Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    96s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/01/2025, 03:36 UTC

General

  • Target

    JaffaCakes118_45c4c38b1c3b20a54138dc13191811d0.exe

  • Size

    140KB

  • MD5

    45c4c38b1c3b20a54138dc13191811d0

  • SHA1

    4f8da3b5e018123a598e4bdbb3200757325732b9

  • SHA256

    e716fb02bab4f27fa34a775dd3616902560250e2148c3d045dc473752e89e71b

  • SHA512

    e04189798948bd87d8e5b1e9e213f7a20ea5c1672a6785c56523bc48ce4a806462005b4c9a3afe256f82b43c8e17a9c3690fd841e5693d2c8d7bd8bc9453a43f

  • SSDEEP

    3072:IkoVocF1mzOAt1+tKevji3kQI6gyOmC9fueGPqq1j:dmB4ctKcix0PR0qqF

Malware Config

Extracted

Family

sality

C2

http://89.119.67.154/testo5/

http://kukutrustnet777.info/home.gif

http://kukutrustnet888.info/home.gif

http://kukutrustnet987.info/home.gif

http://www.klkjwre9fqwieluoi.info/

http://kukutrustnet777888.info/

Signatures

  • Modifies firewall policy service 3 TTPs 7 IoCs
  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

  • Sality family
  • UAC bypass 3 TTPs 1 IoCs
  • Windows security bypass 2 TTPs 6 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Windows security modification 2 TTPs 7 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Windows\system32\winlogon.exe
    winlogon.exe
    1⤵
      PID:612
      • C:\Windows\system32\fontdrvhost.exe
        "fontdrvhost.exe"
        2⤵
          PID:796
        • C:\Windows\system32\dwm.exe
          "dwm.exe"
          2⤵
            PID:316
        • C:\Windows\system32\lsass.exe
          C:\Windows\system32\lsass.exe
          1⤵
            PID:684
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k DcomLaunch -p
            1⤵
              PID:788
              • C:\Windows\system32\wbem\unsecapp.exe
                C:\Windows\system32\wbem\unsecapp.exe -Embedding
                2⤵
                  PID:2256
                • C:\Windows\system32\DllHost.exe
                  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                  2⤵
                    PID:3832
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    2⤵
                      PID:3920
                    • C:\Windows\System32\RuntimeBroker.exe
                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                      2⤵
                        PID:3996
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        2⤵
                          PID:4088
                        • C:\Windows\System32\RuntimeBroker.exe
                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                          2⤵
                            PID:3956
                          • C:\Windows\system32\SppExtComObj.exe
                            C:\Windows\system32\SppExtComObj.exe -Embedding
                            2⤵
                              PID:3980
                            • C:\Windows\system32\DllHost.exe
                              C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                              2⤵
                                PID:3220
                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
                                2⤵
                                  PID:3788
                                • C:\Windows\System32\RuntimeBroker.exe
                                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                                  2⤵
                                    PID:4608
                                  • C:\Windows\System32\RuntimeBroker.exe
                                    C:\Windows\System32\RuntimeBroker.exe -Embedding
                                    2⤵
                                      PID:452
                                    • C:\Windows\System32\RuntimeBroker.exe
                                      C:\Windows\System32\RuntimeBroker.exe -Embedding
                                      2⤵
                                        PID:2012
                                      • C:\Windows\system32\backgroundTaskHost.exe
                                        "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                        2⤵
                                          PID:400
                                      • C:\Windows\system32\fontdrvhost.exe
                                        "fontdrvhost.exe"
                                        1⤵
                                          PID:804
                                        • C:\Windows\system32\svchost.exe
                                          C:\Windows\system32\svchost.exe -k RPCSS -p
                                          1⤵
                                            PID:912
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
                                            1⤵
                                              PID:960
                                            • C:\Windows\system32\svchost.exe
                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                                              1⤵
                                                PID:412
                                              • C:\Windows\system32\svchost.exe
                                                C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
                                                1⤵
                                                  PID:1048
                                                • C:\Windows\System32\svchost.exe
                                                  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                                                  1⤵
                                                    PID:1056
                                                  • C:\Windows\system32\svchost.exe
                                                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                                                    1⤵
                                                      PID:1064
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                                                      1⤵
                                                        PID:1080
                                                      • C:\Windows\system32\svchost.exe
                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                                                        1⤵
                                                          PID:1192
                                                          • C:\Windows\system32\taskhostw.exe
                                                            taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                                                            2⤵
                                                              PID:2940
                                                            • C:\Windows\system32\MusNotification.exe
                                                              C:\Windows\system32\MusNotification.exe
                                                              2⤵
                                                                PID:4424
                                                            • C:\Windows\System32\svchost.exe
                                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                                                              1⤵
                                                                PID:1208
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                                                                1⤵
                                                                  PID:1292
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                                                                  1⤵
                                                                    PID:1312
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                                                                    1⤵
                                                                      PID:1384
                                                                    • C:\Windows\system32\svchost.exe
                                                                      C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                                                      1⤵
                                                                        PID:1400
                                                                      • C:\Windows\system32\svchost.exe
                                                                        C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                                                        1⤵
                                                                          PID:1468
                                                                          • C:\Windows\system32\sihost.exe
                                                                            sihost.exe
                                                                            2⤵
                                                                              PID:2672
                                                                          • C:\Windows\system32\svchost.exe
                                                                            C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                                                            1⤵
                                                                              PID:1492
                                                                            • C:\Windows\System32\svchost.exe
                                                                              C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                                                              1⤵
                                                                                PID:1512
                                                                              • C:\Windows\system32\svchost.exe
                                                                                C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                                                                1⤵
                                                                                  PID:1652
                                                                                • C:\Windows\System32\svchost.exe
                                                                                  C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                                                                  1⤵
                                                                                    PID:1696
                                                                                  • C:\Windows\System32\svchost.exe
                                                                                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                                                                    1⤵
                                                                                      PID:1732
                                                                                    • C:\Windows\System32\svchost.exe
                                                                                      C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                                                                      1⤵
                                                                                        PID:1808
                                                                                      • C:\Windows\System32\svchost.exe
                                                                                        C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                                                        1⤵
                                                                                          PID:1828
                                                                                        • C:\Windows\system32\svchost.exe
                                                                                          C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                                                          1⤵
                                                                                            PID:1932
                                                                                          • C:\Windows\system32\svchost.exe
                                                                                            C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                                                            1⤵
                                                                                              PID:1960
                                                                                            • C:\Windows\System32\svchost.exe
                                                                                              C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                                                              1⤵
                                                                                                PID:1968
                                                                                              • C:\Windows\System32\svchost.exe
                                                                                                C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                                                                1⤵
                                                                                                  PID:2036
                                                                                                • C:\Windows\System32\spoolsv.exe
                                                                                                  C:\Windows\System32\spoolsv.exe
                                                                                                  1⤵
                                                                                                    PID:2060
                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
                                                                                                    1⤵
                                                                                                      PID:2096
                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                      C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
                                                                                                      1⤵
                                                                                                        PID:2120
                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                        C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
                                                                                                        1⤵
                                                                                                          PID:2216
                                                                                                        • C:\Windows\System32\svchost.exe
                                                                                                          C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
                                                                                                          1⤵
                                                                                                            PID:2332
                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                            C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
                                                                                                            1⤵
                                                                                                              PID:2492
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
                                                                                                              1⤵
                                                                                                                PID:2504
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                                                                                                1⤵
                                                                                                                  PID:2700
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
                                                                                                                  1⤵
                                                                                                                    PID:2724
                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
                                                                                                                    1⤵
                                                                                                                      PID:2780
                                                                                                                    • C:\Windows\sysmon.exe
                                                                                                                      C:\Windows\sysmon.exe
                                                                                                                      1⤵
                                                                                                                        PID:2792
                                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                                        C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
                                                                                                                        1⤵
                                                                                                                          PID:2812
                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                          C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
                                                                                                                          1⤵
                                                                                                                            PID:2844
                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                            C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
                                                                                                                            1⤵
                                                                                                                              PID:3100
                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                              C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
                                                                                                                              1⤵
                                                                                                                                PID:3456
                                                                                                                              • C:\Windows\Explorer.EXE
                                                                                                                                C:\Windows\Explorer.EXE
                                                                                                                                1⤵
                                                                                                                                  PID:3540
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_45c4c38b1c3b20a54138dc13191811d0.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_45c4c38b1c3b20a54138dc13191811d0.exe"
                                                                                                                                    2⤵
                                                                                                                                    • Modifies firewall policy service
                                                                                                                                    • UAC bypass
                                                                                                                                    • Windows security bypass
                                                                                                                                    • Drops file in Drivers directory
                                                                                                                                    • Windows security modification
                                                                                                                                    • Checks whether UAC is enabled
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                    • System policy modification
                                                                                                                                    PID:4900
                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                  C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
                                                                                                                                  1⤵
                                                                                                                                    PID:3644
                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                    C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                                                                                    1⤵
                                                                                                                                      PID:3756
                                                                                                                                    • C:\Windows\System32\svchost.exe
                                                                                                                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                                                                                                                                      1⤵
                                                                                                                                        PID:4524
                                                                                                                                      • C:\Windows\system32\svchost.exe
                                                                                                                                        C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
                                                                                                                                        1⤵
                                                                                                                                          PID:2924
                                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                                          C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                                                                                                          1⤵
                                                                                                                                            PID:4040
                                                                                                                                          • C:\Windows\System32\svchost.exe
                                                                                                                                            C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
                                                                                                                                            1⤵
                                                                                                                                              PID:2916
                                                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                                                                                                                                              "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                                                                                                                                              1⤵
                                                                                                                                                PID:4184
                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                                                                1⤵
                                                                                                                                                  PID:952

                                                                                                                                                Network

                                                                                                                                                • flag-us
                                                                                                                                                  DNS
                                                                                                                                                  8.8.8.8.in-addr.arpa
                                                                                                                                                  Dnscache
                                                                                                                                                  Remote address:
                                                                                                                                                  8.8.8.8:53
                                                                                                                                                  Request
                                                                                                                                                  8.8.8.8.in-addr.arpa
                                                                                                                                                  IN PTR
                                                                                                                                                  Response
                                                                                                                                                  8.8.8.8.in-addr.arpa
                                                                                                                                                  IN PTR
                                                                                                                                                  dnsgoogle
                                                                                                                                                • flag-us
                                                                                                                                                  DNS
                                                                                                                                                  209.205.72.20.in-addr.arpa
                                                                                                                                                  Dnscache
                                                                                                                                                  Remote address:
                                                                                                                                                  8.8.8.8:53
                                                                                                                                                  Request
                                                                                                                                                  209.205.72.20.in-addr.arpa
                                                                                                                                                  IN PTR
                                                                                                                                                  Response
                                                                                                                                                • flag-us
                                                                                                                                                  DNS
                                                                                                                                                  88.210.23.2.in-addr.arpa
                                                                                                                                                  Dnscache
                                                                                                                                                  Remote address:
                                                                                                                                                  8.8.8.8:53
                                                                                                                                                  Request
                                                                                                                                                  88.210.23.2.in-addr.arpa
                                                                                                                                                  IN PTR
                                                                                                                                                  Response
                                                                                                                                                  88.210.23.2.in-addr.arpa
                                                                                                                                                  IN PTR
                                                                                                                                                  a2-23-210-88deploystaticakamaitechnologiescom
                                                                                                                                                • flag-us
                                                                                                                                                  DNS
                                                                                                                                                  68.32.126.40.in-addr.arpa
                                                                                                                                                  Dnscache
                                                                                                                                                  Remote address:
                                                                                                                                                  8.8.8.8:53
                                                                                                                                                  Request
                                                                                                                                                  68.32.126.40.in-addr.arpa
                                                                                                                                                  IN PTR
                                                                                                                                                  Response
                                                                                                                                                • flag-us
                                                                                                                                                  DNS
                                                                                                                                                  95.221.229.192.in-addr.arpa
                                                                                                                                                  Dnscache
                                                                                                                                                  Remote address:
                                                                                                                                                  8.8.8.8:53
                                                                                                                                                  Request
                                                                                                                                                  95.221.229.192.in-addr.arpa
                                                                                                                                                  IN PTR
                                                                                                                                                  Response
                                                                                                                                                • flag-us
                                                                                                                                                  DNS
                                                                                                                                                  28.118.140.52.in-addr.arpa
                                                                                                                                                  Dnscache
                                                                                                                                                  Remote address:
                                                                                                                                                  8.8.8.8:53
                                                                                                                                                  Request
                                                                                                                                                  28.118.140.52.in-addr.arpa
                                                                                                                                                  IN PTR
                                                                                                                                                  Response
                                                                                                                                                • flag-us
                                                                                                                                                  DNS
                                                                                                                                                  97.17.167.52.in-addr.arpa
                                                                                                                                                  Dnscache
                                                                                                                                                  Remote address:
                                                                                                                                                  8.8.8.8:53
                                                                                                                                                  Request
                                                                                                                                                  97.17.167.52.in-addr.arpa
                                                                                                                                                  IN PTR
                                                                                                                                                  Response
                                                                                                                                                • flag-us
                                                                                                                                                  DNS
                                                                                                                                                  50.23.12.20.in-addr.arpa
                                                                                                                                                  Dnscache
                                                                                                                                                  Remote address:
                                                                                                                                                  8.8.8.8:53
                                                                                                                                                  Request
                                                                                                                                                  50.23.12.20.in-addr.arpa
                                                                                                                                                  IN PTR
                                                                                                                                                  Response
                                                                                                                                                • flag-us
                                                                                                                                                  DNS
                                                                                                                                                  15.164.165.52.in-addr.arpa
                                                                                                                                                  Dnscache
                                                                                                                                                  Remote address:
                                                                                                                                                  8.8.8.8:53
                                                                                                                                                  Request
                                                                                                                                                  15.164.165.52.in-addr.arpa
                                                                                                                                                  IN PTR
                                                                                                                                                  Response
                                                                                                                                                • flag-us
                                                                                                                                                  DNS
                                                                                                                                                  172.210.232.199.in-addr.arpa
                                                                                                                                                  Dnscache
                                                                                                                                                  Remote address:
                                                                                                                                                  8.8.8.8:53
                                                                                                                                                  Request
                                                                                                                                                  172.210.232.199.in-addr.arpa
                                                                                                                                                  IN PTR
                                                                                                                                                  Response
                                                                                                                                                • flag-us
                                                                                                                                                  DNS
                                                                                                                                                  172.214.232.199.in-addr.arpa
                                                                                                                                                  Dnscache
                                                                                                                                                  Remote address:
                                                                                                                                                  8.8.8.8:53
                                                                                                                                                  Request
                                                                                                                                                  172.214.232.199.in-addr.arpa
                                                                                                                                                  IN PTR
                                                                                                                                                  Response
                                                                                                                                                • flag-us
                                                                                                                                                  DNS
                                                                                                                                                  172.214.232.199.in-addr.arpa
                                                                                                                                                  Dnscache
                                                                                                                                                  Remote address:
                                                                                                                                                  8.8.8.8:53
                                                                                                                                                  Request
                                                                                                                                                  172.214.232.199.in-addr.arpa
                                                                                                                                                  IN PTR
                                                                                                                                                • flag-us
                                                                                                                                                  DNS
                                                                                                                                                  14.227.111.52.in-addr.arpa
                                                                                                                                                  Dnscache
                                                                                                                                                  Remote address:
                                                                                                                                                  8.8.8.8:53
                                                                                                                                                  Request
                                                                                                                                                  14.227.111.52.in-addr.arpa
                                                                                                                                                  IN PTR
                                                                                                                                                  Response
                                                                                                                                                No results found
                                                                                                                                                • 8.8.8.8:53
                                                                                                                                                  8.8.8.8.in-addr.arpa
                                                                                                                                                  dns
                                                                                                                                                  Dnscache
                                                                                                                                                  66 B
                                                                                                                                                  90 B
                                                                                                                                                  1
                                                                                                                                                  1

                                                                                                                                                  DNS Request

                                                                                                                                                  8.8.8.8.in-addr.arpa

                                                                                                                                                • 8.8.8.8:53
                                                                                                                                                  209.205.72.20.in-addr.arpa
                                                                                                                                                  dns
                                                                                                                                                  Dnscache
                                                                                                                                                  72 B
                                                                                                                                                  158 B
                                                                                                                                                  1
                                                                                                                                                  1

                                                                                                                                                  DNS Request

                                                                                                                                                  209.205.72.20.in-addr.arpa

                                                                                                                                                • 8.8.8.8:53
                                                                                                                                                  88.210.23.2.in-addr.arpa
                                                                                                                                                  dns
                                                                                                                                                  Dnscache
                                                                                                                                                  70 B
                                                                                                                                                  133 B
                                                                                                                                                  1
                                                                                                                                                  1

                                                                                                                                                  DNS Request

                                                                                                                                                  88.210.23.2.in-addr.arpa

                                                                                                                                                • 8.8.8.8:53
                                                                                                                                                  68.32.126.40.in-addr.arpa
                                                                                                                                                  dns
                                                                                                                                                  Dnscache
                                                                                                                                                  71 B
                                                                                                                                                  157 B
                                                                                                                                                  1
                                                                                                                                                  1

                                                                                                                                                  DNS Request

                                                                                                                                                  68.32.126.40.in-addr.arpa

                                                                                                                                                • 8.8.8.8:53
                                                                                                                                                  95.221.229.192.in-addr.arpa
                                                                                                                                                  dns
                                                                                                                                                  Dnscache
                                                                                                                                                  73 B
                                                                                                                                                  144 B
                                                                                                                                                  1
                                                                                                                                                  1

                                                                                                                                                  DNS Request

                                                                                                                                                  95.221.229.192.in-addr.arpa

                                                                                                                                                • 8.8.8.8:53
                                                                                                                                                  28.118.140.52.in-addr.arpa
                                                                                                                                                  dns
                                                                                                                                                  Dnscache
                                                                                                                                                  72 B
                                                                                                                                                  158 B
                                                                                                                                                  1
                                                                                                                                                  1

                                                                                                                                                  DNS Request

                                                                                                                                                  28.118.140.52.in-addr.arpa

                                                                                                                                                • 8.8.8.8:53
                                                                                                                                                  97.17.167.52.in-addr.arpa
                                                                                                                                                  dns
                                                                                                                                                  Dnscache
                                                                                                                                                  71 B
                                                                                                                                                  145 B
                                                                                                                                                  1
                                                                                                                                                  1

                                                                                                                                                  DNS Request

                                                                                                                                                  97.17.167.52.in-addr.arpa

                                                                                                                                                • 8.8.8.8:53
                                                                                                                                                  50.23.12.20.in-addr.arpa
                                                                                                                                                  dns
                                                                                                                                                  Dnscache
                                                                                                                                                  70 B
                                                                                                                                                  156 B
                                                                                                                                                  1
                                                                                                                                                  1

                                                                                                                                                  DNS Request

                                                                                                                                                  50.23.12.20.in-addr.arpa

                                                                                                                                                • 8.8.8.8:53
                                                                                                                                                  15.164.165.52.in-addr.arpa
                                                                                                                                                  dns
                                                                                                                                                  Dnscache
                                                                                                                                                  72 B
                                                                                                                                                  146 B
                                                                                                                                                  1
                                                                                                                                                  1

                                                                                                                                                  DNS Request

                                                                                                                                                  15.164.165.52.in-addr.arpa

                                                                                                                                                • 8.8.8.8:53
                                                                                                                                                  172.210.232.199.in-addr.arpa
                                                                                                                                                  dns
                                                                                                                                                  Dnscache
                                                                                                                                                  74 B
                                                                                                                                                  128 B
                                                                                                                                                  1
                                                                                                                                                  1

                                                                                                                                                  DNS Request

                                                                                                                                                  172.210.232.199.in-addr.arpa

                                                                                                                                                • 8.8.8.8:53
                                                                                                                                                  172.214.232.199.in-addr.arpa
                                                                                                                                                  dns
                                                                                                                                                  Dnscache
                                                                                                                                                  148 B
                                                                                                                                                  128 B
                                                                                                                                                  2
                                                                                                                                                  1

                                                                                                                                                  DNS Request

                                                                                                                                                  172.214.232.199.in-addr.arpa

                                                                                                                                                  DNS Request

                                                                                                                                                  172.214.232.199.in-addr.arpa

                                                                                                                                                • 8.8.8.8:53
                                                                                                                                                  14.227.111.52.in-addr.arpa
                                                                                                                                                  dns
                                                                                                                                                  Dnscache
                                                                                                                                                  72 B
                                                                                                                                                  158 B
                                                                                                                                                  1
                                                                                                                                                  1

                                                                                                                                                  DNS Request

                                                                                                                                                  14.227.111.52.in-addr.arpa

                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                Replay Monitor

                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                Downloads

                                                                                                                                                • memory/4900-0-0x0000000001000000-0x0000000001024000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  144KB

                                                                                                                                                • memory/4900-1-0x0000000002440000-0x00000000034CE000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  16.6MB

                                                                                                                                                • memory/4900-7-0x000000007FE40000-0x000000007FE4C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  48KB

                                                                                                                                                • memory/4900-5-0x0000000002440000-0x00000000034CE000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  16.6MB

                                                                                                                                                • memory/4900-9-0x0000000002440000-0x00000000034CE000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  16.6MB

                                                                                                                                                • memory/4900-10-0x0000000002440000-0x00000000034CE000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  16.6MB

                                                                                                                                                • memory/4900-23-0x0000000000B10000-0x0000000000B12000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  8KB

                                                                                                                                                • memory/4900-35-0x0000000001000000-0x0000000001024000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  144KB

                                                                                                                                                • memory/4900-21-0x0000000002440000-0x00000000034CE000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  16.6MB

                                                                                                                                                • memory/4900-29-0x000000007FE40000-0x000000007FE4C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  48KB

                                                                                                                                                • memory/4900-17-0x0000000002440000-0x00000000034CE000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  16.6MB

                                                                                                                                                • memory/4900-19-0x0000000002440000-0x00000000034CE000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  16.6MB

                                                                                                                                                • memory/4900-15-0x0000000002440000-0x00000000034CE000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  16.6MB

                                                                                                                                                • memory/4900-18-0x0000000000B10000-0x0000000000B12000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  8KB

                                                                                                                                                • memory/4900-16-0x0000000000B10000-0x0000000000B12000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  8KB

                                                                                                                                                • memory/4900-14-0x0000000077193000-0x0000000077194000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                • memory/4900-13-0x0000000077192000-0x0000000077193000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                • memory/4900-6-0x0000000002440000-0x00000000034CE000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  16.6MB

                                                                                                                                                • memory/4900-12-0x0000000000D30000-0x0000000000D31000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  4KB

                                                                                                                                                • memory/4900-11-0x0000000000B10000-0x0000000000B12000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  8KB

                                                                                                                                                • memory/4900-8-0x000000007FE40000-0x000000007FE4C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  48KB

                                                                                                                                                • memory/4900-2-0x000000007FE40000-0x000000007FE4C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  48KB

                                                                                                                                                We care about your privacy.

                                                                                                                                                This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.