Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

018ff37ba8...9f.exe

windows7-x64

6

018ff37ba8...9f.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    124s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/09/2024, 01:00 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    018ff37ba8b41d1ae1669d3fd841351f4197f9594c7f05512b5a99cfda88549f.exe

  • Size

    441KB

  • MD5

    b0783a18de531b50debfe5252bc25558

  • SHA1

    bc564e0ceb0e8f99602247bcc559a583f77db8ce

  • SHA256

    018ff37ba8b41d1ae1669d3fd841351f4197f9594c7f05512b5a99cfda88549f

  • SHA512

    927ff7d89d9820745ab5208793444ade73da993b4c482f31297e093cb9d3cee96a8ae0808c1a4813612d61b1eba4e7d40bc7d9c037f4e337f5dccc4228c25e46

  • SSDEEP

    1536:TzOp02gL1jszmCCCCCpCCCCCTdvCCCCCCCCCCC3CCCCCCCCfFIeCCCCCCCCCCCCv:TzSY+zCdsP6GBxhDCovrU/s

Score
10/10
snakekeyloggercollectiondiscoverykeyloggerpersistencestealer

Malware Config

Extracted

Family

snakekeylogger

Credentials

  • Protocol:     smtp
  • Host:
    zulpine.shop
  • Port:
    587
  • Username:
    offic@zulpine.shop
  • Password:
    e5xECScP5KfC
  • Email To:
    sendxoffic@zulpine.shop

Signatures

  • Snake Keylogger

    Keylogger and Infostealer first seen in November 2020.

    stealerkeyloggersnakekeylogger
  • Snake Keylogger payload 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3432
      • C:\Users\Admin\AppData\Local\Temp\018ff37ba8b41d1ae1669d3fd841351f4197f9594c7f05512b5a99cfda88549f.exe
        "C:\Users\Admin\AppData\Local\Temp\018ff37ba8b41d1ae1669d3fd841351f4197f9594c7f05512b5a99cfda88549f.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1896
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        2⤵
        • Accesses Microsoft Outlook profiles
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:5032

    Network

    • flag-de
      GET
      http://172.86.66.70/y3/Tzxjiauolcg.mp3
      018ff37ba8b41d1ae1669d3fd841351f4197f9594c7f05512b5a99cfda88549f.exe
      Remote address:
      172.86.66.70:80
      Request
      GET /y3/Tzxjiauolcg.mp3 HTTP/1.1
      Host: 172.86.66.70
      Connection: Keep-Alive
      Response
      HTTP/1.1 200 OK
      Date: Fri, 27 Sep 2024 01:00:32 GMT
      Server: Apache/2.4.62 (Debian)
      Last-Modified: Wed, 25 Sep 2024 07:28:13 GMT
      ETag: "1c0400-622ec908c3d40"
      Accept-Ranges: bytes
      Content-Length: 1836032
      Keep-Alive: timeout=5, max=100
      Connection: Keep-Alive
      Content-Type: audio/mpeg
    • flag-us
      DNS
      58.55.71.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      58.55.71.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      70.66.86.172.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      70.66.86.172.in-addr.arpa
      IN PTR
      Response
      70.66.86.172.in-addr.arpa
      IN PTR
      706686172staticcloudzycom
    • flag-us
      DNS
      240.221.184.93.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      240.221.184.93.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      22.160.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      22.160.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      154.239.44.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      154.239.44.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      13.86.106.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      13.86.106.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      checkip.dyndns.org
      InstallUtil.exe
      Remote address:
      8.8.8.8:53
      Request
      checkip.dyndns.org
      IN A
      Response
      checkip.dyndns.org
      IN CNAME
      checkip.dyndns.com
      checkip.dyndns.com
      IN A
      132.226.247.73
      checkip.dyndns.com
      IN A
      132.226.8.169
      checkip.dyndns.com
      IN A
      158.101.44.242
      checkip.dyndns.com
      IN A
      193.122.6.168
      checkip.dyndns.com
      IN A
      193.122.130.0
    • flag-br
      GET
      http://checkip.dyndns.org/
      InstallUtil.exe
      Remote address:
      132.226.247.73:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Connection: Keep-Alive
      Response
      HTTP/1.1 200 OK
      Date: Fri, 27 Sep 2024 01:00:53 GMT
      Content-Type: text/html
      Content-Length: 105
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: 6f8103df0f47df4dad5ba5a8b9d24827
    • flag-br
      GET
      http://checkip.dyndns.org/
      InstallUtil.exe
      Remote address:
      132.226.247.73:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Response
      HTTP/1.1 200 OK
      Date: Fri, 27 Sep 2024 01:00:53 GMT
      Content-Type: text/html
      Content-Length: 105
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: 0d46f4a359f1b6a5830952a051f7176c
    • flag-br
      GET
      http://checkip.dyndns.org/
      InstallUtil.exe
      Remote address:
      132.226.247.73:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Response
      HTTP/1.1 200 OK
      Date: Fri, 27 Sep 2024 01:00:54 GMT
      Content-Type: text/html
      Content-Length: 105
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: 8d7481988d1316c5ba91ccc34f949093
    • flag-br
      GET
      http://checkip.dyndns.org/
      InstallUtil.exe
      Remote address:
      132.226.247.73:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Response
      HTTP/1.1 200 OK
      Date: Fri, 27 Sep 2024 01:00:54 GMT
      Content-Type: text/html
      Content-Length: 105
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: 7eea2685d11dde750f53229a2bc4fa05
    • flag-br
      GET
      http://checkip.dyndns.org/
      InstallUtil.exe
      Remote address:
      132.226.247.73:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Response
      HTTP/1.1 200 OK
      Date: Fri, 27 Sep 2024 01:00:54 GMT
      Content-Type: text/html
      Content-Length: 105
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: 14511812f56f1a9d901a1200f1c75534
    • flag-br
      GET
      http://checkip.dyndns.org/
      InstallUtil.exe
      Remote address:
      132.226.247.73:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Response
      HTTP/1.1 200 OK
      Date: Fri, 27 Sep 2024 01:00:55 GMT
      Content-Type: text/html
      Content-Length: 105
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: d67d27bf4d4725819f0e94c365888b6b
    • flag-br
      GET
      http://checkip.dyndns.org/
      InstallUtil.exe
      Remote address:
      132.226.247.73:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Response
      HTTP/1.1 200 OK
      Date: Fri, 27 Sep 2024 01:00:55 GMT
      Content-Type: text/html
      Content-Length: 105
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: 74a41be092b22bc94b055cc381bfbf73
    • flag-br
      GET
      http://checkip.dyndns.org/
      InstallUtil.exe
      Remote address:
      132.226.247.73:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Response
      HTTP/1.1 200 OK
      Date: Fri, 27 Sep 2024 01:00:55 GMT
      Content-Type: text/html
      Content-Length: 105
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: b9743dd832c0ab0a18259c2f4de4168e
    • flag-br
      GET
      http://checkip.dyndns.org/
      InstallUtil.exe
      Remote address:
      132.226.247.73:80
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)
      Host: checkip.dyndns.org
      Response
      HTTP/1.1 200 OK
      Date: Fri, 27 Sep 2024 01:00:56 GMT
      Content-Type: text/html
      Content-Length: 105
      Connection: keep-alive
      Cache-Control: no-cache
      Pragma: no-cache
      X-Request-ID: 142056432a9dfedcfcdab04fec544922
    • flag-us
      DNS
      reallyfreegeoip.org
      InstallUtil.exe
      Remote address:
      8.8.8.8:53
      Request
      reallyfreegeoip.org
      IN A
      Response
      reallyfreegeoip.org
      IN A
      172.67.177.134
      reallyfreegeoip.org
      IN A
      104.21.67.152
    • flag-us
      GET
      https://reallyfreegeoip.org/xml/138.199.29.44
      InstallUtil.exe
      Remote address:
      172.67.177.134:443
      Request
      GET /xml/138.199.29.44 HTTP/1.1
      Host: reallyfreegeoip.org
      Connection: Keep-Alive
      Response
      HTTP/1.1 200 OK
      Date: Fri, 27 Sep 2024 01:00:54 GMT
      Content-Type: application/xml
      Transfer-Encoding: chunked
      Connection: keep-alive
      access-control-allow-origin: *
      vary: Accept-Encoding
      Cache-Control: max-age=86400
      CF-Cache-Status: HIT
      Age: 37671
      Last-Modified: Thu, 26 Sep 2024 14:33:03 GMT
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PeJWJsLp%2FmvxjSbqqb3Fr15RMaGol%2FnjrKqtbDUBofGY7V58rFUuN4QOXjutZQQm6OWFzde4XVKDD4vwN2dwMx4WEZTB1zraetXhQLcSUI47r866LLtOp9tLRcxHPMeq6fCOlc3L"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8c978f372a2860e3-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      GET
      https://reallyfreegeoip.org/xml/138.199.29.44
      InstallUtil.exe
      Remote address:
      172.67.177.134:443
      Request
      GET /xml/138.199.29.44 HTTP/1.1
      Host: reallyfreegeoip.org
      Response
      HTTP/1.1 200 OK
      Date: Fri, 27 Sep 2024 01:00:54 GMT
      Content-Type: application/xml
      Transfer-Encoding: chunked
      Connection: keep-alive
      access-control-allow-origin: *
      vary: Accept-Encoding
      Cache-Control: max-age=86400
      CF-Cache-Status: HIT
      Age: 37671
      Last-Modified: Thu, 26 Sep 2024 14:33:03 GMT
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bc%2F4ZbRXs6%2BwgBUlnZ%2BVBLxHjoRzq%2B22yPOjto9%2BBXDzDrwrabvK5k5C8ZXRSuV6xRlTHvQ1V1A0eluKxTQ5NsNGLmtX09cjY6RaTmP0qTuTpgykqPGRarCfJ7SE%2F4vYNeq%2BQX%2BS"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8c978f38fb1f60e3-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      GET
      https://reallyfreegeoip.org/xml/138.199.29.44
      InstallUtil.exe
      Remote address:
      172.67.177.134:443
      Request
      GET /xml/138.199.29.44 HTTP/1.1
      Host: reallyfreegeoip.org
      Response
      HTTP/1.1 200 OK
      Date: Fri, 27 Sep 2024 01:00:54 GMT
      Content-Type: application/xml
      Transfer-Encoding: chunked
      Connection: keep-alive
      access-control-allow-origin: *
      vary: Accept-Encoding
      Cache-Control: max-age=86400
      CF-Cache-Status: HIT
      Age: 37671
      Last-Modified: Thu, 26 Sep 2024 14:33:03 GMT
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7B9NCDelMa1yjUiRhXmrISSOFTT%2FJFg5H6uqcZqsMB84Y70wpQwOtkSPrf6iVkyuf3alW11A21kWozVbBbwfEoBQiFFTUt4u7wiUgxDnKA1DHa90UJzfVmUpCHSS4N86CnoyLp2g"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8c978f3acc4660e3-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      GET
      https://reallyfreegeoip.org/xml/138.199.29.44
      InstallUtil.exe
      Remote address:
      172.67.177.134:443
      Request
      GET /xml/138.199.29.44 HTTP/1.1
      Host: reallyfreegeoip.org
      Response
      HTTP/1.1 200 OK
      Date: Fri, 27 Sep 2024 01:00:55 GMT
      Content-Type: application/xml
      Transfer-Encoding: chunked
      Connection: keep-alive
      access-control-allow-origin: *
      vary: Accept-Encoding
      Cache-Control: max-age=86400
      CF-Cache-Status: HIT
      Age: 37672
      Last-Modified: Thu, 26 Sep 2024 14:33:03 GMT
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9FzIku%2BUfjUbuX7N%2Fp4nr0yF2qL63bubk1ld%2F2y36v3HKke2vUvZY0lSujnH1aR4TM2ALdoAq2rL7%2B%2Bm9G8p5cdFvPvSWfurBr%2BTeYEO72EEpxtfXTiy57avrvNsKxm4kIPpn00p"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8c978f3c9d5e60e3-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      GET
      https://reallyfreegeoip.org/xml/138.199.29.44
      InstallUtil.exe
      Remote address:
      172.67.177.134:443
      Request
      GET /xml/138.199.29.44 HTTP/1.1
      Host: reallyfreegeoip.org
      Response
      HTTP/1.1 200 OK
      Date: Fri, 27 Sep 2024 01:00:55 GMT
      Content-Type: application/xml
      Transfer-Encoding: chunked
      Connection: keep-alive
      access-control-allow-origin: *
      vary: Accept-Encoding
      Cache-Control: max-age=86400
      CF-Cache-Status: HIT
      Age: 37672
      Last-Modified: Thu, 26 Sep 2024 14:33:03 GMT
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BddXkMyoaxWRHX4gp6w5ugUShI91bXk6nEW38wLeuTsLZUA210GCbkKMaLsHf6X9JGPXLXcQOXPlkg6laUZo2VOf68EyS9t%2FKHuM830hldpVaXgHb03nv4ZDPq4%2BQixsEzhBok0R"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8c978f3e5e4c60e3-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      GET
      https://reallyfreegeoip.org/xml/138.199.29.44
      InstallUtil.exe
      Remote address:
      172.67.177.134:443
      Request
      GET /xml/138.199.29.44 HTTP/1.1
      Host: reallyfreegeoip.org
      Response
      HTTP/1.1 200 OK
      Date: Fri, 27 Sep 2024 01:00:55 GMT
      Content-Type: application/xml
      Transfer-Encoding: chunked
      Connection: keep-alive
      access-control-allow-origin: *
      vary: Accept-Encoding
      Cache-Control: max-age=86400
      CF-Cache-Status: HIT
      Age: 37672
      Last-Modified: Thu, 26 Sep 2024 14:33:03 GMT
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O4lCnMnyoMMQ3O637NUY2pjz%2Beh0XGg664tQ8PHFcH4B3yRxdm8Fkuq4LWXAgQcOc9tK3REZw5INYLEIfrPZcTJ4YcD8Yvgr615Tdu8SzmWgtVMyqNmKtOCBs2%2FYGSAc7y%2FlBfaE"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8c978f401f2660e3-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      GET
      https://reallyfreegeoip.org/xml/138.199.29.44
      InstallUtil.exe
      Remote address:
      172.67.177.134:443
      Request
      GET /xml/138.199.29.44 HTTP/1.1
      Host: reallyfreegeoip.org
      Response
      HTTP/1.1 200 OK
      Date: Fri, 27 Sep 2024 01:00:55 GMT
      Content-Type: application/xml
      Transfer-Encoding: chunked
      Connection: keep-alive
      access-control-allow-origin: *
      vary: Accept-Encoding
      Cache-Control: max-age=86400
      CF-Cache-Status: HIT
      Age: 37672
      Last-Modified: Thu, 26 Sep 2024 14:33:03 GMT
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FI%2BwuvV5xMhWsNPPqXULKnMj%2BxUfjUmWBmF93uqFkvQjplKdlbviLky5IHJIchc5HBSC7G8b%2BzDXtfhh3MiY4xuFdfyyLSjKUnyRGMyDkBcqIfItxZftinZTNWe4JhXi1LEZUQE6"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8c978f41e80a60e3-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      GET
      https://reallyfreegeoip.org/xml/138.199.29.44
      InstallUtil.exe
      Remote address:
      172.67.177.134:443
      Request
      GET /xml/138.199.29.44 HTTP/1.1
      Host: reallyfreegeoip.org
      Response
      HTTP/1.1 200 OK
      Date: Fri, 27 Sep 2024 01:00:56 GMT
      Content-Type: application/xml
      Transfer-Encoding: chunked
      Connection: keep-alive
      access-control-allow-origin: *
      vary: Accept-Encoding
      Cache-Control: max-age=86400
      CF-Cache-Status: HIT
      Age: 37673
      Last-Modified: Thu, 26 Sep 2024 14:33:03 GMT
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T6KhI7ZER1cJgQXKqdVcOWY2nVsunn6RRFQKaKoOc7L7KNyNTwE2Sn1aGRxRGB1ZG%2FbEULyo2BizI9k3vSnY8KIP7aDY3%2BOehuH9MO5Ogg%2FJRKpAoaybRtpIgeqLD9NGZblDOtJZ"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8c978f43c8f160e3-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      DNS
      73.247.226.132.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      73.247.226.132.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      134.177.67.172.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      134.177.67.172.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      50.23.12.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      50.23.12.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      241.42.69.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      241.42.69.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.210.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.210.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      31.243.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      31.243.111.52.in-addr.arpa
      IN PTR
      Response
    • 172.86.66.70:80
      http://172.86.66.70/y3/Tzxjiauolcg.mp3
      http
      018ff37ba8b41d1ae1669d3fd841351f4197f9594c7f05512b5a99cfda88549f.exe
      42.0kB
       1.9MB
       848
      1358

      HTTP Request

      GET http://172.86.66.70/y3/Tzxjiauolcg.mp3

      HTTP Response

      200
    • 132.226.247.73:80
      http://checkip.dyndns.org/
      http
      InstallUtil.exe
      2.1kB
       3.4kB
       21
      13

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200

      HTTP Request

      GET http://checkip.dyndns.org/

      HTTP Response

      200
    • 172.67.177.134:443
      https://reallyfreegeoip.org/xml/138.199.29.44
      tls, http
      InstallUtil.exe
      2.0kB
       12.7kB
       23
      23

      HTTP Request

      GET https://reallyfreegeoip.org/xml/138.199.29.44

      HTTP Response

      200

      HTTP Request

      GET https://reallyfreegeoip.org/xml/138.199.29.44

      HTTP Response

      200

      HTTP Request

      GET https://reallyfreegeoip.org/xml/138.199.29.44

      HTTP Response

      200

      HTTP Request

      GET https://reallyfreegeoip.org/xml/138.199.29.44

      HTTP Response

      200

      HTTP Request

      GET https://reallyfreegeoip.org/xml/138.199.29.44

      HTTP Response

      200

      HTTP Request

      GET https://reallyfreegeoip.org/xml/138.199.29.44

      HTTP Response

      200

      HTTP Request

      GET https://reallyfreegeoip.org/xml/138.199.29.44

      HTTP Response

      200

      HTTP Request

      GET https://reallyfreegeoip.org/xml/138.199.29.44

      HTTP Response

      200
    • 8.8.8.8:53
      58.55.71.13.in-addr.arpa
      dns
      70 B
       144 B
       1
      1

      DNS Request

      58.55.71.13.in-addr.arpa

    • 8.8.8.8:53
      70.66.86.172.in-addr.arpa
      dns
      71 B
       116 B
       1
      1

      DNS Request

      70.66.86.172.in-addr.arpa

    • 8.8.8.8:53
      240.221.184.93.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      240.221.184.93.in-addr.arpa

    • 8.8.8.8:53
      22.160.190.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      22.160.190.20.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      154.239.44.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      154.239.44.20.in-addr.arpa

    • 8.8.8.8:53
      13.86.106.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      13.86.106.20.in-addr.arpa

    • 8.8.8.8:53
      checkip.dyndns.org
      dns
      InstallUtil.exe
      64 B
       176 B
       1
      1

      DNS Request

      checkip.dyndns.org

      DNS Response

      132.226.247.73
      132.226.8.169
      158.101.44.242
      193.122.6.168
      193.122.130.0

    • 8.8.8.8:53
      reallyfreegeoip.org
      dns
      InstallUtil.exe
      65 B
       97 B
       1
      1

      DNS Request

      reallyfreegeoip.org

      DNS Response

      172.67.177.134
      104.21.67.152

    • 8.8.8.8:53
      73.247.226.132.in-addr.arpa
      dns
      73 B
       158 B
       1
      1

      DNS Request

      73.247.226.132.in-addr.arpa

    • 8.8.8.8:53
      134.177.67.172.in-addr.arpa
      dns
      73 B
       135 B
       1
      1

      DNS Request

      134.177.67.172.in-addr.arpa

    • 8.8.8.8:53
      50.23.12.20.in-addr.arpa
      dns
      70 B
       156 B
       1
      1

      DNS Request

      50.23.12.20.in-addr.arpa

    • 8.8.8.8:53
      241.42.69.40.in-addr.arpa
      dns
      71 B
       145 B
       1
      1

      DNS Request

      241.42.69.40.in-addr.arpa

    • 8.8.8.8:53
      172.210.232.199.in-addr.arpa
      dns
      74 B
       128 B
       1
      1

      DNS Request

      172.210.232.199.in-addr.arpa

    • 8.8.8.8:53
      31.243.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      31.243.111.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1896-0-0x0000000074DBE000-0x0000000074DBF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1896-1-0x0000000000D30000-0x0000000000DA2000-memory.dmp

      Filesize

      456KB

      Download

    • memory/1896-2-0x0000000074DB0000-0x0000000075560000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/1896-3-0x00000000060F0000-0x00000000061D6000-memory.dmp

      Filesize

      920KB

      Download

    • memory/1896-13-0x00000000060F0000-0x00000000061D1000-memory.dmp

      Filesize

      900KB

      Download

    • memory/1896-27-0x00000000060F0000-0x00000000061D1000-memory.dmp

      Filesize

      900KB

      Download

    • memory/1896-67-0x00000000060F0000-0x00000000061D1000-memory.dmp

      Filesize

      900KB

      Download

    • memory/1896-65-0x00000000060F0000-0x00000000061D1000-memory.dmp

      Filesize

      900KB

      Download

    • memory/1896-61-0x00000000060F0000-0x00000000061D1000-memory.dmp

      Filesize

      900KB

      Download

    • memory/1896-59-0x00000000060F0000-0x00000000061D1000-memory.dmp

      Filesize

      900KB

      Download

    • memory/1896-57-0x00000000060F0000-0x00000000061D1000-memory.dmp

      Filesize

      900KB

      Download

    • memory/1896-55-0x00000000060F0000-0x00000000061D1000-memory.dmp

      Filesize

      900KB

      Download

    • memory/1896-51-0x00000000060F0000-0x00000000061D1000-memory.dmp

      Filesize

      900KB

      Download

    • memory/1896-49-0x00000000060F0000-0x00000000061D1000-memory.dmp

      Filesize

      900KB

      Download

    • memory/1896-47-0x00000000060F0000-0x00000000061D1000-memory.dmp

      Filesize

      900KB

      Download

    • memory/1896-45-0x00000000060F0000-0x00000000061D1000-memory.dmp

      Filesize

      900KB

      Download

    • memory/1896-43-0x00000000060F0000-0x00000000061D1000-memory.dmp

      Filesize

      900KB

      Download

    • memory/1896-39-0x00000000060F0000-0x00000000061D1000-memory.dmp

      Filesize

      900KB

      Download

    • memory/1896-37-0x00000000060F0000-0x00000000061D1000-memory.dmp

      Filesize

      900KB

      Download

    • memory/1896-35-0x00000000060F0000-0x00000000061D1000-memory.dmp

      Filesize

      900KB

      Download

    • memory/1896-33-0x00000000060F0000-0x00000000061D1000-memory.dmp

      Filesize

      900KB

      Download

    • memory/1896-25-0x00000000060F0000-0x00000000061D1000-memory.dmp

      Filesize

      900KB

      Download

    • memory/1896-24-0x00000000060F0000-0x00000000061D1000-memory.dmp

      Filesize

      900KB

      Download

    • memory/1896-21-0x00000000060F0000-0x00000000061D1000-memory.dmp

      Filesize

      900KB

      Download

    • memory/1896-19-0x00000000060F0000-0x00000000061D1000-memory.dmp

      Filesize

      900KB

      Download

    • memory/1896-17-0x00000000060F0000-0x00000000061D1000-memory.dmp

      Filesize

      900KB

      Download

    • memory/1896-15-0x00000000060F0000-0x00000000061D1000-memory.dmp

      Filesize

      900KB

      Download

    • memory/1896-11-0x00000000060F0000-0x00000000061D1000-memory.dmp

      Filesize

      900KB

      Download

    • memory/1896-9-0x00000000060F0000-0x00000000061D1000-memory.dmp

      Filesize

      900KB

      Download

    • memory/1896-7-0x00000000060F0000-0x00000000061D1000-memory.dmp

      Filesize

      900KB

      Download

    • memory/1896-63-0x00000000060F0000-0x00000000061D1000-memory.dmp

      Filesize

      900KB

      Download

    • memory/1896-53-0x00000000060F0000-0x00000000061D1000-memory.dmp

      Filesize

      900KB

      Download

    • memory/1896-41-0x00000000060F0000-0x00000000061D1000-memory.dmp

      Filesize

      900KB

      Download

    • memory/1896-31-0x00000000060F0000-0x00000000061D1000-memory.dmp

      Filesize

      900KB

      Download

    • memory/1896-29-0x00000000060F0000-0x00000000061D1000-memory.dmp

      Filesize

      900KB

      Download

    • memory/1896-5-0x00000000060F0000-0x00000000061D1000-memory.dmp

      Filesize

      900KB

      Download

    • memory/1896-4-0x00000000060F0000-0x00000000061D1000-memory.dmp

      Filesize

      900KB

      Download

    • memory/1896-1062-0x0000000074DBE000-0x0000000074DBF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1896-1079-0x0000000074DB0000-0x0000000075560000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/1896-1080-0x0000000074DB0000-0x0000000075560000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/1896-1081-0x0000000006340000-0x00000000063A2000-memory.dmp

      Filesize

      392KB

      Download

    • memory/1896-1082-0x00000000063A0000-0x00000000063EC000-memory.dmp

      Filesize

      304KB

      Download

    • memory/1896-1086-0x0000000074DB0000-0x0000000075560000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/1896-1087-0x0000000074DB0000-0x0000000075560000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/1896-1088-0x0000000074DB0000-0x0000000075560000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/1896-1089-0x0000000006C90000-0x0000000007234000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/1896-1090-0x0000000006580000-0x00000000065D4000-memory.dmp

      Filesize

      336KB

      Download

    • memory/1896-1093-0x0000000074DB0000-0x0000000075560000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/5032-1094-0x0000000074DB0000-0x0000000075560000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/5032-1095-0x0000000000400000-0x0000000000426000-memory.dmp

      Filesize

      152KB

      Download

    • memory/5032-1096-0x0000000004FC0000-0x000000000505C000-memory.dmp

      Filesize

      624KB

      Download

    • memory/5032-1097-0x0000000074DB0000-0x0000000075560000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/5032-1098-0x0000000006170000-0x00000000061C0000-memory.dmp

      Filesize

      320KB

      Download

    • memory/5032-1099-0x0000000006390000-0x0000000006552000-memory.dmp

      Filesize

      1.8MB

      Download

    • memory/5032-1100-0x0000000006260000-0x00000000062F2000-memory.dmp

      Filesize

      584KB

      Download

    • memory/5032-1101-0x0000000006200000-0x000000000620A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/5032-1102-0x0000000074DB0000-0x0000000075560000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/5032-1103-0x0000000074DB0000-0x0000000075560000-memory.dmp

      Filesize

      7.7MB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.