Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

16f78f3d51...ea.exe

windows7-x64

1

16f78f3d51...ea.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    5s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/12/2023, 11:18 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    16f78f3d5123d196e4463e1f78507fea.exe

  • Size

    14.9MB

  • MD5

    16f78f3d5123d196e4463e1f78507fea

  • SHA1

    b8be73107d224bed592611f92a5e15931aeb409f

  • SHA256

    18c4a0ea170026c0a9d6d257bc4be5fcd1b19d96c0b752526a3a27c78188823a

  • SHA512

    79d369e747f863a529076fd08373707178a365c90066792be3697b919058c16cb07fafc8392de4005dbaa12fbbf81eb1d5a22cb318b1cea4dbb2e76edf4e80da

  • SSDEEP

    196608:b37hQWf2CsXDjDyfGZkJMsuI9yJld+fZiHXxwicfQRVJwvqA3Kd4Mug4brFQx1RP:/hQLCEDrZk3ry4iH3XWv136WzvFQH

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 15 IoCs
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\16f78f3d5123d196e4463e1f78507fea.exe
    "C:\Users\Admin\AppData\Local\Temp\16f78f3d5123d196e4463e1f78507fea.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:224
    • C:\Users\Admin\AppData\Local\Temp\16f78f3d5123d196e4463e1f78507fea.exe
      "C:\Users\Admin\AppData\Local\Temp\16f78f3d5123d196e4463e1f78507fea.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3600
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
          PID:3720
        • C:\Users\Admin\AppData\Local\Temp\_MEI2242\chromedriver.exe
          C:\Users\Admin\AppData\Local\Temp\_MEI2242\chromedriver.exe --port=56277
          3⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4108
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --allow-pre-commit-input --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-blink-features=ShadowDOMV0 --log-level=3 --no-first-run --no-service-autorun --password-store=basic --remote-debugging-port=0 --test-type=webdriver --use-mock-keychain --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4108_563589807" data:,
            4⤵
            • Enumerates system info in registry
            • Suspicious use of WriteProcessMemory
            PID:5000
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4108_563589807" --display-capture-permissions-policy-allowed --enable-automation --log-level=3 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --enable-blink-features=ShadowDOMV0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3028 --field-trial-handle=1760,i,6403491872037202116,13513003687094551346,131072 /prefetch:1
              5⤵
                PID:3260
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4108_563589807" --display-capture-permissions-policy-allowed --first-renderer-process --enable-automation --log-level=3 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --enable-blink-features=ShadowDOMV0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3012 --field-trial-handle=1760,i,6403491872037202116,13513003687094551346,131072 /prefetch:1
                5⤵
                  PID:2984
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4108_563589807" --log-level=3 --mojo-platform-channel-handle=2224 --field-trial-handle=1760,i,6403491872037202116,13513003687094551346,131072 /prefetch:8
                  5⤵
                    PID:3816
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4108_563589807" --log-level=3 --mojo-platform-channel-handle=2060 --field-trial-handle=1760,i,6403491872037202116,13513003687094551346,131072 /prefetch:8
                    5⤵
                      PID:2200
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4108_563589807" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-level=3 --mojo-platform-channel-handle=1684 --field-trial-handle=1760,i,6403491872037202116,13513003687094551346,131072 /prefetch:2
                      5⤵
                        PID:4048
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir4108_563589807 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\scoped_dir4108_563589807\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir4108_563589807 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9227f9758,0x7ff9227f9768,0x7ff9227f9778
                1⤵
                  PID:2496
                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                  1⤵
                    PID:4420

                  Network

                  • flag-us
                    DNS
                    23.159.190.20.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    23.159.190.20.in-addr.arpa
                    IN PTR
                    Response
                  • flag-us
                    DNS
                    g.bing.com
                    Remote address:
                    8.8.8.8:53
                    Request
                    g.bing.com
                    IN A
                    Response
                    g.bing.com
                    IN CNAME
                    g-bing-com.a-0001.a-msedge.net
                    g-bing-com.a-0001.a-msedge.net
                    IN CNAME
                    dual-a-0001.a-msedge.net
                    dual-a-0001.a-msedge.net
                    IN A
                    204.79.197.200
                    dual-a-0001.a-msedge.net
                    IN A
                    13.107.21.200
                  • flag-us
                    GET
                    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d4f1964feeb347309db3ca6bdea173b8&localId=w:74019202-808B-909D-A3F8-27A805F8E594&deviceId=6825827065235624&anid=
                    Remote address:
                    204.79.197.200:443
                    Request
                    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d4f1964feeb347309db3ca6bdea173b8&localId=w:74019202-808B-909D-A3F8-27A805F8E594&deviceId=6825827065235624&anid= HTTP/2.0
                    host: g.bing.com
                    accept-encoding: gzip, deflate
                    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
                    Response
                    HTTP/2.0 204
                    cache-control: no-cache, must-revalidate
                    pragma: no-cache
                    expires: Fri, 01 Jan 1990 00:00:00 GMT
                    set-cookie: MUID=1184BA2D030E6C7B21AEA9D502B56DED; domain=.bing.com; expires=Fri, 24-Jan-2025 18:03:58 GMT; path=/; SameSite=None; Secure; Priority=High;
                    strict-transport-security: max-age=31536000; includeSubDomains; preload
                    access-control-allow-origin: *
                    x-cache: CONFIG_NOCACHE
                    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                    x-msedge-ref: Ref A: 0DE4B4E02E4149FDBE9BB3474C5F04BF Ref B: LON04EDGE0808 Ref C: 2023-12-31T18:03:58Z
                    date: Sun, 31 Dec 2023 18:03:57 GMT
                  • flag-us
                    GET
                    https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=d4f1964feeb347309db3ca6bdea173b8&localId=w:74019202-808B-909D-A3F8-27A805F8E594&deviceId=6825827065235624&anid=
                    Remote address:
                    204.79.197.200:443
                    Request
                    GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=d4f1964feeb347309db3ca6bdea173b8&localId=w:74019202-808B-909D-A3F8-27A805F8E594&deviceId=6825827065235624&anid= HTTP/2.0
                    host: g.bing.com
                    accept-encoding: gzip, deflate
                    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
                    cookie: MUID=1184BA2D030E6C7B21AEA9D502B56DED
                    Response
                    HTTP/2.0 204
                    cache-control: no-cache, must-revalidate
                    pragma: no-cache
                    expires: Fri, 01 Jan 1990 00:00:00 GMT
                    set-cookie: MSPTC=w_wHoP7hN53KnyCKxCSFU_DwBHxbJVl14OHWry3UkfY; domain=.bing.com; expires=Fri, 24-Jan-2025 18:03:58 GMT; path=/; Partitioned; secure; SameSite=None
                    strict-transport-security: max-age=31536000; includeSubDomains; preload
                    access-control-allow-origin: *
                    x-cache: CONFIG_NOCACHE
                    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                    x-msedge-ref: Ref A: 3A23B6C4BFE040739A1F296E54551091 Ref B: LON04EDGE0808 Ref C: 2023-12-31T18:03:58Z
                    date: Sun, 31 Dec 2023 18:03:57 GMT
                  • flag-us
                    GET
                    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d4f1964feeb347309db3ca6bdea173b8&localId=w:74019202-808B-909D-A3F8-27A805F8E594&deviceId=6825827065235624&anid=
                    Remote address:
                    204.79.197.200:443
                    Request
                    GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d4f1964feeb347309db3ca6bdea173b8&localId=w:74019202-808B-909D-A3F8-27A805F8E594&deviceId=6825827065235624&anid= HTTP/2.0
                    host: g.bing.com
                    accept-encoding: gzip, deflate
                    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
                    cookie: MUID=1184BA2D030E6C7B21AEA9D502B56DED; MSPTC=w_wHoP7hN53KnyCKxCSFU_DwBHxbJVl14OHWry3UkfY
                    Response
                    HTTP/2.0 204
                    cache-control: no-cache, must-revalidate
                    pragma: no-cache
                    expires: Fri, 01 Jan 1990 00:00:00 GMT
                    strict-transport-security: max-age=31536000; includeSubDomains; preload
                    access-control-allow-origin: *
                    x-cache: CONFIG_NOCACHE
                    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                    x-msedge-ref: Ref A: 2E53147A65194182973A70F55E311A40 Ref B: LON04EDGE0808 Ref C: 2023-12-31T18:03:58Z
                    date: Sun, 31 Dec 2023 18:03:57 GMT
                  • flag-us
                    DNS
                    240.221.184.93.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    240.221.184.93.in-addr.arpa
                    IN PTR
                    Response
                  • flag-us
                    DNS
                    240.221.184.93.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    240.221.184.93.in-addr.arpa
                    IN PTR
                  • flag-us
                    DNS
                    2.136.104.51.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    2.136.104.51.in-addr.arpa
                    IN PTR
                    Response
                  • flag-us
                    DNS
                    2.136.104.51.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    2.136.104.51.in-addr.arpa
                    IN PTR
                  • flag-us
                    DNS
                    95.221.229.192.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    95.221.229.192.in-addr.arpa
                    IN PTR
                    Response
                  • flag-us
                    DNS
                    241.154.82.20.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    241.154.82.20.in-addr.arpa
                    IN PTR
                    Response
                  • flag-us
                    DNS
                    241.154.82.20.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    241.154.82.20.in-addr.arpa
                    IN PTR
                  • flag-gb
                    DNS
                    Remote address:
                    96.17.178.193:80
                    Response
                    HTTP/1.1 206 Partial Content
                    Cache-Control: public, max-age=17280000
                    Accept-Ranges: bytes
                    X-AspNetMvc-Version: 5.2
                    MS-CorrelationId: fdb419ca-bb82-438e-ac59-481089ab18ea
                    MS-RequestId: c62b8885-3dce-4fdb-943e-42b014d3b60e
                    MS-CV: FuDIkvp/PUOqVolL.0
                    Content-Disposition: attachment; filename=Microsoft.WindowsAppRuntime.1.2_2000.802.31.0_x86__8wekyb3d8bbwe.Msix
                    X-AspNet-Version: 4.0.30319
                    X-Powered-By: ASP.NET
                    X-Powered-By: ARR/3.0
                    X-Powered-By: ASP.NET
                    X-Azure-Ref-OriginShield: Ref A: 3931C840F9EC47CB98FBAA82F91BFB34 Ref B: CH1AA2040903034 Ref C: 2023-03-15T18:24:30Z
                    X-MSEdge-Ref: Ref A: CF19AD083D9340C49C57567DEB7E80E2 Ref B: BY3EDGE0405 Ref C: 2023-03-15T18:24:31Z
                    Last-Modified: Wed, 15 Mar 2023 18:19:22 GMT
                    ETag: "xVFKVu+y70Rbxkk0UrUZvkwvZDg="
                    Date: Sun, 31 Dec 2023 18:04:39 GMT
                    Content-Type: multipart/byteranges; boundary=299EFCA8F0DF3779
                    Connection: close
                    X-CID: 2
                    X-CCC: GB
                  • flag-gb
                    DNS
                    Remote address:
                    96.17.178.193:80
                    Response
                    HTTP/1.1 206 Partial Content
                    Cache-Control: public, max-age=17280000
                    Accept-Ranges: bytes
                    X-AspNetMvc-Version: 5.2
                    MS-CorrelationId: 109db4c0-4020-4910-9a33-b50fc482bfa5
                    MS-RequestId: 15b02fe7-1fdd-411d-97bf-4acd8b288dfb
                    MS-CV: JSoXw8DG40uXIcEU.1.0.2.1.1.0.0.20.1.1.6.1.1.1.0
                    Content-Disposition: attachment; filename=Microsoft.WindowsAppRuntime.1.2_2000.802.31.0_x64__8wekyb3d8bbwe.Msix
                    X-AspNet-Version: 4.0.30319
                    X-Powered-By: ASP.NET
                    X-Powered-By: ARR/3.0
                    X-Powered-By: ASP.NET
                    X-Azure-Ref-OriginShield: Ref A: 5FA6B13DFB4E4840971617AD80AFBDEF Ref B: MNZ221060607023 Ref C: 2023-03-15T18:24:31Z
                    X-MSEdge-Ref: Ref A: A2AF8FDEBAA0471B8728CAB368EA24B9 Ref B: MEX30EDGE1207 Ref C: 2023-03-15T18:24:31Z
                    Last-Modified: Wed, 15 Mar 2023 18:19:22 GMT
                    ETag: "zz/eo+4uyTK7KXfTFIC318u927g="
                    Date: Sun, 31 Dec 2023 18:04:39 GMT
                    Content-Type: multipart/byteranges; boundary=6311D6B0A39E5CA4
                    Connection: close
                    X-CID: 2
                    X-CCC: GB
                  • flag-us
                    DNS
                    193.178.17.96.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    193.178.17.96.in-addr.arpa
                    IN PTR
                    Response
                    193.178.17.96.in-addr.arpa
                    IN PTR
                    a96-17-178-193deploystaticakamaitechnologiescom
                  • flag-us
                    DNS
                    211.135.221.88.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    211.135.221.88.in-addr.arpa
                    IN PTR
                    Response
                    211.135.221.88.in-addr.arpa
                    IN PTR
                    a88-221-135-211deploystaticakamaitechnologiescom
                  • flag-us
                    DNS
                    201.178.17.96.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    201.178.17.96.in-addr.arpa
                    IN PTR
                    Response
                    201.178.17.96.in-addr.arpa
                    IN PTR
                    a96-17-178-201deploystaticakamaitechnologiescom
                  • flag-gb
                    DNS
                    Remote address:
                    96.17.178.201:80
                    Response
                    HTTP/1.1 206 Partial Content
                    Cache-Control: public, max-age=17280000
                    Accept-Ranges: bytes
                    X-AspNetMvc-Version: 5.2
                    MS-CorrelationId: 109db4c0-4020-4910-9a33-b50fc482bfa5
                    MS-RequestId: 15b02fe7-1fdd-411d-97bf-4acd8b288dfb
                    MS-CV: JSoXw8DG40uXIcEU.1.0.2.1.1.0.0.20.1.1.6.1.1.1.0
                    Content-Disposition: attachment; filename=Microsoft.WindowsAppRuntime.1.2_2000.802.31.0_x64__8wekyb3d8bbwe.Msix
                    X-AspNet-Version: 4.0.30319
                    X-Powered-By: ASP.NET
                    X-Powered-By: ARR/3.0
                    X-Powered-By: ASP.NET
                    X-Azure-Ref-OriginShield: Ref A: 5FA6B13DFB4E4840971617AD80AFBDEF Ref B: MNZ221060607023 Ref C: 2023-03-15T18:24:31Z
                    X-MSEdge-Ref: Ref A: A2AF8FDEBAA0471B8728CAB368EA24B9 Ref B: MEX30EDGE1207 Ref C: 2023-03-15T18:24:31Z
                    Last-Modified: Wed, 15 Mar 2023 18:19:22 GMT
                    ETag: "zz/eo+4uyTK7KXfTFIC318u927g="
                    Date: Sun, 31 Dec 2023 18:05:20 GMT
                    Content-Type: multipart/byteranges; boundary=6311D6B0A39E5CA4
                    Connection: close
                    X-CID: 2
                    X-CCC: GB
                  • 204.79.197.200:443
                    https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d4f1964feeb347309db3ca6bdea173b8&localId=w:74019202-808B-909D-A3F8-27A805F8E594&deviceId=6825827065235624&anid=
                    tls, http2
                    3.1kB
                     10.9kB
                     26
                    19

                    HTTP Request

                    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d4f1964feeb347309db3ca6bdea173b8&localId=w:74019202-808B-909D-A3F8-27A805F8E594&deviceId=6825827065235624&anid=

                    HTTP Response

                    204

                    HTTP Request

                    GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=d4f1964feeb347309db3ca6bdea173b8&localId=w:74019202-808B-909D-A3F8-27A805F8E594&deviceId=6825827065235624&anid=

                    HTTP Response

                    204

                    HTTP Request

                    GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d4f1964feeb347309db3ca6bdea173b8&localId=w:74019202-808B-909D-A3F8-27A805F8E594&deviceId=6825827065235624&anid=

                    HTTP Response

                    204
                  • 96.17.178.193:80
                    http
                    3.4kB
                     81.8kB
                     61
                    62

                    HTTP Response

                    206
                  • 96.17.178.193:80
                    http
                    2.2kB
                     85.9kB
                     45
                    66

                    HTTP Response

                    206
                  • 96.17.178.193:80
                    52 B
                     1
                  • 88.221.135.211:80
                    920 B
                     50.9kB
                     20
                    38
                  • 96.17.178.193:80
                    92 B
                     40 B
                     2
                    1
                  • 96.17.178.193:80
                    98 B
                     92 B
                     2
                    2
                  • 52.165.165.26:443
                    92 B
                     40 B
                     2
                    1
                  • 127.0.0.1:56277
                    16f78f3d5123d196e4463e1f78507fea.exe
                  • 127.0.0.1:56277
                    16f78f3d5123d196e4463e1f78507fea.exe
                  • 96.17.178.201:80
                    http
                    14.5kB
                     433.0kB
                     245
                    310
                  • 52.111.229.48:443
                    tls
                    276 B
                     13.7kB
                     6
                    13
                  • 96.17.178.201:80
                    http
                    9.5kB
                     219.4kB
                     149
                    158

                    HTTP Response

                    206
                  • 96.17.178.201:80
                    4.4kB
                     82.3kB
                     58
                    59
                  • 8.8.8.8:53
                    23.159.190.20.in-addr.arpa
                    dns
                    72 B
                     158 B
                     1
                    1

                    DNS Request

                    23.159.190.20.in-addr.arpa

                  • 8.8.8.8:53
                    g.bing.com
                    dns
                    56 B
                     158 B
                     1
                    1

                    DNS Request

                    g.bing.com

                    DNS Response

                    204.79.197.200
                    13.107.21.200

                  • 8.8.8.8:53
                    240.221.184.93.in-addr.arpa
                    dns
                    146 B
                     144 B
                     2
                    1

                    DNS Request

                    240.221.184.93.in-addr.arpa

                    DNS Request

                    240.221.184.93.in-addr.arpa

                  • 8.8.8.8:53
                    2.136.104.51.in-addr.arpa
                    dns
                    142 B
                     157 B
                     2
                    1

                    DNS Request

                    2.136.104.51.in-addr.arpa

                    DNS Request

                    2.136.104.51.in-addr.arpa

                  • 8.8.8.8:53
                    95.221.229.192.in-addr.arpa
                    dns
                    73 B
                     144 B
                     1
                    1

                    DNS Request

                    95.221.229.192.in-addr.arpa

                  • 8.8.8.8:53
                    241.154.82.20.in-addr.arpa
                    dns
                    144 B
                     158 B
                     2
                    1

                    DNS Request

                    241.154.82.20.in-addr.arpa

                    DNS Request

                    241.154.82.20.in-addr.arpa

                  • 8.8.8.8:53
                    193.178.17.96.in-addr.arpa
                    dns
                    72 B
                     137 B
                     1
                    1

                    DNS Request

                    193.178.17.96.in-addr.arpa

                  • 8.8.8.8:53
                    211.135.221.88.in-addr.arpa
                    dns
                    73 B
                     139 B
                     1
                    1

                    DNS Request

                    211.135.221.88.in-addr.arpa

                  • 8.8.8.8:53
                    201.178.17.96.in-addr.arpa
                    dns
                    72 B
                     137 B
                     1
                    1

                    DNS Request

                    201.178.17.96.in-addr.arpa

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  We care about your privacy.

                  This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.