Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
27/10/2024, 19:47 UTC
General
-
Target
273380e761312bb519d1a0774cdf7f1334e417fe23f90514c27e31f8104716d2N.exe
-
Size
3.6MB
-
MD5
48bac2dba6ccf491a0b5edae84d29d20
-
SHA1
3823d56b5097f9e748b1db2741dfb4bbc94b8ed3
-
SHA256
273380e761312bb519d1a0774cdf7f1334e417fe23f90514c27e31f8104716d2
-
SHA512
a66fb72f996f58df0f282786937424ab44120987a2f86b5c43012da9b41d8c9b9dd6549b8b5ab7919a3f81f1ddc9803f8da5ad89dc37606fe889f25497a85dc5
-
SSDEEP
49152:2nAQqMSPbcBVQej/1INRx+TSqTdX1HkQo6SAAWv:yDqPoBhz1aRxcSUDk36SA/
Score
10/10
Malware Config
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Wannacry family
-
Contacts a large (3194) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Executes dropped EXE 1 IoCs
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies data under HKEY_USERS 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\273380e761312bb519d1a0774cdf7f1334e417fe23f90514c27e31f8104716d2N.exe"C:\Users\Admin\AppData\Local\Temp\273380e761312bb519d1a0774cdf7f1334e417fe23f90514c27e31f8104716d2N.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
-
C:\WINDOWS\tasksche.exeC:\WINDOWS\tasksche.exe /i2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\273380e761312bb519d1a0774cdf7f1334e417fe23f90514c27e31f8104716d2N.exeC:\Users\Admin\AppData\Local\Temp\273380e761312bb519d1a0774cdf7f1334e417fe23f90514c27e31f8104716d2N.exe -m security1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
Network
-
DNS8.8.8.8.in-addr.arpaRemote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle -
DNSwww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comRemote address:8.8.8.8:53Requestwww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comIN AResponsewww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comIN A104.16.167.228www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comIN A104.16.166.228
-
GEThttp://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/Remote address:104.16.167.228:80RequestGET / HTTP/1.1
Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sun, 27 Oct 2024 19:48:17 GMT
Content-Type: text/html
Content-Length: 607
Connection: close
Server: cloudflare
CF-RAY: 8d9533ebfe53653e-LHR
-
GEThttp://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/Remote address:104.16.167.228:80RequestGET / HTTP/1.1
Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sun, 27 Oct 2024 19:48:18 GMT
Content-Type: text/html
Content-Length: 607
Connection: close
Server: cloudflare
CF-RAY: 8d9533ed2c9fcd0a-LHR
-
DNS133.211.185.52.in-addr.arpaRemote address:8.8.8.8:53Request133.211.185.52.in-addr.arpaIN PTRResponse
-
DNS228.167.16.104.in-addr.arpaRemote address:8.8.8.8:53Request228.167.16.104.in-addr.arpaIN PTRResponse
-
DNS79.190.18.2.in-addr.arpaRemote address:8.8.8.8:53Request79.190.18.2.in-addr.arpaIN PTRResponse79.190.18.2.in-addr.arpaIN PTRa2-18-190-79deploystaticakamaitechnologiescom
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS43.58.199.20.in-addr.arpaRemote address:8.8.8.8:53Request43.58.199.20.in-addr.arpaIN PTRResponse
-
DNS74.32.126.40.in-addr.arpaRemote address:8.8.8.8:53Request74.32.126.40.in-addr.arpaIN PTRResponse
-
DNS18.31.95.13.in-addr.arpaRequest18.31.95.13.in-addr.arpaIN PTRResponse
-
DNS197.87.175.4.in-addr.arpaRequest197.87.175.4.in-addr.arpaIN PTRResponse
-
DNS69.190.18.2.in-addr.arpaRequest69.190.18.2.in-addr.arpaIN PTRResponse69.190.18.2.in-addr.arpaIN PTRa2-18-190-69deploystaticakamaitechnologiescom
-
DNS142.225.26.195.in-addr.arpaRequest142.225.26.195.in-addr.arpaIN PTRResponse
-
DNS1.168.33.3.in-addr.arpaRequest1.168.33.3.in-addr.arpaIN PTRResponse1.168.33.3.in-addr.arpaIN PTRa10f5856389f73c80awsglobalacceleratorcom
-
DNS138.168.33.3.in-addr.arpaRequest138.168.33.3.in-addr.arpaIN PTRResponse138.168.33.3.in-addr.arpaIN PTRa2c8be2c2401f090bawsglobalacceleratorcom
-
DNS172.210.232.199.in-addr.arpaRequest172.210.232.199.in-addr.arpaIN PTRResponse
-
DNS1.249.127.147.in-addr.arpaRequest1.249.127.147.in-addr.arpaIN PTRResponse
-
DNS140.249.127.147.in-addr.arpaRequest140.249.127.147.in-addr.arpaIN PTRResponse
-
DNS48.229.111.52.in-addr.arpaRequest48.229.111.52.in-addr.arpaIN PTRResponse
-
DNS2.249.127.147.in-addr.arpaRequest2.249.127.147.in-addr.arpaIN PTRResponse
-
DNS2.168.33.3.in-addr.arpaRequest2.168.33.3.in-addr.arpaIN PTRResponse2.168.33.3.in-addr.arpaIN PTRa1f0e88c38ecea2e8awsglobalacceleratorcom
-
DNS212.214.54.34.in-addr.arpaRequest212.214.54.34.in-addr.arpaIN PTRResponse212.214.54.34.in-addr.arpaIN PTR2122145434bcgoogleusercontentcom
-
DNS2.214.54.34.in-addr.arpaRequest2.214.54.34.in-addr.arpaIN PTRResponse2.214.54.34.in-addr.arpaIN PTR22145434bcgoogleusercontentcom
-
DNStse1.mm.bing.netRequesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEax-0001.ax-msedge.netax-0001.ax-msedge.netIN A150.171.28.10ax-0001.ax-msedge.netIN A150.171.27.10
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239356819466_1PN1118HHI92HRAXE&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90RequestGET /th?id=OADD2.10239356819466_1PN1118HHI92HRAXE&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 978255
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 7080D1EDC36E4DEEB9E20193A65BE461 Ref B: LON601060103031 Ref C: 2024-10-27T19:49:58Z
date: Sun, 27 Oct 2024 19:49:57 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239360608910_1R4TEUG1LRQY39K7S&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90RequestGET /th?id=OADD2.10239360608910_1R4TEUG1LRQY39K7S&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 663065
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 017B1C17D21D40708FB4898030644B80 Ref B: LON601060103031 Ref C: 2024-10-27T19:49:58Z
date: Sun, 27 Oct 2024 19:49:57 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239360608909_1XWUMGMD2M0J0LDVR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90RequestGET /th?id=OADD2.10239360608909_1XWUMGMD2M0J0LDVR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 594481
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 081B84EA6C1F459AACECC748687D5969 Ref B: LON601060103031 Ref C: 2024-10-27T19:49:58Z
date: Sun, 27 Oct 2024 19:49:57 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239356819467_11XRGHD2R08E7TNPP&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90RequestGET /th?id=OADD2.10239356819467_11XRGHD2R08E7TNPP&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 885276
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 82A78575BC1A4428B3D67135A3B26387 Ref B: LON601060103031 Ref C: 2024-10-27T19:49:58Z
date: Sun, 27 Oct 2024 19:49:57 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239339388121_1PVG3IWOLFGR4FW9F&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90RequestGET /th?id=OADD2.10239339388121_1PVG3IWOLFGR4FW9F&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 525731
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: E19B93CAC21346119827360042791264 Ref B: LON601060103031 Ref C: 2024-10-27T19:49:58Z
date: Sun, 27 Oct 2024 19:49:57 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239339388122_1UI0S3FKTR1B3YGS8&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90RequestGET /th?id=OADD2.10239339388122_1UI0S3FKTR1B3YGS8&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
cache-control: public, max-age=2592000
content-length: 512695
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: D29C1CD2A7F54FB0BA915B5D3EE833A7 Ref B: LON601060103031 Ref C: 2024-10-27T19:49:59Z
date: Sun, 27 Oct 2024 19:49:58 GMT
-
DNS5.214.54.34.in-addr.arpaRequest5.214.54.34.in-addr.arpaIN PTRResponse5.214.54.34.in-addr.arpaIN PTR52145434bcgoogleusercontentcom
-
DNS7.214.54.34.in-addr.arpaRequest7.214.54.34.in-addr.arpaIN PTRResponse7.214.54.34.in-addr.arpaIN PTR72145434bcgoogleusercontentcom
-
DNS5.249.127.147.in-addr.arpaRequest5.249.127.147.in-addr.arpaIN PTRResponse
-
DNS8.214.54.34.in-addr.arpaRequest8.214.54.34.in-addr.arpaIN PTRResponse8.214.54.34.in-addr.arpaIN PTR82145434bcgoogleusercontentcom
-
DNS11.214.54.34.in-addr.arpaRequest11.214.54.34.in-addr.arpaIN PTRResponse11.214.54.34.in-addr.arpaIN PTR112145434bcgoogleusercontentcom
-
DNS12.214.54.34.in-addr.arpaRequest12.214.54.34.in-addr.arpaIN PTRResponse12.214.54.34.in-addr.arpaIN PTR122145434bcgoogleusercontentcom
-
DNS13.214.54.34.in-addr.arpaRequest13.214.54.34.in-addr.arpaIN PTRResponse13.214.54.34.in-addr.arpaIN PTR132145434bcgoogleusercontentcom
-
DNS14.214.54.34.in-addr.arpaRequest14.214.54.34.in-addr.arpaIN PTRResponse14.214.54.34.in-addr.arpaIN PTR142145434bcgoogleusercontentcom
-
DNS15.214.54.34.in-addr.arpaRequest15.214.54.34.in-addr.arpaIN PTRResponse15.214.54.34.in-addr.arpaIN PTR152145434bcgoogleusercontentcom
-
DNS85.225.26.195.in-addr.arpaRequest85.225.26.195.in-addr.arpaIN PTRResponse
-
DNS17.214.54.34.in-addr.arpaRequest17.214.54.34.in-addr.arpaIN PTRResponse17.214.54.34.in-addr.arpaIN PTR172145434bcgoogleusercontentcom
-
DNS17.214.54.34.in-addr.arpaRequest17.214.54.34.in-addr.arpaIN PTRResponse17.214.54.34.in-addr.arpaIN PTR172145434bcgoogleusercontentcom
-
DNS210.143.182.52.in-addr.arpaRequest210.143.182.52.in-addr.arpaIN PTRResponse
-
DNS210.143.182.52.in-addr.arpaRequest210.143.182.52.in-addr.arpaIN PTR
-
DNS18.214.54.34.in-addr.arpaRequest18.214.54.34.in-addr.arpaIN PTRResponse18.214.54.34.in-addr.arpaIN PTR182145434bcgoogleusercontentcom
-
DNS18.214.54.34.in-addr.arpaRequest18.214.54.34.in-addr.arpaIN PTRResponse18.214.54.34.in-addr.arpaIN PTR182145434bcgoogleusercontentcom
-
DNS4.168.33.3.in-addr.arpaRequest4.168.33.3.in-addr.arpaIN PTRResponse4.168.33.3.in-addr.arpaIN PTRa003c0ed3de5218ebawsglobalacceleratorcom
-
DNS4.168.33.3.in-addr.arpaRequest4.168.33.3.in-addr.arpaIN PTRResponse4.168.33.3.in-addr.arpaIN PTRa003c0ed3de5218ebawsglobalacceleratorcom
-
DNS19.214.54.34.in-addr.arpaRequest19.214.54.34.in-addr.arpaIN PTRResponse19.214.54.34.in-addr.arpaIN PTR192145434bcgoogleusercontentcom
-
DNS19.214.54.34.in-addr.arpaRequest19.214.54.34.in-addr.arpaIN PTRResponse19.214.54.34.in-addr.arpaIN PTR192145434bcgoogleusercontentcom
-
DNS94.225.26.195.in-addr.arpaRequest94.225.26.195.in-addr.arpaIN PTRResponse
-
DNS94.225.26.195.in-addr.arpaRequest94.225.26.195.in-addr.arpaIN PTRResponse
-
DNS20.214.54.34.in-addr.arpaRequest20.214.54.34.in-addr.arpaIN PTRResponse20.214.54.34.in-addr.arpaIN PTR202145434bcgoogleusercontentcom
-
DNS20.214.54.34.in-addr.arpaRequest20.214.54.34.in-addr.arpaIN PTRResponse20.214.54.34.in-addr.arpaIN PTR202145434bcgoogleusercontentcom
-
DNS7.249.127.147.in-addr.arpaRequest7.249.127.147.in-addr.arpaIN PTRResponse
-
DNS7.249.127.147.in-addr.arpaRequest7.249.127.147.in-addr.arpaIN PTRResponse
-
DNS133.17.8.211.in-addr.arpaRequest133.17.8.211.in-addr.arpaIN PTRResponse
-
DNS133.17.8.211.in-addr.arpaRequest133.17.8.211.in-addr.arpaIN PTRResponse
-
DNS21.214.54.34.in-addr.arpaRequest21.214.54.34.in-addr.arpaIN PTRResponse21.214.54.34.in-addr.arpaIN PTR212145434bcgoogleusercontentcom
-
DNS21.214.54.34.in-addr.arpaRequest21.214.54.34.in-addr.arpaIN PTRResponse21.214.54.34.in-addr.arpaIN PTR212145434bcgoogleusercontentcom
-
104.16.167.228:80http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/http
HTTP Request
GET http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/HTTP Response
200 -
104.16.167.228:80http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/http
HTTP Request
GET http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/HTTP Response
200 -
176.208.163.121:445 -
10.127.0.1:445 -
10.127.2.1:445
-
10.127.1.1:445
-
10.127.6.1:445
-
10.127.10.1:445
-
10.127.4.1:445
-
10.127.3.1:445
-
10.127.5.1:445
-
10.127.7.1:445
-
10.127.8.1:445
-
10.127.9.1:445
-
10.127.11.1:445
-
10.127.12.1:445
-
73.27.98.179:445
-
10.127.13.1:445
-
10.127.14.1:445
-
10.127.15.1:445
-
10.127.16.1:445
-
10.127.17.1:445
-
10.127.18.1:445
-
10.127.19.1:445
-
10.127.20.1:445
-
10.127.21.1:445
-
170.154.64.93:445
-
10.127.22.1:445
-
98.211.70.177:445
-
10.127.23.1:445
-
10.127.25.1:445
-
10.127.26.1:445
-
10.127.24.1:445
-
10.127.27.1:445
-
10.127.29.1:445
-
10.127.30.1:445
-
10.127.28.1:445
-
10.127.31.1:445
-
10.127.32.1:445
-
10.127.33.1:445
-
209.99.90.115:445
-
10.127.34.1:445
-
10.127.35.1:445
-
145.254.12.148:445 -
10.127.36.1:445
-
10.127.37.1:445
-
10.127.38.1:445
-
10.127.39.1:445
-
140.177.109.155:445
-
10.127.40.1:445
-
10.127.43.1:445
-
198.27.191.58:445
-
10.127.41.1:445
-
192.188.115.38:445 -
10.127.42.1:445
-
10.127.48.1:445
-
10.127.45.1:445
-
10.127.44.1:445
-
10.127.47.1:445
-
10.127.51.1:445
-
10.127.49.1:445
-
10.127.46.1:445
-
10.127.50.1:445
-
10.127.52.1:445
-
10.127.53.1:445
-
10.127.54.1:445
-
10.127.55.1:445
-
154.197.49.243:445 -
10.127.56.1:445
-
52.114.49.239:445 -
10.127.57.1:445
-
175.186.96.214:445 -
10.127.58.1:445
-
10.127.60.1:445
-
158.28.176.250:445
-
10.127.61.1:445
-
10.127.59.1:445
-
10.127.66.1:445
-
162.201.177.28:445
-
10.127.64.1:445
-
84.12.241.236:445 -
10.127.62.1:445
-
10.127.63.1:445
-
10.127.68.1:445
-
10.127.65.1:445
-
10.127.67.1:445
-
133.187.26.104:445 -
10.127.69.1:445
-
10.127.70.1:445
-
10.127.71.1:445
-
10.127.72.1:445
-
10.127.73.1:445
-
10.127.74.1:445
-
204.176.6.122:445
-
10.127.75.1:445
-
10.127.76.1:445
-
10.127.77.1:445
-
47.180.10.132:445
-
10.127.78.1:445
-
160.51.229.80:445
-
10.127.79.1:445
-
218.181.176.176:445
-
178.83.88.196:445 -
10.127.80.1:445
-
148.201.202.51:445 -
10.127.81.1:445
-
10.127.86.1:445
-
57.111.237.163:445
-
10.127.83.1:445
-
10.127.87.1:445
-
10.127.88.1:445
-
10.127.84.1:445
-
10.127.82.1:445
-
175.23.239.40:445
-
10.127.85.1:445
-
56.31.178.179:445
-
10.127.89.1:445
-
10.127.91.1:445
-
10.127.92.1:445
-
10.127.90.1:445
-
10.127.93.1:445
-
10.127.94.1:445
-
52.118.73.13:445
-
10.127.95.1:445
-
10.127.96.1:445
-
10.127.97.1:445
-
137.77.134.205:445
-
10.127.98.1:445
-
18.54.238.239:445
-
10.127.99.1:445
-
49.18.173.63:445
-
53.156.81.107:445
-
37.30.70.6:445 -
10.127.102.1:445
-
10.127.101.1:445
-
113.59.11.143:445
-
10.127.104.1:445
-
10.127.100.1:445
-
83.30.188.175:445
-
10.127.108.1:445
-
10.127.105.1:445
-
10.127.110.1:445
-
10.127.103.1:445
-
10.127.107.1:445
-
85.186.236.179:445 -
39.107.173.205:445
-
10.127.106.1:445
-
10.127.113.1:445
-
14.24.158.204:445
-
10.127.109.1:445
-
10.127.111.1:445
-
10.127.112.1:445
-
10.127.114.1:445
-
10.127.115.1:445
-
217.69.109.5:445 -
10.127.116.1:445
-
10.127.117.1:445
-
22.63.91.36:445
-
10.127.118.1:445
-
147.154.133.26:445
-
10.127.119.1:445
-
10.127.121.1:445
-
208.215.254.124:445
-
10.127.120.1:445
-
10.127.124.1:445
-
89.173.92.158:445 -
107.17.254.22:445
-
10.127.123.1:445
-
124.12.123.203:445 -
181.133.191.18:445 -
10.127.122.1:445
-
137.232.66.41:445
-
10.127.126.1:445
-
10.127.125.1:445
-
165.62.195.22:445 -
10.127.128.1:445
-
10.127.127.1:445
-
5.182.245.15:445 -
10.127.134.1:445
-
10.127.132.1:445
-
10.127.133.1:445
-
10.127.129.1:445
-
213.182.71.105:445 -
135.104.203.141:445
-
10.127.130.1:445
-
10.127.131.1:445
-
10.127.135.1:445
-
10.127.136.1:445
-
10.127.137.1:445
-
10.127.138.1:445
-
26.77.131.217:445
-
81.225.201.103:445 -
10.127.139.1:445
-
167.64.205.86:445
-
35.103.48.210:445
-
10.127.140.1:445
-
80.84.166.45:445 -
98.78.225.164:445
-
10.127.142.1:445
-
10.127.144.1:445
-
26.189.217.139:445
-
10.127.143.1:445
-
10.127.145.1:445
-
98.213.27.162:445
-
10.127.141.1:445
-
10.127.146.1:445
-
153.178.173.156:445
-
82.35.41.92:445
-
10.127.150.1:445
-
10.127.151.1:445
-
10.127.147.1:445
-
113.40.182.58:445
-
108.197.160.142:445
-
10.127.148.1:445
-
10.127.154.1:445
-
10.127.149.1:445
-
10.127.155.1:445
-
201.165.31.0:445
-
17.64.110.164:445 -
10.127.152.1:445
-
10.127.153.1:445
-
10.127.156.1:445
-
10.127.157.1:445
-
10.127.158.1:445
-
90.118.211.154:445 -
88.164.185.50:445
-
10.127.159.1:445
-
95.244.12.183:445
-
76.201.127.238:445
-
10.127.160.1:445
-
110.74.219.248:445 -
215.131.109.202:445
-
214.81.253.126:445
-
10.127.162.1:445
-
10.127.164.1:445
-
84.234.188.29:445 -
2.163.149.21:445
-
10.127.161.1:445
-
10.127.166.1:445
-
14.109.101.72:445
-
10.127.168.1:445
-
28.214.18.165:445
-
10.127.163.1:445
-
10.127.165.1:445
-
10.127.167.1:445
-
10.127.170.1:445
-
110.196.109.190:445
-
76.252.121.220:445
-
10.127.173.1:445
-
79.119.16.20:445
-
10.127.171.1:445
-
10.127.172.1:445
-
10.127.169.1:445
-
23.96.126.117:445
-
113.188.111.249:445 -
10.127.174.1:445
-
10.127.175.1:445
-
10.127.176.1:445
-
10.127.177.1:445
-
10.127.178.1:445
-
10.127.179.1:445
-
111.18.245.20:445
-
12.162.113.197:445
-
192.210.127.49:445 -
190.202.245.180:445 -
10.127.181.1:445
-
60.124.41.112:445
-
214.7.15.58:445
-
10.127.180.1:445
-
204.132.61.146:445
-
126.82.11.55:445
-
10.127.183.1:445
-
10.127.182.1:445
-
10.127.185.1:445
-
77.24.19.181:445
-
190.237.138.94:445 -
18.104.82.111:445
-
10.127.184.1:445
-
202.136.40.7:445
-
10.127.186.1:445
-
7.133.95.217:445
-
202.73.73.153:445
-
10.127.192.1:445
-
10.127.190.1:445
-
10.127.188.1:445
-
10.127.193.1:445
-
10.127.187.1:445
-
27.219.46.131:445
-
29.206.139.101:445
-
10.127.191.1:445
-
10.127.189.1:445
-
10.127.194.1:445
-
222.59.35.242:445
-
144.162.151.109:445
-
10.127.195.1:445
-
10.127.196.1:445
-
10.127.197.1:445
-
10.127.198.1:445
-
10.127.199.1:445
-
10.127.200.1:445
-
215.106.105.116:445
-
194.116.109.177:445
-
176.74.13.103:445
-
135.41.247.65:445
-
10.127.203.1:445
-
10.127.204.1:445
-
213.13.51.16:445 -
130.33.37.230:445
-
10.127.201.1:445
-
10.127.202.1:445
-
168.206.133.113:445
-
158.117.31.176:445
-
115.144.174.22:445
-
10.127.206.1:445
-
193.110.60.44:445 -
133.5.175.92:445
-
10.127.209.1:445
-
10.127.210.1:445
-
2.32.9.62:445
-
90.68.240.16:445 -
10.127.205.1:445
-
10.127.208.1:445
-
10.127.207.1:445
-
10.127.211.1:445
-
137.203.104.186:445
-
44.3.86.157:445
-
174.182.157.16:445
-
195.206.166.215:445
-
10.127.214.1:445
-
10.127.213.1:445
-
96.143.176.107:445
-
76.131.232.201:445
-
13.149.83.171:445
-
10.127.216.1:445
-
10.127.212.1:445
-
10.127.215.1:445
-
10.127.217.1:445
-
10.127.218.1:445
-
10.127.219.1:445
-
10.127.220.1:445
-
112.138.62.30:445
-
1.102.210.190:445
-
10.127.222.1:445
-
168.110.243.130:445
-
9.225.244.145:445
-
111.128.2.142:445
-
166.116.240.24:445
-
10.127.223.1:445
-
154.164.156.251:445 -
34.118.47.23:445
-
10.127.227.1:445
-
10.127.221.1:445
-
169.237.59.53:445
-
10.127.225.1:445
-
9.190.213.65:445
-
192.212.230.122:445
-
104.36.34.199:445
-
10.127.224.1:445
-
10.127.229.1:445
-
10.127.226.1:445
-
10.127.228.1:445
-
170.228.215.188:445
-
88.190.238.235:445
-
10.127.232.1:445
-
10.127.231.1:445
-
70.225.91.234:445
-
49.12.8.18:445
-
10.127.230.1:445
-
10.127.234.1:445
-
10.127.235.1:445
-
78.168.222.5:445
-
105.183.114.23:445 -
10.127.236.1:445
-
10.127.233.1:445
-
64.128.130.254:445
-
154.202.231.229:445
-
80.160.179.128:445 -
10.127.240.1:445
-
79.252.22.114:445
-
10.127.237.1:445
-
10.127.238.1:445
-
10.127.239.1:445
-
219.164.172.16:445
-
209.47.3.23:445
-
10.127.241.1:445
-
137.224.171.202:445
-
47.158.88.169:445
-
175.98.234.99:445
-
63.42.193.173:445
-
10.127.242.1:445
-
10.127.244.1:445
-
10.127.243.1:445
-
10.127.248.1:445
-
91.110.225.132:445
-
65.109.102.226:445 -
149.19.176.167:445
-
10.127.247.1:445
-
170.155.152.21:445 -
201.59.116.117:445 -
145.1.26.22:445
-
10.127.249.1:445
-
10.127.245.1:445
-
10.127.246.1:445
-
10.127.250.1:445
-
10.127.251.1:445
-
16.29.183.87:445 -
221.66.133.34:445
-
175.52.50.78:445
-
10.127.252.1:445
-
10.127.253.1:445
-
10.127.254.1:445
-
40.42.177.50:445
-
170.208.1.71:445
-
10.127.255.1:445
-
10.127.0.2:445
-
10.127.1.2:445
-
98.53.93.89:445
-
172.220.195.69:445
-
10.127.2.2:445
-
10.127.3.2:445
-
10.127.4.2:445
-
68.173.57.143:445
-
184.59.73.247:445
-
60.172.183.222:445
-
10.127.5.2:445
-
10.127.6.2:445
-
37.80.172.7:445
-
40.177.221.8:445
-
43.81.169.68:445 -
215.135.246.224:445
-
159.104.160.78:445
-
166.119.3.124:445
-
10.127.7.2:445
-
186.107.130.222:445 -
128.184.211.22:445
-
10.127.8.2:445
-
170.57.178.34:445
-
63.237.173.40:445
-
215.215.21.228:445
-
10.127.9.2:445
-
10.127.11.2:445
-
157.121.216.12:445
-
11.168.234.179:445
-
179.187.96.61:445
-
10.127.10.2:445
-
10.127.12.2:445
-
10.127.13.2:445
-
10.127.14.2:445
-
10.127.15.2:445
-
10.127.16.2:445
-
10.127.17.2:445
-
23.115.116.0:445
-
31.66.94.6:445
-
22.123.201.95:445
-
10.127.18.2:445
-
55.92.125.92:445
-
52.36.151.71:445
-
168.77.50.160:445 -
10.127.19.2:445
-
10.127.20.2:445
-
124.106.24.87:445 -
159.166.3.16:445
-
10.127.21.2:445
-
10.127.22.2:445
-
10.127.23.2:445
-
98.215.158.183:445
-
215.146.165.25:445
-
10.127.24.2:445
-
207.43.127.212:445
-
10.127.25.2:445
-
10.127.26.2:445
-
10.127.27.2:445
-
186.12.38.28:445
-
48.73.84.81:445
-
90.225.76.209:445
-
10.127.28.2:445
-
136.225.36.60:445
-
139.249.203.237:445
-
111.205.219.91:445
-
86.73.146.88:445
-
193.223.219.118:445
-
150.167.195.131:445
-
87.73.19.107:445
-
163.31.241.116:445
-
18.23.86.253:445
-
10.127.32.2:445
-
10.127.29.2:445
-
117.86.162.125:445
-
162.18.39.215:445
-
169.119.115.18:445
-
10.127.35.2:445
-
10.127.30.2:445
-
8.8.8.8:538.8.8.8.in-addr.arpadns
DNS Request
8.8.8.8.in-addr.arpa
-
8.8.8.8:53www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comdns
DNS Request
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
DNS Response
104.16.167.228104.16.166.228
-
8.8.8.8:53133.211.185.52.in-addr.arpadns
DNS Request
133.211.185.52.in-addr.arpa
-
8.8.8.8:53228.167.16.104.in-addr.arpadns
DNS Request
228.167.16.104.in-addr.arpa
-
8.8.8.8:5379.190.18.2.in-addr.arpadns
DNS Request
79.190.18.2.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:5343.58.199.20.in-addr.arpadns
DNS Request
43.58.199.20.in-addr.arpa
-
8.8.8.8:5374.32.126.40.in-addr.arpadns
DNS Request
74.32.126.40.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD5c797b112f8515cf959877216fe253696
SHA1760ae44bdb27e508076cd6918001c883348d362d
SHA2561dd21be7469718e50e735d169b2207f2d99aefe0429d1bd19367af45c13e88a3
SHA512c06ed43e9fc02933485f5bba3ff7a21089cf281b089ae49ab65d26c6cfa3086db908a914ff401c6951b69ba9fc944cd13029ee8fc0e928c20cc65edd98b98b6b