analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

RIP_YOUR_PC_LOL.exe

Full analysis: https://app.any.run/tasks/f1c48679-9f01-4aab-9ee4-c6019c6ed37e
Verdict: Malicious activity
Threats:

DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common.

Malware Trends Tracker     >>>
Analysis date: January 14, 2022, 22:56:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
trojan
rat
redline
evasion
keylogger
hawkeye
nanocore
backdoor
dcrat
fareit
pony
stealer
njrat
bladabindi
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

52867174362410D63215D78E708103EA

SHA1:

7AE4E1048E4463A4201BDEAF224C5B6FACE681BF

SHA256:

37D8E1CE3B6E6488942717AA78CB54785EDC985143BCC8D9BA9F42D73A3DBD7A

SSDEEP:

393216:HJLgf7BPkdKzrZciLxv8naSNtPr5rn57M84UTB9xO5/VWvJKJPkwdnfZ4y5SDkF/:poBPQwxMR7pn5qUTB9xOFVWvJKJPkwdd

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • healastounding.exe (PID: 3076)
      • RIP_YOUR_PC_LOL.exe (PID: 3416)
      • 8f1c8b40c7be588389a8d382040b23bb.exe (PID: 3356)
      • 22.exe (PID: 3156)
      • svchost.exe (PID: 2880)
      • ___11.19.exe (PID: 2932)
      • svchos.exe (PID: 2012)
      • TXPlatforn.exe (PID: 2700)
      • svchost.exe (PID: 664)

    • NANOCORE was detected

      • Opus.exe (PID: 1908)

    • HAWKEYE was detected

      • Pluto Panel.exe (PID: 2368)

    • Changes the autorun value in the registry

      • Opus.exe (PID: 1908)
      • Pluto Panel.exe (PID: 2368)
      • 3.exe (PID: 4032)
      • mediaget.exe (PID: 3816)

    • UAC/LUA settings modification

      • 3.exe (PID: 4032)
      • gay.exe (PID: 2092)

    • Application was dropped or rewritten from another process

      • 0fd7de5367376231a788872005d7ed4f.exe (PID: 2660)
      • Pluto Panel.exe (PID: 2368)
      • 22.exe (PID: 1972)
      • healastounding.exe (PID: 3076)
      • 0fd7de5367376231a788872005d7ed4f.exe (PID: 772)
      • 22.exe (PID: 3156)
      • Opus.exe (PID: 1908)
      • test.exe (PID: 2892)
      • gay.exe (PID: 904)
      • 8f1c8b40c7be588389a8d382040b23bb.exe (PID: 3356)
      • 8f1c8b40c7be588389a8d382040b23bb.exe (PID: 2884)
      • aaa.exe (PID: 3100)
      • 4.exe (PID: 1420)
      • Dcvxaamev.exe (PID: 2780)
      • FFDvbcrdfqs.exe (PID: 1808)
      • Dcvxaamev.exe (PID: 3640)
      • 3.exe (PID: 4032)
      • a.exe (PID: 4036)
      • FFDvbcrdfqs.exe (PID: 2280)
      • ___11.19.exe (PID: 1040)
      • ___11.19.exe (PID: 2932)
      • gay.exe (PID: 2092)
      • mediaget.exe (PID: 3816)
      • HD____11.19.exe (PID: 2264)
      • aaa.exe (PID: 3740)
      • TXPlatforn.exe (PID: 308)
      • svchos.exe (PID: 2012)
      • svchost.exe (PID: 2880)
      • TXPlatforn.exe (PID: 2700)
      • ������������ģ��.exe (PID: 3692)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2236)
      • schtasks.exe (PID: 1896)
      • schtasks.exe (PID: 2056)
      • schtasks.exe (PID: 1320)

    • Runs PING.EXE for delay simulation

      • cmd.exe (PID: 2688)

    • Actions looks like stealing of personal data

      • vbc.exe (PID: 2596)
      • a.exe (PID: 4036)
      • vbc.exe (PID: 3340)

    • REDLINE was detected

      • a.exe (PID: 4036)

    • Connects to CnC server

      • a.exe (PID: 4036)
      • gay.exe (PID: 2092)
      • aaa.exe (PID: 3740)

    • Steals credentials from Web Browsers

      • a.exe (PID: 4036)
      • vbc.exe (PID: 3340)

    • Stealing of credential data

      • vbc.exe (PID: 2596)
      • gay.exe (PID: 2092)
      • Pluto Panel.exe (PID: 2368)

    • DCRAT was detected

      • gay.exe (PID: 2092)

    • Uses NirSoft utilities to collect credentials

      • vbc.exe (PID: 2596)

    • NJRAT was detected

      • mediaget.exe (PID: 3816)

    • Writes to a start menu file

      • mediaget.exe (PID: 3816)

    • Loads dropped or rewritten executable

      • ������������ģ��.exe (PID: 3692)
      • svchos.exe (PID: 2012)
      • svchost.exe (PID: 664)

    • PONY was detected

      • aaa.exe (PID: 3740)

  • SUSPICIOUS

    • Checks supported languages

      • RIP_YOUR_PC_LOL.exe (PID: 3416)
      • healastounding.exe (PID: 3076)
      • Pluto Panel.exe (PID: 2368)
      • gay.exe (PID: 904)
      • 0fd7de5367376231a788872005d7ed4f.exe (PID: 2660)
      • Opus.exe (PID: 1908)
      • 8f1c8b40c7be588389a8d382040b23bb.exe (PID: 3356)
      • 4.exe (PID: 1420)
      • test.exe (PID: 2892)
      • aaa.exe (PID: 3100)
      • FFDvbcrdfqs.exe (PID: 2280)
      • a.exe (PID: 4036)
      • Dcvxaamev.exe (PID: 2780)
      • FFDvbcrdfqs.exe (PID: 1808)
      • 8f1c8b40c7be588389a8d382040b23bb.exe (PID: 2884)
      • Dcvxaamev.exe (PID: 3640)
      • 3.exe (PID: 4032)
      • 22.exe (PID: 3156)
      • 0fd7de5367376231a788872005d7ed4f.exe (PID: 772)
      • ___11.19.exe (PID: 2932)
      • svchost.exe (PID: 2880)
      • TXPlatforn.exe (PID: 308)
      • svchos.exe (PID: 2012)
      • TXPlatforn.exe (PID: 2700)
      • cmd.exe (PID: 2688)
      • HD____11.19.exe (PID: 2264)
      • cmd.exe (PID: 2936)
      • vbc.exe (PID: 2596)
      • mediaget.exe (PID: 3816)
      • ������������ģ��.exe (PID: 3692)
      • gay.exe (PID: 2092)
      • vbc.exe (PID: 3340)

    • Reads the computer name

      • RIP_YOUR_PC_LOL.exe (PID: 3416)
      • healastounding.exe (PID: 3076)
      • test.exe (PID: 2892)
      • Pluto Panel.exe (PID: 2368)
      • 8f1c8b40c7be588389a8d382040b23bb.exe (PID: 3356)
      • 4.exe (PID: 1420)
      • FFDvbcrdfqs.exe (PID: 1808)
      • FFDvbcrdfqs.exe (PID: 2280)
      • Dcvxaamev.exe (PID: 2780)
      • 8f1c8b40c7be588389a8d382040b23bb.exe (PID: 2884)
      • Opus.exe (PID: 1908)
      • Dcvxaamev.exe (PID: 3640)
      • 3.exe (PID: 4032)
      • a.exe (PID: 4036)
      • 22.exe (PID: 3156)
      • 0fd7de5367376231a788872005d7ed4f.exe (PID: 772)
      • svchost.exe (PID: 2880)
      • TXPlatforn.exe (PID: 308)
      • svchos.exe (PID: 2012)
      • TXPlatforn.exe (PID: 2700)
      • HD____11.19.exe (PID: 2264)
      • ___11.19.exe (PID: 2932)
      • vbc.exe (PID: 2596)
      • gay.exe (PID: 2092)
      • gay.exe (PID: 904)
      • ������������ģ��.exe (PID: 3692)
      • mediaget.exe (PID: 3816)
      • vbc.exe (PID: 3340)

    • Creates files in the user directory

      • RIP_YOUR_PC_LOL.exe (PID: 3416)
      • healastounding.exe (PID: 3076)
      • Pluto Panel.exe (PID: 2368)
      • Opus.exe (PID: 1908)
      • 4.exe (PID: 1420)
      • 3.exe (PID: 4032)
      • ___11.19.exe (PID: 2932)
      • gay.exe (PID: 904)
      • mediaget.exe (PID: 3816)

    • Executable content was dropped or overwritten

      • RIP_YOUR_PC_LOL.exe (PID: 3416)
      • healastounding.exe (PID: 3076)
      • 8f1c8b40c7be588389a8d382040b23bb.exe (PID: 3356)
      • Opus.exe (PID: 1908)
      • 4.exe (PID: 1420)
      • 3.exe (PID: 4032)
      • 22.exe (PID: 3156)
      • svchost.exe (PID: 2880)
      • Pluto Panel.exe (PID: 2368)
      • ___11.19.exe (PID: 2932)
      • TXPlatforn.exe (PID: 2700)
      • svchos.exe (PID: 2012)
      • gay.exe (PID: 904)
      • mediaget.exe (PID: 3816)

    • Reads Environment values

      • Pluto Panel.exe (PID: 2368)
      • FFDvbcrdfqs.exe (PID: 1808)
      • Opus.exe (PID: 1908)
      • 3.exe (PID: 4032)
      • a.exe (PID: 4036)
      • gay.exe (PID: 2092)
      • mediaget.exe (PID: 3816)
      • netsh.exe (PID: 3804)

    • Drops a file that was compiled in debug mode

      • RIP_YOUR_PC_LOL.exe (PID: 3416)
      • healastounding.exe (PID: 3076)
      • 22.exe (PID: 3156)
      • TXPlatforn.exe (PID: 2700)
      • svchost.exe (PID: 664)

    • Drops a file with a compile date too recent

      • healastounding.exe (PID: 3076)

    • Application launched itself

      • FFDvbcrdfqs.exe (PID: 2280)
      • 8f1c8b40c7be588389a8d382040b23bb.exe (PID: 3356)
      • Dcvxaamev.exe (PID: 2780)
      • 0fd7de5367376231a788872005d7ed4f.exe (PID: 2660)
      • TXPlatforn.exe (PID: 308)
      • aaa.exe (PID: 3100)

    • Creates files in the Windows directory

      • 22.exe (PID: 3156)
      • svchost.exe (PID: 2880)
      • TXPlatforn.exe (PID: 2700)
      • svchos.exe (PID: 2012)
      • svchost.exe (PID: 664)

    • Creates or modifies windows services

      • 22.exe (PID: 3156)
      • svchos.exe (PID: 2012)
      • TXPlatforn.exe (PID: 2700)

    • Executed via WMI

      • schtasks.exe (PID: 2236)
      • schtasks.exe (PID: 1896)
      • schtasks.exe (PID: 2056)
      • schtasks.exe (PID: 1320)

    • Creates executable files which already exist in Windows

      • ___11.19.exe (PID: 2932)

    • Executed as Windows Service

      • TXPlatforn.exe (PID: 308)

    • Creates files in the program directory

      • 0fd7de5367376231a788872005d7ed4f.exe (PID: 772)

    • Starts CMD.EXE for commands execution

      • svchost.exe (PID: 2880)
      • 3.exe (PID: 4032)

    • Starts CMD.EXE for self-deleting

      • svchost.exe (PID: 2880)

    • Creates files in the driver directory

      • TXPlatforn.exe (PID: 2700)

    • Checks for external IP

      • Pluto Panel.exe (PID: 2368)
      • 0fd7de5367376231a788872005d7ed4f.exe (PID: 772)

    • Executes scripts

      • Pluto Panel.exe (PID: 2368)

    • Starts itself from another location

      • gay.exe (PID: 904)

    • Starts Internet Explorer

      • gay.exe (PID: 2092)

    • Reads the cookies of Mozilla Firefox

      • a.exe (PID: 4036)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2896)

    • Reads the cookies of Google Chrome

      • a.exe (PID: 4036)

    • Uses NETSH.EXE for network configuration

      • mediaget.exe (PID: 3816)
      • 22.exe (PID: 3156)

    • Loads DLL from Mozilla Firefox

      • vbc.exe (PID: 3340)

    • Searches for installed software

      • a.exe (PID: 4036)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • RIP_YOUR_PC_LOL.exe (PID: 3416)

    • Checks supported languages

      • schtasks.exe (PID: 2236)
      • schtasks.exe (PID: 1896)
      • PING.EXE (PID: 3552)
      • schtasks.exe (PID: 2056)
      • svchost.exe (PID: 664)
      • schtasks.exe (PID: 1320)
      • w32tm.exe (PID: 3676)
      • iexplore.exe (PID: 472)
      • iexplore.exe (PID: 2896)
      • netsh.exe (PID: 3804)

    • Reads the computer name

      • schtasks.exe (PID: 2236)
      • schtasks.exe (PID: 1896)
      • PING.EXE (PID: 3552)
      • svchost.exe (PID: 664)
      • schtasks.exe (PID: 2056)
      • schtasks.exe (PID: 1320)
      • w32tm.exe (PID: 3676)
      • iexplore.exe (PID: 2896)
      • iexplore.exe (PID: 472)
      • netsh.exe (PID: 3804)

    • Reads settings of System Certificates

      • a.exe (PID: 4036)
      • iexplore.exe (PID: 472)

    • Application launched itself

      • iexplore.exe (PID: 472)

    • Changes internet zones settings

      • iexplore.exe (PID: 472)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 472)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 472)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2896)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Microsoft Visual Basic 6 (51)
.exe | InstallShield setup (26.7)
.exe | UPX compressed Win32 Executable (16.8)
.exe | Win32 Executable (generic) (2.8)
.exe | Generic Win/DOS Executable (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:12:11 22:08:53+01:00
PEType: PE32
LinkerVersion: 11
CodeSize: 23631360
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x168b4ae
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 14.5.48.86
ProductVersionNumber: 14.5.48.86
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: brawler
FileDescription: earfalserust
FileVersion: 14.5.48.86
InternalName: foampounding.exe
LegalCopyright: emerge © brutal
OriginalFileName: foampounding.exe
ProductName: open
ProductVersion: 14.5.48.86
AssemblyVersion: 14.5.48.86

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 11-Dec-2021 21:08:53
CompanyName: brawler
FileDescription: earfalserust
FileVersion: 14.5.48.86
InternalName: foampounding.exe
LegalCopyright: emerge © brutal
OriginalFilename: foampounding.exe
ProductName: open
ProductVersion: 14.5.48.86
Assembly Version: 14.5.48.86

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 11-Dec-2021 21:08:53
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00002000
0x016894B4
0x01689600
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.78918
.rsrc
0x0168C000
0x00000598
0x00000600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.08611
.reloc
0x0168E000
0x0000000C
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
0.11837

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.00112
490
UNKNOWN
UNKNOWN
RT_MANIFEST

Imports

mscoree.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
118
Monitored processes
59
Malicious processes
19
Suspicious processes
9

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start drop and start drop and start drop and start drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start rip_your_pc_lol.exe healastounding.exe #HAWKEYE pluto panel.exe 0fd7de5367376231a788872005d7ed4f.exe no specs 22.exe no specs test.exe gay.exe #NANOCORE opus.exe aaa.exe no specs 8f1c8b40c7be588389a8d382040b23bb.exe 4.exe #REDLINE a.exe ffdvbcrdfqs.exe no specs ffdvbcrdfqs.exe no specs dcvxaamev.exe no specs 8f1c8b40c7be588389a8d382040b23bb.exe dcvxaamev.exe 3.exe 22.exe ___11.19.exe no specs 0fd7de5367376231a788872005d7ed4f.exe ___11.19.exe svchost.exe schtasks.exe no specs txplatforn.exe no specs schtasks.exe no specs cmd.exe no specs txplatforn.exe svchos.exe ping.exe no specs schtasks.exe no specs schtasks.exe no specs hd____11.19.exe cmd.exe no specs w32tm.exe no specs vbc.exe #NJRAT mediaget.exe #DCRAT gay.exe iexplore.exe iexplore.exe no specs netsh.exe no specs vbc.exe #PONY aaa.exe netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs winlogon.exe no specs svchost.exe no specs cmd.exe no specs svchost.exe no specs ������������ģ��.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3416"C:\Users\admin\Desktop\RIP_YOUR_PC_LOL.exe" C:\Users\admin\Desktop\RIP_YOUR_PC_LOL.exe
Explorer.EXE
User:
admin
Company:
brawler
Integrity Level:
MEDIUM
Description:
earfalserust
Exit code:
0
Version:
14.5.48.86
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\desktop\rip_your_pc_lol.exe
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3076"C:\Users\admin\AppData\Roaming\healastounding.exe" C:\Users\admin\AppData\Roaming\healastounding.exe
RIP_YOUR_PC_LOL.exe
User:
admin
Company:
afternoon
Integrity Level:
MEDIUM
Description:
hardbetween
Exit code:
0
Version:
15.28.2.16
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\roaming\healastounding.exe
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2368"C:\Users\admin\AppData\Roaming\Pluto Panel.exe" C:\Users\admin\AppData\Roaming\Pluto Panel.exe
RIP_YOUR_PC_LOL.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Phulli
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\pluto panel.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2660"C:\Users\admin\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe" C:\Users\admin\AppData\Roaming\0fd7de5367376231a788872005d7ed4f.exe—RIP_YOUR_PC_LOL.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\0fd7de5367376231a788872005d7ed4f.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
1972"C:\Users\admin\AppData\Roaming\22.exe" C:\Users\admin\AppData\Roaming\22.exe—RIP_YOUR_PC_LOL.exe
User:
admin
Company:
4399
Integrity Level:
MEDIUM
Description:
Install Exe.
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\22.exe
c:\windows\system32\ntdll.dll
2892"C:\Users\admin\AppData\Roaming\test.exe" C:\Users\admin\AppData\Roaming\test.exe
healastounding.exe
User:
admin
Integrity Level:
MEDIUM
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\test.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
c:\windows\system32\rpcrt4.dll
904"C:\Users\admin\AppData\Roaming\gay.exe" C:\Users\admin\AppData\Roaming\gay.exe
healastounding.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\gay.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1908"C:\Users\admin\AppData\Roaming\Opus.exe" C:\Users\admin\AppData\Roaming\Opus.exe
healastounding.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\roaming\opus.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\cryptbase.dll
3100"C:\Users\admin\AppData\Roaming\aaa.exe" C:\Users\admin\AppData\Roaming\aaa.exe—healastounding.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Provides content indexing, property caching, and search results for files, e-mail, and other content.
Exit code:
0
Version:
11.42
Modules
Images
c:\windows\system32\shell32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\profapi.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\mscorlib\23349d393ecff063c3152fcf5229b2ab\mscorlib.ni.dll
c:\windows\system32\cryptbase.dll
c:\windows\microsoft.net\framework\v2.0.50727\mscorjit.dll
c:\users\admin\appdata\roaming\aaa.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
3356"C:\Users\admin\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe" C:\Users\admin\AppData\Roaming\8f1c8b40c7be588389a8d382040b23bb.exe
healastounding.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.00
Modules
Images
c:\users\admin\appdata\roaming\8f1c8b40c7be588389a8d382040b23bb.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvbvm60.dll
Total events
32 333
Read events
31 163
Write events
1 158
Delete events
12

Modification events

(PID) Process:(3416) RIP_YOUR_PC_LOL.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3416) RIP_YOUR_PC_LOL.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3416) RIP_YOUR_PC_LOL.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3416) RIP_YOUR_PC_LOL.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3076) healastounding.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3076) healastounding.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3076) healastounding.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3076) healastounding.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(904) gay.exeKey:HKEY_CURRENT_USER
Operation:writeName:di
Value:
!
(PID) Process:(3356) 8f1c8b40c7be588389a8d382040b23bb.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
56
Suspicious files
9
Text files
22
Unknown types
20

Dropped files

PID
Process
Filename
Type
3076healastounding.exeC:\Users\admin\AppData\Roaming\test.exeexecutable
MD5:7E50B292982932190179245C60C0B59B
SHA256:A8DDE4E60DB080DFC397D7E312E7E9F18D9C08D6088E8043FEEAE9AB32ABDBB8
3076healastounding.exeC:\Users\admin\AppData\Roaming\gay.exeexecutable
MD5:8EEDC01C11B251481DEC59E5308DCCC3
SHA256:0184983A425FEF55D46B7E0EB729A245730EE26414EBE4B155917C0124A19C2D
33568f1c8b40c7be588389a8d382040b23bb.exeC:\Users\admin\AppData\Local\Temp\Dcvxaamev.exeexecutable
MD5:870D6E5AEF6DEA98CED388CCE87BFBD4
SHA256:6D50833895B2E3EB9D6F879A6436660127C270B6A516CDA0253E56A3D8B7FBA0
3076healastounding.exeC:\Users\admin\AppData\Roaming\Opus.exeexecutable
MD5:759185EE3724D7563B709C888C696959
SHA256:9384798985672C356A8A41BF822443F8EB0D3747BFCA148CE814594C1A894641
3076healastounding.exeC:\Users\admin\AppData\Roaming\a.exeexecutable
MD5:52CFD35F337CA837D31DF0A95CE2A55E
SHA256:5975E737584DDF2601C02E5918A79DAD7531DF0E13DCA922F0525F66BEC4B448
3076healastounding.exeC:\Users\admin\AppData\Roaming\4.exeexecutable
MD5:E6DACE3F577AC7A6F9747B4A0956C8D7
SHA256:8B4B846FE1023FA173AB410E3A5862A4C09F16534E14926878E387092E7FFB63
1908Opus.exeC:\Users\admin\AppData\Roaming\90059C37-1320-41A4-B58D-2B75A9850D2F\run.datbinary
MD5:BF924C130EEAB21A6A5F14CFE7B855C7
SHA256:F84E81C632D69B1924D333FBF832CBEE3304408EAB718C59E0C3E7C5F896D94F
3416RIP_YOUR_PC_LOL.exeC:\Users\admin\AppData\Roaming\Pluto Panel.exeexecutable
MD5:ED666BF7F4A0766FCEC0E9C8074B089B
SHA256:D1330D349BFBD3AEA545FA08EF63339E82A3F4D04E27216ECC4C45304F079264
2368Pluto Panel.exeC:\Users\admin\AppData\Roaming\pid.txttext
MD5:466ACCBAC9A66B805BA50E42AD715740
SHA256:50F33355A7EE09448ECD0E3A6C4FF600E0E15F9545BE01108DC163B36ADF141D
3416RIP_YOUR_PC_LOL.exeC:\Users\admin\AppData\Roaming\22.exeexecutable
MD5:DBF9DAA1707B1037E28A6E0694B33A4B
SHA256:A604A3FF78644533FAC5EE9F198E9C5F2FA1AE2A5828186367A9E00935CFF6B6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
63
TCP/UDP connections
56
DNS requests
38
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2092
gay.exe
GET
200
92.63.107.12:80
http://92.63.107.12/Poll/Phptrack8request/6python7Uploads/Lowtemporarypoll0/public/Proton/0Default/videoflower.php?APDPxlzzzJEssid0YiAYZ1ClAH=t7cM53DwaT&7f528aaf1d498f0ae42141d6f48dd180=ANlFjZjlTZxQTN4gDNzITYxgjNyUWO1EDNwgzYldzMxQTOyMzM3cjY5gjM2QDN0kjMxIjNxQjM&a9982c9e61949b25e6414a873df9509b=ANjBTMkVmNyUDM2UWZ0QmMidTO2M2M1MDOycTZkBzY3MjY5EzN3ImZ&179e5ef963d7209557ce6d2e775acbf9=d1nI5oUejFjQzQ1Y4FjW1x2VihWOtV1Y4ZVWwY0RSdnQYF1Y4xmYwFzRahGeGhleKhlW6ZlRYNGc6FVavpWSvJFWZFlSDxUaJpGTxQzQOl2bqlUd5cVY6pEWadFdtNmdkhlW0ZUbjdkSDxUa0IDZ2VjMhVnVslkNJNUYwY0RVtmSzImaOhVYFp0QMlGNyQmd1ITY1ZFbJZTSDFGMGdUV0ZUbj5mVHJGbSxWSzlUaJZTS5N2dChVU0Z0VaBjTsl0cJlmYzkTbiJXNXZVavpWSFx2ajxmTYZFdGdlWw4EbJNXS5NmdkdVY5J1VZlXOGJGbs12YpZkMal2bqlUeWJzYWFzVZxmUzUVa3NkYzZlbiZTS5pVdGdEV0Z0VaBjTsl0cJNlYoZ1RkpXO5NGb4dVYtJ0UihmSzoldKh0Y29meZl2bql0bShVWRFzVZxmUzUVa3lWS1hHbjNmRUdlQ4VUVUxWRSNGesx0Y4ZEWjpUaPlWTuJGbW12Yq5EbJNXSpFFSCNlT11kaJZTSTRlQKxWSzl0URZHNrlkNJNkW5ZkMilmSYp1bSNjYOp0QMlWRww0TKl2Tpd3RihGZYpVes1mUpdXaJJUOpRVavpWS6ZlbjBnWYFGM1cVUpdXaJVHZzIWd01mYWpUaPlWQWN1TGVEVpdXaJ1EeVJVRKl2Tp1UMUpkSrl0cJN1S2x2RaFjRFl0MrpnSEZURJJnVHR2cGdlWTh2QJVHbFlEb1cVYNVzRYlHexIGcSdFZCJUeOVzY5FlQClXYsJFSihmVtV1bBNlW1lzRhdXOtNmasdFVp9maJpnVtJmdod0Y2p0MZBXMrl0cJlWS2kUejRnRykVaWJjVpdXaJZDawI1djpGT5F0QRdWVGVFRCNUT3FlaORXVUF2ZrNFVVh2UalXOyE1ZrlWVvd3VaBTNXNVavpWSsFzVZ9kVGVFRKNETplURJdXQTx0ZJhlWwIEWZtmRFlkeOdVYvJEWZlHZFlkQktmVnFVbjhmUtJGaSNTVp9maJxWMXl1TWZUVIpUelJiOiEDNhJjMjJDNihDOlZ2Y2ImY5EzY2YmM5EGOzgzY0EGZiwiIyUjNxMWZ4gjZlRWO2IzMkVTOwQmNlZDNkVTM1YjYhNzYldTZxYGOhJiOiYjN2ETZ3ADOllzN3UWMmFjZzIjZjFTZ5UmMlhTYzMGZiwiIhVTYhdDZzEDNycDO4gTYzQDNmFmYjJDM1kTNlJDZ2ITYiF2N0EDOzIiOiQWNiFWM3UTO3ITY5UmZ2kTOjZmNwI2MyMzN2ATN0YTYis3W
RU
text
2.11 Kb
malicious
2884
8f1c8b40c7be588389a8d382040b23bb.exe
GET
—
194.180.174.53:80
http://194.180.174.53/brikitiki
DE
—
—
malicious
2092
gay.exe
GET
200
92.63.107.12:80
http://92.63.107.12/Poll/Phptrack8request/6python7Uploads/Lowtemporarypoll0/public/Proton/0Default/videoflower.php?APDPxlzzzJEssid0YiAYZ1ClAH=t7cM53DwaT&b413d86971fc42e54d3bceda7c50d277=1f7739aa83855b8bf4bc8f883f476c45&a9982c9e61949b25e6414a873df9509b=AN1kzYilDOyMmM5QDZ3AzN2MTMzYGNmZTM4IWYxMjNzYmM3MmZzE2M&APDPxlzzzJEssid0YiAYZ1ClAH=t7cM53DwaT
RU
text
2.11 Kb
malicious
2092
gay.exe
GET
200
92.63.107.12:80
http://92.63.107.12/Poll/Phptrack8request/6python7Uploads/Lowtemporarypoll0/public/Proton/0Default/videoflower.php?APDPxlzzzJEssid0YiAYZ1ClAH=t7cM53DwaT&7f528aaf1d498f0ae42141d6f48dd180=ANlFjZjlTZxQTN4gDNzITYxgjNyUWO1EDNwgzYldzMxQTOyMzM3cjY5gjM2QDN0kjMxIjNxQjM&a9982c9e61949b25e6414a873df9509b=ANjBTMkVmNyUDM2UWZ0QmMidTO2M2M1MDOycTZkBzY3MjY5EzN3ImZ&179e5ef963d7209557ce6d2e775acbf9=d1nI5oUejFjQzQ1Y4FjW1x2VihWOtV1Y4ZVWwY0RSdnQYF1Y4xmYwFzRahGeGhleKhlW6ZlRYNGc6FVavpWSvJFWZFlSDxUaJpGTxQzQOl2bqlUd5cVY6pEWadFdtNmdkhlW0ZUbjdkSDxUa0IDZ2VjMhVnVslkNJNUYwY0RVtmSzImaOhVYFp0QMlGNyQmd1ITY1ZFbJZTSDFGMGdUV0ZUbj5mVHJGbSxWSzlUaJZTS5N2dChVU0Z0VaBjTsl0cJlmYzkTbiJXNXZVavpWSFx2ajxmTYZFdGdlWw4EbJNXS5NmdkdVY5J1VZlXOGJGbs12YpZkMal2bqlUeWJzYWFzVZxmUzUVa3NkYzZlbiZTS5pVdGdEV0Z0VaBjTsl0cJNlYoZ1RkpXO5NGb4dVYtJ0UihmSzoldKh0Y29meZl2bql0bShVWRFzVZxmUzUVa3lWS1hHbjNmRUdlQ4VUVUxWRSNGesx0Y4ZEWjpUaPlWTuJGbW12Yq5EbJNXSpFFSCNlT11kaJZTSTRlQKxWSzl0URZHNrlkNJNkW5ZkMilmSYp1bSNjYOp0QMlWRww0TKl2Tpd3RihGZYpVes1mUpdXaJJUOpRVavpWS6ZlbjBnWYFGM1cVUpdXaJVHZzIWd01mYWpUaPlWQWN1TGVEVpdXaJ1EeVJVRKl2Tp1UMUpkSrl0cJN1S2x2RaFjRFl0MrpnSEZURJJnVHR2cGdlWTh2QJVHbFlEb1cVYNVzRYlHexIGcSdFZCJUeOVzY5FlQClXYsJFSihmVtV1bBNlW1lzRhdXOtNmasdFVp9maJpnVtJmdod0Y2p0MZBXMrl0cJlWS2kUejRnRykVaWJjVpdXaJZDawI1djpGT5F0QRdWVGVFRCNUT3FlaORXVUF2ZrNFVVh2UalXOyE1ZrlWVvd3VaBTNXNVavpWSsFzVZ9kVGVFRKNETplURJdXQTx0ZJhlWwIEWZtmRFlkeOdVYvJEWZlHZFlkQktmVnFVbjhmUtJGaSNTVp9maJxWMXl1TWZUVIpUelJiOiEDNhJjMjJDNihDOlZ2Y2ImY5EzY2YmM5EGOzgzY0EGZiwiIyUjNxMWZ4gjZlRWO2IzMkVTOwQmNlZDNkVTM1YjYhNzYldTZxYGOhJiOiYjN2ETZ3ADOllzN3UWMmFjZzIjZjFTZ5UmMlhTYzMGZiwiIhVTYhdDZzEDNycDO4gTYzQDNmFmYjJDM1kTNlJDZ2ITYiF2N0EDOzIiOiQWNiFWM3UTO3ITY5UmZ2kTOjZmNwI2MyMzN2ATN0YTYis3W
RU
text
2.11 Kb
malicious
2368
Pluto Panel.exe
GET
301
104.16.155.36:80
http://whatismyipaddress.com/
US
—
—
shared
2092
gay.exe
GET
200
92.63.107.12:80
http://92.63.107.12/Poll/Phptrack8request/6python7Uploads/Lowtemporarypoll0/public/Proton/0Default/videoflower.php?APDPxlzzzJEssid0YiAYZ1ClAH=t7cM53DwaT&7f528aaf1d498f0ae42141d6f48dd180=ANlFjZjlTZxQTN4gDNzITYxgjNyUWO1EDNwgzYldzMxQTOyMzM3cjY5gjM2QDN0kjMxIjNxQjM&a9982c9e61949b25e6414a873df9509b=ANjBTMkVmNyUDM2UWZ0QmMidTO2M2M1MDOycTZkBzY3MjY5EzN3ImZ&ad34a48e6d8df718784ff1d749fc05c5=0VfiIiOiEDNhJjMjJDNihDOlZ2Y2ImY5EzY2YmM5EGOzgzY0EGZiwiIyUjNxMWZ4gjZlRWO2IzMkVTOwQmNlZDNkVTM1YjYhNzYldTZxYGOhJiOiYjN2ETZ3ADOllzN3UWMmFjZzIjZjFTZ5UmMlhTYzMGZiwiIhVTYhdDZzEDNycDO4gTYzQDNmFmYjJDM1kTNlJDZ2ITYiF2N0EDOzIiOiQWNiFWM3UTO3ITY5UmZ2kTOjZmNwI2MyMzN2ATN0YTYis3W
RU
text
2.11 Kb
malicious
772
0fd7de5367376231a788872005d7ed4f.exe
GET
200
54.91.59.199:80
http://api.ipify.org/?format=xml
US
text
13 b
shared
2092
gay.exe
GET
200
92.63.107.12:80
http://92.63.107.12/Poll/Phptrack8request/6python7Uploads/Lowtemporarypoll0/public/Proton/0Default/videoflower.php?APDPxlzzzJEssid0YiAYZ1ClAH=t7cM53DwaT&7f528aaf1d498f0ae42141d6f48dd180=ANlFjZjlTZxQTN4gDNzITYxgjNyUWO1EDNwgzYldzMxQTOyMzM3cjY5gjM2QDN0kjMxIjNxQjM&a9982c9e61949b25e6414a873df9509b=ANjBTMkVmNyUDM2UWZ0QmMidTO2M2M1MDOycTZkBzY3MjY5EzN3ImZ&d1e7b4781b4cb2b6aa49613b1a4398b8=d1nIhZWYmljZ4cjMkJDM2kDOwYGO2MjYlRDZxITZyQDZwQmYkRTYlVjZxIiOiYjN2ETZ3ADOllzN3UWMmFjZzIjZjFTZ5UmMlhTYzMGZiwiIhVTYhdDZzEDNycDO4gTYzQDNmFmYjJDM1kTNlJDZ2ITYiF2N0EDOzIiOiQWNiFWM3UTO3ITY5UmZ2kTOjZmNwI2MyMzN2ATN0YTYis3W&ad34a48e6d8df718784ff1d749fc05c5=d1nIiojIxQTYyIzYyQjY4gTZmNmNiJWOxMmNmJTOhhzM4MGNhRmIsISYmFmZ5YGO3IDZyAjN5gDMmhjNzIWZ0QWMyUmM0QGMkJGZ0EWZ1YWMiojI2YjNxU2NwgTZ5czNlFjZxY2MyY2YxUWOlJTZ4E2MjRmIsISY1EWY3Q2MxQjM3gDO4E2M0QjZhJ2YyATN5UTZyQmNyEmYhdDNxgzMiojIkVjYhFzN1kzNyEWOlZmN5kzYmZDMiNjMzcjNwUDN2EmI7xSfiElZ5oUaUl2bqlEeVdlTxk0RNhmWq5EeZR0ToZEVPFzY6lVNBpWTw0kaOBTSH10MVdVT4lkaNJzYU50dVpmWxk0QMlGNrlkNJlWT00ERPpXVE10dFd1TpJVbaJTQ6lFNrRkW4V0RPhmUtp1dJ1mWs5EVZlmQqplaWdkW5tmaNl2dpl0TKl2TpFFVNlmQUl1aKJjTwsGROFTVX1EeZdlWq5EVPVTQq5UaadlW3llMNFTVq10aKRkW5FkeNd3Yql0cJlGVp9maJJTRt1UbapmTw0EROxmTqplMFR1T0EVbNFTW6lFbopXTrp0VNBTRUlFeFR0TrJFVaJTRX9UMJNETpRzaJZTS55UMVRkW00kaOpXRX1ENFdVTzkEVNFTWHp1dRRkWzEVbZRTSU9kenpXTtpEVZl3Z61EbkRkTpdXaJ9kSp9UanRUTopkMZd3Zq1kaaRkTxcmeOpmTt5UasRlT4VFROJTQUplMjRlTohGVaVTSX90MFRVWqJlaJNXSpRVavpWSpZ1VZhGaE9UaCRUToJlMONTSH50dFdlWwMmeNVTWq1EeJpWTxUUbOFTRU50aSdlWxkFVZ1mSDxUa0sWS2kUaOBTRXlFaOdVTzMmaZJTQ6lFMBR1T5tGVNJzaq1ENFJjT4VUbaxGaEpFMJRlT5VERapmSUpVa3lWSPpUaPlWSq5EeFJTTqZUbNdXSyk1dZRkWsZ0VZRTT61UbSd1T10ERNlmQq1UbkR0T3V1ROlXQEpFbK1WSzlUaUl2bqlkeBpmWzkkMZpmQ65EMNpWTtZFVa1GaE10aKdlT6FERaFTSU1ENrRUT5VkeZpmVH1kMNpnTyk0QMlGNrlkNJNkW5VkMZd3Yqp1aGR1TqpERPpmQ6lVMBpXW0UkMOlXTU9UbadkTzMGVaFTUU5UNNJTTpp0VNl2dpl0TKl2TpVlaNtmVyklaKRkT4V0VNFTWqlleNpnT1UkaONzaqllMZpmTyUUbatGbq5Eba1mWyU0RPxmRql0cJlGVp9maJ1mTqpFbKpmWr5UbaVzZqlVaCpWTrZ0VZdXVy40MnpXW4l0RalXSE9UMJdVT1cmaNFTUE1UaKNETpRzaJZTSplFMR1WW1EkeZ1mRykVNVRlW6V1VOpXRHpFbOdkWoJVbN1GbU1UNF1mTtRmaZFTSy0UaKpmWpdXaJ9kSp9UaFJjTwkleOFzZU9EMrpmTqp1VNRTTX10dRdUT5NGVZNTT61EaaR0TxsGVZlGbU90MVRkTrpUbJNXSpRVavpWSspkaaBTQ61kaGRUTs50RaNTV65UeZRVWtJkaaRzZU5kMFJjTphmaNdXSX1UeVpWT6FkaalXSDxUa0sWS2k0UPhmRt5EeBRlTtxGVaNzZ65ENZpWW0k1RPFTVqpleVdVTxsmaOBzZU9UeFpmTykEROhmVy0Ua3lWSPpUaPlWUql1MV1WWqZ1VNpmV61kMBpnTrxGVNpmSH9UbSdkTyklMNhXTUpVeVRVTzkFVNRTWH90MnpWS3AnaJhmUYlVRShUZsp0QMlWSYpVe5ckY3hGWSdWUYpVdKhlWwUzVTdGMDlkdFpXT5lEVNZTUzMmdodkYo5kMiNXO5xkNBhEZwgWbJZTS5RmdS1mYwRmRWRkRrl0cJlGVp9maJRnRykVaWJjV6xWbJNXSTdVavpWSsVjMi9mQzIWeOdVYO5EWhl2dplkNoBjU3NmaMlXQDF1ZVZUVEJ0QNdXUq5EdVRVYnt2UUVFaTpVe5ITUntWaV92dXpFM1c1Up9maJxWMXl1TWZUVEp0QMlWSFl0dBNFTnlEWaBjQYl1aGVUS650Vh9mQYlVekVUSCR2aWdWUtNGaS1mYoJ1MVl2bqlEbxcVWPZlRVhkSDxUa0sWS2kUaiBXMHplQOhVYpdXaJl2bqlESGVkVpdXaJBDbtF1ZJpXTnd3VZVXOXFmeOhlWtlTbjFlQ550ZNNDZ2JVbiBHZslkNJl2YspFbiBHZsl0cw4WS1lzRaVXOHRldVd0Y2pEWkZkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS0lzRa5WNXFGTCNkWsJFWhVnVGlEdBNkWsxWbaBnTXp1dOhUSwkTbUl2bqlkbKNjYpdXaJp3aE1UdBRFTzFlaOhXVqxEeVpWS2kUeZZHetl0cJlWUIpUaPl2auNGM1cFZ25UbJNXSDpVdGdkYuVzVSl2bqlUd5cVYuZVbjl2dplUd5ckW1lzRUl2bqlUNShVYqp0QMlWT65UdrpmT1lEVPhHNT5ENFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETpVFVNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEDNhJjMjJDNihDOlZ2Y2ImY5EzY2YmM5EGOzgzY0EGZiwiI2UmY4gTMlVWYxIjNwEGMkJDMkhDMmFmY5UGNjdzM2IGO0ETOhJGM5IiOiYjN2ETZ3ADOllzN3UWMmFjZzIjZjFTZ5UmMlhTYzMGZiwiIhVTYhdDZzEDNycDO4gTYzQDNmFmYjJDM1kTNlJDZ2ITYiF2N0EDOzIiOiQWNiFWM3UTO3ITY5UmZ2kTOjZmNwI2MyMzN2ATN0YTYis3W
RU
text
104 b
malicious
2092
gay.exe
GET
200
92.63.107.12:80
http://92.63.107.12/Poll/Phptrack8request/6python7Uploads/Lowtemporarypoll0/public/Proton/0Default/videoflower.php?APDPxlzzzJEssid0YiAYZ1ClAH=t7cM53DwaT&7f528aaf1d498f0ae42141d6f48dd180=ANlFjZjlTZxQTN4gDNzITYxgjNyUWO1EDNwgzYldzMxQTOyMzM3cjY5gjM2QDN0kjMxIjNxQjM&a9982c9e61949b25e6414a873df9509b=ANjBTMkVmNyUDM2UWZ0QmMidTO2M2M1MDOycTZkBzY3MjY5EzN3ImZ&d1e7b4781b4cb2b6aa49613b1a4398b8=d1nIhZWYmljZ4cjMkJDM2kDOwYGO2MjYlRDZxITZyQDZwQmYkRTYlVjZxIiOiYjN2ETZ3ADOllzN3UWMmFjZzIjZjFTZ5UmMlhTYzMGZiwiIhVTYhdDZzEDNycDO4gTYzQDNmFmYjJDM1kTNlJDZ2ITYiF2N0EDOzIiOiQWNiFWM3UTO3ITY5UmZ2kTOjZmNwI2MyMzN2ATN0YTYis3W&ad34a48e6d8df718784ff1d749fc05c5=d1nIiojIxQTYyIzYyQjY4gTZmNmNiJWOxMmNmJTOhhzM4MGNhRmIsISYmFmZ5YGO3IDZyAjN5gDMmhjNzIWZ0QWMyUmM0QGMkJGZ0EWZ1YWMiojI2YjNxU2NwgTZ5czNlFjZxY2MyY2YxUWOlJTZ4E2MjRmIsISY1EWY3Q2MxQjM3gDO4E2M0QjZhJ2YyATN5UTZyQmNyEmYhdDNxgzMiojIkVjYhFzN1kzNyEWOlZmN5kzYmZDMiNjMzcjNwUDN2EmI7xSfiADWmlGNrlkNJNVTsZFVOlmQUllMZRVTycGVZh3aU50MNd1T3lEROpXWE5UaCpnTsZEVNlXSq50MVRUTxk1VOl2dpl0TKl2TplERPp3Z61UMBRUToxmaZtmWt50dNd0T1E1VNhGaUl1aadUTpp1VapXRtl1dZJTWsJVbNVTSql0cJlGVp9maJBTRql1dFdkWpRGROVTUU5EbGRVTtZlMZp3aU90dZpWWtZ1RN1mTU5UMJRkW5FVbNdXTE10MJNETpRzaJZTSp5EaKpmWykFROpXUUpleZ1mT4tGRPtmSU5kMNdlW00ERalmRE5EeFdVT4dGRaBTVt5EasRlTpdXaJ9kSp9UajRlTxE1RPpXW61EaGR0ToZkeOlXRU5UbSdUTwElMOtmSH9UerpXT00kaalXRt1ENNRlWzElaJNXSpRVavpWS0EEVZlmTH1ENJpXWyEFVORzY6llaapWW1UFVNFTUq50dV1mTzUFVZRTVX9UaspnT4VkMZBTSDxUa0sWS2kUaZxmRXlFNnpWW3FEVZtGZ65UaSRUToZ1RONTTU9kMJRVT5lEVOhmWU5EeVRkWrZ1VOJTRtpVa3lWSPpUaPlWWE5EaGdVWqZkeONTSt50dNdkT3tmaNVTRq5UNJR0ToRGVNhmWXpFNRdkT5VlaNhXUykVeV1WSzlUaUl2bqlUeZRVTo5keZhmSE1UaOdUTyE1VahmRH9keNpmWrxGVPpXQql1dJpmWzcGRNxmUq10dRdlWpp0QMlGNrlkNJlXT3llMOlmTyk1djRkT6lkaaFTVtpFNBRkWpZleNdXUX5UeFR0T1EkaNhXTykFbCpmT6NmaOl2dpl0TKl2TpFVbNhmTH10MZdkW4tmeZl3Z6l1dNdlT310RPhGZq1kerpmWtJleONTVX5EMVR1Tq5kaZlmRql0cJlGVp9maJFTSEpFbOJTW5FFVNhmRU5kMJJTT6NGVPhXW65UNJ1mTyklaOhmWHpVNZRlWtpVbOhGaUpFeJNETpRzaJZTSppleZdlW5l1RapmWX9ENJ1WW3lERahmRH1EbkpnT000VNlmUt1UenRlTpZEVPRTSU5EMBpWWpdXaJ9kSp9UaJdkTrp0VPdXTtpFaOd1TxUlMNxmV61EaSdlWqJ1VZtmSqpVNFR1ToplaaNTSX5UaOpWW5lVbJNXSpRVavpWSoRGROJzYU5ENrRkT1kleZ1mRE9kaGRUTrJkaNNTRy4keNRVWycGVOVTRtlVNrpnTxEFRalmSDxUa0sWS2k0UalXWH50dNpXW4FEVapmUy4UMjpWTyUUbadXWH9ENVpmToRmaZRTSE1UaGpWTxkkeNdXWt1Ua3lWSPpUaPl2aUlFaaRVT3VlaaVTVy4ENjR0Tyk0RP1GaU5UMZJTTsZEVOVTWE5ENrpWT4llaOlXUUlFbOpWSzlUaUl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0kUelZTSTlFMGdkUwgGWal2dplUeW12Y2h3RjRjVFlEMW1mY5Z1RkVHbFlEdBNkWsxGWZNnQzMGcSdUSsp0RJBDbKdWa3cVWqJ0Ua5mRHN2ZNhVYvJFbJZTS5RmdS1mYwRmRWRkRrl0cJlGVp9maJRnRykVaWJjV6xWbJNXSTdVavpWSsVjMi9mQzIWeOdVYO5EWhl2dplkNoBjU3NmaMlXQDF1ZVZUVEJ0QNdXUq5EdVRVYnt2UUVFaTpVe5ITUntWaV92dXpFM1c1Up9maJxWMXl1TWZUVEp0QMlWSFl0dBNFTnlEWaBjQYl1aGVUS650Vh9mQYlVekVUSCR2aWdWUtNGaS1mYoJ1MVl2bqlEbxcVWPZlRVhkSDxUa0sWS2kUaiBXMHplQOhVYpdXaJl2bqlESGVkVpdXaJBDbtF1ZJpXTnd3VZVXOXFmeOhlWtlTbjFlQ550ZNNDZ2JVbiBHZslkNJl2YspFbiBHZsl0cw4WS1lzRaVXOHRldVd0Y2pEWkZkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS0lzRa5WNXFGTCNkWsJFWhVnVGlEdBNkWsxWbaBnTXp1dOhUSwkTbUl2bqlkbKNjYpdXaJp3aE1UdBRFTzFlaOhXVqxEeVpWS2kUeZZHetl0cJlWUIpUaPl2auNGM1cFZ25UbJNXSDpVdGdkYuVzVSl2bqlUd5cVYuZVbjl2dplUd5ckW1lzRUl2bqlUNShVYqp0QMlWT65UdrpmT1lEVPhHNT5ENFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETpVFVNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEDNhJjMjJDNihDOlZ2Y2ImY5EzY2YmM5EGOzgzY0EGZiwiI2UmY4gTMlVWYxIjNwEGMkJDMkhDMmFmY5UGNjdzM2IGO0ETOhJGM5IiOiYjN2ETZ3ADOllzN3UWMmFjZzIjZjFTZ5UmMlhTYzMGZiwiIhVTYhdDZzEDNycDO4gTYzQDNmFmYjJDM1kTNlJDZ2ITYiF2N0EDOzIiOiQWNiFWM3UTO3ITY5UmZ2kTOjZmNwI2MyMzN2ATN0YTYis3W
RU
text
104 b
malicious
2092
gay.exe
GET
200
92.63.107.12:80
http://92.63.107.12/Poll/Phptrack8request/6python7Uploads/Lowtemporarypoll0/public/Proton/0Default/videoflower.php?APDPxlzzzJEssid0YiAYZ1ClAH=t7cM53DwaT&7f528aaf1d498f0ae42141d6f48dd180=ANlFjZjlTZxQTN4gDNzITYxgjNyUWO1EDNwgzYldzMxQTOyMzM3cjY5gjM2QDN0kjMxIjNxQjM&a9982c9e61949b25e6414a873df9509b=ANjBTMkVmNyUDM2UWZ0QmMidTO2M2M1MDOycTZkBzY3MjY5EzN3ImZ&d1e7b4781b4cb2b6aa49613b1a4398b8=d1nIhZWYmljZ4cjMkJDM2kDOwYGO2MjYlRDZxITZyQDZwQmYkRTYlVjZxIiOiYjN2ETZ3ADOllzN3UWMmFjZzIjZjFTZ5UmMlhTYzMGZiwiIhVTYhdDZzEDNycDO4gTYzQDNmFmYjJDM1kTNlJDZ2ITYiF2N0EDOzIiOiQWNiFWM3UTO3ITY5UmZ2kTOjZmNwI2MyMzN2ATN0YTYis3W&ad34a48e6d8df718784ff1d749fc05c5=d1nIiojIxQTYyIzYyQjY4gTZmNmNiJWOxMmNmJTOhhzM4MGNhRmIsISYmFmZ5YGO3IDZyAjN5gDMmhjNzIWZ0QWMyUmM0QGMkJGZ0EWZ1YWMiojI2YjNxU2NwgTZ5czNlFjZxY2MyY2YxUWOlJTZ4E2MjRmIsISY1EWY3Q2MxQjM3gDO4E2M0QjZhJ2YyATN5UTZyQmNyEmYhdDNxgzMiojIkVjYhFzN1kzNyEWOlZmN5kzYmZDMiNjMzcjNwUDN2EmI7xSfiElZ5oUaUl2bqlEeVdlTxk0RNhmWq5EeZR0ToZEVPFzY6lVNBpWTw0kaOBTSH10MVdVT4lkaNJzYU50dVpmWxk0QMlGNrlkNJlWT00ERPpXVE10dFd1TpJVbaJTQ6lFNrRkW4V0RPhmUtp1dJ1mWs5EVZlmQqplaWdkW5tmaNl2dpl0TKl2TpFFVNlmQUl1aKJjTwsGROFTVX1EeZdlWq5EVPVTQq5UaadlW3llMNFTVq10aKRkW5FkeNd3Yql0cJlGVp9maJJTRt1UbapmTw0EROxmTqplMFR1T0EVbNFTW6lFbopXTrp0VNBTRUlFeFR0TrJFVaJTRX9UMJNETpRzaJZTS55UMVRkW00kaOpXRX1ENFdVTzkEVNFTWHp1dRRkWzEVbZRTSU9kenpXTtpEVZl3Z61EbkRkTpdXaJ9kSp9UanRUTopkMZd3Zq1kaaRkTxcmeOpmTt5UasRlT4VFROJTQUplMjRlTohGVaVTSX90MFRVWqJlaJNXSpRVavpWSpZ1VZhGaE9UaCRUToJlMONTSH50dFdlWwMmeNVTWq1EeJpWTxUUbOFTRU50aSdlWxkFVZ1mSDxUa0sWS2kUaOBTRXlFaOdVTzMmaZJTQ6lFMBR1T5tGVNJzaq1ENFJjT4VUbaxGaEpFMJRlT5VERapmSUpVa3lWSPpUaPlWSq5EeFJTTqZUbNdXSyk1dZRkWsZ0VZRTT61UbSd1T10ERNlmQq1UbkR0T3V1ROlXQEpFbK1WSzlUaUl2bqlkeBpmWzkkMZpmQ65EMNpWTtZFVa1GaE10aKdlT6FERaFTSU1ENrRUT5VkeZpmVH1kMNpnTyk0QMlGNrlkNJNkW5VkMZd3Yqp1aGR1TqpERPpmQ6lVMBpXW0UkMOlXTU9UbadkTzMGVaFTUU5UNNJTTpp0VNl2dpl0TKl2TpVlaNtmVyklaKRkT4V0VNFTWqlleNpnT1UkaONzaqllMZpmTyUUbatGbq5Eba1mWyU0RPxmRql0cJlGVp9maJ1mTqpFbKpmWr5UbaVzZqlVaCpWTrZ0VZdXVy40MnpXW4l0RalXSE9UMJdVT1cmaNFTUE1UaKNETpRzaJZTSplFMR1WW1EkeZ1mRykVNVRlW6V1VOpXRHpFbOdkWoJVbN1GbU1UNF1mTtRmaZFTSy0UaKpmWpdXaJ9kSp9UaFJjTwkleOFzZU9EMrpmTqp1VNRTTX10dRdUT5NGVZNTT61EaaR0TxsGVZlGbU90MVRkTrpUbJNXSpRVavpWSspkaaBTQ61kaGRUTs50RaNTV65UeZRVWtJkaaRzZU5kMFJjTphmaNdXSX1UeVpWT6FkaalXSDxUa0sWS2k0UPhmRt5EeBRlTtxGVaNzZ65ENZpWW0k1RPFTVqpleVdVTxsmaOBzZU9UeFpmTykEROhmVy0Ua3lWSPpUaPlWUql1MV1WWqZ1VNpmV61kMBpnTrxGVNpmSH9UbSdkTyklMNhXTUpVeVRVTzkFVNRTWH90MnpWS3AnaJhmUYlVRShUZsp0QMlWSYpVe5ckY3hGWSdWUYpVdKhlWwUzVTdGMDlkdFpXT5lEVNZTUzMmdodkYo5kMiNXO5xkNBhEZwgWbJZTS5RmdS1mYwRmRWRkRrl0cJlGVp9maJRnRykVaWJjV6xWbJNXSTdVavpWSsVjMi9mQzIWeOdVYO5EWhl2dplkNoBjU3NmaMlXQDF1ZVZUVEJ0QNdXUq5EdVRVYnt2UUVFaTpVe5ITUntWaV92dXpFM1c1Up9maJxWMXl1TWZUVEp0QMlWSFl0dBNFTnlEWaBjQYl1aGVUS650Vh9mQYlVekVUSCR2aWdWUtNGaS1mYoJ1MVl2bqlEbxcVWPZlRVhkSDxUa0sWS2kUaiBXMHplQOhVYpdXaJl2bqlESGVkVpdXaJBDbtF1ZJpXTnd3VZVXOXFmeOhlWtlTbjFlQ550ZNNDZ2JVbiBHZslkNJl2YspFbiBHZsl0cw4WS1lzRaVXOHRldVd0Y2pEWkZkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS0lzRa5WNXFGTCNkWsJFWhVnVGlEdBNkWsxWbaBnTXp1dOhUSwkTbUl2bqlkbKNjYpdXaJp3aE1UdBRFTzFlaOhXVqxEeVpWS2kUeZZHetl0cJlWUIpUaPl2auNGM1cFZ25UbJNXSDpVdGdkYuVzVSl2bqlUd5cVYuZVbjl2dplUd5ckW1lzRUl2bqlUNShVYqp0QMlWT65UdrpmT1lEVPhHNT5ENFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETpVFVNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiEDNhJjMjJDNihDOlZ2Y2ImY5EzY2YmM5EGOzgzY0EGZiwiI2UmY4gTMlVWYxIjNwEGMkJDMkhDMmFmY5UGNjdzM2IGO0ETOhJGM5IiOiYjN2ETZ3ADOllzN3UWMmFjZzIjZjFTZ5UmMlhTYzMGZiwiIhVTYhdDZzEDNycDO4gTYzQDNmFmYjJDM1kTNlJDZ2ITYiF2N0EDOzIiOiQWNiFWM3UTO3ITY5UmZ2kTOjZmNwI2MyMzN2ATN0YTYis3W
RU
text
104 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2368
Pluto Panel.exe
104.16.155.36:80
whatismyipaddress.com
Cloudflare Inc
US
shared
2884
8f1c8b40c7be588389a8d382040b23bb.exe
194.180.174.53:80
—
—
DE
malicious
1908
Opus.exe
172.98.92.42:58491
—
Total Server Solutions L.L.C.
US
malicious
4036
a.exe
185.82.202.246:81
yabynennet.xyz
Host Sailor Ltd.
NL
malicious
772
0fd7de5367376231a788872005d7ed4f.exe
54.91.59.199:80
api.ipify.org
Amazon.com, Inc.
US
malicious
2368
Pluto Panel.exe
104.16.155.36:443
whatismyipaddress.com
Cloudflare Inc
US
shared
2264
HD____11.19.exe
59.56.110.231:8898
—
Fuzhou
CN
unknown
772
0fd7de5367376231a788872005d7ed4f.exe
80.87.192.115:80
—
JSC ISPsystem
RU
malicious
3816
mediaget.exe
37.201.193.214:1470
kazya1.hopto.org
Liberty Global Operations B.V.
DE
malicious
3156
22.exe
222.99.11.146:80
22ssh.com
Korea Telecom
KR
malicious

DNS requests

Domain
IP
Reputation
pretorian.ac.ug
  • —
malicious
prepepe.ac.ug
  • —
malicious
whatismyipaddress.com
  • 104.16.155.36
  • 104.16.154.36
shared
yabynennet.xyz
  • 185.82.202.246
malicious
22ssh.com
  • 222.99.11.146
malicious
api.ipify.org
  • 54.91.59.199
  • 52.20.78.240
  • 3.232.242.170
  • 3.220.57.224
shared
hackerinvasion.f3322.net
  • 127.0.0.1
malicious
gfhhjgh.duckdns.org
  • 179.13.1.253
malicious
api.ip.sb
  • 172.67.75.172
  • 104.26.12.31
  • 104.26.13.31
whitelisted
kazya1.hopto.org
  • 37.201.193.214
malicious

Threats

PID
Process
Class
Message
2368
Pluto Panel.exe
Potential Corporate Privacy Violation
ET POLICY Known External IP Lookup Service Domain in SNI
2368
Pluto Panel.exe
Potential Corporate Privacy Violation
ET POLICY Known External IP Lookup Service Domain in SNI
772
0fd7de5367376231a788872005d7ed4f.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup (ipify .org)
—
—
Misc activity
ET INFO DYNAMIC_DNS Query to *.duckdns. Domain
2092
gay.exe
A Network Trojan was detected
ET TROJAN DCRAT Activity (GET)
—
—
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.hopto .org
2092
gay.exe
A Network Trojan was detected
ET TROJAN Win32/DCRat CnC Exfil
3740
aaa.exe
A Network Trojan was detected
ET TROJAN Fareit/Pony Downloader Checkin 2
3740
aaa.exe
Potential Corporate Privacy Violation
ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System
3740
aaa.exe
A Network Trojan was detected
ET TROJAN Pony Downloader HTTP Library MSIE 5 Win98
69 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
RIP_YOUR_PC_LOL.exe