Indicator 86.54.24.26 Type ip Category C2 Infrastructure Family CobaltStrike Hosting GT 86 54 24 Confidence high VT Score 11/94 Source shodan First Seen 2026-05-02 16:00:01 UTC Last Seen 2026-05-24 00:00:05 UTC Shodan View on Shodan ↗
Raw JSON
{
  "cobalt_strike_beacon": {
    "x86": {
      "beacon_type": "HTTPS",
      "jitter": 57,
      "dns-beacon.strategy_rotate_seconds": -1,
      "useragent_header": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Edg/140.0.3485.94",
      "http-post.client": [
        "Accept: */*",
        "Accept-Encoding: gzip, deflate, br, zstd",
        "Accept-Language: en-US,en;q=0.5",
        "Content-Type: application/json",
        "Oai-Device-Id: 1abea6bf-bdce-4939-5854-09489bdc6ce3",
        "Origin: https://chatgpt.com",
        "Referer: https://chatgpt.com/",
        "X-Conduit-Token: no-token",
        "{\"action\":\"next\",\"model\":\"",
        "\",\"conversation_mode\":{\"kind\":\"assistant\"}}",
        "oai-did=",
        "; oai-cbs=%2F; oai-hlib=true;",
        "Cookie"
      ],
      "maxgetsize": 2796499,
      "process-inject.min_alloc": 32581,
      "post-ex.spawnto_x86": "%windir%\\syswow64\\regsvr32.exe",
      "port": 443,
      "sleeptime": 85362,
      "uses_cookies": 1,
      "proxy.behavior": "2 (Use IE settings)",
      "process-inject.execute": [
        "CreateThread",
        "RtlCreateUserThread",
        "CreateRemoteThread"
      ],
      "process-inject.startrwx": 4,
      "post-ex.spawnto_x64": "%windir%\\sysnative\\regsvr32.exe",
      "process-inject.stub": "5462f8cce537c664d9b20f4f03cc8339",
      "http-get.uri": "chat.syncwaveenergy.com,/backend-api/gizmos/bootstrap,backend.syncwaveenergy.com,/backend-api/gizmos/bootstrap,api.syncwaveenergy.com,/backend-api/gizmos/bootstrap",
      "watermark": 1158277545,
      "dns-beacon.strategy_fail_seconds": -1,
      "server.publickey_md5": "4002ed4f424a5852cc92ebb9c140adbe",
      "dns-beacon.strategy_fail_x": -1,
      "stage.cleanup": 1,
      "http-post.verb": "POST",
      "http-post.uri": "/services",
      "process-inject.userwx": 32,
      "http-get.verb": "GET",
      "http-get.client": [
        "Accept: */*",
        "Accept-Encoding: gzip, deflate, br, zstd",
        "Accept-Language: en-US,en;q=0.5",
        "Oai-Client-Version: prod-afd11e903ee5f961935eed83cc39e84dbf7fe763",
        "Oai-Device-Id: 8abdf8bf-bdce-3640-7406-950d8b3457ba",
        "Oai-Language: en-US",
        "Priority: u=1, i",
        "Referer: https://chatgpt.com/",
        "Bearer",
        "Authorization"
      ]
    },
    "x64": {
      "beacon_type": "HTTPS",
      "jitter": 57,
      "dns-beacon.strategy_rotate_seconds": -1,
      "useragent_header": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Edg/140.0.3485.94",
      "http-post.client": [
        "Accept: */*",
        "Accept-Encoding: gzip, deflate, br, zstd",
        "Accept-Language: en-US,en;q=0.5",
        "Content-Type: application/json",
        "Oai-Device-Id: 1abea6bf-bdce-4939-5854-09489bdc6ce3",
        "Origin: https://chatgpt.com",
        "Referer: https://chatgpt.com/",
        "X-Conduit-Token: no-token",
        "{\"action\":\"next\",\"model\":\"",
        "\",\"conversation_mode\":{\"kind\":\"assistant\"}}",
        "oai-did=",
        "; oai-cbs=%2F; oai-hlib=true;",
        "Cookie"
      ],
      "maxgetsize": 2796499,
      "process-inject.min_alloc": 32581,
      "post-ex.spawnto_x86": "%windir%\\syswow64\\regsvr32.exe",
      "port": 443,
      "sleeptime": 85362,
      "uses_cookies": 1,
      "proxy.behavior": "2 (Use IE settings)",
      "process-inject.execute": [
        "CreateThread",
        "RtlCreateUserThread",
        "CreateRemoteThread"
      ],
      "process-inject.startrwx": 4,
      "post-ex.spawnto_x64": "%windir%\\sysnative\\regsvr32.exe",
      "process-inject.stub": "5462f8cce537c664d9b20f4f03cc8339",
      "http-get.uri": "chat.syncwaveenergy.com,/backend-api/gizmos/bootstrap,backend.syncwaveenergy.com,/backend-api/gizmos/bootstrap,api.syncwaveenergy.com,/backend-api/gizmos/bootstrap",
      "watermark": 1158277545,
      "dns-beacon.strategy_fail_seconds": -1,
      "server.publickey_md5": "4002ed4f424a5852cc92ebb9c140adbe",
      "dns-beacon.strategy_fail_x": -1,
      "stage.cleanup": 1,
      "http-post.verb": "POST",
      "http-post.uri": "/services",
      "process-inject.userwx": 32,
      "http-get.verb": "GET",
      "http-get.client": [
        "Accept: */*",
        "Accept-Encoding: gzip, deflate, br, zstd",
        "Accept-Language: en-US,en;q=0.5",
        "Oai-Client-Version: prod-afd11e903ee5f961935eed83cc39e84dbf7fe763",
        "Oai-Device-Id: 8abdf8bf-bdce-3640-7406-950d8b3457ba",
        "Oai-Language: en-US",
        "Priority: u=1, i",
        "Referer: https://chatgpt.com/",
        "Bearer",
        "Authorization"
      ]
    }
  },
  "ip": 1446385690,
  "http": {
    "status": 404,
    "robots_hash": null,
    "redirects": [],
    "title_hash": null,
    "securitytxt": null,
    "title": null,
    "sitemap_hash": null,
    "waf": "Cloudflare (Cloudflare Inc.)",
    "robots": null,
    "dom_hash": 0,
    "headers_hash": 11853219,
    "host": "86.54.24.26",
    "html": "",
    "server_hash": 958142897,
    "location": "/",
    "components": {
      "Cloudflare": {
        "categories": [
          "CDN"
        ]
      }
    },
    "securitytxt_hash": null,
    "server": "cloudflare",
    "sitemap": null,
    "html_hash": 0
  },
  "port": 4433,
  "transport": "tcp",
  "location": {
    "city": "Frankfurt am Main",
    "region_code": "HE",
    "area_code": null,
    "longitude": 8.68417,
    "latitude": 50.11552,
    "country_code": "DE",
    "country_name": "Germany"
  },
  "product": "Cobalt Strike Beacon",
  "hash": -708749464,
  "timestamp": "2026-05-02T10:38:23.276904",
  "ssl": {
    "chain_sha256": [
      "a0e4132e0f5b5ecb189210964c206719bb0af6748dd72d0aa0b3732c51786555",
      "aeb1fd7410e83bc96f5da3c6a7c2c1bb836d1fa5cb86e708515890e428a8770b"
    ],
    "jarm": "28d28d28d00028d00042d42d00042de0d120da90d5910c5de2af43b74a6bd8",
    "tlsext": [
      {
        "id": 43,
        "name": "supported_versions"
      },
      {
        "id": 51,
        "name": "key_share"
      },
      {
        "id": 10,
        "name": "supported_groups"
      }
    ],
    "chain": [
      "-----BEGIN CERTIFICATE-----\nMIIDqDCCAy6gAwIBAgISBfnXdiPgi+xqxjK2XwRW6Y7eMAoGCCqGSM49BAMDMDIx\nCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MQswCQYDVQQDEwJF\nNzAeFw0yNTA5MjcyMDE4NDZaFw0yNTEyMjYyMDE4NDVaMB8xHTAbBgNVBAMMFCou\nc3luY3dhdmVlbmVyZ3kuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEphzJ\n8qX0k7kNm5MxZJ0ZbZ8zGJWOeVu7xf8YnRWhgfWvRs2QNx1WorgoxU3fG3WnPK/G\nke/qicj7nOQhEdVEcKOCAjUwggIxMA4GA1UdDwEB/wQEAwIHgDAdBgNVHSUEFjAU\nBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH/BAIwADAdBgNVHQ4EFgQUVUSn\nSmDFHoosAO1d7C74vHoZKdUwHwYDVR0jBBgwFoAUrkie3IcdRKBv2qLlYHQEeMKc\nAIAwMgYIKwYBBQUHAQEEJjAkMCIGCCsGAQUFBzAChhZodHRwOi8vZTcuaS5sZW5j\nci5vcmcvMDMGA1UdEQQsMCqCFCouc3luY3dhdmVlbmVyZ3kuY29tghJzeW5jd2F2\nZWVuZXJneS5jb20wEwYDVR0gBAwwCjAIBgZngQwBAgEwLQYDVR0fBCYwJDAioCCg\nHoYcaHR0cDovL2U3LmMubGVuY3Iub3JnLzk1LmNybDCCAQMGCisGAQQB1nkCBAIE\ngfQEgfEA7wB1AMz7D2qFcQll/pWbU87psnwi6YVcDZeNtql+VMD+TA2wAAABmY0J\ni4YAAAQDAEYwRAIgVtxv+9YUMHaKFhzvdm2lP09IqgtoJVsgnNj2ow3iVdcCIDfX\nWEaliBrtUODGUPXqcCYggw+2rS/w3/4FisEHG4u9AHYAEvFONL1TckyEBhnDjz96\nE/jntWKHiJxtMAWE6+WGJjoAAAGZjQmLcwAABAMARzBFAiBtaLXZAdM7aCKw1zm7\nl+6Fi9E9qvqF0dYafUk/wuCR3QIhAJ04K+sO62pDUqWdqrH1+92qz6tGXEpUeM80\n95jJAynrMAoGCCqGSM49BAMDA2gAMGUCMADVkpgpfmu/UqNWNNZ4zYpxJtawAYI5\n09ogTgOYz0mIBNcyV9WCX0G3gOCN0B6c0AIxAJbrXvABhM3aknbXssgxy+U0Wfmd\nnkvvaFToGMVcjojRT40ZrjLKR+qsCUeRnNTIFw==\n-----END CERTIFICATE-----\n",
      "-----BEGIN CERTIFICATE-----\nMIIEVzCCAj+gAwIBAgIRAKp18eYrjwoiCWbTi7/UuqEwDQYJKoZIhvcNAQELBQAw\nTzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh\ncmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMjQwMzEzMDAwMDAw\nWhcNMjcwMzEyMjM1OTU5WjAyMQswCQYDVQQGEwJVUzEWMBQGA1UEChMNTGV0J3Mg\nRW5jcnlwdDELMAkGA1UEAxMCRTcwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAARB6AST\nCFh/vjcwDMCgQer+VtqEkz7JANurZxLP+U9TCeioL6sp5Z8VRvRbYk4P1INBmbef\nQHJFHCxcSjKmwtvGBWpl/9ra8HW0QDsUaJW2qOJqceJ0ZVFT3hbUHifBM/2jgfgw\ngfUwDgYDVR0PAQH/BAQDAgGGMB0GA1UdJQQWMBQGCCsGAQUFBwMCBggrBgEFBQcD\nATASBgNVHRMBAf8ECDAGAQH/AgEAMB0GA1UdDgQWBBSuSJ7chx1EoG/aouVgdAR4\nwpwAgDAfBgNVHSMEGDAWgBR5tFnme7bl5AFzgAiIyBpY9umbbjAyBggrBgEFBQcB\nAQQmMCQwIgYIKwYBBQUHMAKGFmh0dHA6Ly94MS5pLmxlbmNyLm9yZy8wEwYDVR0g\nBAwwCjAIBgZngQwBAgEwJwYDVR0fBCAwHjAcoBqgGIYWaHR0cDovL3gxLmMubGVu\nY3Iub3JnLzANBgkqhkiG9w0BAQsFAAOCAgEAjx66fDdLk5ywFn3CzA1w1qfylHUD\naEf0QZpXcJseddJGSfbUUOvbNR9N/QQ16K1lXl4VFyhmGXDT5Kdfcr0RvIIVrNxF\nh4lqHtRRCP6RBRstqbZ2zURgqakn/Xip0iaQL0IdfHBZr396FgknniRYFckKORPG\nyM3QKnd66gtMst8I5nkRQlAg/Jb+Gc3egIvuGKWboE1G89NTsN9LTDD3PLj0dUMr\nOIuqVjLB8pEC6yk9enrlrqjXQgkLEYhXzq7dLafv5Vkig6Gl0nuuqjqfp0Q1bi1o\nyVNAlXe6aUXw92CcghC9bNsKEO1+M52YY5+ofIXlS/SEQbvVYYBLZ5yeiglV6t3S\nM6H+vTG0aP9YHzLn/KVOHzGQfXDP7qM5tkf+7diZe7o2fw6O7IvN6fsQXEQQj8TJ\nUXJxv2/uJhcuy/tSDgXwHM8Uk34WNbRT7zGTGkQRX0gsbjAea/jYAoWv0ZvQRwpq\nPe79D/i7Cep8qWnA+7AE/3B3S/3dEEYmc0lpe1366A/6GEgk3ktr9PEoQrLChs6I\ntu3wnNLB2euC8IKGLQFpGtOO/2/hiAKjyajaBP25w1jF0Wl8Bbqne3uZ2q1GyPFJ\nYRmT7/OXpmOH/FVLtwS+8ng1cAmpCujPwteJZNcDG0sF2n/sc0+SQf49fdyUK0ty\n+VUwFj9tmWxyR/M=\n-----END CERTIFICATE-----\n"
    ],
    "versions": [],
    "acceptable_cas": [],
    "alpn": [],
    "cert": {
      "sig_alg": "ecdsa-with-SHA384",
      "issued": "20250927201846Z",
      "expires": "20251226201845Z",
      "pubkey": {
        "bits": 256,
        "type": "dsa"
      },
      "version": 2,
      "extensions": [
        {
          "critical": true,
          "data": "\\x03\\x02\\x07\\x80",
          "name": "keyUsage"
        },
        {
          "data": "0\\x14\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x01\\x06\\x08+\\x06\\x01\\x05\\x05\\x07\\x03\\x02",
          "name": "extendedKeyUsage"
        },
        {
          "critical": true,
          "data": "0\\x00",
          "name": "basicConstraints"
        },
        {
          "data": "\\x04\\x14UD\\xa7J`\\xc5\\x1e\\x8a,\\x00\\xed]\\xec.\\xf8\\xbcz\\x19)\\xd5",
          "name": "subjectKeyIdentifier"
        },
        {
          "data": "0\\x16\\x80\\x14\\xaeH\\x9e\\xdc\\x87\\x1dD\\xa0o\\xda\\xa2\\xe5`t\\x04x\\xc2\\x9c\\x00\\x80",
          "name": "authorityKeyIdentifier"
        },
        {
          "data": "0$0\"\\x06\\x08+\\x06\\x01\\x05\\x05\\x070\\x02\\x86\\x16http://e7.i.lencr.org/",
          "name": "authorityInfoAccess"
        },
        {
          "data": "0*\\x82\\x14*.syncwaveenergy.com\\x82\\x12syncwaveenergy.com",
          "name": "subjectAltName"
        },
        {
          "data": "0\\n0\\x08\\x06\\x06g\\x81\\x0c\\x01\\x02\\x01",
          "name": "certificatePolicies"
        },
        {
          "data": "0$0\"\\xa0 \\xa0\\x1e\\x86\\x1chttp://e7.c.lencr.org/95.crl",
          "name": "crlDistributionPoints"
        },
        {
          "data": "\\x04\\x81\\xf1\\x00\\xef\\x00u\\x00\\xcc\\xfb\\x0fj\\x85q\\te\\xfe\\x95\\x9bS\\xce\\xe9\\xb2|\"\\xe9\\x85\\\\\\r\\x97\\x8d\\xb6\\xa9~T\\xc0\\xfeL\\r\\xb0\\x00\\x00\\x01\\x99\\x8d\\t\\x8b\\x86\\x00\\x00\\x04\\x03\\x00F0D\\x02 V\\xdco\\xfb\\xd6\\x140v\\x8a\\x16\\x1c\\xefvm\\xa5?OH\\xaa\\x0bh%[ \\x9c\\xd8\\xf6\\xa3\\r\\xe2U\\xd7\\x02 7\\xd7XF\\xa5\\x88\\x1a\\xedP\\xe0\\xc6P\\xf5\\xeap& \\x83\\x0f\\xb6\\xad/\\xf0\\xdf\\xfe\\x05\\x8a\\xc1\\x07\\x1b\\x8b\\xbd\\x00v\\x00\\x12\\xf1N4\\xbdSrL\\x84\\x06\\x19\\xc3\\x8f?z\\x13\\xf8\\xe7\\xb5b\\x87\\x88\\x9cm0\\x05\\x84\\xeb\\xe5\\x86&:\\x00\\x00\\x01\\x99\\x8d\\t\\x8bs\\x00\\x00\\x04\\x03\\x00G0E\\x02 mh\\xb5\\xd9\\x01\\xd3;h\"\\xb0\\xd79\\xbb\\x97\\xee\\x85\\x8b\\xd1=\\xaa\\xfa\\x85\\xd1\\xd6\\x1a}I?\\xc2\\xe0\\x91\\xdd\\x02!\\x00\\x9d8+\\xeb\\x0e\\xebjCR\\xa5\\x9d\\xaa\\xb1\\xf5\\xfb\\xdd\\xaa\\xcf\\xabF\\\\JTx\\xcf4\\xf7\\x98\\xc9\\x03)\\xeb",
          "name": "ct_precert_scts"
        }
      ],
      "fingerprint": {
        "sha256": "a0e4132e0f5b5ecb189210964c206719bb0af6748dd72d0aa0b3732c51786555",
        "sha1": "05956d3ed4d7d28401174bd41f1d434262955b5d"
      },
      "serial": 5.2057813645991275e+41,
      "issuer": {
        "C": "US",
        "CN": "E7",
        "O": "Let's Encrypt"
      },
      "expired": true,
      "subject": {
        "CN": "*.syncwaveenergy.com"
      }
    },
    "cipher": {
      "version": "TLSv1.3",
      "bits": 256,
      "name": "TLS_AES_256_GCM_SHA384"
    },
    "trust": {
      "revoked": false,
      "browser": null
    },
    "handshake_states": [
      "before SSL initialization",
      "SSLv3/TLS write client hello",
      "SSLv3/TLS read server hello",
      "TLSv1.3 read encrypted extensions",
      "SSLv3/TLS read server certificate",
      "TLSv1.3 read server certificate verify",
      "SSLv3/TLS read finished",
      "SSLv3/TLS write change cipher spec",
      "SSLv3/TLS write finished",
      "SSL negotiation finished successfully"
    ],
    "ja3s": "f03a69cfa3944d6d51bc52febd87a1a8",
    "ocsp": {}
  },
  "hostnames": [
    "syncwaveenergy.com"
  ],
  "org": "GT 86 54 24",
  "data": "HTTP/1.1 404 Not Found\r\nDate: Sat, 2 May 2026 10:38:23 GMT\r\nContent-Type: text/plain\r\nContent-Length: 0\r\nServer: cloudflare\r\n\r\n\nCobalt Strike Beacon:\n  x86:\n    beacon_type: HTTPS\n    dns-beacon.strategy_fail_seconds: -1\n    dns-beacon.strategy_fail_x: -1\n    dns-beacon.strategy_rotate_seconds: -1\n    http-get.client:\n      Accept: */*\n      Accept-Encoding: gzip, deflate, br, zstd\n      Accept-Language: en-US,en;q=0.5\n      Oai-Client-Version: prod-afd11e903ee5f961935eed83cc39e84dbf7fe763\n      Oai-Device-Id: 8abdf8bf-bdce-3640-7406-950d8b3457ba\n      Oai-Language: en-US\n      Priority: u=1, i\n      Referer: https://chatgpt.com/\n      Bearer\n      Authorization\n    http-get.uri: chat.syncwaveenergy.com,/backend-api/gizmos/bootstrap,backend.syncwaveenergy.com,/backend-api/gizmos/bootstrap,api.syncwaveenergy.com,/backend-api/gizmos/bootstrap\n    http-get.verb: GET\n    http-post.client:\n      Accept: */*\n      Accept-Encoding: gzip, deflate, br, zstd\n      Accept-Language: en-US,en;q=0.5\n      Content-Type: application/json\n      Oai-Device-Id: 1abea6bf-bdce-4939-5854-09489bdc6ce3\n      Origin: https://chatgpt.com\n      Referer: https://chatgpt.com/\n      X-Conduit-Token: no-token\n      {\"action\":\"next\",\"model\":\"\n      \",\"conversation_mode\":{\"kind\":\"assistant\"}}\n      oai-did=\n      ; oai-cbs=%2F; oai-hlib=true;\n      Cookie\n    http-post.uri: /services\n    http-post.verb: POST\n    jitter: 57\n    maxgetsize: 2796499\n    port: 443\n    post-ex.spawnto_x64: %windir%\\sysnative\\regsvr32.exe\n    post-ex.spawnto_x86: %windir%\\syswow64\\regsvr32.exe\n    process-inject.execute:\n      CreateThread\n      RtlCreateUserThread\n      CreateRemoteThread\n    process-inject.min_alloc: 32581\n    process-inject.startrwx: 4\n    process-inject.stub: 5462f8cce537c664d9b20f4f03cc8339\n    process-inject.userwx: 32\n    proxy.behavior: 2 (Use IE settings)\n    server.publickey_md5: 4002ed4f424a5852cc92ebb9c140adbe\n    sleeptime: 85362\n    stage.cleanup: 1\n    useragent_header: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Edg/140.0.3485.94\n    uses_cookies: 1\n    watermark: 1158277545\n  x64:\n    beacon_type: HTTPS\n    dns-beacon.strategy_fail_seconds: -1\n    dns-beacon.strategy_fail_x: -1\n    dns-beacon.strategy_rotate_seconds: -1\n    http-get.client:\n      Accept: */*\n      Accept-Encoding: gzip, deflate, br, zstd\n      Accept-Language: en-US,en;q=0.5\n      Oai-Client-Version: prod-afd11e903ee5f961935eed83cc39e84dbf7fe763\n      Oai-Device-Id: 8abdf8bf-bdce-3640-7406-950d8b3457ba\n      Oai-Language: en-US\n      Priority: u=1, i\n      Referer: https://chatgpt.com/\n      Bearer\n      Authorization\n    http-get.uri: chat.syncwaveenergy.com,/backend-api/gizmos/bootstrap,backend.syncwaveenergy.com,/backend-api/gizmos/bootstrap,api.syncwaveenergy.com,/backend-api/gizmos/bootstrap\n    http-get.verb: GET\n    http-post.client:\n      Accept: */*\n      Accept-Encoding: gzip, deflate, br, zstd\n      Accept-Language: en-US,en;q=0.5\n      Content-Type: application/json\n      Oai-Device-Id: 1abea6bf-bdce-4939-5854-09489bdc6ce3\n      Origin: https://chatgpt.com\n      Referer: https://chatgpt.com/\n      X-Conduit-Token: no-token\n      {\"action\":\"next\",\"model\":\"\n      \",\"conversation_mode\":{\"kind\":\"assistant\"}}\n      oai-did=\n      ; oai-cbs=%2F; oai-hlib=true;\n      Cookie\n    http-post.uri: /services\n    http-post.verb: POST\n    jitter: 57\n    maxgetsize: 2796499\n    port: 443\n    post-ex.spawnto_x64: %windir%\\sysnative\\regsvr32.exe\n    post-ex.spawnto_x86: %windir%\\syswow64\\regsvr32.exe\n    process-inject.execute:\n      CreateThread\n      RtlCreateUserThread\n      CreateRemoteThread\n    process-inject.min_alloc: 32581\n    process-inject.startrwx: 4\n    process-inject.stub: 5462f8cce537c664d9b20f4f03cc8339\n    process-inject.userwx: 32\n    proxy.behavior: 2 (Use IE settings)\n    server.publickey_md5: 4002ed4f424a5852cc92ebb9c140adbe\n    sleeptime: 85362\n    stage.cleanup: 1\n    useragent_header: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Edg/140.0.3485.94\n    uses_cookies: 1\n    watermark: 1158277545\n",
  "asn": "AS16276",
  "cpe23": [
    "cpe:2.3:a:cloudflare:cloudflare",
    "cpe:2.3:a:helpsystems:cobalt_strike"
  ],
  "isp": "OVH SAS",
  "cpe": [
    "cpe:/a:cloudflare:cloudflare",
    "cpe:/a:helpsystems:cobalt_strike"
  ],
  "domains": [
    "syncwaveenergy.com"
  ],
  "ip_str": "86.54.24.26",
  "os": null,
  "_shodan": {
    "region": "na",
    "module": "https-simple-new",
    "ptr": true,
    "options": {},
    "id": "e44df418-e6c6-48c5-8264-92509b3cbb67",
    "crawler": "a1950d6e0c8b7689c47172d5d926ed653f972792"
  }
}