Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

Setup.exe

windows7-x64

10

Setup.exe

windows10-1703-x64

10

Setup.exe

windows10-2004-x64

10

Setup.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240704-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/07/2024, 04:08 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Setup.exe

  • Size

    663.4MB

  • MD5

    70a9e51d9777a02427404e4dc2325f0f

  • SHA1

    b340348b78dcbbdc49dc9206f68aa3950723b964

  • SHA256

    f9f5fe8a6d4ef35fdacc5623b1dc689be3ea89c61efdf68e0ddf449916396f05

  • SHA512

    65888e9a446880cd8911ed56047392c00735fe484530962e8d1b70256b082c9eff822b4db0c84db689e5f11331b56acfa62d86b0a496f8b6b744380853b86ebe

  • SSDEEP

    196608:Xpcugy7TlXNdj+P64+SPrW7hOOo4j704ehNVhV98x+L5rCZhwNNwL84XiOHWgE:Xpcu7k6BkOxU4o

Score
10/10
stealcpuarospywarestealer

Malware Config

Extracted

Family

stealc

Botnet

Puaro

C2

https://9507c272a51ce8cefc8761591b2c50e6.fit

Attributes
  • url_path

    /2fca4d4264af2833.php

Signatures

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:3608
    • C:\Windows\SysWOW64\comp.exe
      C:\Windows\SysWOW64\comp.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:4744
      • C:\Windows\SysWOW64\SearchIndexer.exe
        C:\Windows\SysWOW64\SearchIndexer.exe
        3⤵
        • Loads dropped DLL
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2936
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\HJKECAAAFH.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3736
          • C:\Users\Admin\AppData\Local\Temp\HJKECAAAFH.exe
            "C:\Users\Admin\AppData\Local\Temp\HJKECAAAFH.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            PID:2400
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\SysWOW64\cmd.exe
              6⤵
              • Drops file in Windows directory
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of WriteProcessMemory
              PID:2644
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                7⤵
                  PID:4996

    Network

    • flag-us
      DNS
      g.bing.com
      Remote address:
      8.8.8.8:53
      Request
      g.bing.com
      IN A
      Response
      g.bing.com
      IN CNAME
      g-bing-com.dual-a-0034.a-msedge.net
      g-bing-com.dual-a-0034.a-msedge.net
      IN CNAME
      dual-a-0034.a-msedge.net
      dual-a-0034.a-msedge.net
      IN A
      13.107.21.237
      dual-a-0034.a-msedge.net
      IN A
      204.79.197.237
    • flag-us
      DNS
      4.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      4.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      237.21.107.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      237.21.107.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      26.165.165.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      26.165.165.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      206.23.85.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      206.23.85.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      240.221.184.93.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      240.221.184.93.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      9507c272a51ce8cefc8761591b2c50e6.fit
      SearchIndexer.exe
      Remote address:
      8.8.8.8:53
      Request
      9507c272a51ce8cefc8761591b2c50e6.fit
      IN A
      Response
      9507c272a51ce8cefc8761591b2c50e6.fit
      IN A
      172.67.207.158
      9507c272a51ce8cefc8761591b2c50e6.fit
      IN A
      104.21.93.84
    • flag-us
      POST
      https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php
      SearchIndexer.exe
      Remote address:
      172.67.207.158:443
      Request
      POST /2fca4d4264af2833.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----KKKJEBAAECBGDHIECAKJ
      Host: 9507c272a51ce8cefc8761591b2c50e6.fit
      Content-Length: 212
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sun, 07 Jul 2024 04:10:29 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Vary: Accept-Encoding
      CF-Cache-Status: DYNAMIC
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cI321XPvg3QWuo9MQBq9K58rMh5qxYgAQfEgYt8yByHYbM%2FhCNfrcEwi8PZJuSMh34hYW4UtN%2BTrkLi25uxATGYVIra3RYqY3zKuZgySaRXJTknTcL33DcptKZgBr4hc7NiOrooFBjThol2qE2qwh3zTrgPs9Wk%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 89f4fc2f280a71b4-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      POST
      https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php
      SearchIndexer.exe
      Remote address:
      172.67.207.158:443
      Request
      POST /2fca4d4264af2833.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----ECFCBKJDBFIJKFHIIDAA
      Host: 9507c272a51ce8cefc8761591b2c50e6.fit
      Content-Length: 268
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sun, 07 Jul 2024 04:10:29 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Vary: Accept-Encoding
      CF-Cache-Status: DYNAMIC
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7rkLWl0Z%2FLlySjd0WSYbBVTp5rpoXfE0cWm1%2FR4TaTmz%2BLjaxdX%2BzXfuAfK5kjpFiYYD3YezsUs7ogY5c%2B3r31EX%2BRZH5dmD8qXPitbQMohwNxkKLhf2VNtbSPHAF3w17cPn653Tx8NKpwZbaVOMi0UmbsTLKqw%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 89f4fc2fa83671b4-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      POST
      https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php
      SearchIndexer.exe
      Remote address:
      172.67.207.158:443
      Request
      POST /2fca4d4264af2833.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----BKJJEBKKEHJDGCBGCFCG
      Host: 9507c272a51ce8cefc8761591b2c50e6.fit
      Content-Length: 267
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sun, 07 Jul 2024 04:10:29 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Vary: Accept-Encoding
      CF-Cache-Status: DYNAMIC
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E8UeumWd16ImWkFzQ0cix8B8xcB%2BmwjOka%2FVibEgFg%2F0epdksTQb8Q6EAaeWxrtNTnvIpzBWAxeJx2fOGK%2F0%2BXYxJfCKv2brT2fY%2BhEkwInsiAzkLS2pAMwi%2FJB8inaGvVxExLb2cF4RjOihepFrTTyJck6tcUE%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 89f4fc2fe84571b4-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      POST
      https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php
      SearchIndexer.exe
      Remote address:
      172.67.207.158:443
      Request
      POST /2fca4d4264af2833.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----JEBGCBAFCGDAAKFIDGIE
      Host: 9507c272a51ce8cefc8761591b2c50e6.fit
      Content-Length: 268
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sun, 07 Jul 2024 04:10:29 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Vary: Accept-Encoding
      CF-Cache-Status: DYNAMIC
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=203%2FZF5TWRafXj6B%2BzU5%2Flb6AYukISn6UfG%2FaekwkfxvUrLNCRsTIglP2X3t7ZO98Lb5NevJ3SWg3AnbVK%2B7ZeZZql2ooD07KZI5vhCQ9KYeKPSbWyea0TWmukmX%2For66t23rHrIrVg89V%2FYW%2F10C2x60rr2wls%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 89f4fc30386571b4-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      POST
      https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php
      SearchIndexer.exe
      Remote address:
      172.67.207.158:443
      Request
      POST /2fca4d4264af2833.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----DGDBFBFCBFBKECAAKJKF
      Host: 9507c272a51ce8cefc8761591b2c50e6.fit
      Content-Length: 4643
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sun, 07 Jul 2024 04:10:29 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      CF-Cache-Status: DYNAMIC
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sAol5jhlRM6o%2F6CjmcHDpbrduznNm9sGWcw7hJ0IFxAaq8bmCHwqHhZJVMX1ldrkv8cRCHMZabBnC2gnXyUffpigfbSaG%2Ft%2B5aykv0OZPcWsbkKsWWbq6k8%2FgKONvvrEG5%2BPTlgNume4KFZHtiQTsdwVzEvfYsc%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 89f4fc30888971b4-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      GET
      https://9507c272a51ce8cefc8761591b2c50e6.fit/8960e31f09662674/sqlite3.dll
      SearchIndexer.exe
      Remote address:
      172.67.207.158:443
      Request
      GET /8960e31f09662674/sqlite3.dll HTTP/1.1
      Host: 9507c272a51ce8cefc8761591b2c50e6.fit
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sun, 07 Jul 2024 04:10:29 GMT
      Content-Type: application/x-msdos-program
      Content-Length: 1106998
      Connection: keep-alive
      Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT
      ETag: "10e436-5e7eeebed8d80"
      Accept-Ranges: bytes
      CF-Cache-Status: DYNAMIC
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LAK%2FZ3qwkNcnGHluYVEgDatxWaMc5SUGLz4tZ3ZzxjKTWeyxJ1LLgfVpIHU6R7UjybQ4BdIglMwNljpegjuxFR%2B7hlfMQgWX4aqmkuNTmV8mWHeCiFeyqNRUlufM37OIPTY4Jb%2F3M8eCYZMWS3Ca9H8fjZx0I40%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 89f4fc30e8a771b4-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      POST
      https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php
      SearchIndexer.exe
      Remote address:
      172.67.207.158:443
      Request
      POST /2fca4d4264af2833.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----HJDHCFCBGIDGHJJKJJDG
      Host: 9507c272a51ce8cefc8761591b2c50e6.fit
      Content-Length: 355
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sun, 07 Jul 2024 04:10:30 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      CF-Cache-Status: DYNAMIC
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=47Oev4mrsJNSEWrBsZzkXMsgmOyVxMaBfPZjFS5S55wbMJdJI8z00LV0dTo9Dup2mCws1MEb2DOzRVDTVor6gbmeknavHiJ%2BRrgNDIFj5fQHjZCmN16Sgqe2Kx5htLhm1IcvML7mRYPg0KxJ4sfkTRurigNFV90%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 89f4fc32691a71b4-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      POST
      https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php
      SearchIndexer.exe
      Remote address:
      172.67.207.158:443
      Request
      POST /2fca4d4264af2833.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----FCFBFBFBKFIDHJKFCAFC
      Host: 9507c272a51ce8cefc8761591b2c50e6.fit
      Content-Length: 355
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sun, 07 Jul 2024 04:10:30 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      CF-Cache-Status: DYNAMIC
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6D10kh1AcRccduNuuMgqVuPVv8JGFL62VXTD4Y21Oeqz3cXoQaXbX1Ka7KmZVf3DlXXIqKfujDSGkDlnfJ24D%2B0l2eDH2bLB5yiE6WRihuuyoI%2FNQjOTR47B9vejpTuytpS2cJ5jSSLmuWuj8wiz1YFHDsZNVCw%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 89f4fc33395e71b4-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      GET
      https://9507c272a51ce8cefc8761591b2c50e6.fit/8960e31f09662674/freebl3.dll
      SearchIndexer.exe
      Remote address:
      172.67.207.158:443
      Request
      GET /8960e31f09662674/freebl3.dll HTTP/1.1
      Host: 9507c272a51ce8cefc8761591b2c50e6.fit
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sun, 07 Jul 2024 04:10:30 GMT
      Content-Type: application/x-msdos-program
      Content-Length: 685392
      Connection: keep-alive
      Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT
      ETag: "a7550-5e7ebd4425100"
      Accept-Ranges: bytes
      CF-Cache-Status: DYNAMIC
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YK0WJtGlRuj6hBC9e8fI5Euhd9LMe5x9qA0GG1kN8olQSilTJHz3AlCDJGpAIR75H2WW9gsNWbOzDRwOp3RHvnY684Y4eLYwvS1uBX29sLFZe2pFQv74LlEokXSBU1xWdGKB1S1AdExEY6amQJoyazl7OXJlS04%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 89f4fc33c98b71b4-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      GET
      https://9507c272a51ce8cefc8761591b2c50e6.fit/8960e31f09662674/mozglue.dll
      SearchIndexer.exe
      Remote address:
      172.67.207.158:443
      Request
      GET /8960e31f09662674/mozglue.dll HTTP/1.1
      Host: 9507c272a51ce8cefc8761591b2c50e6.fit
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sun, 07 Jul 2024 04:10:30 GMT
      Content-Type: application/x-msdos-program
      Content-Length: 608080
      Connection: keep-alive
      Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT
      ETag: "94750-5e7ebd4425100"
      Accept-Ranges: bytes
      CF-Cache-Status: DYNAMIC
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kj9Nw5lL%2B3m0wF9d7PmTgm9BC6%2Fl%2Bs7uETw0ga8lSBBXwukPBKi%2Fs7mfTwZuEkAXC7yIeHpeC7uP2gw97L55i3OPOIICckdi10w56MrvNYV610pBQlXUYgyEqG8KyVny8oZqHnE14UD5Ru45%2BW6UAn9wtdiOLBI%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 89f4fc34d9e171b4-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      GET
      https://9507c272a51ce8cefc8761591b2c50e6.fit/8960e31f09662674/msvcp140.dll
      SearchIndexer.exe
      Remote address:
      172.67.207.158:443
      Request
      GET /8960e31f09662674/msvcp140.dll HTTP/1.1
      Host: 9507c272a51ce8cefc8761591b2c50e6.fit
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sun, 07 Jul 2024 04:10:30 GMT
      Content-Type: application/x-msdos-program
      Content-Length: 450024
      Connection: keep-alive
      Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT
      ETag: "6dde8-5e7ebd4425100"
      Accept-Ranges: bytes
      CF-Cache-Status: DYNAMIC
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Mw1aLOKb%2BLwWQBlwYXBGp9lxPirqiLVd7GNYEBtxncJuAiJgelfRDRYiTu1lxy9LqXs6TcagBR%2FjilwsWlBNWhlsrSGRtu9ZMNQpSOacg1Z7YX3yB8E1YKADAm7FPhwj6KJRHkGYYnYEQ4B0qZGSNqccIIaryQM%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 89f4fc356a2171b4-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      GET
      https://9507c272a51ce8cefc8761591b2c50e6.fit/8960e31f09662674/nss3.dll
      SearchIndexer.exe
      Remote address:
      172.67.207.158:443
      Request
      GET /8960e31f09662674/nss3.dll HTTP/1.1
      Host: 9507c272a51ce8cefc8761591b2c50e6.fit
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sun, 07 Jul 2024 04:10:30 GMT
      Content-Type: application/x-msdos-program
      Content-Length: 2046288
      Connection: keep-alive
      Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT
      ETag: "1f3950-5e7ebd4425100"
      Accept-Ranges: bytes
      CF-Cache-Status: DYNAMIC
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B6XABiyxsr71x133I2CPCuwQHBlPbO%2FIgl%2BBN0e%2FJeZ%2BFtH50abLVYBdeJFfmn2hktkavpwBuzR1Wl%2Fr9cx38u7CksTh3LnRwtfwPiStenwKFDFrHRmGcWkBrszYbIMQ0HGxGHLcsZQQ8pGkypgokDQ%2BkEA%2BeXg%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 89f4fc35fa4d71b4-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      GET
      https://9507c272a51ce8cefc8761591b2c50e6.fit/8960e31f09662674/softokn3.dll
      SearchIndexer.exe
      Remote address:
      172.67.207.158:443
      Request
      GET /8960e31f09662674/softokn3.dll HTTP/1.1
      Host: 9507c272a51ce8cefc8761591b2c50e6.fit
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sun, 07 Jul 2024 04:10:30 GMT
      Content-Type: application/x-msdos-program
      Content-Length: 257872
      Connection: keep-alive
      Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT
      ETag: "3ef50-5e7ebd4425100"
      Accept-Ranges: bytes
      CF-Cache-Status: DYNAMIC
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jURXgU3IM0Ji8ScpEn5gVV7muewWtzOyodxZHPQpeFecqIwpVWisFTgbLwuyj%2FFujcW%2FJ%2BjeYk9uGp2snPwK7AHWlCHFcVh2cnEnkIE0eP%2FJNw6dfwdLKwzoOteazNvdBOxg%2B1CCjzV%2BHrYREvnAoa5kBqe2Rrg%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 89f4fc379ae171b4-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      GET
      https://9507c272a51ce8cefc8761591b2c50e6.fit/8960e31f09662674/vcruntime140.dll
      SearchIndexer.exe
      Remote address:
      172.67.207.158:443
      Request
      GET /8960e31f09662674/vcruntime140.dll HTTP/1.1
      Host: 9507c272a51ce8cefc8761591b2c50e6.fit
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sun, 07 Jul 2024 04:10:31 GMT
      Content-Type: application/x-msdos-program
      Content-Length: 80880
      Connection: keep-alive
      Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT
      ETag: "13bf0-5e7ebd4425100"
      Accept-Ranges: bytes
      CF-Cache-Status: DYNAMIC
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N8QHOL98J8HWqItF12ypZgVF%2Bd4l6tzeynluvyryIj%2B%2BT4nH6vKN7BwSyJpCmy48XsEeT6uEn9w0fSSFYLC%2FsWB7sZwCwLkbi%2FXbLY565SsTnpHk%2BpuzU8bQzL6cFtj0oWhyvyY%2FnOCng58FTFE8Y4%2Furq8wNuk%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 89f4fc380b1471b4-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      POST
      https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php
      SearchIndexer.exe
      Remote address:
      172.67.207.158:443
      Request
      POST /2fca4d4264af2833.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----CFIEHCFIECBGCBFHIJJK
      Host: 9507c272a51ce8cefc8761591b2c50e6.fit
      Content-Length: 947
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sun, 07 Jul 2024 04:10:31 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      CF-Cache-Status: DYNAMIC
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eWzcVO3pYWDWclhSgRyVjBM%2BxMpxuN%2FvfwJ4DysaZQQCbX6HxX72faZ99OtaLWhyUrChrzuLKhWbV%2Fm5Hbune95l%2B0KWVGqmWCUcIOrT2wfrYtUUAGlE5KkIaIwwUayNlfTFkMjn7gJ1atfjB%2F95m6S7WAsGojk%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 89f4fc392b7d71b4-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      POST
      https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php
      SearchIndexer.exe
      Remote address:
      172.67.207.158:443
      Request
      POST /2fca4d4264af2833.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----BAFCFBAEGDHIEBFHDGCB
      Host: 9507c272a51ce8cefc8761591b2c50e6.fit
      Content-Length: 267
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sun, 07 Jul 2024 04:10:31 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Vary: Accept-Encoding
      CF-Cache-Status: DYNAMIC
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=c6P0ROeXa4YwoU6UW0Co8UEJCMkp9Ypq3llaqYSGtCigwnH2oHnWLbAAD8UbwJMWofE3LklbYzh3R9MeAsOBuiC0kJk5PDxoxzxpM71Ccsweu%2FDPBn4emR%2BoG48tztH6%2BjnEI072B8VR4%2FTiL0rv93R62IkkgVA%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 89f4fc399b9b71b4-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      POST
      https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php
      SearchIndexer.exe
      Remote address:
      172.67.207.158:443
      Request
      POST /2fca4d4264af2833.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----HIIEBAFCBKFIDGCAKKKF
      Host: 9507c272a51ce8cefc8761591b2c50e6.fit
      Content-Length: 265
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sun, 07 Jul 2024 04:10:31 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Vary: Accept-Encoding
      CF-Cache-Status: DYNAMIC
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mNlsXISOXDyVuRcNhokVgr0QeSIcXtXGBM%2BVJX48%2B%2B8RbO3OjP1289zRmivoqTc%2BTWeHWqGCFXV9k%2FoQmOKCPK2m2CABLrMSdmYCR%2Bdb7XK1UUTpWPmhDI1UydQWO5o204CIaAe4Dz%2FKz4T4P7xL6yeCYm%2FLp%2BA%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 89f4fc39ebb271b4-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      POST
      https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php
      SearchIndexer.exe
      Remote address:
      172.67.207.158:443
      Request
      POST /2fca4d4264af2833.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----AEBAFBGIDHCBFHIECFCB
      Host: 9507c272a51ce8cefc8761591b2c50e6.fit
      Content-Length: 26339
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sun, 07 Jul 2024 04:10:31 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      CF-Cache-Status: DYNAMIC
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GKmwQ4xopRdukRRMYIhLL41S9CtCFtL00XpLAY0d3LRNr6LHXvN0YLwsgLiPU8%2BegabLuVT%2BxVehC3oKJ4Z3tB4jqjIlrAE41PmJOqjljIvINRsTgNlCJT7DrV43Os8jjloX%2Bz%2FhyfwoB4D9YntNNRZ4nyfPoz0%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 89f4fc3a7be171b4-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      POST
      https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php
      SearchIndexer.exe
      Remote address:
      172.67.207.158:443
      Request
      POST /2fca4d4264af2833.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----IDHIEBAAKJDHIECAAFHC
      Host: 9507c272a51ce8cefc8761591b2c50e6.fit
      Content-Length: 20159
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sun, 07 Jul 2024 04:10:31 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      CF-Cache-Status: DYNAMIC
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZE%2Fe14B25p9TzpMhefRhr6FrE3vFnxH1XX%2BlXQDOyAMB9But88TJvUAISPmhk53zygfxkQhq4Ei9q7plIR0TybcUrJ1fOGvISOdUPud0oC2dCv0jkTuvnSQ%2F9XTxWEwsZ5nzRnJpDTMbVyjBKCnFjo9VkDjYVLo%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 89f4fc3afc1571b4-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      POST
      https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php
      SearchIndexer.exe
      Remote address:
      172.67.207.158:443
      Request
      POST /2fca4d4264af2833.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----JEBGCBAFCGDAAKFIDGIE
      Host: 9507c272a51ce8cefc8761591b2c50e6.fit
      Content-Length: 949671
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sun, 07 Jul 2024 04:10:32 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      CF-Cache-Status: DYNAMIC
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iaDtYNJWD7ibE8A9HNINrLiDSevk2%2B3%2FW8JIbergKHtuiGutB0UYy7bH2nrja%2B1VI5GSeK9a4s7htAblOhvkyvbk41idiHOlYVnCgloCiFqzXSiofJw2eXKbyCUTfQbgsi3CaDJrbWXDsLgFQ2g81sg5iyt5PBM%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 89f4fc3ccca271b4-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      POST
      https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php
      SearchIndexer.exe
      Remote address:
      172.67.207.158:443
      Request
      POST /2fca4d4264af2833.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----EBFHJEGDAFHIJKECFBKJ
      Host: 9507c272a51ce8cefc8761591b2c50e6.fit
      Content-Length: 600511
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sun, 07 Jul 2024 04:10:32 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      CF-Cache-Status: DYNAMIC
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YJGxff7ap4Jn7KT7BWS3RKUYs%2BBUb4AxwcyRSAPtA%2BNQ0239tn5w7dY6RKrImwPwp9%2FEwrnuo4vqP51uxdD5sxJZku1%2Bc2Ly6mPbJtJMk0KjZa0CSN80%2Bgc5wmtShR0ajVAFZfjeqj46uV%2BW0lQC4MhmLDt%2F8PE%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 89f4fc3f2dbe71b4-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      POST
      https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php
      SearchIndexer.exe
      Remote address:
      172.67.207.158:443
      Request
      POST /2fca4d4264af2833.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----DBFBFBGDBKJJKFIEHJDB
      Host: 9507c272a51ce8cefc8761591b2c50e6.fit
      Content-Length: 26335
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sun, 07 Jul 2024 04:10:32 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      CF-Cache-Status: DYNAMIC
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AlnetldmYcXc8xuIFAgoG2IMXMJM43JxYZM3K%2BxBVrgsz%2BzPof9zCCwYWml464DP3GQUNTfNUnf4aiG0jexhlPO28mwLtkyNX6YSaaNNvGCwIEw2HseSx%2BDqy3bDT1iYA%2B8kHnDRPjCNyJWwjjdLF2TTOyQk6vg%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 89f4fc418e7971b4-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      POST
      https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php
      SearchIndexer.exe
      Remote address:
      172.67.207.158:443
      Request
      POST /2fca4d4264af2833.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----DHIEHIIEHIEHJKEBKEHJ
      Host: 9507c272a51ce8cefc8761591b2c50e6.fit
      Content-Length: 20155
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sun, 07 Jul 2024 04:10:32 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      CF-Cache-Status: DYNAMIC
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=i3qY4nIGu%2FAoX0eJCpYGI0CAHqVOfdir7oGNAmwsABkH%2FfI5QqjATLz%2F5rtPvvWA3DJM9xP5SXeU862a5hdJkcyWwRGGj0bLtipt%2FD9D2tYwVo%2BXPfJmSiD%2BhEhT%2FAFl0X2tnJ%2BE5uv69%2BwogbyyQQDhxftigfs%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 89f4fc424ebb71b4-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      POST
      https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php
      SearchIndexer.exe
      Remote address:
      172.67.207.158:443
      Request
      POST /2fca4d4264af2833.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----EBGDAAKJJDAAKFHJKJKF
      Host: 9507c272a51ce8cefc8761591b2c50e6.fit
      Content-Length: 363
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sun, 07 Jul 2024 04:10:34 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      CF-Cache-Status: DYNAMIC
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OVP%2FaSRjYjFL%2Bo21MLtcTu3NSzv0TIwrAxWnQPTOIsTEQUgMQooew3OXj%2FlWvRsRmBegYoZnU1vNlbQ28OljWs9k%2BfpwVjmvNdR%2FPnxpds%2FRuQKdUubN9Ixte5TsBhAKaBrsENFvGJdXW4I%2F6gvXPwb0oOETHfE%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 89f4fc4ddab771b4-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      POST
      https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php
      SearchIndexer.exe
      Remote address:
      172.67.207.158:443
      Request
      POST /2fca4d4264af2833.php HTTP/1.1
      Content-Type: multipart/form-data; boundary=----EHDHIDAEHCFHJJJJECAA
      Host: 9507c272a51ce8cefc8761591b2c50e6.fit
      Content-Length: 292
      Connection: Keep-Alive
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sun, 07 Jul 2024 04:10:34 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Vary: Accept-Encoding
      CF-Cache-Status: DYNAMIC
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T8%2F58oqKQB3FEbdDld%2BK6cxmWT90TYeG4kT4%2F%2FM9%2BfPzpLYyUABMKzx%2Fy%2FEdSqOKmcVA8XrW1PTP8%2BlYFvvsKaBH%2Fk20MqaH1Ap84sOQnBjDd2whMv7QoLfNUD0L6AwkkL0qXyQa1vowpe7dw8%2FMGH%2BoUYRKX5k%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 89f4fc4e3ae971b4-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      DNS
      c.pki.goog
      SearchIndexer.exe
      Remote address:
      8.8.8.8:53
      Request
      c.pki.goog
      IN A
      Response
      c.pki.goog
      IN CNAME
      pki-goog.l.google.com
      pki-goog.l.google.com
      IN A
      216.58.201.99
    • flag-gb
      GET
      http://c.pki.goog/r/gsr1.crl
      SearchIndexer.exe
      Remote address:
      216.58.201.99:80
      Request
      GET /r/gsr1.crl HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      User-Agent: Microsoft-CryptoAPI/10.0
      Host: c.pki.goog
      Response
      HTTP/1.1 200 OK
      Accept-Ranges: bytes
      Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
      Cross-Origin-Resource-Policy: cross-origin
      Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
      Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
      Content-Length: 1739
      X-Content-Type-Options: nosniff
      Server: sffe
      X-XSS-Protection: 0
      Date: Sun, 07 Jul 2024 03:36:07 GMT
      Expires: Sun, 07 Jul 2024 04:26:07 GMT
      Cache-Control: public, max-age=3000
      Age: 2062
      Last-Modified: Mon, 08 Apr 2024 07:48:00 GMT
      Content-Type: application/pkix-crl
      Vary: Accept-Encoding
    • flag-gb
      GET
      http://c.pki.goog/r/r4.crl
      SearchIndexer.exe
      Remote address:
      216.58.201.99:80
      Request
      GET /r/r4.crl HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      User-Agent: Microsoft-CryptoAPI/10.0
      Host: c.pki.goog
      Response
      HTTP/1.1 200 OK
      Accept-Ranges: bytes
      Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
      Cross-Origin-Resource-Policy: cross-origin
      Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
      Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
      Content-Length: 436
      X-Content-Type-Options: nosniff
      Server: sffe
      X-XSS-Protection: 0
      Date: Sun, 07 Jul 2024 03:36:10 GMT
      Expires: Sun, 07 Jul 2024 04:26:10 GMT
      Cache-Control: public, max-age=3000
      Age: 2059
      Last-Modified: Wed, 01 Nov 2023 07:48:00 GMT
      Content-Type: application/pkix-crl
      Vary: Accept-Encoding
    • flag-us
      DNS
      158.207.67.172.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      158.207.67.172.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      99.201.58.216.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      99.201.58.216.in-addr.arpa
      IN PTR
      Response
      99.201.58.216.in-addr.arpa
      IN PTR
      prg03s02-in-f991e100net
      99.201.58.216.in-addr.arpa
      IN PTR
      prg03s02-in-f3�H
      99.201.58.216.in-addr.arpa
      IN PTR
      lhr48s48-in-f3�H
    • flag-us
      DNS
      webtime.site
      SearchIndexer.exe
      Remote address:
      8.8.8.8:53
      Request
      webtime.site
      IN A
      Response
      webtime.site
      IN A
      172.67.222.142
      webtime.site
      IN A
      104.21.43.75
    • flag-us
      GET
      https://webtime.site/webdav/mfiles/cp/main.exe
      SearchIndexer.exe
      Remote address:
      172.67.222.142:443
      Request
      GET /webdav/mfiles/cp/main.exe HTTP/1.1
      Host: webtime.site
      Cache-Control: no-cache
      Response
      HTTP/1.1 200 OK
      Date: Sun, 07 Jul 2024 04:10:34 GMT
      Content-Type: application/octet-stream
      Content-Length: 4416400
      Connection: keep-alive
      Last-Modified: Sat, 06 Jul 2024 15:23:02 GMT
      ETag: "66896156-436390"
      Accept-Ranges: bytes
      CF-Cache-Status: DYNAMIC
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=py9L8d8uBP0YN8fbaRFv2A2BaK7IloQ7LiZk8Mi3sLy2ot9szDl9J0h3Rr07Kg0cmqtPZEtxdWhD6HaW%2BnG9i%2BzSEwCScrSfFyreEnOxaqFeYupCSRq23pdVOsQlLGU%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 89f4fc4f7b2b94c1-LHR
      alt-svc: h3=":443"; ma=86400
    • flag-us
      DNS
      142.222.67.172.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      142.222.67.172.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      0.205.248.87.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      0.205.248.87.in-addr.arpa
      IN PTR
      Response
      0.205.248.87.in-addr.arpa
      IN PTR
      https-87-248-205-0lgwllnwnet
    • 13.107.21.237:443
      g.bing.com
      tls
      2.0kB
       9.3kB
       22
      18
    • 172.67.207.158:443
      https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php
      tls, http
      SearchIndexer.exe
      2.0MB
       5.5MB
       5317
      4509

      HTTP Request

      POST https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php

      HTTP Response

      200

      HTTP Request

      POST https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php

      HTTP Response

      200

      HTTP Request

      POST https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php

      HTTP Response

      200

      HTTP Request

      POST https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php

      HTTP Response

      200

      HTTP Request

      POST https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php

      HTTP Response

      200

      HTTP Request

      GET https://9507c272a51ce8cefc8761591b2c50e6.fit/8960e31f09662674/sqlite3.dll

      HTTP Response

      200

      HTTP Request

      POST https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php

      HTTP Response

      200

      HTTP Request

      POST https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php

      HTTP Response

      200

      HTTP Request

      GET https://9507c272a51ce8cefc8761591b2c50e6.fit/8960e31f09662674/freebl3.dll

      HTTP Response

      200

      HTTP Request

      GET https://9507c272a51ce8cefc8761591b2c50e6.fit/8960e31f09662674/mozglue.dll

      HTTP Response

      200

      HTTP Request

      GET https://9507c272a51ce8cefc8761591b2c50e6.fit/8960e31f09662674/msvcp140.dll

      HTTP Response

      200

      HTTP Request

      GET https://9507c272a51ce8cefc8761591b2c50e6.fit/8960e31f09662674/nss3.dll

      HTTP Response

      200

      HTTP Request

      GET https://9507c272a51ce8cefc8761591b2c50e6.fit/8960e31f09662674/softokn3.dll

      HTTP Response

      200

      HTTP Request

      GET https://9507c272a51ce8cefc8761591b2c50e6.fit/8960e31f09662674/vcruntime140.dll

      HTTP Response

      200

      HTTP Request

      POST https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php

      HTTP Response

      200

      HTTP Request

      POST https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php

      HTTP Response

      200

      HTTP Request

      POST https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php

      HTTP Response

      200

      HTTP Request

      POST https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php

      HTTP Response

      200

      HTTP Request

      POST https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php

      HTTP Response

      200

      HTTP Request

      POST https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php

      HTTP Response

      200

      HTTP Request

      POST https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php

      HTTP Response

      200

      HTTP Request

      POST https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php

      HTTP Response

      200

      HTTP Request

      POST https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php

      HTTP Response

      200

      HTTP Request

      POST https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php

      HTTP Response

      200

      HTTP Request

      POST https://9507c272a51ce8cefc8761591b2c50e6.fit/2fca4d4264af2833.php

      HTTP Response

      200
    • 216.58.201.99:80
      http://c.pki.goog/r/r4.crl
      http
      SearchIndexer.exe
      556 B
       3.8kB
       7
      5

      HTTP Request

      GET http://c.pki.goog/r/gsr1.crl

      HTTP Response

      200

      HTTP Request

      GET http://c.pki.goog/r/r4.crl

      HTTP Response

      200
    • 172.67.222.142:443
      https://webtime.site/webdav/mfiles/cp/main.exe
      tls, http
      SearchIndexer.exe
      175.1kB
       4.6MB
       3299
      3290

      HTTP Request

      GET https://webtime.site/webdav/mfiles/cp/main.exe

      HTTP Response

      200
    • 8.8.8.8:53
      g.bing.com
      dns
      56 B
       151 B
       1
      1

      DNS Request

      g.bing.com

      DNS Response

      13.107.21.237
      204.79.197.237

    • 8.8.8.8:53
      4.159.190.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      4.159.190.20.in-addr.arpa

    • 8.8.8.8:53
      237.21.107.13.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      237.21.107.13.in-addr.arpa

    • 8.8.8.8:53
      26.165.165.52.in-addr.arpa
      dns
      72 B
       146 B
       1
      1

      DNS Request

      26.165.165.52.in-addr.arpa

    • 8.8.8.8:53
      206.23.85.13.in-addr.arpa
      dns
      71 B
       145 B
       1
      1

      DNS Request

      206.23.85.13.in-addr.arpa

    • 8.8.8.8:53
      240.221.184.93.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      240.221.184.93.in-addr.arpa

    • 8.8.8.8:53
      9507c272a51ce8cefc8761591b2c50e6.fit
      dns
      SearchIndexer.exe
      82 B
       114 B
       1
      1

      DNS Request

      9507c272a51ce8cefc8761591b2c50e6.fit

      DNS Response

      172.67.207.158
      104.21.93.84

    • 8.8.8.8:53
      c.pki.goog
      dns
      SearchIndexer.exe
      56 B
       107 B
       1
      1

      DNS Request

      c.pki.goog

      DNS Response

      216.58.201.99

    • 8.8.8.8:53
      158.207.67.172.in-addr.arpa
      dns
      73 B
       135 B
       1
      1

      DNS Request

      158.207.67.172.in-addr.arpa

    • 8.8.8.8:53
      99.201.58.216.in-addr.arpa
      dns
      72 B
       169 B
       1
      1

      DNS Request

      99.201.58.216.in-addr.arpa

    • 8.8.8.8:53
      webtime.site
      dns
      SearchIndexer.exe
      58 B
       90 B
       1
      1

      DNS Request

      webtime.site

      DNS Response

      172.67.222.142
      104.21.43.75

    • 8.8.8.8:53
      142.222.67.172.in-addr.arpa
      dns
      73 B
       135 B
       1
      1

      DNS Request

      142.222.67.172.in-addr.arpa

    • 8.8.8.8:53
      0.205.248.87.in-addr.arpa
      dns
      71 B
       116 B
       1
      1

      DNS Request

      0.205.248.87.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\RepairImport.docx
      Filesize

      19KB

      MD5

      1da30b9c273aba8df63806618a4d01c1

      SHA1

      029841e0c1f8a92f04094dd18e7aa4a09199e230

      SHA256

      32d68b9ca53e77fea0306623a1165ea13ccfe14162463e93a2df0a7e8c979592

      SHA512

      336356c8984c29dbf678767dc7cd258a5805f0f97a68e176bb222b4a381a4bd69694724c943f5f1e0a61be40dc18312ab9ffc1dadb6f894837350f4613b61095

      Download Submit

    • C:\ProgramData\RestoreWrite.docx
      Filesize

      14KB

      MD5

      72407d691c2cff98fd3a9bd711c7d710

      SHA1

      c14f08ee716ac517fa67b7cf68c709f4175d2736

      SHA256

      49d6a5017376d2a6e0c3c30894b9c796fff2399fd92ad2173481df501b01cf0b

      SHA512

      ba35f0cddee91c5ec657036b7b5d76c6441774b4bdf12d4f4ca9984806a02dfdf8f911f4d55bbe96e2f4aafb7e794f494462da697872da4e94c48c8a8892f849

      Download Submit

    • C:\ProgramData\mozglue.dll
      Filesize

      593KB

      MD5

      c8fd9be83bc728cc04beffafc2907fe9

      SHA1

      95ab9f701e0024cedfbd312bcfe4e726744c4f2e

      SHA256

      ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

      SHA512

      fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

      Download Submit

    • C:\ProgramData\nss3.dll
      Filesize

      2.0MB

      MD5

      1cc453cdf74f31e4d913ff9c10acdde2

      SHA1

      6e85eae544d6e965f15fa5c39700fa7202f3aafe

      SHA256

      ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

      SHA512

      dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\3ca04955
      Filesize

      1.1MB

      MD5

      82e99a942be9e87d87605f37c5d844d2

      SHA1

      b3b99274d676558c3c4f5b6b45e3f871a908b07e

      SHA256

      3386e4e5d2af739636f374f2f2a18d07f5a3c33eab9eacd664b6ae5a8096e468

      SHA512

      9eeab9a65bae7145868b2d28be8538f7eba57b4167add8c4568a855d9c26d09667ea1436a74d300f146cbd4cd096539e29c98be121da4a4f72907561b2b32e29

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\3fb09280
      Filesize

      1.1MB

      MD5

      7106f93155d69418352d372abf1433b5

      SHA1

      972163cb3a6ee6026ea67f8af8de3beaee16d2dc

      SHA256

      a52c3817f26e988f5ecb73955b18acb7692e7dd328ad6e4e37271839a50c1a8f

      SHA512

      a0c34732d9644ebcd4d9e334031d78775b3b7b617c7fa7134a43a70fd1a4db6e56d68bf95baa9803bff74bb8a6ebbd1c02188a929b138a562f95cfe63570d709

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\43ed0324
      Filesize

      876KB

      MD5

      97a3924f38b6fe507dbcce5621dddd82

      SHA1

      ae07c5939a1135b359f9816651b0372f5d774df4

      SHA256

      366b99bf15bff92a31b7c2fdd8d2f27bab9c08eb1cd6f7c2dd6923b63912179c

      SHA512

      3c3e479fca7f16b984e72c4ad97fe6f541c386048f07bb88b43dda06e037eb98b7376a7fd3682d3522f396e27e6135488f2156f669448128edc2f8ec9075d270

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\45e14d42
      Filesize

      869KB

      MD5

      207c07acbc7d9db91cbb46eecaae3b9d

      SHA1

      d3d988d6055a76056e30dbaf64ca6cae746ec057

      SHA256

      7f9f1e332e28a51208c83e873c53fd7552568a68a7c9e6aa11b281fff4df85aa

      SHA512

      8af60b63c9bc8f72185de045dbd92c9075278d36e2e48a6ea700672bd30170f9296edfd59dcffac7d894642094a067e6365aa61279b387ab4632ecfa1eed1784

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\HJKECAAAFH.exe
      Filesize

      4.2MB

      MD5

      01b77cf729fa55834d4ea8be3602255f

      SHA1

      2371f13477843b45b3f12d058432b283ce264733

      SHA256

      76bb3021ce006df3ecf9740b1eb164bd1036472ae68fe262767d0025b94ecede

      SHA512

      5d85ef4e23d1de2e4b3a2a622e7062bc0356b1c7a89be8979d239fc3d04814434d992cac5788299a5e3b25ae9e0d41ca5662d9897d39524da75782d3380962d7

      Download Submit

    • memory/2400-136-0x00007FFE2A770000-0x00007FFE2A965000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2400-129-0x0000000000850000-0x0000000000C8C000-memory.dmp

      Filesize

      4.2MB

      Download

    • memory/2644-141-0x00007FFE2A770000-0x00007FFE2A965000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2644-142-0x0000000073FC0000-0x0000000073FD4000-memory.dmp

      Filesize

      80KB

      Download

    • memory/2644-148-0x0000000073FC0000-0x0000000073FD4000-memory.dmp

      Filesize

      80KB

      Download

    • memory/2644-149-0x0000000073FC0000-0x0000000073FD4000-memory.dmp

      Filesize

      80KB

      Download

    • memory/2644-155-0x0000000073FC0000-0x0000000073FD4000-memory.dmp

      Filesize

      80KB

      Download

    • memory/2936-32-0x0000000061E00000-0x0000000061EF3000-memory.dmp

      Filesize

      972KB

      Download

    • memory/2936-125-0x0000000000340000-0x000000000057D000-memory.dmp

      Filesize

      2.2MB

      Download

    • memory/2936-25-0x0000000000090000-0x0000000000144000-memory.dmp

      Filesize

      720KB

      Download

    • memory/2936-24-0x00000000000CB000-0x00000000000D2000-memory.dmp

      Filesize

      28KB

      Download

    • memory/2936-22-0x0000000000340000-0x000000000057D000-memory.dmp

      Filesize

      2.2MB

      Download

    • memory/2936-103-0x0000000000340000-0x000000000057D000-memory.dmp

      Filesize

      2.2MB

      Download

    • memory/2936-21-0x00007FFE2A770000-0x00007FFE2A965000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2936-20-0x0000000000340000-0x000000000057D000-memory.dmp

      Filesize

      2.2MB

      Download

    • memory/3608-8-0x0000000073FD2000-0x0000000073FD4000-memory.dmp

      Filesize

      8KB

      Download

    • memory/3608-6-0x0000000073FC0000-0x0000000073FD4000-memory.dmp

      Filesize

      80KB

      Download

    • memory/3608-7-0x00007FFE2A770000-0x00007FFE2A965000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/3608-0-0x00000000006E0000-0x0000000001359000-memory.dmp

      Filesize

      12.5MB

      Download

    • memory/3608-9-0x0000000073FC0000-0x0000000073FD4000-memory.dmp

      Filesize

      80KB

      Download

    • memory/3608-10-0x0000000073FC0000-0x0000000073FD4000-memory.dmp

      Filesize

      80KB

      Download

    • memory/4744-13-0x0000000073FC0000-0x0000000073FD4000-memory.dmp

      Filesize

      80KB

      Download

    • memory/4744-15-0x00007FFE2A770000-0x00007FFE2A965000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/4744-16-0x0000000073FC0000-0x0000000073FD4000-memory.dmp

      Filesize

      80KB

      Download

    • memory/4744-17-0x0000000073FC0000-0x0000000073FD4000-memory.dmp

      Filesize

      80KB

      Download

    • memory/4744-19-0x0000000073FC0000-0x0000000073FD4000-memory.dmp

      Filesize

      80KB

      Download

    • memory/4996-153-0x0000000000D20000-0x0000000000D88000-memory.dmp

      Filesize

      416KB

      Download

    • memory/4996-156-0x00007FFE2A770000-0x00007FFE2A965000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/4996-157-0x0000000000D20000-0x0000000000D88000-memory.dmp

      Filesize

      416KB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.