Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

3

269bb7c929...68.exe

windows7-x64

8

269bb7c929...68.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    83s
  • max time network
    179s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/10/2023, 22:16 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    269bb7c929843683404be4d35f70b9c3e24d6161d5ffe8092f7f785423a8e468.exe

  • Size

    2.8MB

  • MD5

    f468f5c4e87794fa3ee3e1e1476a06da

  • SHA1

    9fda5a96ef04fe722e4a03b971752d266d46840c

  • SHA256

    269bb7c929843683404be4d35f70b9c3e24d6161d5ffe8092f7f785423a8e468

  • SHA512

    b04d3d43a9abcc35c61102fca723354cf347fd881a71821b57e5c86206d2a01dfa1693b30197b0cca6890b17ed77ed285260d73af3f796412a9b00d6ad62143e

  • SSDEEP

    49152:D7TvfU+8X9GrNOsva5RbKhF3ANkTTlz1QUhNCYa0YA:Q+8X9G3vP3AMhDJLYA

Score
8/10
persistence

Malware Config

Signatures

  • Modifies Installed Components in the registry 2 TTPs 3 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 33 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 37 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\269bb7c929843683404be4d35f70b9c3e24d6161d5ffe8092f7f785423a8e468.exe
    "C:\Users\Admin\AppData\Local\Temp\269bb7c929843683404be4d35f70b9c3e24d6161d5ffe8092f7f785423a8e468.exe"
    1⤵
      PID:1860
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1296
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3888
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:5012
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2760
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:3492
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1480
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4168
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:2916
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:3392
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:60
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:4308
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
                PID:1144
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                  PID:4844
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:3896
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:2924
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:4180
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:2232
                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                          1⤵
                            PID:4984
                          • C:\Windows\explorer.exe
                            explorer.exe
                            1⤵
                              PID:4480
                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                              1⤵
                                PID:1288
                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                1⤵
                                  PID:1972
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:1112
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:424
                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                      1⤵
                                        PID:3560
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:2900
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:1520
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:440
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:3392
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:4112
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:4840
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:4496
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:4856
                                                      • C:\Windows\explorer.exe
                                                        explorer.exe
                                                        1⤵
                                                          PID:3152
                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                          1⤵
                                                            PID:2996
                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                            1⤵
                                                              PID:4644
                                                            • C:\Windows\explorer.exe
                                                              explorer.exe
                                                              1⤵
                                                                PID:5064
                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                1⤵
                                                                  PID:4048
                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                  1⤵
                                                                    PID:4144
                                                                  • C:\Windows\explorer.exe
                                                                    explorer.exe
                                                                    1⤵
                                                                      PID:1584
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                        PID:2140
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        1⤵
                                                                          PID:4712
                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                          1⤵
                                                                            PID:1988

                                                                          Network

                                                                          • flag-us
                                                                            DNS
                                                                            72.32.126.40.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            72.32.126.40.in-addr.arpa
                                                                            IN PTR
                                                                            Response
                                                                          • flag-us
                                                                            DNS
                                                                            8.8.8.8.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            8.8.8.8.in-addr.arpa
                                                                            IN PTR
                                                                            Response
                                                                            8.8.8.8.in-addr.arpa
                                                                            IN PTR
                                                                            dnsgoogle
                                                                          • flag-us
                                                                            DNS
                                                                            71.121.18.2.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            71.121.18.2.in-addr.arpa
                                                                            IN PTR
                                                                            Response
                                                                            71.121.18.2.in-addr.arpa
                                                                            IN PTR
                                                                            a2-18-121-71deploystaticakamaitechnologiescom
                                                                          • flag-us
                                                                            DNS
                                                                            108.211.229.192.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            108.211.229.192.in-addr.arpa
                                                                            IN PTR
                                                                            Response
                                                                          • flag-us
                                                                            DNS
                                                                            241.154.82.20.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            241.154.82.20.in-addr.arpa
                                                                            IN PTR
                                                                            Response
                                                                          • flag-us
                                                                            DNS
                                                                            55.36.223.20.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            55.36.223.20.in-addr.arpa
                                                                            IN PTR
                                                                            Response
                                                                          • flag-us
                                                                            DNS
                                                                            54.120.234.20.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            54.120.234.20.in-addr.arpa
                                                                            IN PTR
                                                                            Response
                                                                          • flag-us
                                                                            DNS
                                                                            41.110.16.96.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            41.110.16.96.in-addr.arpa
                                                                            IN PTR
                                                                            Response
                                                                            41.110.16.96.in-addr.arpa
                                                                            IN PTR
                                                                            a96-16-110-41deploystaticakamaitechnologiescom
                                                                          • flag-us
                                                                            DNS
                                                                            146.78.124.51.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            146.78.124.51.in-addr.arpa
                                                                            IN PTR
                                                                            Response
                                                                          • flag-us
                                                                            DNS
                                                                            203.197.79.204.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            203.197.79.204.in-addr.arpa
                                                                            IN PTR
                                                                            Response
                                                                            203.197.79.204.in-addr.arpa
                                                                            IN PTR
                                                                            a-0003a-msedgenet
                                                                          • flag-us
                                                                            DNS
                                                                            86.23.85.13.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            86.23.85.13.in-addr.arpa
                                                                            IN PTR
                                                                          • flag-us
                                                                            DNS
                                                                            86.23.85.13.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            86.23.85.13.in-addr.arpa
                                                                            IN PTR
                                                                          • flag-us
                                                                            DNS
                                                                            86.23.85.13.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            86.23.85.13.in-addr.arpa
                                                                            IN PTR
                                                                          • flag-us
                                                                            DNS
                                                                            86.23.85.13.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            86.23.85.13.in-addr.arpa
                                                                            IN PTR
                                                                          • flag-us
                                                                            DNS
                                                                            86.23.85.13.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            86.23.85.13.in-addr.arpa
                                                                            IN PTR
                                                                          • flag-us
                                                                            DNS
                                                                            206.23.85.13.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            206.23.85.13.in-addr.arpa
                                                                            IN PTR
                                                                            Response
                                                                          • flag-us
                                                                            DNS
                                                                            126.22.238.8.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            126.22.238.8.in-addr.arpa
                                                                            IN PTR
                                                                            Response
                                                                          • flag-us
                                                                            DNS
                                                                            69.31.126.40.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            69.31.126.40.in-addr.arpa
                                                                            IN PTR
                                                                            Response
                                                                          • flag-us
                                                                            DNS
                                                                            59.128.231.4.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            59.128.231.4.in-addr.arpa
                                                                            IN PTR
                                                                            Response
                                                                          • flag-us
                                                                            DNS
                                                                            14.227.111.52.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            14.227.111.52.in-addr.arpa
                                                                            IN PTR
                                                                            Response
                                                                          • flag-us
                                                                            DNS
                                                                            83.121.18.2.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            83.121.18.2.in-addr.arpa
                                                                            IN PTR
                                                                            Response
                                                                            83.121.18.2.in-addr.arpa
                                                                            IN PTR
                                                                            a2-18-121-83deploystaticakamaitechnologiescom
                                                                          • flag-us
                                                                            DNS
                                                                            88.156.103.20.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            88.156.103.20.in-addr.arpa
                                                                            IN PTR
                                                                            Response
                                                                          • flag-us
                                                                            DNS
                                                                            126.211.247.8.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            126.211.247.8.in-addr.arpa
                                                                            IN PTR
                                                                            Response
                                                                          • flag-us
                                                                            DNS
                                                                            209.80.50.20.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            209.80.50.20.in-addr.arpa
                                                                            IN PTR
                                                                            Response
                                                                          • flag-us
                                                                            DNS
                                                                            95.221.229.192.in-addr.arpa
                                                                            Remote address:
                                                                            8.8.8.8:53
                                                                            Request
                                                                            95.221.229.192.in-addr.arpa
                                                                            IN PTR
                                                                            Response
                                                                          • 10.127.0.134:7799
                                                                            269bb7c929843683404be4d35f70b9c3e24d6161d5ffe8092f7f785423a8e468.exe
                                                                          • 10.127.0.134:6217
                                                                            269bb7c929843683404be4d35f70b9c3e24d6161d5ffe8092f7f785423a8e468.exe
                                                                          • 10.127.0.134:25871
                                                                            269bb7c929843683404be4d35f70b9c3e24d6161d5ffe8092f7f785423a8e468.exe
                                                                          • 10.127.0.134:7799
                                                                            269bb7c929843683404be4d35f70b9c3e24d6161d5ffe8092f7f785423a8e468.exe
                                                                          • 10.127.0.134:6217
                                                                            269bb7c929843683404be4d35f70b9c3e24d6161d5ffe8092f7f785423a8e468.exe
                                                                          • 10.127.0.134:25871
                                                                            269bb7c929843683404be4d35f70b9c3e24d6161d5ffe8092f7f785423a8e468.exe
                                                                          • 10.127.0.134:7799
                                                                            269bb7c929843683404be4d35f70b9c3e24d6161d5ffe8092f7f785423a8e468.exe
                                                                          • 10.127.0.134:6217
                                                                            269bb7c929843683404be4d35f70b9c3e24d6161d5ffe8092f7f785423a8e468.exe
                                                                          • 10.127.0.134:25871
                                                                            269bb7c929843683404be4d35f70b9c3e24d6161d5ffe8092f7f785423a8e468.exe
                                                                          • 10.127.0.134:7799
                                                                            269bb7c929843683404be4d35f70b9c3e24d6161d5ffe8092f7f785423a8e468.exe
                                                                          • 10.127.0.134:6217
                                                                            269bb7c929843683404be4d35f70b9c3e24d6161d5ffe8092f7f785423a8e468.exe
                                                                          • 10.127.0.134:25871
                                                                            269bb7c929843683404be4d35f70b9c3e24d6161d5ffe8092f7f785423a8e468.exe
                                                                          • 8.8.8.8:53
                                                                            8.8.8.8.in-addr.arpa
                                                                            dns
                                                                            66 B
                                                                             90 B
                                                                             1
                                                                            1

                                                                            DNS Request

                                                                            8.8.8.8.in-addr.arpa

                                                                          • 8.8.8.8:53
                                                                            72.32.126.40.in-addr.arpa
                                                                            dns
                                                                            71 B
                                                                             157 B
                                                                             1
                                                                            1

                                                                            DNS Request

                                                                            72.32.126.40.in-addr.arpa

                                                                          • 8.8.8.8:53
                                                                            71.121.18.2.in-addr.arpa
                                                                            dns
                                                                            70 B
                                                                             133 B
                                                                             1
                                                                            1

                                                                            DNS Request

                                                                            71.121.18.2.in-addr.arpa

                                                                          • 8.8.8.8:53
                                                                            108.211.229.192.in-addr.arpa
                                                                            dns
                                                                            74 B
                                                                             145 B
                                                                             1
                                                                            1

                                                                            DNS Request

                                                                            108.211.229.192.in-addr.arpa

                                                                          • 8.8.8.8:53
                                                                            241.154.82.20.in-addr.arpa
                                                                            dns
                                                                            72 B
                                                                             158 B
                                                                             1
                                                                            1

                                                                            DNS Request

                                                                            241.154.82.20.in-addr.arpa

                                                                          • 8.8.8.8:53
                                                                            55.36.223.20.in-addr.arpa
                                                                            dns
                                                                            71 B
                                                                             157 B
                                                                             1
                                                                            1

                                                                            DNS Request

                                                                            55.36.223.20.in-addr.arpa

                                                                          • 8.8.8.8:53
                                                                            54.120.234.20.in-addr.arpa
                                                                            dns
                                                                            72 B
                                                                             158 B
                                                                             1
                                                                            1

                                                                            DNS Request

                                                                            54.120.234.20.in-addr.arpa

                                                                          • 8.8.8.8:53
                                                                            41.110.16.96.in-addr.arpa
                                                                            dns
                                                                            71 B
                                                                             135 B
                                                                             1
                                                                            1

                                                                            DNS Request

                                                                            41.110.16.96.in-addr.arpa

                                                                          • 8.8.8.8:53
                                                                            146.78.124.51.in-addr.arpa
                                                                            dns
                                                                            72 B
                                                                             158 B
                                                                             1
                                                                            1

                                                                            DNS Request

                                                                            146.78.124.51.in-addr.arpa

                                                                          • 8.8.8.8:53
                                                                            203.197.79.204.in-addr.arpa
                                                                            dns
                                                                            73 B
                                                                             106 B
                                                                             1
                                                                            1

                                                                            DNS Request

                                                                            203.197.79.204.in-addr.arpa

                                                                          • 8.8.8.8:53
                                                                            86.23.85.13.in-addr.arpa
                                                                            dns
                                                                            350 B
                                                                             5

                                                                            DNS Request

                                                                            86.23.85.13.in-addr.arpa

                                                                            DNS Request

                                                                            86.23.85.13.in-addr.arpa

                                                                            DNS Request

                                                                            86.23.85.13.in-addr.arpa

                                                                            DNS Request

                                                                            86.23.85.13.in-addr.arpa

                                                                            DNS Request

                                                                            86.23.85.13.in-addr.arpa

                                                                          • 8.8.8.8:53
                                                                            206.23.85.13.in-addr.arpa
                                                                            dns
                                                                            71 B
                                                                             145 B
                                                                             1
                                                                            1

                                                                            DNS Request

                                                                            206.23.85.13.in-addr.arpa

                                                                          • 8.8.8.8:53
                                                                            126.22.238.8.in-addr.arpa
                                                                            dns
                                                                            71 B
                                                                             125 B
                                                                             1
                                                                            1

                                                                            DNS Request

                                                                            126.22.238.8.in-addr.arpa

                                                                          • 8.8.8.8:53
                                                                            69.31.126.40.in-addr.arpa
                                                                            dns
                                                                            71 B
                                                                             157 B
                                                                             1
                                                                            1

                                                                            DNS Request

                                                                            69.31.126.40.in-addr.arpa

                                                                          • 8.8.8.8:53
                                                                            59.128.231.4.in-addr.arpa
                                                                            dns
                                                                            71 B
                                                                             157 B
                                                                             1
                                                                            1

                                                                            DNS Request

                                                                            59.128.231.4.in-addr.arpa

                                                                          • 8.8.8.8:53
                                                                            14.227.111.52.in-addr.arpa
                                                                            dns
                                                                            72 B
                                                                             158 B
                                                                             1
                                                                            1

                                                                            DNS Request

                                                                            14.227.111.52.in-addr.arpa

                                                                          • 8.8.8.8:53
                                                                            83.121.18.2.in-addr.arpa
                                                                            dns
                                                                            70 B
                                                                             133 B
                                                                             1
                                                                            1

                                                                            DNS Request

                                                                            83.121.18.2.in-addr.arpa

                                                                          • 8.8.8.8:53
                                                                            88.156.103.20.in-addr.arpa
                                                                            dns
                                                                            72 B
                                                                             158 B
                                                                             1
                                                                            1

                                                                            DNS Request

                                                                            88.156.103.20.in-addr.arpa

                                                                          • 8.8.8.8:53
                                                                            126.211.247.8.in-addr.arpa
                                                                            dns
                                                                            72 B
                                                                             126 B
                                                                             1
                                                                            1

                                                                            DNS Request

                                                                            126.211.247.8.in-addr.arpa

                                                                          • 8.8.8.8:53
                                                                            209.80.50.20.in-addr.arpa
                                                                            dns
                                                                            71 B
                                                                             157 B
                                                                             1
                                                                            1

                                                                            DNS Request

                                                                            209.80.50.20.in-addr.arpa

                                                                          • 8.8.8.8:53
                                                                            95.221.229.192.in-addr.arpa
                                                                            dns
                                                                            73 B
                                                                             144 B
                                                                             1
                                                                            1

                                                                            DNS Request

                                                                            95.221.229.192.in-addr.arpa

                                                                          MITRE ATT&CK Enterprise v15

                                                                          Replay Monitor

                                                                          Loading Replay Monitor...

                                                                          Downloads

                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                            Filesize

                                                                            471B

                                                                            MD5

                                                                            d819e41f638ffed2a0deb886c2d7e761

                                                                            SHA1

                                                                            79a058dbb783510c08a77e3211c3947f99adea6d

                                                                            SHA256

                                                                            6896c87b8f09add8862cfbdcbf5fae895b1eb4e0df7e9a8a03df7595988666a7

                                                                            SHA512

                                                                            deacf6e95cb4da05def81da84e42c6cf14f230b22965d07da6eb7e94d1937109769bd23c4cbe70b7b9a265a3c835eb70c53c94ebb34c85f83ef486c704b783ed

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                                            Filesize

                                                                            412B

                                                                            MD5

                                                                            b9d852b5a8460e2dc160b3680a70e8a2

                                                                            SHA1

                                                                            c00f46ffe2b78b0bcc2807d6dfcb48862deca16a

                                                                            SHA256

                                                                            10cba151fafb20fbd3335dc1e5f651c46751e6231d346528c0e183148f100513

                                                                            SHA512

                                                                            e8e2a1130569cc22ff3473d8325083618f227f0a5693320b8ba1d9e8042501641e24a8df91e7cc99f4075b32e0e81650f2495c3213508232102fac71d1424f77

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml
                                                                            Filesize

                                                                            97B

                                                                            MD5

                                                                            c31f790cfd02ef244af845fc39b43ad4

                                                                            SHA1

                                                                            947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                            SHA256

                                                                            5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                            SHA512

                                                                            135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml
                                                                            Filesize

                                                                            97B

                                                                            MD5

                                                                            c31f790cfd02ef244af845fc39b43ad4

                                                                            SHA1

                                                                            947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                            SHA256

                                                                            5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                            SHA512

                                                                            135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml
                                                                            Filesize

                                                                            97B

                                                                            MD5

                                                                            c31f790cfd02ef244af845fc39b43ad4

                                                                            SHA1

                                                                            947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                            SHA256

                                                                            5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                            SHA512

                                                                            135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml
                                                                            Filesize

                                                                            97B

                                                                            MD5

                                                                            c31f790cfd02ef244af845fc39b43ad4

                                                                            SHA1

                                                                            947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                            SHA256

                                                                            5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                            SHA512

                                                                            135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml
                                                                            Filesize

                                                                            97B

                                                                            MD5

                                                                            c31f790cfd02ef244af845fc39b43ad4

                                                                            SHA1

                                                                            947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                            SHA256

                                                                            5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                            SHA512

                                                                            135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml
                                                                            Filesize

                                                                            97B

                                                                            MD5

                                                                            c31f790cfd02ef244af845fc39b43ad4

                                                                            SHA1

                                                                            947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                            SHA256

                                                                            5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                            SHA512

                                                                            135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml
                                                                            Filesize

                                                                            97B

                                                                            MD5

                                                                            c31f790cfd02ef244af845fc39b43ad4

                                                                            SHA1

                                                                            947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                            SHA256

                                                                            5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                            SHA512

                                                                            135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                            Download Submit

                                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZVGOYGA8\microsoft.windows[1].xml
                                                                            Filesize

                                                                            97B

                                                                            MD5

                                                                            c31f790cfd02ef244af845fc39b43ad4

                                                                            SHA1

                                                                            947a1baf207f5bc852b97ed0eca9a029c58b5126

                                                                            SHA256

                                                                            5cf8b4a512238a819ac8e892709eb239e784c6fb6c70fdb8c05bc258962fe489

                                                                            SHA512

                                                                            135037a2d115efdab8b9fd4211289603115ee8ddfd6cda42b831a12984128e24dcb13ff7669b97077787743ef437a64e0bcb84bad7abe569af4403b4052b09f5

                                                                            Download Submit

                                                                          • memory/440-130-0x000001570A030000-0x000001570A050000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/440-127-0x0000015709C00000-0x0000015709C20000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/440-125-0x0000015709C40000-0x0000015709C60000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/1112-94-0x00000000043D0000-0x00000000043D1000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/1480-8-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/1972-81-0x000001A5641C0000-0x000001A5641E0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/1972-84-0x000001A5645D0000-0x000001A5645F0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/1972-79-0x000001A564200000-0x000001A564220000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/2900-117-0x0000000004F50000-0x0000000004F51000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/2916-22-0x00000248B92F0000-0x00000248B9310000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/2916-15-0x00000248B8F20000-0x00000248B8F40000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/2916-20-0x00000248B8BE0000-0x00000248B8C00000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/3152-161-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/3392-138-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/3560-102-0x000001ECDE360000-0x000001ECDE380000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/3560-104-0x000001ECDE320000-0x000001ECDE340000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/3560-109-0x000001ECDE740000-0x000001ECDE760000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4144-195-0x0000022EF2DD0000-0x0000022EF2DF0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4144-192-0x0000022EF2E30000-0x0000022EF2E50000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4144-198-0x0000022EF32C0000-0x0000022EF32E0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4180-48-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/4308-25-0x0000000004920000-0x0000000004921000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/4480-72-0x0000000004430000-0x0000000004431000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          • memory/4644-169-0x00000159FC230000-0x00000159FC250000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4644-171-0x00000159FC1D0000-0x00000159FC1F0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4644-174-0x00000159FC670000-0x00000159FC690000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4840-147-0x000001E945BD0000-0x000001E945BF0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4840-149-0x000001E946070000-0x000001E946090000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4840-145-0x000001E945C10000-0x000001E945C30000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4844-38-0x000002784F680000-0x000002784F6A0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4844-35-0x000002784F270000-0x000002784F290000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4844-32-0x000002784F2B0000-0x000002784F2D0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4984-56-0x0000022E98A20000-0x0000022E98A40000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4984-59-0x0000022E987E0000-0x0000022E98800000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/4984-61-0x0000022E98E80000-0x0000022E98EA0000-memory.dmp

                                                                            Filesize

                                                                            128KB

                                                                            Download

                                                                          • memory/5064-184-0x0000000004A10000-0x0000000004A11000-memory.dmp

                                                                            Filesize

                                                                            4KB

                                                                            Download

                                                                          We care about your privacy.

                                                                          This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.