Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10/11/2024, 14:24 UTC
General
-
Target
2024-11-10_0ba0bc85f73eaff3c610778d903048d4_wannacry.exe
-
Size
5.0MB
-
MD5
0ba0bc85f73eaff3c610778d903048d4
-
SHA1
476be04618e16f5876c2cb3ee0cb43c6a3c85779
-
SHA256
cf3494f6313f1b474cc1c261a1cf94d1095212c62ed19a5ae16d9ab9fec5e57d
-
SHA512
d43419db90c9e4fb1f4c89958803feafe68fc8f962f2ca543a33f3a1954146f446f5a35dfea715f699c95acb0b2763ab26ecebb07542735dbc4c16204b798f19
-
SSDEEP
98304:SDqPoBt1aRxcSUDk36SAEdhvxWa9P593R+:SDqPO1Cxcxk3ZAEUadzR
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 4 IoCs
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Wannacry family
-
Contacts a large (3193) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Drops file in Windows directory 1 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies data under HKEY_USERS 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious behavior: MapViewOfSection 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵
-
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding2⤵
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵
-
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵
-
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca2⤵
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵
-
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider2⤵
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
-
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe2⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-11-10_0ba0bc85f73eaff3c610778d903048d4_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-10_0ba0bc85f73eaff3c610778d903048d4_wannacry.exe"2⤵
- Modifies firewall policy service
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 14403⤵
- Program crash
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\2024-11-10_0ba0bc85f73eaff3c610778d903048d4_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2024-11-10_0ba0bc85f73eaff3c610778d903048d4_wannacry.exe -m security1⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 1680 -ip 16801⤵
Network
-
DNSilo.brenz.plRemote address:8.8.8.8:53Requestilo.brenz.plIN AResponse -
DNSant.trenz.plRemote address:8.8.8.8:53Requestant.trenz.plIN AResponse
-
DNSwww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comRemote address:8.8.8.8:53Requestwww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comIN AResponsewww.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comIN A104.16.167.228www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comIN A104.16.166.228
-
GEThttp://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/Remote address:104.16.167.228:80RequestGET / HTTP/1.1
Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sun, 10 Nov 2024 14:24:12 GMT
Content-Type: text/html
Content-Length: 607
Connection: close
Server: cloudflare
CF-RAY: 8e06b470984776f5-LHR
-
DNS8.8.8.8.in-addr.arpaRemote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
DNS196.249.167.52.in-addr.arpaRemote address:8.8.8.8:53Request196.249.167.52.in-addr.arpaIN PTRResponse
-
GEThttp://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/Remote address:104.16.167.228:80RequestGET / HTTP/1.1
Host: www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Date: Sun, 10 Nov 2024 14:24:13 GMT
Content-Type: text/html
Content-Length: 607
Connection: close
Server: cloudflare
CF-RAY: 8e06b4739d8993f0-LHR
-
DNS88.210.23.2.in-addr.arpaRemote address:8.8.8.8:53Request88.210.23.2.in-addr.arpaIN PTRResponse88.210.23.2.in-addr.arpaIN PTRa2-23-210-88deploystaticakamaitechnologiescom
-
DNS228.167.16.104.in-addr.arpaRemote address:8.8.8.8:53Request228.167.16.104.in-addr.arpaIN PTRResponse
-
DNS17.160.190.20.in-addr.arpaRemote address:8.8.8.8:53Request17.160.190.20.in-addr.arpaIN PTRResponse
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS209.205.72.20.in-addr.arpaRemote address:8.8.8.8:53Request209.205.72.20.in-addr.arpaIN PTRResponse
-
DNS104.219.191.52.in-addr.arpaRemote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse
-
DNS200.163.202.172.in-addr.arpaRequest200.163.202.172.in-addr.arpaIN PTRResponse
-
DNS206.23.85.13.in-addr.arpaRequest206.23.85.13.in-addr.arpaIN PTRResponse
-
DNS172.214.232.199.in-addr.arpaRequest172.214.232.199.in-addr.arpaIN PTRResponse
-
DNS220.35.22.5.in-addr.arpaRequest220.35.22.5.in-addr.arpaIN PTRResponse
-
DNS1.35.22.5.in-addr.arpaRequest1.35.22.5.in-addr.arpaIN PTRResponse
-
DNS2.35.22.5.in-addr.arpaRequest2.35.22.5.in-addr.arpaIN PTRResponse
-
DNS94.8.30.152.in-addr.arpaRequest94.8.30.152.in-addr.arpaIN PTRResponse
-
DNS2.8.30.152.in-addr.arpaRequest2.8.30.152.in-addr.arpaIN PTRResponse
-
DNS140.233.41.39.in-addr.arpaRequest140.233.41.39.in-addr.arpaIN PTRResponse
-
DNS99.12.39.39.in-addr.arpaRequest99.12.39.39.in-addr.arpaIN PTRResponse
-
DNS189.115.149.34.in-addr.arpaRequest189.115.149.34.in-addr.arpaIN PTRResponse189.115.149.34.in-addr.arpaIN PTR18911514934bcgoogleusercontentcom
-
DNS2.115.149.34.in-addr.arpaRequest2.115.149.34.in-addr.arpaIN PTRResponse2.115.149.34.in-addr.arpaIN PTR211514934bcgoogleusercontentcom
-
DNS3.8.30.152.in-addr.arpaRequest3.8.30.152.in-addr.arpaIN PTRResponse
-
DNS3.115.149.34.in-addr.arpaRequest3.115.149.34.in-addr.arpaIN PTRResponse3.115.149.34.in-addr.arpaIN PTR311514934bcgoogleusercontentcom
-
DNS4.115.149.34.in-addr.arpaRequest4.115.149.34.in-addr.arpaIN PTRResponse4.115.149.34.in-addr.arpaIN PTR411514934bcgoogleusercontentcom
-
DNS3.35.22.5.in-addr.arpaRequest3.35.22.5.in-addr.arpaIN PTRResponse
-
DNS7.115.149.34.in-addr.arpaRequest7.115.149.34.in-addr.arpaIN PTRResponse7.115.149.34.in-addr.arpaIN PTR711514934bcgoogleusercontentcom
-
DNS19.12.39.39.in-addr.arpaRequest19.12.39.39.in-addr.arpaIN PTRResponse
-
DNS139.203.94.192.in-addr.arpaRequest139.203.94.192.in-addr.arpaIN PTRResponse139.203.94.192.in-addr.arpaIN PTRvbnet-rdvpn-i1venablecom
-
DNS8.115.149.34.in-addr.arpaRequest8.115.149.34.in-addr.arpaIN PTRResponse8.115.149.34.in-addr.arpaIN PTR811514934bcgoogleusercontentcom
-
DNS9.115.149.34.in-addr.arpaRequest9.115.149.34.in-addr.arpaIN PTRResponse9.115.149.34.in-addr.arpaIN PTR911514934bcgoogleusercontentcom
-
104.16.167.228:80http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/http
HTTP Request
GET http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/HTTP Response
200 -
83.133.119.197:80 -
83.133.119.197:80
-
104.16.167.228:80http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/http
HTTP Request
GET http://www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com/HTTP Response
200 -
136.70.100.147:445
-
10.127.0.1:445 -
10.127.1.1:445
-
10.127.6.1:445
-
10.127.2.1:445
-
10.127.3.1:445
-
10.127.4.1:445
-
10.127.5.1:445
-
10.127.7.1:445
-
10.127.8.1:445
-
10.127.9.1:445
-
10.127.10.1:445
-
79.205.71.17:445
-
10.127.11.1:445
-
10.127.12.1:445
-
10.127.13.1:445
-
10.127.14.1:445
-
10.127.15.1:445
-
10.127.20.1:445
-
10.127.17.1:445
-
82.73.167.68:445 -
10.127.16.1:445
-
10.127.21.1:445
-
10.127.19.1:445
-
95.154.241.127:445 -
10.127.18.1:445
-
10.127.22.1:445
-
10.127.23.1:445
-
10.127.24.1:445
-
10.127.25.1:445
-
10.127.26.1:445
-
10.127.27.1:445
-
10.127.28.1:445
-
10.127.29.1:445
-
10.127.30.1:445
-
10.127.31.1:445
-
10.127.32.1:445
-
20.155.209.51:445
-
72.243.178.58:445
-
10.127.35.1:445
-
10.127.36.1:445
-
10.127.33.1:445
-
10.127.40.1:445
-
10.127.38.1:445
-
10.127.34.1:445
-
134.181.250.87:445
-
10.127.42.1:445
-
10.127.37.1:445
-
51.119.186.52:445 -
10.127.43.1:445
-
10.127.39.1:445
-
3.35.75.232:445 -
10.127.41.1:445
-
10.127.44.1:445
-
10.127.45.1:445
-
10.127.46.1:445
-
10.127.47.1:445
-
10.127.48.1:445
-
10.127.49.1:445
-
10.127.50.1:445
-
10.127.51.1:445
-
10.127.52.1:445
-
10.127.53.1:445
-
10.127.54.1:445
-
194.122.90.157:445
-
121.47.19.194:445 -
10.127.59.1:445
-
182.141.90.115:445
-
10.127.55.1:445
-
10.127.61.1:445
-
10.127.56.1:445
-
10.127.58.1:445
-
10.127.60.1:445
-
10.127.63.1:445
-
52.252.67.181:445
-
10.127.57.1:445
-
4.100.48.243:445
-
10.127.65.1:445
-
10.127.62.1:445
-
10.127.64.1:445
-
135.124.113.24:445
-
10.127.70.1:445
-
10.127.66.1:445
-
10.127.67.1:445
-
10.127.68.1:445
-
10.127.69.1:445
-
10.127.71.1:445
-
2.23.40.26:445 -
10.127.72.1:445
-
10.127.73.1:445
-
10.127.74.1:445
-
10.127.75.1:445
-
10.127.76.1:445
-
215.241.133.14:445
-
10.127.77.1:445
-
38.108.154.81:445
-
15.31.213.161:445
-
10.127.78.1:445
-
10.127.81.1:445
-
10.127.80.1:445
-
206.31.86.187:445
-
184.125.35.95:445
-
10.127.79.1:445
-
10.127.83.1:445
-
10.127.82.1:445
-
10.127.84.1:445
-
115.177.170.81:445 -
10.127.85.1:445
-
10.127.87.1:445
-
32.180.200.89:445
-
10.127.90.1:445
-
10.127.86.1:445
-
10.127.91.1:445
-
10.127.88.1:445
-
10.127.89.1:445
-
10.127.92.1:445
-
10.127.93.1:445
-
10.127.94.1:445
-
186.113.138.204:445 -
10.127.95.1:445
-
10.127.96.1:445
-
10.127.97.1:445
-
67.9.207.62:445
-
10.127.98.1:445
-
8.244.77.248:445
-
107.252.168.37:445
-
10.127.99.1:445
-
10.127.102.1:445
-
10.127.101.1:445
-
10.127.100.1:445
-
141.154.63.52:445
-
10.127.106.1:445
-
10.127.103.1:445
-
10.127.108.1:445
-
167.137.232.57:445
-
124.110.147.27:445
-
10.127.104.1:445
-
121.164.127.213:445
-
32.126.139.245:445
-
10.127.107.1:445
-
10.127.111.1:445
-
10.127.105.1:445
-
10.127.109.1:445
-
166.87.117.208:445 -
10.127.110.1:445
-
10.127.112.1:445
-
10.127.113.1:445
-
10.127.114.1:445
-
10.127.115.1:445
-
10.127.116.1:445
-
10.127.117.1:445
-
10.127.118.1:445
-
10.127.119.1:445
-
26.100.123.61:445
-
10.127.120.1:445
-
74.123.30.36:445
-
109.81.119.163:445 -
190.252.76.218:445
-
10.127.121.1:445
-
10.127.122.1:445
-
120.146.51.16:445 -
10.127.124.1:445
-
10.127.126.1:445
-
67.186.115.39:445
-
10.127.123.1:445
-
10.127.127.1:445
-
10.127.129.1:445
-
152.249.17.182:445 -
104.139.216.49:445
-
51.244.74.109:445
-
83.179.127.138:445 -
10.127.128.1:445
-
10.127.130.1:445
-
10.127.125.1:445
-
120.136.187.143:445
-
10.127.131.1:445
-
68.165.128.171:445
-
10.127.133.1:445
-
10.127.132.1:445
-
10.127.134.1:445
-
10.127.135.1:445
-
10.127.136.1:445
-
10.127.137.1:445
-
10.127.138.1:445
-
10.127.139.1:445
-
10.127.140.1:445
-
111.94.210.66:445 -
10.127.141.1:445
-
10.127.142.1:445
-
29.110.31.90:445
-
40.234.39.126:445
-
66.11.28.72:445
-
11.40.208.11:445
-
161.5.156.14:445 -
10.127.146.1:445
-
80.36.210.174:445 -
10.127.143.1:445
-
10.127.144.1:445
-
93.5.250.231:445 -
17.168.224.145:445
-
10.127.153.1:445
-
10.127.147.1:445
-
10.127.145.1:445
-
10.127.149.1:445
-
149.218.129.140:445 -
186.99.93.133:445
-
10.127.148.1:445
-
10.127.151.1:445
-
10.127.150.1:445
-
105.222.58.61:445 -
205.181.144.191:445
-
10.127.152.1:445
-
10.127.158.1:445
-
154.82.128.91:445 -
10.127.154.1:445
-
10.127.155.1:445
-
10.127.156.1:445
-
10.127.157.1:445
-
10.127.159.1:445
-
10.127.160.1:445
-
10.127.161.1:445
-
10.127.162.1:445
-
10.2.225.247:445
-
10.127.163.1:445
-
10.127.164.1:445
-
210.67.112.166:445 -
119.180.185.202:445
-
38.6.9.100:445
-
76.52.123.203:445
-
57.157.2.114:445
-
96.234.211.38:445
-
10.127.167.1:445
-
10.127.165.1:445
-
120.202.232.86:445
-
10.127.166.1:445
-
10.127.168.1:445
-
183.161.13.89:445
-
192.215.144.89:445
-
10.127.172.1:445
-
145.60.101.216:445 -
113.29.3.167:445
-
10.127.169.1:445
-
10.127.170.1:445
-
213.0.6.6:445
-
10.127.171.1:445
-
182.193.158.251:445
-
10.127.173.1:445
-
10.127.176.1:445
-
10.127.174.1:445
-
184.153.88.128:445
-
76.56.188.81:445
-
10.127.175.1:445
-
10.127.178.1:445
-
10.127.177.1:445
-
10.127.179.1:445
-
10.127.180.1:445
-
10.127.181.1:445
-
10.127.182.1:445
-
10.127.183.1:445
-
216.48.116.242:445
-
10.127.184.1:445
-
10.127.185.1:445
-
10.127.186.1:445
-
200.126.25.131:445 -
221.47.5.56:445
-
167.189.118.170:445
-
36.28.83.233:445
-
125.56.248.139:445
-
116.241.0.96:445
-
150.201.37.30:445
-
131.136.15.3:445 -
10.127.194.1:445
-
10.127.188.1:445
-
10.127.190.1:445
-
10.127.193.1:445
-
21.180.199.122:445
-
209.56.155.15:445
-
10.127.195.1:445
-
10.127.191.1:445
-
9.27.254.148:445
-
133.177.70.43:445
-
10.127.196.1:445
-
10.127.189.1:445
-
170.118.146.59:445
-
60.41.165.45:445
-
10.127.192.1:445
-
10.127.187.1:445
-
116.29.53.140:445
-
66.158.162.60:445
-
10.127.197.1:445
-
10.127.198.1:445
-
10.127.199.1:445
-
10.127.200.1:445
-
10.127.201.1:445
-
10.127.202.1:445
-
10.127.203.1:445
-
10.127.204.1:445
-
10.127.205.1:445
-
37.112.155.129:445
-
142.210.73.215:445
-
10.127.206.1:445
-
10.127.207.1:445
-
10.127.208.1:445
-
51.236.82.212:445
-
25.22.217.223:445
-
216.67.213.208:445
-
46.80.47.87:445
-
10.127.209.1:445
-
10.127.210.1:445
-
68.49.24.116:445
-
219.138.14.205:445
-
10.127.213.1:445
-
220.205.125.174:445
-
189.61.11.172:445
-
10.127.214.1:445
-
10.127.216.1:445
-
23.110.67.87:445
-
198.156.129.17:445
-
116.62.215.188:445
-
10.127.212.1:445
-
10.127.211.1:445
-
66.178.200.69:445
-
109.251.55.134:445 -
175.14.159.0:445
-
172.52.203.85:445
-
10.127.215.1:445
-
10.127.218.1:445
-
188.241.54.66:445 -
87.105.150.97:445 -
10.127.217.1:445
-
10.127.223.1:445
-
10.127.219.1:445
-
10.127.220.1:445
-
10.127.221.1:445
-
10.127.222.1:445
-
10.127.224.1:445
-
10.127.225.1:445
-
10.127.226.1:445
-
10.127.227.1:445
-
30.26.133.233:445
-
10.127.228.1:445
-
30.82.160.214:445
-
10.127.229.1:445
-
10.127.230.1:445
-
79.90.230.50:445
-
96.169.22.196:445
-
13.204.169.34:445
-
210.61.134.123:445
-
71.95.50.153:445
-
10.127.231.1:445
-
219.174.189.83:445
-
66.230.92.187:445
-
22.211.133.125:445
-
176.108.246.206:445
-
10.127.233.1:445
-
9.88.220.36:445
-
114.76.72.22:445
-
10.127.235.1:445
-
61.29.36.147:445
-
10.127.239.1:445
-
10.127.238.1:445
-
180.87.109.166:445 -
150.181.212.189:445
-
10.127.232.1:445
-
150.249.2.175:445
-
10.127.240.1:445
-
10.127.234.1:445
-
216.5.247.166:445
-
211.190.133.149:445
-
10.127.241.1:445
-
10.127.236.1:445
-
10.127.237.1:445
-
10.127.244.1:445
-
17.192.97.193:445
-
12.29.240.111:445
-
10.127.245.1:445
-
10.127.247.1:445
-
10.127.242.1:445
-
10.127.243.1:445
-
10.127.246.1:445
-
10.127.248.1:445
-
10.127.249.1:445
-
211.173.194.22:445
-
40.213.226.175:445
-
10.127.250.1:445
-
10.127.251.1:445
-
137.48.220.206:445
-
137.14.117.127:445
-
50.202.188.99:445
-
32.80.168.8:445
-
189.85.117.95:445
-
162.136.29.63:445
-
84.125.53.59:445
-
193.244.1.230:445
-
10.127.252.1:445
-
184.180.48.147:445
-
112.199.138.168:445
-
10.127.1.2:445
-
10.127.253.1:445
-
213.192.34.199:445
-
215.209.251.189:445
-
203.232.239.153:445
-
10.127.4.2:445
-
103.148.174.79:445
-
10.127.255.1:445
-
31.137.26.162:445
-
10.127.254.1:445
-
10.127.2.2:445
-
62.21.220.190:445
-
10.127.0.2:445
-
10.127.3.2:445
-
166.21.223.176:445
-
138.43.97.21:445 -
136.51.122.137:445
-
10.127.5.2:445
-
8.215.15.93:445
-
221.40.120.244:445
-
10.127.7.2:445
-
10.127.6.2:445
-
67.239.104.219:445
-
192.76.243.187:445
-
10.127.8.2:445
-
10.127.9.2:445
-
10.127.10.2:445
-
10.127.11.2:445
-
10.127.12.2:445
-
10.127.13.2:445
-
10.127.14.2:445
-
10.127.15.2:445
-
10.127.16.2:445
-
10.127.17.2:445
-
45.75.23.198:445
-
153.116.113.54:445
-
2.89.17.110:445 -
10.127.18.2:445
-
106.94.232.179:445
-
134.183.166.133:445
-
160.78.161.126:445
-
170.137.11.23:445
-
2.160.55.55:445
-
208.19.208.4:445
-
10.127.19.2:445
-
47.198.189.151:445
-
52.170.95.173:445
-
10.127.22.2:445
-
10.127.21.2:445
-
2.134.97.48:445 -
180.62.14.172:445
-
10.127.24.2:445
-
145.113.220.83:445
-
10.127.20.2:445
-
10.127.27.2:445
-
103.101.44.45:445
-
116.169.53.59:445
-
101.34.9.44:445
-
10.127.29.2:445
-
10.127.23.2:445
-
138.243.4.83:445
-
186.231.157.111:445
-
193.59.38.87:445
-
10.127.25.2:445
-
169.6.32.185:445
-
182.201.80.15:445
-
15.155.4.245:445
-
10.127.26.2:445
-
10.127.28.2:445
-
10.127.32.2:445
-
10.127.34.2:445
-
81.55.173.74:445
-
138.159.179.0:445
-
10.127.36.2:445
-
10.127.30.2:445
-
10.127.31.2:445
-
10.127.33.2:445
-
10.127.35.2:445
-
10.127.37.2:445
-
10.127.38.2:445
-
20.36.90.243:445
-
218.27.125.45:445
-
190.209.206.4:445 -
141.37.198.175:445
-
97.243.155.119:445
-
34.112.96.83:445
-
196.169.251.234:445 -
10.127.39.2:445
-
8.8.8.8:53ilo.brenz.pldns
DNS Request
ilo.brenz.pl
-
8.8.8.8:53ant.trenz.pldns
DNS Request
ant.trenz.pl
-
8.8.8.8:53www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.comdns
DNS Request
www.iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com
DNS Response
104.16.167.228104.16.166.228
-
8.8.8.8:538.8.8.8.in-addr.arpadns
DNS Request
8.8.8.8.in-addr.arpa
-
8.8.8.8:53196.249.167.52.in-addr.arpadns
DNS Request
196.249.167.52.in-addr.arpa
-
8.8.8.8:5388.210.23.2.in-addr.arpadns
DNS Request
88.210.23.2.in-addr.arpa
-
8.8.8.8:53228.167.16.104.in-addr.arpadns
DNS Request
228.167.16.104.in-addr.arpa
-
8.8.8.8:5317.160.190.20.in-addr.arpadns
DNS Request
17.160.190.20.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:53209.205.72.20.in-addr.arpadns
DNS Request
209.205.72.20.in-addr.arpa
-
8.8.8.8:53104.219.191.52.in-addr.arpadns
DNS Request
104.219.191.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.4MB
-
Filesize
48KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
6.4MB
-
Filesize
6.4MB
-
Filesize
6.4MB