Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
07/01/2024, 18:26 UTC
240107-w3ameabffn 10Analysis
-
max time kernel
102s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
07/01/2024, 18:26 UTC
General
-
Target
Samples 6/ca181f57edb3d99fbdfd1a512a783d266d479c2fd38ffea14742771df7ba2c1a.exe
-
Size
248KB
-
MD5
14c45fa75b1f8644c5fe37ca234a456b
-
SHA1
056713d15dfa8032597aac2e3f61e6a5794a53e8
-
SHA256
ca181f57edb3d99fbdfd1a512a783d266d479c2fd38ffea14742771df7ba2c1a
-
SHA512
b6f212cbb3255c2da4d1935507c5f83833bbeea3b6aca7c0632852db2018dc1a667756b8693a50793cc1ea75296fc13b60eea8c0b645a9e7c901a69a6adbbc21
-
SSDEEP
3072:A9orP+stnvfG4+zxvGz/QUVcRe/1nkJuTby/cT2cARxVC09++zu:SoCshG4qx1UVco/1aYySAR+
Score
10/10
Malware Config
Extracted
Family
smokeloader
Botnet
pub4
Extracted
Family
smokeloader
Version
2022
C2
http://dpav.cc/tmp/
http://lrproduct.ru/tmp/
http://kggcp.com/tmp/
http://talesofpirates.net/tmp/
http://pirateking.online/tmp/
http://piratia.pw/tmp/
http://go-piratia.ru/tmp/
rc4.i32
1
0x3b22e540
rc4.i32
1
0xa6b397e0
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Deletes itself 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Samples 6\ca181f57edb3d99fbdfd1a512a783d266d479c2fd38ffea14742771df7ba2c1a.exe"C:\Users\Admin\AppData\Local\Temp\Samples 6\ca181f57edb3d99fbdfd1a512a783d266d479c2fd38ffea14742771df7ba2c1a.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
Network
-
DNS19.177.190.20.in-addr.arpaRemote address:8.8.8.8:53Request19.177.190.20.in-addr.arpaIN PTRResponse -
DNS19.177.190.20.in-addr.arpaRemote address:8.8.8.8:53Request19.177.190.20.in-addr.arpaIN PTR
-
DNS146.78.124.51.in-addr.arpaRemote address:8.8.8.8:53Request146.78.124.51.in-addr.arpaIN PTRResponse
-
DNS194.178.17.96.in-addr.arpaRemote address:8.8.8.8:53Request194.178.17.96.in-addr.arpaIN PTRResponse194.178.17.96.in-addr.arpaIN PTRa96-17-178-194deploystaticakamaitechnologiescom
-
DNS194.178.17.96.in-addr.arpaRemote address:8.8.8.8:53Request194.178.17.96.in-addr.arpaIN PTR
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS43.58.199.20.in-addr.arpaRemote address:8.8.8.8:53Request43.58.199.20.in-addr.arpaIN PTRResponse
-
DNS241.154.82.20.in-addr.arpaRemote address:8.8.8.8:53Request241.154.82.20.in-addr.arpaIN PTRResponse
-
DNS103.169.127.40.in-addr.arpaRemote address:8.8.8.8:53Request103.169.127.40.in-addr.arpaIN PTRResponse
-
DNS75.159.190.20.in-addr.arpaRemote address:8.8.8.8:53Request75.159.190.20.in-addr.arpaIN PTRResponse
-
DNS75.159.190.20.in-addr.arpaRemote address:8.8.8.8:53Request75.159.190.20.in-addr.arpaIN PTR
-
DNS75.159.190.20.in-addr.arpaRemote address:8.8.8.8:53Request75.159.190.20.in-addr.arpaIN PTR
-
DNS59.128.231.4.in-addr.arpaRemote address:8.8.8.8:53Request59.128.231.4.in-addr.arpaIN PTRResponse
-
DNSdpav.ccRemote address:8.8.8.8:53Requestdpav.ccIN AResponsedpav.ccIN A211.181.24.133dpav.ccIN A123.140.161.243dpav.ccIN A175.120.254.9dpav.ccIN A211.171.233.129dpav.ccIN A180.94.156.61dpav.ccIN A189.232.1.60dpav.ccIN A190.224.203.37dpav.ccIN A175.126.109.15dpav.ccIN A109.175.29.39dpav.ccIN A186.13.17.220
-
POSThttp://dpav.cc/tmp/Remote address:211.181.24.133:80RequestPOST /tmp/ HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://jwatyipdwmeik.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Content-Length: 226
Host: dpav.cc
-
DNS11.2.37.23.in-addr.arpaRemote address:8.8.8.8:53Request11.2.37.23.in-addr.arpaIN PTRResponse11.2.37.23.in-addr.arpaIN PTRa23-37-2-11deploystaticakamaitechnologiescom
-
DNSlrproduct.ruRemote address:8.8.8.8:53Requestlrproduct.ruIN AResponse
-
DNSlrproduct.ruRemote address:8.8.8.8:53Requestlrproduct.ruIN AResponse
-
DNS133.24.181.211.in-addr.arpaRemote address:8.8.8.8:53Request133.24.181.211.in-addr.arpaIN PTRResponse
-
DNSkggcp.comRemote address:8.8.8.8:53Requestkggcp.comIN AResponse
-
DNStalesofpirates.netRemote address:8.8.8.8:53Requesttalesofpirates.netIN AResponsetalesofpirates.netIN A104.21.1.180talesofpirates.netIN A172.67.129.176
-
POSThttp://talesofpirates.net/tmp/Remote address:104.21.1.180:80RequestPOST /tmp/ HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://sohxfuborahxc.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Content-Length: 137
Host: talesofpirates.net
ResponseHTTP/1.1 301 Moved Permanently
Date: Sun, 07 Jan 2024 18:34:11 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Sun, 07 Jan 2024 19:34:11 GMT
Location: https://talesofpirates.net/tmp/
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3qikrhStPhb4jdXXmJUSTg9On7He3waaK0Ww6FCsHh%2F%2BU8SDS6WkB0YoYjhrj36Ck7blCYjUBD%2F9cMQkXCMtqd9VptGG3SWVZbAXEH8NeERKglnmqE8WjeS1M08rjoCr4S9UDVg%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 841e4b2089b3731b-LHR
alt-svc: h3=":443"; ma=86400
-
GEThttps://talesofpirates.net/tmp/Remote address:104.21.1.180:443RequestGET /tmp/ HTTP/1.1
Connection: Keep-Alive
Accept: */*
Referer: http://sohxfuborahxc.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Host: talesofpirates.net
ResponseHTTP/1.1 200 OK
Date: Sun, 07 Jan 2024 18:34:19 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/7.4.33
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=ug4q4d6cc8ttmdcaotatusrl8j; path=/
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VJ2MppETchxq1cYixgnRITA4xBM6vIPw6GqSLh%2BzIlGSeJWXtCcJKhPGk801BlZ5a7pDuoyg%2B7ON9XeM01N1CinIzY7Fq8rIs9rmbDAA%2FZksXs0YmI9oH4YrFWVveAU1NDL1bKw%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 841e4b4dc83d63e7-LHR
alt-svc: h3=":443"; ma=86400
-
DNS180.1.21.104.in-addr.arpaRemote address:8.8.8.8:53Request180.1.21.104.in-addr.arpaIN PTRResponse
-
DNS180.1.21.104.in-addr.arpaRemote address:8.8.8.8:53Request180.1.21.104.in-addr.arpaIN PTR
-
DNS56.126.166.20.in-addr.arpaRemote address:8.8.8.8:53Request56.126.166.20.in-addr.arpaIN PTRResponse
-
DNS232.135.221.88.in-addr.arpaRemote address:8.8.8.8:53Request232.135.221.88.in-addr.arpaIN PTRResponse232.135.221.88.in-addr.arpaIN PTRa88-221-135-232deploystaticakamaitechnologiescom
-
DNS150.1.37.23.in-addr.arpaRemote address:8.8.8.8:53Request150.1.37.23.in-addr.arpaIN PTRResponse150.1.37.23.in-addr.arpaIN PTRa23-37-1-150deploystaticakamaitechnologiescom
-
DNSpirateking.onlineRemote address:8.8.8.8:53Requestpirateking.onlineIN AResponsepirateking.onlineIN A172.67.180.11pirateking.onlineIN A104.21.96.118
-
DNSpirateking.onlineRemote address:8.8.8.8:53Requestpirateking.onlineIN A
-
POSThttp://pirateking.online/tmp/Remote address:172.67.180.11:80RequestPOST /tmp/ HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://pvasducwsnbk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Content-Length: 141
Host: pirateking.online
ResponseHTTP/1.1 301 Moved Permanently
Date: Sun, 07 Jan 2024 18:34:20 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Sun, 07 Jan 2024 19:34:20 GMT
Location: https://pirateking.online/tmp/
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IXBIHSRHfXFDdBUnrCwYpKkSUBdWL410VWodhKWUHTy95z24nx3azzZNZJq6Ur%2FZs64pR%2BCyFvtCQowLbcKc4xyThau8WvhbtnuiD1OXjMUUpFBWWvbJFdoflm9xD0CCzgt6zQ%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 841e4b567cdb79ba-LHR
alt-svc: h3=":443"; ma=86400
-
GEThttps://pirateking.online/tmp/Remote address:172.67.180.11:443RequestGET /tmp/ HTTP/1.1
Connection: Keep-Alive
Accept: */*
Referer: http://pvasducwsnbk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Host: pirateking.online
ResponseHTTP/1.1 520
Date: Sun, 07 Jan 2024 18:34:21 GMT
Content-Type: text/plain; charset=UTF-8
Content-Length: 15
Connection: keep-alive
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nIIFjTlFsAb3f5M6KQ9Ef48iIvWnQDEn%2FCzNeYwALRXb3v1y2E65qR3qywdfUkbjMAupOZjWs4vWxFWS9hJhWss1oCMWAZIPftluQ6OrFLiegekD7vMDdj4IFaQtiRum1dvUTw%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Strict-Transport-Security: max-age=2592000; includeSubDomains
X-Frame-Options: SAMEORIGIN
Referrer-Policy: same-origin
Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 01 Jan 1970 00:00:01 GMT
Server: cloudflare
CF-RAY: 841e4b57cb0c7755-LHR
alt-svc: h3=":443"; ma=86400
-
DNSpiratia.pwRemote address:8.8.8.8:53Requestpiratia.pwIN AResponsepiratia.pwIN A104.21.79.117piratia.pwIN A172.67.170.133
-
POSThttp://piratia.pw/tmp/Remote address:104.21.79.117:80RequestPOST /tmp/ HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://hdyfoqbyrdss.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Content-Length: 237
Host: piratia.pw
-
DNS11.180.67.172.in-addr.arpaRemote address:8.8.8.8:53Request11.180.67.172.in-addr.arpaIN PTRResponse
-
DNS117.79.21.104.in-addr.arpaRemote address:8.8.8.8:53Request117.79.21.104.in-addr.arpaIN PTRResponse
-
DNS117.79.21.104.in-addr.arpaRemote address:8.8.8.8:53Request117.79.21.104.in-addr.arpaIN PTR
-
DNSgo-piratia.ruRemote address:8.8.8.8:53Requestgo-piratia.ruIN AResponsego-piratia.ruIN A104.21.51.101go-piratia.ruIN A172.67.179.5
-
POSThttp://go-piratia.ru/tmp/Remote address:104.21.51.101:80RequestPOST /tmp/ HTTP/1.1
Connection: Keep-Alive
Content-Type: application/x-www-form-urlencoded
Accept: */*
Referer: http://lswmwcurwnk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Content-Length: 238
Host: go-piratia.ru
ResponseHTTP/1.1 301 Moved Permanently
Date: Sun, 07 Jan 2024 18:34:25 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Sun, 07 Jan 2024 19:34:25 GMT
Location: https://go-piratia.ru/tmp/
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OJ7BOmdERqDD26AEu6cTNek58pb9WDsY7gjYj7OjATKdeJ2yBemlP3O%2FfnpJwVEkq34YUKaQTyLTqVgWjNNxtjPNJjrY1ggdKiznI8OOkK9sQ4KlguET3VgXqDvcGHLT"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 841e4b74b9b63859-LHR
alt-svc: h3=":443"; ma=86400
-
GEThttps://go-piratia.ru/tmp/Remote address:104.21.51.101:443RequestGET /tmp/ HTTP/1.1
Connection: Keep-Alive
Accept: */*
Referer: http://lswmwcurwnk.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Host: go-piratia.ru
ResponseHTTP/1.1 404 Not Found
Date: Sun, 07 Jan 2024 18:34:27 GMT
Content-Type: text/html;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
X-Powered-By: PHP/8.0.30
X-IPS-LoggedIn: 0
Vary: Cookie,Accept-Encoding
X-XSS-Protection: 0
X-Frame-Options: sameorigin
Content-Security-Policy: frame-ancestors 'self'
X-Content-Security-Policy: frame-ancestors 'self'
Referrer-Policy: strict-origin-when-cross-origin
Expires: Sun, 07 Jan 2024 18:49:27 GMT
Cache-Control: no-cache="Set-Cookie", max-age=900, public, s-maxage=900, stale-while-revalidate, stale-if-error
Set-Cookie: ips4_IPSSessionFront=7eb3b1231b1937499caf55a2a4be7091; path=/; secure; HttpOnly
Set-Cookie: ips4_chatbox_inRoom=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; secure; HttpOnly
Last-Modified: Sun, 07 Jan 2024 18:34:27 GMT
CF-Cache-Status: DYNAMIC
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nF2Uclhh08%2FyjydiRTWZmwltm68ePLqI11V7Bi%2Ff0Jo%2BBqrz0xCW8slXrls%2Bmy2FXeRxbVC%2FnrXVXG81ste1bt2JQMWLz%2BMbYm%2B2INDKYDmvOJxXq1Fq1T1W3C%2F3jglC"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 841e4b7e48086358-LHR
alt-svc: h3=":443"; ma=86400
-
DNS101.51.21.104.in-addr.arpaRemote address:8.8.8.8:53Request101.51.21.104.in-addr.arpaIN PTRResponse
-
DNS186.178.17.96.in-addr.arpaRemote address:8.8.8.8:53Request186.178.17.96.in-addr.arpaIN PTRResponse186.178.17.96.in-addr.arpaIN PTRa96-17-178-186deploystaticakamaitechnologiescom
-
DNS205.47.74.20.in-addr.arpaRemote address:8.8.8.8:53Request205.47.74.20.in-addr.arpaIN PTRResponse
-
DNS100.5.17.2.in-addr.arpaRemote address:8.8.8.8:53Request100.5.17.2.in-addr.arpaIN PTRResponse100.5.17.2.in-addr.arpaIN PTRa2-17-5-100deploystaticakamaitechnologiescom
-
DNS100.5.17.2.in-addr.arpaRemote address:8.8.8.8:53Request100.5.17.2.in-addr.arpaIN PTR
-
DNS119.110.54.20.in-addr.arpaRemote address:8.8.8.8:53Request119.110.54.20.in-addr.arpaIN PTRResponse
-
DNS30.243.111.52.in-addr.arpaRemote address:8.8.8.8:53Request30.243.111.52.in-addr.arpaIN PTRResponse
-
DNS18.134.221.88.in-addr.arpaRemote address:8.8.8.8:53Request18.134.221.88.in-addr.arpaIN PTRResponse18.134.221.88.in-addr.arpaIN PTRa88-221-134-18deploystaticakamaitechnologiescom
-
DNS187.178.17.96.in-addr.arpaRemote address:8.8.8.8:53Request187.178.17.96.in-addr.arpaIN PTRResponse187.178.17.96.in-addr.arpaIN PTRa96-17-178-187deploystaticakamaitechnologiescom
-
DNS80.135.221.88.in-addr.arpaRemote address:8.8.8.8:53Request80.135.221.88.in-addr.arpaIN PTRResponse80.135.221.88.in-addr.arpaIN PTRa88-221-135-80deploystaticakamaitechnologiescom
-
DNS80.135.221.88.in-addr.arpaRemote address:8.8.8.8:53Request80.135.221.88.in-addr.arpaIN PTR
-
DNS0.204.248.87.in-addr.arpaRemote address:8.8.8.8:53Request0.204.248.87.in-addr.arpaIN PTRResponse0.204.248.87.in-addr.arpaIN PTRhttps-87-248-204-0lhrllnwnet
-
DNS0.204.248.87.in-addr.arpaRemote address:8.8.8.8:53Request0.204.248.87.in-addr.arpaIN PTR
-
DNSRemote address:8.8.8.8:53Responsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
DNS79.121.231.20.in-addr.arpaRemote address:8.8.8.8:53Request79.121.231.20.in-addr.arpaIN PTRResponse
-
138.91.171.81:80
-
211.181.24.133:80http://dpav.cc/tmp/http
HTTP Request
POST http://dpav.cc/tmp/ -
104.21.1.180:80http://talesofpirates.net/tmp/http
HTTP Request
POST http://talesofpirates.net/tmp/HTTP Response
301 -
104.21.1.180:443https://talesofpirates.net/tmp/tls, http
HTTP Request
GET https://talesofpirates.net/tmp/HTTP Response
200 -
172.67.180.11:80http://pirateking.online/tmp/http
HTTP Request
POST http://pirateking.online/tmp/HTTP Response
301 -
172.67.180.11:443https://pirateking.online/tmp/tls, http
HTTP Request
GET https://pirateking.online/tmp/HTTP Response
520 -
104.21.79.117:80http://piratia.pw/tmp/http
HTTP Request
POST http://piratia.pw/tmp/ -
104.21.51.101:80http://go-piratia.ru/tmp/http
HTTP Request
POST http://go-piratia.ru/tmp/HTTP Response
301 -
104.21.51.101:443https://go-piratia.ru/tmp/tls, http
HTTP Request
GET https://go-piratia.ru/tmp/HTTP Response
404 -
204.79.197.200:443tse1.mm.bing.nettls
-
204.79.197.200:443tse1.mm.bing.nettls
-
204.79.197.200:443tse1.mm.bing.nettls
-
204.79.197.200:443tse1.mm.bing.nettls
-
204.79.197.200:443tse1.mm.bing.nettls
-
8.8.8.8:5319.177.190.20.in-addr.arpadns
DNS Request
19.177.190.20.in-addr.arpa
DNS Request
19.177.190.20.in-addr.arpa
-
8.8.8.8:53146.78.124.51.in-addr.arpadns
DNS Request
146.78.124.51.in-addr.arpa
-
8.8.8.8:53194.178.17.96.in-addr.arpadns
DNS Request
194.178.17.96.in-addr.arpa
DNS Request
194.178.17.96.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:5343.58.199.20.in-addr.arpadns
DNS Request
43.58.199.20.in-addr.arpa
-
8.8.8.8:53241.154.82.20.in-addr.arpadns
DNS Request
241.154.82.20.in-addr.arpa
-
8.8.8.8:53103.169.127.40.in-addr.arpadns
DNS Request
103.169.127.40.in-addr.arpa
-
8.8.8.8:5375.159.190.20.in-addr.arpadns
DNS Request
75.159.190.20.in-addr.arpa
DNS Request
75.159.190.20.in-addr.arpa
DNS Request
75.159.190.20.in-addr.arpa
-
8.8.8.8:5359.128.231.4.in-addr.arpadns
DNS Request
59.128.231.4.in-addr.arpa
-
8.8.8.8:53dpav.ccdns
DNS Request
dpav.cc
DNS Response
211.181.24.133123.140.161.243175.120.254.9211.171.233.129180.94.156.61189.232.1.60190.224.203.37175.126.109.15109.175.29.39186.13.17.220
-
8.8.8.8:5311.2.37.23.in-addr.arpadns
DNS Request
11.2.37.23.in-addr.arpa
-
8.8.8.8:53lrproduct.rudns
DNS Request
lrproduct.ru
DNS Request
lrproduct.ru
-
8.8.8.8:53133.24.181.211.in-addr.arpadns
DNS Request
133.24.181.211.in-addr.arpa
-
8.8.8.8:53kggcp.comdns
DNS Request
kggcp.com
-
8.8.8.8:53talesofpirates.netdns
DNS Request
talesofpirates.net
DNS Response
104.21.1.180172.67.129.176
-
8.8.8.8:53180.1.21.104.in-addr.arpadns
DNS Request
180.1.21.104.in-addr.arpa
DNS Request
180.1.21.104.in-addr.arpa
-
8.8.8.8:5356.126.166.20.in-addr.arpadns
DNS Request
56.126.166.20.in-addr.arpa
-
8.8.8.8:53232.135.221.88.in-addr.arpadns
DNS Request
232.135.221.88.in-addr.arpa
-
8.8.8.8:53150.1.37.23.in-addr.arpadns
DNS Request
150.1.37.23.in-addr.arpa
-
8.8.8.8:53pirateking.onlinedns
DNS Request
pirateking.online
DNS Request
pirateking.online
DNS Response
172.67.180.11104.21.96.118
-
8.8.8.8:53piratia.pwdns
DNS Request
piratia.pw
DNS Response
104.21.79.117172.67.170.133
-
8.8.8.8:5311.180.67.172.in-addr.arpadns
DNS Request
11.180.67.172.in-addr.arpa
-
8.8.8.8:53117.79.21.104.in-addr.arpadns
DNS Request
117.79.21.104.in-addr.arpa
DNS Request
117.79.21.104.in-addr.arpa
-
8.8.8.8:53go-piratia.rudns
DNS Request
go-piratia.ru
DNS Response
104.21.51.101172.67.179.5
-
8.8.8.8:53101.51.21.104.in-addr.arpadns
DNS Request
101.51.21.104.in-addr.arpa
-
8.8.8.8:53186.178.17.96.in-addr.arpadns
DNS Request
186.178.17.96.in-addr.arpa
-
8.8.8.8:53205.47.74.20.in-addr.arpadns
DNS Request
205.47.74.20.in-addr.arpa
-
8.8.8.8:53100.5.17.2.in-addr.arpadns
DNS Request
100.5.17.2.in-addr.arpa
DNS Request
100.5.17.2.in-addr.arpa
-
8.8.8.8:53119.110.54.20.in-addr.arpadns
DNS Request
119.110.54.20.in-addr.arpa
-
8.8.8.8:5330.243.111.52.in-addr.arpadns
DNS Request
30.243.111.52.in-addr.arpa
-
8.8.8.8:5318.134.221.88.in-addr.arpadns
DNS Request
18.134.221.88.in-addr.arpa
-
8.8.8.8:53187.178.17.96.in-addr.arpadns
DNS Request
187.178.17.96.in-addr.arpa
-
8.8.8.8:5380.135.221.88.in-addr.arpadns
DNS Request
80.135.221.88.in-addr.arpa
DNS Request
80.135.221.88.in-addr.arpa
-
8.8.8.8:530.204.248.87.in-addr.arpadns
DNS Request
0.204.248.87.in-addr.arpa
DNS Request
0.204.248.87.in-addr.arpa
-
8.8.8.8:53dns
DNS Response
204.79.197.20013.107.21.200
-
8.8.8.8:5379.121.231.20.in-addr.arpadns
DNS Request
79.121.231.20.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
-
Filesize
3.8MB
-
Filesize
44KB
-
Filesize
1024KB
-
Filesize
3.8MB