Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

7

HeraklesMT...T2.exe

windows7-x64

3

HeraklesMT...T2.exe

windows10-2004-x64

3

HeraklesMT...se.dll

windows7-x64

3

HeraklesMT...se.dll

windows10-2004-x64

3

HeraklesMT...32.dll

windows7-x64

3

HeraklesMT...32.dll

windows10-2004-x64

3

HeraklesMT...y2.dll

windows7-x64

3

HeraklesMT...y2.dll

windows10-2004-x64

3

HeraklesMT...id.dll

windows7-x64

1

HeraklesMT...id.dll

windows10-2004-x64

1

HeraklesMT...15.dll

windows7-x64

3

HeraklesMT...15.dll

windows10-2004-x64

3

HeraklesMT...lu.dll

windows7-x64

5

HeraklesMT...lu.dll

windows10-2004-x64

5

HeraklesMT...lp.dll

windows7-x64

3

HeraklesMT...lp.dll

windows10-2004-x64

3

HeraklesMT...32.dll

windows7-x64

3

HeraklesMT...32.dll

windows10-2004-x64

3

HeraklesMT...32.dll

windows7-x64

3

HeraklesMT...32.dll

windows10-2004-x64

3

HeraklesMT...20.dll

windows7-x64

3

HeraklesMT...20.dll

windows10-2004-x64

3

HeraklesMT...0d.dll

windows7-x64

3

HeraklesMT...0d.dll

windows10-2004-x64

3

HeraklesMT...00.dll

windows7-x64

1

HeraklesMT...00.dll

windows10-2004-x64

1

HeraklesMT...20.dll

windows7-x64

3

HeraklesMT...20.dll

windows10-2004-x64

HeraklesMT...0d.dll

windows7-x64

3

HeraklesMT...0d.dll

windows10-2004-x64

3

HeraklesMT...32.dll

windows7-x64

3

HeraklesMT...32.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    02/10/2024, 09:28 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    HeraklesMT2Full17082013/HERAKLESMT2FULLPACK/HeraklesMT2.exe

  • Size

    2.3MB

  • MD5

    a94410c40daf4539bd714f63f1992483

  • SHA1

    9276f5c6a7b6ed2c9f33ab0fb1c893dab8bc4b65

  • SHA256

    e5b1f72f7041adce0ad3069fd3250c8707cbff41345a158dbe8bad6601270850

  • SHA512

    f932073b656567e88fa216b3d6a169250969274eacf403b58dd699a2d2fe3e5d990609b90c2cabd60673759a8f751a439db47ccff9aec1d20293e3eabd845abb

  • SSDEEP

    49152:mgppP3tfnT4VdEMisxQ2c8TKJnkwVMIguJ98CM+3zwj44:FvP9fEors4VMIg2aCM+8j/

Score
3/10
discovery

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HeraklesMT2Full17082013\HERAKLESMT2FULLPACK\HeraklesMT2.exe
    "C:\Users\Admin\AppData\Local\Temp\HeraklesMT2Full17082013\HERAKLESMT2FULLPACK\HeraklesMT2.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2848
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2848 -s 2152
      2⤵
      • Program crash
      PID:3056

Network

  • flag-us
    DNS
    www.heraklesmt2.com
    HeraklesMT2.exe
    Remote address:
    8.8.8.8:53
    Request
    www.heraklesmt2.com
    IN A
    Response
    www.heraklesmt2.com
    IN A
    172.67.148.20
    www.heraklesmt2.com
    IN A
    104.21.71.189
  • flag-us
    GET
    http://www.heraklesmt2.com/duyuru.php
    HeraklesMT2.exe
    Remote address:
    172.67.148.20:80
    Request
    GET /duyuru.php HTTP/1.1
    Accept: */*
    Accept-Language: en-US
    Accept-Encoding: gzip, deflate
    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
    Host: www.heraklesmt2.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 301 Moved Permanently
    Date: Wed, 02 Oct 2024 09:28:27 GMT
    Content-Type: text/html
    Content-Length: 167
    Connection: keep-alive
    Cache-Control: max-age=3600
    Expires: Wed, 02 Oct 2024 10:28:27 GMT
    Location: https://www.heraklesmt2.com/duyuru.php
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AQDeJnF5gQPT2KuW%2BY3uCqa%2F2dV0zQCkQl5zCPiPsuMX%2FoTxYOd1GTwvGyMFB15adXHOaftsgK8ozMRbEUmkoEKhC1jGWY8IxsmBIFiR%2FTkPUQu1TNl2WLUwFaO1EKKZE9JC1BQE"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Vary: Accept-Encoding
    Speculation-Rules: "/cdn-cgi/speculation"
    Server: cloudflare
    CF-RAY: 8cc3a9917aef940d-LHR
  • flag-us
    GET
    https://www.heraklesmt2.com/duyuru.php
    HeraklesMT2.exe
    Remote address:
    172.67.148.20:443
    Request
    GET /duyuru.php HTTP/1.1
    Accept: */*
    Accept-Language: en-US
    Accept-Encoding: gzip, deflate
    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
    Host: www.heraklesmt2.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 403 Forbidden
    Date: Wed, 02 Oct 2024 09:28:27 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: close
    Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
    Critical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
    Cross-Origin-Embedder-Policy: require-corp
    Cross-Origin-Opener-Policy: same-origin
    Cross-Origin-Resource-Policy: same-origin
    Origin-Agent-Cluster: ?1
    Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
    Referrer-Policy: same-origin
    X-Content-Options: nosniff
    X-Frame-Options: SAMEORIGIN
    cf-mitigated: challenge
    cf-chl-out: pLLvKq8R229FeSs2LGQeRaWPQ9JjfAGHmQztJNn87UJQ/3Ffvd2l00FmicEO2yv3tuGJpKMjR8maDWsC7qFRff9lQ5ezzyaqbM0kRr295lPLlgbNN2XD5BTsB3wTivJXJczJAvjYqAjTSvg+Qnoozw==$akUYOmC+JnORrZHAV7dLWw==
    Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
    Expires: Thu, 01 Jan 1970 00:00:01 GMT
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1Sdkm%2BbnJLMpNsQEKthqyYL16yjf776EAS6fV%2BzNnpKD%2BYrXeTUf1C29E1%2F%2B0yf%2BjSr%2B%2FH7zuzkgkbN8Y6fPi%2FqLDZscFCRiDlcKmLSy%2BwVfGjZnArt%2FCxXHRwziQOwnZofwlqhi"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Vary: Accept-Encoding
    Speculation-Rules: "/cdn-cgi/speculation"
    Server: cloudflare
    CF-RAY: 8cc3a99538d971cf-LHR
    Content-Encoding: gzip
  • flag-us
    DNS
    c.pki.goog
    HeraklesMT2.exe
    Remote address:
    8.8.8.8:53
    Request
    c.pki.goog
    IN A
    Response
    c.pki.goog
    IN CNAME
    pki-goog.l.google.com
    pki-goog.l.google.com
    IN A
    172.217.169.67
  • flag-gb
    GET
    http://c.pki.goog/r/gsr1.crl
    HeraklesMT2.exe
    Remote address:
    172.217.169.67:80
    Request
    GET /r/gsr1.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: c.pki.goog
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
    Cross-Origin-Resource-Policy: cross-origin
    Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
    Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
    Content-Length: 1739
    X-Content-Type-Options: nosniff
    Server: sffe
    X-XSS-Protection: 0
    Date: Wed, 02 Oct 2024 08:47:32 GMT
    Expires: Wed, 02 Oct 2024 09:37:32 GMT
    Cache-Control: public, max-age=3000
    Age: 2455
    Last-Modified: Mon, 08 Jul 2024 07:38:00 GMT
    Content-Type: application/pkix-crl
    Vary: Accept-Encoding
  • flag-gb
    GET
    http://c.pki.goog/r/r4.crl
    HeraklesMT2.exe
    Remote address:
    172.217.169.67:80
    Request
    GET /r/r4.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: c.pki.goog
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
    Cross-Origin-Resource-Policy: cross-origin
    Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
    Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
    Content-Length: 436
    X-Content-Type-Options: nosniff
    Server: sffe
    X-XSS-Protection: 0
    Date: Wed, 02 Oct 2024 08:47:32 GMT
    Expires: Wed, 02 Oct 2024 09:37:32 GMT
    Cache-Control: public, max-age=3000
    Age: 2455
    Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
    Content-Type: application/pkix-crl
    Vary: Accept-Encoding
  • flag-us
    GET
    http://www.heraklesmt2.com/patch/patch.txt?time=202410020928263716
    HeraklesMT2.exe
    Remote address:
    172.67.148.20:80
    Request
    GET /patch/patch.txt?time=202410020928263716 HTTP/1.1
    Host: www.heraklesmt2.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 301 Moved Permanently
    Date: Wed, 02 Oct 2024 09:28:29 GMT
    Content-Type: text/html
    Content-Length: 167
    Connection: keep-alive
    Cache-Control: max-age=3600
    Expires: Wed, 02 Oct 2024 10:28:29 GMT
    Location: https://www.heraklesmt2.com/patch/patch.txt?time=202410020928263716
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=t6lgmvTezqSj5vVJ%2B5O4uwPCXIeF%2F2GXEEPBlfF44QSdWXuverA0f%2BU97IwgE%2ByNy%2Bkru3eo%2Fgspnl0lYQbGgxFdZ3zY2UMNvkAZqjKOmk5wlg6MgSa1zbD9qfcg6Uqqu52%2FAqLJ"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Speculation-Rules: "/cdn-cgi/speculation"
    Server: cloudflare
    CF-RAY: 8cc3a9a1ced29508-LHR
  • flag-us
    GET
    https://www.heraklesmt2.com/patch/patch.txt?time=202410020928263716
    HeraklesMT2.exe
    Remote address:
    172.67.148.20:443
    Request
    GET /patch/patch.txt?time=202410020928263716 HTTP/1.1
    Host: www.heraklesmt2.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 403 Forbidden
    Date: Wed, 02 Oct 2024 09:28:29 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: close
    Accept-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
    Critical-CH: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
    Cross-Origin-Embedder-Policy: require-corp
    Cross-Origin-Opener-Policy: same-origin
    Cross-Origin-Resource-Policy: same-origin
    Origin-Agent-Cluster: ?1
    Permissions-Policy: accelerometer=(),autoplay=(),browsing-topics=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
    Referrer-Policy: same-origin
    X-Content-Options: nosniff
    X-Frame-Options: SAMEORIGIN
    cf-mitigated: challenge
    cf-chl-out: psnqnP3LcypVMY8Rpsy9tNfkHD+CgitQAy+fCrTcaFivvWmbtGZl0LOCmJ++7K+DSYx3cRQryCn0xF9elUt/5LDzRaBNUlrAmVTHae0UHePzeQODuQSgMQ40N+oo5bdlM/v301HCtpjuMm9bkJTtQA==$77BzP7m4xzlruEKV/gip2A==
    Cache-Control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
    Expires: Thu, 01 Jan 1970 00:00:01 GMT
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hFsUmSCkrzkUALCs%2B8wl8kV3L1LijI1oYatrpWEkO%2BBgrcclKsGR6%2FF5dUzL8YpdppEqa9%2FSCSUSuVhqr9ZifEARvYXjWn827ux2XpMyDerrp4mk5PBmCFhXy14IUxXEM%2B4ELVgL"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Speculation-Rules: "/cdn-cgi/speculation"
    Server: cloudflare
    CF-RAY: 8cc3a9a35ad39448-LHR
  • flag-us
    DNS
    crl.microsoft.com
    Remote address:
    8.8.8.8:53
    Request
    crl.microsoft.com
    IN A
    Response
    crl.microsoft.com
    IN CNAME
    crl.www.ms.akadns.net
    crl.www.ms.akadns.net
    IN CNAME
    a1363.dscg.akamai.net
    a1363.dscg.akamai.net
    IN A
    2.19.117.22
    a1363.dscg.akamai.net
    IN A
    2.19.117.18
  • flag-gb
    GET
    http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
    Remote address:
    2.19.117.22:80
    Request
    GET /pki/crl/products/MicRooCerAut2011_2011_03_22.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    If-Modified-Since: Wed, 01 May 2024 09:28:59 GMT
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: crl.microsoft.com
    Response
    HTTP/1.1 200 OK
    Content-Length: 1036
    Content-Type: application/octet-stream
    Content-MD5: 8M9bF5Tsp81z+cAg2quO8g==
    Last-Modified: Thu, 26 Sep 2024 02:21:11 GMT
    ETag: 0x8DCDDD1E3AF2C76
    Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
    x-ms-request-id: 0d86e878-601e-0013-6cbc-0f73e6000000
    x-ms-version: 2009-09-19
    x-ms-lease-status: unlocked
    x-ms-blob-type: BlockBlob
    Date: Wed, 02 Oct 2024 09:28:58 GMT
    Connection: keep-alive
  • flag-us
    DNS
    www.microsoft.com
    Remote address:
    8.8.8.8:53
    Request
    www.microsoft.com
    IN A
    Response
    www.microsoft.com
    IN CNAME
    www.microsoft.com-c-3.edgekey.net
    www.microsoft.com-c-3.edgekey.net
    IN CNAME
    www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
    www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net
    IN CNAME
    e13678.dscb.akamaiedge.net
    e13678.dscb.akamaiedge.net
    IN A
    2.17.5.133
  • flag-gb
    GET
    http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
    Remote address:
    2.17.5.133:80
    Request
    GET /pkiops/crl/MicCodSigPCA2011_2011-07-08.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    If-Modified-Since: Mon, 03 Jun 2024 21:25:24 GMT
    User-Agent: Microsoft-CryptoAPI/6.1
    Host: www.microsoft.com
    Response
    HTTP/1.1 200 OK
    Content-Length: 1078
    Content-Type: application/octet-stream
    Content-MD5: cyz+t2uRxNE5eKALjGZu1w==
    Last-Modified: Sun, 18 Aug 2024 00:23:49 GMT
    ETag: 0x8DCBF1C07FCB4BF
    x-ms-request-id: f8a60053-701e-000f-593e-f12186000000
    x-ms-version: 2009-09-19
    x-ms-lease-status: unlocked
    x-ms-blob-type: BlockBlob
    Date: Wed, 02 Oct 2024 09:28:58 GMT
    Connection: keep-alive
    TLS_version: UNKNOWN
    ms-cv: CASMicrosoftCVbe21b334.0
    ms-cv-esi: CASMicrosoftCVbe21b334.0
    X-RTag: RT
  • 172.67.148.20:80
    http://www.heraklesmt2.com/duyuru.php
    http
    HeraklesMT2.exe
    582 B
     1.0kB
     5
    3

    HTTP Request

    GET http://www.heraklesmt2.com/duyuru.php

    HTTP Response

    301
  • 172.67.148.20:443
    https://www.heraklesmt2.com/duyuru.php
    tls, http
    HeraklesMT2.exe
    1.4kB
     12.6kB
     15
    19

    HTTP Request

    GET https://www.heraklesmt2.com/duyuru.php

    HTTP Response

    403
  • 172.217.169.67:80
    http://c.pki.goog/r/r4.crl
    http
    HeraklesMT2.exe
    606 B
     5.0kB
     8
    6

    HTTP Request

    GET http://c.pki.goog/r/gsr1.crl

    HTTP Response

    200

    HTTP Request

    GET http://c.pki.goog/r/r4.crl

    HTTP Response

    200
  • 172.67.148.20:80
    http://www.heraklesmt2.com/patch/patch.txt?time=202410020928263716
    http
    HeraklesMT2.exe
    390 B
     1.9kB
     6
    4

    HTTP Request

    GET http://www.heraklesmt2.com/patch/patch.txt?time=202410020928263716

    HTTP Response

    301
  • 172.67.148.20:443
    https://www.heraklesmt2.com/patch/patch.txt?time=202410020928263716
    tls, http
    HeraklesMT2.exe
    1.1kB
     14.2kB
     15
    21

    HTTP Request

    GET https://www.heraklesmt2.com/patch/patch.txt?time=202410020928263716

    HTTP Response

    403
  • 2.19.117.22:80
    http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
    http
    399 B
     1.7kB
     4
    4

    HTTP Request

    GET http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl

    HTTP Response

    200
  • 2.17.5.133:80
    http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
    http
    393 B
     1.7kB
     4
    4

    HTTP Request

    GET http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl

    HTTP Response

    200
  • 8.8.8.8:53
    www.heraklesmt2.com
    dns
    HeraklesMT2.exe
    65 B
     97 B
     1
    1

    DNS Request

    www.heraklesmt2.com

    DNS Response

    172.67.148.20
    104.21.71.189

  • 8.8.8.8:53
    c.pki.goog
    dns
    HeraklesMT2.exe
    56 B
     107 B
     1
    1

    DNS Request

    c.pki.goog

    DNS Response

    172.217.169.67

  • 8.8.8.8:53
    crl.microsoft.com
    dns
    63 B
     162 B
     1
    1

    DNS Request

    crl.microsoft.com

    DNS Response

    2.19.117.22
    2.19.117.18

  • 8.8.8.8:53
    www.microsoft.com
    dns
    63 B
     230 B
     1
    1

    DNS Request

    www.microsoft.com

    DNS Response

    2.17.5.133

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2848-0-0x0000000074C6E000-0x0000000074C6F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2848-1-0x0000000000260000-0x00000000004AC000-memory.dmp

    Filesize

    2.3MB

    Download

  • memory/2848-2-0x0000000074C60000-0x000000007534E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2848-3-0x0000000004E40000-0x0000000004FD4000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/2848-4-0x0000000074C60000-0x000000007534E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2848-5-0x0000000074C60000-0x000000007534E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2848-22-0x0000000074C60000-0x000000007534E000-memory.dmp

    Filesize

    6.9MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.