Configuration

95.182.114.29 — x64 — port 443
hash cdf2304c33d90d3af616107898ba07bc17149ec7d7cd5dcfcfa2c99b1669542c
first 2026-06-14 00:05:17 CEST / last 2026-06-14 16:08:16 CEST

Attributes

Full JSON

{
  "protocol": "https",
  "settings": {
    "SETTING_BOF_ALLOCATOR": "VirtualAlloc",
    "SETTING_C2_CHUNK_POST": 0,
    "SETTING_C2_POSTREQ": [
      [
        "_HEADER",
        "Connection: : Keep-Alive"
      ],
      [
        "_HEADER",
        "Accept: : */*"
      ],
      [
        "_HEADER",
        "Accept-Encoding: : identity"
      ],
      [
        "_HEADER",
        "User-Agent: : Microsoft BITS/7.5"
      ],
      [
        "_HOSTHEADER",
        "Host: au.download.windowsupdate.com"
      ],
      [
        "BUILD",
        "id"
      ],
      [
        "MASK",
        true
      ],
      [
        "BASE64URL",
        true
      ],
      [
        "PREPEND",
        "bytes="
      ],
      [
        "HEADER",
        "Range"
      ],
      [
        "BUILD",
        "output"
      ],
      [
        "MASK",
        true
      ],
      [
        "PRINT",
        true
      ]
    ],
    "SETTING_C2_RECOVER": [
      [
        "print",
        true
      ],
      [
        "append",
        53
      ],
      [
        "prepend",
        1025
      ],
      [
        "mask",
        true
      ]
    ],
    "SETTING_C2_REQUEST": [
      [
        "_HEADER",
        "Connection: : Keep-Alive"
      ],
      [
        "_HEADER",
        "Accept: : */*"
      ],
      [
        "_HEADER",
        "Accept-Encoding: : identity"
      ],
      [
        "_HEADER",
        "User-Agent: : Microsoft BITS/7.5"
      ],
      [
        "_HOSTHEADER",
        "Host: au.download.windowsupdate.com"
      ],
      [
        "BUILD",
        "metadata"
      ],
      [
        "BASE64URL",
        true
      ],
      [
        "PREPEND",
        "Range="
      ],
      [
        "HEADER",
        "Range"
      ]
    ],
    "SETTING_C2_VERB_GET": "GET",
    "SETTING_C2_VERB_POST": "POST",
    "SETTING_CFG_CAUTION": 1,
    "SETTING_CLEANUP": 1,
    "SETTING_CRYPTO_SCHEME": 0,
    "SETTING_DATA_STORE_SIZE": 16,
    "SETTING_DOMAINS": "95.182.114.29,/msdownload/update/2022/04/windows6.1-kb98218-v3-x86_0c754.psf",
    "SETTING_DOMAIN_STRATEGY": 0,
    "SETTING_DOMAIN_STRATEGY_FAIL_SECONDS": 4294967295,
    "SETTING_DOMAIN_STRATEGY_FAIL_X": 4294967295,
    "SETTING_DOMAIN_STRATEGY_SECONDS": 4294967295,
    "SETTING_EXIT_FUNK": 0,
    "SETTING_GARGLE_NOOK": 0,
    "SETTING_HOST_HEADER": "",
    "SETTING_HTTP_NO_COOKIES": 0,
    "SETTING_JITTER": 20,
    "SETTING_KILLDATE": 0,
    "SETTING_MASKED_WATERMARK": "c49fe99c9f7c5a1be8bf93399b406640b7d1fe11fe3d0b6fdcba8f1bb0770b52",
    "SETTING_MAXGET": 1049658,
    "SETTING_MAX_RETRY_STRATEGY_ATTEMPTS": 0,
    "SETTING_MAX_RETRY_STRATEGY_DURATION": 0,
    "SETTING_MAX_RETRY_STRATEGY_INCREASE": 0,
    "SETTING_PORT": 443,
    "SETTING_PROCINJ_ALLOCATOR": 0,
    "SETTING_PROCINJ_BOF_REUSE_MEM": 1,
    "SETTING_PROCINJ_EXECUTE": [
      "CreateThread",
      "SetThreadContext",
      "CreateRemoteThread",
      "RtlCreateUserThread"
    ],
    "SETTING_PROCINJ_MINALLOC": 0,
    "SETTING_PROCINJ_PERMS": 64,
    "SETTING_PROCINJ_PERMS_I": 64,
    "SETTING_PROCINJ_STUB": "e781a4479f7c5a03b2dcfe4bd436366f",
    "SETTING_PROCINJ_TRANSFORM_X64": [
      [
        "append",
        ""
      ],
      [
        "prepend",
        ""
      ]
    ],
    "SETTING_PROCINJ_TRANSFORM_X86": [
      [
        "append",
        ""
      ],
      [
        "prepend",
        ""
      ]
    ],
    "SETTING_PROTOCOL": 8,
    "SETTING_PROXY_BEHAVIOR": 2,
    "SETTING_PUBKEY": "49f1721d680c17da0504f50f0c1bbf4d2f95286edd00a9c3594aed52684c63c0",
    "SETTING_SLEEPTIME": 60000,
    "SETTING_SMB_FRAME_HEADER": "",
    "SETTING_SPAWNTO": "00000000000000000000000000000000",
    "SETTING_SPAWNTO_X64": "%windir%\\sysnative\\rundll32.exe",
    "SETTING_SPAWNTO_X86": "%windir%\\syswow64\\rundll32.exe",
    "SETTING_SUBMITURI": "/msdownload/update/2022/04/windows6.1-kb98218-v3-x64_0c754.psf",
    "SETTING_SYSCALL_METHOD": 0,
    "SETTING_TCP_FRAME_HEADER": "",
    "SETTING_USERAGENT": "User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0",
    "SETTING_WATERMARK": 666666666,
    "SETTING_WATERMARKHASH": "Vbi/d5GsmtZldELooLqdHw=="
  },
  "trial": false,
  "version": "Cobalt Strike 4.9 (Sep 19, 2023)",
  "watermark": 666666666
}