Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

18/04/2024, 05:14 UTC

240418-fxa3zsdd41 10

18/04/2024, 05:14 UTC

240418-fw8mvsca99 10

18/04/2024, 05:14 UTC

240418-fw642aca97 10

18/04/2024, 05:14 UTC

240418-fw6hhaca96 10

18/04/2024, 05:14 UTC

240418-fw5wzadd4y 10

22/09/2021, 13:23 UTC

210922-qmv1hsfdbr 10

Analysis

  • max time kernel
    600s
  • max time network
    535s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    18/04/2024, 05:14 UTC

General

  • Target

    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe

  • Size

    434KB

  • MD5

    556c756b428b0a6f1516de031c3bfdb3

  • SHA1

    d4a8195611ac93a268b0ebdc14319a75de856725

  • SHA256

    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239

  • SHA512

    0e6ffc8dd5dda62a3936a5ea311a9e7007f27ead2f86f9f3f17510a78d2181b16473c69b3b5aa465f68042adef0d95fa8403f9d5bb106dbb4896750caef60a26

  • SSDEEP

    12288:rXPcLcbGfVylwG/ZDCK/ScBXo8TsyMkKMY8m7WOK9SATTsx/SA/WegYfdNbrqnuh:rXh6XcBXo8TsL8Y8m/ATTySA/DrfdNb7

Score
10/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Uses Tor communications 1 TTPs

    Malware can proxy its traffic through Tor for more anonymity.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    "C:\Users\Admin\AppData\Local\Temp\6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4808
    • C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe
      "C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe"
      2⤵
      • Executes dropped EXE
      PID:4688

Network

  • flag-ca
    GET
    http://199.58.81.140/tor/status-vote/current/consensus
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    199.58.81.140:80
    Request
    GET /tor/status-vote/current/consensus HTTP/1.0
    Host: 199.58.81.140
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:15:10 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Thu, 18 Apr 2024 06:00:00 GMT
    Vary: X-Or-Diff-From-Consensus
  • flag-us
    DNS
    140.81.58.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    140.81.58.199.in-addr.arpa
    IN PTR
    Response
    140.81.58.199.in-addr.arpa
    IN PTR
    longclawriseupnet
  • flag-us
    DNS
    api.ipify.org
    Remote address:
    8.8.8.8:53
    Request
    api.ipify.org
    IN A
    Response
    api.ipify.org
    IN A
    104.26.12.205
    api.ipify.org
    IN A
    104.26.13.205
    api.ipify.org
    IN A
    172.67.74.152
  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    time-a.nist.gov
    Remote address:
    8.8.8.8:53
    Request
    time-a.nist.gov
    IN A
    Response
    time-a.nist.gov
    IN CNAME
    time-a-g.nist.gov
    time-a-g.nist.gov
    IN A
    129.6.15.28
  • flag-us
    DNS
    time-a-g.nist.gov
    Remote address:
    8.8.8.8:53
    Request
    time-a-g.nist.gov
    IN A
    Response
    time-a-g.nist.gov
    IN A
    129.6.15.28
  • flag-us
    DNS
    244.244.23.193.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    244.244.23.193.in-addr.arpa
    IN PTR
    Response
    244.244.23.193.in-addr.arpa
    IN PTR
    dannenbergtorauthde
  • flag-us
    DNS
    97.96.212.83.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.96.212.83.in-addr.arpa
    IN PTR
    Response
    97.96.212.83.in-addr.arpa
    IN PTR
    snf-889779vmokeanosgrnetgr
  • flag-us
    DNS
    226.162.46.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    226.162.46.104.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    25.24.18.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    25.24.18.2.in-addr.arpa
    IN PTR
    Response
    25.24.18.2.in-addr.arpa
    IN PTR
    a2-18-24-25deploystaticakamaitechnologiescom
  • flag-us
    DNS
    38.3.148.185.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    38.3.148.185.in-addr.arpa
    IN PTR
    Response
    38.3.148.185.in-addr.arpa
    IN PTR
    this-is-hosted-by pulsedmediacom
  • flag-us
    GET
    https://api.ipify.org/
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    104.26.12.205:443
    Request
    GET / HTTP/1.0
    Host: api.ipify.org
    Response
    HTTP/1.1 200 OK
    Date: Thu, 18 Apr 2024 05:15:13 GMT
    Content-Type: text/plain
    Content-Length: 14
    Connection: close
    Vary: Origin
    CF-Cache-Status: DYNAMIC
    Server: cloudflare
    CF-RAY: 87622d011a3f954a-LHR
  • flag-us
    GET
    http://216.218.219.41/tor/server/fp/3e09aef0b44e9416bc2d87032d3416431e8231dc
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    216.218.219.41:80
    Request
    GET /tor/server/fp/3e09aef0b44e9416bc2d87032d3416431e8231dc HTTP/1.0
    Host: 216.218.219.41
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:15:13 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:15:13 GMT
  • flag-us
    DNS
    205.12.26.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    205.12.26.104.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    205.101.220.185.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    205.101.220.185.in-addr.arpa
    IN PTR
    Response
    205.101.220.185.in-addr.arpa
    IN PTR
    tor-exit-205 for-privacynet
  • flag-us
    DNS
    103.210.211.95.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    103.210.211.95.in-addr.arpa
    IN PTR
    Response
    103.210.211.95.in-addr.arpa
    IN PTR
    lucrativemobicom
  • flag-us
    DNS
    ctldl.windowsupdate.com
    Remote address:
    8.8.8.8:53
    Request
    ctldl.windowsupdate.com
    IN A
    Response
    ctldl.windowsupdate.com
    IN CNAME
    wu-bg-shim.trafficmanager.net
    wu-bg-shim.trafficmanager.net
    IN CNAME
    windowsupdatebg.s.llnwi.net
    windowsupdatebg.s.llnwi.net
    IN A
    87.248.204.0
  • flag-us
    DNS
    16.177.154.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    16.177.154.23.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    50.129.72.50.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    50.129.72.50.in-addr.arpa
    IN PTR
    Response
    50.129.72.50.in-addr.arpa
    IN PTR
    S01065a7bc589b5d9wp shawcablenet
  • flag-us
    DNS
    41.219.218.216.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    41.219.218.216.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    92.202.137.79.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    92.202.137.79.in-addr.arpa
    IN PTR
    Response
    92.202.137.79.in-addr.arpa
    IN PTR
    tornode7 shadowbrokerseu
  • flag-us
    DNS
    nexusrules.officeapps.live.com
    Remote address:
    8.8.8.8:53
    Request
    nexusrules.officeapps.live.com
    IN A
    Response
    nexusrules.officeapps.live.com
    IN CNAME
    prod.nexusrules.live.com.akadns.net
    prod.nexusrules.live.com.akadns.net
    IN A
    52.111.236.23
  • flag-us
    DNS
    ocsp.digicert.com
    Remote address:
    8.8.8.8:53
    Request
    ocsp.digicert.com
    IN A
    Response
    ocsp.digicert.com
    IN CNAME
    ocsp.edge.digicert.com
    ocsp.edge.digicert.com
    IN CNAME
    fp2e7a.wpc.2be4.phicdn.net
    fp2e7a.wpc.2be4.phicdn.net
    IN CNAME
    fp2e7a.wpc.phicdn.net
    fp2e7a.wpc.phicdn.net
    IN A
    192.229.221.95
  • flag-us
    DNS
    101.209.81.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    101.209.81.51.in-addr.arpa
    IN PTR
    Response
    101.209.81.51.in-addr.arpa
    IN PTR
    vps-eea3d679vpsovhus
  • flag-us
    DNS
    254.122.147.38.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    254.122.147.38.in-addr.arpa
    IN PTR
    Response
    254.122.147.38.in-addr.arpa
    IN PTR
    254onionnsaorg
  • flag-us
    DNS
    165.154.171.31.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    165.154.171.31.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    self.events.data.microsoft.com
    Remote address:
    8.8.8.8:53
    Request
    self.events.data.microsoft.com
    IN A
    Response
    self.events.data.microsoft.com
    IN CNAME
    self-events-data.trafficmanager.net
    self-events-data.trafficmanager.net
    IN CNAME
    onedscolprdaus02.australiasoutheast.cloudapp.azure.com
    onedscolprdaus02.australiasoutheast.cloudapp.azure.com
    IN A
    104.46.162.226
  • flag-us
    DNS
    ctldl.windowsupdate.com
    Remote address:
    8.8.8.8:53
    Request
    ctldl.windowsupdate.com
    IN A
    Response
    ctldl.windowsupdate.com
    IN CNAME
    wu-bg-shim.trafficmanager.net
    wu-bg-shim.trafficmanager.net
    IN CNAME
    download.windowsupdate.com.edgesuite.net
    download.windowsupdate.com.edgesuite.net
    IN CNAME
    a767.dspw65.akamai.net
    a767.dspw65.akamai.net
    IN A
    2.18.24.25
    a767.dspw65.akamai.net
    IN A
    2.18.24.18
  • flag-us
    DNS
    157.235.9.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    157.235.9.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    28.15.6.129.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.15.6.129.in-addr.arpa
    IN PTR
    Response
    28.15.6.129.in-addr.arpa
    IN PTR
    time-a-gnistgov
  • flag-us
    DNS
    15.229.177.185.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.229.177.185.in-addr.arpa
    IN PTR
    Response
    15.229.177.185.in-addr.arpa
    IN PTR
    15-229-177-185clientsgthostcom
  • flag-us
    DNS
    23.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    23.236.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    0.204.248.87.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.204.248.87.in-addr.arpa
    IN PTR
    Response
    0.204.248.87.in-addr.arpa
    IN PTR
    https-87-248-204-0lhrllnwnet
  • flag-us
    DNS
    154.96.8.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    154.96.8.204.in-addr.arpa
    IN PTR
    Response
  • flag-de
    GET
    http://193.23.244.244/tor/server/fp/a98f492f6531ae3a068dd35395ca9f5be8f0355c
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    193.23.244.244:80
    Request
    GET /tor/server/fp/a98f492f6531ae3a068dd35395ca9f5be8f0355c HTTP/1.0
    Host: 193.23.244.244
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:15:15 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:15:15 GMT
  • flag-de
    GET
    http://193.23.244.244/tor/server/fp/af7094b62864de941dcd88a2f0dbafecf3997e47
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    193.23.244.244:80
    Request
    GET /tor/server/fp/af7094b62864de941dcd88a2f0dbafecf3997e47 HTTP/1.0
    Host: 193.23.244.244
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:15:16 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:15:16 GMT
  • flag-de
    GET
    http://193.23.244.244/tor/server/fp/b8348f1e967d9a432f2d03e572def76fb25f04d3
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    193.23.244.244:80
    Request
    GET /tor/server/fp/b8348f1e967d9a432f2d03e572def76fb25f04d3 HTTP/1.0
    Host: 193.23.244.244
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:15:16 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:15:16 GMT
  • flag-us
    GET
    http://216.218.219.41/tor/server/fp/b83dc1558f0d34353bb992ef93afeafdb226a73e
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    216.218.219.41:80
    Request
    GET /tor/server/fp/b83dc1558f0d34353bb992ef93afeafdb226a73e HTTP/1.0
    Host: 216.218.219.41
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:15:18 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:15:18 GMT
  • flag-us
    GET
    http://216.218.219.41/tor/server/fp/b85e978aee73a9604fd9b124e1d834080afc3fa4
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    216.218.219.41:80
    Request
    GET /tor/server/fp/b85e978aee73a9604fd9b124e1d834080afc3fa4 HTTP/1.0
    Host: 216.218.219.41
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:15:20 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:15:20 GMT
  • flag-us
    GET
    http://216.218.219.41/tor/server/fp/a205f116df47e8b980b5bed006cd85390a6b8f13
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    216.218.219.41:80
    Request
    GET /tor/server/fp/a205f116df47e8b980b5bed006cd85390a6b8f13 HTTP/1.0
    Host: 216.218.219.41
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:15:22 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:15:22 GMT
  • flag-de
    GET
    http://193.23.244.244/tor/server/fp/a2211bec0ceb70c2634f425200c82b89dffb9923
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    193.23.244.244:80
    Request
    GET /tor/server/fp/a2211bec0ceb70c2634f425200c82b89dffb9923 HTTP/1.0
    Host: 193.23.244.244
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:15:23 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:15:23 GMT
  • flag-de
    GET
    http://193.23.244.244/tor/server/fp/a22b1c2ef2255987f8ab8aa0b1a8e23f5023eeb8
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    193.23.244.244:80
    Request
    GET /tor/server/fp/a22b1c2ef2255987f8ab8aa0b1a8e23f5023eeb8 HTTP/1.0
    Host: 193.23.244.244
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:15:24 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:15:24 GMT
  • flag-de
    GET
    http://193.23.244.244/tor/server/fp/b8ac259d400172997d08120b3bd5a4090841b06f
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    193.23.244.244:80
    Request
    GET /tor/server/fp/b8ac259d400172997d08120b3bd5a4090841b06f HTTP/1.0
    Host: 193.23.244.244
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:15:27 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:15:27 GMT
  • flag-de
    GET
    http://193.23.244.244/tor/server/fp/ff462edfe7b07dbc0a4beb473e57bdefe9178b85
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    193.23.244.244:80
    Request
    GET /tor/server/fp/ff462edfe7b07dbc0a4beb473e57bdefe9178b85 HTTP/1.0
    Host: 193.23.244.244
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:15:27 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:15:27 GMT
  • flag-de
    GET
    http://193.23.244.244/tor/server/fp/0ef99182cb04b14a718efdfcc0fa3528ed486ab5
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    193.23.244.244:80
    Request
    GET /tor/server/fp/0ef99182cb04b14a718efdfcc0fa3528ed486ab5 HTTP/1.0
    Host: 193.23.244.244
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:15:28 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:15:28 GMT
  • flag-de
    GET
    http://193.23.244.244/tor/server/fp/84fa05e6a80ebe36bd84a51705c467fa98188d4a
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    193.23.244.244:80
    Request
    GET /tor/server/fp/84fa05e6a80ebe36bd84a51705c467fa98188d4a HTTP/1.0
    Host: 193.23.244.244
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:15:45 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:15:45 GMT
  • flag-de
    GET
    http://193.23.244.244/tor/server/fp/0cf2f07ff0581ebbccdf209e655694358a98d816
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    193.23.244.244:80
    Request
    GET /tor/server/fp/0cf2f07ff0581ebbccdf209e655694358a98d816 HTTP/1.0
    Host: 193.23.244.244
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:15:46 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:15:46 GMT
  • flag-us
    GET
    http://216.218.219.41/tor/server/fp/a44a9974aaeaf814534c2f773d87093c733e417d
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    216.218.219.41:80
    Request
    GET /tor/server/fp/a44a9974aaeaf814534c2f773d87093c733e417d HTTP/1.0
    Host: 216.218.219.41
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:15:46 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:15:46 GMT
  • flag-de
    GET
    http://193.23.244.244/tor/server/fp/0b888583edb73862f444f2224f5c411da4f7e9fe
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    193.23.244.244:80
    Request
    GET /tor/server/fp/0b888583edb73862f444f2224f5c411da4f7e9fe HTTP/1.0
    Host: 193.23.244.244
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:15:51 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:15:51 GMT
  • flag-de
    GET
    http://193.23.244.244/tor/server/fp/a1177d4bf4698a74b926ae1e0fc533578fa55667
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    193.23.244.244:80
    Request
    GET /tor/server/fp/a1177d4bf4698a74b926ae1e0fc533578fa55667 HTTP/1.0
    Host: 193.23.244.244
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:15:51 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:15:51 GMT
  • flag-us
    GET
    http://216.218.219.41/tor/server/fp/e975f09b4a4e3cdeb11c951eaa1292defb515e1a
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    216.218.219.41:80
    Request
    GET /tor/server/fp/e975f09b4a4e3cdeb11c951eaa1292defb515e1a HTTP/1.0
    Host: 216.218.219.41
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:15:52 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:15:52 GMT
  • flag-de
    GET
    http://193.23.244.244/tor/server/fp/e656030ddfea6b38a590612bfe419dbc0649a74d
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    193.23.244.244:80
    Request
    GET /tor/server/fp/e656030ddfea6b38a590612bfe419dbc0649a74d HTTP/1.0
    Host: 193.23.244.244
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:15:52 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:15:52 GMT
  • flag-us
    GET
    http://216.218.219.41/tor/server/fp/be09d5f931c9240ce5369861cd67a1f66a636c76
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    216.218.219.41:80
    Request
    GET /tor/server/fp/be09d5f931c9240ce5369861cd67a1f66a636c76 HTTP/1.0
    Host: 216.218.219.41
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:16:10 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:16:10 GMT
  • flag-us
    GET
    http://216.218.219.41/tor/server/fp/61137fac08e0ae62165d18fe8855ccca26b6d631
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    216.218.219.41:80
    Request
    GET /tor/server/fp/61137fac08e0ae62165d18fe8855ccca26b6d631 HTTP/1.0
    Host: 216.218.219.41
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:16:11 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:16:11 GMT
  • flag-de
    GET
    http://193.23.244.244/tor/server/fp/f14bd56313420511a97afe4197e7c72882d3da81
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    193.23.244.244:80
    Request
    GET /tor/server/fp/f14bd56313420511a97afe4197e7c72882d3da81 HTTP/1.0
    Host: 193.23.244.244
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:16:12 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:16:12 GMT
  • flag-de
    GET
    http://193.23.244.244/tor/server/fp/431c23492de6169e6a5aceb9b24033d58428c116
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    193.23.244.244:80
    Request
    GET /tor/server/fp/431c23492de6169e6a5aceb9b24033d58428c116 HTTP/1.0
    Host: 193.23.244.244
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:16:22 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:16:22 GMT
  • flag-us
    GET
    http://216.218.219.41/tor/server/fp/ffa72bd683bc2fcf988356e6bec1e490f313fb07
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    216.218.219.41:80
    Request
    GET /tor/server/fp/ffa72bd683bc2fcf988356e6bec1e490f313fb07 HTTP/1.0
    Host: 216.218.219.41
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:16:23 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:16:23 GMT
  • flag-us
    GET
    http://216.218.219.41/tor/server/fp/2c26cbacab3b83142a54637ca30ff130c9bd331f
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    216.218.219.41:80
    Request
    GET /tor/server/fp/2c26cbacab3b83142a54637ca30ff130c9bd331f HTTP/1.0
    Host: 216.218.219.41
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:16:23 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:16:23 GMT
  • flag-us
    GET
    http://216.218.219.41/tor/server/fp/24676c50eae80778ecb5b2a76be0e82a7f04084b
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    216.218.219.41:80
    Request
    GET /tor/server/fp/24676c50eae80778ecb5b2a76be0e82a7f04084b HTTP/1.0
    Host: 216.218.219.41
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:21:38 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:21:38 GMT
  • flag-de
    GET
    http://193.23.244.244/tor/server/fp/557acec850f54eee65839f83cace2b0825be811e
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    193.23.244.244:80
    Request
    GET /tor/server/fp/557acec850f54eee65839f83cace2b0825be811e HTTP/1.0
    Host: 193.23.244.244
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:21:39 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:21:39 GMT
  • flag-us
    GET
    http://216.218.219.41/tor/server/fp/7e95fdf5ef72c6543a448a202afed4b459e97ea2
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    216.218.219.41:80
    Request
    GET /tor/server/fp/7e95fdf5ef72c6543a448a202afed4b459e97ea2 HTTP/1.0
    Host: 216.218.219.41
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:21:39 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:21:39 GMT
  • flag-de
    GET
    http://193.23.244.244/tor/server/fp/da91c260d6a78f748bdf17131a1f1d18443be1eb
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    193.23.244.244:80
    Request
    GET /tor/server/fp/da91c260d6a78f748bdf17131a1f1d18443be1eb HTTP/1.0
    Host: 193.23.244.244
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:21:45 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:21:45 GMT
  • flag-us
    GET
    http://216.218.219.41/tor/server/fp/dba3d441290af38b21446a5a41952430bfd74e69
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    216.218.219.41:80
    Request
    GET /tor/server/fp/dba3d441290af38b21446a5a41952430bfd74e69 HTTP/1.0
    Host: 216.218.219.41
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:21:46 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:21:46 GMT
  • flag-us
    GET
    http://216.218.219.41/tor/server/fp/25fc41154dcb2cae3abd74a8dfcd5b90d2cffd57
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    216.218.219.41:80
    Request
    GET /tor/server/fp/25fc41154dcb2cae3abd74a8dfcd5b90d2cffd57 HTTP/1.0
    Host: 216.218.219.41
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:21:47 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:21:47 GMT
  • flag-us
    GET
    http://216.218.219.41/tor/server/fp/da77aafe0cc38db958432b45910f47714d614aa8
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    216.218.219.41:80
    Request
    GET /tor/server/fp/da77aafe0cc38db958432b45910f47714d614aa8 HTTP/1.0
    Host: 216.218.219.41
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:22:08 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:22:08 GMT
  • flag-us
    GET
    http://216.218.219.41/tor/server/fp/e8965a79fb2f335194141e8968755524840c44b6
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    216.218.219.41:80
    Request
    GET /tor/server/fp/e8965a79fb2f335194141e8968755524840c44b6 HTTP/1.0
    Host: 216.218.219.41
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:22:09 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:22:09 GMT
  • flag-us
    GET
    http://216.218.219.41/tor/server/fp/85c29d07636bebacfca0df5ab31b333882745065
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    216.218.219.41:80
    Request
    GET /tor/server/fp/85c29d07636bebacfca0df5ab31b333882745065 HTTP/1.0
    Host: 216.218.219.41
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:22:12 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:22:12 GMT
  • flag-de
    GET
    http://193.23.244.244/tor/server/fp/f2ab0e62ef6d632ba47ab1ba7336de24003f6e0f
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    193.23.244.244:80
    Request
    GET /tor/server/fp/f2ab0e62ef6d632ba47ab1ba7336de24003f6e0f HTTP/1.0
    Host: 193.23.244.244
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:22:23 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:22:23 GMT
  • flag-us
    GET
    http://216.218.219.41/tor/server/fp/ebd7520d6ca3cd325ade5c3c802a7dafa0ba6c71
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    216.218.219.41:80
    Request
    GET /tor/server/fp/ebd7520d6ca3cd325ade5c3c802a7dafa0ba6c71 HTTP/1.0
    Host: 216.218.219.41
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:22:24 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:22:24 GMT
  • flag-us
    GET
    http://216.218.219.41/tor/server/fp/a0e3d391b83ced2f264cd6d39525e37775ea1eeb
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    216.218.219.41:80
    Request
    GET /tor/server/fp/a0e3d391b83ced2f264cd6d39525e37775ea1eeb HTTP/1.0
    Host: 216.218.219.41
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:22:25 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:22:25 GMT
  • flag-us
    GET
    http://216.218.219.41/tor/server/fp/405b635b7026b28da52e0062f67470da28aabc45
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    216.218.219.41:80
    Request
    GET /tor/server/fp/405b635b7026b28da52e0062f67470da28aabc45 HTTP/1.0
    Host: 216.218.219.41
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:22:49 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:22:49 GMT
  • flag-de
    GET
    http://193.23.244.244/tor/server/fp/cb81bcfd44fc142616bb5983648bd8af01930789
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    193.23.244.244:80
    Request
    GET /tor/server/fp/cb81bcfd44fc142616bb5983648bd8af01930789 HTTP/1.0
    Host: 193.23.244.244
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:22:50 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:22:50 GMT
  • flag-us
    GET
    http://216.218.219.41/tor/server/fp/62430484c9b56100f3679d04d61edb99c0c51dbf
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    216.218.219.41:80
    Request
    GET /tor/server/fp/62430484c9b56100f3679d04d61edb99c0c51dbf HTTP/1.0
    Host: 216.218.219.41
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:22:51 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:22:51 GMT
  • flag-de
    GET
    http://193.23.244.244/tor/server/fp/4f3d0dd92350cd63024feaad5cc466a5d1fdfaa7
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    193.23.244.244:80
    Request
    GET /tor/server/fp/4f3d0dd92350cd63024feaad5cc466a5d1fdfaa7 HTTP/1.0
    Host: 193.23.244.244
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:23:25 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:23:25 GMT
  • flag-de
    GET
    http://193.23.244.244/tor/server/fp/d8f3b0a19a71fa8bacec4b36e0a8645eeff01e6f
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    193.23.244.244:80
    Request
    GET /tor/server/fp/d8f3b0a19a71fa8bacec4b36e0a8645eeff01e6f HTTP/1.0
    Host: 193.23.244.244
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:23:26 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:23:26 GMT
  • flag-us
    GET
    http://216.218.219.41/tor/server/fp/23e1eca2727d24a05b3407c0a686d0ba9d3d1a26
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    Remote address:
    216.218.219.41:80
    Request
    GET /tor/server/fp/23e1eca2727d24a05b3407c0a686d0ba9d3d1a26 HTTP/1.0
    Host: 216.218.219.41
    Response
    HTTP/1.0 200 OK
    Date: Thu, 18 Apr 2024 05:23:27 GMT
    Content-Type: text/plain
    X-Your-Address-Is: 191.101.209.39
    Content-Encoding: identity
    Expires: Sat, 20 Apr 2024 05:23:27 GMT
  • 199.58.81.140:80
    http://199.58.81.140/tor/status-vote/current/consensus
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    66.2kB
    3.3MB
    1388
    2379

    HTTP Request

    GET http://199.58.81.140/tor/status-vote/current/consensus

    HTTP Response

    200
  • 104.26.12.205:443
    https://api.ipify.org/
    tls, http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    810 B
    5.6kB
    10
    12

    HTTP Request

    GET https://api.ipify.org/

    HTTP Response

    200
  • 216.218.219.41:80
    http://216.218.219.41/tor/server/fp/3e09aef0b44e9416bc2d87032d3416431e8231dc
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    371 B
    3.0kB
    6
    6

    HTTP Request

    GET http://216.218.219.41/tor/server/fp/3e09aef0b44e9416bc2d87032d3416431e8231dc

    HTTP Response

    200
  • 38.147.122.254:443
    tls, https
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    21.8kB
    24.3kB
    58
    69
  • 129.6.15.28:13
    time-a-g.nist.gov
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    190 B
    132 B
    4
    3
  • 129.6.15.28:13
    time-a-g.nist.gov
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    190 B
    223 B
    4
    4
  • 193.23.244.244:80
    http://193.23.244.244/tor/server/fp/a98f492f6531ae3a068dd35395ca9f5be8f0355c
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    371 B
    2.7kB
    6
    5

    HTTP Request

    GET http://193.23.244.244/tor/server/fp/a98f492f6531ae3a068dd35395ca9f5be8f0355c

    HTTP Response

    200
  • 193.23.244.244:80
    http://193.23.244.244/tor/server/fp/af7094b62864de941dcd88a2f0dbafecf3997e47
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    417 B
    6.5kB
    7
    8

    HTTP Request

    GET http://193.23.244.244/tor/server/fp/af7094b62864de941dcd88a2f0dbafecf3997e47

    HTTP Response

    200
  • 193.23.244.244:80
    http://193.23.244.244/tor/server/fp/b8348f1e967d9a432f2d03e572def76fb25f04d3
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    417 B
    6.2kB
    7
    7

    HTTP Request

    GET http://193.23.244.244/tor/server/fp/b8348f1e967d9a432f2d03e572def76fb25f04d3

    HTTP Response

    200
  • 216.218.219.41:80
    http://216.218.219.41/tor/server/fp/b83dc1558f0d34353bb992ef93afeafdb226a73e
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    371 B
    3.0kB
    6
    6

    HTTP Request

    GET http://216.218.219.41/tor/server/fp/b83dc1558f0d34353bb992ef93afeafdb226a73e

    HTTP Response

    200
  • 216.218.219.41:80
    http://216.218.219.41/tor/server/fp/b85e978aee73a9604fd9b124e1d834080afc3fa4
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    647 B
    21.0kB
    12
    19

    HTTP Request

    GET http://216.218.219.41/tor/server/fp/b85e978aee73a9604fd9b124e1d834080afc3fa4

    HTTP Response

    200
  • 216.218.219.41:80
    http://216.218.219.41/tor/server/fp/a205f116df47e8b980b5bed006cd85390a6b8f13
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    371 B
    3.1kB
    6
    6

    HTTP Request

    GET http://216.218.219.41/tor/server/fp/a205f116df47e8b980b5bed006cd85390a6b8f13

    HTTP Response

    200
  • 193.23.244.244:80
    http://193.23.244.244/tor/server/fp/a2211bec0ceb70c2634f425200c82b89dffb9923
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    371 B
    2.8kB
    6
    5

    HTTP Request

    GET http://193.23.244.244/tor/server/fp/a2211bec0ceb70c2634f425200c82b89dffb9923

    HTTP Response

    200
  • 193.23.244.244:80
    http://193.23.244.244/tor/server/fp/a22b1c2ef2255987f8ab8aa0b1a8e23f5023eeb8
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    371 B
    2.8kB
    6
    5

    HTTP Request

    GET http://193.23.244.244/tor/server/fp/a22b1c2ef2255987f8ab8aa0b1a8e23f5023eeb8

    HTTP Response

    200
  • 193.23.244.244:80
    http://193.23.244.244/tor/server/fp/b8ac259d400172997d08120b3bd5a4090841b06f
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    417 B
    6.7kB
    7
    8

    HTTP Request

    GET http://193.23.244.244/tor/server/fp/b8ac259d400172997d08120b3bd5a4090841b06f

    HTTP Response

    200
  • 185.220.101.205:443
    tls, https
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    21.4kB
    24.3kB
    50
    71
  • 193.23.244.244:80
    http://193.23.244.244/tor/server/fp/ff462edfe7b07dbc0a4beb473e57bdefe9178b85
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    371 B
    2.7kB
    6
    5

    HTTP Request

    GET http://193.23.244.244/tor/server/fp/ff462edfe7b07dbc0a4beb473e57bdefe9178b85

    HTTP Response

    200
  • 193.23.244.244:80
    http://193.23.244.244/tor/server/fp/0ef99182cb04b14a718efdfcc0fa3528ed486ab5
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    509 B
    11.2kB
    9
    11

    HTTP Request

    GET http://193.23.244.244/tor/server/fp/0ef99182cb04b14a718efdfcc0fa3528ed486ab5

    HTTP Response

    200
  • 193.23.244.244:80
    http://193.23.244.244/tor/server/fp/84fa05e6a80ebe36bd84a51705c467fa98188d4a
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    371 B
    4.2kB
    6
    6

    HTTP Request

    GET http://193.23.244.244/tor/server/fp/84fa05e6a80ebe36bd84a51705c467fa98188d4a

    HTTP Response

    200
  • 79.137.202.92:443
    tls, https
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    21.5kB
    24.3kB
    52
    69
  • 193.23.244.244:80
    http://193.23.244.244/tor/server/fp/0cf2f07ff0581ebbccdf209e655694358a98d816
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    371 B
    2.6kB
    6
    5

    HTTP Request

    GET http://193.23.244.244/tor/server/fp/0cf2f07ff0581ebbccdf209e655694358a98d816

    HTTP Response

    200
  • 216.218.219.41:80
    http://216.218.219.41/tor/server/fp/a44a9974aaeaf814534c2f773d87093c733e417d
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    371 B
    2.9kB
    6
    6

    HTTP Request

    GET http://216.218.219.41/tor/server/fp/a44a9974aaeaf814534c2f773d87093c733e417d

    HTTP Response

    200
  • 193.23.244.244:80
    http://193.23.244.244/tor/server/fp/0b888583edb73862f444f2224f5c411da4f7e9fe
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    371 B
    4.9kB
    6
    6

    HTTP Request

    GET http://193.23.244.244/tor/server/fp/0b888583edb73862f444f2224f5c411da4f7e9fe

    HTTP Response

    200
  • 185.177.229.15:443
    tls
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    383 B
    172 B
    5
    4
  • 193.23.244.244:80
    http://193.23.244.244/tor/server/fp/a1177d4bf4698a74b926ae1e0fc533578fa55667
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    371 B
    2.8kB
    6
    5

    HTTP Request

    GET http://193.23.244.244/tor/server/fp/a1177d4bf4698a74b926ae1e0fc533578fa55667

    HTTP Response

    200
  • 31.171.154.165:443
    tls, https
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    22.2kB
    25.6kB
    55
    75
  • 216.218.219.41:80
    http://216.218.219.41/tor/server/fp/e975f09b4a4e3cdeb11c951eaa1292defb515e1a
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    371 B
    2.9kB
    6
    6

    HTTP Request

    GET http://216.218.219.41/tor/server/fp/e975f09b4a4e3cdeb11c951eaa1292defb515e1a

    HTTP Response

    200
  • 193.23.244.244:80
    http://193.23.244.244/tor/server/fp/e656030ddfea6b38a590612bfe419dbc0649a74d
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    463 B
    7.6kB
    8
    8

    HTTP Request

    GET http://193.23.244.244/tor/server/fp/e656030ddfea6b38a590612bfe419dbc0649a74d

    HTTP Response

    200
  • 216.218.219.41:80
    http://216.218.219.41/tor/server/fp/be09d5f931c9240ce5369861cd67a1f66a636c76
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    371 B
    2.8kB
    6
    6

    HTTP Request

    GET http://216.218.219.41/tor/server/fp/be09d5f931c9240ce5369861cd67a1f66a636c76

    HTTP Response

    200
  • 83.212.96.97:443
    tls, https
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    21.6kB
    24.5kB
    54
    73
  • 216.218.219.41:80
    http://216.218.219.41/tor/server/fp/61137fac08e0ae62165d18fe8855ccca26b6d631
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    371 B
    3.2kB
    6
    6

    HTTP Request

    GET http://216.218.219.41/tor/server/fp/61137fac08e0ae62165d18fe8855ccca26b6d631

    HTTP Response

    200
  • 193.23.244.244:80
    http://193.23.244.244/tor/server/fp/f14bd56313420511a97afe4197e7c72882d3da81
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    647 B
    18.1kB
    12
    16

    HTTP Request

    GET http://193.23.244.244/tor/server/fp/f14bd56313420511a97afe4197e7c72882d3da81

    HTTP Response

    200
  • 193.23.244.244:80
    http://193.23.244.244/tor/server/fp/431c23492de6169e6a5aceb9b24033d58428c116
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    371 B
    3.2kB
    6
    5

    HTTP Request

    GET http://193.23.244.244/tor/server/fp/431c23492de6169e6a5aceb9b24033d58428c116

    HTTP Response

    200
  • 95.211.210.103:443
    tls, https
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    21.6kB
    24.0kB
    54
    62
  • 216.218.219.41:80
    http://216.218.219.41/tor/server/fp/ffa72bd683bc2fcf988356e6bec1e490f313fb07
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    371 B
    3.2kB
    6
    6

    HTTP Request

    GET http://216.218.219.41/tor/server/fp/ffa72bd683bc2fcf988356e6bec1e490f313fb07

    HTTP Response

    200
  • 216.218.219.41:80
    http://216.218.219.41/tor/server/fp/2c26cbacab3b83142a54637ca30ff130c9bd331f
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    647 B
    20.7kB
    12
    19

    HTTP Request

    GET http://216.218.219.41/tor/server/fp/2c26cbacab3b83142a54637ca30ff130c9bd331f

    HTTP Response

    200
  • 216.218.219.41:80
    http://216.218.219.41/tor/server/fp/24676c50eae80778ecb5b2a76be0e82a7f04084b
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    371 B
    4.9kB
    6
    7

    HTTP Request

    GET http://216.218.219.41/tor/server/fp/24676c50eae80778ecb5b2a76be0e82a7f04084b

    HTTP Response

    200
  • 23.154.177.16:443
    tls, https
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    21.3kB
    24.2kB
    48
    66
  • 193.23.244.244:80
    http://193.23.244.244/tor/server/fp/557acec850f54eee65839f83cace2b0825be811e
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    371 B
    2.9kB
    6
    5

    HTTP Request

    GET http://193.23.244.244/tor/server/fp/557acec850f54eee65839f83cace2b0825be811e

    HTTP Response

    200
  • 216.218.219.41:80
    http://216.218.219.41/tor/server/fp/7e95fdf5ef72c6543a448a202afed4b459e97ea2
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    601 B
    16.2kB
    11
    16

    HTTP Request

    GET http://216.218.219.41/tor/server/fp/7e95fdf5ef72c6543a448a202afed4b459e97ea2

    HTTP Response

    200
  • 193.23.244.244:80
    http://193.23.244.244/tor/server/fp/da91c260d6a78f748bdf17131a1f1d18443be1eb
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    371 B
    2.7kB
    6
    5

    HTTP Request

    GET http://193.23.244.244/tor/server/fp/da91c260d6a78f748bdf17131a1f1d18443be1eb

    HTTP Response

    200
  • 51.81.209.101:443
    tls, https
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    21.5kB
    24.4kB
    52
    72
  • 216.218.219.41:80
    http://216.218.219.41/tor/server/fp/dba3d441290af38b21446a5a41952430bfd74e69
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    371 B
    2.9kB
    6
    6

    HTTP Request

    GET http://216.218.219.41/tor/server/fp/dba3d441290af38b21446a5a41952430bfd74e69

    HTTP Response

    200
  • 216.218.219.41:80
    http://216.218.219.41/tor/server/fp/25fc41154dcb2cae3abd74a8dfcd5b90d2cffd57
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    371 B
    4.5kB
    6
    7

    HTTP Request

    GET http://216.218.219.41/tor/server/fp/25fc41154dcb2cae3abd74a8dfcd5b90d2cffd57

    HTTP Response

    200
  • 216.218.219.41:80
    http://216.218.219.41/tor/server/fp/da77aafe0cc38db958432b45910f47714d614aa8
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    417 B
    7.8kB
    7
    9

    HTTP Request

    GET http://216.218.219.41/tor/server/fp/da77aafe0cc38db958432b45910f47714d614aa8

    HTTP Response

    200
  • 204.8.96.154:443
    tls, https
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    21.6kB
    24.3kB
    55
    70
  • 216.218.219.41:80
    http://216.218.219.41/tor/server/fp/e8965a79fb2f335194141e8968755524840c44b6
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    371 B
    3.4kB
    6
    6

    HTTP Request

    GET http://216.218.219.41/tor/server/fp/e8965a79fb2f335194141e8968755524840c44b6

    HTTP Response

    200
  • 216.218.219.41:80
    http://216.218.219.41/tor/server/fp/85c29d07636bebacfca0df5ab31b333882745065
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    417 B
    6.2kB
    7
    8

    HTTP Request

    GET http://216.218.219.41/tor/server/fp/85c29d07636bebacfca0df5ab31b333882745065

    HTTP Response

    200
  • 193.23.244.244:80
    http://193.23.244.244/tor/server/fp/f2ab0e62ef6d632ba47ab1ba7336de24003f6e0f
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    371 B
    2.9kB
    6
    5

    HTTP Request

    GET http://193.23.244.244/tor/server/fp/f2ab0e62ef6d632ba47ab1ba7336de24003f6e0f

    HTTP Response

    200
  • 192.9.235.157:443
    tls, https
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    21.5kB
    24.4kB
    53
    72
  • 216.218.219.41:80
    http://216.218.219.41/tor/server/fp/ebd7520d6ca3cd325ade5c3c802a7dafa0ba6c71
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    371 B
    4.5kB
    6
    7

    HTTP Request

    GET http://216.218.219.41/tor/server/fp/ebd7520d6ca3cd325ade5c3c802a7dafa0ba6c71

    HTTP Response

    200
  • 216.218.219.41:80
    http://216.218.219.41/tor/server/fp/a0e3d391b83ced2f264cd6d39525e37775ea1eeb
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    647 B
    21.0kB
    12
    19

    HTTP Request

    GET http://216.218.219.41/tor/server/fp/a0e3d391b83ced2f264cd6d39525e37775ea1eeb

    HTTP Response

    200
  • 216.218.219.41:80
    http://216.218.219.41/tor/server/fp/405b635b7026b28da52e0062f67470da28aabc45
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    371 B
    2.7kB
    6
    6

    HTTP Request

    GET http://216.218.219.41/tor/server/fp/405b635b7026b28da52e0062f67470da28aabc45

    HTTP Response

    200
  • 185.148.3.38:443
    tls, https
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    10.8kB
    13.3kB
    30
    36
  • 193.23.244.244:80
    http://193.23.244.244/tor/server/fp/cb81bcfd44fc142616bb5983648bd8af01930789
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    371 B
    2.7kB
    6
    5

    HTTP Request

    GET http://193.23.244.244/tor/server/fp/cb81bcfd44fc142616bb5983648bd8af01930789

    HTTP Response

    200
  • 216.218.219.41:80
    http://216.218.219.41/tor/server/fp/62430484c9b56100f3679d04d61edb99c0c51dbf
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    371 B
    3.6kB
    6
    6

    HTTP Request

    GET http://216.218.219.41/tor/server/fp/62430484c9b56100f3679d04d61edb99c0c51dbf

    HTTP Response

    200
  • 193.23.244.244:80
    http://193.23.244.244/tor/server/fp/4f3d0dd92350cd63024feaad5cc466a5d1fdfaa7
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    371 B
    2.7kB
    6
    5

    HTTP Request

    GET http://193.23.244.244/tor/server/fp/4f3d0dd92350cd63024feaad5cc466a5d1fdfaa7

    HTTP Response

    200
  • 50.72.129.50:443
    tls, https
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    3.6kB
    5.9kB
    14
    15
  • 193.23.244.244:80
    http://193.23.244.244/tor/server/fp/d8f3b0a19a71fa8bacec4b36e0a8645eeff01e6f
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    371 B
    2.7kB
    6
    5

    HTTP Request

    GET http://193.23.244.244/tor/server/fp/d8f3b0a19a71fa8bacec4b36e0a8645eeff01e6f

    HTTP Response

    200
  • 216.218.219.41:80
    http://216.218.219.41/tor/server/fp/23e1eca2727d24a05b3407c0a686d0ba9d3d1a26
    http
    6b64ec1c1ec9e8eb486f721c283d377a2e52f177e9f947d0d217ce84685ed239.exe
    371 B
    4.0kB
    6
    7

    HTTP Request

    GET http://216.218.219.41/tor/server/fp/23e1eca2727d24a05b3407c0a686d0ba9d3d1a26

    HTTP Response

    200
  • 8.8.8.8:53
    140.81.58.199.in-addr.arpa
    dns
    678 B
    1.1kB
    10
    10

    DNS Request

    140.81.58.199.in-addr.arpa

    DNS Request

    api.ipify.org

    DNS Response

    104.26.12.205
    104.26.13.205
    172.67.74.152

    DNS Request

    8.8.8.8.in-addr.arpa

    DNS Request

    time-a.nist.gov

    DNS Response

    129.6.15.28

    DNS Request

    time-a-g.nist.gov

    DNS Response

    129.6.15.28

    DNS Request

    244.244.23.193.in-addr.arpa

    DNS Request

    97.96.212.83.in-addr.arpa

    DNS Request

    226.162.46.104.in-addr.arpa

    DNS Request

    25.24.18.2.in-addr.arpa

    DNS Request

    38.3.148.185.in-addr.arpa

  • 8.8.8.8:53
    205.12.26.104.in-addr.arpa
    dns
    431 B
    765 B
    6
    6

    DNS Request

    205.12.26.104.in-addr.arpa

    DNS Request

    205.101.220.185.in-addr.arpa

    DNS Request

    103.210.211.95.in-addr.arpa

    DNS Request

    ctldl.windowsupdate.com

    DNS Response

    87.248.204.0

    DNS Request

    16.177.154.23.in-addr.arpa

    DNS Request

    50.129.72.50.in-addr.arpa

  • 8.8.8.8:53
    41.219.218.216.in-addr.arpa
    dns
    356 B
    660 B
    5
    5

    DNS Request

    41.219.218.216.in-addr.arpa

    DNS Request

    92.202.137.79.in-addr.arpa

    DNS Request

    nexusrules.officeapps.live.com

    DNS Response

    52.111.236.23

    DNS Request

    ocsp.digicert.com

    DNS Response

    192.229.221.95

    DNS Request

    101.209.81.51.in-addr.arpa

  • 8.8.8.8:53
    254.122.147.38.in-addr.arpa
    dns
    363 B
    826 B
    5
    5

    DNS Request

    254.122.147.38.in-addr.arpa

    DNS Request

    165.154.171.31.in-addr.arpa

    DNS Request

    self.events.data.microsoft.com

    DNS Response

    104.46.162.226

    DNS Request

    ctldl.windowsupdate.com

    DNS Response

    2.18.24.25
    2.18.24.18

    DNS Request

    157.235.9.192.in-addr.arpa

  • 8.8.8.8:53
    28.15.6.129.in-addr.arpa
    dns
    357 B
    620 B
    5
    5

    DNS Request

    28.15.6.129.in-addr.arpa

    DNS Request

    15.229.177.185.in-addr.arpa

    DNS Request

    23.236.111.52.in-addr.arpa

    DNS Request

    0.204.248.87.in-addr.arpa

    DNS Request

    154.96.8.204.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\GetX64BTIT.exe

    Filesize

    3KB

    MD5

    b4cd27f2b37665f51eb9fe685ec1d373

    SHA1

    7f08febf0fdb7fc9f8bf35a10fb11e7de431abe0

    SHA256

    91f1023142b7babf6ff75dad984c2a35bde61dc9e61f45483f4b65008576d581

    SHA512

    e025f65224d78f5fd0abebe281ac0d44a385b2641e367cf39eed6aefada20a112ac47f94d7febc4424f1db6a6947bac16ff83ef93a8d745b3cddfdbe64c49a1e

  • C:\Users\Admin\AppData\Local\Temp\x64btit.txt

    Filesize

    28B

    MD5

    dc9465190a378e31b3a95edb04a13eee

    SHA1

    54681d57c6ede2933f5b2012c37f47e73516c3cc

    SHA256

    6ac2408be5359b80d4cd9262e5b39896583c72f7f87ee8c3673797807fb8137d

    SHA512

    763d91fb358938569a66500c9d8da04e4042eee8b3a7c4b0a9f6e8f8264fadd939add97ea02182b38c709671faf8274024c72bc329f2e7e7d45b1457c7bcbfd2

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.