Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

776f5f4b37...03.exe

windows7-x64

10

776f5f4b37...03.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    168s
  • max time network
    184s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/12/2023, 02:30 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    776f5f4b3705685232f19d3bc76bc34af07ee2f230b9f4e16e56475dc7318603.exe

  • Size

    9KB

  • MD5

    fa17ada82de6fd6c7b93ec054ce3f085

  • SHA1

    9db9954948de1c720ad28bf41b5e10c3588d9c21

  • SHA256

    776f5f4b3705685232f19d3bc76bc34af07ee2f230b9f4e16e56475dc7318603

  • SHA512

    0495c2479f5d7fd47bdcd5a5a098fca2c05c50f2c851540da138f0f280ba944eb4f8cdb9241d54faf829f217b7d2f82d394cc84feb1536f2a96664e49234323e

  • SSDEEP

    96:WAfyA0Qts/4gb1f4JaYogNJVMps3PH7C64ln+flCnWiYNYNaRzNt:z0Q6/4gkT2ps+6unyBakz

Score
10/10
zgratpersistencerat

Malware Config

Signatures

  • Detect ZGRat V1 34 IoCs
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\776f5f4b3705685232f19d3bc76bc34af07ee2f230b9f4e16e56475dc7318603.exe
    "C:\Users\Admin\AppData\Local\Temp\776f5f4b3705685232f19d3bc76bc34af07ee2f230b9f4e16e56475dc7318603.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1000
    • C:\Users\Admin\AppData\Local\Temp\776f5f4b3705685232f19d3bc76bc34af07ee2f230b9f4e16e56475dc7318603.exe
      C:\Users\Admin\AppData\Local\Temp\776f5f4b3705685232f19d3bc76bc34af07ee2f230b9f4e16e56475dc7318603.exe
      2⤵
        PID:1832

    Network

    • flag-us
      DNS
      81.171.91.138.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      81.171.91.138.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      81.171.91.138.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      81.171.91.138.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      85.177.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      85.177.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      9.228.82.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      9.228.82.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      57.169.31.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      57.169.31.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      kiosk.citizen-me.com
      776f5f4b3705685232f19d3bc76bc34af07ee2f230b9f4e16e56475dc7318603.exe
      Remote address:
      8.8.8.8:53
      Request
      kiosk.citizen-me.com
      IN A
      Response
      kiosk.citizen-me.com
      IN A
      86.96.203.247
    • flag-ae
      GET
      https://kiosk.citizen-me.com/Dmcftaoqvxi.vdf
      776f5f4b3705685232f19d3bc76bc34af07ee2f230b9f4e16e56475dc7318603.exe
      Remote address:
      86.96.203.247:443
      Request
      GET /Dmcftaoqvxi.vdf HTTP/1.1
      Host: kiosk.citizen-me.com
      Connection: Keep-Alive
      Response
      HTTP/1.1 200 OK
      Server: nginx/1.6.2
      Date: Sun, 31 Dec 2023 02:17:02 GMT
      Content-Length: 1418240
      Connection: keep-alive
      Last-Modified: Wed, 27 Dec 2023 19:05:00 GMT
      Accept-Ranges: bytes
    • flag-us
      DNS
      247.203.96.86.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      247.203.96.86.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      146.78.124.51.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      146.78.124.51.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      114.110.16.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      114.110.16.96.in-addr.arpa
      IN PTR
      Response
      114.110.16.96.in-addr.arpa
      IN PTR
      a96-16-110-114deploystaticakamaitechnologiescom
    • flag-us
      DNS
      41.110.16.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      41.110.16.96.in-addr.arpa
      IN PTR
      Response
      41.110.16.96.in-addr.arpa
      IN PTR
      a96-16-110-41deploystaticakamaitechnologiescom
    • flag-us
      DNS
      50.23.12.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      50.23.12.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      198.187.3.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      198.187.3.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      17.53.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      17.53.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      2.136.104.51.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      2.136.104.51.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      2.136.104.51.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      2.136.104.51.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      208.194.73.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      208.194.73.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      59.128.231.4.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      59.128.231.4.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      26.35.223.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      26.35.223.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      1.173.189.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      1.173.189.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      1.173.189.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      1.173.189.20.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      1.173.189.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      1.173.189.20.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      tse1.mm.bing.net
      Remote address:
      8.8.8.8:53
      Request
      tse1.mm.bing.net
      IN A
      Response
      tse1.mm.bing.net
      IN CNAME
      mm-mm.bing.net.trafficmanager.net
      mm-mm.bing.net.trafficmanager.net
      IN CNAME
      dual-a-0001.a-msedge.net
      dual-a-0001.a-msedge.net
      IN A
      204.79.197.200
      dual-a-0001.a-msedge.net
      IN A
      13.107.21.200
    • flag-us
      DNS
      tse1.mm.bing.net
      Remote address:
      8.8.8.8:53
      Request
      tse1.mm.bing.net
      IN A
      Response
      tse1.mm.bing.net
      IN CNAME
      mm-mm.bing.net.trafficmanager.net
      mm-mm.bing.net.trafficmanager.net
      IN CNAME
      dual-a-0001.a-msedge.net
      dual-a-0001.a-msedge.net
      IN A
      204.79.197.200
      dual-a-0001.a-msedge.net
      IN A
      13.107.21.200
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239317301028_1XA7S3UMPIIEY7PGU&pid=21.2&w=1920&h=1080&c=4
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239317301028_1XA7S3UMPIIEY7PGU&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 576184
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 242842603C0A4341A79E0F0633D856B4 Ref B: LON04EDGE1218 Ref C: 2023-12-31T02:33:51Z
      date: Sun, 31 Dec 2023 02:33:50 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239317300961_12GZY3GJPK3SP20HI&pid=21.2&w=1920&h=1080&c=4
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239317300961_12GZY3GJPK3SP20HI&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 424336
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: CF7742849FDB42FD8D53368D269E6B41 Ref B: LON04EDGE1218 Ref C: 2023-12-31T02:33:52Z
      date: Sun, 31 Dec 2023 02:33:51 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239317300983_1WZXOPL411WEADUNL&pid=21.2&w=1920&h=1080&c=4
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239317300983_1WZXOPL411WEADUNL&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 495109
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 1B2816DF0F1249CAB309E8C840AC4E2F Ref B: LON04EDGE1218 Ref C: 2023-12-31T02:33:52Z
      date: Sun, 31 Dec 2023 02:33:51 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239317301461_1T6N40BUM5QD4UOJ8&pid=21.2&w=1080&h=1920&c=4
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239317301461_1T6N40BUM5QD4UOJ8&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 459022
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: D6532CB551D04C47801EC97F292F524D Ref B: LON04EDGE1218 Ref C: 2023-12-31T02:33:52Z
      date: Sun, 31 Dec 2023 02:33:51 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239317301394_1XQ1UP6CPBEHM2FCF&pid=21.2&w=1080&h=1920&c=4
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239317301394_1XQ1UP6CPBEHM2FCF&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239317301416_1MP9AZ7DJ4UBDL0Q4&pid=21.2&w=1080&h=1920&c=4
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239317301416_1MP9AZ7DJ4UBDL0Q4&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    • flag-us
      DNS
      200.197.79.204.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      200.197.79.204.in-addr.arpa
      IN PTR
      Response
      200.197.79.204.in-addr.arpa
      IN PTR
      a-0001a-msedgenet
    • flag-us
      DNS
      200.197.79.204.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      200.197.79.204.in-addr.arpa
      IN PTR
      Response
      200.197.79.204.in-addr.arpa
      IN PTR
      a-0001a-msedgenet
    • 86.96.203.247:443
      https://kiosk.citizen-me.com/Dmcftaoqvxi.vdf
      tls, http
      776f5f4b3705685232f19d3bc76bc34af07ee2f230b9f4e16e56475dc7318603.exe
      33.9kB
       1.5MB
       701
      1079

      HTTP Request

      GET https://kiosk.citizen-me.com/Dmcftaoqvxi.vdf

      HTTP Response

      200
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls, http2
      1.6kB
       955 B
       15
      9
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls, http2
      1.5kB
       808 B
       14
      8
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls, http2
      1.6kB
       9.2kB
       17
      14
    • 204.79.197.200:443
      https://tse1.mm.bing.net/th?id=OADD2.10239317301416_1MP9AZ7DJ4UBDL0Q4&pid=21.2&w=1080&h=1920&c=4
      tls, http2
      45.9kB
       1.3MB
       922
      916

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239317301028_1XA7S3UMPIIEY7PGU&pid=21.2&w=1920&h=1080&c=4

      HTTP Response

      200

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239317300961_12GZY3GJPK3SP20HI&pid=21.2&w=1920&h=1080&c=4

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239317300983_1WZXOPL411WEADUNL&pid=21.2&w=1920&h=1080&c=4

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239317301461_1T6N40BUM5QD4UOJ8&pid=21.2&w=1080&h=1920&c=4

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239317301394_1XQ1UP6CPBEHM2FCF&pid=21.2&w=1080&h=1920&c=4

      HTTP Response

      200

      HTTP Response

      200

      HTTP Response

      200

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239317301416_1MP9AZ7DJ4UBDL0Q4&pid=21.2&w=1080&h=1920&c=4
    • 8.8.8.8:53
      81.171.91.138.in-addr.arpa
      dns
      144 B
       146 B
       2
      1

      DNS Request

      81.171.91.138.in-addr.arpa

      DNS Request

      81.171.91.138.in-addr.arpa

    • 8.8.8.8:53
      85.177.190.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      85.177.190.20.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      9.228.82.20.in-addr.arpa
      dns
      70 B
       156 B
       1
      1

      DNS Request

      9.228.82.20.in-addr.arpa

    • 8.8.8.8:53
      57.169.31.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      57.169.31.20.in-addr.arpa

    • 8.8.8.8:53
      kiosk.citizen-me.com
      dns
      776f5f4b3705685232f19d3bc76bc34af07ee2f230b9f4e16e56475dc7318603.exe
      66 B
       82 B
       1
      1

      DNS Request

      kiosk.citizen-me.com

      DNS Response

      86.96.203.247

    • 8.8.8.8:53
      247.203.96.86.in-addr.arpa
      dns
      72 B
       143 B
       1
      1

      DNS Request

      247.203.96.86.in-addr.arpa

    • 8.8.8.8:53
      146.78.124.51.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      146.78.124.51.in-addr.arpa

    • 8.8.8.8:53
      114.110.16.96.in-addr.arpa
      dns
      72 B
       137 B
       1
      1

      DNS Request

      114.110.16.96.in-addr.arpa

    • 8.8.8.8:53
      41.110.16.96.in-addr.arpa
      dns
      71 B
       135 B
       1
      1

      DNS Request

      41.110.16.96.in-addr.arpa

    • 8.8.8.8:53
      50.23.12.20.in-addr.arpa
      dns
      70 B
       156 B
       1
      1

      DNS Request

      50.23.12.20.in-addr.arpa

    • 8.8.8.8:53
      198.187.3.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      198.187.3.20.in-addr.arpa

    • 8.8.8.8:53
      17.53.126.40.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      17.53.126.40.in-addr.arpa

    • 8.8.8.8:53
      2.136.104.51.in-addr.arpa
      dns
      142 B
       157 B
       2
      1

      DNS Request

      2.136.104.51.in-addr.arpa

      DNS Request

      2.136.104.51.in-addr.arpa

    • 8.8.8.8:53
      208.194.73.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      208.194.73.20.in-addr.arpa

    • 8.8.8.8:53
      59.128.231.4.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      59.128.231.4.in-addr.arpa

    • 8.8.8.8:53
      26.35.223.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      26.35.223.20.in-addr.arpa

    • 8.8.8.8:53
      1.173.189.20.in-addr.arpa
      dns
      213 B
       157 B
       3
      1

      DNS Request

      1.173.189.20.in-addr.arpa

      DNS Request

      1.173.189.20.in-addr.arpa

      DNS Request

      1.173.189.20.in-addr.arpa

    • 8.8.8.8:53
      tse1.mm.bing.net
      dns
      124 B
       346 B
       2
      2

      DNS Request

      tse1.mm.bing.net

      DNS Request

      tse1.mm.bing.net

      DNS Response

      204.79.197.200
      13.107.21.200

      DNS Response

      204.79.197.200
      13.107.21.200

    • 8.8.8.8:53
      200.197.79.204.in-addr.arpa
      dns
      146 B
       212 B
       2
      2

      DNS Request

      200.197.79.204.in-addr.arpa

      DNS Request

      200.197.79.204.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\776f5f4b3705685232f19d3bc76bc34af07ee2f230b9f4e16e56475dc7318603.exe.log
      Filesize

      1KB

      MD5

      613cb5d019ab441a116f4eef391473c5

      SHA1

      f5b5ee69ffed1572a4dfeb057ff7d8497ca26b7e

      SHA256

      fdee314b0607958df9c21a1c3ecad8149a243e0a6fe15002ff0fcc3435a9f1e6

      SHA512

      2dfb09adac2591594932cbf634ed54b52336150e5c1b9ae8ed09a2a61035296c02cc4d22bb515c88b36bacd26271048fa99d2044242631ecd9cf6a724fb8809f

      Download Submit

    • memory/1000-41-0x00000253709B0000-0x0000025370B0B000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-17-0x00000253709B0000-0x0000025370B0B000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-3-0x00007FFCD1C20000-0x00007FFCD26E1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/1000-4-0x0000025358070000-0x0000025358080000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1000-5-0x00000253709B0000-0x0000025370B10000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-6-0x00000253709B0000-0x0000025370B0B000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-7-0x00000253709B0000-0x0000025370B0B000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-9-0x00000253709B0000-0x0000025370B0B000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-11-0x00000253709B0000-0x0000025370B0B000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-13-0x00000253709B0000-0x0000025370B0B000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-15-0x00000253709B0000-0x0000025370B0B000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-19-0x00000253709B0000-0x0000025370B0B000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-0-0x00000253562A0000-0x00000253562A8000-memory.dmp

      Filesize

      32KB

      Download

    • memory/1000-21-0x00000253709B0000-0x0000025370B0B000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-23-0x00000253709B0000-0x0000025370B0B000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-25-0x00000253709B0000-0x0000025370B0B000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-27-0x00000253709B0000-0x0000025370B0B000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-29-0x00000253709B0000-0x0000025370B0B000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-31-0x00000253709B0000-0x0000025370B0B000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-33-0x00000253709B0000-0x0000025370B0B000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-35-0x00000253709B0000-0x0000025370B0B000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-37-0x00000253709B0000-0x0000025370B0B000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-2-0x0000025358070000-0x0000025358080000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1000-39-0x00000253709B0000-0x0000025370B0B000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-57-0x00000253709B0000-0x0000025370B0B000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-45-0x00000253709B0000-0x0000025370B0B000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-47-0x00000253709B0000-0x0000025370B0B000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-49-0x00000253709B0000-0x0000025370B0B000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-51-0x00000253709B0000-0x0000025370B0B000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-53-0x00000253709B0000-0x0000025370B0B000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-55-0x00000253709B0000-0x0000025370B0B000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-43-0x00000253709B0000-0x0000025370B0B000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-59-0x00000253709B0000-0x0000025370B0B000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-61-0x00000253709B0000-0x0000025370B0B000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-63-0x00000253709B0000-0x0000025370B0B000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-65-0x00000253709B0000-0x0000025370B0B000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-67-0x00000253709B0000-0x0000025370B0B000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-69-0x00000253709B0000-0x0000025370B0B000-memory.dmp

      Filesize

      1.4MB

      Download

    • memory/1000-938-0x0000025356680000-0x0000025356681000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1000-939-0x0000025370B10000-0x0000025370C08000-memory.dmp

      Filesize

      992KB

      Download

    • memory/1000-940-0x0000025357FF0000-0x000002535803C000-memory.dmp

      Filesize

      304KB

      Download

    • memory/1000-1-0x00007FFCD1C20000-0x00007FFCD26E1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/1000-949-0x00007FFCD1C20000-0x00007FFCD26E1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/1832-947-0x00000222CCBD0000-0x00000222CCBE0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1832-946-0x00007FFCD1C20000-0x00007FFCD26E1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/1832-948-0x00000222CCA00000-0x00000222CCB0A000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/1832-945-0x0000000140000000-0x00000001400D0000-memory.dmp

      Filesize

      832KB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.