Report - stsecirtempupload.blob.core.windows.net/incident-response/Kape.zip?sp=racw&st=2025-04-16T06:47:23Z&se=2025-05-16T14:47:23Z&spr=https&sv=2024-11-04&sr=b&sig=UgSaSEeFT3OeNrWBS44eQ0EbzQAcrkbGIevd7V/6pog=

Report Overview

Visited public
2025-05-06 09:09:12
Tags
URL
stsecirtempupload.blob.core.windows.net/incident-response/Kape.zip?sp=racw&st=2025-04-16T06:47:23Z&se=2025-05-16T14:47:23Z&spr=https&sv=2024-11-04&sr=b&sig=UgSaSEeFT3OeNrWBS44eQ0EbzQAcrkbGIevd7V/6pog=
Finishing URL
about:privatebrowsing
IP / ASN
20.209.72.65
#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
stsecirtempupload.blob.core.windows.net	unknown	unknown	No data	No data	668 B	14 MB	20.209.72.65

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
stsecirtempupload.blob.core.windows.net/incident-response/Kape.zip?sp=racw&st=2025-04-16T06:47:23Z&se=2025-05-16T14:47:23Z&spr=https&sv=2024-11-04&sr=b&sig=UgSaSEeFT3OeNrWBS44eQ0EbzQAcrkbGIevd7V/6pog=
IP
20.209.72.65
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

File type
Zip archive data, at least v2.0 to extract, compression method=store
Size
14 MB (14023475 bytes)
Hash
f9465299c8a9a48f0c17b886f6bf29d0
f6fdb710776e31c1ff6e5b989149ba65d63799ae
6fcbdde649ebf6156fac40c2c9a384365a12c1fa2051357fb1407b6732d15186

Archive (562)

Filename

Md5

File type

DocumentationAndEULA.txt

5df1999ff6fd330da672a4d53b8d38fa

ASCII text

Get-KAPEUpdate.ps1

2dc061ae17f114336f0c94ee23b13184

Unicode text, UTF-8 (with BOM) text

gkape.settings

9f886f8f22ee2e3b9777b28b12cc4b68

JSON text data

kape.exe

7e09af85742522ab31748c8992839ae6

PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

dfir-livedata.mkape

41eb4e4d538e37179c17e3e1b2c49746

ASCII text

Improsec_SysInternals_Autoruns.mkape

bd573ca1f291a9812bb81f13e099cf31

ASCII text

WinPmem-mini.mkape

a67adbc1987d6e6adabd82dd4a722816

ASCII text

DensityScout.mkape

e9604563e7d7d31d1ff4fb03930bca8e

ASCII text

DumpIt_Memory.mkape

f16536207b2d324cbee0ce7e1030615c

ASCII text

DumpIt_Memory_ARM.mkape

f726c467cc514c906d7c2d7d92085f8b

ASCII text

Everything_ParseEFU.mkape

c33aeaec0b1a5609278cc424c0ab6ba3

ASCII text

ExifTool.mkape

2a1ec38873befeea40e2af461a66fbe3

ASCII text

BackstageParser.mkape

f4d8e784136789ae5069cad4aec48051

ASCII text

BitsParser.mkape

1148a148375fe16d23d8c2bcd314d231

ASCII text

BMC-Tools_RDPBitmapCacheParser.mkape

8038aa462f8d67690fa08bb23233e8d3

ASCII text

Bulk_extractor.mkape

0a0e71a67773ff6c37ff83eaeb9e90d6

ASCII text, with very long lines (467)

CCMRUAFinder_RecentlyUsedApps.mkape

d498b6eed04fc29983111ca3878d30e6

ASCII text

Chainsaw.mkape

5e7b887e2cf64f6bd248fc03a8307782

ASCII text, with very long lines (305)

DeepblueCLI.mkape

f6d486cfb6758da2ed783c36d97205d6

ASCII text

DHParser.mkape

995e8e22801b6ce9d2ad92632f792c07

ASCII text

Ese2csv_SRUM.mkape

27c583a264ac530f8c02af186440ab2b

ASCII text

hasherezade_HollowsHunter.mkape

a4d16793d702cd4d064efcb2808fb4c2

ASCII text

HatTrickFreenetParser.mkape

54eafa67e02b1c3403a7b8a78bb47056

ASCII text

INDXRipper.mkape

2ba99b3aa95927acb601747309e9220f

ASCII text

iTunesBackupReader.mkape

92b227bb8d2e02aad02d7991821f621c

ASCII text

KernelDump.mkape

20b9c5a081810f315ddf14f70e597dd9

ASCII text

LevelDBDumper.mkape

092e81f04bcb6fe414eabf4995e1753d

ASCII text

log4j-scanner.mkape

7c7f23d2d7f2a40aa6fc3dadbb5feec2

ASCII text

Loki_LiveResponse.mkape

5b91621403c5581ed54e629120961bb8

ASCII text

Loki_Scan.mkape

b5d52a54d7f1835c03a6e7f85df354df

ASCII text

LolDriverScan.mkape

29c4a75b8fe1f56143b37820c0d1dd96

ASCII text, with very long lines (304)

mimikatz_NTLMHashes.mkape

77da26569475c189d2ca82128b085cb5

ASCII text

MMDBCmd.mkape

000c98fa9fb7c99d7113d1cca42c0cc9

ASCII text

Mplog-Parser.mkape

5fb3782d0ac58c9a8403c534e1e07d5b

ASCII text

ObsidianForensics_Hindsight.mkape

f1346fb7082e697260b36431d438f2fe

ASCII text

OneDriveExplorer.mkape

7a978a91970b62549de6bb8f1dd154a0

ASCII text

PowerShell_AD_Timeline.mkape

abfdd1fc51c65be1746ce3abc2251d8a

ASCII text, with very long lines (335)

PowerShell_ConvertPSHistoryTo-CSV.mkape

916a860744c834723c351e82cf7f9af0

ASCII text

PowerShell_ConvertUsageLogsTo-CSV.mkape

480e006e05374c584df2f1ebe4272849

ASCII text

PowerShell_ConvertWindowsDefenderMPLogTo-CSV.mkape

496e5429f2893ab7b4a070dfc4b4e23d

ASCII text

PowerShell_Execute-BmcTools.mkape

81f040e28083b234b4ff5f6088cf9168

ASCII text

PowerShell_Execute-ThumbcacheViewer.mkape

eeb8abf938895b1420150eaf9b6d3db6

ASCII text

PowerShell_Execute-Winlogbeat.mkape

460bf6b71876d3664659609526777e4c

ASCII text

PowerShell_Get-ChainsawSigmaRules.mkape

04c02565b4c3e258dc7e9628c15a78a7

ASCII text

PowerShell_Get-DoSvc4n6.mkape

11fc5b90ad611f792019f6e0a9d50ee5

ASCII text

PowerShell_Get-NetworkConnection.mkape

bb040f45a7826c51d3db386aa5889236

ASCII text

PowerShell_MFTECmd_J-MFTParsing.mkape

3efb9f5512e5c7d5b3d552db5fcf8788

ASCII text

PowerShell_Move-KAPEConsoleHost_history.mkape

2e9d7a5b32636e29f88acdd32f1f5998

ASCII text

PowerShell_Netscan.mkape

d18408e15f1030bd1759697210b7be8f

ASCII text

PowerShell_Parse-MatterMostDownloadsJson.mkape

328ead48f81c80455a36befe80df58c0

ASCII text

PowerShell_PCAParser.mkape

df683c799ea7d1a28fcef962a94cfc0f

ASCII text

PowerShell_Signed.mkape

a5500ea4c09449b9049456d15eb814a5

ASCII text

PowerShell_SrumECmd_SRUM-RepairAndParse.mkape

ac92336ee3c7f5d8f21fef055f3fc8f2

ASCII text

PowerShell_SumECmd_SUM-RepairAndParse.mkape

5a4f03e8cbffb5671a8bcef70a7cfc46

ASCII text

PrefetchDecompressionEnMasse.mkape

3ff855797dce97739d635f6d754b4be1

ASCII text

SEPparser.mkape

29d102d7194e4b6e710ab6013007f265

ASCII text

SIDR_WindowsIndexSearchParser.mkape

0db99a811f22bf288b627a043969cf8c

ASCII text

SRUMDump.mkape

4cda4fccdb8eeb5620f3e10c533af2a8

ASCII text

TeamsParser.mkape

596600e3d2f92e028fb2ba1e40835396

ASCII text

ThumbCacheViewer.mkape

2956f3828c21612a011d571d946ab7bb

ASCII text

VLSeeRecent_VLCRecentFiles.mkape

7a8112bd609ad7cb793d1d9830be80dc

ASCII text

WIFIPassView.mkape

812c4c00734484ca265cb6d772d527fb

ASCII text

Windows_Hello2Hashcat.mkape

58b963e2d49081cde03bcbc66b5423ae

ASCII text

WMI-Parser.mkape

f9f1655e7a470f2cf84e89a1af8d0e0a

ASCII text

KAPE_Automation.mkape

c36259941ec36758c97869087cb44035

Unicode text, UTF-8 text

Kaspersky_TDSSKiller.mkape

f1f744cbf20dbe447fc0df9339e71310

ASCII text

McAfeeStinger.mkape

b3725f832cda41bfc3ae04d2a46e0637

ASCII text

NTFSLogTracker_$J.mkape

7218d98589df902a408448b6159651bb

ASCII text

NTFSLogTracker_$LogFile.mkape

bea14a517296d78d2e9ec64edeb06b9c

ASCII text

PowerShell_5SecondPause.mkape

db3a6687b3582235c88fef59bf9c4bf0

ASCII text

PowerShell_log4j.mkape

3a4d05aa9332e160c4b327a2031d2561

ASCII text

Snap2HTML.mkape

a8d5e9c230a2cfcd9d6fd5bfedaf0de6

ASCII text

SQLite3_TeraCopy_History.mkape

863c3179b4f66b3665e6cc0cce3572c9

ASCII text, with very long lines (621)

SQLite3_TeraCopy_Main.mkape

3ac31c8638e9b2f25853c345b3da9404

ASCII text, with very long lines (403)

SysInternals_Autoruns.mkape

aba20fc9557a148135bfae354f3cbdda

ASCII text

SysInternals_Handle.mkape

a1873bbbc583272354ffda6572e80db2

ASCII text

SysInternals_PsFile.mkape

796453107158119f3ed4550605e563f5

ASCII text

SysInternals_PsInfo.mkape

ae0501b38dbfba8419cb794e740481cb

ASCII text, with very long lines (351)

SysInternals_PsList.mkape

fccad7a95d269f44f9a29bf340c4f3f5

ASCII text

SysInternals_PsLoggedOn.mkape

db00c31612ebd66511553d0785a336c6

ASCII text

SysInternals_PsService.mkape

4f8e7183ea56076cc494b45afa20100f

ASCII text

SysInternals_PsTree.mkape

e99a2b2ff5540392b73df1e2fbfe31cc

ASCII text

SysInternals_SigCheck.mkape

177a0aa17dcf989ed75bc9f6bed88436

ASCII text

SysInternals_Tcpvcon.mkape

1d6ecd048c844bb061c7af0312811569

ASCII text

Winlogbeat_ALL.mkape

feefe20c83c390b381c7aea4c10ff698

ASCII text

Autoruns.exe

583ed542be17b83f3c102d49fe984e26

PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections

Autoruns64.exe

2b2d8df5fc1cab874d05c4a820fbcde3

PE32+ executable (GUI) x86-64, for MS Windows, 9 sections

autorunsc.exe

86abd51a63aa80dd57f491d9bc489930

PE32 executable (console) Intel 80386, for MS Windows, 5 sections

autorunsc64.exe

75c71f8328f5ed7e9f638a40aecacfd6

PE32+ executable (console) x86-64, for MS Windows, 7 sections

bstrings.exe

3767936b7666f4dcfa37d59aa1464f4a

PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections

Get-NetworkConnectionUTC.ps1

7e9873a3f705f1764c8cd3c09c222184

Unicode text, UTF-8 (with BOM) text

handle.exe

9f637fba2d680e23da0266c1507f870f

PE32 executable (console) Intel 80386, for MS Windows, 5 sections

pslist.exe

6c08bae0981841e0cd22ff0f0e8f7510

PE32 executable (console) Intel 80386, for MS Windows, 5 sections

PsService.exe

136f9205a5945681ec470b8461dfee5f

PE32 executable (console) Intel 80386, for MS Windows, 5 sections

winpmem_mini_x64_rc2.exe

9dd3160679832165738bfabd7279aceb

PE32+ executable (console) x86-64, for MS Windows, 7 sections

!!ToolSync.mkape

e5bd30f72bfb382efee50c68e7c51220

ASCII text

!EZParser.mkape

ab1f472c241553ae60e6a4b4d12296b8

ASCII text

bstrings.mkape

615912c68dbd9d41c74554c1eefa66f4

ASCII text

bstrings_CryptoWallets.mkape

7e50275c1dd963cb62bb0079bb7b203e

ASCII text

Events-Ripper.mkape

2b1b1566f4da67b0f64afd3442ba587f

ASCII text

Hayabusa.mkape

4681de11a114f768d1106a79b89df477

ASCII text

KapeResearch_Registry_JSON.mkape

fa9d6116b9eeb3b41058fc4afcffaf1d

ASCII text

LiveResponse_NetSystemInfo.mkape

a6e6df4e1ab825a1a865e33aa54a651d

ASCII text

LiveResponse_NetworkDetails.mkape

8b1dad264fe27f60512a66b7fa771e83

ASCII text

LiveResponse_ProcessDetails.mkape

d3a5f84fd279660595887ac198193c9c

ASCII text

LogParser.mkape

924101236e8d9060e4cfbc6425db7dd7

ASCII text

MFTECmd.mkape

c775b4d3f95d1ef2c19646da80cdf753

ASCII text

NTFSLogTracker.mkape

8e9c4944ed8f200e9346673c1afb8158

ASCII text

PowerShell_LiveResponse_SystemInfo.mkape

0c43536d2b5626be6107b4328d4ae702

ASCII text

RECmd_AllBatchFiles.mkape

78333880b190c64895aa9a029bdb20f5

ASCII text

CompoundModuleGuide.guide

b35821db56c7331519cc55e0408b0392

ASCII text

CompoundModuleTemplate.template

d16df3ed126416e5651cb0ab48fc1c6f

ASCII text

AmcacheParser.mkape

ce453ce59a32e1308e44001844d88607

ASCII text

AppCompatCacheParser.mkape

4a634f0878c90f0bbb3f3e90da1eb1ee

ASCII text

bstrings_AeonWallet.mkape

9a85ad1e47a810a8eca240a758dfa0b1

ASCII text

bstrings_BitCoinWallet.mkape

ca09c714e1dcccb38767d6acd37f2922

ASCII text

bstrings_Bitlocker.mkape

9d9bd59b5430cd7815ce6a2b7b4fd467

ASCII text

bstrings_ByteCoinWallet.mkape

eac9f20207758ab33cd14cc1017bd868

ASCII text

bstrings_CreditCards.mkape

97dd8740dfbf2f556cd07797741c244d

ASCII text

bstrings_DashCoinWallet.mkape

0a92e636a2148c6d3a20285430b5f603

ASCII text

bstrings_DashCoinWallet2.mkape

3919073be3b3d5ae0be61e07dd55bbfd

ASCII text

bstrings_Email.mkape

e2db752b42556bbfeca2cf5c052dbc93

ASCII text

bstrings_FantomCoinWallet.mkape

651ff992fd0f1d0717cf98c27895344a

ASCII text

bstrings_IPv4.mkape

dfde4820d42587edbdcaebfd7d26ab4d

ASCII text, with very long lines (305)

bstrings_MACAddresses.mkape

ff199efe3b5d0896dc9062ff6f905fe6

ASCII text

bstrings_MoneroWallet.mkape

66a2947ef94fcc39ee410b752207a0b3

ASCII text

bstrings_SSN.mkape

dd29df233b477f2cd6bee2e88b902227

ASCII text

bstrings_SumoKoinWallet.mkape

6bb962e3e63d71fab9700044083ad0c2

ASCII text

bstrings_UNC.mkape

04d02ba6353afd96f4ee3c0057436bda

ASCII text

bstrings_URLs.mkape

c670fe68aad7ce4636aa6fc0d1377f19

ASCII text

bstrings_USPhone.mkape

ded04016cedb3a8dfca89c6f3ff159ba

ASCII text

bstrings_WinPath.mkape

a470508006478dc4b1e7a00bb61a59fd

ASCII text

bstrings_ZipCodes.mkape

bef160a5c80fca5807405ccf4abe9c20

ASCII text

EvtxECmd.mkape

94a780432ecebf768b230ff2d9f5291b

ASCII text

EvtxECmd_RDP.mkape

290277cbba3ba49dc36fe632d3d988dd

ASCII text, with very long lines (494)

iisGeoLocate.mkape

f21400bb4b3487251c577b45060e2b3e

ASCII text

JLECmd.mkape

4e0a49d3ad82bbb2268fa30304b50e8e

ASCII text

LECmd.mkape

b0f3ccf0d6a763240f64f175bbb68af3

ASCII text

MFTECmd_$Boot.mkape

44c440f5f222a1ef82fabb11f4b7e9d5

ASCII text

MFTECmd_$I30.mkape

bc7043634f72c956361157a25eca4c5e

ASCII text

MFTECmd_$J.mkape

880093dfb0cb6a964c2cd0a01e3eea2d

ASCII text

MFTECmd_$MFT.mkape

70114f8b76c1b07c1403d9b1b7694587

ASCII text

MFTECmd_$MFT_DumpResidentFiles.mkape

06eba1c5547b6d8873928f82feeb11cc

ASCII text

MFTECmd_$MFT_FileListing.mkape

0fc996ce958c990685d54c6e48732533

ASCII text

MFTECmd_$MFT_ProcessMFTSlack.mkape

30d09b75fa7fb7c92fe02626a4f6acaa

ASCII text

MFTECmd_$SDS.mkape

d7d03376f1fa16e7dde8aaf744f9a2de

ASCII text

MFTECmd_BulkExtractorCarvedMFTRecords.mkape

3568486a935a22afc91174cd2d9dda5e

ASCII text

PECmd.mkape

c92ad16f550fb1d9f7a3f6dc4aa2790b

ASCII text

RBCmd.mkape

881fdbdfe0e36e41dcfacc6c29a1d858

ASCII text

RecentFileCacheParser.mkape

bf5c0acbd5f39a6b3ce5839024a9c82b

ASCII text

RECmd_AllRegExecutablesFoundOrRun.mkape

9db651bc51c7f1656ad70be81a5639e5

ASCII text

RECmd_BasicSystemInfo.mkape

aea7b0080f8a4f9e8a03e083aa2ba955

ASCII text

RECmd_BCDBootVolume.mkape

af9b8acec40c793ce542103486310b7a

ASCII text

RECmd_InstalledSoftware.mkape

1d0f7c1070f7c944e2d4e3b62a700945

ASCII text

RECmd_Kroll.mkape

fd89aacb7870a9777cf22fd67f7b7b78

ASCII text

RECmd_RECmd_Batch_MC.mkape

8e79d2beb51f1a1e7d6c4e22eb417808

ASCII text

RECmd_RegistryASEPs.mkape

273a7653d97ecb4cd7950ab075dc2678

ASCII text

RECmd_SoftwareASEPs.mkape

509866cd0aa996af6aa3928405a4bfa4

ASCII text

RECmd_SoftwareClassesASEPs.mkape

bf4395ce3c92079157d72e4ce9dde09b

ASCII text

RECmd_SoftwareWoW6432ASEPs.mkape

027b2b5965dc01950c8fee91634a40c9

ASCII text

RECmd_SystemASEPs.mkape

afe96f8526052a7d276443cacd576edf

ASCII text

RECmd_UserActivity.mkape

03b1ee177d61453fa0a0ed5ad23e7758

ASCII text

RECmd_UserClassesASEPs.mkape

621a39d81ecf4430c8896f8422809d50

ASCII text

SBECmd.mkape

c92a48221adbda2bcc57b42daed195b4

ASCII text

SQLECmd.mkape

d1935b9419a5623917511537cb4a44ee

ASCII text

SQLECmd_Hunt.mkape

98f255001767537654084d678741764d

ASCII text

SrumECmd.mkape

f117e395e6409b9ba3058de0d65df773

ASCII text

SumECmd.mkape

8c9ce40e6dbea0b9f0bb9c9580757a74

ASCII text

WxTCmd.mkape

ccfa21364698b050597226d2620fc51e

ASCII text

itm8-PowerShell_Get-NetworkConnectionUTC.mkape

c9f96e92acf5d9f8c165143ee5fab345

ASCII text

itm8-PowerShell_LocalAdmin.mkape

be9c1cf6037050cd3146d939a4fadf6f

ASCII text

itm8-Powershell_NamedPipes.mkape

c3dc173b2aac5cf36029d2e939b43a67

ASCII text

itm8-PowerShell_ProcessList_WMI.mkape

4c5cc3a0a93ee5bcbd61e4a354fce936

ASCII text, with very long lines (1286)

itm8-Powershell_Services.mkape

6d626cdaa16c3db2d73101a81c294396

ASCII text

itm8-PowerShell_SMBMapping.mkape

4f3c775ed1e29b18c71c713d2118251d

ASCII text

itm8-PowerShell_WMICollector.mkape

a6a45fa8811ef32271cf8a0eac527698

ASCII text, with very long lines (628)

itm8-Windows_schtasks_csv.mkape

87b2f7f2b2e39af7b5129933b6db9d05

ASCII text

itm8-Windows_schtasks_xml.mkape

002ff56baefff79c6703702a90cdc4d5

ASCII text

KapeResearch_EventLogs_XML.mkape

49899b633875d2002e362edcf34f91d3

ASCII text

KapeResearch_Registry_Amcache_JSON.mkape

c30644342180a5267cbfb7817a4fb88c

ASCII text

KapeResearch_Registry_BBI_JSON.mkape

cf601ca57f289e0461d5c28ceecca12c

ASCII text

KapeResearch_Registry_BCD-Template_JSON.mkape

4d9b28b771aa771762d6d43e254f7c70

ASCII text

KapeResearch_Registry_COMPONENTS_JSON.mkape

622348bfdd682ab24d39902fc0cb1824

ASCII text

KapeResearch_Registry_DEFAULT_JSON.mkape

3e4311f328edc38db5a4fa12588ac5db

ASCII text

KapeResearch_Registry_DRIVERS_JSON.mkape

f9def76ed4f92999c680b9ab506d3a95

ASCII text

KapeResearch_Registry_ELAM_JSON.mkape

dc8f1e8539757924be35925756f37cff

ASCII text

KapeResearch_Registry_NTUSER_JSON.mkape

6b22dd266bb7e4551bdf7779f5feb94b

ASCII text

KapeResearch_Registry_SAM_JSON.mkape

a60a45efda588407e6422f5af6b232da

ASCII text

KapeResearch_Registry_SECURITY_JSON.mkape

dc47a188192718172bc648b49de0d5be

ASCII text

KapeResearch_Registry_SOFTWARE_JSON.mkape

8135e8a2dfd3a86963a92749d63b1522

ASCII text

KapeResearch_Registry_SysCache_JSON.mkape

1e049f947c74830a0a8f49493c7c72dd

ASCII text

KapeResearch_Registry_SYSTEM_JSON.mkape

624fe79787c6e870837fe86147e1b19e

ASCII text

KapeResearch_Registry_userdiff_JSON.mkape

2d303d389de8bf3eed029599edd8f43a

ASCII text

KapeResearch_Registry_UsrClass_JSON.mkape

4ddcb388c79cefde0f176948e28ce2df

ASCII text

KapeResearch_Registry_VSMIDK_JSON.mkape

793265185a4689c35cc87ccfbfd4d495

ASCII text

Sync_EvtxECmd.mkape

c3406a79836c7f3ebf8f3ba42532856b

ASCII text

Sync_KAPE.mkape

494e164ecbad2dc81b304d59713260c5

ASCII text

Sync_RECmd.mkape

699fb0b085fe668c9e6734708874f41a

ASCII text

Sync_SQLECmd.mkape

0f9129ea1c4f8f39b51438dfb679e9da

ASCII text

ModuleGuide.guide

36c2308234210d516f29ca47953f50d5

ASCII text, with very long lines (305)

ModuleTemplate.template

c2cd335326e8e48a416a9f2118451d66

ASCII text

PowerShell_Arp_Cache_Extraction.mkape

cd4ea63df9d7dfd4fa94e1c1641811ec

ASCII text

PowerShell_Bitlocker_Key_Extraction.mkape

53b0eac138d615e886ed79c45d83dc4a

ASCII text

PowerShell_Bitlocker_Status.mkape

7a48811c91405649df3e8e9bea76aafc

ASCII text

PowerShell_Defender_Exclusions.mkape

b3d2bf8f4c6942a72e43b80c16b3e91c

ASCII text

PowerShell_DLL_List.mkape

d69600eeac825ea72929dff03c98b7e4

ASCII text

PowerShell_Dns_Cache.mkape

d23be2502601f7145e263c54e4a14c60

ASCII text

PowerShell_LocalAdmin.mkape

70c9d2dbd95d85eacf7ef08c0f7a7be3

ASCII text

PowerShell_Local_Group_List.mkape

57f298e3abab2f76f98e2be9698c0018

ASCII text

PowerShell_NamedPipes.mkape

4e4058beb8240a49fb6d95e9cbbe8c5c

ASCII text

PowerShell_NetUserAdministrators.mkape

4f7261f277a6dcae8dca1b75ba758612

ASCII text

PowerShell_Network_Configuration.mkape

f422397d313470560c5dd5d7a2d178ec

ASCII text, with very long lines (442)

PowerShell_Network_Connections_Status.mkape

55c3c5039ae5e81a174180510efa66dd

ASCII text, with very long lines (304)

PowerShell_Network_Share.mkape

a177974357a0cf3fd9386071ec57c9b0

ASCII text

PowerShell_ParseScheduledTasks.mkape

7645ec5ca5efa39c1455c000e80a0f55

ASCII text, with very long lines (1424)

PowerShell_ProcessList_CimInstance.mkape

762523005388937ff06b3a2b8b94eb77

ASCII text, with very long lines (357)

PowerShell_ProcessList_WMI.mkape

1b199403e4be769d89642acbdc5ae985

ASCII text, with very long lines (1287)

PowerShell_Process_Cmdline.mkape

981cf9e355d5bb6e977014bcf8d74752

ASCII text

PowerShell_Services_List.mkape

922ec68ee21544d6b40dabecd8b3dbde

ASCII text

PowerShell_SMBMapping.mkape

e766ee14a3375b543b27478e7bcbaafe

ASCII text

PowerShell_SMBOpenFile.mkape

372897458e64265ff30a23d54c29ea3f

ASCII text

PowerShell_SMBSession.mkape

0e3fa29c86dd24545f214ae624d5f7be

ASCII text

PowerShell_Startup_Commands.mkape

79730ba91439d2cb46e7d3fb46da1894

ASCII text

PowerShell_User_List.mkape

8d8c62e5ae034b19459df7e13908c4f4

ASCII text

Powershell_Wireless_Network_Connections.mkape

fb3449907fb2d9fd36b77cdd7fa0853f

Unicode text, UTF-8 text, with very long lines (400)

PowerShell_WMIRepositoryAuditing.mkape

c4851b95e096788bb236c411cd56a164

ASCII text, with very long lines (372)

Windows_ARPCache.mkape

68b67be41ad097b0505220f384aa7887

ASCII text

Windows_DNSCache.mkape

1538c0a464d5d58c7975233ee8b9022b

ASCII text

Windows_GpResult.mkape

c9bcfddeb098275e853ad723c5875f9c

ASCII text

Windows_IPConfig.mkape

5274927ad218eb0c896835bd666e9090

ASCII text

Windows_ManageBDE_BitLockerKeys.mkape

9973b8e293ab19752a0cbf71a055b4ca

ASCII text

Windows_ManageBDE_BitLockerStatus.mkape

bd55fbdcff421fb20d91026000b1e3c8

ASCII text

Windows_MsInfo.mkape

d2a32657d552af931c554d86b93c6e52

ASCII text

Windows_nbtstat_NetBIOSCache.mkape

b7e12050dfe910e898d176ddd2da39a5

ASCII text

Windows_nbtstat_NetBIOSSessions.mkape

57c1275868f542d35cdfab0741bd311a

ASCII text

Windows_netsh_portproxy.mkape

31b9c860c7aab11de8738c989f6c4e79

ASCII text

Windows_NetStat.mkape

1b0c4e00020455348a334b07f90e1e62

ASCII text

Windows_Net_Accounts.mkape

d3816f61fb7695e0929c03037195be43

ASCII text

Windows_Net_File.mkape

e5b9cf98ef6515c61602dc5cc134e7d8

ASCII text

Windows_Net_LocalGroup.mkape

66028f9e156ce965af19e941a9e65de2

ASCII text

Windows_Net_Session.mkape

52e0cbc25c28db4a183ff653a08fdda6

ASCII text

Windows_Net_Share.mkape

28514c49403b0d2eac34d0960382316a

ASCII text

Windows_Net_Start.mkape

c1d173e6a6f4a963f76f7c07e1aee966

ASCII text

Windows_Net_Use.mkape

64b3cc603fec640cee8f4c99a6b23732

ASCII text

Windows_Net_User.mkape

e3a6e2cfa24032986dc684f785e843f4

ASCII text

Windows_qwinsta_RDPSessions.mkape

a43ca741bea0580d32c92749d05e9147

ASCII text

Windows_RoutingTable.mkape

ef37b93d74e5dfa5e9eb6713d4052bc1

ASCII text

Windows_schtasks.mkape

ee8e5b4e8d991c723f23d7a009aab350

ASCII text

Windows_SystemInfo.mkape

ac8e10929d7f6fff2747b8b94a023012

ASCII text

sas.txt

e6286c7ee87a6cd6a6a5fe619cbc9e38

ASCII text, with no line terminators

!KapeTriage.tkape

e099a8c81f0b92d3b468fee05c7eb042

ASCII text

dfir-target.tkape

f2b16d69c761754244f0c47bafab2aae

ASCII text, with very long lines (379)

EventLogs-RDP_6db0441c-db0b-4cab-b3cf-5fbed682fa5b.tkape

437c504615ca72910bd4499c7f424c09

ASCII text

USBDevicesLogs_77aa6fd6-8b06-4061-8213-cc36783f424e.tkape

8c6eff461cf763347e472d3fbf8bcf24

ASCII text

Avast.tkape

b999dee150e842f336ce61f878b174b8

ASCII text

AVG.tkape

723d94e660d0de568976b5781b990dfa

ASCII text

AviraAVLogs.tkape

d3fdd7a537f7fd8a433b27cda9d70f07

ASCII text

Bitdefender.tkape

bfe5d4cb90c05c3ce7d362d984b86241

ASCII text

Combofix.tkape

9eaa6b89219a92551c144e50e743c504

ASCII text

Cybereason.tkape

ab0246df02a58d79856006111cf6714f

ASCII text

Cylance.tkape

4ec66d03ef51162a97faf9dbc7f4aad6

ASCII text

Emsisoft.tkape

a8c5b271d3c1b3b35024ed96b86c5dad

ASCII text

ESET.tkape

ff362c876e5cc1e6d01a2bcb9ae0557f

ASCII text

FSecure.tkape

48f0dda3d6287fdf4608d6c4bc010e1c

ASCII text

HitmanPro.tkape

06084ccdd164e02e50173e1b2bb67f26

ASCII text

Malwarebytes.tkape

4b3ac5e52f9271def13a09d002219fa0

ASCII text

McAfee.tkape

841310ebada24f557c429ce6f8dc0afc

ASCII text

McAfee_ePO.tkape

f255d2da120790728bdb34164c58a5c0

ASCII text

RogueKiller.tkape

af94d6d3e6e1067bbb13d1e0632d2b2e

ASCII text

SecureAge.tkape

d85b318b2f0d46ab276f1e3a84e84b0a

ASCII text

SentinelOne.tkape

5c638a4c861386061f3309e02a69a2f1

ASCII text

Sophos.tkape

2ba278abade7bc0272c705cdfacb5437

ASCII text

SUPERAntiSpyware.tkape

2e6070b9251b3d24fc478bf5929a1894

ASCII text

Symantec_AV_Logs.tkape

752cd3a36f15d03d01f5f2b2c14f4640

ASCII text

TotalAV.tkape

77b84c6e3646a62c774e1e3c1c5e696f

ASCII text

TrendMicro.tkape

fceab95544d50d200cec71b2363b0356

ASCII text

VIPRE.tkape

5d4e15d1b038bc59249e18bfaf7bb233

ASCII text

Webroot.tkape

ac2f6ee8ac68d2f76d9baa5bce73a802

ASCII text

WinDefendDetectionHist.tkape

7d7c5bad60bb254dc43ff1b735adcd0d

ASCII text

WindowsDefender.tkape

28f8d2433f727e42751d643953396f95

ASCII text

1Password.tkape

4933bf28c68cda01d4fcc2aae62542e3

ASCII text

4KVideoDownloader.tkape

77135986b5d3ec9402bee8fd55636e2d

ASCII text

AceText.tkape

012b48d6475d7d0047e3f0ce1fea3d8e

ASCII text

AcronisTrueImage.tkape

cfaaa676986088c96a2eceeaf6ef5018

ASCII text

Action1.tkape

1c8b470f399d4eda65aa0c06f8c6d6ea

ASCII text

AgentRansack.tkape

11d1904c1817cfc35756f0163e3dcb7d

ASCII text

Ammyy.tkape

1b2acac2993bcc488ada368b1867badb

ASCII text

AnyDesk.tkape

3dc9016ed975297433203fd4ae09ee1e

ASCII text

AsperaConnect.tkape

f0a2396ed51717f2c1e65a12eef0a3b1

ASCII text

AteraAgent.tkape

684347d75eaa686cd0fb73e6d4ff481a

ASCII text

BoxDrive_Metadata.tkape

dd6efbeb94047f7e0194d8e0b721565d

ASCII text

BoxDrive_UserFiles.tkape

5be58762952653c9c1efba7059b6b33f

ASCII text

CiscoJabber.tkape

82a8b9cc76575476968f9385eafa4799

ASCII text

ClipboardMaster.tkape

eb7481ebc913f9eae0e0480c081423a5

Unicode text, UTF-8 text

ConfluenceLogs.tkape

97ee212fea1e57b01f58598831afede3

ASCII text

DirectoryOpus.tkape

7388b9c69c25b6c4d7e87f51e06981c7

ASCII text

Discord.tkape

aa2d18297ff0e672e237696609826daf

ASCII text

DoubleCommander.tkape

136db0da026300458a6e4fe2358d161b

ASCII text

Dropbox_Metadata.tkape

7984f4226a464b7be95ada7087a16c46

Unicode text, UTF-8 text, with very long lines (400)

Dropbox_UserFiles.tkape

abfd960faaab0a61de1cd43a990230e7

ASCII text

DWAgent.tkape

a026139b85b741a548843222f3b0a3c4

ASCII text

EFCommander.tkape

33356430febf4338b248ae3a0afb6f3a

ASCII text

Evernote.tkape

41adcfcfb4c8099628cc5dbb5a1636c8

ASCII text

Everything (VoidTools).tkape

024bb0d4d6161286964c07524720ef98

ASCII text

ExchangeTransport.tkape

862a55e4ec7ca3f398d0833b6835be29

ASCII text

Fences.tkape

9d033e2fa7be1ada9f9277d72b6e0eb9

ASCII text

FileZillaClient.tkape

c7bb172a4d9231664a379fbf9910bc52

ASCII text

FileZillaServer.tkape

14a16c03d8d0df1e261b05f46169a4ba

ASCII text

FreeCommander.tkape

46ab1aaa5229d195489bb6cf756c2bf9

ASCII text, with very long lines (337)

FreeDownloadManager.tkape

5d09d14cda4678893805ada723606591

ASCII text

FreeFileSync.tkape

8d06320a7399fa8c5aedc7b7150f6cbe

ASCII text

PowerShell_Get-NetworkConnection.mkape

759603abd7dd2b62416ebb4c1ca6854c

ASCII text

GoogleDriveBackupSync_UserFiles.tkape

0fd562d234846a2cf884f10be35f2cb8

ASCII text

GoogleDrive_Metadata.tkape

230575f2af4ac4fa8cd5985580512233

ASCII text

GoogleEarth.tkape

a8dea3b3e5fb481dc28b4ea8af2a84db

ASCII text

HeidiSQL.tkape

bbffb8172283fddab600f4647efa600d

ASCII text

HexChat.tkape

84a78009b45c775ca736ba506502ace4

ASCII text

IceChat.tkape

952a503db46fea2a0568ac631913f94e

ASCII text

Idrive.tkape

043fe369127305cc2527c4ffa674db91

ASCII text

ImgBurn.tkape

220291aed35ce85c8717f90db98c752c

ASCII text

IrfanView.tkape

1d7a45403dc61e4a9631b09150625380

ASCII text

ISLOnline.tkape

f25bef1f60e3f989801153f0c2f8b2c7

ASCII text

iTunesBackup.tkape

3ced4db297745fbc8a5421dd3e2b82ab

ASCII text

JavaWebCache.tkape

fa60deb4ecee08e399ad19222e6b6279

ASCII text

JDownloader2.tkape

6726918e27d94e053f54cc7b23c3d0d3

ASCII text

Kaseya.tkape

e2d8170510ad4c79136306023bf94d80

ASCII text

Keepass.tkape

f068c1478b0d474161446f5aee0eaf93

ASCII text, with very long lines (403)

KeepassXC.tkape

846854df3d7d0fabce4cf11811c31197

ASCII text

Level.tkape

562999dc047febc97fadc3429e81e80c

ASCII text

LogMeIn.tkape

94fd1bf03fcc60ba99ba9b1401d631f4

ASCII text

MacriumReflect.tkape

74f15192841bf2e7e381ed448b7af1d6

ASCII text

Mattermost.tkape

80bc93c9a355699da78089d3b099c388

ASCII text

MediaMonkey.tkape

8eff34fd1d393070b7ad4ebfdc30f47d

ASCII text

Megasync.tkape

e3707fc84f7f98ab3077996cd627a2ae

ASCII text

MicrosoftOneNote.tkape

36e91bca163da53a4113f10e15947bc6

ASCII text

MicrosoftStickyNotes.tkape

e26081037c693a37a54b5436e176ec6a

ASCII text

MicrosoftTeams.tkape

80a05e6a983df3f672e85b79b59c603f

ASCII text

MicrosoftToDo.tkape

39a50380b9178a4c223201f1cd61250d

ASCII text

MidnightCommander.tkape

6d57e4b5196ba41d86ea798bf8a62787

ASCII text

mIRC.tkape

4bd3dd5b34f5cdcddf47ef2d9a040978

ASCII text

mRemoteNG.tkape

7930b69dff065f92940dc8be61641dc2

ASCII text

MultiCommander.tkape

05363658ccdb4ee9bfd8fefc2575680a

ASCII text

Nessus.tkape

3654743b12e10acbd71116da201acd97

ASCII text

NetMonitorforEmployeesProfessional.tkape

007da95c16c50d75c696f538d0dcf380

ASCII text

Notepad++.tkape

adbfe3e79e2e472a04cff91a0141d050

ASCII text

Notion.tkape

0246301fb10b714b9580c43db70d5132

ASCII text

OneCommander.tkape

1be455d57851e9f0508722383e5e5e39

ASCII text

OneDrive_Metadata.tkape

be367d916a5db616e362821c44ea111c

ASCII text

OneDrive_UserFiles.tkape

1558dae3f290cc06beab763561f35c42

ASCII text

OpenSSHClient.tkape

b4ac7573b4bb7bb5e5dda1d24ae7370d

ASCII text

OpenSSHServer.tkape

a42660c42992d09129c554de04ffc66a

ASCII text

OpenVPNClient.tkape

f5b8429a145125884103be3a4f3a1ff1

ASCII text

OutlookPSTOST.tkape

9c34f85dbb42faba109bed4ea91eb9b1

ASCII text

pCloudDatabase.tkape

3e5232fb8b749e1b110843c2f648a32e

ASCII text

PeaZip.tkape

d4d3deca471723566dfee252a20cd1af

ASCII text

ProtonVPN.tkape

53b4b36a62c5396251669d1a7f3c6e2e

ASCII text

Q-Dir.tkape

00bb65821e431fae3aca30166e8a7e1a

ASCII text

QFinderPro (QNAP).tkape

d4581054b77ebbffd0146145253f3eda

ASCII text

Radmin.tkape

e3981e7add161393c647f927d7163fcc

ASCII text

RcloneConf.tkape

5e44a522e90ed658b5a23c180fbcd4b7

ASCII text

RemoteUtilities_app.tkape

c63c9068b44188cef2c30f818a001c16

ASCII text

Robo-FTP.tkape

0468bda5c35f2689f10fb9bcfff763c2

ASCII text

RustDesk.tkape

954dba5cdda160617ae3e09088f1f51f

ASCII text

ScreenConnect.tkape

9d73dcb41d5350d0f20e523236ceeaac

ASCII text

ShareX.tkape

85d2418a2987739e9a892cfdd9d4f2dd

ASCII text

SiemensTIA.tkape

88a99cf1a7e02eab53ff5f6657bc32c0

ASCII text

Signal.tkape

db2e7f09cfcb23868ae03f85191e2f64

ASCII text

Skype.tkape

7f0f0be0dba779b12839a60eec27c273

ASCII text

Slack.tkape

243a1c9ac1cb2939154e61216e064255

ASCII text

Snagit.tkape

c98dbd40b42f7f0b2af44e329c959667

ASCII text

SpeedCommander.tkape

265b3c002ed1628c878bfb1300850956

ASCII text

Splashtop.tkape

a6f114879961a244e19a41604bc0643b

ASCII text

Steam.tkape

450708d662c8d91db3fae66700e9f43a

ASCII text

SublimeText.tkape

c6cad11512976ce45e9b0fe0e891b9ee

ASCII text

SugarSync.tkape

2bb926078d8be1545e353a9799730651

ASCII text

SumatraPDF.tkape

a746bc8d40c2847e8503c087d24a22fd

ASCII text

SupremoRemoteDesktop.tkape

fdb9a1764ae96a30e71a9fa811800bea

ASCII text

TablacusExplorer.tkape

afb9640ba1d595f27a4de4bc4575887e

ASCII text

TeamViewerLogs.tkape

5f45eb3f6e56603dd0c579702102e768

ASCII text

Telegram.tkape

c86cc01a67fb4ff1d9c1dc4c6a9d1047

ASCII text

TeraCopy.tkape

7ed092a2a9d9536aa8be1752a154d5c3

ASCII text

Thunderbird.tkape

4537ec80e47ffd2a25e430ce7ba6f7ce

ASCII text

TotalCommander.tkape

ce448b732dd511501c7908870a68144f

ASCII text

TreeSize.tkape

7cf37a595e0a6463be32f288abd55b6f

ASCII text

Ultraviewer.tkape

cb495f60b2fc536dd9f7996e7f8d571e

ASCII text

Viber.tkape

afcd325090821cc8b0754957b65a7c42

ASCII text

VirtualBoxConfig.tkape

e90ae70ec3946e94440e8f5725c6fd05

ASCII text

VirtualBoxLogs.tkape

cc1584900211ec6061d36c1c63afd5f7

ASCII text

VirtualBoxMemory.tkape

3b8c67f8105e7c891e5a1b32b52fd205

ASCII text

VisualStudioCode.tkape

b9079f2a6995346abe65e7ed52006734

Unicode text, UTF-8 text

VLC Media Player.tkape

2c05a4bda7a04db893b0b417b397c37f

ASCII text

VMwareInventory.tkape

c607be935bb81613ffa4768d65438048

ASCII text

VMwareMemory.tkape

39de8b9917e8779796632750f437418e

ASCII text

VNCLogs.tkape

e67a451724d3f6420f2ec6709a9e9f45

ASCII text

WhatsApp.tkape

612cfadb56285f3dfed4756b240cd654

ASCII text

WhatsApp_Media.tkape

82eb8196fb12d25a5999a5929b17897f

ASCII text

WindowsYourPhone.tkape

c1ca2caf373128dce7536526a835f7d5

ASCII text

WinSCP.tkape

16bc90df17dbb710edc0634eb7597b16

ASCII text

Xeox.tkape

1094ad045438cf57e11406b2876afa82

ASCII text

XYplorer.tkape

cdf1013219b309b9df61621d44e8df54

ASCII text

ZohoAssist.tkape

3c546476ff3d365794afb63c7e99e7ce

ASCII text

Zoom.tkape

eb09607e775bcd437a3dda69b0118f35

ASCII text

BraveBrowser.tkape

5ba41a9b763360f090ee9d29a909e0cc

ASCII text

BrowserCache.tkape

ec42e50f00f2c4331d9f58f8384521c3

ASCII text

Chrome.tkape

10e87f278fae949912bedfb04f3273aa

ASCII text

ChromeExtensions.tkape

9994f77a00d6b6de7b29ac7994591eb6

ASCII text

ChromeFileSystem.tkape

4664669b1f0021f64b1c8a17c29bc458

ASCII text

Edge.tkape

9aae688a205eb7199f999cbba46376da

ASCII text

EdgeChromium.tkape

00452e79201a01b8e93cb8ff94097be2

ASCII text

EdgeChromiumExtensions.tkape

2fed1759c51d44908d5b4cd57f987213

ASCII text

Firefox.tkape

71e7276817c9b07bc8f8f34124656bb6

ASCII text

InternetExplorer.tkape

82cee7fef8008e4e1bd6422f3319ed11

ASCII text

Opera.tkape

c9e21b4a7fe6a6f75bbe7ad2f18944b3

ASCII text

PuffinSecureBrowser.tkape

b2e9af2376f7ee94bc9f8a5a0267272a

ASCII text, with very long lines (341)

Vivaldi.tkape

cb9f23c7f50d923df75dbea57df8a61a

Unicode text, UTF-8 text

Yandex.tkape

2e707379b8868bb5f6b0d0f48a89dfd3

Unicode text, UTF-8 text

!BasicCollection.tkape

3a4b3f81b34cf8cb6b441ae7b79d12d5

ASCII text

!SANS_Triage.tkape

69ae8157d48b9292516a872885d6ee32

ASCII text

Antivirus.tkape

9b16910fd9551bbdab31be4f360890ea

ASCII text

CloudStorage_All.tkape

dcb59f055d7d7121e6333308cd10fcfd

ASCII text

CloudStorage_Metadata.tkape

4de36d44a3e35e1e2853ff9d1f288582

ASCII text

CloudStorage_OneDriveExplorer.tkape

dd9db24862b333c3bd1b3a4b8cd5d108

ASCII text

CombinedLogs.tkape

0ba6b821c937e7c34e2402b494232bbb

ASCII text

EvidenceOfExecution.tkape

3e17930e663196a995f756a5f82985ed

ASCII text

Exchange.tkape

b907cf88bbbe733bb6b93d254f240961

ASCII text

FileExplorerReplacements.tkape

324089fe9016efbabd8ffc10f6816ba9

ASCII text

FileSystem.tkape

b52edf7bb6fd240d9e9500aa5466d764

ASCII text

FTPClients.tkape

d3f81d68acf43e0f57d32fb280a21a73

ASCII text

IRCClients.tkape

faf4df2b7fd310816843770e9a089d66

ASCII text

KapeTriage.tkape

77c51a886441dda8eab704002da379eb

ASCII text, with very long lines (458)

MessagingClients.tkape

18b0f2e130c81046615a18d1f4bc85c4

ASCII text

MiniTimelineCollection.tkape

b0a5d414239c1bb41dad699f28ef3451

ASCII text

P2PClients.tkape

4204a9b8a966ed09e5933e1b970f41b2

ASCII text

RecycleBin.tkape

b65cbfbf12897de286cb17c51392879c

ASCII text

RegistryHives.tkape

be18356c23ea8a7a6f8e468f48d7a67d

ASCII text

RemoteAdmin.tkape

7ce45dc408e7f7b85bc6d4f4b150d124

ASCII text

ServerTriage.tkape

99eff8fde90f52d36d88c7c82b8c1157

ASCII text

SOFELK.tkape

15e87d80613aad72f944d772bbff6ded

ASCII text

SQLiteDatabases.tkape

7014c81b1e03e0ece1695a2b98d4c578

ASCII text

TorrentClients.tkape

01e8d18b6110275846ecbf1b22571f9d

ASCII text

USBDetective.tkape

185b1e378c4401996b92909bd3903732

ASCII text

UsenetClients.tkape

0ddcd7f16e6a85a3b358c112ba3e9106

ASCII text

VirtualBox.tkape

1fffc141879a44095dc729456cea0ff8

ASCII text

VMware.tkape

b2c21ac6f97072ca2b7b6bcb4389f097

ASCII text

WebBrowsers.tkape

82fa0e3475af903b684686f865ba4a7a

ASCII text

WebServers.tkape

34b3c1794063911ef7b86a2cc92c315c

ASCII text

WSL.tkape

ee5618ab6604d461fb722c8975acf935

ASCII text

CompoundTargetGuide.guide

237ba8131e12a07863f9b6c1d25a82da

ASCII text

CompoundTargetTemplate.template

166d8d54942c1578185383bf4ddef5e5

ASCII text

ApacheAccessLog.tkape

5ece1037506bdcd2f9282f06dc222d93

ASCII text

IISLogFiles.tkape

9bd0a9ed574a72c40d79cd9d1a327f4b

ASCII text

ManageEngineLogs.tkape

a4bfe77f649acce8bd8e1365dace0af8

ASCII text

MSSQLErrorLog.tkape

b376a3bfefeac6c56a7ade906e8bafcc

ASCII text

NGINXLogs.tkape

2966fe72f8443515f23fd200c160ce22

ASCII text

PowerShellConsole.tkape

f34dd508027940c4fb7ff0edd1faef6c

ASCII text

BitTorrent.tkape

a4ebf896bae73821e9d05f8e03b4b23a

ASCII text

DC++.tkape

0177863430ab2ffd7cf9d78151369fd4

ASCII text

Freenet.tkape

dcfc1828344471ca40498253faf6c885

ASCII text

FrostWire.tkape

cf136a582961efd81ac981010ba88059

ASCII text

Gigatribe.tkape

8d129e6e981f7575b1d0309c75ec8d34

Unicode text, UTF-8 text

NewsbinPro.tkape

c264afb644534e4477f9048bb69a1c43

ASCII text

Newsleecher.tkape

c8733daeb1eac8444ebeb43bae6f73db

ASCII text

Nicotine++.tkape

e5a631d21845d7d4ed39b42878118222

ASCII text

NZBGet.tkape

ec1d23dddbf97c05ca20bfeda1a8b2a5

ASCII text

qBittorrent.tkape

c737b46760aaca1df9caa11078f959ee

ASCII text

SABnbzd.tkape

c664b3b87441ccf27e14a7d573eef031

ASCII text

Shareaza.tkape

858c15c555f4e09054e62856add51dc6

ASCII text

Soulseek.tkape

21ca3389134dab544f355c0d865fce5c

ASCII text

Torrents.tkape

d8f8d3d6c929700a08adbf3cc77d6fd1

ASCII text

Usenet.tkape

5295cbd56161b1faba0df3bfd2d7ad53

ASCII text

uTorrent.tkape

3d9ba59deefd9c6a0953441411e590c1

ASCII text

TargetGuide.guide

2b905d468a55791872ad10c8352841e3

ASCII text, with very long lines (490)

TargetTemplate.template

040b0ee858e96161991e5010b1dddc70

ASCII text

$Boot.tkape

1b9c80db561dc4db91c39c82be992961

ASCII text

$J.tkape

2c4cf317a1cb6e657e7ed2bad6a10a2b

ASCII text, with very long lines (304)

$LogFile.tkape

0df889d130d4fb8859a364d774574e5a

ASCII text

$MFT.tkape

db883dd78b4049d46636a8210f2fca65

ASCII text

$MFTMirr.tkape

d91253358bb77ed11750146bb1ff60aa

ASCII text

$SDS.tkape

404ef6e23479bc6e19508b6cb197c193

ASCII text, with very long lines (302)

$T.tkape

2b57db05da7b861daf9a558bfc225671

ASCII text, with very long lines (302)

ActiveDirectoryNTDS.tkape

195f92114376db0253a11371b550c98d

ASCII text

ActiveDirectorySysvol.tkape

20b65bfcd85ce136eab16fc9f15f4397

ASCII text

Amcache.tkape

12a4e03099c5c0ece3823b503969406c

ASCII text

AppCompatPCA.tkape

c4c111071605ecaaf43eeb91ff15c5c2

ASCII text

ApplicationEvents.tkape

bf48455e34bef1ed734eccc08e638e09

ASCII text

AppXPackages.tkape

4fd98f6db13d37dbc869784e5326030c

ASCII text

BCD.tkape

4f2993a10cf197663c36835bd70f3f04

ASCII text

BITS.tkape

ec464f3b6ed626434ff9a06c2ccef1d8

ASCII text

CertUtil.tkape

36774908a8c2ef6f2d1c16d6e724982f

ASCII text

Drivers.tkape

c80998c25a81d4b6f29a4d45f8af7b3f

ASCII text

EncapsulationLogging.tkape

aed4e8cec8832919f14bf3d883d495bf

ASCII text

EventLogs-RDP.tkape

718af3892626c3703aed3c319232c8d7

ASCII text

EventLogs.tkape

e294b33fa3212b4911ebaa905a0afbec

ASCII text

EventTraceLogs.tkape

6c7c5efbbf9a55dde1558f9ad9f0c25a

ASCII text

EventTranscriptDB.tkape

e19581d894b9dff4d7c90d1273c896bb

ASCII text

ExchangeClientAccess.tkape

9f417b72bd834c6f5c18050ba44fdd12

ASCII text

ExchangeCve-2021-26855.tkape

76c59e06011636759c237a17162ac4bb

ASCII text

GroupPolicy.tkape

22d286a6f7aa1c3159984bde9c653859

ASCII text

IISConfiguration.tkape

178821413ede38da9b0622e63367cb1e

ASCII text

LinuxOnWindowsProfileFiles.tkape

f6ff4a6e170e74bd8259eb799f734026

ASCII text

LNKFilesAndJumpLists.tkape

4bd997607702acd8c8f4ce2cf2fa868f

ASCII text

LogFiles.tkape

6389af39e038d9dde7ddf6f9e94ccdd1

ASCII text

MemoryFiles.tkape

dd3f90629864c7bb17175e5799f928b6

ASCII text

MicrosoftOfficeBackstage.tkape

5a3a8c9b63293affe81ebadb0723f1ad

ASCII text

MOF.tkape

e86d6cf3655911bb4f5392602ba82df2

ASCII text

NETCLRUsageLogs.tkape

a183755a1ecaa7d85f1bf7ff712d554e

ASCII text

Notepad.tkape

13ca9056750f9100b1f9ce684bf87e5f

ASCII text

OfficeAutosave.tkape

b028a823b3e9ae3f15ad566f9db03204

ASCII text

OfficeDiagnostics.tkape

02c83284cee4031386e63789c820d0a7

ASCII text

OfficeDocumentCache.tkape

f2bc4f12b8fc365655de76cc722dcf11

ASCII text

PerfLogs.tkape

a4a1f97bcc46e0aba9f8aadf0e05b1f8

ASCII text

PowerShell7Config.tkape

03905cf1d9a2708a2299f7b96146599e

ASCII text

PowerShellTranscripts.tkape

3c3b37f6e0958cc9330869a0d415bf52

ASCII text

Prefetch.tkape

7d56aa1f1434e77bbd576b65191fd889

ASCII text

ProgramData.tkape

86f41461a86452f3b90228796ec12817

ASCII text

PushNotification.tkape

eaa28337c9f63e36dd66b7cffd46ad14

ASCII text

RDPCache.tkape

e36657b2da2b457e4df56e3dce9c1a1d

ASCII text

RDPLogs.tkape

2198723b1dcfda52823531e43a8bcd64

ASCII text

RecentFileCache.tkape

b0bf1e6a70df0e321ebc0ca63f8bd87e

ASCII text

RecycleBin_DataFiles.tkape

73a65aecf61480a0130c243fee6fee42

ASCII text

RecycleBin_InfoFiles.tkape

2ac6231e9800ed2029c0f35a9ad6697f

ASCII text

RegistryHivesMSIXApps.tkape

6cd2e8a84f358842d3c03fa8c4b06d64

ASCII text

RegistryHivesOther.tkape

96d08bad518ef324a11a7342b82740e9

ASCII text

RegistryHivesSystem.tkape

fae9e6b55b2da2681feaeb7c6990a597

ASCII text

RegistryHivesUser.tkape

ec3484e31aac6b32cb718b9176076f62

ASCII text

RoamingProfile.tkape

b7876d359014e67ab22e39c24c8b6922

ASCII text

SCCMClientLogs.tkape

5a1bee03da3a11283c66d498f09699c8

ASCII text

ScheduledTasks.tkape

6935beac0dffc925dda7c6a7f23bfff6

ASCII text

SDB.tkape

688696c38b5503240c66aaef4a0d0982

ASCII text

SignatureCatalog.tkape

79a4a3eb9c405741b8e6d50e364404b8

ASCII text

SnipAndSketch.tkape

e32215c645dd982183477a75f90a9866

ASCII text

SRUM.tkape

a1d89746cc8fdc9b82d761d770bbb09e

ASCII text

StartupFolders.tkape

b23d01078103f5bf65fbb73160900f7c

ASCII text

StartupInfo.tkape

5fe0388716a89cadab85ab5ff4f5c275

ASCII text

SUM.tkape

05df3fa8057ab98c8fc8f810b316415b

ASCII text

Syscache.tkape

fc60a198c2de5d8f6ae49884e32b3a84

ASCII text

ThumbCache.tkape

894c0ea467e86de70507bc1269abd12c

ASCII text

USBDevicesLogs.tkape

a7e2c092aeb0198db03a75977ac1fb32

ASCII text

VirtualDisks.tkape

768d86d5f0d593dea231f4252673a785

ASCII text

WBEM.tkape

ecf39834de0a5e4e5e0f4d29e5ac8143

ASCII text

WER.tkape

4000ec4e2f93f55a31947b098e654d16

ASCII text

WindowsFirewall.tkape

f995d032a5474b539c6e3436b230280f

ASCII text

WindowsHello.tkape

ccecba013695e0800da2952985176dc7

ASCII text

WindowsIndexSearch.tkape

b7252227e489f9b51ec66bdb610c4748

ASCII text

WindowsNetwork.tkape

7dfd363e7e1e1b69236bd56eb9e49a4c

ASCII text

WindowsNotificationsDB.tkape

c95b92419b15712a283a3e8b396a2d49

ASCII text

WindowsOSUpgradeArtifacts.tkape

ed32a4e1250e4e2b0649e1e8c6bdbf80

ASCII text

WindowsPowerDiagnostics.tkape

42ae6a02e0214c01aa3ecb343fc134dd

ASCII text

WindowsServerDNSAndDHCP.tkape

1a0e200577129cb6344540c9194bf5b0

ASCII text

WindowsTelemetryDiagnosticsLegacy.tkape

3976ac01ca600eefdf08a5483574d943

ASCII text

WindowsTimeline.tkape

c4e41817c508e345eb2729506526a9b2

ASCII text

WindowsUpdate.tkape

e96bd12776e59519b1bd1f070b4890d7

ASCII text

WindowsSubsystemforAndroid.tkape

c9239684f5262cafa7a85f677db0f2d9

ASCII text

Debian.tkape

6b3098cf289aae47461da26d95bf78fa

ASCII text

Kali.tkape

d8b46b30022104caed3d2f234efd1977

ASCII text

openSUSE.tkape

4cf5f8dea0af044579e2f90d683d991f

ASCII text

SUSELinuxEnterpriseServer.tkape

7fba03402d7658d8a16d2f74f07efd72

ASCII text

Ubuntu.tkape

57f77383019411d79e902e4495475070

ASCII text

XPRestorePoints.tkape

130d1bb47945d7ca31eff228427d7b33

ASCII text

.gitignore

a932af246c2dedf3c4258cb24ff273f4

ASCII text

readme.txt

1a89df55b34f5e39f1031ac8c788fe8c

ASCII text

SANS_Triage.ps1

ed5cd0db71d54b663b64109e7a13e0e3

Unicode text, UTF-8 (with BOM) text, with CRLF, LF line terminators

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
YARAhub by abuse.ch	malware	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
YARAhub by abuse.ch	malware	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe
YARAhub by abuse.ch	malware	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe
YARAhub by abuse.ch	malware	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

JavaScript (0)

HTTP Transactions (1)

URL IP Response Size

	URL	IP	Response	Size
	stsecirtempupload.blob.core.windows.net/incident-response/Kape.zip?sp=racw&st=2025-04-16T06:47:23Z&se=2025-05-16T14:47:23Z&spr=https&sv=2024-11-04&sr=b&sig=UgSaSEeFT3OeNrWBS44eQ0EbzQAcrkbGIevd7V/6pog=	20.209.72.65	200 OK	14 MB
URL User Request GET stsecirtempupload.blob.core.windows.net/incident-response/Kape.zip?sp=racw&st=2025-04-16T06:47:23Z&se=2025-05-16T14:47:23Z&spr=https&sv=2024-11-04&sr=b&sig=UgSaSEeFT3OeNrWBS44eQ0EbzQAcrkbGIevd7V/6pog= IP 20.209.72.65:443 ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK Certificate IssuerMicrosoft Corporation Subject.blob.core.windows.net Fingerprint19:3E:1B:CA:89:D7:0C:10:5C:01:22:39:2B:65:3E:D5:B6:44:A9:28 ValidityMon, 27 Jan 2025 08:45:29 GMT - Sat, 26 Jul 2025 08:45:29 GMT File type Zip archive data, at least v2.0 to extract, compression method=store Size 14 MB (14023475 bytes) Hash f9465299c8a9a48f0c17b886f6bf29d0 f6fdb710776e31c1ff6e5b989149ba65d63799ae 6fcbdde649ebf6156fac40c2c9a384365a12c1fa2051357fb1407b6732d15186 HTTP Headers GET /incident-response/Kape.zip?sp=racw&st=2025-04-16T06:47:23Z&se=2025-05-16T14:47:23Z&spr=https&sv=2024-11-04&sr=b&sig=UgSaSEeFT3OeNrWBS44eQ0EbzQAcrkbGIevd7V/6pog= HTTP/1.1 Host: stsecirtempupload.blob.core.windows.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache HTTP/1.1 200 OK Content-Length: 14023475 Content-Type: application/x-zip-compressed Content-MD5: +UZSmcippI8MF7iG9r8p0A== Last-Modified: Wed, 16 Apr 2025 13:53:24 GMT Accept-Ranges: bytes ETag: "0x8DD7CEE0E7EB125" Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 014f2ffd-801e-003a-4166-be13df000000 x-ms-version: 2024-11-04 x-ms-creation-time: Wed, 16 Apr 2025 13:53:24 GMT x-ms-lease-status: unlocked x-ms-lease-state: available x-ms-blob-type: BlockBlob x-ms-server-encrypted: true Date: Tue, 06 May 2025 09:08:33 GMT

stsecirtempupload.blob.core.windows.net/incident-response/Kape.zip?sp=racw&st=2025-04-16T06:47:23Z&se=2025-05-16T14:47:23Z&spr=https&sv=2024-11-04&sr=b&sig=UgSaSEeFT3OeNrWBS44eQ0EbzQAcrkbGIevd7V/6pog=

20.209.72.65

200 OK

14 MB

URL User Request GET
stsecirtempupload.blob.core.windows.net/incident-response/Kape.zip?sp=racw&st=2025-04-16T06:47:23Z&se=2025-05-16T14:47:23Z&spr=https&sv=2024-11-04&sr=b&sig=UgSaSEeFT3OeNrWBS44eQ0EbzQAcrkbGIevd7V/6pog=
IP
20.209.72.65:443
ASN
#8075 MICROSOFT-CORP-MSN-AS-BLOCK

Certificate
IssuerMicrosoft Corporation
Subject*.blob.core.windows.net
Fingerprint19:3E:1B:CA:89:D7:0C:10:5C:01:22:39:2B:65:3E:D5:B6:44:A9:28
ValidityMon, 27 Jan 2025 08:45:29 GMT - Sat, 26 Jul 2025 08:45:29 GMT

File type
Zip archive data, at least v2.0 to extract, compression method=store
Size
14 MB (14023475 bytes)
Hash
f9465299c8a9a48f0c17b886f6bf29d0
f6fdb710776e31c1ff6e5b989149ba65d63799ae
6fcbdde649ebf6156fac40c2c9a384365a12c1fa2051357fb1407b6732d15186

HTTP Headers

GET /incident-response/Kape.zip?sp=racw&st=2025-04-16T06:47:23Z&se=2025-05-16T14:47:23Z&spr=https&sv=2024-11-04&sr=b&sig=UgSaSEeFT3OeNrWBS44eQ0EbzQAcrkbGIevd7V/6pog= HTTP/1.1
Host: stsecirtempupload.blob.core.windows.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Content-Length: 14023475
Content-Type: application/x-zip-compressed
Content-MD5: +UZSmcippI8MF7iG9r8p0A==
Last-Modified: Wed, 16 Apr 2025 13:53:24 GMT
Accept-Ranges: bytes
ETag: "0x8DD7CEE0E7EB125"
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: 014f2ffd-801e-003a-4166-be13df000000
x-ms-version: 2024-11-04
x-ms-creation-time: Wed, 16 Apr 2025 13:53:24 GMT
x-ms-lease-status: unlocked
x-ms-lease-state: available
x-ms-blob-type: BlockBlob
x-ms-server-encrypted: true
Date: Tue, 06 May 2025 09:08:33 GMT

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (562)

Detections

JavaScript (0)

HTTP Transactions (1)

URL User Request GET

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers