Overview

overview

10

Static

static

3

084867eab2...7a.exe

windows7-x64

10

084867eab2...7a.exe

windows10-1703-x64

10

084867eab2...7a.exe

windows10-2004-x64

10

084867eab2...7a.exe

windows11-21h2-x64

10

Resubmissions

07/01/2024, 18:07 UTC

240107-wqhr9abfcn 10

15/01/2022, 08:40 UTC

220115-kkxhnsdham 10

Analysis

  • max time kernel
    146s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/01/2024, 18:07 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    084867eab2023c445721b0cd205ce47a.exe

  • Size

    419KB

  • MD5

    084867eab2023c445721b0cd205ce47a

  • SHA1

    0f465ee53425b4c9a963f6ecfe1119840fa810d7

  • SHA256

    5d9dc24f2de724f0921574f0589d39f79cbdd85cc817a6345267aa9aa9632a2b

  • SHA512

    58ec053935a7d8e2f206f3ecf76ab575dcf95736f1f23c2b8944ff4e5c31b3f6faaef20cd959a8206003c298e82770f456261a3122f815dd6347f08dd1992c3c

  • SSDEEP

    6144:pryICqvsNS64vmvH3uSlMe1DjJY4aUWXCZnMDHzfA2PjdlIJfD0:pryIC2SHhMexi48y1MDTfA2dlq

Score
10/10
gcleaneronlyloggerloader

Malware Config

Extracted

Family

gcleaner

C2

web-stat.biz

privatevolume.bi

Signatures

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger
  • OnlyLogger payload 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 7 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\084867eab2023c445721b0cd205ce47a.exe
    "C:\Users\Admin\AppData\Local\Temp\084867eab2023c445721b0cd205ce47a.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4232
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 744
      2⤵
      • Program crash
      PID:2012
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 744
      2⤵
      • Program crash
      PID:4856
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 920
      2⤵
      • Program crash
      PID:1336
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 764
      2⤵
      • Program crash
      PID:2588
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 920
      2⤵
      • Program crash
      PID:396
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 728
      2⤵
      • Program crash
      PID:1940
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im "084867eab2023c445721b0cd205ce47a.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\084867eab2023c445721b0cd205ce47a.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1200
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /im "084867eab2023c445721b0cd205ce47a.exe" /f
        3⤵
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4700
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 724
      2⤵
      • Program crash
      PID:2524
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4232 -ip 4232
    1⤵
      PID:2644
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4232 -ip 4232
      1⤵
        PID:1636
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4232 -ip 4232
        1⤵
          PID:2116
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4232 -ip 4232
          1⤵
            PID:4868
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4232 -ip 4232
            1⤵
              PID:1960
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4232 -ip 4232
              1⤵
                PID:2236
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4232 -ip 4232
                1⤵
                  PID:1148

                Network

                • flag-us
                  DNS
                  146.78.124.51.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  146.78.124.51.in-addr.arpa
                  IN PTR
                  Response
                • flag-us
                  DNS
                  146.78.124.51.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  146.78.124.51.in-addr.arpa
                  IN PTR
                • flag-us
                  DNS
                  146.78.124.51.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  146.78.124.51.in-addr.arpa
                  IN PTR
                • flag-us
                  DNS
                  67.179.17.96.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  67.179.17.96.in-addr.arpa
                  IN PTR
                  Response
                  67.179.17.96.in-addr.arpa
                  IN PTR
                  a96-17-179-67deploystaticakamaitechnologiescom
                • flag-us
                  DNS
                  67.179.17.96.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  67.179.17.96.in-addr.arpa
                  IN PTR
                • flag-us
                  DNS
                  67.179.17.96.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  67.179.17.96.in-addr.arpa
                  IN PTR
                • flag-us
                  DNS
                  19.177.190.20.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  19.177.190.20.in-addr.arpa
                  IN PTR
                  Response
                • flag-us
                  DNS
                  19.177.190.20.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  19.177.190.20.in-addr.arpa
                  IN PTR
                • flag-us
                  DNS
                  19.177.190.20.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  19.177.190.20.in-addr.arpa
                  IN PTR
                • flag-us
                  DNS
                  26.35.223.20.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  26.35.223.20.in-addr.arpa
                  IN PTR
                  Response
                • flag-us
                  DNS
                  178.223.142.52.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  178.223.142.52.in-addr.arpa
                  IN PTR
                  Response
                • flag-us
                  DNS
                  2.136.104.51.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  2.136.104.51.in-addr.arpa
                  IN PTR
                  Response
                • flag-us
                  DNS
                  157.123.68.40.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  157.123.68.40.in-addr.arpa
                  IN PTR
                  Response
                • flag-us
                  DNS
                  56.126.166.20.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  56.126.166.20.in-addr.arpa
                  IN PTR
                  Response
                • flag-us
                  DNS
                  56.126.166.20.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  56.126.166.20.in-addr.arpa
                  IN PTR
                • flag-us
                  DNS
                  217.135.221.88.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  217.135.221.88.in-addr.arpa
                  IN PTR
                  Response
                  217.135.221.88.in-addr.arpa
                  IN PTR
                  a88-221-135-217deploystaticakamaitechnologiescom
                • flag-us
                  DNS
                  61.179.17.96.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  61.179.17.96.in-addr.arpa
                  IN PTR
                  Response
                  61.179.17.96.in-addr.arpa
                  IN PTR
                  a96-17-179-61deploystaticakamaitechnologiescom
                • flag-us
                  DNS
                  31.243.111.52.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  31.243.111.52.in-addr.arpa
                  IN PTR
                  Response
                • flag-us
                  DNS
                  43.58.199.20.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  43.58.199.20.in-addr.arpa
                  IN PTR
                  Response
                • flag-us
                  DNS
                  tse1.mm.bing.net
                  Remote address:
                  8.8.8.8:53
                  Request
                  tse1.mm.bing.net
                  IN A
                  Response
                  tse1.mm.bing.net
                  IN CNAME
                  mm-mm.bing.net.trafficmanager.net
                  mm-mm.bing.net.trafficmanager.net
                  IN CNAME
                  dual-a-0001.a-msedge.net
                  dual-a-0001.a-msedge.net
                  IN A
                  204.79.197.200
                  dual-a-0001.a-msedge.net
                  IN A
                  13.107.21.200
                • flag-us
                  DNS
                  tse1.mm.bing.net
                  Remote address:
                  8.8.8.8:53
                  Request
                  tse1.mm.bing.net
                  IN A
                • flag-us
                  GET
                  https://tse1.mm.bing.net/th?id=OADD2.10239317301409_1O8VP6TH939POQOPO&pid=21.2&w=1080&h=1920&c=4
                  Remote address:
                  204.79.197.200:443
                  Request
                  GET /th?id=OADD2.10239317301409_1O8VP6TH939POQOPO&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
                  host: tse1.mm.bing.net
                  accept: */*
                  accept-encoding: gzip, deflate, br
                  user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                  Response
                  HTTP/2.0 200
                  cache-control: public, max-age=2592000
                  content-length: 301075
                  content-type: image/jpeg
                  x-cache: TCP_HIT
                  access-control-allow-origin: *
                  access-control-allow-headers: *
                  access-control-allow-methods: GET, POST, OPTIONS
                  timing-allow-origin: *
                  report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
                  nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                  accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                  x-msedge-ref: Ref A: D95A81156D4740B98A4FFABA529BA680 Ref B: LON04EDGE1213 Ref C: 2024-01-07T18:09:43Z
                  date: Sun, 07 Jan 2024 18:09:42 GMT
                • flag-us
                  GET
                  https://tse1.mm.bing.net/th?id=OADD2.10239317300976_175WPYH13KO5QTHY0&pid=21.2&w=1920&h=1080&c=4
                  Remote address:
                  204.79.197.200:443
                  Request
                  GET /th?id=OADD2.10239317300976_175WPYH13KO5QTHY0&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
                  host: tse1.mm.bing.net
                  accept: */*
                  accept-encoding: gzip, deflate, br
                  user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                  Response
                  HTTP/2.0 200
                  cache-control: public, max-age=2592000
                  content-length: 313621
                  content-type: image/jpeg
                  x-cache: TCP_HIT
                  access-control-allow-origin: *
                  access-control-allow-headers: *
                  access-control-allow-methods: GET, POST, OPTIONS
                  timing-allow-origin: *
                  report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
                  nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                  accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                  x-msedge-ref: Ref A: 7F670C22DADE48DA8E2B5CCAD0BDA2B7 Ref B: LON04EDGE1213 Ref C: 2024-01-07T18:09:43Z
                  date: Sun, 07 Jan 2024 18:09:42 GMT
                • flag-us
                  GET
                  https://tse1.mm.bing.net/th?id=OADD2.10239317301256_1KGERJE9NLTBHW1IO&pid=21.2&w=1920&h=1080&c=4
                  Remote address:
                  204.79.197.200:443
                  Request
                  GET /th?id=OADD2.10239317301256_1KGERJE9NLTBHW1IO&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
                  host: tse1.mm.bing.net
                  accept: */*
                  accept-encoding: gzip, deflate, br
                  user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                  Response
                  HTTP/2.0 200
                  cache-control: public, max-age=2592000
                  content-length: 342941
                  content-type: image/jpeg
                  x-cache: TCP_HIT
                  access-control-allow-origin: *
                  access-control-allow-headers: *
                  access-control-allow-methods: GET, POST, OPTIONS
                  timing-allow-origin: *
                  report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
                  nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
                  accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
                  x-msedge-ref: Ref A: E3723B8A98454B33BDAD7873991A121A Ref B: LON04EDGE1213 Ref C: 2024-01-07T18:09:43Z
                  date: Sun, 07 Jan 2024 18:09:42 GMT
                • flag-us
                  GET
                  https://tse1.mm.bing.net/th?id=OADD2.10239317301284_1CC0VBRXKJYE8N866&pid=21.2&w=1920&h=1080&c=4
                  Remote address:
                  204.79.197.200:443
                  Request
                  GET /th?id=OADD2.10239317301284_1CC0VBRXKJYE8N866&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
                  host: tse1.mm.bing.net
                  accept: */*
                  accept-encoding: gzip, deflate, br
                  user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                • flag-us
                  GET
                  https://tse1.mm.bing.net/th?id=OADD2.10239317301665_1S4CNP8PR7TX8NHG9&pid=21.2&w=1080&h=1920&c=4
                  Remote address:
                  204.79.197.200:443
                  Request
                  GET /th?id=OADD2.10239317301665_1S4CNP8PR7TX8NHG9&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
                  host: tse1.mm.bing.net
                  accept: */*
                  accept-encoding: gzip, deflate, br
                  user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                • flag-us
                  GET
                  https://tse1.mm.bing.net/th?id=OADD2.10239317301693_145L9YC8UIVZ76Q81&pid=21.2&w=1080&h=1920&c=4
                  Remote address:
                  204.79.197.200:443
                  Request
                  GET /th?id=OADD2.10239317301693_145L9YC8UIVZ76Q81&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
                  host: tse1.mm.bing.net
                  accept: */*
                  accept-encoding: gzip, deflate, br
                  user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
                • flag-us
                  DNS
                  200.197.79.204.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  200.197.79.204.in-addr.arpa
                  IN PTR
                  Response
                  200.197.79.204.in-addr.arpa
                  IN PTR
                  a-0001a-msedgenet
                • flag-us
                  DNS
                  200.197.79.204.in-addr.arpa
                  Remote address:
                  8.8.8.8:53
                  Request
                  200.197.79.204.in-addr.arpa
                  IN PTR
                • 204.79.197.200:443
                  tse1.mm.bing.net
                  tls, http2
                  1.2kB
                   8.3kB
                   16
                  14
                • 204.79.197.200:443
                  tse1.mm.bing.net
                  tls, http2
                  1.2kB
                   8.3kB
                   16
                  14
                • 204.79.197.200:443
                  https://tse1.mm.bing.net/th?id=OADD2.10239317301693_145L9YC8UIVZ76Q81&pid=21.2&w=1080&h=1920&c=4
                  tls, http2
                  23.6kB
                   615.7kB
                   466
                  463

                  HTTP Request

                  GET https://tse1.mm.bing.net/th?id=OADD2.10239317301409_1O8VP6TH939POQOPO&pid=21.2&w=1080&h=1920&c=4

                  HTTP Request

                  GET https://tse1.mm.bing.net/th?id=OADD2.10239317300976_175WPYH13KO5QTHY0&pid=21.2&w=1920&h=1080&c=4

                  HTTP Request

                  GET https://tse1.mm.bing.net/th?id=OADD2.10239317301256_1KGERJE9NLTBHW1IO&pid=21.2&w=1920&h=1080&c=4

                  HTTP Request

                  GET https://tse1.mm.bing.net/th?id=OADD2.10239317301284_1CC0VBRXKJYE8N866&pid=21.2&w=1920&h=1080&c=4

                  HTTP Request

                  GET https://tse1.mm.bing.net/th?id=OADD2.10239317301665_1S4CNP8PR7TX8NHG9&pid=21.2&w=1080&h=1920&c=4

                  HTTP Response

                  200

                  HTTP Response

                  200

                  HTTP Response

                  200

                  HTTP Request

                  GET https://tse1.mm.bing.net/th?id=OADD2.10239317301693_145L9YC8UIVZ76Q81&pid=21.2&w=1080&h=1920&c=4
                • 204.79.197.200:443
                  tse1.mm.bing.net
                  tls, http2
                  1.2kB
                   8.3kB
                   16
                  14
                • 204.79.197.200:443
                  tse1.mm.bing.net
                  tls, http2
                  1.3kB
                   8.4kB
                   17
                  15
                • 8.8.8.8:53
                  146.78.124.51.in-addr.arpa
                  dns
                  216 B
                   158 B
                   3
                  1

                  DNS Request

                  146.78.124.51.in-addr.arpa

                  DNS Request

                  146.78.124.51.in-addr.arpa

                  DNS Request

                  146.78.124.51.in-addr.arpa

                • 8.8.8.8:53
                  67.179.17.96.in-addr.arpa
                  dns
                  213 B
                   135 B
                   3
                  1

                  DNS Request

                  67.179.17.96.in-addr.arpa

                  DNS Request

                  67.179.17.96.in-addr.arpa

                  DNS Request

                  67.179.17.96.in-addr.arpa

                • 8.8.8.8:53
                  19.177.190.20.in-addr.arpa
                  dns
                  216 B
                   158 B
                   3
                  1

                  DNS Request

                  19.177.190.20.in-addr.arpa

                  DNS Request

                  19.177.190.20.in-addr.arpa

                  DNS Request

                  19.177.190.20.in-addr.arpa

                • 8.8.8.8:53
                  26.35.223.20.in-addr.arpa
                  dns
                  71 B
                   157 B
                   1
                  1

                  DNS Request

                  26.35.223.20.in-addr.arpa

                • 8.8.8.8:53
                  178.223.142.52.in-addr.arpa
                  dns
                  73 B
                   147 B
                   1
                  1

                  DNS Request

                  178.223.142.52.in-addr.arpa

                • 8.8.8.8:53
                  2.136.104.51.in-addr.arpa
                  dns
                  71 B
                   157 B
                   1
                  1

                  DNS Request

                  2.136.104.51.in-addr.arpa

                • 8.8.8.8:53
                  157.123.68.40.in-addr.arpa
                  dns
                  72 B
                   146 B
                   1
                  1

                  DNS Request

                  157.123.68.40.in-addr.arpa

                • 8.8.8.8:53
                  56.126.166.20.in-addr.arpa
                  dns
                  144 B
                   158 B
                   2
                  1

                  DNS Request

                  56.126.166.20.in-addr.arpa

                  DNS Request

                  56.126.166.20.in-addr.arpa

                • 8.8.8.8:53
                  217.135.221.88.in-addr.arpa
                  dns
                  73 B
                   139 B
                   1
                  1

                  DNS Request

                  217.135.221.88.in-addr.arpa

                • 8.8.8.8:53
                  61.179.17.96.in-addr.arpa
                  dns
                  71 B
                   135 B
                   1
                  1

                  DNS Request

                  61.179.17.96.in-addr.arpa

                • 8.8.8.8:53
                  31.243.111.52.in-addr.arpa
                  dns
                  72 B
                   158 B
                   1
                  1

                  DNS Request

                  31.243.111.52.in-addr.arpa

                • 8.8.8.8:53
                  43.58.199.20.in-addr.arpa
                  dns
                  71 B
                   157 B
                   1
                  1

                  DNS Request

                  43.58.199.20.in-addr.arpa

                • 8.8.8.8:53
                  tse1.mm.bing.net
                  dns
                  124 B
                   173 B
                   2
                  1

                  DNS Request

                  tse1.mm.bing.net

                  DNS Request

                  tse1.mm.bing.net

                  DNS Response

                  204.79.197.200
                  13.107.21.200

                • 8.8.8.8:53
                  200.197.79.204.in-addr.arpa
                  dns
                  146 B
                   106 B
                   2
                  1

                  DNS Request

                  200.197.79.204.in-addr.arpa

                  DNS Request

                  200.197.79.204.in-addr.arpa

                MITRE ATT&CK Enterprise v15

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • memory/4232-1-0x00000000005B0000-0x00000000006B0000-memory.dmp

                  Filesize

                  1024KB

                  Download

                • memory/4232-2-0x00000000006F0000-0x000000000073C000-memory.dmp

                  Filesize

                  304KB

                  Download

                • memory/4232-3-0x0000000000400000-0x0000000000579000-memory.dmp

                  Filesize

                  1.5MB

                  Download

                • memory/4232-4-0x0000000000400000-0x0000000000579000-memory.dmp

                  Filesize

                  1.5MB

                  Download

                • memory/4232-5-0x00000000006F0000-0x000000000073C000-memory.dmp

                  Filesize

                  304KB

                  Download

                We care about your privacy.

                This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.