Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

main - Copy (2).exe

windows10-2004-x64

10

main - Copy (3).exe

windows10-2004-x64

10

main - Copy (4).exe

windows10-2004-x64

10

main - Copy (5).exe

windows10-2004-x64

10

main - Copy (6).exe

windows10-2004-x64

10

main - Copy (7).exe

windows10-2004-x64

10

main - Copy (8).exe

windows10-2004-x64

10

main - Copy (9).exe

windows10-2004-x64

10

main - Copy.exe

windows10-2004-x64

1

main.exe

windows10-2004-x64

10

Resubmissions

30/12/2023, 13:31 UTC

231230-qsrkaahffl 10

30/12/2023, 12:06 UTC

231230-n98h1sdhfj 10

30/12/2023, 12:06 UTC

231230-n9779adhep 10

30/12/2023, 12:06 UTC

231230-n97xgsgaf7 10

30/12/2023, 12:06 UTC

231230-n97aysgaf6 10

30/12/2023, 12:06 UTC

231230-n96z7adhej 10

30/12/2023, 12:06 UTC

231230-n96pesdhdq 10

29/12/2023, 23:47 UTC

231229-3sy1ksader 10

29/12/2023, 23:47 UTC

231229-3syd2saden 10

29/12/2023, 23:47 UTC

231229-3sxgrachf3 10

Analysis

  • max time kernel
    1789s
  • max time network
    1170s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 12:06 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    main - Copy.exe

  • Size

    6.9MB

  • MD5

    22c978ffaefef3389bf29068b9621661

  • SHA1

    5671972c1d70826fb85dced4c83c700dd282ea21

  • SHA256

    e6ee8e9b38e10a92a89e61b8655ca4fedcc381fd93cb36f43fe323132923dfcf

  • SHA512

    8a280cb782f0afab171d2e7955b75362e98cefd449d382004ef2568c2c230cd633a754b1dd5f0dc5e17407819e4dceb5b0cbb2647e279a6ec674b8d9484be26a

  • SSDEEP

    98304:7b5Ak7khMiyw0VREqfnle5EEPbxVhCQHSIMf:5LUMiywZqshDxaQHh

Score
1/10

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\main - Copy.exe
    "C:\Users\Admin\AppData\Local\Temp\main - Copy.exe"
    1⤵
      PID:4824
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
      1⤵
        PID:2280
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k UnistackSvcGroup
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3136

      Network

      • flag-us
        DNS
        146.78.124.51.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        146.78.124.51.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        0.181.190.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        0.181.190.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        github.com
        main - Copy.exe
        Remote address:
        8.8.8.8:53
        Request
        github.com
        IN A
        Response
        github.com
        IN A
        140.82.121.3
      • flag-us
        DNS
        3.121.82.140.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        3.121.82.140.in-addr.arpa
        IN PTR
        Response
        3.121.82.140.in-addr.arpa
        IN PTR
        lb-140-82-121-3-fragithubcom
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        241.154.82.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        241.154.82.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        88.156.103.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        88.156.103.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        88.156.103.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        88.156.103.20.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        178.223.142.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        178.223.142.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        26.165.165.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        26.165.165.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        41.110.16.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        41.110.16.96.in-addr.arpa
        IN PTR
        Response
        41.110.16.96.in-addr.arpa
        IN PTR
        a96-16-110-41deploystaticakamaitechnologiescom
      • flag-us
        DNS
        15.164.165.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        15.164.165.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        15.164.165.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        15.164.165.52.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        18.134.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        18.134.221.88.in-addr.arpa
        IN PTR
        Response
        18.134.221.88.in-addr.arpa
        IN PTR
        a88-221-134-18deploystaticakamaitechnologiescom
      • flag-us
        DNS
        tse1.mm.bing.net
        Remote address:
        8.8.8.8:53
        Request
        tse1.mm.bing.net
        IN A
        Response
        tse1.mm.bing.net
        IN CNAME
        mm-mm.bing.net.trafficmanager.net
        mm-mm.bing.net.trafficmanager.net
        IN CNAME
        dual-a-0001.a-msedge.net
        dual-a-0001.a-msedge.net
        IN A
        204.79.197.200
        dual-a-0001.a-msedge.net
        IN A
        13.107.21.200
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301685_171YK8L2RNOTOWUB0&pid=21.2&w=1080&h=1920&c=4
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317301685_171YK8L2RNOTOWUB0&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 203882
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 13661EA4F1BF437990340D2AFF0A8FCF Ref B: LON04EDGE0615 Ref C: 2023-12-30T13:01:15Z
        date: Sat, 30 Dec 2023 13:01:15 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301276_1FHQU2O53GKUUYZPS&pid=21.2&w=1920&h=1080&c=4
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317301276_1FHQU2O53GKUUYZPS&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 203137
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 268B87953E4C4B69885D3A80F85B326A Ref B: LON04EDGE0615 Ref C: 2023-12-30T13:01:15Z
        date: Sat, 30 Dec 2023 13:01:15 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301235_1HF3YV71T1KJCXDY3&pid=21.2&w=1920&h=1080&c=4
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317301235_1HF3YV71T1KJCXDY3&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 358514
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 535767FD84154FA0BA89A152FDE7D4EE Ref B: LON04EDGE0615 Ref C: 2023-12-30T13:01:15Z
        date: Sat, 30 Dec 2023 13:01:15 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301644_1VM6W540D06LTCJ4J&pid=21.2&w=1080&h=1920&c=4
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317301644_1VM6W540D06LTCJ4J&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 300283
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: BCBF5BF5BCD446F79E32E3C26AFECD08 Ref B: LON04EDGE0615 Ref C: 2023-12-30T13:01:15Z
        date: Sat, 30 Dec 2023 13:01:15 GMT
      • flag-us
        DNS
        200.197.79.204.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        200.197.79.204.in-addr.arpa
        IN PTR
        Response
        200.197.79.204.in-addr.arpa
        IN PTR
        a-0001a-msedgenet
      • flag-us
        DNS
        100.5.17.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        100.5.17.2.in-addr.arpa
        IN PTR
        Response
        100.5.17.2.in-addr.arpa
        IN PTR
        a2-17-5-100deploystaticakamaitechnologiescom
      • flag-us
        DNS
        18.31.95.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        18.31.95.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        119.110.54.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        119.110.54.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        217.135.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        217.135.221.88.in-addr.arpa
        IN PTR
        Response
        217.135.221.88.in-addr.arpa
        IN PTR
        a88-221-135-217deploystaticakamaitechnologiescom
      • flag-us
        DNS
        217.135.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        217.135.221.88.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        178.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        178.178.17.96.in-addr.arpa
        IN PTR
        Response
        178.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-178deploystaticakamaitechnologiescom
      • flag-us
        DNS
        178.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        178.178.17.96.in-addr.arpa
        IN PTR
        Response
        178.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-178deploystaticakamaitechnologiescom
      • flag-us
        DNS
        32.134.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        32.134.221.88.in-addr.arpa
        IN PTR
        Response
        32.134.221.88.in-addr.arpa
        IN PTR
        a88-221-134-32deploystaticakamaitechnologiescom
      • flag-us
        DNS
        32.134.221.88.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        32.134.221.88.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        91.16.208.104.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        91.16.208.104.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        91.16.208.104.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        91.16.208.104.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        204.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        204.178.17.96.in-addr.arpa
        IN PTR
        Response
        204.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-204deploystaticakamaitechnologiescom
      • flag-us
        DNS
        204.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        204.178.17.96.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        193.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        193.178.17.96.in-addr.arpa
        IN PTR
        Response
        193.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-193deploystaticakamaitechnologiescom
      • flag-us
        DNS
        193.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        193.178.17.96.in-addr.arpa
        IN PTR
        Response
        193.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-193deploystaticakamaitechnologiescom
      • flag-us
        DNS
        201.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        201.178.17.96.in-addr.arpa
        IN PTR
        Response
        201.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-201deploystaticakamaitechnologiescom
      • flag-us
        DNS
        201.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        201.178.17.96.in-addr.arpa
        IN PTR
      • 140.82.121.3:443
        github.com
        tls
        main - Copy.exe
        2.2kB
         3.3kB
         17
        9
      • 204.79.197.200:443
        https://tse1.mm.bing.net/th?id=OADD2.10239317301644_1VM6W540D06LTCJ4J&pid=21.2&w=1080&h=1920&c=4
        tls, http2
        41.1kB
         1.1MB
         822
        816

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301685_171YK8L2RNOTOWUB0&pid=21.2&w=1080&h=1920&c=4

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301276_1FHQU2O53GKUUYZPS&pid=21.2&w=1920&h=1080&c=4

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301235_1HF3YV71T1KJCXDY3&pid=21.2&w=1920&h=1080&c=4

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301644_1VM6W540D06LTCJ4J&pid=21.2&w=1080&h=1920&c=4

        HTTP Response

        200

        HTTP Response

        200

        HTTP Response

        200

        HTTP Response

        200
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         8.3kB
         16
        14
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.5kB
         8.2kB
         17
        13
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.5kB
         8.3kB
         17
        14
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 96.17.178.201:80
      • 8.8.8.8:53
        146.78.124.51.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        146.78.124.51.in-addr.arpa

      • 8.8.8.8:53
        0.181.190.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        0.181.190.20.in-addr.arpa

      • 8.8.8.8:53
        github.com
        dns
        main - Copy.exe
        56 B
         72 B
         1
        1

        DNS Request

        github.com

        DNS Response

        140.82.121.3

      • 8.8.8.8:53
        3.121.82.140.in-addr.arpa
        dns
        71 B
         115 B
         1
        1

        DNS Request

        3.121.82.140.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
         144 B
         1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        241.154.82.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        241.154.82.20.in-addr.arpa

      • 8.8.8.8:53
        88.156.103.20.in-addr.arpa
        dns
        144 B
         158 B
         2
        1

        DNS Request

        88.156.103.20.in-addr.arpa

        DNS Request

        88.156.103.20.in-addr.arpa

      • 8.8.8.8:53
        178.223.142.52.in-addr.arpa
        dns
        73 B
         147 B
         1
        1

        DNS Request

        178.223.142.52.in-addr.arpa

      • 8.8.8.8:53
        26.165.165.52.in-addr.arpa
        dns
        72 B
         146 B
         1
        1

        DNS Request

        26.165.165.52.in-addr.arpa

      • 8.8.8.8:53
        41.110.16.96.in-addr.arpa
        dns
        71 B
         135 B
         1
        1

        DNS Request

        41.110.16.96.in-addr.arpa

      • 8.8.8.8:53
        15.164.165.52.in-addr.arpa
        dns
        144 B
         146 B
         2
        1

        DNS Request

        15.164.165.52.in-addr.arpa

        DNS Request

        15.164.165.52.in-addr.arpa

      • 8.8.8.8:53
        18.134.221.88.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        18.134.221.88.in-addr.arpa

      • 8.8.8.8:53
        tse1.mm.bing.net
        dns
        62 B
         173 B
         1
        1

        DNS Request

        tse1.mm.bing.net

        DNS Response

        204.79.197.200
        13.107.21.200

      • 8.8.8.8:53
        200.197.79.204.in-addr.arpa
        dns
        73 B
         106 B
         1
        1

        DNS Request

        200.197.79.204.in-addr.arpa

      • 8.8.8.8:53
        100.5.17.2.in-addr.arpa
        dns
        69 B
         131 B
         1
        1

        DNS Request

        100.5.17.2.in-addr.arpa

      • 8.8.8.8:53
        18.31.95.13.in-addr.arpa
        dns
        70 B
         144 B
         1
        1

        DNS Request

        18.31.95.13.in-addr.arpa

      • 8.8.8.8:53
        119.110.54.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        119.110.54.20.in-addr.arpa

      • 8.8.8.8:53
        217.135.221.88.in-addr.arpa
        dns
        146 B
         139 B
         2
        1

        DNS Request

        217.135.221.88.in-addr.arpa

        DNS Request

        217.135.221.88.in-addr.arpa

      • 8.8.8.8:53
        178.178.17.96.in-addr.arpa
        dns
        144 B
         274 B
         2
        2

        DNS Request

        178.178.17.96.in-addr.arpa

        DNS Request

        178.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        32.134.221.88.in-addr.arpa
        dns
        144 B
         137 B
         2
        1

        DNS Request

        32.134.221.88.in-addr.arpa

        DNS Request

        32.134.221.88.in-addr.arpa

      • 8.8.8.8:53
        91.16.208.104.in-addr.arpa
        dns
        144 B
         292 B
         2
        2

        DNS Request

        91.16.208.104.in-addr.arpa

        DNS Request

        91.16.208.104.in-addr.arpa

      • 8.8.8.8:53
        204.178.17.96.in-addr.arpa
        dns
        144 B
         137 B
         2
        1

        DNS Request

        204.178.17.96.in-addr.arpa

        DNS Request

        204.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        193.178.17.96.in-addr.arpa
        dns
        144 B
         274 B
         2
        2

        DNS Request

        193.178.17.96.in-addr.arpa

        DNS Request

        193.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        201.178.17.96.in-addr.arpa
        dns
        144 B
         137 B
         2
        1

        DNS Request

        201.178.17.96.in-addr.arpa

        DNS Request

        201.178.17.96.in-addr.arpa

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/3136-0-0x0000026410D40000-0x0000026410D50000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3136-16-0x0000026410E40000-0x0000026410E50000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3136-34-0x0000026419440000-0x0000026419441000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3136-40-0x0000026419440000-0x0000026419441000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3136-42-0x0000026419440000-0x0000026419441000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3136-41-0x0000026419440000-0x0000026419441000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3136-39-0x0000026419440000-0x0000026419441000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3136-38-0x0000026419440000-0x0000026419441000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3136-37-0x0000026419440000-0x0000026419441000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3136-36-0x0000026419440000-0x0000026419441000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3136-52-0x0000026418F90000-0x0000026418F91000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3136-68-0x00000264192B0000-0x00000264192B1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3136-67-0x00000264191A0000-0x00000264191A1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3136-66-0x00000264191A0000-0x00000264191A1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3136-64-0x0000026419190000-0x0000026419191000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3136-49-0x0000026419050000-0x0000026419051000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3136-46-0x0000026419060000-0x0000026419061000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3136-44-0x0000026419050000-0x0000026419051000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3136-43-0x0000026419060000-0x0000026419061000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3136-35-0x0000026419440000-0x0000026419441000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3136-33-0x0000026419440000-0x0000026419441000-memory.dmp

        Filesize

        4KB

        Download

      • memory/3136-32-0x0000026419410000-0x0000026419411000-memory.dmp

        Filesize

        4KB

        Download

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.