Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02/02/2025, 02:46 UTC
General
-
Target
JaffaCakes118_782e3d3fa5434fbc95aec12657c7f493.exe
-
Size
277KB
-
MD5
782e3d3fa5434fbc95aec12657c7f493
-
SHA1
2f193f9b807e8786cd8e024b172284a174f9d7ab
-
SHA256
56655a085e5b4201bb77299bb7fab80c5355bce33b295db59ec29443e22ff3bc
-
SHA512
caaf1195e5363453ae7ea53208ffc10530e744cc9735184b9af0b74e905c17e9298004da2ee3c1dd2967205eb2955420f6e0efc378b8712ebeed50bf94a92338
-
SSDEEP
6144:buANRAZLcYjAgQiRchFGbKgn6H4XZ2JzZqV866JRu27Id6XoSOpr:VMZjxQiRXbKPH4Ie8w2sdppr
Score
10/10
Malware Config
Signatures
-
Cycbot
Cycbot is a backdoor and trojan written in C++..
-
Cycbot family
-
Detects Cycbot payload 6 IoCs
Cycbot is a backdoor and trojan written in C++.
-
Modifies security service 2 TTPs 1 IoCs
-
Pony family
-
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 13 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 26 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies Internet Explorer settings 1 TTPs 20 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 25 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
-
System policy modification 1 TTPs 2 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_782e3d3fa5434fbc95aec12657c7f493.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_782e3d3fa5434fbc95aec12657c7f493.exe"1⤵
- Modifies security service
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_782e3d3fa5434fbc95aec12657c7f493.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_782e3d3fa5434fbc95aec12657c7f493.exe startC:\Users\Admin\AppData\Roaming\AA466\9217E.exe%C:\Users\Admin\AppData\Roaming\AA4662⤵
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_782e3d3fa5434fbc95aec12657c7f493.exeC:\Users\Admin\AppData\Local\Temp\JaffaCakes118_782e3d3fa5434fbc95aec12657c7f493.exe startC:\Program Files (x86)\66A23\lvvm.exe%C:\Program Files (x86)\66A232⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\LP\7E0A\147D.tmp"C:\Program Files (x86)\LP\7E0A\147D.tmp"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of SendNotifyMessage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\explorer.exeexplorer.exe1⤵
Network
-
DNS228.249.119.40.in-addr.arpaRemote address:8.8.8.8:53Request228.249.119.40.in-addr.arpaIN PTRResponse -
DNS73.31.126.40.in-addr.arpaRemote address:8.8.8.8:53Request73.31.126.40.in-addr.arpaIN PTRResponse
-
DNS5.114.82.104.in-addr.arpaRemote address:8.8.8.8:53Request5.114.82.104.in-addr.arpaIN PTRResponse5.114.82.104.in-addr.arpaIN PTRa104-82-114-5deploystaticakamaitechnologiescom
-
DNSevcs-ocsp.ws.symantec.comRemote address:8.8.8.8:53Requestevcs-ocsp.ws.symantec.comIN AResponseevcs-ocsp.ws.symantec.comIN CNAMEmpki-ocsp.digicert.commpki-ocsp.digicert.comIN CNAMEmpki-ocsp.edge.digicert.commpki-ocsp.edge.digicert.comIN CNAMEpki-ocsp.digicert.com.edgekey.netpki-ocsp.digicert.com.edgekey.netIN CNAMEe3782.cd.akamaiedge.nete3782.cd.akamaiedge.netIN A104.78.173.45
-
GEThttp://evcs-ocsp.ws.symantec.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQckPwgwK2Thdm9JYVwXQ4ERz3XDQQUo47PGUI9MeGrIYmEbcvZeaKysloCEHX7Uch2jvaSe%2FQdoaI0odk%3DRemote address:104.78.173.45:80RequestGET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQckPwgwK2Thdm9JYVwXQ4ERz3XDQQUo47PGUI9MeGrIYmEbcvZeaKysloCEHX7Uch2jvaSe%2FQdoaI0odk%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: evcs-ocsp.ws.symantec.com
ResponseHTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 5
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Cache-Control: public, max-age=235
Date: Sun, 02 Feb 2025 02:46:44 GMT
Connection: keep-alive
Server-Timing: cdn-cache; desc=HIT
Server-Timing: edge; dur=1
Akamai-GRN: 0.de3e1202.1738464404.499b38dc
Server-Timing: ak_p; desc="1738464404432_34750174_1234909404_7_469_0_0_-";dur=1
-
GEThttp://evcs-ocsp.ws.symantec.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQckPwgwK2Thdm9JYVwXQ4ERz3XDQQUo47PGUI9MeGrIYmEbcvZeaKysloCEHX7Uch2jvaSe%2FQdoaI0odk%3DRemote address:104.78.173.45:80RequestGET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQckPwgwK2Thdm9JYVwXQ4ERz3XDQQUo47PGUI9MeGrIYmEbcvZeaKysloCEHX7Uch2jvaSe%2FQdoaI0odk%3D HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: evcs-ocsp.ws.symantec.com
ResponseHTTP/1.1 200 OK
Content-Type: application/ocsp-response
Content-Length: 5
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Cache-Control: public, max-age=235
Date: Sun, 02 Feb 2025 02:46:44 GMT
Connection: keep-alive
Server-Timing: cdn-cache; desc=HIT
Server-Timing: edge; dur=1
Akamai-GRN: 0.de3e1202.1738464404.499b38dd
Server-Timing: ak_p; desc="1738464404484_34750174_1234909405_6_324_50_0_-";dur=1
-
DNSevcs-crl.ws.symantec.comRemote address:8.8.8.8:53Requestevcs-crl.ws.symantec.comIN AResponseevcs-crl.ws.symantec.comIN CNAMEcrl-symcprod.digicert.comcrl-symcprod.digicert.comIN CNAMEmpki-crl.edge.digicert.commpki-crl.edge.digicert.comIN CNAMEpki-ocsp.digicert.com.edgekey.netpki-ocsp.digicert.com.edgekey.netIN CNAMEe3782.cd.akamaiedge.nete3782.cd.akamaiedge.netIN A2.17.65.87
-
GEThttp://evcs-crl.ws.symantec.com/evcs.crlRemote address:2.17.65.87:80RequestGET /evcs.crl HTTP/1.1
Cache-Control: max-age = 3600
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Mon, 07 Oct 2024 08:46:45 GMT
User-Agent: Microsoft-CryptoAPI/10.0
Host: evcs-crl.ws.symantec.com
ResponseHTTP/1.1 200 OK
Content-Type: application/pkix-crl
Content-Length: 1824
X-XSS-Protection: 1; mode=block
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
Cache-Control: public, max-age=2327
Date: Sun, 02 Feb 2025 02:46:44 GMT
Connection: keep-alive
Server-Timing: cdn-cache; desc=HIT
Server-Timing: edge; dur=1
Akamai-GRN: 0.667032b8.1738464404.2bf9418
Server-Timing: ak_p; desc="1738464404648_3090313318_46109720_11_847_0_0_-";dur=1
-
DNShck.enotusfed.comRemote address:8.8.8.8:53Requesthck.enotusfed.comIN AResponse
-
DNSistockanalyst.comRemote address:8.8.8.8:53Requestistockanalyst.comIN AResponseistockanalyst.comIN A104.21.112.1istockanalyst.comIN A104.21.16.1istockanalyst.comIN A104.21.32.1istockanalyst.comIN A104.21.64.1istockanalyst.comIN A104.21.96.1istockanalyst.comIN A104.21.80.1istockanalyst.comIN A104.21.48.1
-
DNS87.65.17.2.in-addr.arpaRemote address:8.8.8.8:53Request87.65.17.2.in-addr.arpaIN PTRResponse87.65.17.2.in-addr.arpaIN PTRa2-17-65-87deploystaticakamaitechnologiescom
-
DNS104.219.191.52.in-addr.arpaRemote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse
-
DNS45.173.78.104.in-addr.arpaRemote address:8.8.8.8:53Request45.173.78.104.in-addr.arpaIN PTRResponse45.173.78.104.in-addr.arpaIN PTRa104-78-173-45deploystaticakamaitechnologiescom
-
GEThttp://istockanalyst.com/12.jpg?sv=526&tq=gJ4WK%2FSUh%2FTNhRMw9YLJ%2BMSTUivqg4b0xZFSK%2B%2Fbxmq1SfkIYQAERemote address:104.21.112.1:80RequestGET /12.jpg?sv=526&tq=gJ4WK%2FSUh%2FTNhRMw9YLJ%2BMSTUivqg4b0xZFSK%2B%2Fbxmq1SfkIYQAE HTTP/1.0
Connection: close
Host: istockanalyst.com
Accept: */*
User-Agent: chrome/9.0
ResponseHTTP/1.1 301 Moved Permanently
Date: Sun, 02 Feb 2025 02:46:45 GMT
Content-Type: text/html
Content-Length: 167
Connection: close
Cache-Control: max-age=3600
Expires: Sun, 02 Feb 2025 03:46:45 GMT
Location: https://istockanalyst.com/12.jpg?sv=526&tq=gJ4WK%2FSUh%2FTNhRMw9YLJ%2BMSTUivqg4b0xZFSK%2B%2Fbxmq1SfkIYQAE
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bWglQV72L6V6CICeOb8e1xh8lI8n7eHEiqOicIl2plZPfpz8AU9TaUAIT2VhTcYNln1JSXsdaS120U2iXblLdh9XBudgZq33A8beSGdsqvZ5tMQRjbK1ilnPj3id8vj1%2Fw7Sgg%3D%3D"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Server: cloudflare
CF-RAY: 90b6da46bc706535-LHR
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=47216&min_rtt=47216&rtt_var=23608&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=178&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
-
DNS1.112.21.104.in-addr.arpaRemote address:8.8.8.8:53Request1.112.21.104.in-addr.arpaIN PTRResponse
-
DNS98j6.enotusfed.comRemote address:8.8.8.8:53Request98j6.enotusfed.comIN AResponse
-
DNS167.173.78.104.in-addr.arpaRemote address:8.8.8.8:53Request167.173.78.104.in-addr.arpaIN PTRResponse167.173.78.104.in-addr.arpaIN PTRa104-78-173-167deploystaticakamaitechnologiescom
-
DNSjz4jz.opalimanos.comRemote address:8.8.8.8:53Requestjz4jz.opalimanos.comIN AResponse
-
DNS212.20.149.52.in-addr.arpaRemote address:8.8.8.8:53Request212.20.149.52.in-addr.arpaIN PTRResponse
-
DNS198.187.3.20.in-addr.arpaRemote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
DNS172.210.232.199.in-addr.arpaRemote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
DNSTRANSERSDATAFORME.COMRemote address:8.8.8.8:53RequestTRANSERSDATAFORME.COMIN AResponse
-
DNS11.153.16.2.in-addr.arpaRemote address:8.8.8.8:53Request11.153.16.2.in-addr.arpaIN PTRResponse11.153.16.2.in-addr.arpaIN PTRa2-16-153-11deploystaticakamaitechnologiescom
-
DNSwww.google.comRemote address:8.8.8.8:53Requestwww.google.comIN AResponsewww.google.comIN A142.250.178.4
-
GEThttp://www.google.com/Remote address:142.250.178.4:80RequestGET / HTTP/1.0
Connection: close
Host: www.google.com
Accept: */*
ResponseHTTP/1.0 302 Found
Location: http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgS117BTGNG5-7wGIjBJcLUPCpjDJLVntpk9eusZpi6eHQjiYL57jRSJecowHa8Pu5vxnQj36t6aZEKasA4yAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
x-hallmonitor-challenge: CgwI0bn7vAYQjP2VjQMSBLXXsFM
Content-Type: text/html; charset=UTF-8
Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-vLqiP27vXTu0zqv5bXXwOw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
Date: Sun, 02 Feb 2025 02:47:45 GMT
Server: gws
Content-Length: 396
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AVcja2feB0JMwIeMeNjk1uySI9gsqNn0-GvGgVosKaiatUpsq3nWTulFPg; expires=Fri, 01-Aug-2025 02:47:45 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
-
DNSp82.opalimanos.comRemote address:8.8.8.8:53Requestp82.opalimanos.comIN AResponse
-
GEThttp://www.google.com/Remote address:142.250.178.4:80RequestGET / HTTP/1.1
Connection: close
Pragma: no-cache
Host: www.google.com
ResponseHTTP/1.1 302 Found
Location: http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgS117BTGNK5-7wGIjAVfBCRVeIS7E0YwXWS5V2CUj7Du0H8g4BtEexz2HZYyuRNdFzDHLhfgTm5H-7QRmIyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM
x-hallmonitor-challenge: CgwI0rn7vAYQu8PKzQESBLXXsFM
Content-Type: text/html; charset=UTF-8
Content-Security-Policy-Report-Only: object-src 'none';base-uri 'self';script-src 'nonce-P1hIaWjHxktpGHrCFGi8jA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other-hp
Date: Sun, 02 Feb 2025 02:47:46 GMT
Server: gws
Content-Length: 396
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
Set-Cookie: AEC=AVcja2fLfYi4Cgzya6w0lnA__OG3GExx9Nsfs978671mHnJjSPj07t_uBg; expires=Fri, 01-Aug-2025 02:47:46 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=lax
Connection: close
-
DNS4.178.250.142.in-addr.arpaRemote address:8.8.8.8:53Request4.178.250.142.in-addr.arpaIN PTRResponse4.178.250.142.in-addr.arpaIN PTRlhr48s27-in-f41e100net
-
GEThttp://www.google.com/sorry/index?continue=http://www.google.com/&q=EgS117BTGNK5-7wGIjAVfBCRVeIS7E0YwXWS5V2CUj7Du0H8g4BtEexz2HZYyuRNdFzDHLhfgTm5H-7QRmIyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMRemote address:142.250.178.4:80RequestGET /sorry/index?continue=http://www.google.com/&q=EgS117BTGNK5-7wGIjAVfBCRVeIS7E0YwXWS5V2CUj7Du0H8g4BtEexz2HZYyuRNdFzDHLhfgTm5H-7QRmIyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUM HTTP/1.1
Connection: close
Pragma: no-cache
Host: www.google.com
ResponseHTTP/1.1 429 Too Many Requests
Date: Sun, 02 Feb 2025 02:47:46 GMT
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Content-Type: text/html
Server: HTTP server (unknown)
Content-Length: 3075
X-XSS-Protection: 0
Connection: close
-
104.78.173.45:80http://evcs-ocsp.ws.symantec.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQckPwgwK2Thdm9JYVwXQ4ERz3XDQQUo47PGUI9MeGrIYmEbcvZeaKysloCEHX7Uch2jvaSe%2FQdoaI0odk%3Dhttp
HTTP Request
GET http://evcs-ocsp.ws.symantec.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQckPwgwK2Thdm9JYVwXQ4ERz3XDQQUo47PGUI9MeGrIYmEbcvZeaKysloCEHX7Uch2jvaSe%2FQdoaI0odk%3DHTTP Response
200HTTP Request
GET http://evcs-ocsp.ws.symantec.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQckPwgwK2Thdm9JYVwXQ4ERz3XDQQUo47PGUI9MeGrIYmEbcvZeaKysloCEHX7Uch2jvaSe%2FQdoaI0odk%3DHTTP Response
200 -
2.17.65.87:80http://evcs-crl.ws.symantec.com/evcs.crlhttp
HTTP Request
GET http://evcs-crl.ws.symantec.com/evcs.crlHTTP Response
200 -
104.21.112.1:80http://istockanalyst.com/12.jpg?sv=526&tq=gJ4WK%2FSUh%2FTNhRMw9YLJ%2BMSTUivqg4b0xZFSK%2B%2Fbxmq1SfkIYQAEhttp
HTTP Request
GET http://istockanalyst.com/12.jpg?sv=526&tq=gJ4WK%2FSUh%2FTNhRMw9YLJ%2BMSTUivqg4b0xZFSK%2B%2Fbxmq1SfkIYQAEHTTP Response
301 -
142.250.178.4:80http://www.google.com/http
HTTP Request
GET http://www.google.com/HTTP Response
302 -
142.250.178.4:80http://www.google.com/http
HTTP Request
GET http://www.google.com/HTTP Response
302 -
142.250.178.4:80http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgS117BTGNK5-7wGIjAVfBCRVeIS7E0YwXWS5V2CUj7Du0H8g4BtEexz2HZYyuRNdFzDHLhfgTm5H-7QRmIyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMhttp
HTTP Request
GET http://www.google.com/sorry/index?continue=http://www.google.com/&q=EgS117BTGNK5-7wGIjAVfBCRVeIS7E0YwXWS5V2CUj7Du0H8g4BtEexz2HZYyuRNdFzDHLhfgTm5H-7QRmIyAXJKGVNPUlJZX0FCVVNJVkVfTkVUX01FU1NBR0VaAUMHTTP Response
429 -
127.0.0.1:54061 -
127.0.0.1:54061
-
8.8.8.8:53228.249.119.40.in-addr.arpadns
DNS Request
228.249.119.40.in-addr.arpa
-
8.8.8.8:5373.31.126.40.in-addr.arpadns
DNS Request
73.31.126.40.in-addr.arpa
-
8.8.8.8:535.114.82.104.in-addr.arpadns
DNS Request
5.114.82.104.in-addr.arpa
-
8.8.8.8:53evcs-ocsp.ws.symantec.comdns
DNS Request
evcs-ocsp.ws.symantec.com
DNS Response
104.78.173.45
-
8.8.8.8:53evcs-crl.ws.symantec.comdns
DNS Request
evcs-crl.ws.symantec.com
DNS Response
2.17.65.87
-
8.8.8.8:53hck.enotusfed.comdns
DNS Request
hck.enotusfed.com
-
8.8.8.8:53istockanalyst.comdns
DNS Request
istockanalyst.com
DNS Response
104.21.112.1104.21.16.1104.21.32.1104.21.64.1104.21.96.1104.21.80.1104.21.48.1
-
8.8.8.8:5387.65.17.2.in-addr.arpadns
DNS Request
87.65.17.2.in-addr.arpa
-
8.8.8.8:53104.219.191.52.in-addr.arpadns
DNS Request
104.219.191.52.in-addr.arpa
-
8.8.8.8:5345.173.78.104.in-addr.arpadns
DNS Request
45.173.78.104.in-addr.arpa
-
8.8.8.8:531.112.21.104.in-addr.arpadns
DNS Request
1.112.21.104.in-addr.arpa
-
8.8.8.8:5398j6.enotusfed.comdns
DNS Request
98j6.enotusfed.com
-
8.8.8.8:53167.173.78.104.in-addr.arpadns
DNS Request
167.173.78.104.in-addr.arpa
-
8.8.8.8:53jz4jz.opalimanos.comdns
DNS Request
jz4jz.opalimanos.com
-
8.8.8.8:53212.20.149.52.in-addr.arpadns
DNS Request
212.20.149.52.in-addr.arpa
-
8.8.8.8:53198.187.3.20.in-addr.arpadns
DNS Request
198.187.3.20.in-addr.arpa
-
8.8.8.8:53172.210.232.199.in-addr.arpadns
DNS Request
172.210.232.199.in-addr.arpa
-
8.8.8.8:53TRANSERSDATAFORME.COMdns
DNS Request
TRANSERSDATAFORME.COM
-
8.8.8.8:5311.153.16.2.in-addr.arpadns
DNS Request
11.153.16.2.in-addr.arpa
-
8.8.8.8:53www.google.comdns
DNS Request
www.google.com
DNS Response
142.250.178.4
-
8.8.8.8:53p82.opalimanos.comdns
DNS Request
p82.opalimanos.com
-
8.8.8.8:534.178.250.142.in-addr.arpadns
DNS Request
4.178.250.142.in-addr.arpa
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5494a3113d8759a37d39e4cc5a4b3dc2d
SHA116e693a0055dbc4c799220b522895c22730cdae0
SHA256b3c6ca55cf933b8724e4923a664f5e13cd2dac07f90e9179f41ca2bcda727015
SHA512b9a9a342abd3ae50095d7a405be6058fcdf140fe6893cb3a50caa20df9af4368a9ef5ea47ff1191760395e66381295922d530be7166e575c290057885e0de69b
-
Filesize
471B
MD5bae977366963bb7100ebf1732c8af5a3
SHA1c654956e9ce8faf3901cb5f8dbb6e11a41917aaa
SHA2566a54bce97c677b4874fd5cbdbeb297304e3662f6c4624a5ff345ea0bb6590d86
SHA51289c81dfad870c8e9f51ee8e9c0ee4556106fb14f87fc74bd928624a5fed8121c001c044d40ce853e524061ec191c232eee58a06307deadad98d0f65046509caa
-
Filesize
412B
MD5e2a346f7e9f530bfbb9eab79b58de0de
SHA132502c0b187128b13b182197ca047ba1f707e141
SHA2561093ca8e666c2a4894d8d55f7e8642f4f993e2f3497c53e5b42ec448a6428286
SHA512c316eb87ba3164ac21a13099a81b7e026edf399a90655766efe1f9d7aab01bd0beda47974e25cb27def2488e188a79a55ad084ff3b34b629b39b40cc526145fa
-
Filesize
2KB
MD562ef45c72c2cbb534865b3351b964e50
SHA1f2995b532b47f9a372d1e1c0c24edca1513967fe
SHA2569506d39b59bdaa8851ed6506b0a33309418469f5a7c493ea171aa877858303a0
SHA512151b3cffb0c7c9fd142f2bb2e98981043e492f8e37e7d684454ea407413f665222b6b205bf9627b636d49d4e9dbbe23ba55492a47274db64589cf31f808d9760
-
Filesize
36KB
MD58aaad0f4eb7d3c65f81c6e6b496ba889
SHA1231237a501b9433c292991e4ec200b25c1589050
SHA256813c66ce7dec4cff9c55fb6f809eab909421e37f69ff30e4acaa502365a32bd1
SHA5121a83ce732dc47853bf6e8f4249054f41b0dea8505cda73433b37dfa16114f27bfed3b4b3ba580aa9d53c3dcc8d48bf571a45f7c0468e6a0f2a227a7e59e17d62
-
Filesize
36KB
MD5f6a5ffe5754175d3603c3a77dcfeca6b
SHA1dacd500aeef9dd69b87feae7521899040e7df1d9
SHA256fab3529f4a4df98271fa2f6a7860a28fdc30215144b7eefbaf6d424a2847d035
SHA51266ec46041f1fe20203cda7a4d68b61d2e5bcdd09a36ee8171efa53fe92a9e6e023c5a254a4c43c110a99749829d7b99613f8d13dfb4c42656097cb8d224a531e
-
Filesize
96B
MD5732a32ad072ef786d816a4f85b1b6bea
SHA1fe1945717c160ac3266f291564a003c044d409b0
SHA2567dd2262373fcd6ebe2ed2c6e66242c85b1434c3fe23ca92ba41ae328ce8b941e
SHA51255b57d5bf942f20a3557f20adeebb4c01cde4aec9d7a4fa8bfe6281fe0981773d8ce637fdbd1dc64f25abe72d75fad2a6538fadc86483ede9fdc5b59c0d36b79
-
Filesize
190B
MD55d3dd5a4448598ff8af887f7673ecc38
SHA17bf8aa6d50e574fc6bb28b67f20efbdd8a473f02
SHA25675e076b4289b7a1081d470a066ee1d304518ef5c8269d8cd58266f126d2a7d45
SHA51271bd1d3e5a27cf930961b12c63a8d0fa7ae515b43ed7a9a57182ca6e809674ef036062d533c39f03c265051a102ab20f77f43c29bac435a859557ccd88649142
-
Filesize
696B
MD52f470a6fc56c5f107046ee5a49b2dc0c
SHA1350c5c5f789a64126bec7dc68981933e13fdda2b
SHA256f87a2df1117f271918b3a148338fd0721fef7ae73554129fe930192609388dc5
SHA512715e4919fee876e3b80de854c50bb67aa42c8c98ceeaad4fb813e769a4dd755c43929bdcdacefd5390a0c9c153d8a70a5a5c9b6c8169387b568b2fe531fe8872
-
Filesize
1KB
MD5007b21e48295731376168c6a0c261942
SHA1c860354f8bcd79b5572c0b8aafd457475ecabcaa
SHA2567e05484718e71c042dadea206dd6f1e2ec9d556441c946b84643f822b82b4770
SHA5129f786196866bb8b4c51789836444799dd5a47b2f3cedadbb1dc46e4c08810c836183324d723097a7537c2dd92d5de676cf2b2be0dfc5f77c53c82843e1787c04
-
Filesize
300B
MD55a17d52803b45d550356414e2c65f3e8
SHA1d05e25bcf1dff7e168612567cd95b6a8a62824ce
SHA256f6a1648adbfc7ffcc6bb8e577a1c8da3527d4bbc17a65ab83983c32e767e4ea6
SHA51247f1893f8b69b1d041f51de36fabba1870da39a50ee31893cf64335dd05c29970804fe6f1a9bfec74fa7b2835a3957dc9851b56df08908853072467cbe44d722
-
Filesize
1KB
MD5dba752b77238b435f4bf7dcd76197959
SHA114c9e47a1f113608409be0d58a29fbb32cd4d31e
SHA256e2e2f92255fac3fc09ef6b634c4d1202635d4769ccc090c8d2f97db0e05f43c9
SHA51207a487e380d294e6d9005b5967ab20df49a83aca3ad9507b68092e07fe37fd918aae2f889b3856b3c517ee0038297863c8386081a66935237952236fff8fd86f
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
112KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
1024KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
424KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
412KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
424KB
-
Filesize
412KB