Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
30/04/2024, 10:14 UTC
General
-
Target
40591b5f2e9261925f211547f9aa9d758dc78d2897634fae6828dc12194396c5.exe
-
Size
1.3MB
-
MD5
fdcabcb8be12117c4a8618d928150eec
-
SHA1
ba8de3b00b01f515a1a426281f4a2f9e45245022
-
SHA256
40591b5f2e9261925f211547f9aa9d758dc78d2897634fae6828dc12194396c5
-
SHA512
b591703fa18fff42a942ff4aa55f7f0a2156853b1c58c474d0c589b0501adbebf68a1747c7fc909a4cb43aa4a6361bb0e76bb51be24eff1e121a9edaa14f4f68
-
SSDEEP
24576:Qak/7Nk4RZGKZu0zoFmDcpii9iGn+66rLfJIgtEqPILWz8oDqE:Qak/VZu+k0WdEacJRIo+E
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 25 IoCs
-
Suspicious use of SendNotifyMessage 24 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\40591b5f2e9261925f211547f9aa9d758dc78d2897634fae6828dc12194396c5.exe"C:\Users\Admin\AppData\Local\Temp\40591b5f2e9261925f211547f9aa9d758dc78d2897634fae6828dc12194396c5.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\40591b5f2e9261925f211547f9aa9d758dc78d2897634fae6828dc12194396c5.exe"C:\Users\Admin\AppData\Local\Temp\40591b5f2e9261925f211547f9aa9d758dc78d2897634fae6828dc12194396c5.exe" Master2⤵
- Drops file in Drivers directory
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.178stu.com/my.htm3⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff5e3c46f8,0x7fff5e3c4708,0x7fff5e3c47184⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,6066170803844111880,8833341033908797615,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,6066170803844111880,8833341033908797615,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2336 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,6066170803844111880,8833341033908797615,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6066170803844111880,8833341033908797615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6066170803844111880,8833341033908797615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,6066170803844111880,8833341033908797615,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4720 /prefetch:84⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,6066170803844111880,8833341033908797615,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4720 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6066170803844111880,8833341033908797615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6066170803844111880,8833341033908797615,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6066170803844111880,8833341033908797615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6066170803844111880,8833341033908797615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3732 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6066170803844111880,8833341033908797615,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3792 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6066170803844111880,8833341033908797615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6066170803844111880,8833341033908797615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,6066170803844111880,8833341033908797615,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4976 /prefetch:24⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6066170803844111880,8833341033908797615,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3128 /prefetch:14⤵
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
-
DNSinfo.178stu.comRemote address:8.8.8.8:53Requestinfo.178stu.comIN A -
DNSinfo.178stu.comRemote address:8.8.8.8:53Requestinfo.178stu.comIN A
-
DNSinfo.178stu.comRemote address:8.8.8.8:53Requestinfo.178stu.comIN A
-
DNSinfo.178stu.comRemote address:8.8.8.8:53Requestinfo.178stu.comIN A
-
DNSinfo.178stu.comRemote address:8.8.8.8:53Requestinfo.178stu.comIN A
-
DNSwww.178stu.comRemote address:8.8.8.8:53Requestwww.178stu.comIN A
-
DNSwww.178stu.comRemote address:8.8.8.8:53Requestwww.178stu.comIN A
-
DNSwww.178stu.comRemote address:8.8.8.8:53Requestwww.178stu.comIN A
-
DNSwww.178stu.comRemote address:8.8.8.8:53Requestwww.178stu.comIN A
-
DNSwww.178stu.comRemote address:8.8.8.8:53Requestwww.178stu.comIN A
-
DNSnav.smartscreen.msiserver.lanRemote address:8.8.8.8:53Requestnav.smartscreen.msiserver.lanIN A
-
DNSnav.smartscreen.msiserver.lanRemote address:8.8.8.8:53Requestnav.smartscreen.msiserver.lanIN A
-
DNSnav.smartscreen.msiserver.lanRemote address:8.8.8.8:53Requestnav.smartscreen.msiserver.lanIN A
-
DNSnav.smartscreen.msiserver.lanRemote address:8.8.8.8:53Requestnav.smartscreen.msiserver.lanIN A
-
DNSnav.smartscreen.msiserver.lanRemote address:8.8.8.8:53Requestnav.smartscreen.msiserver.lanIN A
-
DNSarc.srv.lanRemote address:8.8.8.8:53Requestarc.srv.lanIN A
-
DNSarc.srv.lanRemote address:8.8.8.8:53Requestarc.srv.lanIN A
-
DNSarc.srv.lanRemote address:8.8.8.8:53Requestarc.srv.lanIN A
-
DNSarc.srv.lanRemote address:8.8.8.8:53Requestarc.srv.lanIN A
-
DNSarc.srv.lanRemote address:8.8.8.8:53Requestarc.srv.lanIN A
-
DNSedge.msiserver.lanRemote address:8.8.8.8:53Requestedge.msiserver.lanIN A
-
DNSedge.msiserver.lanRemote address:8.8.8.8:53Requestedge.msiserver.lanIN A
-
DNSedge.msiserver.lanRemote address:8.8.8.8:53Requestedge.msiserver.lanIN A
-
DNSedge.msiserver.lanRemote address:8.8.8.8:53Requestedge.msiserver.lanIN A
-
DNSedge.msiserver.lanRemote address:8.8.8.8:53Requestedge.msiserver.lanIN A
-
DNSntp.srv.lanRemote address:8.8.8.8:53Requestntp.srv.lanIN A
-
DNSntp.srv.lanRemote address:8.8.8.8:53Requestntp.srv.lanIN A
-
DNSntp.srv.lanRemote address:8.8.8.8:53Requestntp.srv.lanIN A
-
DNSntp.srv.lanRemote address:8.8.8.8:53Requestntp.srv.lanIN A
-
DNSntp.srv.lanRemote address:8.8.8.8:53Requestntp.srv.lanIN A
-
DNSgoogle.comRemote address:8.8.8.8:53Requestgoogle.comIN A
-
DNSgoogle.comRemote address:8.8.8.8:53Requestgoogle.comIN A
-
DNSgoogle.comRemote address:8.8.4.4:53Requestgoogle.comIN A
-
DNSwww.178stu.comRemote address:8.8.8.8:53Requestwww.178stu.comIN A
-
DNSwww.178stu.comRemote address:8.8.8.8:53Requestwww.178stu.comIN A
-
DNSwww.178stu.comRemote address:8.8.8.8:53Requestwww.178stu.comIN A
-
DNSwww.178stu.comRemote address:8.8.8.8:53Requestwww.178stu.comIN A
-
DNSwww.178stu.comRemote address:8.8.8.8:53Requestwww.178stu.comIN A
-
DNS4.4.8.8.in-addr.arpaRemote address:8.8.8.8:53Request4.4.8.8.in-addr.arpaIN PTR
-
DNS4.4.8.8.in-addr.arpaRemote address:8.8.8.8:53Request4.4.8.8.in-addr.arpaIN PTR
-
DNS4.4.8.8.in-addr.arpaRemote address:8.8.8.8:53Request4.4.8.8.in-addr.arpaIN PTR
-
DNS4.4.8.8.in-addr.arpaRemote address:8.8.8.8:53Request4.4.8.8.in-addr.arpaIN PTR
-
DNS4.4.8.8.in-addr.arpaRemote address:8.8.8.8:53Request4.4.8.8.in-addr.arpaIN PTR
-
DNSwww.178stu.comRemote address:8.8.8.8:53Requestwww.178stu.comIN A
-
DNSwww.178stu.comRemote address:8.8.8.8:53Requestwww.178stu.comIN A
-
DNSwww.178stu.comRemote address:8.8.8.8:53Requestwww.178stu.comIN A
-
DNSwww.178stu.comRemote address:8.8.8.8:53Requestwww.178stu.comIN A
-
DNSwww.178stu.comRemote address:8.8.8.8:53Requestwww.178stu.comIN A
-
DNSnav.smartscreen.msiserver.lanRemote address:8.8.8.8:53Requestnav.smartscreen.msiserver.lanIN A
-
DNSnav.smartscreen.msiserver.lanRemote address:8.8.8.8:53Requestnav.smartscreen.msiserver.lanIN A
-
DNSnav.smartscreen.msiserver.lanRemote address:8.8.8.8:53Requestnav.smartscreen.msiserver.lanIN A
-
DNSnav.smartscreen.msiserver.lanRemote address:8.8.8.8:53Requestnav.smartscreen.msiserver.lanIN A
-
DNSnav.smartscreen.msiserver.lanRemote address:8.8.8.8:53Requestnav.smartscreen.msiserver.lanIN A
-
DNSedge.msiserver.lanRemote address:8.8.8.8:53Requestedge.msiserver.lanIN A
-
DNSedge.msiserver.lanRemote address:8.8.8.8:53Requestedge.msiserver.lanIN A
-
DNSedge.msiserver.lanRemote address:8.8.8.8:53Requestedge.msiserver.lanIN A
-
DNSedge.msiserver.lanRemote address:8.8.8.8:53Requestedge.msiserver.lanIN A
-
DNSedge.msiserver.lanRemote address:8.8.8.8:53Requestedge.msiserver.lanIN A
-
DNSwww.178stu.comRemote address:8.8.8.8:53Requestwww.178stu.comIN A
-
DNSwww.178stu.comRemote address:8.8.8.8:53Requestwww.178stu.comIN A
-
DNSwww.178stu.comRemote address:8.8.8.8:53Requestwww.178stu.comIN A
-
DNSwww.178stu.comRemote address:8.8.8.8:53Requestwww.178stu.comIN A
-
DNSnav.smartscreen.msiserver.lanRemote address:8.8.8.8:53Requestnav.smartscreen.msiserver.lanIN A
-
DNSnav.smartscreen.msiserver.lanRemote address:8.8.8.8:53Requestnav.smartscreen.msiserver.lanIN A
-
DNSnav.smartscreen.msiserver.lanRemote address:8.8.8.8:53Requestnav.smartscreen.msiserver.lanIN A
No results found
-
8.8.8.8:53info.178stu.comdns
DNS Request
info.178stu.com
DNS Request
info.178stu.com
DNS Request
info.178stu.com
DNS Request
info.178stu.com
DNS Request
info.178stu.com
-
8.8.8.8:53www.178stu.comdns
DNS Request
www.178stu.com
DNS Request
www.178stu.com
DNS Request
www.178stu.com
DNS Request
www.178stu.com
DNS Request
www.178stu.com
-
8.8.8.8:53nav.smartscreen.msiserver.landns
DNS Request
nav.smartscreen.msiserver.lan
DNS Request
nav.smartscreen.msiserver.lan
DNS Request
nav.smartscreen.msiserver.lan
DNS Request
nav.smartscreen.msiserver.lan
DNS Request
nav.smartscreen.msiserver.lan
-
8.8.8.8:53arc.srv.landns
DNS Request
arc.srv.lan
DNS Request
arc.srv.lan
DNS Request
arc.srv.lan
DNS Request
arc.srv.lan
DNS Request
arc.srv.lan
-
8.8.8.8:53edge.msiserver.landns
DNS Request
edge.msiserver.lan
DNS Request
edge.msiserver.lan
DNS Request
edge.msiserver.lan
DNS Request
edge.msiserver.lan
DNS Request
edge.msiserver.lan
-
224.0.0.251:5353 -
8.8.8.8:53ntp.srv.landns
DNS Request
ntp.srv.lan
DNS Request
ntp.srv.lan
DNS Request
ntp.srv.lan
DNS Request
ntp.srv.lan
DNS Request
ntp.srv.lan
-
8.8.8.8:53google.comdns
DNS Request
google.com
-
8.8.8.8:53google.comdns
DNS Request
google.com
-
8.8.4.4:53google.comdns
DNS Request
google.com
-
8.8.8.8:53www.178stu.comdns
DNS Request
www.178stu.com
DNS Request
www.178stu.com
DNS Request
www.178stu.com
DNS Request
www.178stu.com
DNS Request
www.178stu.com
-
8.8.8.8:534.4.8.8.in-addr.arpadns
DNS Request
4.4.8.8.in-addr.arpa
DNS Request
4.4.8.8.in-addr.arpa
DNS Request
4.4.8.8.in-addr.arpa
DNS Request
4.4.8.8.in-addr.arpa
DNS Request
4.4.8.8.in-addr.arpa
-
8.8.8.8:53www.178stu.comdns
DNS Request
www.178stu.com
DNS Request
www.178stu.com
DNS Request
www.178stu.com
DNS Request
www.178stu.com
DNS Request
www.178stu.com
-
8.8.8.8:53nav.smartscreen.msiserver.landns
DNS Request
nav.smartscreen.msiserver.lan
DNS Request
nav.smartscreen.msiserver.lan
DNS Request
nav.smartscreen.msiserver.lan
DNS Request
nav.smartscreen.msiserver.lan
DNS Request
nav.smartscreen.msiserver.lan
-
8.8.8.8:53edge.msiserver.landns
DNS Request
edge.msiserver.lan
DNS Request
edge.msiserver.lan
DNS Request
edge.msiserver.lan
DNS Request
edge.msiserver.lan
DNS Request
edge.msiserver.lan
-
8.8.8.8:53www.178stu.comdns
DNS Request
www.178stu.com
DNS Request
www.178stu.com
DNS Request
www.178stu.com
DNS Request
www.178stu.com
-
8.8.8.8:53nav.smartscreen.msiserver.landns
DNS Request
nav.smartscreen.msiserver.lan
DNS Request
nav.smartscreen.msiserver.lan
DNS Request
nav.smartscreen.msiserver.lan
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD51cbd0e9a14155b7f5d4f542d09a83153
SHA127a442a921921d69743a8e4b76ff0b66016c4b76
SHA256243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c
SHA51217e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d
-
Filesize
152B
MD54e96ed67859d0bafd47d805a71041f49
SHA17806c54ae29a6c8d01dcbc78e5525ddde321b16b
SHA256bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d
SHA512432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7
-
Filesize
6KB
MD5710172551b85bcaee775262c29b0aae6
SHA18ecdee5ef1cc3457d3e75322a38b78b0179aeafc
SHA256eed49f57d0e957beba083c6fef441a6b44d2e39dfc6d159e27d516f3dc1945eb
SHA512da843b69724f81dce7cf12e096b96cd7dc10dbaba36ecfc05cd1e10ffab682db499b1c3f01130e988c0008589cd49e8f8a12960b82435f428d7e892479c77965
-
Filesize
6KB
MD5df63c5046368a857095dcf114d23e700
SHA1516bf6a170c9425ac89739b80afea8476daa958e
SHA256a278753a7d207d314eacc1ceeb8527d7c134fc51fc04b6deeb850535f52ea72a
SHA5128c3fe1ea23da1da6e5063feb899a49021e0fa979da991e039aef79eef0005ea44daf7407f6fe69bf68e8e9e93a08d18fa89c2e5ad112481df7cf569353d3b62a
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
8KB
MD572c9e67574a5710d6cc12db9b57838a1
SHA18d4680106ab8cdbb891847e54f9052d7fa5fbfec
SHA2563df812d68d2957f0f2f166f03e6c0888607fa5156b39706e0af6d68583099bd9
SHA5127fa2298f90f0d2fe9f9508937cfd523fcf0fcb5d04e027be111d683ef111dee354f2ba7f037840bf477abe27c3c86c63f5932a5c63b4080fd58c3438b85c8a99
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
4KB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
4KB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB
-
Filesize
2.6MB