GMT
Age: 12
X-Served-By: cache-iad-kiad7000062-IAD, cache-par-lfpg1960027-PAR
X-Cache: Miss from cloudfront, HIT, HIT
X-Cache-Hits: 1, 5
X-Timer: S1704391923.121266,VS0,VE0
Strict-Transport-Security: max-age=300
Access-Control-Allow-Methods: GET, OPTIONS
Access-Control-Allow-Origin: *
Server: cat factory 1.0
X-Content-Type-Options: nosniff
Content-Range: bytes 39502-53463/550472
-
Remote address:199.232.168.193:443RequestGET /tc6bGvH.png HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Mon, 18 Jan 2021 19:44:24 GMT
Range: bytes=53464-82813
User-Agent: Microsoft BITS/7.5
Host: i.imgur.com
ResponseHTTP/1.1 206 Partial Content
Content-Length: 29350
Content-Type: image/png
Last-Modified: Mon, 18 Jan 2021 19:44:24 GMT
ETag: "8a0495e7d2efa7e2e0f7b66a01aaafd1"
x-amz-storage-class: STANDARD_IA
X-Amz-Cf-Pop: IAD12-P2
X-Amz-Cf-Id: lg2mQvp5BbZO2q0uV5BiUWaj2qJR-v8HcdbRA6cbzUcvtNWkzlzprw==
cache-control: public, max-age=31536000
Accept-Ranges: bytes
Date: Thu, 04 Jan 2024 18:12:04 GMT
Age: 13
X-Served-By: cache-iad-kiad7000062-IAD, cache-par-lfpg1960027-PAR
X-Cache: Miss from cloudfront, HIT, HIT
X-Cache-Hits: 1, 6
X-Timer: S1704391924.112844,VS0,VE0
Strict-Transport-Security: max-age=300
Access-Control-Allow-Methods: GET, OPTIONS
Access-Control-Allow-Origin: *
Server: cat factory 1.0
X-Content-Type-Options: nosniff
Content-Range: bytes 53464-82813/550472
-
Remote address:199.232.168.193:443RequestGET /tc6bGvH.png HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Mon, 18 Jan 2021 19:44:24 GMT
Range: bytes=82814-142790
User-Agent: Microsoft BITS/7.5
Host: i.imgur.com
ResponseHTTP/1.1 206 Partial Content
Content-Length: 59977
Content-Type: image/png
Last-Modified: Mon, 18 Jan 2021 19:44:24 GMT
ETag: "8a0495e7d2efa7e2e0f7b66a01aaafd1"
x-amz-storage-class: STANDARD_IA
X-Amz-Cf-Pop: IAD12-P2
X-Amz-Cf-Id: lg2mQvp5BbZO2q0uV5BiUWaj2qJR-v8HcdbRA6cbzUcvtNWkzlzprw==
cache-control: public, max-age=31536000
Accept-Ranges: bytes
Date: Thu, 04 Jan 2024 18:12:05 GMT
Age: 14
X-Served-By: cache-iad-kiad7000062-IAD, cache-par-lfpg1960027-PAR
X-Cache: Miss from cloudfront, HIT, HIT
X-Cache-Hits: 1, 7
X-Timer: S1704391925.127769,VS0,VE0
Strict-Transport-Security: max-age=300
Access-Control-Allow-Methods: GET, OPTIONS
Access-Control-Allow-Origin: *
Server: cat factory 1.0
X-Content-Type-Options: nosniff
Content-Range: bytes 82814-142790/550472
-
Remote address:199.232.168.193:443RequestGET /tc6bGvH.png HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Mon, 18 Jan 2021 19:44:24 GMT
Range: bytes=142791-229067
User-Agent: Microsoft BITS/7.5
Host: i.imgur.com
ResponseHTTP/1.1 206 Partial Content
Content-Length: 86277
Content-Type: image/png
Last-Modified: Mon, 18 Jan 2021 19:44:24 GMT
ETag: "8a0495e7d2efa7e2e0f7b66a01aaafd1"
x-amz-storage-class: STANDARD_IA
X-Amz-Cf-Pop: IAD12-P2
X-Amz-Cf-Id: lg2mQvp5BbZO2q0uV5BiUWaj2qJR-v8HcdbRA6cbzUcvtNWkzlzprw==
cache-control: public, max-age=31536000
Accept-Ranges: bytes
Date: Thu, 04 Jan 2024 18:12:06 GMT
Age: 15
X-Served-By: cache-iad-kiad7000062-IAD, cache-par-lfpg1960027-PAR
X-Cache: Miss from cloudfront, HIT, HIT
X-Cache-Hits: 1, 8
X-Timer: S1704391926.149504,VS0,VE0
Strict-Transport-Security: max-age=300
Access-Control-Allow-Methods: GET, OPTIONS
Access-Control-Allow-Origin: *
Server: cat factory 1.0
X-Content-Type-Options: nosniff
Content-Range: bytes 142791-229067/550472
-
Remote address:199.232.168.193:443RequestGET /tc6bGvH.png HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Mon, 18 Jan 2021 19:44:24 GMT
Range: bytes=229068-327278
User-Agent: Microsoft BITS/7.5
Host: i.imgur.com
ResponseHTTP/1.1 206 Partial Content
Content-Length: 98211
Content-Type: image/png
Last-Modified: Mon, 18 Jan 2021 19:44:24 GMT
ETag: "8a0495e7d2efa7e2e0f7b66a01aaafd1"
x-amz-storage-class: STANDARD_IA
X-Amz-Cf-Pop: IAD12-P2
X-Amz-Cf-Id: lg2mQvp5BbZO2q0uV5BiUWaj2qJR-v8HcdbRA6cbzUcvtNWkzlzprw==
cache-control: public, max-age=31536000
Accept-Ranges: bytes
Date: Thu, 04 Jan 2024 18:12:07 GMT
Age: 16
X-Served-By: cache-iad-kiad7000062-IAD, cache-par-lfpg1960027-PAR
X-Cache: Miss from cloudfront, HIT, HIT
X-Cache-Hits: 1, 9
X-Timer: S1704391927.155251,VS0,VE0
Strict-Transport-Security: max-age=300
Access-Control-Allow-Methods: GET, OPTIONS
Access-Control-Allow-Origin: *
Server: cat factory 1.0
X-Content-Type-Options: nosniff
Content-Range: bytes 229068-327278/550472
-
Remote address:199.232.168.193:443RequestGET /tc6bGvH.png HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Mon, 18 Jan 2021 19:44:24 GMT
Range: bytes=327279-419271
User-Agent: Microsoft BITS/7.5
Host: i.imgur.com
ResponseHTTP/1.1 206 Partial Content
Content-Length: 91993
Content-Type: image/png
Last-Modified: Mon, 18 Jan 2021 19:44:24 GMT
ETag: "8a0495e7d2efa7e2e0f7b66a01aaafd1"
x-amz-storage-class: STANDARD_IA
X-Amz-Cf-Pop: IAD12-P2
X-Amz-Cf-Id: lg2mQvp5BbZO2q0uV5BiUWaj2qJR-v8HcdbRA6cbzUcvtNWkzlzprw==
cache-control: public, max-age=31536000
Accept-Ranges: bytes
Date: Thu, 04 Jan 2024 18:12:08 GMT
Age: 18
X-Served-By: cache-iad-kiad7000062-IAD, cache-par-lfpg1960027-PAR
X-Cache: Miss from cloudfront, HIT, HIT
X-Cache-Hits: 1, 10
X-Timer: S1704391928.479750,VS0,VE0
Strict-Transport-Security: max-age=300
Access-Control-Allow-Methods: GET, OPTIONS
Access-Control-Allow-Origin: *
Server: cat factory 1.0
X-Content-Type-Options: nosniff
Content-Range: bytes 327279-419271/550472
-
Remote address:199.232.168.193:443RequestGET /tc6bGvH.png HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Mon, 18 Jan 2021 19:44:24 GMT
Range: bytes=419272-496399
User-Agent: Microsoft BITS/7.5
Host: i.imgur.com
ResponseHTTP/1.1 206 Partial Content
Content-Length: 77128
Content-Type: image/png
Last-Modified: Mon, 18 Jan 2021 19:44:24 GMT
ETag: "8a0495e7d2efa7e2e0f7b66a01aaafd1"
x-amz-storage-class: STANDARD_IA
X-Amz-Cf-Pop: IAD12-P2
X-Amz-Cf-Id: lg2mQvp5BbZO2q0uV5BiUWaj2qJR-v8HcdbRA6cbzUcvtNWkzlzprw==
cache-control: public, max-age=31536000
Accept-Ranges: bytes
Date: Thu, 04 Jan 2024 18:12:09 GMT
Age: 19
X-Served-By: cache-iad-kiad7000062-IAD, cache-par-lfpg1960027-PAR
X-Cache: Miss from cloudfront, HIT, HIT
X-Cache-Hits: 1, 11
X-Timer: S1704391930.588618,VS0,VE0
Strict-Transport-Security: max-age=300
Access-Control-Allow-Methods: GET, OPTIONS
Access-Control-Allow-Origin: *
Server: cat factory 1.0
X-Content-Type-Options: nosniff
Content-Range: bytes 419272-496399/550472
-
Remote address:199.232.168.193:443RequestGET /tc6bGvH.png HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Mon, 18 Jan 2021 19:44:24 GMT
Range: bytes=496400-550471
User-Agent: Microsoft BITS/7.5
Host: i.imgur.com
ResponseHTTP/1.1 206 Partial Content
Content-Length: 54072
Content-Type: image/png
Last-Modified: Mon, 18 Jan 2021 19:44:24 GMT
ETag: "8a0495e7d2efa7e2e0f7b66a01aaafd1"
x-amz-storage-class: STANDARD_IA
X-Amz-Cf-Pop: IAD12-P2
X-Amz-Cf-Id: lg2mQvp5BbZO2q0uV5BiUWaj2qJR-v8HcdbRA6cbzUcvtNWkzlzprw==
cache-control: public, max-age=31536000
Accept-Ranges: bytes
Date: Thu, 04 Jan 2024 18:12:10 GMT
Age: 20
X-Served-By: cache-iad-kiad7000062-IAD, cache-par-lfpg1960027-PAR
X-Cache: Miss from cloudfront, HIT, HIT
X-Cache-Hits: 1, 12
X-Timer: S1704391931.800972,VS0,VE0
Strict-Transport-Security: max-age=300
Access-Control-Allow-Methods: GET, OPTIONS
Access-Control-Allow-Origin: *
Server: cat factory 1.0
X-Content-Type-Options: nosniff
Content-Range: bytes 496400-550471/550472
-
Remote address:8.8.8.8:53Requestwww.microsoft.comIN AResponsewww.microsoft.comIN CNAMEwww.microsoft.com-c-3.edgekey.netwww.microsoft.com-c-3.edgekey.netIN CNAMEwww.microsoft.com-c-3.edgekey.net.globalredir.akadns.netwww.microsoft.com-c-3.edgekey.net.globalredir.akadns.netIN CNAMEe13678.dscb.akamaiedge.nete13678.dscb.akamaiedge.netIN A2.17.5.133
-
Remote address:8.8.8.8:53Requestwww.microsoft.comIN A
-
Remote address:8.8.8.8:53Requesti.imgur.comIN AResponsei.imgur.comIN CNAMEipv4.imgur.map.fastly.netipv4.imgur.map.fastly.netIN A151.101.60.193
-
Remote address:131.188.40.189:80RequestGET /tor/status-vote/current/consensus HTTP/1.0
Host: 131.188.40.189
ResponseHTTP/1.0 200 OK
Content-Type: text/plain
X-Your-Address-Is: 89.149.23.59
Content-Encoding: identity
Expires: Thu, 04 Jan 2024 19:00:00 GMT
Vary: X-Or-Diff-From-Consensus
-
Remote address:8.8.8.8:53Requestapi.ipify.orgIN AResponseapi.ipify.orgIN CNAMEapi4.ipify.orgapi4.ipify.orgIN A104.237.62.212api4.ipify.orgIN A64.185.227.156api4.ipify.orgIN A173.231.16.77
-
Remote address:193.23.244.244:80RequestGET /tor/server/fp/63e742d4f2552c0299e563cc7013c20575042630 HTTP/1.0
Host: 193.23.244.244
ResponseHTTP/1.0 200 OK
Content-Type: text/plain
X-Your-Address-Is: 89.149.23.59
Content-Encoding: identity
Expires: Sat, 06 Jan 2024 18:13:02 GMT
-
Remote address:8.8.8.8:53Requesttime-a.nist.govIN AResponsetime-a.nist.govIN CNAMEtime-a-g.nist.govtime-a-g.nist.govIN A129.6.15.28
-
Remote address:8.8.8.8:53Requesttime-a-g.nist.govIN AResponsetime-a-g.nist.govIN A129.6.15.28
-
Remote address:8.8.8.8:53Requesttime-a-g.nist.govIN A
-
Remote address:8.8.8.8:53Requesttime.nist.govIN AResponsetime.nist.govIN CNAMEntp1.glb.nist.govntp1.glb.nist.govIN A132.163.97.3
-
Remote address:193.23.244.244:80RequestGET /tor/server/fp/083c52051140db8af770bd40c7c8883efff4caf3 HTTP/1.0
Host: 193.23.244.244
ResponseHTTP/1.0 200 OK
Content-Type: text/plain
X-Your-Address-Is: 89.149.23.59
Content-Encoding: identity
Expires: Sat, 06 Jan 2024 18:13:48 GMT
-
Remote address:193.23.244.244:80RequestGET /tor/server/fp/2776b79f177cab267ef5334ccfcfa82356082e8f HTTP/1.0
Host: 193.23.244.244
ResponseHTTP/1.0 200 OK
Content-Type: text/plain
X-Your-Address-Is: 89.149.23.59
Content-Encoding: identity
Expires: Sat, 06 Jan 2024 18:13:58 GMT
-
Remote address:193.23.244.244:80RequestGET /tor/server/fp/a347d0563fc397d434898395fee6e8395e2f18a0 HTTP/1.0
Host: 193.23.244.244
ResponseHTTP/1.0 200 OK
Content-Type: text/plain
X-Your-Address-Is: 89.149.23.59
Content-Encoding: identity
Expires: Sat, 06 Jan 2024 18:14:02 GMT
-
Remote address:193.23.244.244:80RequestGET /tor/server/fp/950e02db326d28101e29286044c5714a204f3222 HTTP/1.0
Host: 193.23.244.244
ResponseHTTP/1.0 200 OK
Content-Type: text/plain
X-Your-Address-Is: 89.149.23.59
Content-Encoding: identity
Expires: Sat, 06 Jan 2024 18:14:02 GMT
-
17.2kB 592.2kB 276 452
HTTP Request
HEAD https://i.imgur.com/tc6bGvH.pngHTTP Response
200HTTP Request
GET https://i.imgur.com/tc6bGvH.pngHTTP Response
206HTTP Request
GET https://i.imgur.com/tc6bGvH.pngHTTP Response
206HTTP Request
GET https://i.imgur.com/tc6bGvH.pngHTTP Response
206HTTP Request
GET https://i.imgur.com/tc6bGvH.pngHTTP Response
206HTTP Request
GET https://i.imgur.com/tc6bGvH.pngHTTP Response
206HTTP Request
GET https://i.imgur.com/tc6bGvH.pngHTTP Response
206HTTP Request
GET https://i.imgur.com/tc6bGvH.pngHTTP Response
206HTTP Request
GET https://i.imgur.com/tc6bGvH.pngHTTP Response
206HTTP Request
GET https://i.imgur.com/tc6bGvH.pngHTTP Response
206HTTP Request
GET https://i.imgur.com/tc6bGvH.pngHTTP Response
206HTTP Request
GET https://i.imgur.com/tc6bGvH.pngHTTP Response
206HTTP Request
GET https://i.imgur.com/tc6bGvH.pngHTTP Response
206 -
70.9kB 3.5MB 1483 2494
HTTP Request
GET http://131.188.40.189/tor/status-vote/current/consensusHTTP Response
200 -
603 B 251 B 8 6
-
193.23.244.244:80http://193.23.244.244/tor/server/fp/63e742d4f2552c0299e563cc7013c20575042630httpcmd.exe371 B 2.6kB 6 5
HTTP Request
GET http://193.23.244.244/tor/server/fp/63e742d4f2552c0299e563cc7013c20575042630HTTP Response
200 -
466 B 219 B 8 5
-
426 B 172 B 9 4
-
242 B 132 B 5 3
-
294 B 275 B 6 5
-
193.23.244.244:80http://193.23.244.244/tor/server/fp/083c52051140db8af770bd40c7c8883efff4caf3httpcmd.exe423 B 2.9kB 7 5
HTTP Request
GET http://193.23.244.244/tor/server/fp/083c52051140db8af770bd40c7c8883efff4caf3HTTP Response
200 -
4.4kB 7.9kB 17 17
-
193.23.244.244:80http://193.23.244.244/tor/server/fp/2776b79f177cab267ef5334ccfcfa82356082e8fhttpcmd.exe371 B 2.6kB 6 5
HTTP Request
GET http://193.23.244.244/tor/server/fp/2776b79f177cab267ef5334ccfcfa82356082e8fHTTP Response
200 -
193.23.244.244:80http://193.23.244.244/tor/server/fp/a347d0563fc397d434898395fee6e8395e2f18a0httpcmd.exe607 B 16.1kB 11 14
HTTP Request
GET http://193.23.244.244/tor/server/fp/a347d0563fc397d434898395fee6e8395e2f18a0HTTP Response
200 -
417 B 2.7kB 7 5
HTTP Request
GET http://193.23.244.244/tor/server/fp/950e02db326d28101e29286044c5714a204f3222HTTP Response
200 -
325 B 219 B 5 5
-
114 B 112 B 2 1
DNS Request
i.imgur.com
DNS Request
i.imgur.com
DNS Response
199.232.168.193
-
126 B 230 B 2 1
DNS Request
www.microsoft.com
DNS Request
www.microsoft.com
DNS Response
2.17.5.133
-
57 B 112 B 1 1
DNS Request
i.imgur.com
DNS Response
151.101.60.193
-
59 B 126 B 1 1
DNS Request
api.ipify.org
DNS Response
104.237.62.21264.185.227.156173.231.16.77
-
61 B 100 B 1 1
DNS Request
time-a.nist.gov
DNS Response
129.6.15.28
-
126 B 79 B 2 1
DNS Request
time-a-g.nist.gov
DNS Request
time-a-g.nist.gov
DNS Response
129.6.15.28
-
59 B 98 B 1 1
DNS Request
time.nist.gov
DNS Response
132.163.97.3
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5b4cd27f2b37665f51eb9fe685ec1d373
SHA17f08febf0fdb7fc9f8bf35a10fb11e7de431abe0
SHA25691f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581
SHA512e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e
-
Filesize
28B
MD5ebc99b8fff3a6ff144ca58f73d2b9d7b
SHA19f2e6623fd0074cd3f9dbb59d184d32098d83133
SHA256a29526f00c9f0de050c7003624ddc94e1dd0419f16c99b328d67f073352ac535
SHA5129acc3b34348403ec74f2bb234f6f4853e771815fd517a573a6c6dcb9c73083d385fa16970e3953ee0b366716dbd012442cf1399d3064e0c5c2928dde72e7a198