Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
29/05/2024, 20:25 UTC
General
-
Target
81cf7488fac67047a8c2d0543b1f7973_JaffaCakes118.html
-
Size
141KB
-
MD5
81cf7488fac67047a8c2d0543b1f7973
-
SHA1
d0a52630ab073077bdd777e30873f73d28b22c6c
-
SHA256
b5d832d8c005eb897170e7860c323e58594c26d8ea1b920f8927bb4e58b0f1be
-
SHA512
14ef45be9b0214f243c54822ac2de8f9570c0b8efb3dd12e6526b1fccc3eb0d996d9e42a9feb3a0ff6ad1ba5f1b1905ed23c947033ccc673e4c9a56388f23c75
-
SSDEEP
3072:S15kAnjlAx7dyfkMY+BES09JXAnyrZalI+YQ:SVhAx7osMYod+X3oI+YQ
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
-
Suspicious use of FindShellTrayWindow 25 IoCs
-
Suspicious use of SendNotifyMessage 24 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\81cf7488fac67047a8c2d0543b1f7973_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa292946f8,0x7ffa29294708,0x7ffa292947182⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,5544770710731546169,13484760987485267493,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,5544770710731546169,13484760987485267493,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,5544770710731546169,13484760987485267493,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5544770710731546169,13484760987485267493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,5544770710731546169,13484760987485267493,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,5544770710731546169,13484760987485267493,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3052 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
-
DNS149.220.183.52.in-addr.arpaRemote address:8.8.8.8:53Request149.220.183.52.in-addr.arpaIN PTRResponse -
DNSwww.gwstkw.topRemote address:8.8.8.8:53Requestwww.gwstkw.topIN AResponse
-
DNSpush.zhanzhang.baidu.comRemote address:8.8.8.8:53Requestpush.zhanzhang.baidu.comIN AResponsepush.zhanzhang.baidu.comIN CNAMEshare.jomodns.comshare.jomodns.comIN CNAMEshare.n.shifen.comshare.n.shifen.comIN A182.61.201.93share.n.shifen.comIN A182.61.201.94share.n.shifen.comIN A182.61.244.229share.n.shifen.comIN A14.215.182.161share.n.shifen.comIN A39.156.68.163share.n.shifen.comIN A112.34.113.148share.n.shifen.comIN A163.177.17.97share.n.shifen.comIN A180.101.212.103
-
DNS73.31.126.40.in-addr.arpaRemote address:8.8.8.8:53Request73.31.126.40.in-addr.arpaIN PTRResponse
-
DNS43.43.201.23.in-addr.arpaRemote address:8.8.8.8:53Request43.43.201.23.in-addr.arpaIN PTRResponse43.43.201.23.in-addr.arpaIN PTRa23-201-43-43deploystaticakamaitechnologiescom
-
DNSbdimg.share.baidu.comRemote address:8.8.8.8:53Requestbdimg.share.baidu.comIN AResponsebdimg.share.baidu.comIN CNAMEshare.jomodns.comshare.jomodns.comIN CNAMEshare.n.shifen.comshare.n.shifen.comIN A14.215.182.161share.n.shifen.comIN A39.156.68.163share.n.shifen.comIN A112.34.113.148share.n.shifen.comIN A163.177.17.97share.n.shifen.comIN A180.101.212.103share.n.shifen.comIN A182.61.201.93share.n.shifen.comIN A182.61.201.94share.n.shifen.comIN A182.61.244.229
-
DNS232.168.11.51.in-addr.arpaRemote address:8.8.8.8:53Request232.168.11.51.in-addr.arpaIN PTRResponse
-
DNS103.169.127.40.in-addr.arpaRemote address:8.8.8.8:53Request103.169.127.40.in-addr.arpaIN PTRResponse
-
DNS171.39.242.20.in-addr.arpaRemote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
DNS57.169.31.20.in-addr.arpaRemote address:8.8.8.8:53Request57.169.31.20.in-addr.arpaIN PTRResponse
-
DNStse1.mm.bing.netRemote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239340783932_1JCHO8JLBZ4TPAX49&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239340783932_1JCHO8JLBZ4TPAX49&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 638730
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 1EF61815714D4BF0BBF18AF300B58F49 Ref B: LON04EDGE1113 Ref C: 2024-05-29T20:26:59Z
date: Wed, 29 May 2024 20:26:59 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239340783933_1QOIM48UV8MGOV4SU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239340783933_1QOIM48UV8MGOV4SU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 415458
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: E8A40F99C20749289CB19A6C8CBBBEEC Ref B: LON04EDGE1113 Ref C: 2024-05-29T20:26:59Z
date: Wed, 29 May 2024 20:26:59 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239360931610_110BPTPDN41GIXK2B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239360931610_110BPTPDN41GIXK2B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 555746
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 94C5BF840CF54CB3A871F8ECF6E3F6CA Ref B: LON04EDGE1113 Ref C: 2024-05-29T20:26:59Z
date: Wed, 29 May 2024 20:26:59 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239360931609_1JAA48IJSET6WWQHH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239360931609_1JAA48IJSET6WWQHH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 430689
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: EB75DF36404A483187468FD3CBFF5762 Ref B: LON04EDGE1113 Ref C: 2024-05-29T20:26:59Z
date: Wed, 29 May 2024 20:26:59 GMT
-
DNS31.243.111.52.in-addr.arpaRemote address:8.8.8.8:53Request31.243.111.52.in-addr.arpaIN PTRResponse
-
GEThttps://www.bing.com/th?id=OADD2.10239356736264_1E1NQW5LZ8SVSGPEK&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90Remote address:23.62.61.185:443RequestGET /th?id=OADD2.10239356736264_1E1NQW5LZ8SVSGPEK&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
host: www.bing.com
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-type: image/png
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
content-length: 999
date: Wed, 29 May 2024 20:27:29 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.9c3d3e17.1717014449.19feb5cb
-
DNS185.61.62.23.in-addr.arpaRemote address:8.8.8.8:53Request185.61.62.23.in-addr.arpaIN PTRResponse185.61.62.23.in-addr.arpaIN PTRa23-62-61-185deploystaticakamaitechnologiescom
-
182.61.201.93:80bdimg.share.baidu.com -
182.61.201.93:80bdimg.share.baidu.com
-
14.215.182.161:80bdimg.share.baidu.com
-
14.215.182.161:80bdimg.share.baidu.com
-
182.61.201.94:80bdimg.share.baidu.com
-
182.61.201.94:80bdimg.share.baidu.com
-
39.156.68.163:80bdimg.share.baidu.com
-
39.156.68.163:80bdimg.share.baidu.com
-
182.61.244.229:80bdimg.share.baidu.com
-
182.61.244.229:80bdimg.share.baidu.com
-
112.34.113.148:80bdimg.share.baidu.com
-
112.34.113.148:80bdimg.share.baidu.com
-
14.215.182.161:80bdimg.share.baidu.com
-
14.215.182.161:80bdimg.share.baidu.com
-
163.177.17.97:80bdimg.share.baidu.com
-
163.177.17.97:80bdimg.share.baidu.com
-
204.79.197.200:443tse1.mm.bing.nettls, http2
-
204.79.197.200:443tse1.mm.bing.nettls, http2
-
204.79.197.200:443https://tse1.mm.bing.net/th?id=OADD2.10239360931609_1JAA48IJSET6WWQHH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90tls, http2
HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239340783932_1JCHO8JLBZ4TPAX49&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239340783933_1QOIM48UV8MGOV4SU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239360931610_110BPTPDN41GIXK2B&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239360931609_1JAA48IJSET6WWQHH&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200 -
204.79.197.200:443tse1.mm.bing.nettls, http2
-
39.156.68.163:80bdimg.share.baidu.com
-
39.156.68.163:80bdimg.share.baidu.com
-
180.101.212.103:80bdimg.share.baidu.com
-
180.101.212.103:80bdimg.share.baidu.com
-
23.62.61.185:443https://www.bing.com/th?id=OADD2.10239356736264_1E1NQW5LZ8SVSGPEK&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90tls, http2
HTTP Request
GET https://www.bing.com/th?id=OADD2.10239356736264_1E1NQW5LZ8SVSGPEK&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90HTTP Response
200 -
112.34.113.148:80bdimg.share.baidu.com
-
112.34.113.148:80bdimg.share.baidu.com
-
182.61.201.93:80bdimg.share.baidu.com
-
182.61.201.93:80bdimg.share.baidu.com
-
163.177.17.97:80bdimg.share.baidu.com
-
163.177.17.97:80bdimg.share.baidu.com
-
182.61.201.94:80bdimg.share.baidu.com
-
182.61.201.94:80bdimg.share.baidu.com
-
180.101.212.103:80bdimg.share.baidu.com
-
180.101.212.103:80bdimg.share.baidu.com
-
182.61.244.229:80bdimg.share.baidu.com
-
182.61.244.229:80
-
8.8.8.8:53149.220.183.52.in-addr.arpadns
DNS Request
149.220.183.52.in-addr.arpa
-
8.8.8.8:53www.gwstkw.topdns
DNS Request
www.gwstkw.top
-
8.8.8.8:53push.zhanzhang.baidu.comdns
DNS Request
push.zhanzhang.baidu.com
DNS Response
182.61.201.93182.61.201.94182.61.244.22914.215.182.16139.156.68.163112.34.113.148163.177.17.97180.101.212.103
-
8.8.8.8:5373.31.126.40.in-addr.arpadns
DNS Request
73.31.126.40.in-addr.arpa
-
8.8.8.8:5343.43.201.23.in-addr.arpadns
DNS Request
43.43.201.23.in-addr.arpa
-
8.8.8.8:53bdimg.share.baidu.comdns
DNS Request
bdimg.share.baidu.com
DNS Response
14.215.182.16139.156.68.163112.34.113.148163.177.17.97180.101.212.103182.61.201.93182.61.201.94182.61.244.229
-
224.0.0.251:5353 -
8.8.8.8:53232.168.11.51.in-addr.arpadns
DNS Request
232.168.11.51.in-addr.arpa
-
8.8.8.8:53103.169.127.40.in-addr.arpadns
DNS Request
103.169.127.40.in-addr.arpa
-
8.8.8.8:53171.39.242.20.in-addr.arpadns
DNS Request
171.39.242.20.in-addr.arpa
-
8.8.8.8:5357.169.31.20.in-addr.arpadns
DNS Request
57.169.31.20.in-addr.arpa
-
8.8.8.8:53tse1.mm.bing.netdns
DNS Request
tse1.mm.bing.net
DNS Response
204.79.197.20013.107.21.200
-
8.8.8.8:5331.243.111.52.in-addr.arpadns
DNS Request
31.243.111.52.in-addr.arpa
-
8.8.8.8:53185.61.62.23.in-addr.arpadns
DNS Request
185.61.62.23.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD54b4f91fa1b362ba5341ecb2836438dea
SHA19561f5aabed742404d455da735259a2c6781fa07
SHA256d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
SHA512fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
-
Filesize
152B
MD5eaa3db555ab5bc0cb364826204aad3f0
SHA1a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA256ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
SHA512e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
-
Filesize
5KB
MD59f3b1817e1a19b554552945c32069ac6
SHA1a03b8068cebd386b86fe7164c0725cf39d0bc2f6
SHA256ce03eb32b5d401a6e8ad44e4dad48a4abeecc9a4fd039e4c9505f8f3b051b5cc
SHA512d2067d31b9b29512684e70d52c4f1c12cc9af4444b51e01b995c4ba6acdcaf1f56dab29911536fd6c3797bc197d3ebfe3b50f607468a1b6359b4dc799dcf6308
-
Filesize
6KB
MD5a65ce401c404a19ceb0215c37d842485
SHA10d64fc451b6dbad0989fa3951d058b6c85ba06fb
SHA25664683446cdfcddafd20c840101db3e4c041c9db7a54f19d0a9a675d87e428435
SHA512db3b01485aee06c8cb73f5eeffb0b0ff4d07d032952d2baa03af9789652ca46ad49bbc1121595af5ca82aeef81d092f86f102eb4895347ec59f9b18f462c927e
-
Filesize
11KB
MD5732b5c83fdebdfda28088e7119c5915a
SHA15de9c17482e3659e98a92c2633a73919afa7d69a
SHA2567837d8f207055fc74e8796845e2bdca162ad26407f7ae0c8897c95888470563d
SHA51256e4f89b160490103164dfac502d82be4ab554c08d4e9e033453404777fca304ed291b72486bbb1110f34f4f3acd8e71a1f89de8158eb87472afdc16b9e52372