Configuration

185.196.8.2 — x64 — port 8443
hash a645cfd798d7e693626471b34e86d20d5e9939e9c666554489de582469d44b48
first 2026-01-17 08:13:26 CET / last 2026-01-17 08:13:26 CET

Attributs

Full JSON (entry)

{
  "protocol": "https",
  "settings": {
    "SETTING_BOF_ALLOCATOR": "VirtualAlloc",
    "SETTING_C2_CHUNK_POST": 0,
    "SETTING_C2_POSTREQ": [
      [
        "_HEADER",
        "Accept: */*"
      ],
      [
        "_HEADER",
        "Origin: https://www.amazon.com"
      ],
      [
        "BUILD",
        "output"
      ],
      [
        "BASE64URL",
        true
      ],
      [
        "PREPEND",
        "{\"events\":[{\"data\":{\"schemaId\":\"csa.VideoInteractions.1\",\"application\":\"Retail:Prod:,\"requestId\":\"MBFV82TTQV2JNBKJJ50B\",\"title\":\"Amazon.com. Spend less. Smile more.\",\"subPageType\":\"desktop\",\"session\":{\"id\":\"133-9905055-2677266\"},\"video\":{\"id\":\""
      ],
      [
        "APPEND",
        "\"\n"
      ],
      [
        "APPEND",
        "\"playerMode\":\"INLINE\",\"videoRequestId\":\"MBFV82TTQV2JNBKJJ50B\",\"isAudioOn\":\"false\",\"player\":\"IVS\",\"event\":\"NONE\"}}}}]}"
      ],
      [
        "PRINT",
        true
      ],
      [
        "BUILD",
        "id"
      ],
      [
        "BASE64URL",
        true
      ],
      [
        "HEADER",
        "x-amz-rid"
      ]
    ],
    "SETTING_C2_RECOVER": [
      [
        "print",
        true
      ],
      [
        "append",
        1308
      ],
      [
        "append",
        1
      ],
      [
        "prepend",
        204
      ],
      [
        "base64",
        true
      ]
    ],
    "SETTING_C2_REQUEST": [
      [
        "_HEADER",
        "Accept: */*"
      ],
      [
        "_HEADER",
        "Content-Type: application/x-www-form-urlencoded"
      ],
      [
        "_HEADER",
        "Content-Transfer-Encoding: base64"
      ],
      [
        "_HEADER",
        "Connection: Keep-Alive"
      ],
      [
        "BUILD",
        "metadata"
      ],
      [
        "NETBIOSU",
        true
      ],
      [
        "URI_APPEND",
        true
      ]
    ],
    "SETTING_C2_VERB_GET": "GET",
    "SETTING_C2_VERB_POST": "POST",
    "SETTING_CFG_CAUTION": 1,
    "SETTING_CLEANUP": 1,
    "SETTING_CRYPTO_SCHEME": 0,
    "SETTING_DATA_STORE_SIZE": 16,
    "SETTING_DOMAINS": "bbcbook.net,/api/v1/Updates",
    "SETTING_DOMAIN_STRATEGY": 0,
    "SETTING_DOMAIN_STRATEGY_FAIL_SECONDS": 4294967295,
    "SETTING_DOMAIN_STRATEGY_FAIL_X": 4294967295,
    "SETTING_DOMAIN_STRATEGY_SECONDS": 4294967295,
    "SETTING_EXIT_FUNK": 0,
    "SETTING_GARGLE_NOOK": 1,
    "SETTING_GARGLE_SECTIONS": [
      "0x32000-0x41c02",
      "0x42000-0x53848",
      "0x54000-0x56454",
      "0x57000-0x57fd0"
    ],
    "SETTING_HOST_HEADER": "",
    "SETTING_HTTP_NO_COOKIES": 0,
    "SETTING_JITTER": 66,
    "SETTING_KILLDATE": 0,
    "SETTING_MASKED_WATERMARK": "407aabd5342e35ca8c998b4e4349a82d6e5e4f3f7b7f51fd8ccbc46c1747e421",
    "SETTING_MAXGET": 27963541,
    "SETTING_MAX_RETRY_STRATEGY_ATTEMPTS": 0,
    "SETTING_MAX_RETRY_STRATEGY_DURATION": 0,
    "SETTING_MAX_RETRY_STRATEGY_INCREASE": 0,
    "SETTING_PORT": 443,
    "SETTING_PROCINJ_ALLOCATOR": 1,
    "SETTING_PROCINJ_BOF_REUSE_MEM": 1,
    "SETTING_PROCINJ_EXECUTE": [
      "CreateThread \"ntdll.dll!RtlUserThreadStart+0x1000\"",
      "SetThreadContext",
      "NtQueueApcThread_s",
      "CreateRemoteThread \"kernel32.dll!LoadLibraryA+0x1000\"",
      "CreateRemoteThread",
      "RtlCreateUserThread"
    ],
    "SETTING_PROCINJ_MINALLOC": 16700,
    "SETTING_PROCINJ_PERMS": 32,
    "SETTING_PROCINJ_PERMS_I": 4,
    "SETTING_PROCINJ_STUB": "0b34150c342e35d2ffacb2227620d91c",
    "SETTING_PROCINJ_TRANSFORM_X64": [
      [
        "append",
        "I\u000f\u001f"
      ],
      [
        "prepend",
        ""
      ]
    ],
    "SETTING_PROCINJ_TRANSFORM_X86": [
      [
        "append",
        "@EfۇAHF\u000f\u001f"
      ],
      [
        "prepend",
        ""
      ]
    ],
    "SETTING_PROTOCOL": 8,
    "SETTING_PROXY_BEHAVIOR": 2,
    "SETTING_PUBKEY": "9a1a3ca0d88855322c0e83494633829cdd3d2cfff877d3f1adbffaee54b1cc17",
    "SETTING_SLEEPTIME": 36143,
    "SETTING_SMB_FRAME_HEADER": "",
    "SETTING_SPAWNTO": "00000000000000000000000000000000",
    "SETTING_SPAWNTO_X64": "%windir%\\sysnative\\wbem\\wmiprvse.exe -Embedding",
    "SETTING_SPAWNTO_X86": "%windir%\\syswow64\\wbem\\wmiprvse.exe -Embedding",
    "SETTING_SUBMITURI": "/1/events/com.amazon.csm.csa.prod",
    "SETTING_SYSCALL_METHOD": 0,
    "SETTING_TCP_FRAME_HEADER": "",
    "SETTING_USERAGENT": "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; FunWebProducts)",
    "SETTING_WATERMARK": 987654321,
    "SETTING_WATERMARKHASH": "NtZOV6JzDr9QkEnX6bobPg=="
  },
  "trial": false,
  "version": "Cobalt Strike 4.9 (Sep 19, 2023)",
  "watermark": 987654321
}