Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

e11532b77b...56.exe

windows7-x64

10

e11532b77b...56.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    132s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/09/2024, 11:34 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e11532b77bec09e8a74fa02135de0a9e00adfc73956027e436eb7954c5548756.exe

  • Size

    100.0MB

  • MD5

    744720a3be6bbd237c8fe1e119d04638

  • SHA1

    7182439de1107effdc51f7ae73c44588e6a90970

  • SHA256

    e11532b77bec09e8a74fa02135de0a9e00adfc73956027e436eb7954c5548756

  • SHA512

    1ab6fc386397b83feba691d758df03583c6ca1b3b3570929b988738b11d1c454e562874095f4f740352cbe4def554a942fa5b61b6f274b54f08e2a3171f4e548

  • SSDEEP

    24576:oAHnh+eWsN3skA4RV1Hom2KXMmHa2kIXhDnPa5:vh+ZkldoPK8Ya2kahDn4

Score
10/10
snakekeyloggerdiscoverykeyloggerstealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    mail.optec.com.ec
  • Port:
    587
  • Username:
    donotreply@optec.com.ec
  • Password:
    9A0hmRgU~OhG
  • Email To:
    ventas@optec.com.ec

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger
  • Snake Keylogger payload 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e11532b77bec09e8a74fa02135de0a9e00adfc73956027e436eb7954c5548756.exe
    "C:\Users\Admin\AppData\Local\Temp\e11532b77bec09e8a74fa02135de0a9e00adfc73956027e436eb7954c5548756.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1992
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\e11532b77bec09e8a74fa02135de0a9e00adfc73956027e436eb7954c5548756.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1136
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5064
        • C:\Windows\SysWOW64\choice.exe
          choice /C Y /N /D Y /T 3
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2608
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4412,i,11708048364682646792,608099842549576907,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
    1⤵
      PID:1116

    Network

    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
      Response
      8.8.8.8.in-addr.arpa
      IN PTR
      dnsgoogle
    • flag-us
      DNS
      228.249.119.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      228.249.119.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      checkip.dyndns.org
      RegSvcs.exe
      Remote address:
      8.8.8.8:53
      Request
      checkip.dyndns.org
      IN A
      Response
      checkip.dyndns.org
      IN CNAME
      checkip.dyndns.com
      checkip.dyndns.com
      IN A
      193.122.6.168
      checkip.dyndns.com
      IN A
      132.226.247.73
      checkip.dyndns.com
      IN A
      132.226.8.169
      checkip.dyndns.com
      IN A
      193.122.130.0
      checkip.dyndns.com
      IN A
      158.101.44.242
    • flag-de
      GET
      http://checkip.dyndns.org/
      RegSvcs.exe
      Remote address:
      193.122.6.168:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Connection: Keep-Alive
      Response
      HTTP/1.1 200 OK
      Date: Mon, 09 Sep 2024 11:34:56 GMT
      Content-Type: text/html
      Content-Length: 105
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: 323007a13cbd5d749da13d6a448891de
    • flag-de
      GET
      http://checkip.dyndns.org/
      RegSvcs.exe
      Remote address:
      193.122.6.168:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Response
      HTTP/1.1 200 OK
      Date: Mon, 09 Sep 2024 11:34:56 GMT
      Content-Type: text/html
      Content-Length: 105
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: ca39aab15b6170b9bf0a176abcffb1b1
    • flag-de
      GET
      http://checkip.dyndns.org/
      RegSvcs.exe
      Remote address:
      193.122.6.168:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Response
      HTTP/1.1 200 OK
      Date: Mon, 09 Sep 2024 11:34:57 GMT
      Content-Type: text/html
      Content-Length: 105
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: 76f5d6169364a57f71cf278680ba59ab
    • flag-de
      GET
      http://checkip.dyndns.org/
      RegSvcs.exe
      Remote address:
      193.122.6.168:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Response
      HTTP/1.1 200 OK
      Date: Mon, 09 Sep 2024 11:35:04 GMT
      Content-Type: text/html
      Content-Length: 105
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: e8543e8edc7436f2acce4012cd086ccd
    • flag-de
      GET
      http://checkip.dyndns.org/
      RegSvcs.exe
      Remote address:
      193.122.6.168:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Response
      HTTP/1.1 200 OK
      Date: Mon, 09 Sep 2024 11:35:08 GMT
      Content-Type: text/html
      Content-Length: 105
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: 14631930138c44450209992a8f2a7647
    • flag-de
      GET
      http://checkip.dyndns.org/
      RegSvcs.exe
      Remote address:
      193.122.6.168:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Response
      HTTP/1.1 200 OK
      Date: Mon, 09 Sep 2024 11:35:10 GMT
      Content-Type: text/html
      Content-Length: 105
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: 0d3caaeb7cd9ecd1ce6c3b8311a0923a
    • flag-de
      GET
      http://checkip.dyndns.org/
      RegSvcs.exe
      Remote address:
      193.122.6.168:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Response
      HTTP/1.1 200 OK
      Date: Mon, 09 Sep 2024 11:35:11 GMT
      Content-Type: text/html
      Content-Length: 105
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: 1d20dbc747e17ccc4f49fb7ce2177480
    • flag-de
      GET
      http://checkip.dyndns.org/
      RegSvcs.exe
      Remote address:
      193.122.6.168:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Response
      HTTP/1.1 200 OK
      Date: Mon, 09 Sep 2024 11:35:13 GMT
      Content-Type: text/html
      Content-Length: 105
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: 100618e56c9fc5e1f6e64a5d786324fd
    • flag-de
      GET
      http://checkip.dyndns.org/
      RegSvcs.exe
      Remote address:
      193.122.6.168:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Response
      HTTP/1.1 504 Gateway Time-out
      Date: Mon, 09 Sep 2024 11:35:16 GMT
      Content-Type: text/html
      Content-Length: 557
      Connection: keep-alive
      X-Request-ID: 610e71f0922c8ccb7ef34edfbeda941c
    • flag-us
      DNS
      reallyfreegeoip.org
      RegSvcs.exe
      Remote address:
      8.8.8.8:53
      Request
      reallyfreegeoip.org
      IN A
      Response
      reallyfreegeoip.org
      IN A
      172.67.177.134
      reallyfreegeoip.org
      IN A
      104.21.67.152
    • flag-us
      GET
      https://reallyfreegeoip.org/xml/194.110.13.70
      RegSvcs.exe
      Remote address:
      172.67.177.134:443
      Request
      GET /xml/194.110.13.70 HTTP/1.1
      Host: reallyfreegeoip.org
      Connection: Keep-Alive
      Response
      HTTP/1.1 200 OK
      Date: Mon, 09 Sep 2024 11:34:57 GMT
      Content-Type: application/xml
      Transfer-Encoding: chunked
      Connection: keep-alive
      access-control-allow-origin: *
      vary: Accept-Encoding
      Cache-Control: max-age=86400
      CF-Cache-Status: HIT
      Age: 77452
      Last-Modified: Sun, 08 Sep 2024 14:04:05 GMT
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WJqPolYfv2cwO3DlOgT4ir1PERX9gGxEF%2FwGC7sx89%2BO9yE85gRXlIoBjc1qNuLsB7DD08wNIMZs1JdqroUyffXLbS986bBMpLXqruw2qkWEgOQs%2FmxACLZq7qflNrd8%2FjJFGFQY"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8c06df3fe98e632b-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      GET
      https://reallyfreegeoip.org/xml/194.110.13.70
      RegSvcs.exe
      Remote address:
      172.67.177.134:443
      Request
      GET /xml/194.110.13.70 HTTP/1.1
      Host: reallyfreegeoip.org
      Response
      HTTP/1.1 200 OK
      Date: Mon, 09 Sep 2024 11:35:00 GMT
      Content-Type: application/xml
      Transfer-Encoding: chunked
      Connection: keep-alive
      access-control-allow-origin: *
      vary: Accept-Encoding
      Cache-Control: max-age=86400
      CF-Cache-Status: HIT
      Age: 77455
      Last-Modified: Sun, 08 Sep 2024 14:04:05 GMT
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ox5nvkuTabDtcUKsP3gv8x00jmKYxDEjXsnPx6vS14QUX9IeZvCBFzvlwMA04yu4DIWd%2BTb2kn39G0IH3BwOJytBebo5av9q5j16V09EHnDtQc9bclyuoPhWBMHfJ6N79r6l%2FYE6"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8c06df56cc8a632b-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      GET
      https://reallyfreegeoip.org/xml/194.110.13.70
      RegSvcs.exe
      Remote address:
      172.67.177.134:443
      Request
      GET /xml/194.110.13.70 HTTP/1.1
      Host: reallyfreegeoip.org
      Response
      HTTP/1.1 200 OK
      Date: Mon, 09 Sep 2024 11:35:04 GMT
      Content-Type: application/xml
      Transfer-Encoding: chunked
      Connection: keep-alive
      access-control-allow-origin: *
      vary: Accept-Encoding
      Cache-Control: max-age=86400
      CF-Cache-Status: HIT
      Age: 77459
      Last-Modified: Sun, 08 Sep 2024 14:04:05 GMT
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sGiNBladudT8rfxfUZPgyf2qvTcOAR70ZeLVzDSS%2FxJIXc6%2Bio4j2yx%2Bi5ARWfGPbW7TUd%2FRiX3nYK6QIwNJS7ZzKkMgLeUgsmhI7AqjpuU1ObLD0qvAAR5yPSj0zHjsZJlnUwA6"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8c06df702c08632b-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      GET
      https://reallyfreegeoip.org/xml/194.110.13.70
      RegSvcs.exe
      Remote address:
      172.67.177.134:443
      Request
      GET /xml/194.110.13.70 HTTP/1.1
      Host: reallyfreegeoip.org
      Response
      HTTP/1.1 200 OK
      Date: Mon, 09 Sep 2024 11:35:09 GMT
      Content-Type: application/xml
      Transfer-Encoding: chunked
      Connection: keep-alive
      access-control-allow-origin: *
      vary: Accept-Encoding
      Cache-Control: max-age=86400
      CF-Cache-Status: HIT
      Age: 77464
      Last-Modified: Sun, 08 Sep 2024 14:04:05 GMT
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=F2CTk4D7nd%2Fb4XHh4JDGSs5%2BYWrLvUeFojwqVHMQ%2BCuUZVLGAcbxKe7%2B%2FFcnB6r824mc0odSG8Y66VoyOwnk0sssCO7HNEEY9SUDZePQjxvL9%2FVApEBgwgmUiBeCqjrdarnba2bF"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8c06df89fd69632b-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      GET
      https://reallyfreegeoip.org/xml/194.110.13.70
      RegSvcs.exe
      Remote address:
      172.67.177.134:443
      Request
      GET /xml/194.110.13.70 HTTP/1.1
      Host: reallyfreegeoip.org
      Response
      HTTP/1.1 200 OK
      Date: Mon, 09 Sep 2024 11:35:10 GMT
      Content-Type: application/xml
      Transfer-Encoding: chunked
      Connection: keep-alive
      access-control-allow-origin: *
      vary: Accept-Encoding
      Cache-Control: max-age=86400
      CF-Cache-Status: HIT
      Age: 77465
      Last-Modified: Sun, 08 Sep 2024 14:04:05 GMT
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SDyFeXqx1Jop2N1TiL9nKVKQb%2FTcx4cv4ZHdjET%2FmnRGE%2FErZZpqA7qyTUifbnhCIlLaT2kTn9OYss9HfqhChJdHl14kb1MnMfEqCSv8iQOTLXRViNnmBno58Jk9E83Lt62TNzXF"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8c06df958be5632b-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      GET
      https://reallyfreegeoip.org/xml/194.110.13.70
      RegSvcs.exe
      Remote address:
      172.67.177.134:443
      Request
      GET /xml/194.110.13.70 HTTP/1.1
      Host: reallyfreegeoip.org
      Response
      HTTP/1.1 200 OK
      Date: Mon, 09 Sep 2024 11:35:12 GMT
      Content-Type: application/xml
      Transfer-Encoding: chunked
      Connection: keep-alive
      access-control-allow-origin: *
      vary: Accept-Encoding
      Cache-Control: max-age=86400
      CF-Cache-Status: HIT
      Age: 77467
      Last-Modified: Sun, 08 Sep 2024 14:04:05 GMT
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3eMEDFtw126OMz3rQAiODDgzrJEXaEYHsBUWeUVxsTXxgUWTqk6uBwzVUHleRkpnJdKhGTdr7qi5Sd0xfYE7ZreYt9wdkzDP%2BebRvbzltKAHD92boTyzVGJ2ryvnzdSizmmuhqoF"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8c06df9bec38632b-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      GET
      https://reallyfreegeoip.org/xml/194.110.13.70
      RegSvcs.exe
      Remote address:
      172.67.177.134:443
      Request
      GET /xml/194.110.13.70 HTTP/1.1
      Host: reallyfreegeoip.org
      Response
      HTTP/1.1 200 OK
      Date: Mon, 09 Sep 2024 11:35:13 GMT
      Content-Type: application/xml
      Transfer-Encoding: chunked
      Connection: keep-alive
      access-control-allow-origin: *
      vary: Accept-Encoding
      Cache-Control: max-age=86400
      CF-Cache-Status: HIT
      Age: 77468
      Last-Modified: Sun, 08 Sep 2024 14:04:05 GMT
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1rR2PtZWIMbsEiB6Eyd%2BZRqpw5G8CJsD1rPYhSG8WA%2BTHigTfgO6E8BJm6bUc6CdDEr2FVNF3e%2BKNvLmhuzJSIFsztnxvmSnYqQFwbLJDYP3TnNjG6FGogo1dakQV18lcF1VVfs2"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8c06dfa38fe1632b-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      DNS
      168.6.122.193.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      168.6.122.193.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      134.177.67.172.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      134.177.67.172.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      240.221.184.93.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      240.221.184.93.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      240.221.184.93.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      240.221.184.93.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      240.221.184.93.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      240.221.184.93.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      240.221.184.93.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      240.221.184.93.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      240.221.184.93.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      240.221.184.93.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      73.31.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      73.31.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      73.31.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      73.31.126.40.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      73.31.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      73.31.126.40.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      73.31.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      73.31.126.40.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      73.31.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      73.31.126.40.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      97.17.167.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      97.17.167.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      97.17.167.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      97.17.167.52.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      97.17.167.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      97.17.167.52.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      50.23.12.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      50.23.12.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      15.164.165.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      15.164.165.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      232.168.11.51.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      232.168.11.51.in-addr.arpa
      IN PTR
      Response
    • 193.122.6.168:80
      http://checkip.dyndns.org/
      http
      RegSvcs.exe
      2.7kB
       4.2kB
       24
      21

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      504
    • 172.67.177.134:443
      https://reallyfreegeoip.org/xml/194.110.13.70
      tls, http
      RegSvcs.exe
      1.9kB
       11.6kB
       21
      20

      HTTP Request

      GET https://reallyfreegeoip.org/xml/194.110.13.70

      HTTP Response

      200

      HTTP Request

      GET https://reallyfreegeoip.org/xml/194.110.13.70

      HTTP Response

      200

      HTTP Request

      GET https://reallyfreegeoip.org/xml/194.110.13.70

      HTTP Response

      200

      HTTP Request

      GET https://reallyfreegeoip.org/xml/194.110.13.70

      HTTP Response

      200

      HTTP Request

      GET https://reallyfreegeoip.org/xml/194.110.13.70

      HTTP Response

      200

      HTTP Request

      GET https://reallyfreegeoip.org/xml/194.110.13.70

      HTTP Response

      200

      HTTP Request

      GET https://reallyfreegeoip.org/xml/194.110.13.70

      HTTP Response

      200
    • 8.8.8.8:53
      8.8.8.8.in-addr.arpa
      dns
      66 B
       90 B
       1
      1

      DNS Request

      8.8.8.8.in-addr.arpa

    • 8.8.8.8:53
      228.249.119.40.in-addr.arpa
      dns
      73 B
       159 B
       1
      1

      DNS Request

      228.249.119.40.in-addr.arpa

    • 8.8.8.8:53
      checkip.dyndns.org
      dns
      RegSvcs.exe
      64 B
       176 B
       1
      1

      DNS Request

      checkip.dyndns.org

      DNS Response

      193.122.6.168
      132.226.247.73
      132.226.8.169
      193.122.130.0
      158.101.44.242

    • 8.8.8.8:53
      reallyfreegeoip.org
      dns
      RegSvcs.exe
      65 B
       97 B
       1
      1

      DNS Request

      reallyfreegeoip.org

      DNS Response

      172.67.177.134
      104.21.67.152

    • 8.8.8.8:53
      168.6.122.193.in-addr.arpa
      dns
      72 B
       146 B
       1
      1

      DNS Request

      168.6.122.193.in-addr.arpa

    • 8.8.8.8:53
      134.177.67.172.in-addr.arpa
      dns
      73 B
       135 B
       1
      1

      DNS Request

      134.177.67.172.in-addr.arpa

    • 8.8.8.8:53
      240.221.184.93.in-addr.arpa
      dns
      365 B
       144 B
       5
      1

      DNS Request

      240.221.184.93.in-addr.arpa

      DNS Request

      240.221.184.93.in-addr.arpa

      DNS Request

      240.221.184.93.in-addr.arpa

      DNS Request

      240.221.184.93.in-addr.arpa

      DNS Request

      240.221.184.93.in-addr.arpa

    • 8.8.8.8:53
      73.31.126.40.in-addr.arpa
      dns
      355 B
       157 B
       5
      1

      DNS Request

      73.31.126.40.in-addr.arpa

      DNS Request

      73.31.126.40.in-addr.arpa

      DNS Request

      73.31.126.40.in-addr.arpa

      DNS Request

      73.31.126.40.in-addr.arpa

      DNS Request

      73.31.126.40.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      365 B
       144 B
       5
      1

      DNS Request

      95.221.229.192.in-addr.arpa

      DNS Request

      95.221.229.192.in-addr.arpa

      DNS Request

      95.221.229.192.in-addr.arpa

      DNS Request

      95.221.229.192.in-addr.arpa

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      97.17.167.52.in-addr.arpa
      dns
      213 B
       145 B
       3
      1

      DNS Request

      97.17.167.52.in-addr.arpa

      DNS Request

      97.17.167.52.in-addr.arpa

      DNS Request

      97.17.167.52.in-addr.arpa

    • 8.8.8.8:53
      50.23.12.20.in-addr.arpa
      dns
      70 B
       156 B
       1
      1

      DNS Request

      50.23.12.20.in-addr.arpa

    • 8.8.8.8:53
      15.164.165.52.in-addr.arpa
      dns
      72 B
       146 B
       1
      1

      DNS Request

      15.164.165.52.in-addr.arpa

    • 8.8.8.8:53
      232.168.11.51.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      232.168.11.51.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1136-12-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

      Download

    • memory/1136-13-0x0000000073DFE000-0x0000000073DFF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1136-14-0x0000000005E80000-0x0000000006424000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/1136-15-0x0000000005800000-0x000000000589C000-memory.dmp

      Filesize

      624KB

      Download

    • memory/1136-16-0x0000000073DF0000-0x00000000745A0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/1136-17-0x0000000073DFE000-0x0000000073DFF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1136-18-0x0000000073DF0000-0x00000000745A0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/1136-20-0x0000000073DF0000-0x00000000745A0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/1992-11-0x0000000001920000-0x0000000001924000-memory.dmp

      Filesize

      16KB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.