Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/03/2024, 21:24 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3465b8401f4a4fdf430a1d9b290fdc5eb0b14c65e59f1a8d22d2326e6b8901cc.exe

  • Size

    2.0MB

  • MD5

    288efaa07033b852144f21b84879e7ee

  • SHA1

    b73ec50804af41d300151b01ff2b045e21151047

  • SHA256

    3465b8401f4a4fdf430a1d9b290fdc5eb0b14c65e59f1a8d22d2326e6b8901cc

  • SHA512

    51c7e2dd02418d7324670bc0a9698e801ee910397d8c7f285c38daed2df74534c978ae6fec8ae095473cf4916eccc3715c788c45d4a4216ce2c76d7ea02e8d81

  • SSDEEP

    49152:pB5LeDUUNAK0R8s7nDf5L+vpJ010HFUX20h3g/eVykcHJNs6NEx:p/LewUNAKJKDNEESK/9GNpCyE

Score
10/10
riseproevasionstealer

Malware Config

Extracted

Family

risepro

C2

193.233.132.74:58709

Signatures

  • RisePro

    RisePro stealer is an infostealer distributed by PrivateLoader.

    stealerrisepro
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\3465b8401f4a4fdf430a1d9b290fdc5eb0b14c65e59f1a8d22d2326e6b8901cc.exe
    "C:\Users\Admin\AppData\Local\Temp\3465b8401f4a4fdf430a1d9b290fdc5eb0b14c65e59f1a8d22d2326e6b8901cc.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    PID:3104

Network

  • flag-us
    DNS
    0.181.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.181.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    149.220.183.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    149.220.183.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    149.220.183.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    149.220.183.52.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    9.228.82.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    9.228.82.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    9.228.82.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    9.228.82.20.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    190.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    190.178.17.96.in-addr.arpa
    IN PTR
    Response
    190.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-190deploystaticakamaitechnologiescom
  • flag-us
    DNS
    26.35.223.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    26.35.223.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    97.17.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.17.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    86.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    86.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    41.110.16.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    41.110.16.96.in-addr.arpa
    IN PTR
    Response
    41.110.16.96.in-addr.arpa
    IN PTR
    a96-16-110-41deploystaticakamaitechnologiescom
  • flag-us
    DNS
    13.86.106.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.86.106.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    55.36.223.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    55.36.223.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    15.164.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.164.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    dual-a-0001.a-msedge.net
    dual-a-0001.a-msedge.net
    IN A
    204.79.197.200
    dual-a-0001.a-msedge.net
    IN A
    13.107.21.200
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239339388155_1D0BH5IJGCW4E5I58&pid=21.2&w=1920&h=1080&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239339388155_1D0BH5IJGCW4E5I58&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 438556
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 1FCA41DAF5E241A0BDFA41C7C2545C62 Ref B: LON04EDGE0720 Ref C: 2024-03-19T21:25:36Z
    date: Tue, 19 Mar 2024 21:25:36 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239339388156_1Z2O2J8YHL5HTDB24&pid=21.2&w=1080&h=1920&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239339388156_1Z2O2J8YHL5HTDB24&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 395332
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 6DBE54E7EDA04B11AD69463185F46AED Ref B: LON04EDGE0720 Ref C: 2024-03-19T21:25:37Z
    date: Tue, 19 Mar 2024 21:25:37 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239340418581_1PW4UWMX6DVDU64ZR&pid=21.2&w=1080&h=1920&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239340418581_1PW4UWMX6DVDU64ZR&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 174803
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 900AC54F0A5B4B7D8335CDECF633234B Ref B: LON04EDGE0720 Ref C: 2024-03-19T21:25:37Z
    date: Tue, 19 Mar 2024 21:25:37 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239340418582_18ZLZW09JZ7BHXRKX&pid=21.2&w=1920&h=1080&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239340418582_18ZLZW09JZ7BHXRKX&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 132331
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: DC2814D1B3244E28B0F86A75D1FACAD2 Ref B: LON04EDGE0720 Ref C: 2024-03-19T21:25:37Z
    date: Tue, 19 Mar 2024 21:25:37 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317300953_1D5LV5AQACOXD14DO&pid=21.2&w=1920&h=1080&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317300953_1D5LV5AQACOXD14DO&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 260013
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 6FB604A443024897A1AF01DAE463C43F Ref B: LON04EDGE0720 Ref C: 2024-03-19T21:25:37Z
    date: Tue, 19 Mar 2024 21:25:37 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301386_1ULDF9WY67KMMWR8R&pid=21.2&w=1080&h=1920&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301386_1ULDF9WY67KMMWR8R&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 237369
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 05A6B5AF8C524F429C75FEC5088144F5 Ref B: LON04EDGE0720 Ref C: 2024-03-19T21:25:43Z
    date: Tue, 19 Mar 2024 21:25:42 GMT
  • flag-us
    DNS
    200.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.197.79.204.in-addr.arpa
    IN PTR
    Response
    200.197.79.204.in-addr.arpa
    IN PTR
    a-0001a-msedgenet
  • flag-us
    DNS
    217.106.137.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.106.137.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    23.160.77.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    23.160.77.104.in-addr.arpa
    IN PTR
    Response
    23.160.77.104.in-addr.arpa
    IN PTR
    a104-77-160-23deploystaticakamaitechnologiescom
  • flag-us
    DNS
    185.13.222.173.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    185.13.222.173.in-addr.arpa
    IN PTR
    Response
    185.13.222.173.in-addr.arpa
    IN PTR
    a173-222-13-185deploystaticakamaitechnologiescom
  • flag-us
    DNS
    119.110.54.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    119.110.54.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    119.110.54.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    119.110.54.20.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    28.160.77.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.160.77.104.in-addr.arpa
    IN PTR
    Response
    28.160.77.104.in-addr.arpa
    IN PTR
    a104-77-160-28deploystaticakamaitechnologiescom
  • flag-us
    DNS
    28.160.77.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.160.77.104.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    28.160.77.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.160.77.104.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    185.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    185.178.17.96.in-addr.arpa
    IN PTR
    Response
    185.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-185deploystaticakamaitechnologiescom
  • flag-us
    DNS
    185.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    185.178.17.96.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    185.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    185.178.17.96.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    193.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    193.178.17.96.in-addr.arpa
    IN PTR
    Response
    193.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-193deploystaticakamaitechnologiescom
  • flag-us
    DNS
    193.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    193.178.17.96.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    193.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    193.178.17.96.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    181.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    181.178.17.96.in-addr.arpa
    IN PTR
    Response
    181.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-181deploystaticakamaitechnologiescom
  • flag-us
    DNS
    181.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    181.178.17.96.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    30.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    30.243.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    30.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    30.243.111.52.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    201.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    201.178.17.96.in-addr.arpa
    IN PTR
    Response
    201.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-201deploystaticakamaitechnologiescom
  • flag-us
    DNS
    201.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    201.178.17.96.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    23.173.189.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    23.173.189.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    183.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    183.178.17.96.in-addr.arpa
    IN PTR
    Response
    183.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-183deploystaticakamaitechnologiescom
  • flag-us
    DNS
    141.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    141.178.17.96.in-addr.arpa
    IN PTR
    Response
    141.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-141deploystaticakamaitechnologiescom
  • 20.231.121.79:80
    46 B
     1
  • 204.79.197.200:443
    https://tse1.mm.bing.net/th?id=OADD2.10239317301386_1ULDF9WY67KMMWR8R&pid=21.2&w=1080&h=1920&c=4
    tls, http2
    60.5kB
     1.7MB
     1259
    1249

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239339388155_1D0BH5IJGCW4E5I58&pid=21.2&w=1920&h=1080&c=4

    HTTP Response

    200

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239339388156_1Z2O2J8YHL5HTDB24&pid=21.2&w=1080&h=1920&c=4

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239340418581_1PW4UWMX6DVDU64ZR&pid=21.2&w=1080&h=1920&c=4

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239340418582_18ZLZW09JZ7BHXRKX&pid=21.2&w=1920&h=1080&c=4

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317300953_1D5LV5AQACOXD14DO&pid=21.2&w=1920&h=1080&c=4

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301386_1ULDF9WY67KMMWR8R&pid=21.2&w=1080&h=1920&c=4

    HTTP Response

    200
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.5kB
     8.0kB
     15
    11
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.6kB
     8.1kB
     18
    14
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.6kB
     8.0kB
     17
    12
  • 204.79.197.200:443
    tse1.mm.bing.net
    tls, http2
    1.6kB
     8.1kB
     18
    14
  • 8.8.8.8:53
    0.181.190.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    0.181.190.20.in-addr.arpa

  • 8.8.8.8:53
    149.220.183.52.in-addr.arpa
    dns
    146 B
     147 B
     2
    1

    DNS Request

    149.220.183.52.in-addr.arpa

    DNS Request

    149.220.183.52.in-addr.arpa

  • 8.8.8.8:53
    9.228.82.20.in-addr.arpa
    dns
    140 B
     156 B
     2
    1

    DNS Request

    9.228.82.20.in-addr.arpa

    DNS Request

    9.228.82.20.in-addr.arpa

  • 8.8.8.8:53
    190.178.17.96.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    190.178.17.96.in-addr.arpa

  • 8.8.8.8:53
    26.35.223.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    26.35.223.20.in-addr.arpa

  • 8.8.8.8:53
    97.17.167.52.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    97.17.167.52.in-addr.arpa

  • 8.8.8.8:53
    86.23.85.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    86.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    41.110.16.96.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    41.110.16.96.in-addr.arpa

  • 8.8.8.8:53
    13.86.106.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    13.86.106.20.in-addr.arpa

  • 8.8.8.8:53
    55.36.223.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    55.36.223.20.in-addr.arpa

  • 8.8.8.8:53
    15.164.165.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    15.164.165.52.in-addr.arpa

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    62 B
     173 B
     1
    1

    DNS Request

    tse1.mm.bing.net

    DNS Response

    204.79.197.200
    13.107.21.200

  • 8.8.8.8:53
    200.197.79.204.in-addr.arpa
    dns
    73 B
     106 B
     1
    1

    DNS Request

    200.197.79.204.in-addr.arpa

  • 8.8.8.8:53
    217.106.137.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    217.106.137.52.in-addr.arpa

  • 8.8.8.8:53
    23.160.77.104.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    23.160.77.104.in-addr.arpa

  • 8.8.8.8:53
    185.13.222.173.in-addr.arpa
    dns
    73 B
     139 B
     1
    1

    DNS Request

    185.13.222.173.in-addr.arpa

  • 8.8.8.8:53
    119.110.54.20.in-addr.arpa
    dns
    144 B
     158 B
     2
    1

    DNS Request

    119.110.54.20.in-addr.arpa

    DNS Request

    119.110.54.20.in-addr.arpa

  • 8.8.8.8:53
    28.160.77.104.in-addr.arpa
    dns
    216 B
     137 B
     3
    1

    DNS Request

    28.160.77.104.in-addr.arpa

    DNS Request

    28.160.77.104.in-addr.arpa

    DNS Request

    28.160.77.104.in-addr.arpa

  • 8.8.8.8:53
    185.178.17.96.in-addr.arpa
    dns
    216 B
     137 B
     3
    1

    DNS Request

    185.178.17.96.in-addr.arpa

    DNS Request

    185.178.17.96.in-addr.arpa

    DNS Request

    185.178.17.96.in-addr.arpa

  • 8.8.8.8:53
    193.178.17.96.in-addr.arpa
    dns
    216 B
     137 B
     3
    1

    DNS Request

    193.178.17.96.in-addr.arpa

    DNS Request

    193.178.17.96.in-addr.arpa

    DNS Request

    193.178.17.96.in-addr.arpa

  • 8.8.8.8:53
    181.178.17.96.in-addr.arpa
    dns
    144 B
     137 B
     2
    1

    DNS Request

    181.178.17.96.in-addr.arpa

    DNS Request

    181.178.17.96.in-addr.arpa

  • 8.8.8.8:53
    30.243.111.52.in-addr.arpa
    dns
    144 B
     158 B
     2
    1

    DNS Request

    30.243.111.52.in-addr.arpa

    DNS Request

    30.243.111.52.in-addr.arpa

  • 8.8.8.8:53
    201.178.17.96.in-addr.arpa
    dns
    144 B
     137 B
     2
    1

    DNS Request

    201.178.17.96.in-addr.arpa

    DNS Request

    201.178.17.96.in-addr.arpa

  • 8.8.8.8:53
    23.173.189.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    23.173.189.20.in-addr.arpa

  • 8.8.8.8:53
    183.178.17.96.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    183.178.17.96.in-addr.arpa

  • 8.8.8.8:53
    141.178.17.96.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    141.178.17.96.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3104-0-0x0000000000580000-0x0000000000A8B000-memory.dmp

    Filesize

    5.0MB

    Download

  • memory/3104-1-0x0000000000580000-0x0000000000A8B000-memory.dmp

    Filesize

    5.0MB

    Download

  • memory/3104-2-0x0000000000580000-0x0000000000A8B000-memory.dmp

    Filesize

    5.0MB

    Download

  • memory/3104-3-0x0000000000580000-0x0000000000A8B000-memory.dmp

    Filesize

    5.0MB

    Download

  • memory/3104-4-0x0000000000580000-0x0000000000A8B000-memory.dmp

    Filesize

    5.0MB

    Download

  • memory/3104-5-0x0000000000580000-0x0000000000A8B000-memory.dmp

    Filesize

    5.0MB

    Download

  • memory/3104-6-0x0000000000580000-0x0000000000A8B000-memory.dmp

    Filesize

    5.0MB

    Download

  • memory/3104-7-0x0000000000580000-0x0000000000A8B000-memory.dmp

    Filesize

    5.0MB

    Download

  • memory/3104-8-0x0000000000580000-0x0000000000A8B000-memory.dmp

    Filesize

    5.0MB

    Download

  • memory/3104-9-0x0000000000580000-0x0000000000A8B000-memory.dmp

    Filesize

    5.0MB

    Download

  • memory/3104-10-0x0000000000580000-0x0000000000A8B000-memory.dmp

    Filesize

    5.0MB

    Download

  • memory/3104-11-0x0000000000580000-0x0000000000A8B000-memory.dmp

    Filesize

    5.0MB

    Download

  • memory/3104-12-0x0000000000580000-0x0000000000A8B000-memory.dmp

    Filesize

    5.0MB

    Download

  • memory/3104-13-0x0000000000580000-0x0000000000A8B000-memory.dmp

    Filesize

    5.0MB

    Download

  • memory/3104-14-0x0000000000580000-0x0000000000A8B000-memory.dmp

    Filesize

    5.0MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.