Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

65db1ed7a7...18.exe

windows7-x64

8

65db1ed7a7...18.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/07/2024, 02:51 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe

  • Size

    731KB

  • MD5

    65db1ed7a70e9f5c9278f7ee2467af10

  • SHA1

    fa748afc18507d19b3557ad430cfb1ab2259c1c6

  • SHA256

    0aef999386f2e78feb0597d96dc395f59ff40128ee80fbeaef82a1af643b3cd1

  • SHA512

    f98aebe4162cd1dddf6904b6a8e1d941d5730e311060b3f781c33394ad86e62459e35582f4522b1155858e1661000d58d3b2ea503057c9f84ead6e45df006bf6

  • SSDEEP

    12288:Jaingtd/9iCpVEZxzraxdUdpm1FmjnDgGeIttwoPR5pWZhAIRXHYnrm5:JaigD/ArravUds1wnlFttwYQRXHYrm5

Score
8/10
evasionpersistenceprivilege_escalation

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 2 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3396
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir "C:\Users\Admin\AppData\Local\DirectDownloader"
      2⤵
        PID:2012
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C echo ifms > "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
        2⤵
          PID:5036
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1872
          • C:\Windows\SysWOW64\netsh.exe
            netsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe"
            3⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            PID:3540
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2516
          • C:\Windows\SysWOW64\netsh.exe
            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe" "DirectDownloader" ENABLE
            3⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            PID:2100

      Network

      • flag-us
        DNS
        g.bing.com
        Remote address:
        8.8.8.8:53
        Request
        g.bing.com
        IN A
        Response
        g.bing.com
        IN CNAME
        g-bing-com.dual-a-0034.a-msedge.net
        g-bing-com.dual-a-0034.a-msedge.net
        IN CNAME
        dual-a-0034.a-msedge.net
        dual-a-0034.a-msedge.net
        IN A
        13.107.21.237
        dual-a-0034.a-msedge.net
        IN A
        204.79.197.237
      • flag-us
        DNS
        g.bing.com
        Remote address:
        8.8.8.8:53
        Request
        g.bing.com
        IN A
      • flag-us
        DNS
        8.8.8.8.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        8.8.8.8.in-addr.arpa
        IN PTR
        Response
        8.8.8.8.in-addr.arpa
        IN PTR
        dnsgoogle
      • flag-us
        DNS
        240.221.184.93.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        240.221.184.93.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        28.118.140.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        28.118.140.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        cdn.download.sweetpacks.com
        65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
        Remote address:
        8.8.8.8:53
        Request
        cdn.download.sweetpacks.com
        IN A
        Response
        cdn.download.sweetpacks.com
        IN CNAME
        cdn.sweetpacks.com.edgesuite.net
        cdn.sweetpacks.com.edgesuite.net
        IN CNAME
        a733.g1.akamai.net
        a733.g1.akamai.net
        IN A
        2.16.170.40
        a733.g1.akamai.net
        IN A
        2.16.170.51
      • flag-gb
        GET
        http://cdn.download.sweetpacks.com/simsdm/bundle/bundlesweetimsetup.exe
        65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
        Remote address:
        2.16.170.40:80
        Request
        GET /simsdm/bundle/bundlesweetimsetup.exe HTTP/1.1
        Range: bytes=0-
        User-Agent: downloader
        Host: cdn.download.sweetpacks.com
        Response
        HTTP/1.1 503 Service Unavailable
        Server: AkamaiGHost
        Mime-Version: 1.0
        Content-Type: text/html
        Content-Length: 373
        Expires: Tue, 23 Jul 2024 03:52:46 GMT
        Date: Tue, 23 Jul 2024 03:52:46 GMT
        Connection: keep-alive
        X-Cdn: Served-By-Akamai
        Cache-Control: private,
      • flag-us
        DNS
        www.directdownloader.com
        65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
        Remote address:
        8.8.8.8:53
        Request
        www.directdownloader.com
        IN A
        Response
        www.directdownloader.com
        IN A
        162.255.119.249
      • flag-us
        GET
        http://www.directdownloader.com/DirectDownloaderInstaller.exe
        65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
        Remote address:
        162.255.119.249:80
        Request
        GET /DirectDownloaderInstaller.exe HTTP/1.1
        Range: bytes=0-
        User-Agent: downloader
        Host: www.directdownloader.com
        Response
        HTTP/1.1 302 Found
        Date: Tue, 23 Jul 2024 03:52:47 GMT
        Content-Type: text/html; charset=utf-8
        Content-Length: 113
        Connection: keep-alive
        Location: http://www.google.com/enterprise/apps/business/products.html/DirectDownloaderInstaller.exe
        X-Served-By: Namecheap URL Forward
        Server: namecheap-nginx
      • flag-us
        DNS
        www.google.com
        65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
        Remote address:
        8.8.8.8:53
        Request
        www.google.com
        IN A
        Response
        www.google.com
        IN A
        142.250.187.228
      • flag-gb
        GET
        http://www.google.com/enterprise/apps/business/products.html/DirectDownloaderInstaller.exe
        65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
        Remote address:
        142.250.187.228:80
        Request
        GET /enterprise/apps/business/products.html/DirectDownloaderInstaller.exe HTTP/1.1
        Range: bytes=0-
        User-Agent: downloader
        Host: www.google.com
        Connection: Keep-Alive
        Response
        HTTP/1.1 301 Moved Permanently
        Location: https://enterprise.google.com/apps/business/products.html/DirectDownloaderInstaller.exe
        Cross-Origin-Resource-Policy: cross-origin
        Content-Type: text/html; charset=UTF-8
        X-Content-Type-Options: nosniff
        Date: Tue, 23 Jul 2024 03:52:47 GMT
        Expires: Tue, 23 Jul 2024 04:22:47 GMT
        Cache-Control: public, max-age=1800
        Server: sffe
        Content-Length: 284
        X-XSS-Protection: 0
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=a80291d2e8804f358aa9ea67c0a85f44&localId=w:7F54B7CC-A139-0C44-079B-F8E35781E681&deviceId=6825836757805329&anid=
        Remote address:
        13.107.21.237:443
        Request
        GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=a80291d2e8804f358aa9ea67c0a85f44&localId=w:7F54B7CC-A139-0C44-079B-F8E35781E681&deviceId=6825836757805329&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        set-cookie: MUID=29D4CBE647DA6DAE3AD2DF23463A6C10; domain=.bing.com; expires=Sun, 17-Aug-2025 03:52:47 GMT; path=/; SameSite=None; Secure; Priority=High;
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: F032C5708ECA4CDA90090BBAD49B7AF0 Ref B: LON04EDGE1007 Ref C: 2024-07-23T03:52:47Z
        date: Tue, 23 Jul 2024 03:52:47 GMT
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=a80291d2e8804f358aa9ea67c0a85f44&localId=w:7F54B7CC-A139-0C44-079B-F8E35781E681&deviceId=6825836757805329&anid=
        Remote address:
        13.107.21.237:443
        Request
        GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=a80291d2e8804f358aa9ea67c0a85f44&localId=w:7F54B7CC-A139-0C44-079B-F8E35781E681&deviceId=6825836757805329&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=29D4CBE647DA6DAE3AD2DF23463A6C10
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        set-cookie: MSPTC=a2zVuecujiWaK2wM8rtx8xjcgnFFfvuGG8VAoBN30f4; domain=.bing.com; expires=Sun, 17-Aug-2025 03:52:47 GMT; path=/; Partitioned; secure; SameSite=None
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 0A7D7BA452764B29AEB725D2107E115D Ref B: LON04EDGE1007 Ref C: 2024-07-23T03:52:47Z
        date: Tue, 23 Jul 2024 03:52:47 GMT
      • flag-us
        GET
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=a80291d2e8804f358aa9ea67c0a85f44&localId=w:7F54B7CC-A139-0C44-079B-F8E35781E681&deviceId=6825836757805329&anid=
        Remote address:
        13.107.21.237:443
        Request
        GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=a80291d2e8804f358aa9ea67c0a85f44&localId=w:7F54B7CC-A139-0C44-079B-F8E35781E681&deviceId=6825836757805329&anid= HTTP/2.0
        host: g.bing.com
        accept-encoding: gzip, deflate
        user-agent: WindowsShellClient/9.0.40929.0 (Windows)
        cookie: MUID=29D4CBE647DA6DAE3AD2DF23463A6C10; MSPTC=a2zVuecujiWaK2wM8rtx8xjcgnFFfvuGG8VAoBN30f4
        Response
        HTTP/2.0 204
        cache-control: no-cache, must-revalidate
        pragma: no-cache
        expires: Fri, 01 Jan 1990 00:00:00 GMT
        strict-transport-security: max-age=31536000; includeSubDomains; preload
        access-control-allow-origin: *
        x-cache: CONFIG_NOCACHE
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 730A3D01FDE7454898E14270420E945D Ref B: LON04EDGE1007 Ref C: 2024-07-23T03:52:47Z
        date: Tue, 23 Jul 2024 03:52:47 GMT
      • flag-us
        DNS
        enterprise.google.com
        65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
        Remote address:
        8.8.8.8:53
        Request
        enterprise.google.com
        IN A
        Response
        enterprise.google.com
        IN CNAME
        www3.l.google.com
        www3.l.google.com
        IN A
        142.250.180.14
      • flag-gb
        GET
        https://enterprise.google.com/apps/business/products.html/DirectDownloaderInstaller.exe
        65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
        Remote address:
        142.250.180.14:443
        Request
        GET /apps/business/products.html/DirectDownloaderInstaller.exe HTTP/1.1
        Range: bytes=0-
        User-Agent: downloader
        Connection: Keep-Alive
        Host: enterprise.google.com
        Response
        HTTP/1.1 301 Moved Permanently
        Location: https://gsuite.google.com/products.html/DirectDownloaderInstaller.exe
        Cross-Origin-Resource-Policy: cross-origin
        Content-Type: text/html; charset=UTF-8
        X-Content-Type-Options: nosniff
        Date: Tue, 23 Jul 2024 03:52:48 GMT
        Expires: Tue, 23 Jul 2024 04:22:48 GMT
        Cache-Control: public, max-age=1800
        Server: sffe
        Content-Length: 266
        X-XSS-Protection: 0
        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
      • flag-us
        DNS
        17.160.190.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        17.160.190.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        40.170.16.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        40.170.16.2.in-addr.arpa
        IN PTR
        Response
        40.170.16.2.in-addr.arpa
        IN PTR
        a2-16-170-40deploystaticakamaitechnologiescom
      • flag-us
        DNS
        249.119.255.162.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        249.119.255.162.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        228.187.250.142.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        228.187.250.142.in-addr.arpa
        IN PTR
        Response
        228.187.250.142.in-addr.arpa
        IN PTR
        lhr25s34-in-f41e100net
      • flag-us
        DNS
        c.pki.goog
        65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
        Remote address:
        8.8.8.8:53
        Request
        c.pki.goog
        IN A
        Response
        c.pki.goog
        IN CNAME
        pki-goog.l.google.com
        pki-goog.l.google.com
        IN A
        172.217.169.3
      • flag-gb
        GET
        http://c.pki.goog/r/r1.crl
        65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
        Remote address:
        172.217.169.3:80
        Request
        GET /r/r1.crl HTTP/1.1
        Connection: Keep-Alive
        Accept: */*
        User-Agent: Microsoft-CryptoAPI/10.0
        Host: c.pki.goog
        Response
        HTTP/1.1 200 OK
        Accept-Ranges: bytes
        Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
        Cross-Origin-Resource-Policy: cross-origin
        Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
        Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
        Content-Length: 854
        X-Content-Type-Options: nosniff
        Server: sffe
        X-XSS-Protection: 0
        Date: Tue, 23 Jul 2024 03:36:16 GMT
        Expires: Tue, 23 Jul 2024 04:26:16 GMT
        Cache-Control: public, max-age=3000
        Age: 991
        Last-Modified: Wed, 01 Nov 2023 07:48:00 GMT
        Content-Type: application/pkix-crl
        Vary: Accept-Encoding
      • flag-us
        DNS
        o.pki.goog
        65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
        Remote address:
        8.8.8.8:53
        Request
        o.pki.goog
        IN A
        Response
        o.pki.goog
        IN CNAME
        pki-goog.l.google.com
        pki-goog.l.google.com
        IN A
        172.217.169.3
      • flag-gb
        GET
        http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDJocJI3cuzOAqV4KAdwn94
        65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
        Remote address:
        172.217.169.3:80
        Request
        GET /wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDJocJI3cuzOAqV4KAdwn94 HTTP/1.1
        Connection: Keep-Alive
        Accept: */*
        User-Agent: Microsoft-CryptoAPI/10.0
        Host: o.pki.goog
        Response
        HTTP/1.1 200 OK
        Server: ocsp_responder
        Content-Length: 472
        X-XSS-Protection: 0
        X-Frame-Options: SAMEORIGIN
        Date: Tue, 23 Jul 2024 02:53:45 GMT
        Cache-Control: public, max-age=14400
        Content-Type: application/ocsp-response
        Age: 3542
      • flag-us
        DNS
        gsuite.google.com
        65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
        Remote address:
        8.8.8.8:53
        Request
        gsuite.google.com
        IN A
        Response
        gsuite.google.com
        IN A
        142.250.179.238
      • flag-gb
        GET
        https://gsuite.google.com/products.html/DirectDownloaderInstaller.exe
        65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
        Remote address:
        142.250.179.238:443
        Request
        GET /products.html/DirectDownloaderInstaller.exe HTTP/1.1
        Range: bytes=0-
        User-Agent: downloader
        Connection: Keep-Alive
        Host: gsuite.google.com
        Response
        HTTP/1.1 301 Moved Permanently
        Location: https://workspace.google.com/products.html/DirectDownloaderInstaller.exe
        Content-Type: text/html; charset=UTF-8
        P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
        X-Content-Type-Options: nosniff
        Date: Tue, 23 Jul 2024 03:52:48 GMT
        Expires: Tue, 23 Jul 2024 04:22:48 GMT
        Cache-Control: public, max-age=1800
        Server: sffe
        Content-Length: 269
        X-XSS-Protection: 0
        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
      • flag-us
        DNS
        workspace.google.com
        65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
        Remote address:
        8.8.8.8:53
        Request
        workspace.google.com
        IN A
        Response
        workspace.google.com
        IN A
        216.58.213.14
      • flag-gb
        GET
        https://workspace.google.com/products.html/DirectDownloaderInstaller.exe
        65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
        Remote address:
        216.58.213.14:443
        Request
        GET /products.html/DirectDownloaderInstaller.exe HTTP/1.1
        Range: bytes=0-
        User-Agent: downloader
        Connection: Keep-Alive
        Host: workspace.google.com
        Response
        HTTP/1.1 404 Not Found
        Cross-Origin-Resource-Policy: cross-origin
        Content-Type: text/html; charset=ISO-8859-1
        P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
        Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
        X-Content-Type-Options: nosniff
        Date: Tue, 23 Jul 2024 03:52:48 GMT
        Server: sffe
        Content-Length: 159708
        X-XSS-Protection: 0
        Set-Cookie: NID=516=rWjgz_ZAt7IpYTZXkwLri13KBe4ww0r6bzpgnwoANWHhAWUaBg_vy-qDpERXUhdPAArO0XL3yTtsdeeSxsT2JcUDZc18U7IMhLPGSWxct-Tocy1Jp_VjNtCYFkQpX8TyfEajTrBFXNzxLehysxgihfEtQjztgXCZjsld7N28RU4; expires=Wed, 22-Jan-2025 03:52:48 GMT; path=/; domain=.google.com; HttpOnly
        Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
      • flag-us
        DNS
        237.21.107.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        237.21.107.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        14.180.250.142.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        14.180.250.142.in-addr.arpa
        IN PTR
        Response
        14.180.250.142.in-addr.arpa
        IN PTR
        lhr25s32-in-f141e100net
      • flag-us
        DNS
        43.58.199.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        43.58.199.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        238.179.250.142.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        238.179.250.142.in-addr.arpa
        IN PTR
        Response
        238.179.250.142.in-addr.arpa
        IN PTR
        lhr25s31-in-f141e100net
      • flag-us
        DNS
        14.213.58.216.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        14.213.58.216.in-addr.arpa
        IN PTR
        Response
        14.213.58.216.in-addr.arpa
        IN PTR
        lhr25s25-in-f141e100net
        14.213.58.216.in-addr.arpa
        IN PTR
        ber01s14-in-f14�H
      • flag-us
        DNS
        196.249.167.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        196.249.167.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        157.123.68.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        157.123.68.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        147.142.123.92.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        147.142.123.92.in-addr.arpa
        IN PTR
        Response
        147.142.123.92.in-addr.arpa
        IN PTR
        a92-123-142-147deploystaticakamaitechnologiescom
      • flag-us
        DNS
        18.31.95.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        18.31.95.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        172.214.232.199.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        172.214.232.199.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        57.169.31.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        57.169.31.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        48.229.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        48.229.111.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        205.47.74.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        205.47.74.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        tse1.mm.bing.net
        Remote address:
        8.8.8.8:53
        Request
        tse1.mm.bing.net
        IN A
        Response
        tse1.mm.bing.net
        IN CNAME
        mm-mm.bing.net.trafficmanager.net
        mm-mm.bing.net.trafficmanager.net
        IN CNAME
        ax-0001.ax-msedge.net
        ax-0001.ax-msedge.net
        IN A
        150.171.28.10
        ax-0001.ax-msedge.net
        IN A
        150.171.27.10
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239360259212_1BAR08KBTVWDNYB0F&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        Remote address:
        150.171.28.10:443
        Request
        GET /th?id=OADD2.10239360259212_1BAR08KBTVWDNYB0F&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 562299
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 45CB7865C57D43B9AA314EE33573297E Ref B: LON04EDGE1006 Ref C: 2024-07-23T03:54:25Z
        date: Tue, 23 Jul 2024 03:54:25 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239360259211_1RHQV0P5DTUS9XFSL&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        Remote address:
        150.171.28.10:443
        Request
        GET /th?id=OADD2.10239360259211_1RHQV0P5DTUS9XFSL&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 439394
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 2245A88960914DB082DD80B69FF65833 Ref B: LON04EDGE1006 Ref C: 2024-07-23T03:54:25Z
        date: Tue, 23 Jul 2024 03:54:25 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239339388139_1V33IWZ6VRJP589I2&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        Remote address:
        150.171.28.10:443
        Request
        GET /th?id=OADD2.10239339388139_1V33IWZ6VRJP589I2&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 618774
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 737DF9A0F62C4F22B8797C76E944A751 Ref B: LON04EDGE1006 Ref C: 2024-07-23T03:54:25Z
        date: Tue, 23 Jul 2024 03:54:25 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239339388138_1BGRZNVGM70GGXZ62&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        Remote address:
        150.171.28.10:443
        Request
        GET /th?id=OADD2.10239339388138_1BGRZNVGM70GGXZ62&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 634779
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 40096314775948908458BD4E4789B667 Ref B: LON04EDGE1006 Ref C: 2024-07-23T03:54:25Z
        date: Tue, 23 Jul 2024 03:54:25 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301285_1YX3CCWTOZVY6EU1J&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        Remote address:
        150.171.28.10:443
        Request
        GET /th?id=OADD2.10239317301285_1YX3CCWTOZVY6EU1J&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 677488
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 95E1EF1C6CEC433C8099CF0AA0255849 Ref B: LON04EDGE1006 Ref C: 2024-07-23T03:54:25Z
        date: Tue, 23 Jul 2024 03:54:25 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301694_17Y0IRSKKQEXFDPLC&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        Remote address:
        150.171.28.10:443
        Request
        GET /th?id=OADD2.10239317301694_17Y0IRSKKQEXFDPLC&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 580561
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 32AAC4B4A51540F08A5987679F5E6BBA Ref B: LON04EDGE1006 Ref C: 2024-07-23T03:54:26Z
        date: Tue, 23 Jul 2024 03:54:25 GMT
      • flag-us
        DNS
        91.16.208.104.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        91.16.208.104.in-addr.arpa
        IN PTR
        Response
      • 2.16.170.40:80
        http://cdn.download.sweetpacks.com/simsdm/bundle/bundlesweetimsetup.exe
        http
        65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
        406 B
         818 B
         6
        4

        HTTP Request

        GET http://cdn.download.sweetpacks.com/simsdm/bundle/bundlesweetimsetup.exe

        HTTP Response

        503
      • 162.255.119.249:80
        http://www.directdownloader.com/DirectDownloaderInstaller.exe
        http
        65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
        672 B
         592 B
         12
        4

        HTTP Request

        GET http://www.directdownloader.com/DirectDownloaderInstaller.exe

        HTTP Response

        302
      • 142.250.187.228:80
        http://www.google.com/enterprise/apps/business/products.html/DirectDownloaderInstaller.exe
        http
        65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
        449 B
         876 B
         6
        4

        HTTP Request

        GET http://www.google.com/enterprise/apps/business/products.html/DirectDownloaderInstaller.exe

        HTTP Response

        301
      • 13.107.21.237:443
        https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=a80291d2e8804f358aa9ea67c0a85f44&localId=w:7F54B7CC-A139-0C44-079B-F8E35781E681&deviceId=6825836757805329&anid=
        tls, http2
        2.0kB
         9.3kB
         21
        18

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=a80291d2e8804f358aa9ea67c0a85f44&localId=w:7F54B7CC-A139-0C44-079B-F8E35781E681&deviceId=6825836757805329&anid=

        HTTP Response

        204

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=a80291d2e8804f358aa9ea67c0a85f44&localId=w:7F54B7CC-A139-0C44-079B-F8E35781E681&deviceId=6825836757805329&anid=

        HTTP Response

        204

        HTTP Request

        GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=a80291d2e8804f358aa9ea67c0a85f44&localId=w:7F54B7CC-A139-0C44-079B-F8E35781E681&deviceId=6825836757805329&anid=

        HTTP Response

        204
      • 142.250.180.14:443
        https://enterprise.google.com/apps/business/products.html/DirectDownloaderInstaller.exe
        tls, http
        65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
        1.1kB
         8.0kB
         14
        11

        HTTP Request

        GET https://enterprise.google.com/apps/business/products.html/DirectDownloaderInstaller.exe

        HTTP Response

        301
      • 172.217.169.3:80
        http://c.pki.goog/r/r1.crl
        http
        65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
        395 B
         1.8kB
         6
        5

        HTTP Request

        GET http://c.pki.goog/r/r1.crl

        HTTP Response

        200
      • 172.217.169.3:80
        http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDJocJI3cuzOAqV4KAdwn94
        http
        65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
        509 B
         885 B
         6
        4

        HTTP Request

        GET http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDJocJI3cuzOAqV4KAdwn94

        HTTP Response

        200
      • 142.250.179.238:443
        https://gsuite.google.com/products.html/DirectDownloaderInstaller.exe
        tls, http
        65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
        1.1kB
         8.0kB
         14
        11

        HTTP Request

        GET https://gsuite.google.com/products.html/DirectDownloaderInstaller.exe

        HTTP Response

        301
      • 216.58.213.14:443
        https://workspace.google.com/products.html/DirectDownloaderInstaller.exe
        tls, http
        65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
        6.6kB
         176.1kB
         134
        131

        HTTP Request

        GET https://workspace.google.com/products.html/DirectDownloaderInstaller.exe

        HTTP Response

        404
      • 150.171.28.10:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         6.9kB
         15
        13
      • 150.171.28.10:443
        https://tse1.mm.bing.net/th?id=OADD2.10239317301694_17Y0IRSKKQEXFDPLC&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        tls, http2
        124.9kB
         3.6MB
         2643
        2639

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239360259212_1BAR08KBTVWDNYB0F&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239360259211_1RHQV0P5DTUS9XFSL&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239339388139_1V33IWZ6VRJP589I2&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239339388138_1BGRZNVGM70GGXZ62&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301285_1YX3CCWTOZVY6EU1J&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

        HTTP Response

        200

        HTTP Response

        200

        HTTP Response

        200

        HTTP Response

        200

        HTTP Response

        200

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301694_17Y0IRSKKQEXFDPLC&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

        HTTP Response

        200
      • 150.171.28.10:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         6.9kB
         15
        13
      • 150.171.28.10:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         6.9kB
         15
        13
      • 150.171.28.10:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
         6.9kB
         15
        13
      • 8.8.8.8:53
        g.bing.com
        dns
        112 B
         151 B
         2
        1

        DNS Request

        g.bing.com

        DNS Request

        g.bing.com

        DNS Response

        13.107.21.237
        204.79.197.237

      • 8.8.8.8:53
        8.8.8.8.in-addr.arpa
        dns
        66 B
         90 B
         1
        1

        DNS Request

        8.8.8.8.in-addr.arpa

      • 8.8.8.8:53
        240.221.184.93.in-addr.arpa
        dns
        73 B
         144 B
         1
        1

        DNS Request

        240.221.184.93.in-addr.arpa

      • 8.8.8.8:53
        28.118.140.52.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        28.118.140.52.in-addr.arpa

      • 8.8.8.8:53
        cdn.download.sweetpacks.com
        dns
        65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
        73 B
         180 B
         1
        1

        DNS Request

        cdn.download.sweetpacks.com

        DNS Response

        2.16.170.40
        2.16.170.51

      • 8.8.8.8:53
        www.directdownloader.com
        dns
        65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
        70 B
         86 B
         1
        1

        DNS Request

        www.directdownloader.com

        DNS Response

        162.255.119.249

      • 8.8.8.8:53
        www.google.com
        dns
        65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
        60 B
         76 B
         1
        1

        DNS Request

        www.google.com

        DNS Response

        142.250.187.228

      • 8.8.8.8:53
        enterprise.google.com
        dns
        65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
        67 B
         104 B
         1
        1

        DNS Request

        enterprise.google.com

        DNS Response

        142.250.180.14

      • 8.8.8.8:53
        17.160.190.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        17.160.190.20.in-addr.arpa

      • 8.8.8.8:53
        40.170.16.2.in-addr.arpa
        dns
        70 B
         133 B
         1
        1

        DNS Request

        40.170.16.2.in-addr.arpa

      • 8.8.8.8:53
        249.119.255.162.in-addr.arpa
        dns
        74 B
         154 B
         1
        1

        DNS Request

        249.119.255.162.in-addr.arpa

      • 8.8.8.8:53
        228.187.250.142.in-addr.arpa
        dns
        74 B
         112 B
         1
        1

        DNS Request

        228.187.250.142.in-addr.arpa

      • 8.8.8.8:53
        c.pki.goog
        dns
        65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
        56 B
         107 B
         1
        1

        DNS Request

        c.pki.goog

        DNS Response

        172.217.169.3

      • 8.8.8.8:53
        o.pki.goog
        dns
        65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
        56 B
         107 B
         1
        1

        DNS Request

        o.pki.goog

        DNS Response

        172.217.169.3

      • 8.8.8.8:53
        gsuite.google.com
        dns
        65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
        63 B
         79 B
         1
        1

        DNS Request

        gsuite.google.com

        DNS Response

        142.250.179.238

      • 8.8.8.8:53
        workspace.google.com
        dns
        65db1ed7a70e9f5c9278f7ee2467af10_JaffaCakes118.exe
        66 B
         82 B
         1
        1

        DNS Request

        workspace.google.com

        DNS Response

        216.58.213.14

      • 8.8.8.8:53
        237.21.107.13.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        237.21.107.13.in-addr.arpa

      • 8.8.8.8:53
        14.180.250.142.in-addr.arpa
        dns
        73 B
         112 B
         1
        1

        DNS Request

        14.180.250.142.in-addr.arpa

      • 8.8.8.8:53
        43.58.199.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        43.58.199.20.in-addr.arpa

      • 8.8.8.8:53
        238.179.250.142.in-addr.arpa
        dns
        74 B
         113 B
         1
        1

        DNS Request

        238.179.250.142.in-addr.arpa

      • 8.8.8.8:53
        14.213.58.216.in-addr.arpa
        dns
        72 B
         141 B
         1
        1

        DNS Request

        14.213.58.216.in-addr.arpa

      • 8.8.8.8:53
        196.249.167.52.in-addr.arpa
        dns
        73 B
         147 B
         1
        1

        DNS Request

        196.249.167.52.in-addr.arpa

      • 8.8.8.8:53
        157.123.68.40.in-addr.arpa
        dns
        72 B
         146 B
         1
        1

        DNS Request

        157.123.68.40.in-addr.arpa

      • 8.8.8.8:53
        18.31.95.13.in-addr.arpa
        dns
        70 B
         144 B
         1
        1

        DNS Request

        18.31.95.13.in-addr.arpa

      • 8.8.8.8:53
        147.142.123.92.in-addr.arpa
        dns
        73 B
         139 B
         1
        1

        DNS Request

        147.142.123.92.in-addr.arpa

      • 8.8.8.8:53
        172.214.232.199.in-addr.arpa
        dns
        74 B
         128 B
         1
        1

        DNS Request

        172.214.232.199.in-addr.arpa

      • 8.8.8.8:53
        57.169.31.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        57.169.31.20.in-addr.arpa

      • 8.8.8.8:53
        48.229.111.52.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        48.229.111.52.in-addr.arpa

      • 8.8.8.8:53
        205.47.74.20.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        205.47.74.20.in-addr.arpa

      • 8.8.8.8:53
        tse1.mm.bing.net
        dns
        62 B
         170 B
         1
        1

        DNS Request

        tse1.mm.bing.net

        DNS Response

        150.171.28.10
        150.171.27.10

      • 8.8.8.8:53
        91.16.208.104.in-addr.arpa
        dns
        72 B
         146 B
         1
        1

        DNS Request

        91.16.208.104.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\DirectDownloader\directdownloader.exe
        Filesize

        7B

        MD5

        824ab679eea19c5b43b186800c2c625f

        SHA1

        f8b90bc89117ac4f1a272e7acef952a79a64b617

        SHA256

        f6d4a23bd6b412e4d4906cbd1c56dcbcf5ddd96b6a9098ceba96be94e52f7ab3

        SHA512

        e13bb9c005c2acb412916bf0f4a37b39c2800298042d5344b877143d1b767342903c9bb3e8d4eda75f37cc323b5f623d6bf34629d2c999c7df316de4ffd3caf4

        Download Submit

      • memory/3396-13-0x0000000000400000-0x00000000004C3000-memory.dmp

        Filesize

        780KB

        Download

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.