Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
75s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11/12/2024, 11:24 UTC
General
-
Target
e13f1b7f45d99e88c2be459c7caffd91_JaffaCakes118.exe
-
Size
273KB
-
MD5
e13f1b7f45d99e88c2be459c7caffd91
-
SHA1
c7341562529930ab22843a773a39c2fde0eeba30
-
SHA256
b67c52a3d00ddde108f4366b640afd4481ec46fc677696521040311d383448e0
-
SHA512
b38da9d9a6d1efdf7a2ddace409d53010424bd5ea55371cf7bd50a52bde61fac7fc06dd0b3076c98e6e8d841c0345a2d1a83abfff926a2da98f303bfa56c0aff
-
SSDEEP
6144:P5ZRjqjwX9bDjclGvXL5G6e/KbhofVehvcq00e:vRO8X9PFvXNx6KuV0v1
Score
10/10
Malware Config
Signatures
-
Cycbot
Cycbot is a backdoor and trojan written in C++..
-
Cycbot family
-
Detects Cycbot payload 7 IoCs
Cycbot is a backdoor and trojan written in C++.
-
Modifies security service 2 TTPs 1 IoCs
-
Pony family
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 10 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 20 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
UPX packed file 9 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 16 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 18 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e13f1b7f45d99e88c2be459c7caffd91_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\e13f1b7f45d99e88c2be459c7caffd91_JaffaCakes118.exe"1⤵
- Modifies security service
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e13f1b7f45d99e88c2be459c7caffd91_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\e13f1b7f45d99e88c2be459c7caffd91_JaffaCakes118.exe startC:\Users\Admin\AppData\Roaming\F607A\B3ED3.exe%C:\Users\Admin\AppData\Roaming\F607A2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\e13f1b7f45d99e88c2be459c7caffd91_JaffaCakes118.exeC:\Users\Admin\AppData\Local\Temp\e13f1b7f45d99e88c2be459c7caffd91_JaffaCakes118.exe startC:\Program Files (x86)\7A1AF\lvvm.exe%C:\Program Files (x86)\7A1AF2⤵
-
-
C:\Program Files (x86)\LP\D3AF\1B72.tmp"C:\Program Files (x86)\LP\D3AF\1B72.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
Network
-
DNS154.239.44.20.in-addr.arpaRemote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTRResponse -
DNS67.31.126.40.in-addr.arpaRemote address:8.8.8.8:53Request67.31.126.40.in-addr.arpaIN PTRResponse
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNSevcs-ocsp.ws.symantec.comRemote address:8.8.8.8:53Requestevcs-ocsp.ws.symantec.comIN AResponseevcs-ocsp.ws.symantec.comIN CNAMEmpki-ocsp.digicert.commpki-ocsp.digicert.comIN CNAMEfp3011.wpc.2be4.phicdn.netfp3011.wpc.2be4.phicdn.netIN CNAMEfp3011.wpc.phicdn.netfp3011.wpc.phicdn.netIN A152.199.19.74
-
GEThttp://evcs-ocsp.ws.symantec.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQckPwgwK2Thdm9JYVwXQ4ERz3XDQQUo47PGUI9MeGrIYmEbcvZeaKysloCEHX7Uch2jvaSe%2FQdoaI0odk%3DRemote address:152.199.19.74:80RequestGET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQckPwgwK2Thdm9JYVwXQ4ERz3XDQQUo47PGUI9MeGrIYmEbcvZeaKysloCEHX7Uch2jvaSe%2FQdoaI0odk%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: evcs-ocsp.ws.symantec.com
ResponseHTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 620
Cache-Control: public, max-age=300
Content-Type: application/ocsp-response
Date: Wed, 11 Dec 2024 11:24:40 GMT
Last-Modified: Wed, 11 Dec 2024 11:14:20 GMT
Server: ECAcc (lhc/7916)
X-Cache: HIT
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Content-Length: 5
-
GEThttp://evcs-ocsp.ws.symantec.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQckPwgwK2Thdm9JYVwXQ4ERz3XDQQUo47PGUI9MeGrIYmEbcvZeaKysloCEHX7Uch2jvaSe%2FQdoaI0odk%3DRemote address:152.199.19.74:80RequestGET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQckPwgwK2Thdm9JYVwXQ4ERz3XDQQUo47PGUI9MeGrIYmEbcvZeaKysloCEHX7Uch2jvaSe%2FQdoaI0odk%3D HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: evcs-ocsp.ws.symantec.com
ResponseHTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 620
Cache-Control: public, max-age=300
Content-Type: application/ocsp-response
Date: Wed, 11 Dec 2024 11:24:40 GMT
Last-Modified: Wed, 11 Dec 2024 11:14:20 GMT
Server: ECAcc (lhc/7916)
X-Cache: HIT
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Content-Length: 5
-
DNSevcs-crl.ws.symantec.comRemote address:8.8.8.8:53Requestevcs-crl.ws.symantec.comIN AResponseevcs-crl.ws.symantec.comIN CNAMEcrl-symcprod.digicert.comcrl-symcprod.digicert.comIN CNAMEcrl.edge.digicert.comcrl.edge.digicert.comIN CNAMEfp2e7a.wpc.2be4.phicdn.netfp2e7a.wpc.2be4.phicdn.netIN CNAMEfp2e7a.wpc.phicdn.netfp2e7a.wpc.phicdn.netIN A192.229.221.95
-
GEThttp://evcs-crl.ws.symantec.com/evcs.crlRemote address:192.229.221.95:80RequestGET /evcs.crl HTTP/1.1
Cache-Control: max-age = 3600
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Mon, 07 Oct 2024 08:46:45 GMT
User-Agent: Microsoft-CryptoAPI/10.0
Host: evcs-crl.ws.symantec.com
ResponseHTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 735
Cache-Control: public, max-age=3600
Content-Type: application/pkix-crl
Date: Wed, 11 Dec 2024 11:24:40 GMT
Last-Modified: Wed, 11 Dec 2024 11:12:25 GMT
Server: ECAcc (lhd/35B2)
X-Cache: HIT
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Content-Length: 1859
-
DNS74.19.199.152.in-addr.arpaRemote address:8.8.8.8:53Request74.19.199.152.in-addr.arpaIN PTRResponse
-
DNSknowledgesutra.comRemote address:8.8.8.8:53Requestknowledgesutra.comIN AResponseknowledgesutra.comIN A3.33.130.190knowledgesutra.comIN A15.197.148.33
-
GEThttp://knowledgesutra.com/img/temp/hi.cgi?pr=gA924CD3uYd2g0w%2F75eF8BgsCCsiS3YyeeDWHkxNge1u15U8M0n6qMBBZ4SPpXLi1nDGn3ar%2Bfc6PuopKkRO%2FiEwherkJbSX%2BZInzJJ3RDZC37zv%2FxjmEpxjhb%2FI7r04BbahyAFZgz2t0I%2F2zEnt%2FKP%2FhXWkFv7tGXBdtFY60V5kP9SltDjI6uovp64gyPtgW0FDqBICTSrOPD1k1Ygi97CZCssjH0T24at6zaeYHTUU8AwcTpmhObmlzV8VOE0a1xDrQ6ilY%2F8dedK1Pg9t30c8FdugOoayUiN9HHcQM9qS%2BCNWyksvAwrG%2FsLpPJLmdTUZirTCt3oajY%2FoEc8Pv1dqpqabaNQfYtfmoMRiCU8fVFpSLy10Ot4RLAlbRemote address:3.33.130.190:80RequestGET /img/temp/hi.cgi?pr=gA924CD3uYd2g0w%2F75eF8BgsCCsiS3YyeeDWHkxNge1u15U8M0n6qMBBZ4SPpXLi1nDGn3ar%2Bfc6PuopKkRO%2FiEwherkJbSX%2BZInzJJ3RDZC37zv%2FxjmEpxjhb%2FI7r04BbahyAFZgz2t0I%2F2zEnt%2FKP%2FhXWkFv7tGXBdtFY60V5kP9SltDjI6uovp64gyPtgW0FDqBICTSrOPD1k1Ygi97CZCssjH0T24at6zaeYHTUU8AwcTpmhObmlzV8VOE0a1xDrQ6ilY%2F8dedK1Pg9t30c8FdugOoayUiN9HHcQM9qS%2BCNWyksvAwrG%2FsLpPJLmdTUZirTCt3oajY%2FoEc8Pv1dqpqabaNQfYtfmoMRiCU8fVFpSLy10Ot4RLAlb HTTP/1.0
Connection: close
Host: knowledgesutra.com
Accept: */*
User-Agent: chrome/9.0
ResponseHTTP/1.0 200 OK
content-type: text/html
date: Wed, 11 Dec 2024 11:24:42 GMT
content-length: 524
-
DNS190.130.33.3.in-addr.arpaRemote address:8.8.8.8:53Request190.130.33.3.in-addr.arpaIN PTRResponse190.130.33.3.in-addr.arpaIN PTRa2aa9ff50de748dbeawsglobalacceleratorcom
-
DNSjumptomoon.comRemote address:8.8.8.8:53Requestjumptomoon.comIN AResponse
-
DNS149.220.183.52.in-addr.arpaRemote address:8.8.8.8:53Request149.220.183.52.in-addr.arpaIN PTRResponse
-
DNSjumptomoon.comRemote address:8.8.8.8:53Requestjumptomoon.comIN AResponse
-
DNSourdatatransfers.comRemote address:8.8.8.8:53Requestourdatatransfers.comIN AResponse
-
DNS197.87.175.4.in-addr.arpaRemote address:8.8.8.8:53Request197.87.175.4.in-addr.arpaIN PTRResponse
-
DNS206.23.85.13.in-addr.arpaRemote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
DNSsimplexstored.comRemote address:8.8.8.8:53Requestsimplexstored.comIN AResponse
-
GEThttp://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3DRemote address:192.229.221.95:80RequestGET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D HTTP/1.1
Connection: close
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: ocsp.digicert.com
ResponseHTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 809
Cache-Control: max-age=7200
Content-Type: application/ocsp-response
Date: Wed, 11 Dec 2024 11:25:09 GMT
Last-Modified: Wed, 11 Dec 2024 11:11:40 GMT
Server: ECAcc (lhd/35B8)
X-Cache: HIT
Content-Length: 471
Connection: close
-
DNS83.210.23.2.in-addr.arpaRemote address:8.8.8.8:53Request83.210.23.2.in-addr.arpaIN PTRResponse83.210.23.2.in-addr.arpaIN PTRa2-23-210-83deploystaticakamaitechnologiescom
-
DNSwww.google.comRemote address:8.8.8.8:53Requestwww.google.comIN AResponsewww.google.comIN A172.217.20.164
-
GEThttp://www.google.com/Remote address:172.217.20.164:80RequestGET / HTTP/1.0
Connection: close
Host: www.google.com
Accept: */*
ResponseHTTP/1.0 302 Found
Location: http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgS117BTGLbt5boGIjAfcLy3NYONgvyW68t6PU4zpEljgiop0dJe3FtOz0ccEG_WfyRQmGe__1a-rDilNGcyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
x-hallmonitor-challenge: CgwItu3lugYQ9Yj2ywESBLXXsFM
Content-Type: text/html; charset=UTF-8
Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-CQqKRJSd5phQBq-IXQ-9lQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
Date: Wed, 11 Dec 2024 11:25:42 GMT
Server: gws
Content-Length: 396
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AZ6Zc-V4flsyCmaWMgDBrGBiR6gTzPE6cPLdIBzIWPpp6E1zXmqUSyDEu7E; expires=Mon, 09-Jun-2025 11:25:42 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
-
GEThttp://www.google.com/Remote address:172.217.20.164:80RequestGET / HTTP/1.1
Connection: close
Pragma: no-cache
Host: www.google.com
ResponseHTTP/1.1 302 Found
Location: http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgS117BTGLbt5boGIjAfcLy3NYONgvyW68t6PU4zpEljgiop0dJe3FtOz0ccEG_WfyRQmGe__1a-rDilNGcyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
x-hallmonitor-challenge: CgwIt-3lugYQoNa7iQESBLXXsFM
Content-Type: text/html; charset=UTF-8
Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-XwoG95DMmub0JwdwgpS1tQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
Date: Wed, 11 Dec 2024 11:25:43 GMT
Server: gws
Content-Length: 396
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AZ6Zc-Uv_U_KNI8IFzucpHoKbbln8I85k-jdg8K-03WP_kjMsOozCewwGw; expires=Mon, 09-Jun-2025 11:25:43 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
Connection: close
-
DNS164.20.217.172.in-addr.arpaRemote address:8.8.8.8:53Request164.20.217.172.in-addr.arpaIN PTRResponse164.20.217.172.in-addr.arpaIN PTRwaw02s07-in-f1641e100net164.20.217.172.in-addr.arpaIN PTRwaw02s07-in-f4�J164.20.217.172.in-addr.arpaIN PTRpar10s49-in-f4�J
-
GEThttp://www.google.com/sorry/index?continue=http://www.google.com/&q=EgS117BTGLbt5boGIjAfcLy3NYONgvyW68t6PU4zpEljgiop0dJe3FtOz0ccEG_WfyRQmGe__1a-rDilNGcyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMRemote address:172.217.20.164:80RequestGET /sorry/index?continue=http://www.google.com/&q=EgS117BTGLbt5boGIjAfcLy3NYONgvyW68t6PU4zpEljgiop0dJe3FtOz0ccEG_WfyRQmGe__1a-rDilNGcyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1
Connection: close
Pragma: no-cache
Host: www.google.com
ResponseHTTP/1.1 429 Too Many Requests
Date: Wed, 11 Dec 2024 11:25:44 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html
Server: HTTP server (unknown)
Content-Length: 3075
X-XSS-Protection: 0
Connection: close
-
DNS19.229.111.52.in-addr.arpaRemote address:8.8.8.8:53Request19.229.111.52.in-addr.arpaIN PTRResponse
-
DNS13.173.189.20.in-addr.arpaRemote address:8.8.8.8:53Request13.173.189.20.in-addr.arpaIN PTRResponse
-
152.199.19.74:80http://evcs-ocsp.ws.symantec.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQckPwgwK2Thdm9JYVwXQ4ERz3XDQQUo47PGUI9MeGrIYmEbcvZeaKysloCEHX7Uch2jvaSe%2FQdoaI0odk%3Dhttp
HTTP Request
GET http://evcs-ocsp.ws.symantec.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQckPwgwK2Thdm9JYVwXQ4ERz3XDQQUo47PGUI9MeGrIYmEbcvZeaKysloCEHX7Uch2jvaSe%2FQdoaI0odk%3DHTTP Response
200HTTP Request
GET http://evcs-ocsp.ws.symantec.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQckPwgwK2Thdm9JYVwXQ4ERz3XDQQUo47PGUI9MeGrIYmEbcvZeaKysloCEHX7Uch2jvaSe%2FQdoaI0odk%3DHTTP Response
200 -
192.229.221.95:80http://evcs-crl.ws.symantec.com/evcs.crlhttp
HTTP Request
GET http://evcs-crl.ws.symantec.com/evcs.crlHTTP Response
200 -
3.33.130.190:80http://knowledgesutra.com/img/temp/hi.cgi?pr=gA924CD3uYd2g0w%2F75eF8BgsCCsiS3YyeeDWHkxNge1u15U8M0n6qMBBZ4SPpXLi1nDGn3ar%2Bfc6PuopKkRO%2FiEwherkJbSX%2BZInzJJ3RDZC37zv%2FxjmEpxjhb%2FI7r04BbahyAFZgz2t0I%2F2zEnt%2FKP%2FhXWkFv7tGXBdtFY60V5kP9SltDjI6uovp64gyPtgW0FDqBICTSrOPD1k1Ygi97CZCssjH0T24at6zaeYHTUU8AwcTpmhObmlzV8VOE0a1xDrQ6ilY%2F8dedK1Pg9t30c8FdugOoayUiN9HHcQM9qS%2BCNWyksvAwrG%2FsLpPJLmdTUZirTCt3oajY%2FoEc8Pv1dqpqabaNQfYtfmoMRiCU8fVFpSLy10Ot4RLAlbhttp
HTTP Request
GET http://knowledgesutra.com/img/temp/hi.cgi?pr=gA924CD3uYd2g0w%2F75eF8BgsCCsiS3YyeeDWHkxNge1u15U8M0n6qMBBZ4SPpXLi1nDGn3ar%2Bfc6PuopKkRO%2FiEwherkJbSX%2BZInzJJ3RDZC37zv%2FxjmEpxjhb%2FI7r04BbahyAFZgz2t0I%2F2zEnt%2FKP%2FhXWkFv7tGXBdtFY60V5kP9SltDjI6uovp64gyPtgW0FDqBICTSrOPD1k1Ygi97CZCssjH0T24at6zaeYHTUU8AwcTpmhObmlzV8VOE0a1xDrQ6ilY%2F8dedK1Pg9t30c8FdugOoayUiN9HHcQM9qS%2BCNWyksvAwrG%2FsLpPJLmdTUZirTCt3oajY%2FoEc8Pv1dqpqabaNQfYtfmoMRiCU8fVFpSLy10Ot4RLAlbHTTP Response
200 -
192.229.221.95:80http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3Dhttp
HTTP Request
GET http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3DHTTP Response
200 -
127.0.0.1:64848 -
127.0.0.1:64848
-
172.217.20.164:80http://www.google.com/http
HTTP Request
GET http://www.google.com/HTTP Response
302 -
172.217.20.164:80http://www.google.com/http
HTTP Request
GET http://www.google.com/HTTP Response
302 -
172.217.20.164:80http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgS117BTGLbt5boGIjAfcLy3NYONgvyW68t6PU4zpEljgiop0dJe3FtOz0ccEG_WfyRQmGe__1a-rDilNGcyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMhttp
HTTP Request
GET http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgS117BTGLbt5boGIjAfcLy3NYONgvyW68t6PU4zpEljgiop0dJe3FtOz0ccEG_WfyRQmGe__1a-rDilNGcyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMHTTP Response
429 -
127.0.0.1:64848
-
127.0.0.1:64848
-
127.0.0.1:64848
-
127.0.0.1:64848
-
8.8.8.8:53154.239.44.20.in-addr.arpadns
DNS Request
154.239.44.20.in-addr.arpa
-
8.8.8.8:5367.31.126.40.in-addr.arpadns
DNS Request
67.31.126.40.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:53evcs-ocsp.ws.symantec.comdns
DNS Request
evcs-ocsp.ws.symantec.com
DNS Response
152.199.19.74
-
8.8.8.8:53evcs-crl.ws.symantec.comdns
DNS Request
evcs-crl.ws.symantec.com
DNS Response
192.229.221.95
-
8.8.8.8:5374.19.199.152.in-addr.arpadns
DNS Request
74.19.199.152.in-addr.arpa
-
8.8.8.8:53knowledgesutra.comdns
DNS Request
knowledgesutra.com
DNS Response
3.33.130.19015.197.148.33
-
8.8.8.8:53190.130.33.3.in-addr.arpadns
DNS Request
190.130.33.3.in-addr.arpa
-
224.0.0.251:5353
-
8.8.8.8:53jumptomoon.comdns
DNS Request
jumptomoon.com
-
8.8.8.8:53149.220.183.52.in-addr.arpadns
DNS Request
149.220.183.52.in-addr.arpa
-
8.8.8.8:53jumptomoon.comdns
DNS Request
jumptomoon.com
-
8.8.8.8:53ourdatatransfers.comdns
DNS Request
ourdatatransfers.com
-
8.8.8.8:53197.87.175.4.in-addr.arpadns
DNS Request
197.87.175.4.in-addr.arpa
-
8.8.8.8:53206.23.85.13.in-addr.arpadns
DNS Request
206.23.85.13.in-addr.arpa
-
8.8.8.8:53simplexstored.comdns
DNS Request
simplexstored.com
-
8.8.8.8:5383.210.23.2.in-addr.arpadns
DNS Request
83.210.23.2.in-addr.arpa
-
8.8.8.8:53www.google.comdns
DNS Request
www.google.com
DNS Response
172.217.20.164
-
8.8.8.8:53164.20.217.172.in-addr.arpadns
DNS Request
164.20.217.172.in-addr.arpa
-
8.8.8.8:5319.229.111.52.in-addr.arpadns
DNS Request
19.229.111.52.in-addr.arpa
-
8.8.8.8:5313.173.189.20.in-addr.arpadns
DNS Request
13.173.189.20.in-addr.arpa
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
103KB
MD586d203aa2caa9884b7b360153e9ea8c1
SHA1a10e4e44dfc2a2ace55bf60eb769da2dcc79ca73
SHA2560e8be7424ef08580c27c82cdc0226abeef27ce7664a16491c4d5c7eecbe6272d
SHA512491afdef0e57cd084ac76493755c3dff971f1aef06bd4bc3d13447e159f3a32e8b9cc39e30af4f934badaeb2d922a18cf40dfc933b32b9afcb9b64d3a9349567
-
Filesize
471B
MD5208708bfb45252d979ab5ba44053c609
SHA1e4c3e8d332d84cc361d468f1eb6ae88814348c14
SHA256936f238fe633ee6e5783b80325311fd09c63c0471b094d95b990fd52ba57fd2b
SHA512f1e583604373404d300027f691f150527219bc932f6fd1fdd9a2c3466187f454554f2a82c4e63efd7d7caadd62505cea975f1cecb766460f44c04246f1d125d1
-
Filesize
412B
MD53170b69e80f9a8b2dff4457eee6e0e65
SHA17fdc7f84274b557fd6b9ef29db3e1e5d07ba91e7
SHA256b5c2dd0d057d2b3f89fa5646f04d08b393ad584719dff8bbc5e9d0b49eb64105
SHA5120489ed314844410d4576cd0564b8420069e8070b47a6c13a265a1baf2222b7f3db2130051da10a96de9272eb5325db2c4146a47b88ae6b8fb717db2d73c5cff0
-
Filesize
2KB
MD53fa9a8f0222ea50ddb873086b0bb6a5f
SHA191509f51c49eaf01bc492b27f0cbb63ab2cb4ab1
SHA256c831f1e498e82d534843b24c475108dbf835e6662d621abdb73dd682a61f612c
SHA512ed72030f231bc17cdd48bb705dfb07bebadf446d92b26c91270b272dcf33d2e1e0a5c5fb4b33b684aed56b6a71e9c9c7dbc4d41cc8a069d9fa003ce0a7e4f13e
-
Filesize
96B
MD5c839a1973d3feaead377ea2dad131fe6
SHA1252758616792b9b2f10bc460c84b1c1eba75ea04
SHA256efecd8d483398a6cb569af17e66cb0ba1ca4b9c65f4a697fc7642cc007fc3ccd
SHA512fee6ca3d2ae272b0f1f291e98830215f2ac138747651be78325ab7c1ba3f01f72cbfed4c886853caba45f16c59c78543a87a5f872b2c1f85bffa3a4e11bf50e1
-
Filesize
1KB
MD5fae39a36ba4ed9b57215eb5781dcef28
SHA1e4406df15129ea5c9495585b4829a3928731cc15
SHA256c756480a1cd073e21c5f538602c06b5ccff66f4dded54422cef2f600e547e3fa
SHA512add810e9c759a5a132be4ac04c3c7f34c338acb31ab8b179c1a5bf2daa4131d49a98e04100c23f0f491504c4b9c4e6bac883338c966c934a86047754097776e7
-
Filesize
600B
MD5374c035c9325356a4a98b21bb163d956
SHA1a908e847f21e7fd28dd474c9a317e52a820583d8
SHA2564be0902289b832aed21cf898670b0ef22c4afa1b2691dcdb357b4be516afdc55
SHA512c7f198549985fdaa298da0499bb4783e5d36c843276211bea6449dadcb24ca6d01f0e47997d026597a1c5dbb4de9bc9aa7aa83c14b7da6e9bd164ec44843811f
-
Filesize
996B
MD5d5b20684703f8d84a454fb174ac5d4dd
SHA10ca6118bf0416e707d7320aaed8619b5ffd2ce6e
SHA256b655301259ecfbb4d9a843075d2e6a20bd25516f07eafcaac1436ec73fe8c95c
SHA512e4c992ba67d0f3dc831799435e2cce48ceb22bec5fc87592ac23e7f1f73f422885bdb6854353c7f7920c124f6de1367d90f733d4b0f144f1abdac708d725874a
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
128KB
-
Filesize
112KB
-
Filesize
1024KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
412KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
412KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
424KB
-
Filesize
4KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
4KB