Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

6

Static

static

3

3cb8590c7b...44.exe

windows7-x64

6

3cb8590c7b...44.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    2s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/01/2024, 11:23 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3cb8590c7b77611ff486ea54d9326044.exe

  • Size

    10KB

  • MD5

    3cb8590c7b77611ff486ea54d9326044

  • SHA1

    60796d20dd43ba739f0fc7e532709401ed412e15

  • SHA256

    7910afb3bbcb3bee0463b099032788942f837b7b3dc8c92ef6623db0f213488a

  • SHA512

    e2ccbb3ed7f149c16cdad2e640e1bba170244b2a98618db3ab4b29ef46165c388f342f982bbb99ff8b72ea138b2e71c56c2cf87912fe592e55f70cabf67c73e0

  • SSDEEP

    192:kGXmfPWOjVY8Zq70V5neld/B9cuYykCYypsWIKiI4ma7cybYYKJ49oo:B8PWORYaUd/oAkCXps5KZ4f7cy/KJ49o

Score
6/10
persistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Program crash 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3cb8590c7b77611ff486ea54d9326044.exe
    "C:\Users\Admin\AppData\Local\Temp\3cb8590c7b77611ff486ea54d9326044.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetWindowsHookEx
    PID:3784
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3784 -s 2312
      2⤵
      • Program crash
      PID:4312
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3784 -ip 3784
    1⤵
      PID:4788

    Network

    • flag-us
      DNS
      www.google.com
      3cb8590c7b77611ff486ea54d9326044.exe
      Remote address:
      8.8.8.8:53
      Request
      www.google.com
      IN A
      Response
      www.google.com
      IN A
      142.250.200.4
    • flag-us
      DNS
      www.google.com
      3cb8590c7b77611ff486ea54d9326044.exe
      Remote address:
      8.8.8.8:53
      Request
      www.google.com
      IN A
    • flag-us
      DNS
      g.bing.com
      Remote address:
      8.8.8.8:53
      Request
      g.bing.com
      IN A
      Response
      g.bing.com
      IN CNAME
      g-bing-com.a-0001.a-msedge.net
      g-bing-com.a-0001.a-msedge.net
      IN CNAME
      dual-a-0001.a-msedge.net
      dual-a-0001.a-msedge.net
      IN A
      204.79.197.200
      dual-a-0001.a-msedge.net
      IN A
      13.107.21.200
    • flag-us
      GET
      https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=36f49617f89a4c93b73a35e565775fb1&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid=
      Remote address:
      204.79.197.200:443
      Request
      GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=36f49617f89a4c93b73a35e565775fb1&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid= HTTP/2.0
      host: g.bing.com
      accept-encoding: gzip, deflate
      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
      Response
      HTTP/2.0 204
      cache-control: no-cache, must-revalidate
      pragma: no-cache
      expires: Fri, 01 Jan 1990 00:00:00 GMT
      set-cookie: MUID=21E23D234A0E6B9B1C3529204BEE6A55; domain=.bing.com; expires=Tue, 04-Feb-2025 02:19:20 GMT; path=/; SameSite=None; Secure; Priority=High;
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      access-control-allow-origin: *
      x-cache: CONFIG_NOCACHE
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 7371C2E4626C47509CFF17FCF0667C6D Ref B: LON04EDGE1012 Ref C: 2024-01-11T02:19:20Z
      date: Thu, 11 Jan 2024 02:19:19 GMT
    • flag-us
      GET
      https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=36f49617f89a4c93b73a35e565775fb1&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid=
      Remote address:
      204.79.197.200:443
      Request
      GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=36f49617f89a4c93b73a35e565775fb1&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid= HTTP/2.0
      host: g.bing.com
      accept-encoding: gzip, deflate
      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
      cookie: MUID=21E23D234A0E6B9B1C3529204BEE6A55
      Response
      HTTP/2.0 204
      cache-control: no-cache, must-revalidate
      pragma: no-cache
      expires: Fri, 01 Jan 1990 00:00:00 GMT
      set-cookie: MSPTC=aK4jiBTlRKhHagwJ8kCEPEOsYzW9AkQbtgSoqCEyYmk; domain=.bing.com; expires=Tue, 04-Feb-2025 02:19:20 GMT; path=/; Partitioned; secure; SameSite=None
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      access-control-allow-origin: *
      x-cache: CONFIG_NOCACHE
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 7CCCAB15BA3A4AEFB2DE67C4FDABEBF9 Ref B: LON04EDGE1012 Ref C: 2024-01-11T02:19:20Z
      date: Thu, 11 Jan 2024 02:19:19 GMT
    • flag-us
      GET
      https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=36f49617f89a4c93b73a35e565775fb1&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid=
      Remote address:
      204.79.197.200:443
      Request
      GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=36f49617f89a4c93b73a35e565775fb1&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid= HTTP/2.0
      host: g.bing.com
      accept-encoding: gzip, deflate
      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
      cookie: MUID=21E23D234A0E6B9B1C3529204BEE6A55; MSPTC=aK4jiBTlRKhHagwJ8kCEPEOsYzW9AkQbtgSoqCEyYmk
      Response
      HTTP/2.0 204
      cache-control: no-cache, must-revalidate
      pragma: no-cache
      expires: Fri, 01 Jan 1990 00:00:00 GMT
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      access-control-allow-origin: *
      x-cache: CONFIG_NOCACHE
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 3D267ED10AE0481BBDDE6357D87D33A8 Ref B: LON04EDGE1012 Ref C: 2024-01-11T02:19:20Z
      date: Thu, 11 Jan 2024 02:19:19 GMT
    • flag-us
      DNS
      2.136.104.51.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      2.136.104.51.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      200.197.79.204.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      200.197.79.204.in-addr.arpa
      IN PTR
      Response
      200.197.79.204.in-addr.arpa
      IN PTR
      a-0001a-msedgenet
    • flag-us
      DNS
      194.178.17.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      194.178.17.96.in-addr.arpa
      IN PTR
      Response
      194.178.17.96.in-addr.arpa
      IN PTR
      a96-17-178-194deploystaticakamaitechnologiescom
    • flag-gb
      GET
      http://www.google.com/
      3cb8590c7b77611ff486ea54d9326044.exe
      Remote address:
      142.250.200.4:80
      Request
      GET / HTTP/1.1
      Accept: */*
      Accept-Language: en-US
      Accept-Encoding: gzip, deflate
      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
      Host: www.google.com
      Connection: Keep-Alive
      Response
      HTTP/1.1 302 Found
      Location: https://www.google.com/?gws_rd=ssl
      Cache-Control: private
      Content-Type: text/html; charset=UTF-8
      Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-xd_mkF6aFdPj-10wC_827Q' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
      Date: Thu, 11 Jan 2024 02:19:20 GMT
      Server: gws
      Content-Length: 231
      X-XSS-Protection: 0
      X-Frame-Options: SAMEORIGIN
      Set-Cookie: AEC=Ae3NU9NIFSvB2mBjQ770DPFIa2M006abQXdzJ7cSyqFRh-Gdu2D-NepaGiU; expires=Tue, 09-Jul-2024 02:19:20 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
    • flag-gb
      GET
      https://www.google.com/?gws_rd=ssl
      3cb8590c7b77611ff486ea54d9326044.exe
      Remote address:
      142.250.200.4:443
      Request
      GET /?gws_rd=ssl HTTP/1.1
      Accept: */*
      Accept-Language: en-US
      Accept-Encoding: gzip, deflate
      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
      Connection: Keep-Alive
      Host: www.google.com
      Cookie: AEC=Ae3NU9NIFSvB2mBjQ770DPFIa2M006abQXdzJ7cSyqFRh-Gdu2D-NepaGiU
      Response
      HTTP/1.1 200 OK
      Date: Thu, 11 Jan 2024 02:19:25 GMT
      Expires: -1
      Cache-Control: private, max-age=0
      Content-Type: text/html; charset=UTF-8
      Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-r8K1u22hJw5fSEaUNCm_rw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
      P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
      Content-Encoding: gzip
      Server: gws
      X-XSS-Protection: 0
      X-Frame-Options: SAMEORIGIN
      Set-Cookie: SOCS=CAAaBgiA3_ysBg; expires=Sun, 09-Feb-2025 02:19:25 GMT; path=/; domain=.google.com; Secure; SameSite=lax
      Set-Cookie: __Secure-ENID=17.SE=Weqsfmw5VNiMRjG-l0GBASlF_LFB6XMrcKsupU-VLvyR3KmdlxC0flb7nvwJZY998Mrdvpjg5erRtTrwYBVIDDrcYAfz-z3rtN7SpqZp3C2_fJNDw9WmrsmMLTk_VOHyyNChbg1bcXxEmfxkAydgJlWcMEh7SIUtWRFvc_tcD8g; expires=Sun, 09-Feb-2025 18:37:43 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
      Set-Cookie: CONSENT=PENDING+981; expires=Sat, 10-Jan-2026 02:19:25 GMT; path=/; domain=.google.com; Secure
      Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
      Transfer-Encoding: chunked
    • flag-gb
      GET
      https://www.google.com/images/branding/googlelogo/1x/googlelogo_white_background_color_272x92dp.png
      3cb8590c7b77611ff486ea54d9326044.exe
      Remote address:
      142.250.200.4:443
      Request
      GET /images/branding/googlelogo/1x/googlelogo_white_background_color_272x92dp.png HTTP/1.1
      Accept: */*
      Referer: https://www.google.com/?gws_rd=ssl
      Accept-Language: en-US
      Accept-Encoding: gzip, deflate
      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
      Host: www.google.com
      Connection: Keep-Alive
      Cookie: AEC=Ae3NU9NIFSvB2mBjQ770DPFIa2M006abQXdzJ7cSyqFRh-Gdu2D-NepaGiU; SOCS=CAAaBgiA3_ysBg; __Secure-ENID=17.SE=Weqsfmw5VNiMRjG-l0GBASlF_LFB6XMrcKsupU-VLvyR3KmdlxC0flb7nvwJZY998Mrdvpjg5erRtTrwYBVIDDrcYAfz-z3rtN7SpqZp3C2_fJNDw9WmrsmMLTk_VOHyyNChbg1bcXxEmfxkAydgJlWcMEh7SIUtWRFvc_tcD8g; CONSENT=PENDING+981
      Response
      HTTP/1.1 200 OK
      Accept-Ranges: bytes
      Content-Type: image/png
      Cross-Origin-Resource-Policy: cross-origin
      Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="static-on-bigtable"
      Report-To: {"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
      Content-Length: 5482
      Date: Thu, 11 Jan 2024 02:19:25 GMT
      Expires: Thu, 11 Jan 2024 02:19:25 GMT
      Cache-Control: private, max-age=31536000
      Last-Modified: Tue, 22 Oct 2019 18:30:00 GMT
      X-Content-Type-Options: nosniff
      Server: sffe
      X-XSS-Protection: 0
      Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
    • flag-us
      DNS
      4.200.250.142.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      4.200.250.142.in-addr.arpa
      IN PTR
      Response
      4.200.250.142.in-addr.arpa
      IN PTR
      lhr48s29-in-f41e100net
    • flag-us
      DNS
      4.200.250.142.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      4.200.250.142.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      9.228.82.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      9.228.82.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      9.228.82.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      9.228.82.20.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      35.200.250.142.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      35.200.250.142.in-addr.arpa
      IN PTR
      Response
      35.200.250.142.in-addr.arpa
      IN PTR
      lhr48s30-in-f31e100net
    • flag-us
      DNS
      86.23.85.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      86.23.85.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      41.110.16.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      41.110.16.96.in-addr.arpa
      IN PTR
      Response
      41.110.16.96.in-addr.arpa
      IN PTR
      a96-16-110-41deploystaticakamaitechnologiescom
    • flag-us
      DNS
      178.223.142.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      178.223.142.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      171.39.242.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      171.39.242.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      240.221.184.93.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      240.221.184.93.in-addr.arpa
      IN PTR
      Response
    • flag-gb
      DNS
      Remote address:
      87.248.205.0:80
      Response
      HTTP/1.1 304 Not Modified
      Content-Type: application/vnd.ms-cab-compressed
      X-LLID: 008fe6f9133d967135bfb486fc4f1537
      Age: 581
      Date: Thu, 11 Jan 2024 02:20:23 GMT
      Expires: Thu, 11 Jan 2024 02:25:42 GMT
      Connection: keep-alive
      X-CID: 4
      X-CCC: gb
    • flag-us
      DNS
      31.243.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      31.243.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      31.243.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      31.243.111.52.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      tse1.mm.bing.net
      Remote address:
      8.8.8.8:53
      Request
      tse1.mm.bing.net
      IN A
      Response
      tse1.mm.bing.net
      IN CNAME
      mm-mm.bing.net.trafficmanager.net
      mm-mm.bing.net.trafficmanager.net
      IN CNAME
      dual-a-0001.a-msedge.net
      dual-a-0001.a-msedge.net
      IN A
      204.79.197.200
      dual-a-0001.a-msedge.net
      IN A
      13.107.21.200
    • flag-us
      DNS
      tse1.mm.bing.net
      Remote address:
      8.8.8.8:53
      Request
      tse1.mm.bing.net
      IN A
      Response
      tse1.mm.bing.net
      IN CNAME
      mm-mm.bing.net.trafficmanager.net
      mm-mm.bing.net.trafficmanager.net
      IN CNAME
      dual-a-0001.a-msedge.net
      dual-a-0001.a-msedge.net
      IN A
      204.79.197.200
      dual-a-0001.a-msedge.net
      IN A
      13.107.21.200
    • flag-us
      DNS
      131.109.69.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      131.109.69.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      131.109.69.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      131.109.69.13.in-addr.arpa
      IN PTR
      Response
    • 204.79.197.200:443
      https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=36f49617f89a4c93b73a35e565775fb1&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid=
      tls, http2
      2.0kB
       9.4kB
       22
      19

      HTTP Request

      GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=36f49617f89a4c93b73a35e565775fb1&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid=

      HTTP Response

      204

      HTTP Request

      GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=36f49617f89a4c93b73a35e565775fb1&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid=

      HTTP Response

      204

      HTTP Request

      GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=36f49617f89a4c93b73a35e565775fb1&localId=w:8DF2633F-10BE-C247-8B12-9A64CE5AE8FE&deviceId=6896190589629886&anid=

      HTTP Response

      204
    • 142.250.200.4:80
      http://www.google.com/
      http
      3cb8590c7b77611ff486ea54d9326044.exe
      1.3kB
       1.1kB
       8
      4

      HTTP Request

      GET http://www.google.com/

      HTTP Response

      302
    • 142.250.200.4:443
      https://www.google.com/images/branding/googlelogo/1x/googlelogo_white_background_color_272x92dp.png
      tls, http
      3cb8590c7b77611ff486ea54d9326044.exe
      2.7kB
       22.9kB
       27
      22

      HTTP Request

      GET https://www.google.com/?gws_rd=ssl

      HTTP Response

      200

      HTTP Request

      GET https://www.google.com/images/branding/googlelogo/1x/googlelogo_white_background_color_272x92dp.png

      HTTP Response

      200
    • 87.248.205.0:80
      http
      190 B
       412 B
       4
      4

      HTTP Response

      304
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls
      1.6kB
       8.3kB
       17
      14
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls
      43.1kB
       1.2MB
       889
      888
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls
      1.1kB
       549 B
       10
      7
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls
      1.5kB
       8.2kB
       16
      13
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls
      1.5kB
       8.3kB
       16
      14
    • 8.8.8.8:53
      www.google.com
      dns
      3cb8590c7b77611ff486ea54d9326044.exe
      120 B
       76 B
       2
      1

      DNS Request

      www.google.com

      DNS Request

      www.google.com

      DNS Response

      142.250.200.4

    • 8.8.8.8:53
      g.bing.com
      dns
      56 B
       158 B
       1
      1

      DNS Request

      g.bing.com

      DNS Response

      204.79.197.200
      13.107.21.200

    • 8.8.8.8:53
      2.136.104.51.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      2.136.104.51.in-addr.arpa

    • 8.8.8.8:53
      200.197.79.204.in-addr.arpa
      dns
      73 B
       106 B
       1
      1

      DNS Request

      200.197.79.204.in-addr.arpa

    • 8.8.8.8:53
      194.178.17.96.in-addr.arpa
      dns
      72 B
       137 B
       1
      1

      DNS Request

      194.178.17.96.in-addr.arpa

    • 8.8.8.8:53
      4.200.250.142.in-addr.arpa
      dns
      144 B
       110 B
       2
      1

      DNS Request

      4.200.250.142.in-addr.arpa

      DNS Request

      4.200.250.142.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      146 B
       144 B
       2
      1

      DNS Request

      95.221.229.192.in-addr.arpa

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      9.228.82.20.in-addr.arpa
      dns
      140 B
       156 B
       2
      1

      DNS Request

      9.228.82.20.in-addr.arpa

      DNS Request

      9.228.82.20.in-addr.arpa

    • 8.8.8.8:53
      35.200.250.142.in-addr.arpa
      dns
      73 B
       111 B
       1
      1

      DNS Request

      35.200.250.142.in-addr.arpa

    • 8.8.8.8:53
      86.23.85.13.in-addr.arpa
      dns
      70 B
       144 B
       1
      1

      DNS Request

      86.23.85.13.in-addr.arpa

    • 8.8.8.8:53
      41.110.16.96.in-addr.arpa
      dns
      71 B
       135 B
       1
      1

      DNS Request

      41.110.16.96.in-addr.arpa

    • 8.8.8.8:53
      178.223.142.52.in-addr.arpa
      dns
      73 B
       147 B
       1
      1

      DNS Request

      178.223.142.52.in-addr.arpa

    • 8.8.8.8:53
      171.39.242.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      171.39.242.20.in-addr.arpa

    • 8.8.8.8:53
      240.221.184.93.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      240.221.184.93.in-addr.arpa

    • 8.8.8.8:53
      31.243.111.52.in-addr.arpa
      dns
      144 B
       158 B
       2
      1

      DNS Request

      31.243.111.52.in-addr.arpa

      DNS Request

      31.243.111.52.in-addr.arpa

    • 8.8.8.8:53
      tse1.mm.bing.net
      dns
      124 B
       346 B
       2
      2

      DNS Request

      tse1.mm.bing.net

      DNS Request

      tse1.mm.bing.net

      DNS Response

      204.79.197.200
      13.107.21.200

      DNS Response

      204.79.197.200
      13.107.21.200

    • 8.8.8.8:53
      131.109.69.13.in-addr.arpa
      dns
      144 B
       292 B
       2
      2

      DNS Request

      131.109.69.13.in-addr.arpa

      DNS Request

      131.109.69.13.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3784-0-0x0000000000400000-0x0000000000408150-memory.dmp

      Filesize

      32KB

      Download

    • memory/3784-1-0x0000000000400000-0x0000000000408150-memory.dmp

      Filesize

      32KB

      Download

    • memory/3784-4-0x0000000000400000-0x0000000000408150-memory.dmp

      Filesize

      32KB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.