Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

c780695e67...18.dll

windows7-x64

10

c780695e67...18.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/08/2024, 19:26 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c780695e67460a79b2f51ff3fe1e2b63_JaffaCakes118.dll

  • Size

    5.0MB

  • MD5

    c780695e67460a79b2f51ff3fe1e2b63

  • SHA1

    3e6971f31861aa47feba4fdc83a47b2b7a312385

  • SHA256

    7b83e2b619cf6fcc242e066415bf3631c4aa87144e0d595f118f1ee97c156a6c

  • SHA512

    efa80ffd3f6fe3dc9db97956f7a1e5fadd0f87e42bfd8516db42c4fb513677a58e321871d61f1d4dbacbcdf72b969878681dd8d46727e6b083c0b0e6117da6e3

  • SSDEEP

    98304:TDqPoBhz1aRxcSUDk36SAEdhvxWa9P593R8yAVpNZH:TDqPe1Cxcxk3ZAEUadzR8ycPZH

Score
10/10
wannacrydiscoveryransomwareworm

Malware Config

Signatures

  • Wannacry

    WannaCry is a ransomware cryptoworm.

    ransomwarewormwannacry
  • Contacts a large (3227) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Executes dropped EXE 3 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\c780695e67460a79b2f51ff3fe1e2b63_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3572
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\c780695e67460a79b2f51ff3fe1e2b63_JaffaCakes118.dll,#1
      2⤵
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3356
      • C:\WINDOWS\mssecsvc.exe
        C:\WINDOWS\mssecsvc.exe
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:1148
        • C:\WINDOWS\tasksche.exe
          C:\WINDOWS\tasksche.exe /i
          4⤵
          • Executes dropped EXE
          PID:2920
  • C:\WINDOWS\mssecsvc.exe
    C:\WINDOWS\mssecsvc.exe -m security
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Modifies data under HKEY_USERS
    PID:4052

Network

  • flag-us
    DNS
    www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    mssecsvc.exe
    Remote address:
    8.8.8.8:53
    Request
    www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    IN A
    Response
    www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    IN A
    104.16.167.228
    www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    IN A
    104.16.166.228
  • flag-us
    GET
    http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
    mssecsvc.exe
    Remote address:
    104.16.167.228:80
    Request
    GET / HTTP/1.1
    Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Wed, 28 Aug 2024 19:26:51 GMT
    Content-Type: text/html
    Content-Length: 607
    Connection: close
    Server: cloudflare
    CF-RAY: 8ba6b2020a88640a-LHR
  • flag-us
    GET
    http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
    mssecsvc.exe
    Remote address:
    104.16.167.228:80
    Request
    GET / HTTP/1.1
    Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Date: Wed, 28 Aug 2024 19:26:51 GMT
    Content-Type: text/html
    Content-Length: 607
    Connection: close
    Server: cloudflare
    CF-RAY: 8ba6b202ee394889-LHR
  • flag-us
    DNS
    228.167.16.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    228.167.16.104.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    73.144.22.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.144.22.2.in-addr.arpa
    IN PTR
    Response
    73.144.22.2.in-addr.arpa
    IN PTR
    a2-22-144-73deploystaticakamaitechnologiescom
  • flag-us
    DNS
    0.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    209.205.72.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    209.205.72.20.in-addr.arpa
    IN PTR
    Response
  • DNS
    50.23.12.20.in-addr.arpa
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
    Response
  • DNS
    198.187.3.20.in-addr.arpa
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
  • DNS
    192.142.123.92.in-addr.arpa
    Request
    192.142.123.92.in-addr.arpa
    IN PTR
    Response
    192.142.123.92.in-addr.arpa
    IN PTR
    a92-123-142-192deploystaticakamaitechnologiescom
  • DNS
    223.177.61.191.in-addr.arpa
    Request
    223.177.61.191.in-addr.arpa
    IN PTR
    Response
  • DNS
    1.177.61.191.in-addr.arpa
    Request
    1.177.61.191.in-addr.arpa
    IN PTR
    Response
  • DNS
    140.196.215.85.in-addr.arpa
    Request
    140.196.215.85.in-addr.arpa
    IN PTR
    Response
    140.196.215.85.in-addr.arpa
    IN PTR
    ip85215196140pbiaascom
  • DNS
    140.196.215.85.in-addr.arpa
    Request
    140.196.215.85.in-addr.arpa
    IN PTR
  • DNS
    2.177.61.191.in-addr.arpa
    Request
    2.177.61.191.in-addr.arpa
    IN PTR
    Response
  • DNS
    3.196.215.85.in-addr.arpa
    Request
    3.196.215.85.in-addr.arpa
    IN PTR
    Response
    3.196.215.85.in-addr.arpa
    IN PTR
    ip852151963pbiaascom
  • DNS
    4.196.215.85.in-addr.arpa
    Request
    4.196.215.85.in-addr.arpa
    IN PTR
    Response
    4.196.215.85.in-addr.arpa
    IN PTR
    ip852151964pbiaascom
  • DNS
    3.177.61.191.in-addr.arpa
    Request
    3.177.61.191.in-addr.arpa
    IN PTR
    Response
  • DNS
    4.177.61.191.in-addr.arpa
    Request
    4.177.61.191.in-addr.arpa
    IN PTR
    Response
  • DNS
    4.177.61.191.in-addr.arpa
    Request
    4.177.61.191.in-addr.arpa
    IN PTR
  • DNS
    4.177.61.191.in-addr.arpa
    Request
    4.177.61.191.in-addr.arpa
    IN PTR
  • DNS
    5.177.61.191.in-addr.arpa
    Request
    5.177.61.191.in-addr.arpa
    IN PTR
    Response
  • DNS
    8.196.215.85.in-addr.arpa
    Request
    8.196.215.85.in-addr.arpa
    IN PTR
    Response
    8.196.215.85.in-addr.arpa
    IN PTR
    ip852151968pbiaascom
  • DNS
    6.177.61.191.in-addr.arpa
    Request
    6.177.61.191.in-addr.arpa
    IN PTR
    Response
  • DNS
    17.196.215.85.in-addr.arpa
    Request
    17.196.215.85.in-addr.arpa
    IN PTR
    Response
    17.196.215.85.in-addr.arpa
    IN PTR
    ip8521519617pbiaascom
  • DNS
    7.177.61.191.in-addr.arpa
    Request
    7.177.61.191.in-addr.arpa
    IN PTR
    Response
  • DNS
    25.196.215.85.in-addr.arpa
    Request
    25.196.215.85.in-addr.arpa
    IN PTR
    Response
    25.196.215.85.in-addr.arpa
    IN PTR
    ip8521519625pbiaascom
  • DNS
    8.177.61.191.in-addr.arpa
    Request
    8.177.61.191.in-addr.arpa
    IN PTR
    Response
  • DNS
    8.177.61.191.in-addr.arpa
    Request
    8.177.61.191.in-addr.arpa
    IN PTR
  • DNS
    8.177.61.191.in-addr.arpa
    Request
    8.177.61.191.in-addr.arpa
    IN PTR
  • DNS
    29.196.215.85.in-addr.arpa
    Request
    29.196.215.85.in-addr.arpa
    IN PTR
    Response
    29.196.215.85.in-addr.arpa
    IN PTR
    ip8521519629pbiaascom
  • DNS
    26.35.223.20.in-addr.arpa
    Request
    26.35.223.20.in-addr.arpa
    IN PTR
    Response
  • DNS
    tse1.mm.bing.net
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    ax-0001.ax-msedge.net
    ax-0001.ax-msedge.net
    IN A
    150.171.27.10
    ax-0001.ax-msedge.net
    IN A
    150.171.28.10
  • GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317300924_1N7S5A2UISE5XQ4TY&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Request
    GET /th?id=OADD2.10239317300924_1N7S5A2UISE5XQ4TY&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 533708
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 70826A8BE44343C1B7301AAC8315117F Ref B: LON04EDGE0715 Ref C: 2024-08-28T19:28:52Z
    date: Wed, 28 Aug 2024 19:28:52 GMT
  • GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301463_1E0AQKX8AO4FC6HSZ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Request
    GET /th?id=OADD2.10239317301463_1E0AQKX8AO4FC6HSZ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 626306
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 79D8D815BA944A3EA27B505678EC840E Ref B: LON04EDGE0715 Ref C: 2024-08-28T19:28:52Z
    date: Wed, 28 Aug 2024 19:28:52 GMT
  • GET
    https://tse1.mm.bing.net/th?id=OADD2.10239339388072_1EV9TE4QEFANKPF6H&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Request
    GET /th?id=OADD2.10239339388072_1EV9TE4QEFANKPF6H&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 739143
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 52E8E1BC8CC0409E8700212A08FC331C Ref B: LON04EDGE0715 Ref C: 2024-08-28T19:28:52Z
    date: Wed, 28 Aug 2024 19:28:52 GMT
  • GET
    https://tse1.mm.bing.net/th?id=OADD2.10239339388073_119U9LBW9PBGDFL1U&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Request
    GET /th?id=OADD2.10239339388073_119U9LBW9PBGDFL1U&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 495209
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 0F1EA2CF1E8F4429A3AB7D989EBE55B4 Ref B: LON04EDGE0715 Ref C: 2024-08-28T19:28:52Z
    date: Wed, 28 Aug 2024 19:28:52 GMT
  • GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301030_1TE3F1N1J3L68IZAX&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Request
    GET /th?id=OADD2.10239317301030_1TE3F1N1J3L68IZAX&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 660072
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: D0D259D3FBBA4F25AF7CBBB0AEB15248 Ref B: LON04EDGE0715 Ref C: 2024-08-28T19:28:52Z
    date: Wed, 28 Aug 2024 19:28:52 GMT
  • DNS
    33.196.215.85.in-addr.arpa
    Request
    33.196.215.85.in-addr.arpa
    IN PTR
    Response
    33.196.215.85.in-addr.arpa
    IN PTR
    ip8521519633pbiaascom
  • DNS
    9.177.61.191.in-addr.arpa
    Request
    9.177.61.191.in-addr.arpa
    IN PTR
    Response
  • DNS
    9.177.61.191.in-addr.arpa
    Request
    9.177.61.191.in-addr.arpa
    IN PTR
  • DNS
    37.196.215.85.in-addr.arpa
    Request
    37.196.215.85.in-addr.arpa
    IN PTR
    Response
    37.196.215.85.in-addr.arpa
    IN PTR
    ip8521519637pbiaascom
  • DNS
    10.177.61.191.in-addr.arpa
    Request
    10.177.61.191.in-addr.arpa
    IN PTR
    Response
  • DNS
    10.177.61.191.in-addr.arpa
    Request
    10.177.61.191.in-addr.arpa
    IN PTR
  • DNS
    11.177.61.191.in-addr.arpa
    Request
    11.177.61.191.in-addr.arpa
    IN PTR
  • DNS
    11.177.61.191.in-addr.arpa
    Request
    11.177.61.191.in-addr.arpa
    IN PTR
  • DNS
    11.177.61.191.in-addr.arpa
    Request
    11.177.61.191.in-addr.arpa
    IN PTR
  • 104.16.167.228:80
    http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
    http
    mssecsvc.exe
    376 B
     990 B
     6
    5

    HTTP Request

    GET http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/

    HTTP Response

    200
  • 104.16.167.228:80
    http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/
    http
    mssecsvc.exe
    376 B
     990 B
     6
    5

    HTTP Request

    GET http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/

    HTTP Response

    200
  • 85.80.35.138:445
    mssecsvc.exe
    104 B
     2
  • 10.127.0.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.3.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.6.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.1.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.2.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.7.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.4.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.5.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.9.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.8.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.11.1:445
    mssecsvc.exe
    104 B
     2
  • 161.250.121.220:445
    mssecsvc.exe
    104 B
     2
  • 10.127.10.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.13.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.12.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.14.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.15.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.16.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.17.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.18.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.19.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.20.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.21.1:445
    mssecsvc.exe
    104 B
     2
  • 28.78.42.82:445
    mssecsvc.exe
    104 B
     2
  • 10.127.22.1:445
    mssecsvc.exe
    104 B
     2
  • 88.9.164.78:445
    mssecsvc.exe
    52 B
     1
  • 10.127.23.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.27.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.29.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.25.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.24.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.30.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.26.1:445
    mssecsvc.exe
    52 B
     1
  • 213.21.60.214:445
    mssecsvc.exe
    52 B
     1
  • 10.127.28.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.31.1:445
    mssecsvc.exe
    104 B
     2
  • 188.188.106.2:445
    mssecsvc.exe
    52 B
     1
  • 10.127.32.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.33.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.34.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.35.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.36.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.37.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.38.1:445
    mssecsvc.exe
    104 B
     2
  • 173.83.28.36:445
    mssecsvc.exe
    52 B
     1
  • 176.166.55.118:445
    mssecsvc.exe
    104 B
     2
  • 10.127.40.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.39.1:445
    mssecsvc.exe
    104 B
     2
  • 65.36.154.69:445
    mssecsvc.exe
    104 B
     2
  • 10.127.41.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.42.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.43.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.47.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.44.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.46.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.50.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.48.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.51.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.45.1:445
    mssecsvc.exe
    104 B
     2
  • 89.48.137.19:445
    mssecsvc.exe
    104 B
     2
  • 10.127.49.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.53.1:445
    mssecsvc.exe
    104 B
     2
  • 162.0.91.14:445
    mssecsvc.exe
    52 B
     1
  • 10.127.52.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.54.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.55.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.56.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.57.1:445
    mssecsvc.exe
    52 B
     1
  • 77.199.13.177:445
    mssecsvc.exe
    104 B
     2
  • 10.127.58.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.59.1:445
    mssecsvc.exe
    52 B
     1
  • 148.91.206.4:445
    mssecsvc.exe
    104 B
     2
  • 10.127.60.1:445
    mssecsvc.exe
    104 B
     2
  • 22.69.109.72:445
    mssecsvc.exe
    52 B
     1
  • 10.127.61.1:445
    mssecsvc.exe
    104 B
     2
  • 55.153.61.122:445
    mssecsvc.exe
    104 B
     2
  • 10.127.65.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.63.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.68.1:445
    mssecsvc.exe
    104 B
     2
  • 91.84.201.33:445
    mssecsvc.exe
    52 B
     1
  • 10.127.69.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.62.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.64.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.66.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.71.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.67.1:445
    mssecsvc.exe
    104 B
     2
  • 83.163.31.146:445
    mssecsvc.exe
    104 B
     2
  • 180.161.147.34:445
    mssecsvc.exe
    104 B
     2
  • 10.127.70.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.74.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.72.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.73.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.75.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.76.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.77.1:445
    mssecsvc.exe
    52 B
     1
  • 74.157.35.21:445
    mssecsvc.exe
    104 B
     2
  • 10.127.78.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.79.1:445
    mssecsvc.exe
    104 B
     2
  • 50.186.123.214:445
    mssecsvc.exe
    104 B
     2
  • 10.127.80.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.81.1:445
    mssecsvc.exe
    104 B
     2
  • 94.176.108.233:445
    mssecsvc.exe
    104 B
     2
  • 213.6.55.246:445
    mssecsvc.exe
    52 B
     1
  • 202.132.187.10:445
    mssecsvc.exe
    104 B
     2
  • 10.127.86.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.82.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.84.1:445
    mssecsvc.exe
    104 B
     2
  • 151.223.141.186:445
    mssecsvc.exe
    52 B
     1
  • 10.127.83.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.91.1:445
    mssecsvc.exe
    52 B
     1
  • 12.192.177.220:445
    mssecsvc.exe
    104 B
     2
  • 10.127.89.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.90.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.85.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.88.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.92.1:445
    mssecsvc.exe
    104 B
     2
  • 192.135.34.152:445
    mssecsvc.exe
    104 B
     2
  • 10.127.87.1:445
    mssecsvc.exe
    52 B
     1
  • 2.250.254.94:445
    mssecsvc.exe
    104 B
     2
  • 10.127.94.1:445
    mssecsvc.exe
    104 B
     2
  • 68.170.54.202:445
    mssecsvc.exe
    104 B
     2
  • 10.127.93.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.95.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.96.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.97.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.98.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.99.1:445
    mssecsvc.exe
    104 B
     2
  • 36.242.245.79:445
    mssecsvc.exe
    104 B
     2
  • 10.127.102.1:445
    mssecsvc.exe
    104 B
     2
  • 138.56.207.141:445
    mssecsvc.exe
    104 B
     2
  • 71.191.121.181:445
    mssecsvc.exe
    104 B
     2
  • 10.127.104.1:445
    mssecsvc.exe
    52 B
     1
  • 141.114.159.147:445
    mssecsvc.exe
    104 B
     2
  • 10.127.100.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.103.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.101.1:445
    mssecsvc.exe
    104 B
     2
  • 41.238.204.219:445
    mssecsvc.exe
    104 B
     2
  • 151.7.232.130:445
    mssecsvc.exe
    52 B
     1
  • 10.127.105.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.109.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.111.1:445
    mssecsvc.exe
    104 B
     2
  • 90.154.71.107:445
    mssecsvc.exe
    52 B
     1
  • 10.127.108.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.107.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.112.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.106.1:445
    mssecsvc.exe
    104 B
     2
  • 150.143.225.70:445
    mssecsvc.exe
    104 B
     2
  • 16.170.95.49:445
    mssecsvc.exe
    104 B
     80 B
     2
    2
  • 10.127.110.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.114.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.113.1:445
    mssecsvc.exe
    52 B
     1
  • 22.41.21.126:445
    mssecsvc.exe
    104 B
     2
  • 54.85.76.54:445
    mssecsvc.exe
    104 B
     2
  • 10.127.115.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.116.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.117.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.118.1:445
    mssecsvc.exe
    104 B
     2
  • 63.212.60.101:445
    mssecsvc.exe
    104 B
     2
  • 10.127.121.1:445
    mssecsvc.exe
    104 B
     2
  • 126.184.146.205:445
    mssecsvc.exe
    104 B
     2
  • 10.127.123.1:445
    mssecsvc.exe
    52 B
     1
  • 101.121.217.155:445
    mssecsvc.exe
    104 B
     2
  • 10.127.119.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.122.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.125.1:445
    mssecsvc.exe
    52 B
     1
  • 125.68.186.242:445
    mssecsvc.exe
    52 B
     1
  • 55.10.116.86:445
    mssecsvc.exe
    52 B
     1
  • 10.127.120.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.126.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.124.1:445
    mssecsvc.exe
    104 B
     2
  • 163.220.94.108:445
    mssecsvc.exe
    52 B
     1
  • 213.177.46.150:445
    mssecsvc.exe
    104 B
     2
  • 128.225.81.70:445
    mssecsvc.exe
    52 B
     1
  • 10.127.127.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.131.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.130.1:445
    mssecsvc.exe
    52 B
     1
  • 31.82.52.18:445
    mssecsvc.exe
    104 B
     2
  • 196.4.212.19:445
    mssecsvc.exe
    104 B
     2
  • 10.127.128.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.135.1:445
    mssecsvc.exe
    104 B
     2
  • 132.211.94.214:445
    mssecsvc.exe
    52 B
     1
  • 156.8.196.134:445
    mssecsvc.exe
    104 B
     2
  • 10.127.132.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.129.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.133.1:445
    mssecsvc.exe
    104 B
     2
  • 55.127.110.176:445
    mssecsvc.exe
    104 B
     2
  • 10.127.134.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.136.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.137.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.138.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.139.1:445
    mssecsvc.exe
    104 B
     2
  • 71.3.26.17:445
    mssecsvc.exe
    52 B
     1
  • 194.10.134.56:445
    mssecsvc.exe
    104 B
     2
  • 8.133.18.25:445
    mssecsvc.exe
    52 B
     1
  • 10.127.144.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.140.1:445
    mssecsvc.exe
    52 B
     1
  • 145.178.7.119:445
    mssecsvc.exe
    104 B
     2
  • 146.62.233.19:445
    mssecsvc.exe
    104 B
     2
  • 10.127.148.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.142.1:445
    mssecsvc.exe
    104 B
     2
  • 33.104.167.60:445
    mssecsvc.exe
    104 B
     2
  • 47.238.8.94:445
    mssecsvc.exe
    104 B
     2
  • 10.127.143.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.141.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.146.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.145.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.147.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.149.1:445
    mssecsvc.exe
    52 B
     1
  • 149.210.186.128:445
    mssecsvc.exe
    52 B
     1
  • 10.127.150.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.151.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.152.1:445
    mssecsvc.exe
    104 B
     2
  • 77.136.170.211:445
    mssecsvc.exe
    52 B
     1
  • 10.127.153.1:445
    mssecsvc.exe
    52 B
     1
  • 78.5.21.161:445
    mssecsvc.exe
    104 B
     2
  • 71.65.151.131:445
    mssecsvc.exe
    104 B
     2
  • 10.127.154.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.155.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.156.1:445
    mssecsvc.exe
    104 B
     2
  • 36.29.164.139:445
    mssecsvc.exe
    52 B
     1
  • 10.127.157.1:445
    mssecsvc.exe
    104 B
     2
  • 117.215.138.25:445
    mssecsvc.exe
    52 B
     1
  • 10.127.158.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.159.1:445
    mssecsvc.exe
    52 B
     1
  • 61.134.130.160:445
    mssecsvc.exe
    104 B
     2
  • 133.59.150.175:445
    mssecsvc.exe
    104 B
     2
  • 10.127.160.1:445
    mssecsvc.exe
    52 B
     1
  • 150.93.38.242:445
    mssecsvc.exe
    52 B
     1
  • 10.127.161.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.162.1:445
    mssecsvc.exe
    104 B
     2
  • 30.226.138.63:445
    mssecsvc.exe
    104 B
     2
  • 10.127.163.1:445
    mssecsvc.exe
    104 B
     2
  • 112.81.103.178:445
    mssecsvc.exe
    104 B
     2
  • 93.85.71.162:445
    mssecsvc.exe
    104 B
     2
  • 186.166.177.18:445
    mssecsvc.exe
    104 B
     2
  • 81.74.251.54:445
    mssecsvc.exe
    52 B
     1
  • 45.151.169.167:445
    mssecsvc.exe
    52 B
     1
  • 10.127.164.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.165.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.166.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.167.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.168.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.169.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.170.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.171.1:445
    mssecsvc.exe
    52 B
     1
  • 48.65.153.130:445
    mssecsvc.exe
    104 B
     2
  • 47.165.153.91:445
    mssecsvc.exe
    52 B
     1
  • 10.127.172.1:445
    mssecsvc.exe
    52 B
     1
  • 111.63.205.99:445
    mssecsvc.exe
    52 B
     1
  • 10.127.173.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.174.1:445
    mssecsvc.exe
    52 B
     1
  • 201.111.131.52:445
    mssecsvc.exe
    104 B
     2
  • 68.163.224.165:445
    mssecsvc.exe
    104 B
     2
  • 10.127.175.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.176.1:445
    mssecsvc.exe
    104 B
     2
  • 44.168.43.91:445
    mssecsvc.exe
    104 B
     2
  • 10.127.177.1:445
    mssecsvc.exe
    104 B
     2
  • 60.233.205.90:445
    mssecsvc.exe
    104 B
     2
  • 10.127.178.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.179.1:445
    mssecsvc.exe
    104 B
     2
  • 74.171.135.149:445
    mssecsvc.exe
    104 B
     2
  • 10.127.180.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.181.1:445
    mssecsvc.exe
    52 B
     1
  • 139.218.116.130:445
    mssecsvc.exe
    104 B
     2
  • 10.127.182.1:445
    mssecsvc.exe
    104 B
     2
  • 107.11.225.205:445
    mssecsvc.exe
    104 B
     2
  • 10.127.183.1:445
    mssecsvc.exe
    104 B
     2
  • 125.157.24.59:445
    mssecsvc.exe
    104 B
     2
  • 1.61.29.96:445
    mssecsvc.exe
    104 B
     2
  • 10.127.185.1:445
    mssecsvc.exe
    52 B
     1
  • 95.69.104.127:445
    mssecsvc.exe
    104 B
     2
  • 128.223.123.57:445
    mssecsvc.exe
    52 B
     1
  • 10.127.184.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.187.1:445
    mssecsvc.exe
    104 B
     2
  • 213.119.175.48:445
    mssecsvc.exe
    52 B
     1
  • 86.158.248.0:445
    mssecsvc.exe
    104 B
     2
  • 10.127.186.1:445
    mssecsvc.exe
    52 B
     1
  • 12.157.65.133:445
    mssecsvc.exe
    104 B
     2
  • 10.127.188.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.189.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.190.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.191.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.192.1:445
    mssecsvc.exe
    104 B
     2
  • 82.118.112.140:445
    mssecsvc.exe
    104 B
     2
  • 10.127.193.1:445
    mssecsvc.exe
    104 B
     2
  • 20.127.8.96:445
    mssecsvc.exe
    104 B
     2
  • 26.234.26.165:445
    mssecsvc.exe
    104 B
     2
  • 10.127.194.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.195.1:445
    mssecsvc.exe
    104 B
     2
  • 118.40.136.101:445
    mssecsvc.exe
    104 B
     2
  • 163.78.191.246:445
    mssecsvc.exe
    104 B
     2
  • 10.127.196.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.197.1:445
    mssecsvc.exe
    104 B
     2
  • 11.92.213.24:445
    mssecsvc.exe
    104 B
     2
  • 26.200.135.160:445
    mssecsvc.exe
    104 B
     2
  • 10.127.198.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.199.1:445
    mssecsvc.exe
    104 B
     2
  • 174.78.103.221:445
    mssecsvc.exe
    52 B
     1
  • 10.127.200.1:445
    mssecsvc.exe
    104 B
     2
  • 94.180.150.57:445
    mssecsvc.exe
    104 B
     2
  • 181.129.177.5:445
    mssecsvc.exe
    104 B
     80 B
     2
    2
  • 10.127.201.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.203.1:445
    mssecsvc.exe
    52 B
     1
  • 80.59.234.72:445
    mssecsvc.exe
    52 B
     1
  • 110.38.35.204:445
    mssecsvc.exe
    52 B
     1
  • 120.169.211.106:445
    mssecsvc.exe
    104 B
     2
  • 131.90.16.113:445
    mssecsvc.exe
    52 B
     1
  • 76.221.209.40:445
    mssecsvc.exe
    52 B
     1
  • 10.127.204.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.202.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.205.1:445
    mssecsvc.exe
    104 B
     2
  • 213.228.56.45:445
    mssecsvc.exe
    52 B
     1
  • 122.155.43.187:445
    mssecsvc.exe
    52 B
     1
  • 10.127.207.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.206.1:445
    mssecsvc.exe
    52 B
     1
  • 106.35.103.180:445
    mssecsvc.exe
    52 B
     1
  • 176.130.245.222:445
    mssecsvc.exe
    104 B
     2
  • 10.127.210.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.208.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.209.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.211.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.212.1:445
    mssecsvc.exe
    104 B
     2
  • 215.129.198.192:445
    mssecsvc.exe
    104 B
     2
  • 10.127.213.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.214.1:445
    mssecsvc.exe
    104 B
     2
  • 58.112.104.224:445
    mssecsvc.exe
    104 B
     2
  • 10.127.215.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.216.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.217.1:445
    mssecsvc.exe
    104 B
     2
  • 88.188.138.243:445
    mssecsvc.exe
    104 B
     2
  • 147.66.199.26:445
    mssecsvc.exe
    104 B
     2
  • 141.134.43.155:445
    mssecsvc.exe
    104 B
     2
  • 10.127.218.1:445
    mssecsvc.exe
    104 B
     2
  • 162.36.41.193:445
    mssecsvc.exe
    52 B
     1
  • 111.129.234.203:445
    mssecsvc.exe
    52 B
     1
  • 10.127.219.1:445
    mssecsvc.exe
    104 B
     2
  • 81.169.136.51:445
    mssecsvc.exe
    104 B
     80 B
     2
    2
  • 66.209.238.228:445
    mssecsvc.exe
    104 B
     2
  • 10.127.220.1:445
    mssecsvc.exe
    104 B
     2
  • 22.7.94.105:445
    mssecsvc.exe
    104 B
     2
  • 142.206.131.57:445
    mssecsvc.exe
    52 B
     1
  • 148.57.188.225:445
    mssecsvc.exe
    104 B
     2
  • 133.6.54.80:445
    mssecsvc.exe
    104 B
     2
  • 29.208.104.0:445
    mssecsvc.exe
    104 B
     2
  • 10.127.221.1:445
    mssecsvc.exe
    52 B
     1
  • 175.106.229.190:445
    mssecsvc.exe
    52 B
     1
  • 181.229.24.216:445
    mssecsvc.exe
    104 B
     2
  • 211.106.35.94:445
    mssecsvc.exe
    52 B
     1
  • 10.127.228.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.225.1:445
    mssecsvc.exe
    52 B
     1
  • 118.86.75.192:445
    mssecsvc.exe
    104 B
     2
  • 37.229.97.50:445
    mssecsvc.exe
    52 B
     1
  • 10.127.229.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.227.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.226.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.223.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.222.1:445
    mssecsvc.exe
    52 B
     1
  • 223.80.251.189:445
    mssecsvc.exe
    104 B
     2
  • 64.66.171.88:445
    mssecsvc.exe
    104 B
     2
  • 10.127.230.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.224.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.231.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.232.1:445
    mssecsvc.exe
    52 B
     1
  • 88.116.121.238:445
    mssecsvc.exe
    104 B
     2
  • 113.84.185.222:445
    mssecsvc.exe
    52 B
     1
  • 10.127.233.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.234.1:445
    mssecsvc.exe
    104 B
     2
  • 95.47.97.101:445
    mssecsvc.exe
    52 B
     1
  • 10.127.235.1:445
    mssecsvc.exe
    104 B
     2
  • 139.191.199.126:445
    mssecsvc.exe
    104 B
     2
  • 6.7.58.180:445
    mssecsvc.exe
    52 B
     1
  • 10.127.236.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.237.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.238.1:445
    mssecsvc.exe
    104 B
     2
  • 126.66.129.65:445
    mssecsvc.exe
    104 B
     2
  • 104.156.55.229:445
    mssecsvc.exe
    104 B
     2
  • 185.192.157.183:445
    mssecsvc.exe
    104 B
     2
  • 10.127.239.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.240.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.241.1:445
    mssecsvc.exe
    52 B
     1
  • 12.201.50.173:445
    mssecsvc.exe
    104 B
     2
  • 115.242.84.213:445
    mssecsvc.exe
    104 B
     2
  • 10.127.242.1:445
    mssecsvc.exe
    104 B
     2
  • 214.145.114.219:445
    mssecsvc.exe
    104 B
     2
  • 52.173.140.15:445
    mssecsvc.exe
    104 B
     2
  • 72.139.119.54:445
    mssecsvc.exe
    104 B
     2
  • 3.13.186.39:445
    mssecsvc.exe
    104 B
     2
  • 8.96.151.178:445
    mssecsvc.exe
    104 B
     2
  • 10.127.243.1:445
    mssecsvc.exe
    104 B
     2
  • 204.191.236.18:445
    mssecsvc.exe
    104 B
     2
  • 38.110.131.32:445
    mssecsvc.exe
    104 B
     2
  • 46.38.185.218:445
    mssecsvc.exe
    104 B
     2
  • 10.127.244.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.248.1:445
    mssecsvc.exe
    104 B
     2
  • 57.89.170.205:445
    mssecsvc.exe
    104 B
     2
  • 27.223.94.42:445
    mssecsvc.exe
    104 B
     2
  • 132.176.165.49:445
    mssecsvc.exe
    104 B
     2
  • 10.127.249.1:445
    mssecsvc.exe
    104 B
     2
  • 48.226.42.45:445
    mssecsvc.exe
    52 B
     1
  • 67.218.114.97:445
    mssecsvc.exe
    52 B
     1
  • 10.127.250.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.245.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.246.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.247.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.251.1:445
    mssecsvc.exe
    52 B
     1
  • 10.127.252.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.253.1:445
    mssecsvc.exe
    104 B
     2
  • 83.18.79.48:445
    mssecsvc.exe
    104 B
     2
  • 213.252.152.56:445
    mssecsvc.exe
    104 B
     2
  • 10.127.254.1:445
    mssecsvc.exe
    104 B
     2
  • 10.127.255.1:445
    mssecsvc.exe
    52 B
     1
  • 214.143.121.166:445
    mssecsvc.exe
    104 B
     2
  • 35.126.202.214:445
    mssecsvc.exe
    104 B
     2
  • 51.181.254.163:445
    mssecsvc.exe
    52 B
     1
  • 10.127.0.2:445
    mssecsvc.exe
    52 B
     1
  • 10.127.1.2:445
    mssecsvc.exe
    52 B
     1
  • 74.18.243.11:445
    mssecsvc.exe
    52 B
     1
  • 212.70.170.138:445
    mssecsvc.exe
    52 B
     1
  • 133.153.179.118:445
    mssecsvc.exe
    52 B
     1
  • 10.127.2.2:445
    mssecsvc.exe
    52 B
     1
  • 10.127.3.2:445
    mssecsvc.exe
    52 B
     1
  • 10.127.4.2:445
    mssecsvc.exe
    104 B
     2
  • 72.53.45.71:445
    mssecsvc.exe
    52 B
     1
  • 6.136.47.103:445
    mssecsvc.exe
    52 B
     1
  • 32.165.154.176:445
    mssecsvc.exe
    104 B
     2
  • 24.130.22.125:445
    mssecsvc.exe
    104 B
     2
  • 84.235.57.165:445
    mssecsvc.exe
    104 B
     2
  • 35.67.194.247:445
    mssecsvc.exe
    52 B
     1
  • 203.152.225.143:445
    mssecsvc.exe
    52 B
     1
  • 112.242.110.92:445
    mssecsvc.exe
    104 B
     2
  • 10.127.8.2:445
    mssecsvc.exe
    52 B
     1
  • 77.115.109.248:445
    mssecsvc.exe
    104 B
     2
  • 182.209.179.150:445
    mssecsvc.exe
    104 B
     2
  • 50.175.223.74:445
    mssecsvc.exe
    52 B
     1
  • 10.127.12.2:445
    mssecsvc.exe
    52 B
     1
  • 10.127.11.2:445
    mssecsvc.exe
    104 B
     2
  • 26.222.210.254:445
    mssecsvc.exe
    104 B
     2
  • 81.20.37.253:445
    mssecsvc.exe
    104 B
     2
  • 118.96.67.49:445
    mssecsvc.exe
    104 B
     80 B
     2
    2
  • 10.127.9.2:445
    mssecsvc.exe
    104 B
     2
  • 10.127.10.2:445
    mssecsvc.exe
    104 B
     2
  • 10.127.15.2:445
    mssecsvc.exe
    104 B
     2
  • 10.127.6.2:445
    mssecsvc.exe
    52 B
     1
  • 11.155.87.242:445
    mssecsvc.exe
    104 B
     2
  • 63.215.200.54:445
    mssecsvc.exe
    104 B
     2
  • 104.9.31.74:445
    mssecsvc.exe
    104 B
     2
  • 10.127.5.2:445
    mssecsvc.exe
    52 B
     1
  • 10.127.16.2:445
    mssecsvc.exe
    104 B
     2
  • 10.127.7.2:445
    mssecsvc.exe
    52 B
     1
  • 10.127.13.2:445
    mssecsvc.exe
    104 B
     2
  • 10.127.14.2:445
    mssecsvc.exe
    104 B
     2
  • 10.127.17.2:445
    mssecsvc.exe
    104 B
     2
  • 10.127.18.2:445
    mssecsvc.exe
    104 B
     2
  • 27.175.53.90:445
    mssecsvc.exe
    104 B
     2
  • 145.193.17.229:445
    mssecsvc.exe
    104 B
     2
  • 10.127.19.2:445
    mssecsvc.exe
    104 B
     2
  • 29.211.152.245:445
    mssecsvc.exe
    104 B
     2
  • 218.57.240.41:445
    mssecsvc.exe
    104 B
     2
  • 121.167.69.108:445
    mssecsvc.exe
    52 B
     1
  • 10.127.20.2:445
    mssecsvc.exe
    104 B
     2
  • 10.127.21.2:445
    mssecsvc.exe
    52 B
     1
  • 10.127.22.2:445
    mssecsvc.exe
    104 B
     2
  • 186.136.136.45:445
    mssecsvc.exe
    104 B
     2
  • 4.152.112.163:445
    mssecsvc.exe
    104 B
     2
  • 123.163.5.22:445
    mssecsvc.exe
    104 B
     2
  • 10.127.23.2:445
    mssecsvc.exe
    104 B
     2
  • 10.127.24.2:445
    mssecsvc.exe
    52 B
     1
  • 77.114.147.195:445
    mssecsvc.exe
    104 B
     2
  • 136.95.248.138:445
    mssecsvc.exe
    52 B
     1
  • 140.181.162.111:445
    mssecsvc.exe
    52 B
     1
  • 59.172.7.12:445
    mssecsvc.exe
    104 B
     2
  • 24.236.71.8:445
    mssecsvc.exe
    104 B
     2
  • 23.193.227.147:445
    mssecsvc.exe
    104 B
     2
  • 95.204.170.149:445
    mssecsvc.exe
    104 B
     2
  • 35.157.3.27:445
    mssecsvc.exe
    52 B
     1
  • 10.127.29.2:445
    mssecsvc.exe
    104 B
     2
  • 52.31.182.51:445
    mssecsvc.exe
    104 B
     2
  • 10.127.27.2:445
    mssecsvc.exe
    104 B
     2
  • 10.127.25.2:445
    mssecsvc.exe
    52 B
     1
  • 10.127.26.2:445
    mssecsvc.exe
    52 B
     1
  • 4.129.196.182:445
    mssecsvc.exe
    104 B
     2
  • 124.157.144.172:445
    mssecsvc.exe
    104 B
     2
  • 10.127.31.2:445
    mssecsvc.exe
    104 B
     2
  • 82.203.83.74:445
    mssecsvc.exe
    104 B
     2
  • 10.127.33.2:445
    mssecsvc.exe
    104 B
     2
  • 85.134.166.1:445
    mssecsvc.exe
    52 B
     1
  • 157.175.5.108:445
    mssecsvc.exe
    52 B
     1
  • 151.199.217.251:445
    mssecsvc.exe
    52 B
     1
  • 10.127.28.2:445
    mssecsvc.exe
    104 B
     2
  • 37.29.183.80:445
    mssecsvc.exe
    104 B
     2
  • 8.8.8.8:53
    www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
    dns
    mssecsvc.exe
    95 B
     127 B
     1
    1

    DNS Request

    www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com

    DNS Response

    104.16.167.228
    104.16.166.228

  • 8.8.8.8:53
    228.167.16.104.in-addr.arpa
    dns
    73 B
     135 B
     1
    1

    DNS Request

    228.167.16.104.in-addr.arpa

  • 8.8.8.8:53
    28.118.140.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    28.118.140.52.in-addr.arpa

  • 8.8.8.8:53
    73.144.22.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    73.144.22.2.in-addr.arpa

  • 8.8.8.8:53
    0.159.190.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    0.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    209.205.72.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    209.205.72.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\mssecsvc.exe
    Filesize

    3.6MB

    MD5

    a3a851e54f411362285a07a4f6fa9f3e

    SHA1

    059d56add1505a6944e4d9897a7c1ea72481f917

    SHA256

    84569284fba295f43f677b85835c7cc9b262f1bceee24ee8a243cd6c1fa97edd

    SHA512

    c750dee59ec845f15dcbe4bc97a972a7902674088a73ae96cdc32e8f75ac2dc31f1881760de09985c3f7acdb78e58abbe9bf87a79655b5ee1b932c85d876f2f1

    Download Submit

  • C:\Windows\tasksche.exe
    Filesize

    3.4MB

    MD5

    61008c022798d82b5feb2999cebd47fc

    SHA1

    d96a1dff1f6713d5d043a2d924324369cfbf10b4

    SHA256

    22391324f6b59aa7162b755428c43a3224c574f1bb4e447997448d082a887081

    SHA512

    8010bf1393617a9aa86f45b1c44f42f0c7fd8cd241419cff7c7e9c5a0e5da54e677842cd818be3965f9dbb2f53b3a4b65a25c53d0fae383714b002471b1aefb7

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.