- First seen
- Last seen
THREAT SIGNALBenign
VirusSign assessment
Indicator overview
INDICATOR PROFILEThe reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.
- SHA256
2907b7616e2de83d5a58ebeb7b757b4f30a8ad536ff72e26be0ce87979d60148- SHA1
40d21b3022b1733a4a6ee0e50444f3ebd6d0f405- MD5
e92c7ea8097efb0fc512b9fdae1621a1- Filename
- 2907b761_kittip.dll.bin
- File type
- text
- MIME
- text/plain
- File size
- 31
- SSDEEP
3:R9QPFfrR:R9wj- First seen
- 2017-04-18T15:56:48Z
- Last seen
- 2026-09-03T15:17:35Z
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
No detections were reported by the available engines. Review related indicators for additional context.
Detection signal
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
Relationship context
17 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.
Analysis signals
OBSERVEDEngine detections0%
Relationship context17 visible
Intelligence freshnessAging
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Parent files
Files that may have delivered, loaded, or executed this indicator.
5shown
83%
critical
peexe
2392576 bytes
drops
Filename
78d6c05f_synaptics.exe.bin
Family
optix
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
88%
critical
peexe
836608 bytes
drops
Filename
96805139_synaptics.exe.bin
Family
darkkomet
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
87%
critical
peexe
735744 bytes
drops
Filename
8f29d9ef_synaptics.exe.bin
Family
agentb
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
78%
critical
peexe
726016 bytes
drops
Filename
d8329322_synaptics.exe.bin
Family
agentb
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
79%
critical
peexe
3931136 bytes
drops
Filename
eaa13383_synaptics.exe.bin
Family
optix
Type
trojan
File type
peexe
MIME
application/vnd.microsoft.portable-executable
Related IPs
Network IPs associated with this indicator.
5shown
5%
low
US
communicates
CIDR
64.233.160.0/19
Network
64.233.160.0-64.233.191.255
First seen
2023-09-30T05:42:06Z
Last seen
2026-11-14T10:46:32Z
0%
US
communicates
CIDR
23.64.112.0/20
Network
23.32.0.0-23.67.255.255
First seen
2023-09-29T13:22:46Z
Last seen
2026-11-14T10:48:04Z
0%
US
communicates
CIDR
23.64.112.0/20
Network
23.32.0.0-23.67.255.255
First seen
2023-10-01T08:22:29Z
Last seen
2026-11-14T10:48:04Z
0%
US
communicates
CIDR
23.64.112.0/20
Network
23.32.0.0-23.67.255.255
First seen
2023-09-29T16:36:10Z
Last seen
2026-11-14T11:05:37Z
0%
US
communicates
CIDR
172.217.128.0/17
Network
172.217.0.0-172.217.255.255
First seen
2023-09-30T16:47:29Z
Last seen
2026-11-14T10:53:27Z
Related domains
Domains associated with this indicator.
5shown
0%
.com
communicates
Root
gvt1.com
TLD
com
Subdomain
edgedl.me
First seen
2023-09-30T04:07:43Z
Last seen
2026-11-14T11:10:23Z
5%
high
.com
communicates
Root
googleapis.com
TLD
com
Subdomain
storage
First seen
2023-09-28T17:11:14Z
Last seen
2026-11-14T11:11:03Z
0%
.com
communicates
Root
microsoft.com
TLD
com
First seen
2026-01-29T18:48:34Z
Last seen
2026-11-14T11:09:58Z
0%
.com
communicates
Root
microsoft.com
TLD
com
Subdomain
oneocsp
First seen
2023-10-01T15:38:17Z
Last seen
2026-11-14T11:09:58Z
5%
low
.net
communicates
Root
azureedge.net
TLD
net
Subdomain
edge-consumer-static
First seen
2023-10-29T04:39:06Z
Last seen
2026-11-14T11:11:32Z
Related URLs
URLs associated with this indicator.
2shown
0%
communicates
TLD
com
HTTP status
200
Content length
81
Content SHA256
7c279458a718a72122d5cf874aade8f5b4bbd5cee00eee596d51b91f8d267bff
First seen
2025-11-30T04:52:04Z
0%
communicates
TLD
com
HTTP status
200
Content length
957
Content SHA256
c67dc6249ab19589bbb92a8a5bceed4adca79c0f5c432678088e97611f7fcc1e
First seen
2025-11-15T06:31:58Z
Analysis details
text
Freshness: Aging · Last seen 71 days ago.
- Detection rate
- 0%
- detection
- 0 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
2907b7616e2de83d5a58ebeb7b757b4f30a8ad536ff72e26be0ce87979d60148- SHA1
40d21b3022b1733a4a6ee0e50444f3ebd6d0f405- MD5
e92c7ea8097efb0fc512b9fdae1621a1- Filename
- 2907b761_kittip.dll.bin
- File type
- text
- MIME
- text/plain
- File size
- 31
- SSDEEP
3:R9QPFfrR:R9wj- First seen
- 2017-04-18T15:56:48Z
- Last seen
- 2026-09-03T15:17:35Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
No detections were reported by the available engines. Review related indicators for additional context.
Detection signal
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
Relationship context
17 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
18 timestamped observations are arranged from 1992-06-19 to 2026-01-29. These are observation or metadata times, not execution order.
Infrastructure geography
5 infrastructure/location point(s) are visible on the map.
Intelligence freshness
Last seen 71 days ago. Revalidate volatile infrastructure before enforcement.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The reported engine detection rate is 0%. This does not establish that the indicator is benign; review the available classification, relationship and historical evidence.
Reported 0% detection rate, not missing data. This alone does not establish that the indicator is benign.
4 relationship group(s) provide pivot and infrastructure context.
Last seen 71 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- 2907b761_kittip.dll.bin
- File type
- text
- MIME
- text/plain
- Size
- 31
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity5+
TCP, HTTP, UDPports 443, 80, 53
- 5+ outbound connections observed
- 2 domains, 5+ IPs, 2 URLs
- Common ports: 443, 80, 53
- Protocols: TCP, HTTP, UDP
View details · 5 shown
- IP
- 92.223.96.6
- Port
- 80
- Protocol
- TCP
- IP
- 199.232.210.172
- Port
- 80
- Protocol
- TCP
- Domain
- oneocsp.microsoft.com
- URL
- http://oneocsp.microsoft.com/ocsp/mfqwujbqme4wtdajbgurdgmcgguabbq3l3/a6adk8nray2gxzvayrhg4aqub6t+2v+xq3lso2d33ojhnyhhqoucezmaaaagb6jmmcovb6saaaaaaay=
- Protocol
- HTTP
- Domain
- clients2.google.com
- URL
- http://clients2.google.com/time/1/current?cup2key=8:jgc43mbasf1q72l9dkzakvyi0bt93a-fzexmd1ibebg&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
- Protocol
- HTTP
- IP
- 74.125.202.132
- Port
- 443
- Protocol
- TCP
5 shown
DNS request activity5+
A5+ response IPs
- 5+ DNS requests observed
- 5+ unique queries
- 5+ response IPs
- Query types: A
- Response codes: NOERROR
View details · 5 shown
- Query
- storage.googleapis.com
- Query
- redirector.gvt1.com
- Type
- A
- Answers
- 64.233.179.102, 64.233.179.139, 64.233.179.113, 64.233.179.100, 142.251.184.100, 142.251.184.102, 172.217.214.100, 142.251.184.113 …
- Response
- NOERROR
- Query
- edge-consumer-static.azureedge.net
- Query
- clients2.googleusercontent.com
- Type
- A
- Answers
- 74.125.202.132
- Response
- NOERROR
- Query
- edgedl.me.gvt1.com
- Type
- A
- Answers
- 34.104.35.123
- Response
- NOERROR
5 shown
Behavior details
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- Classification label
- Connects to IPs without corresponding DNS lookups
- Performs DNS lookups
- Sample contains empty HTML title
- Sigma detected: Chromium Browser Instance Executed With Custom Extension
5 shown
View MBC details · 3 shown
- CommunicationObjectives: OC0006
- C0002 — HTTP CommunicationObjectives: OC0006
- C0005.001 — InternetConnectObjectives: OC0006