Configuration

223.165.5.84 — x86 — port 443
hash f0edac77181ccab49aaf2c3992d02476c5a457805d93253c51f9a1ae2645533f
first 2026-03-31 08:05:52 CEST / last 2026-03-31 08:05:52 CEST

Attributes

Full JSON

{
  "protocol": "https",
  "settings": {
    "SETTING_C2_CHUNK_POST": 0,
    "SETTING_C2_POSTREQ": [
      [
        "_HOSTHEADER",
        "Host: dash.cloudflare.com"
      ],
      [
        "_HEADER",
        "Cookie: vses2=8jc2h3;sparrow_id=%7B%22deviceId%22%3A%220996e503-50d76211cf%22%7D"
      ],
      [
        "_HEADER",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
      ],
      [
        "_HEADER",
        "Accept: */*"
      ],
      [
        "BUILD",
        "id"
      ],
      [
        "MASK",
        true
      ],
      [
        "NETBIOSU",
        true
      ],
      [
        "PREPEND",
        "user="
      ],
      [
        "APPEND",
        "%%"
      ],
      [
        "HEADER",
        "User"
      ],
      [
        "BUILD",
        "output"
      ],
      [
        "MASK",
        true
      ],
      [
        "BASE64URL",
        true
      ],
      [
        "PREPEND",
        "data="
      ],
      [
        "APPEND",
        "%%"
      ],
      [
        "PRINT",
        true
      ]
    ],
    "SETTING_C2_RECOVER": [
      [
        "print",
        true
      ],
      [
        "append",
        2
      ],
      [
        "prepend",
        5
      ],
      [
        "netbios",
        true
      ],
      [
        "mask",
        true
      ]
    ],
    "SETTING_C2_REQUEST": [
      [
        "_HOSTHEADER",
        "Host: dash.cloudflare.com"
      ],
      [
        "_HEADER",
        "Cookie: vses2=8jc2h3;sparrow_id=%7B%22deviceId%22%3A%220c-8e98-4b50d76211cf%22%7D"
      ],
      [
        "_HEADER",
        "Sec-Ch-Ua-Mobile: ?0"
      ],
      [
        "_HEADER",
        "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36"
      ],
      [
        "_HEADER",
        "Sec-Ch-Ua-Arch: 'x86'"
      ],
      [
        "_HEADER",
        "Sec-Ch-Ua-Bitness: '64'"
      ],
      [
        "_HEADER",
        "Sec-Ch-Ua-Platform: 'Windows'"
      ],
      [
        "_HEADER",
        "Accept: */*"
      ],
      [
        "BUILD",
        "metadata"
      ],
      [
        "BASE64URL",
        true
      ],
      [
        "PREPEND",
        "SESSIONID="
      ],
      [
        "HEADER",
        "Cookie"
      ]
    ],
    "SETTING_C2_VERB_GET": "GET",
    "SETTING_C2_VERB_POST": "POST",
    "SETTING_CFG_CAUTION": 0,
    "SETTING_CLEANUP": 0,
    "SETTING_CRYPTO_SCHEME": 0,
    "SETTING_DOMAINS": "www.vertiogodoha.com,/www/handle/doc",
    "SETTING_DOMAIN_STRATEGY": 0,
    "SETTING_DOMAIN_STRATEGY_FAIL_SECONDS": 4294967295,
    "SETTING_DOMAIN_STRATEGY_FAIL_X": 4294967295,
    "SETTING_DOMAIN_STRATEGY_SECONDS": 4294967295,
    "SETTING_EXIT_FUNK": 0,
    "SETTING_GARGLE_NOOK": 0,
    "SETTING_HOST_HEADER": "",
    "SETTING_HTTP_NO_COOKIES": 1,
    "SETTING_JITTER": 7,
    "SETTING_KILLDATE": 0,
    "SETTING_MAXGET": 2097167,
    "SETTING_PORT": 443,
    "SETTING_PROCINJ_ALLOCATOR": 0,
    "SETTING_PROCINJ_EXECUTE": [
      "CreateThread",
      "SetThreadContext",
      "CreateRemoteThread",
      "RtlCreateUserThread"
    ],
    "SETTING_PROCINJ_MINALLOC": 0,
    "SETTING_PROCINJ_PERMS": 64,
    "SETTING_PROCINJ_PERMS_I": 64,
    "SETTING_PROCINJ_STUB": "9286e1a68873fc07be8d81c17fb02c83",
    "SETTING_PROCINJ_TRANSFORM_X64": [
      [
        "append",
        ""
      ],
      [
        "prepend",
        ""
      ]
    ],
    "SETTING_PROCINJ_TRANSFORM_X86": [
      [
        "append",
        ""
      ],
      [
        "prepend",
        ""
      ]
    ],
    "SETTING_PROTOCOL": 8,
    "SETTING_PROXY_BEHAVIOR": 2,
    "SETTING_PUBKEY": "7fd316b022a0761ef07a6468daf5071d382ad75c51135f73e61255e7a2a278f4",
    "SETTING_SLEEPTIME": 300,
    "SETTING_SMB_FRAME_HEADER": "",
    "SETTING_SPAWNTO": "00000000000000000000000000000000",
    "SETTING_SPAWNTO_X64": "c:\\windows\\system32\\rundll32.exe",
    "SETTING_SPAWNTO_X86": "c:\\windows\\syswow64\\rundll32.exe",
    "SETTING_SUBMITURI": "/IMXo",
    "SETTING_TCP_FRAME_HEADER": "",
    "SETTING_USERAGENT": "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; MANM; MANM)",
    "SETTING_WATERMARK": 1580103824
  },
  "trial": false,
  "version": "Cobalt Strike 4.4 (Aug 04, 2021)",
  "watermark": 1580103824
}