Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

CrosshairX.exe

windows7-x64

3

CrosshairX.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    93s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/01/2025, 17:57 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    CrosshairX.exe

  • Size

    150.4MB

  • MD5

    c68c83300786177c8cdf38dc8b276937

  • SHA1

    500d471de0d74c2317033f39866692649dff47fb

  • SHA256

    e31ccd1df6c97cfce993def645f813d55405d3e5d858f0b2682a48ff2200888d

  • SHA512

    45c94294198d9666addcfd532895db7db38f9a672ed4a1f7ea4cd6a0bd344e8df9b03e52eabd56572b217a064b695b314407dc136196eeef01172320f4220e27

  • SSDEEP

    6144:pTPOsgo5qJgKjOfDDBrwHJAtlsGMpZh7exUG0Gv0JYlCaLkmJ3/n2b:pPOi8go6BrwSMpZg+GBv0JYlCahJ34

Score
10/10
lummadiscoverystealer

Malware Config

Extracted

Family

lumma

C2

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

Extracted

Family

lumma

C2

https://abruptyopsn.shop/api

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

https://cloudewahsj.shop/api

Signatures

  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CrosshairX.exe
    "C:\Users\Admin\AppData\Local\Temp\CrosshairX.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4688
    • C:\Users\Admin\AppData\Local\Temp\CrosshairX.exe
      "C:\Users\Admin\AppData\Local\Temp\CrosshairX.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:5024
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 820
      2⤵
      • Program crash
      PID:3384
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4688 -ip 4688
    1⤵
      PID:2872

    Network

    • flag-us
      DNS
      8.8.8.8.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      8.8.8.8.in-addr.arpa
      IN PTR
      Response
      8.8.8.8.in-addr.arpa
      IN PTR
      dnsgoogle
    • flag-us
      DNS
      149.220.183.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      149.220.183.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.210.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.210.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      17.160.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      17.160.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      undesirabkel.click
      CrosshairX.exe
      Remote address:
      8.8.8.8:53
      Request
      undesirabkel.click
      IN A
      Response
      undesirabkel.click
      IN A
      172.67.150.49
      undesirabkel.click
      IN A
      104.21.30.13
    • flag-us
      POST
      https://undesirabkel.click/api
      CrosshairX.exe
      Remote address:
      172.67.150.49:443
      Request
      POST /api HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/x-www-form-urlencoded
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
      Content-Length: 8
      Host: undesirabkel.click
      Response
      HTTP/1.1 200 OK
      Date: Sun, 05 Jan 2025 18:01:40 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Set-Cookie: PHPSESSID=4tg98kkku84ilnv3rauopn7161; expires=Thu, 01 May 2025 11:48:18 GMT; Max-Age=9999999; path=/
      Expires: Thu, 19 Nov 1981 08:52:00 GMT
      Cache-Control: no-store, no-cache, must-revalidate
      Pragma: no-cache
      X-Frame-Options: DENY
      X-Content-Type-Options: nosniff
      X-XSS-Protection: 1; mode=block
      cf-cache-status: DYNAMIC
      vary: accept-encoding
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dnVc8PCBbMB%2BOQewk5C5xbFoUU%2FohXM2Q9uAfh%2Bdd8NMGDa%2BdafqcHYe3gCDkxp00Rr1Z1XAG8wki3HqduA%2FR2ddJBFdh6Gc9JAC6s59Fxd5lT4AGWgvaycnvMaQmYcFDswJV2M%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8fd55fcb5eec652d-LHR
      alt-svc: h3=":443"; ma=86400
      server-timing: cfL4;desc="?proto=TCP&rtt=30031&min_rtt=27065&rtt_var=10355&sent=6&recv=7&lost=0&retrans=0&sent_bytes=3302&recv_bytes=609&delivery_rate=130030&cwnd=253&unsent_bytes=0&cid=338e3fc65edff0a7&ts=7414&x=0"
    • flag-us
      DNS
      49.150.67.172.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      49.150.67.172.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      nearycrepso.shop
      CrosshairX.exe
      Remote address:
      8.8.8.8:53
      Request
      nearycrepso.shop
      IN A
      Response
    • flag-us
      DNS
      abruptyopsn.shop
      CrosshairX.exe
      Remote address:
      8.8.8.8:53
      Request
      abruptyopsn.shop
      IN A
      Response
      abruptyopsn.shop
      IN A
      104.21.64.1
      abruptyopsn.shop
      IN A
      104.21.80.1
      abruptyopsn.shop
      IN A
      104.21.96.1
      abruptyopsn.shop
      IN A
      104.21.48.1
      abruptyopsn.shop
      IN A
      104.21.112.1
      abruptyopsn.shop
      IN A
      104.21.16.1
      abruptyopsn.shop
      IN A
      104.21.32.1
    • flag-us
      POST
      https://abruptyopsn.shop/api
      CrosshairX.exe
      Remote address:
      104.21.64.1:443
      Request
      POST /api HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/x-www-form-urlencoded
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
      Content-Length: 8
      Host: abruptyopsn.shop
      Response
      HTTP/1.1 200 OK
      Date: Sun, 05 Jan 2025 18:01:40 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Set-Cookie: PHPSESSID=48e3s02oi78fudr8993epql3bo; expires=Thu, 01 May 2025 11:48:19 GMT; Max-Age=9999999; path=/
      Expires: Thu, 19 Nov 1981 08:52:00 GMT
      Cache-Control: no-store, no-cache, must-revalidate
      Pragma: no-cache
      X-Frame-Options: DENY
      X-Content-Type-Options: nosniff
      X-XSS-Protection: 1; mode=block
      cf-cache-status: DYNAMIC
      vary: accept-encoding
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OMCaYfIUnxgJegGD2qJ%2BqWOzbDLWIj3mrGCiyjdtNlytcEDUse97n6d%2FnKWL4XqPcxsLLTQZjLlOp8i%2FMpMa3pdJKHDl3p%2B0uKHsxQG4rEM1ACKyyWlvrKFWdns4hZ1IskWm"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8fd55ffa7ec07711-LHR
      alt-svc: h3=":443"; ma=86400
      server-timing: cfL4;desc="?proto=TCP&rtt=30992&min_rtt=28224&rtt_var=10214&sent=6&recv=7&lost=0&retrans=0&sent_bytes=3510&recv_bytes=605&delivery_rate=92084&cwnd=239&unsent_bytes=0&cid=21caf8c677a31042&ts=260&x=0"
    • flag-us
      DNS
      wholersorie.shop
      CrosshairX.exe
      Remote address:
      8.8.8.8:53
      Request
      wholersorie.shop
      IN A
      Response
      wholersorie.shop
      IN A
      172.67.160.114
      wholersorie.shop
      IN A
      104.21.41.51
    • flag-us
      POST
      https://wholersorie.shop/api
      CrosshairX.exe
      Remote address:
      172.67.160.114:443
      Request
      POST /api HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/x-www-form-urlencoded
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
      Content-Length: 8
      Host: wholersorie.shop
      Response
      HTTP/1.1 200 OK
      Date: Sun, 05 Jan 2025 18:01:40 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Set-Cookie: PHPSESSID=f52a36ke39aae753net0opg8pd; expires=Thu, 01 May 2025 11:48:19 GMT; Max-Age=9999999; path=/
      Expires: Thu, 19 Nov 1981 08:52:00 GMT
      Cache-Control: no-store, no-cache, must-revalidate
      Pragma: no-cache
      X-Frame-Options: DENY
      X-Content-Type-Options: nosniff
      X-XSS-Protection: 1; mode=block
      cf-cache-status: DYNAMIC
      vary: accept-encoding
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xC2qm23ILl2Dr85f5DtubETmQW7NoPRQvHIRNyoc487vypL0Cqzy2ep4im%2BDmWHRwssyuYokl2LpuiRn9NnRhurazasvn7CTKyUAfGK08t%2F7UqzO8pyOMlRLr2loD8W2Ng%2FK"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8fd55ffcd8cbef3a-LHR
      alt-svc: h3=":443"; ma=86400
      server-timing: cfL4;desc="?proto=TCP&rtt=42941&min_rtt=38812&rtt_var=10373&sent=6&recv=7&lost=0&retrans=0&sent_bytes=3300&recv_bytes=605&delivery_rate=91212&cwnd=253&unsent_bytes=0&cid=3f173b645245ade5&ts=298&x=0"
    • flag-us
      DNS
      framekgirus.shop
      CrosshairX.exe
      Remote address:
      8.8.8.8:53
      Request
      framekgirus.shop
      IN A
      Response
      framekgirus.shop
      IN A
      104.21.18.19
      framekgirus.shop
      IN A
      172.67.179.160
    • flag-us
      POST
      https://framekgirus.shop/api
      CrosshairX.exe
      Remote address:
      104.21.18.19:443
      Request
      POST /api HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/x-www-form-urlencoded
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
      Content-Length: 8
      Host: framekgirus.shop
      Response
      HTTP/1.1 200 OK
      Date: Sun, 05 Jan 2025 18:01:41 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Set-Cookie: PHPSESSID=1fv52pem51ccpri5522g3t6nk9; expires=Thu, 01 May 2025 11:48:20 GMT; Max-Age=9999999; path=/
      Expires: Thu, 19 Nov 1981 08:52:00 GMT
      Cache-Control: no-store, no-cache, must-revalidate
      Pragma: no-cache
      X-Frame-Options: DENY
      X-Content-Type-Options: nosniff
      X-XSS-Protection: 1; mode=block
      cf-cache-status: DYNAMIC
      vary: accept-encoding
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qf66KY2Z7lxhHUDM66XQVWfI7jfjhO2Hjr0059TlgZSoT6izlJ91NbgHhRFb%2FvdWdkBjpBuYhqrZ7rdxb4SE7ay00ftqDTPN%2BgoPVp2dvS5%2Ft7WlMLbLKLqMlYLyPLhq%2Bg48"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8fd55fff29e16409-LHR
      alt-svc: h3=":443"; ma=86400
      server-timing: cfL4;desc="?proto=TCP&rtt=27739&min_rtt=26710&rtt_var=7402&sent=6&recv=7&lost=0&retrans=0&sent_bytes=3295&recv_bytes=605&delivery_rate=132774&cwnd=253&unsent_bytes=0&cid=769ecf0556e080c1&ts=264&x=0"
    • flag-us
      DNS
      1.64.21.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      1.64.21.104.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      114.160.67.172.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      114.160.67.172.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      tirepublicerj.shop
      CrosshairX.exe
      Remote address:
      8.8.8.8:53
      Request
      tirepublicerj.shop
      IN A
      Response
      tirepublicerj.shop
      IN A
      104.21.96.1
      tirepublicerj.shop
      IN A
      104.21.48.1
      tirepublicerj.shop
      IN A
      104.21.16.1
      tirepublicerj.shop
      IN A
      104.21.64.1
      tirepublicerj.shop
      IN A
      104.21.112.1
      tirepublicerj.shop
      IN A
      104.21.80.1
      tirepublicerj.shop
      IN A
      104.21.32.1
    • flag-us
      POST
      https://tirepublicerj.shop/api
      CrosshairX.exe
      Remote address:
      104.21.96.1:443
      Request
      POST /api HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/x-www-form-urlencoded
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
      Content-Length: 8
      Host: tirepublicerj.shop
      Response
      HTTP/1.1 200 OK
      Date: Sun, 05 Jan 2025 18:01:41 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Set-Cookie: PHPSESSID=4r6v2bd6gdmap57aaj3m6v8nl2; expires=Thu, 01 May 2025 11:48:20 GMT; Max-Age=9999999; path=/
      Expires: Thu, 19 Nov 1981 08:52:00 GMT
      Cache-Control: no-store, no-cache, must-revalidate
      Pragma: no-cache
      X-Frame-Options: DENY
      X-Content-Type-Options: nosniff
      X-XSS-Protection: 1; mode=block
      cf-cache-status: DYNAMIC
      vary: accept-encoding
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AlP%2Bj3cyQ4e1L8%2FOt9Cm9RGQT2O4dEtnlm4Ui0Xz1kR%2BsVSooWUwt%2B9JX9jLCEmcyeloWI%2FB4KN1MOmui5d7AMnKvd5oEtuVjz3YeFMGBnsAaKCDPhtRsficqA5lqHMiYBPDjRM%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8fd560016b06becd-LHR
      alt-svc: h3=":443"; ma=86400
      server-timing: cfL4;desc="?proto=TCP&rtt=28946&min_rtt=27202&rtt_var=7702&sent=6&recv=7&lost=0&retrans=0&sent_bytes=3301&recv_bytes=609&delivery_rate=132325&cwnd=253&unsent_bytes=0&cid=28bd33ce70067db8&ts=232&x=0"
    • flag-us
      DNS
      noisycuttej.shop
      CrosshairX.exe
      Remote address:
      8.8.8.8:53
      Request
      noisycuttej.shop
      IN A
      Response
      noisycuttej.shop
      IN A
      172.67.170.178
      noisycuttej.shop
      IN A
      104.21.71.146
    • flag-us
      POST
      https://noisycuttej.shop/api
      CrosshairX.exe
      Remote address:
      172.67.170.178:443
      Request
      POST /api HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/x-www-form-urlencoded
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
      Content-Length: 8
      Host: noisycuttej.shop
      Response
      HTTP/1.1 200 OK
      Date: Sun, 05 Jan 2025 18:01:41 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Set-Cookie: PHPSESSID=3jm7sbhnrldnj0mib49vfc2ssq; expires=Thu, 01 May 2025 11:48:20 GMT; Max-Age=9999999; path=/
      Expires: Thu, 19 Nov 1981 08:52:00 GMT
      Cache-Control: no-store, no-cache, must-revalidate
      Pragma: no-cache
      X-Frame-Options: DENY
      X-Content-Type-Options: nosniff
      X-XSS-Protection: 1; mode=block
      cf-cache-status: DYNAMIC
      vary: accept-encoding
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ip2YoNY0gINsxqHB0JvkiLjELFofHM4XOzuKwbbeLs0hNvvjjA4T66qUz0wvZlODkwVROgJI8FpKpY%2Fj97CuUt%2BKTVwjjcgqRevjc379svC9yP92jZ6PdsKMAt9FzY%2BIJU4v"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8fd560036fc84970-LHR
      alt-svc: h3=":443"; ma=86400
      server-timing: cfL4;desc="?proto=TCP&rtt=29230&min_rtt=28181&rtt_var=7705&sent=6&recv=7&lost=0&retrans=0&sent_bytes=3299&recv_bytes=605&delivery_rate=125369&cwnd=253&unsent_bytes=0&cid=b595e53e74527b91&ts=257&x=0"
    • flag-us
      DNS
      rabidcowse.shop
      CrosshairX.exe
      Remote address:
      8.8.8.8:53
      Request
      rabidcowse.shop
      IN A
      Response
      rabidcowse.shop
      IN A
      104.21.7.224
      rabidcowse.shop
      IN A
      172.67.156.127
    • flag-us
      POST
      https://rabidcowse.shop/api
      CrosshairX.exe
      Remote address:
      104.21.7.224:443
      Request
      POST /api HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/x-www-form-urlencoded
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
      Content-Length: 8
      Host: rabidcowse.shop
      Response
      HTTP/1.1 200 OK
      Date: Sun, 05 Jan 2025 18:01:42 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Set-Cookie: PHPSESSID=vp0eralarnkhqmdjf90rqtat1r; expires=Thu, 01 May 2025 11:48:21 GMT; Max-Age=9999999; path=/
      Expires: Thu, 19 Nov 1981 08:52:00 GMT
      Cache-Control: no-store, no-cache, must-revalidate
      Pragma: no-cache
      X-Frame-Options: DENY
      X-Content-Type-Options: nosniff
      X-XSS-Protection: 1; mode=block
      cf-cache-status: DYNAMIC
      vary: accept-encoding
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=eXgUjSwGCQE5TUVWCLTF148m8YqjEU8zB67ucwPrqrQsHZ7AzqoTMdzPKhW4hgldYqQuZPfF6qmxk9%2Bw9eUtbQMAktKIJpiZZzEMr8kJMPt8URa9XnWdZojHNVkkxcftLhM%3D"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8fd56005a8813853-LHR
      alt-svc: h3=":443"; ma=86400
      server-timing: cfL4;desc="?proto=TCP&rtt=30861&min_rtt=28368&rtt_var=10025&sent=6&recv=7&lost=0&retrans=0&sent_bytes=3293&recv_bytes=603&delivery_rate=111865&cwnd=252&unsent_bytes=0&cid=2ffa4d2176e344f7&ts=268&x=0"
    • flag-us
      DNS
      19.18.21.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      19.18.21.104.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      1.96.21.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      1.96.21.104.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      cloudewahsj.shop
      CrosshairX.exe
      Remote address:
      8.8.8.8:53
      Request
      cloudewahsj.shop
      IN A
      Response
      cloudewahsj.shop
      IN A
      104.21.96.1
      cloudewahsj.shop
      IN A
      104.21.64.1
      cloudewahsj.shop
      IN A
      104.21.32.1
      cloudewahsj.shop
      IN A
      104.21.48.1
      cloudewahsj.shop
      IN A
      104.21.16.1
      cloudewahsj.shop
      IN A
      104.21.80.1
      cloudewahsj.shop
      IN A
      104.21.112.1
    • flag-us
      POST
      https://cloudewahsj.shop/api
      CrosshairX.exe
      Remote address:
      104.21.96.1:443
      Request
      POST /api HTTP/1.1
      Connection: Keep-Alive
      Content-Type: application/x-www-form-urlencoded
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
      Content-Length: 8
      Host: cloudewahsj.shop
      Response
      HTTP/1.1 200 OK
      Date: Sun, 05 Jan 2025 18:01:42 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: keep-alive
      Set-Cookie: PHPSESSID=etmclvs4v04hu64lbgsgcr4t3e; expires=Thu, 01 May 2025 11:48:21 GMT; Max-Age=9999999; path=/
      Expires: Thu, 19 Nov 1981 08:52:00 GMT
      Cache-Control: no-store, no-cache, must-revalidate
      Pragma: no-cache
      X-Frame-Options: DENY
      X-Content-Type-Options: nosniff
      X-XSS-Protection: 1; mode=block
      cf-cache-status: DYNAMIC
      vary: accept-encoding
      Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iJvDgFrDXMIPAT3peL6TsLCjzMK01%2FQGAdtar%2FoKW3c5gfbjPjS8%2B9m3m4dT6OkwMwwmBmA1BRvgh1GzIfadtegdOWFMwji%2Bt7xOFE8Z6rkNDtJYaM4nqTDhVbGRr0gd2LiB"}],"group":"cf-nel","max_age":604800}
      NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
      Server: cloudflare
      CF-RAY: 8fd56007dc219472-LHR
      alt-svc: h3=":443"; ma=86400
      server-timing: cfL4;desc="?proto=TCP&rtt=28278&min_rtt=27087&rtt_var=7511&sent=6&recv=7&lost=0&retrans=0&sent_bytes=3293&recv_bytes=605&delivery_rate=135528&cwnd=251&unsent_bytes=0&cid=82fe5a013922016f&ts=274&x=0"
    • flag-us
      DNS
      steamcommunity.com
      CrosshairX.exe
      Remote address:
      8.8.8.8:53
      Request
      steamcommunity.com
      IN A
      Response
      steamcommunity.com
      IN A
      2.18.131.137
    • flag-fr
      GET
      https://steamcommunity.com/profiles/76561199724331900
      CrosshairX.exe
      Remote address:
      2.18.131.137:443
      Request
      GET /profiles/76561199724331900 HTTP/1.1
      Connection: Keep-Alive
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
      Host: steamcommunity.com
      Response
      HTTP/1.1 200 OK
      Server: nginx
      Content-Type: text/html; charset=UTF-8
      Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.cloudflare.steamstatic.com/ https://cdn.cloudflare.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.cloudflare.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/;
      Expires: Mon, 26 Jul 1997 05:00:00 GMT
      Cache-Control: no-cache
      Date: Sun, 05 Jan 2025 18:01:43 GMT
      Content-Length: 25984
      Connection: keep-alive
      Set-Cookie: sessionid=963c3993ff9f55676883a9ef; Path=/; Secure; SameSite=None
      Set-Cookie: steamCountry=GB%7C7d625a3b038bb98f68b4e14dac147806; Path=/; Secure; HttpOnly; SameSite=None
    • flag-us
      DNS
      178.170.67.172.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      178.170.67.172.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      224.7.21.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      224.7.21.104.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      137.131.18.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      137.131.18.2.in-addr.arpa
      IN PTR
      Response
      137.131.18.2.in-addr.arpa
      IN PTR
      a2-18-131-137deploystaticakamaitechnologiescom
    • flag-us
      DNS
      13.86.106.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      13.86.106.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      197.87.175.4.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      197.87.175.4.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      206.23.85.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      206.23.85.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      167.190.18.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      167.190.18.2.in-addr.arpa
      IN PTR
      Response
      167.190.18.2.in-addr.arpa
      IN PTR
      a2-18-190-167deploystaticakamaitechnologiescom
    • flag-us
      DNS
      180.129.81.91.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      180.129.81.91.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.214.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.214.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      48.229.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      48.229.111.52.in-addr.arpa
      IN PTR
      Response
    • 172.67.150.49:443
      https://undesirabkel.click/api
      tls, http
      CrosshairX.exe
      1.0kB
       4.9kB
       9
      9

      HTTP Request

      POST https://undesirabkel.click/api

      HTTP Response

      200
    • 104.21.64.1:443
      https://abruptyopsn.shop/api
      tls, http
      CrosshairX.exe
      1.0kB
       5.1kB
       9
      9

      HTTP Request

      POST https://abruptyopsn.shop/api

      HTTP Response

      200
    • 172.67.160.114:443
      https://wholersorie.shop/api
      tls, http
      CrosshairX.exe
      1.0kB
       4.9kB
       9
      9

      HTTP Request

      POST https://wholersorie.shop/api

      HTTP Response

      200
    • 104.21.18.19:443
      https://framekgirus.shop/api
      tls, http
      CrosshairX.exe
      1.0kB
       4.9kB
       9
      9

      HTTP Request

      POST https://framekgirus.shop/api

      HTTP Response

      200
    • 104.21.96.1:443
      https://tirepublicerj.shop/api
      tls, http
      CrosshairX.exe
      1.0kB
       4.9kB
       9
      9

      HTTP Request

      POST https://tirepublicerj.shop/api

      HTTP Response

      200
    • 172.67.170.178:443
      https://noisycuttej.shop/api
      tls, http
      CrosshairX.exe
      1.0kB
       4.9kB
       9
      9

      HTTP Request

      POST https://noisycuttej.shop/api

      HTTP Response

      200
    • 104.21.7.224:443
      https://rabidcowse.shop/api
      tls, http
      CrosshairX.exe
      999 B
       4.9kB
       9
      9

      HTTP Request

      POST https://rabidcowse.shop/api

      HTTP Response

      200
    • 104.21.96.1:443
      https://cloudewahsj.shop/api
      tls, http
      CrosshairX.exe
      1.0kB
       4.9kB
       9
      9

      HTTP Request

      POST https://cloudewahsj.shop/api

      HTTP Response

      200
    • 2.18.131.137:443
      https://steamcommunity.com/profiles/76561199724331900
      tls, http
      CrosshairX.exe
      1.4kB
       33.2kB
       18
      30

      HTTP Request

      GET https://steamcommunity.com/profiles/76561199724331900

      HTTP Response

      200
    • 8.8.8.8:53
      8.8.8.8.in-addr.arpa
      dns
      66 B
       90 B
       1
      1

      DNS Request

      8.8.8.8.in-addr.arpa

    • 8.8.8.8:53
      149.220.183.52.in-addr.arpa
      dns
      73 B
       147 B
       1
      1

      DNS Request

      149.220.183.52.in-addr.arpa

    • 8.8.8.8:53
      172.210.232.199.in-addr.arpa
      dns
      74 B
       128 B
       1
      1

      DNS Request

      172.210.232.199.in-addr.arpa

    • 8.8.8.8:53
      17.160.190.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      17.160.190.20.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      undesirabkel.click
      dns
      CrosshairX.exe
      64 B
       96 B
       1
      1

      DNS Request

      undesirabkel.click

      DNS Response

      172.67.150.49
      104.21.30.13

    • 8.8.8.8:53
      49.150.67.172.in-addr.arpa
      dns
      72 B
       134 B
       1
      1

      DNS Request

      49.150.67.172.in-addr.arpa

    • 8.8.8.8:53
      nearycrepso.shop
      dns
      CrosshairX.exe
      62 B
       119 B
       1
      1

      DNS Request

      nearycrepso.shop

    • 8.8.8.8:53
      abruptyopsn.shop
      dns
      CrosshairX.exe
      62 B
       174 B
       1
      1

      DNS Request

      abruptyopsn.shop

      DNS Response

      104.21.64.1
      104.21.80.1
      104.21.96.1
      104.21.48.1
      104.21.112.1
      104.21.16.1
      104.21.32.1

    • 8.8.8.8:53
      wholersorie.shop
      dns
      CrosshairX.exe
      62 B
       94 B
       1
      1

      DNS Request

      wholersorie.shop

      DNS Response

      172.67.160.114
      104.21.41.51

    • 8.8.8.8:53
      framekgirus.shop
      dns
      CrosshairX.exe
      62 B
       94 B
       1
      1

      DNS Request

      framekgirus.shop

      DNS Response

      104.21.18.19
      172.67.179.160

    • 8.8.8.8:53
      1.64.21.104.in-addr.arpa
      dns
      70 B
       132 B
       1
      1

      DNS Request

      1.64.21.104.in-addr.arpa

    • 8.8.8.8:53
      114.160.67.172.in-addr.arpa
      dns
      73 B
       135 B
       1
      1

      DNS Request

      114.160.67.172.in-addr.arpa

    • 8.8.8.8:53
      tirepublicerj.shop
      dns
      CrosshairX.exe
      64 B
       176 B
       1
      1

      DNS Request

      tirepublicerj.shop

      DNS Response

      104.21.96.1
      104.21.48.1
      104.21.16.1
      104.21.64.1
      104.21.112.1
      104.21.80.1
      104.21.32.1

    • 8.8.8.8:53
      noisycuttej.shop
      dns
      CrosshairX.exe
      62 B
       94 B
       1
      1

      DNS Request

      noisycuttej.shop

      DNS Response

      172.67.170.178
      104.21.71.146

    • 8.8.8.8:53
      rabidcowse.shop
      dns
      CrosshairX.exe
      61 B
       93 B
       1
      1

      DNS Request

      rabidcowse.shop

      DNS Response

      104.21.7.224
      172.67.156.127

    • 8.8.8.8:53
      19.18.21.104.in-addr.arpa
      dns
      71 B
       133 B
       1
      1

      DNS Request

      19.18.21.104.in-addr.arpa

    • 8.8.8.8:53
      1.96.21.104.in-addr.arpa
      dns
      70 B
       132 B
       1
      1

      DNS Request

      1.96.21.104.in-addr.arpa

    • 8.8.8.8:53
      cloudewahsj.shop
      dns
      CrosshairX.exe
      62 B
       174 B
       1
      1

      DNS Request

      cloudewahsj.shop

      DNS Response

      104.21.96.1
      104.21.64.1
      104.21.32.1
      104.21.48.1
      104.21.16.1
      104.21.80.1
      104.21.112.1

    • 8.8.8.8:53
      steamcommunity.com
      dns
      CrosshairX.exe
      64 B
       80 B
       1
      1

      DNS Request

      steamcommunity.com

      DNS Response

      2.18.131.137

    • 8.8.8.8:53
      178.170.67.172.in-addr.arpa
      dns
      73 B
       135 B
       1
      1

      DNS Request

      178.170.67.172.in-addr.arpa

    • 8.8.8.8:53
      224.7.21.104.in-addr.arpa
      dns
      71 B
       133 B
       1
      1

      DNS Request

      224.7.21.104.in-addr.arpa

    • 8.8.8.8:53
      137.131.18.2.in-addr.arpa
      dns
      71 B
       135 B
       1
      1

      DNS Request

      137.131.18.2.in-addr.arpa

    • 8.8.8.8:53
      13.86.106.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      13.86.106.20.in-addr.arpa

    • 8.8.8.8:53
      197.87.175.4.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      197.87.175.4.in-addr.arpa

    • 8.8.8.8:53
      206.23.85.13.in-addr.arpa
      dns
      71 B
       145 B
       1
      1

      DNS Request

      206.23.85.13.in-addr.arpa

    • 8.8.8.8:53
      167.190.18.2.in-addr.arpa
      dns
      71 B
       135 B
       1
      1

      DNS Request

      167.190.18.2.in-addr.arpa

    • 8.8.8.8:53
      180.129.81.91.in-addr.arpa
      dns
      72 B
       147 B
       1
      1

      DNS Request

      180.129.81.91.in-addr.arpa

    • 8.8.8.8:53
      172.214.232.199.in-addr.arpa
      dns
      74 B
       128 B
       1
      1

      DNS Request

      172.214.232.199.in-addr.arpa

    • 8.8.8.8:53
      48.229.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      48.229.111.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4688-0-0x0000000074F2E000-0x0000000074F2F000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4688-1-0x0000000000B80000-0x0000000000BE2000-memory.dmp

      Filesize

      392KB

      Download

    • memory/4688-2-0x0000000005970000-0x0000000005F14000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/4688-7-0x0000000074F20000-0x00000000756D0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/5024-4-0x0000000000400000-0x000000000045C000-memory.dmp

      Filesize

      368KB

      Download

    • memory/5024-6-0x0000000000400000-0x000000000045C000-memory.dmp

      Filesize

      368KB

      Download

    • memory/5024-8-0x0000000000400000-0x000000000045C000-memory.dmp

      Filesize

      368KB

      Download

    • memory/5024-9-0x0000000000400000-0x000000000045C000-memory.dmp

      Filesize

      368KB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.