Overview

overview

10

Static

static

10

ec4f09f82d...d3.exe

windows10-2004-x64

10

efd97b1038...ea4.js

windows10-2004-x64

3

emotet_exe...04.exe

windows10-2004-x64

10

emotet_exe...23.exe

windows10-2004-x64

10

eupdate.exe

windows10-2004-x64

7

f4f47c67be...3f.exe

windows10-2004-x64

10

fb5d110ced...9c.exe

windows10-2004-x64

6

fee15285c3...35.exe

windows10-2004-x64

10

file(1).exe

windows10-2004-x64

1

file.exe

windows10-2004-x64

7

gjMEi6eG.exe

windows10-2004-x64

10

good.exe

windows10-2004-x64

10

hyundai st...1).exe

windows10-2004-x64

10

hyundai st...10.exe

windows10-2004-x64

10

infected d...er.exe

windows10-2004-x64

10

inps_979.xls

windows10-2004-x64

1

jar.jar

windows10-2004-x64

10

june9.dll

windows10-2004-x64

10

mouse_2.exe

windows10-2004-x64

10

oof.exe

windows10-2004-x64

3

openme.exe

windows10-2004-x64

10

ou55sg33s_1.exe

windows10-2004-x64

10

senate.dll

windows10-2004-x64

10

starticon3.exe

windows10-2004-x64

10

str.dll

windows10-2004-x64

10

svchost.exe

windows10-2004-x64

10

update.exe

windows10-2004-x64

10

vir1.xlsx

windows10-2004-x64

1

wwf[1].exe

windows10-2004-x64

10

xNet.dll

windows10-2004-x64

1

전산 및...��.exe

windows10-2004-x64

10

전산 및...�1.exe

windows10-2004-x64

10

Resubmissions

20/04/2025, 00:10 UTC

250420-agcc8axyax 10

16/04/2025, 11:04 UTC

250416-m58gsaz1ay 10

15/04/2025, 17:34 UTC

250415-v5ylksypw9 10

15/04/2025, 06:16 UTC

250415-g1p7ras1dw 10

14/04/2025, 08:06 UTC

250414-jzpwpstxhx 10

14/04/2025, 07:59 UTC

250414-jvg1assky4 10

14/04/2025, 07:22 UTC

250414-h7g1dss1h1 10

14/04/2025, 07:16 UTC

250414-h3xv2s1nv6 10

Analysis

  • max time kernel
    93s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/12/2024, 19:31 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe

  • Size

    917KB

  • MD5

    d592e787314d1c327dbc2da117e1dc59

  • SHA1

    ba3a26eaa200d53129e304078309758bbb3c95f1

  • SHA256

    ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3

  • SHA512

    1e805105ab482c752bd24afa028daa3e7bd83f0258510a6fa2ea0c90eb44d1eec590c926982252dbf3a28bb070befbaea5e78c00d556bd9b380a3c79f1480cf7

  • SSDEEP

    24576:Hk5FAciH/EjiQXFPQ0NQaScQqYLQnasbbTq4cSJG:Hk5O/EjiuFP32CYL/wnqlUG

Score
10/10
djvudiscoverypersistenceransomware

Malware Config

Extracted

Family

djvu

C2

http://dell1.ug/hdfhgbdgbdbfgteerpenelop/cvnvbndtedfg/get.php

Attributes
  • extension

    .gero

  • offline_id

    CkRzIzWzRp3U1ooEeUkKN4owpKdqn4SHRoxPMtt1

  • payload_url

    http://dell1.ug/files/penelop/updatewin1.exe

    http://dell1.ug/files/penelop/updatewin2.exe

    http://dell1.ug/files/penelop/updatewin.exe

    http://dell1.ug/files/penelop/3.exe

    http://dell1.ug/files/penelop/4.exe

    http://dell1.ug/files/penelop/5.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-sTWdbjk1AY Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: gorentos@bitmessage.ch Reserve e-mail address to contact us: gerentoshelp@firemail.cc Your personal ID: 0156mJddLsdH

rsa_pubkey.plain
1
-----BEGIN PUBLIC KEY-----
2
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAyGDI+a7vfQKTY3CiJSgy
3
5+YUzhKBcuhwYBQThxNLMpQJlDVwbZM2eHc+HhwEL1D7BGcMYkQ2Tc+LZYGKlTKt
4
SwzNZC81igqdIK/t7hFNnsPlWkLuwxYqCtjCRCvpkOnZH98psOx8T1aK1UTIlIrP
5
l8FYeZsFVwBHq0YdTYpUqOYrAxFG00zAFcs7OkS2Bc4eEaTGPqMJS12sJpWLSFOv
6
VUz10xGBjZihHF+CrpahoPqy8G0hY2gsR3VIyRPx5MDdzgmw8Gi+j3fIcmdFg/RH
7
vuowjwaMmNVNY2b7gNfE1T/1ZOSqXZgAUufStgz7ifPsCCD2ozscMdh6wCCsX94R
8
GwIDAQAB
9
-----END PUBLIC KEY-----

Signatures

  • Detected Djvu ransomware 9 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Djvu family
    djvu
  • Renames multiple (174) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe
    "C:\Users\Admin\AppData\Local\Temp\ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4340
    • C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\f89826d1-4dc5-4b5f-97ed-4f2e82818dc2" /deny *S-1-1-0:(OI)(CI)(DE,DC)
      2⤵
      • Modifies file permissions
      • System Location Discovery: System Language Discovery
      PID:1780
    • C:\Users\Admin\AppData\Local\Temp\ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe
      "C:\Users\Admin\AppData\Local\Temp\ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe" --Admin IsNotAutoStart IsNotTask
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:3340
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 1792
        3⤵
        • Program crash
        PID:3996
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 1868
      2⤵
      • Program crash
      PID:2536
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4340 -ip 4340
    1⤵
      PID:2428
    • C:\Users\Admin\AppData\Local\f89826d1-4dc5-4b5f-97ed-4f2e82818dc2\ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe
      C:\Users\Admin\AppData\Local\f89826d1-4dc5-4b5f-97ed-4f2e82818dc2\ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe --Task
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4040
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4040 -s 1640
        2⤵
        • Program crash
        PID:5092
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4040 -ip 4040
      1⤵
        PID:2972
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3340 -ip 3340
        1⤵
          PID:4692

        Network

        • flag-us
          DNS
          13.86.106.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          13.86.106.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          95.221.229.192.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          95.221.229.192.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          14.160.190.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          14.160.190.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          api.2ip.ua
          ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe
          Remote address:
          8.8.8.8:53
          Request
          api.2ip.ua
          IN A
          Response
          api.2ip.ua
          IN A
          172.67.139.220
          api.2ip.ua
          IN A
          104.21.65.24
        • flag-us
          GET
          https://api.2ip.ua/geo.json
          ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe
          Remote address:
          172.67.139.220:443
          Request
          GET /geo.json HTTP/1.1
          User-Agent: Microsoft Internet Explorer
          Host: api.2ip.ua
          Response
          HTTP/1.1 200 OK
          Date: Wed, 04 Dec 2024 19:34:05 GMT
          Content-Type: application/json
          Transfer-Encoding: chunked
          Connection: keep-alive
          strict-transport-security: max-age=63072000; preload
          x-frame-options: SAMEORIGIN
          x-content-type-options: nosniff
          x-xss-protection: 1; mode=block; report=...
          access-control-allow-origin: *
          access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE
          access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type
          CF-Cache-Status: DYNAMIC
          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WFWT3dI4brROc9QSjmByMy3HqEyos3whiZXFXAe%2FkX5G2dAPdICyKf9aNwwqXMLrqQXQjMBfTu%2B4u0ml53sXxQq38NykhVVoPqei3VmNTzAMv2u91RvaZYTsQzVE"}],"group":"cf-nel","max_age":604800}
          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
          Server: cloudflare
          CF-RAY: 8ece3b5dac399ea1-CDG
          alt-svc: h3=":443"; ma=86400
          server-timing: cfL4;desc="?proto=TCP&rtt=33656&min_rtt=32990&rtt_var=5911&sent=6&recv=9&lost=0&retrans=0&sent_bytes=3266&recv_bytes=384&delivery_rate=122779&cwnd=254&unsent_bytes=0&cid=6c8a34881ffcc5b5&ts=384&x=0"
        • flag-us
          DNS
          c.pki.goog
          ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe
          Remote address:
          8.8.8.8:53
          Request
          c.pki.goog
          IN A
          Response
          c.pki.goog
          IN CNAME
          pki-goog.l.google.com
          pki-goog.l.google.com
          IN A
          142.250.200.3
        • flag-gb
          GET
          http://c.pki.goog/r/gsr1.crl
          ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe
          Remote address:
          142.250.200.3:80
          Request
          GET /r/gsr1.crl HTTP/1.1
          Connection: Keep-Alive
          Accept: */*
          User-Agent: Microsoft-CryptoAPI/10.0
          Host: c.pki.goog
          Response
          HTTP/1.1 200 OK
          Accept-Ranges: bytes
          Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
          Cross-Origin-Resource-Policy: cross-origin
          Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
          Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
          Content-Length: 1739
          X-Content-Type-Options: nosniff
          Server: sffe
          X-XSS-Protection: 0
          Date: Wed, 04 Dec 2024 18:52:38 GMT
          Expires: Wed, 04 Dec 2024 19:42:38 GMT
          Cache-Control: public, max-age=3000
          Age: 2487
          Last-Modified: Mon, 07 Oct 2024 07:18:00 GMT
          Content-Type: application/pkix-crl
          Vary: Accept-Encoding
        • flag-gb
          GET
          http://c.pki.goog/r/r4.crl
          ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe
          Remote address:
          142.250.200.3:80
          Request
          GET /r/r4.crl HTTP/1.1
          Connection: Keep-Alive
          Accept: */*
          User-Agent: Microsoft-CryptoAPI/10.0
          Host: c.pki.goog
          Response
          HTTP/1.1 200 OK
          Accept-Ranges: bytes
          Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
          Cross-Origin-Resource-Policy: cross-origin
          Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
          Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
          Content-Length: 436
          X-Content-Type-Options: nosniff
          Server: sffe
          X-XSS-Protection: 0
          Date: Wed, 04 Dec 2024 18:52:40 GMT
          Expires: Wed, 04 Dec 2024 19:42:40 GMT
          Cache-Control: public, max-age=3000
          Age: 2485
          Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
          Content-Type: application/pkix-crl
          Vary: Accept-Encoding
        • flag-us
          DNS
          220.139.67.172.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          220.139.67.172.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          3.200.250.142.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          3.200.250.142.in-addr.arpa
          IN PTR
          Response
          3.200.250.142.in-addr.arpa
          IN PTR
          lhr48s29-in-f31e100net
        • flag-us
          GET
          https://api.2ip.ua/geo.json
          ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe
          Remote address:
          172.67.139.220:443
          Request
          GET /geo.json HTTP/1.1
          User-Agent: Microsoft Internet Explorer
          Host: api.2ip.ua
          Response
          HTTP/1.1 429 Too Many Requests
          Date: Wed, 04 Dec 2024 19:34:08 GMT
          Content-Type: text/html; charset=UTF-8
          Transfer-Encoding: chunked
          Connection: keep-alive
          strict-transport-security: max-age=63072000; preload
          x-frame-options: SAMEORIGIN
          x-content-type-options: nosniff
          x-xss-protection: 1; mode=block; report=...
          access-control-allow-origin: *
          access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE
          access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type
          CF-Cache-Status: DYNAMIC
          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tQ3G1arGNz%2B%2BtpkpUpDsCENoS75GwkIVDu1FNSEqWcBCw1jEvCEDlw5%2B4X%2FDqsS%2BGrLw16LFHrCngO4kvceWY2klL%2FVeTvAWM67Ug3d8yesNG2qutal%2B7G318Js0"}],"group":"cf-nel","max_age":604800}
          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
          Server: cloudflare
          CF-RAY: 8ece3b714da16ab5-MAN
          alt-svc: h3=":443"; ma=86400
          server-timing: cfL4;desc="?proto=TCP&rtt=34100&min_rtt=32421&rtt_var=9365&sent=8&recv=10&lost=0&retrans=1&sent_bytes=3522&recv_bytes=384&delivery_rate=108490&cwnd=253&unsent_bytes=0&cid=567a59690ebd3e33&ts=408&x=0"
        • flag-us
          DNS
          dell1.ug
          ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe
          Remote address:
          8.8.8.8:53
          Request
          dell1.ug
          IN A
          Response
        • flag-us
          DNS
          dell1.ug
          ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe
          Remote address:
          8.8.8.8:53
          Request
          dell1.ug
          IN A
          Response
        • flag-us
          DNS
          dell1.ug
          ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe
          Remote address:
          8.8.8.8:53
          Request
          dell1.ug
          IN A
          Response
        • flag-us
          DNS
          149.220.183.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          149.220.183.52.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          dell1.ug
          ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe
          Remote address:
          8.8.8.8:53
          Request
          dell1.ug
          IN A
          Response
        • flag-us
          GET
          https://api.2ip.ua/geo.json
          ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe
          Remote address:
          172.67.139.220:443
          Request
          GET /geo.json HTTP/1.1
          User-Agent: Microsoft Internet Explorer
          Host: api.2ip.ua
          Response
          HTTP/1.1 429 Too Many Requests
          Date: Wed, 04 Dec 2024 19:34:25 GMT
          Content-Type: text/html; charset=UTF-8
          Transfer-Encoding: chunked
          Connection: keep-alive
          strict-transport-security: max-age=63072000; preload
          x-frame-options: SAMEORIGIN
          x-content-type-options: nosniff
          x-xss-protection: 1; mode=block; report=...
          access-control-allow-origin: *
          access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE
          access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type
          CF-Cache-Status: DYNAMIC
          Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tzt1Ech1BhuDfy%2FbGLPov6Xpf1YbSMYcePrtqwpPtBCIFutTyWIzjjEe7kT1SrH4Wo82oGwnVAc04C3gGFr57J7QQyfUdS7UO6NG32xR1fPDz%2BJDwpx0xFEIegpv"}],"group":"cf-nel","max_age":604800}
          NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
          Server: cloudflare
          CF-RAY: 8ece3bd79844ef1f-LHR
          alt-svc: h3=":443"; ma=86400
          server-timing: cfL4;desc="?proto=TCP&rtt=29135&min_rtt=26785&rtt_var=6255&sent=6&recv=9&lost=0&retrans=0&sent_bytes=3264&recv_bytes=384&delivery_rate=151738&cwnd=251&unsent_bytes=0&cid=6f9580b0533cbc62&ts=116&x=0"
        • flag-us
          DNS
          50.23.12.20.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          50.23.12.20.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          241.42.69.40.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          241.42.69.40.in-addr.arpa
          IN PTR
          Response
        • flag-us
          DNS
          73.190.18.2.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          73.190.18.2.in-addr.arpa
          IN PTR
          Response
          73.190.18.2.in-addr.arpa
          IN PTR
          a2-18-190-73deploystaticakamaitechnologiescom
        • flag-us
          DNS
          43.229.111.52.in-addr.arpa
          Remote address:
          8.8.8.8:53
          Request
          43.229.111.52.in-addr.arpa
          IN PTR
          Response
        • 172.67.139.220:443
          https://api.2ip.ua/geo.json
          tls, http
          ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe
          970 B
           5.4kB
           13
          10

          HTTP Request

          GET https://api.2ip.ua/geo.json

          HTTP Response

          200
        • 142.250.200.3:80
          http://c.pki.goog/r/r4.crl
          http
          ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe
          556 B
           3.8kB
           7
          5

          HTTP Request

          GET http://c.pki.goog/r/gsr1.crl

          HTTP Response

          200

          HTTP Request

          GET http://c.pki.goog/r/r4.crl

          HTTP Response

          200
        • 172.67.139.220:443
          https://api.2ip.ua/geo.json
          tls, http
          ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe
          1.1kB
           5.9kB
           14
          11

          HTTP Request

          GET https://api.2ip.ua/geo.json

          HTTP Response

          429
        • 172.67.139.220:443
          https://api.2ip.ua/geo.json
          tls, http
          ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe
          1.0kB
           5.9kB
           14
          11

          HTTP Request

          GET https://api.2ip.ua/geo.json

          HTTP Response

          429
        • 8.8.8.8:53
          13.86.106.20.in-addr.arpa
          dns
          71 B
           157 B
           1
          1

          DNS Request

          13.86.106.20.in-addr.arpa

        • 8.8.8.8:53
          95.221.229.192.in-addr.arpa
          dns
          73 B
           144 B
           1
          1

          DNS Request

          95.221.229.192.in-addr.arpa

        • 8.8.8.8:53
          14.160.190.20.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          14.160.190.20.in-addr.arpa

        • 8.8.8.8:53
          api.2ip.ua
          dns
          ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe
          56 B
           88 B
           1
          1

          DNS Request

          api.2ip.ua

          DNS Response

          172.67.139.220
          104.21.65.24

        • 8.8.8.8:53
          c.pki.goog
          dns
          ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe
          56 B
           107 B
           1
          1

          DNS Request

          c.pki.goog

          DNS Response

          142.250.200.3

        • 8.8.8.8:53
          220.139.67.172.in-addr.arpa
          dns
          73 B
           135 B
           1
          1

          DNS Request

          220.139.67.172.in-addr.arpa

        • 8.8.8.8:53
          3.200.250.142.in-addr.arpa
          dns
          72 B
           110 B
           1
          1

          DNS Request

          3.200.250.142.in-addr.arpa

        • 8.8.8.8:53
          dell1.ug
          dns
          ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe
          54 B
           118 B
           1
          1

          DNS Request

          dell1.ug

        • 8.8.8.8:53
          dell1.ug
          dns
          ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe
          54 B
           118 B
           1
          1

          DNS Request

          dell1.ug

        • 8.8.8.8:53
          dell1.ug
          dns
          ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe
          54 B
           118 B
           1
          1

          DNS Request

          dell1.ug

        • 8.8.8.8:53
          149.220.183.52.in-addr.arpa
          dns
          73 B
           147 B
           1
          1

          DNS Request

          149.220.183.52.in-addr.arpa

        • 8.8.8.8:53
          dell1.ug
          dns
          ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe
          54 B
           118 B
           1
          1

          DNS Request

          dell1.ug

        • 8.8.8.8:53
          50.23.12.20.in-addr.arpa
          dns
          70 B
           156 B
           1
          1

          DNS Request

          50.23.12.20.in-addr.arpa

        • 8.8.8.8:53
          241.42.69.40.in-addr.arpa
          dns
          71 B
           145 B
           1
          1

          DNS Request

          241.42.69.40.in-addr.arpa

        • 8.8.8.8:53
          73.190.18.2.in-addr.arpa
          dns
          70 B
           133 B
           1
          1

          DNS Request

          73.190.18.2.in-addr.arpa

        • 8.8.8.8:53
          43.229.111.52.in-addr.arpa
          dns
          72 B
           158 B
           1
          1

          DNS Request

          43.229.111.52.in-addr.arpa

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
          Filesize

          1KB

          MD5

          67e486b2f148a3fca863728242b6273e

          SHA1

          452a84c183d7ea5b7c015b597e94af8eef66d44a

          SHA256

          facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb

          SHA512

          d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
          Filesize

          436B

          MD5

          971c514f84bba0785f80aa1c23edfd79

          SHA1

          732acea710a87530c6b08ecdf32a110d254a54c8

          SHA256

          f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

          SHA512

          43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
          Filesize

          174B

          MD5

          5b000b189f5387eec1f3217964104c2f

          SHA1

          eecbada8c2734cd8e6629ea3c4635e883331c037

          SHA256

          f48e66d51e27aeba28e5c95361e5c1afb28f1a5bdb043cbc9b12af581e6a9141

          SHA512

          04f0a0e0b5ee7761ae1046ea17f386d59072997ec64ccc755727f3a744301a8dc7f71d962a10323ae3e1becedfe615bb4b979800f12af9f7a819edc32877bb7a

          Download Submit

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
          Filesize

          170B

          MD5

          67dc90f66ee215dd0b9d8e0a788ac276

          SHA1

          d8d891fbe208a2da7c2848d3ac9af1de5be99fcb

          SHA256

          ee9dab168ef8f4089402b0febb95f14a5b3258f4e2504a90f619041131a86d82

          SHA512

          711d5d90ea75fddd3fe341745c3c8a0f94b866ab6bc0f9a3fcb7f81fab58536f46eba21dd0ad486af960513924b595290493442228b4a02636a6189be8c75abf

          Download Submit

        • C:\Users\Admin\AppData\Local\f89826d1-4dc5-4b5f-97ed-4f2e82818dc2\ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3.exe
          Filesize

          917KB

          MD5

          d592e787314d1c327dbc2da117e1dc59

          SHA1

          ba3a26eaa200d53129e304078309758bbb3c95f1

          SHA256

          ec4f09f82d932cdd40700a74a8875b73a783cbaab1f313286adf615a5336d7d3

          SHA512

          1e805105ab482c752bd24afa028daa3e7bd83f0258510a6fa2ea0c90eb44d1eec590c926982252dbf3a28bb070befbaea5e78c00d556bd9b380a3c79f1480cf7

          Download Submit

        • memory/3340-22-0x0000000000400000-0x0000000004EE3000-memory.dmp

          Filesize

          74.9MB

          Download

        • memory/3340-28-0x0000000000400000-0x0000000004EE3000-memory.dmp

          Filesize

          74.9MB

          Download

        • memory/3340-378-0x0000000000400000-0x0000000004EE3000-memory.dmp

          Filesize

          74.9MB

          Download

        • memory/4040-25-0x0000000000400000-0x0000000004EE3000-memory.dmp

          Filesize

          74.9MB

          Download

        • memory/4340-15-0x0000000006E90000-0x0000000006FAA000-memory.dmp

          Filesize

          1.1MB

          Download

        • memory/4340-14-0x0000000000400000-0x0000000004EE3000-memory.dmp

          Filesize

          74.9MB

          Download

        • memory/4340-16-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

          Download

        • memory/4340-1-0x0000000006DC0000-0x0000000006E8C000-memory.dmp

          Filesize

          816KB

          Download

        • memory/4340-3-0x0000000000400000-0x0000000000537000-memory.dmp

          Filesize

          1.2MB

          Download

        • memory/4340-2-0x0000000006E90000-0x0000000006FAA000-memory.dmp

          Filesize

          1.1MB

          Download

        We care about your privacy.

        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.