File name:

SQL Dumper v 8.5.zip

Full analysis: https://app.any.run/tasks/a4be4933-8da0-4e1c-824f-3c7c0c70570f
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: November 13, 2023, 13:04:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
backdoor
dcrat
remote
stealer
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

7FEC911D075E52605BEEFF600771A703

SHA1:

94779FEFAED981E0EBA8F67AEC481B5F62956C90

SHA256:

FF438D82C97F29DFD30CE86CDE6501FEFA4B075570DEFA2A20B9ECA189F54D1F

SSDEEP:

98304:tbmrB50q0CI+H66M0ghDcUbweNAsL+tOJmOG1JUsXeP2SldOFl0TN6Z8JM5uUTUl:jTBW3bdv/G

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • SQLi Dumper v8.5.exe (PID: 3456)
      • System32.exe (PID: 3220)

    • Create files in the Startup directory

      • System32.exe (PID: 3220)

    • Connects to the CnC server

      • Microsoft.exe (PID: 2928)

    • Steals credentials from Web Browsers

      • Microsoft.exe (PID: 2928)

    • DCRAT has been detected (SURICATA)

      • Microsoft.exe (PID: 2928)

    • DCRAT has been detected (YARA)

      • Microsoft.exe (PID: 2928)

    • Steals credentials

      • Microsoft.exe (PID: 2928)

    • UAC/LUA settings modification

      • Microsoft.exe (PID: 2928)

    • Actions looks like stealing of personal data

      • Microsoft.exe (PID: 2928)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • WinRAR.exe (PID: 3376)

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 3376)

    • Reads the Internet Settings

      • SQLi Dumper v8.5.exe (PID: 3456)
      • Microsoft.exe (PID: 2928)

    • Starts CMD.EXE for commands execution

      • SQLi Dumper v8.5.exe (PID: 3456)
      • Microsoft.exe (PID: 2928)

    • Reads settings of System Certificates

      • Microsoft.exe (PID: 2928)

    • Probably delay the execution using 'w32tm.exe'

      • cmd.exe (PID: 3992)

    • Reads browser cookies

      • Microsoft.exe (PID: 2928)

    • Loads DLL from Mozilla Firefox

      • Microsoft.exe (PID: 2928)

    • Executing commands from a ".bat" file

      • Microsoft.exe (PID: 2928)

    • Connects to the server without a host name

      • Microsoft.exe (PID: 2928)

  • INFO

    • Checks supported languages

      • SQLi Dumper v8.5.exe (PID: 3456)
      • Microsoft.exe (PID: 2928)
      • System32.exe (PID: 3220)

    • Create files in a temporary directory

      • SQLi Dumper v8.5.exe (PID: 3456)
      • Microsoft.exe (PID: 2928)

    • Reads the computer name

      • SQLi Dumper v8.5.exe (PID: 3456)
      • System32.exe (PID: 3220)
      • Microsoft.exe (PID: 2928)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 3376)

    • Creates files or folders in the user directory

      • System32.exe (PID: 3220)

    • Reads the machine GUID from the registry

      • System32.exe (PID: 3220)
      • Microsoft.exe (PID: 2928)

    • Reads Environment values

      • Microsoft.exe (PID: 2928)

    • Reads product name

      • Microsoft.exe (PID: 2928)

    • Process checks are UAC notifies on

      • Microsoft.exe (PID: 2928)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

DcRat

(PID) Process(2928) Microsoft.exe
C2 (1)https://pastebin.com/raw/LWvs8stk
Options
MutexDCR_MUTEX-SXhglnzOTZk9uvwyAXEf
savebrowsersdatatosinglefilefalse
ignorepartiallyemptydatafalse
cookiestrue
passwordstrue
formstrue
cctrue
historyfalse
telegramtrue
steamtrue
discordtrue
filezillatrue
screenshottrue
clipboardtrue
sysinfotrue
searchpath%UsersFolder% - Fast
Targetru
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2023:11:11 15:57:04
ZipCRC: 0x8ca18770
ZipCompressedSize: 137049
ZipUncompressedSize: 316416
ZipFileName: dxdiagn.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
7
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs sqli dumper v8.5.exe no specs system32.exe #DCRAT microsoft.exe cmd.exe no specs cmd.exe no specs w32tm.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2904"C:\Windows\system32\cmd.exe" /c del "C:\Users\admin\AppData\Local\Temp\Rar$EXa3376.15874\SQLi Dumper v8.5.exe" >> NULC:\Windows\System32\cmd.exe—SQLi Dumper v8.5.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2928"C:\Users\admin\AppData\Local\Temp\Microsoft.exe" C:\Users\admin\AppData\Local\Temp\Microsoft.exe
SQLi Dumper v8.5.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225547
Version:
5.15.2.0
Modules
Images
c:\users\admin\appdata\local\temp\microsoft.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
DcRat
(PID) Process(2928) Microsoft.exe
C2 (1)https://pastebin.com/raw/LWvs8stk
Options
MutexDCR_MUTEX-SXhglnzOTZk9uvwyAXEf
savebrowsersdatatosinglefilefalse
ignorepartiallyemptydatafalse
cookiestrue
passwordstrue
formstrue
cctrue
historyfalse
telegramtrue
steamtrue
discordtrue
filezillatrue
screenshottrue
clipboardtrue
sysinfotrue
searchpath%UsersFolder% - Fast
Targetru
3220"C:\Users\admin\AppData\Local\Temp\System32.exe" C:\Users\admin\AppData\Local\Temp\System32.exe
SQLi Dumper v8.5.exe
User:
admin
Company:
Microsoft 1989-2023
Integrity Level:
MEDIUM
Description:
System32
Exit code:
0
Version:
12.6.12.6
Modules
Images
c:\users\admin\appdata\local\temp\system32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3376"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\SQL Dumper v 8.5.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3456"C:\Users\admin\AppData\Local\Temp\Rar$EXa3376.15874\SQLi Dumper v8.5.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3376.15874\SQLi Dumper v8.5.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3376.15874\sqli dumper v8.5.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3972w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 C:\Windows\System32\w32tm.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Time Service Diagnostic Tool
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\w32tm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3992C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\pvvx2o8qhw.bat" "C:\Windows\System32\cmd.exe—Microsoft.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
6 038
Read events
5 993
Write events
45
Delete events
0

Modification events

(PID) Process:(3376) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(3376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(3376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(3376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3376) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
8
Suspicious files
25
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
3456SQLi Dumper v8.5.exeC:\Users\admin\AppData\Local\Temp\System32.exeexecutable
MD5:2EFE3845E4F5AF06520A814F8DD17991
SHA256:B68340976D8736507AEDFED85CCE9D6C0A158EE9ECBC54473921D0DB04062724
3376WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3376.15874\eapp3hst.dllexecutable
MD5:12BF0E1F71E2EA1A52B5D1723F87BD16
SHA256:A668165F00276FA4FEFE3F10A04E5D42FD60683CF7664C6D741F6EDF2943BD4C
3456SQLi Dumper v8.5.exeC:\Users\admin\AppData\Local\Temp\Microsoft.exeexecutable
MD5:40F67FCDFA54779C715D7056C9B53E85
SHA256:8634047C7A8B0AB06D55D569EA430A379C559FD7A05DBE210E993A0D948DC58C
3376WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3376.15874\SQLi Dumper v8.5.exeexecutable
MD5:F5049E4D9B1AD4D39F86FCE0F86EB6C5
SHA256:A118F2B71C68978113711187D2F055CB0D86148BA7628241B56403FFDD70FF0F
3376WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3376.15874\eapphost.dllexecutable
MD5:7F9AEC82D7480068C6D444D4FD8FB36F
SHA256:E697AA951AA9E49988DF3C984FC5426D267D7BBC9DB83670E3C1F34DA95095F9
3376WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3376.15874\NlsData0026.dllexecutable
MD5:A08FF320A2BD98F9982B2B91F57D7881
SHA256:D175F3C196BAFA05D18424490BFCF2DF7A93341608DF67B808DCED5EE7CEC668
3220System32.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\System32.exeexecutable
MD5:2EFE3845E4F5AF06520A814F8DD17991
SHA256:B68340976D8736507AEDFED85CCE9D6C0A158EE9ECBC54473921D0DB04062724
2928Microsoft.exeC:\Users\admin\AppData\Local\Temp\1uZF0YiNvebinary
MD5:A5B55EF875A290F8739655274B5CFAE6
SHA256:3C6E069A7DF07EE5ECA265821545BD9B5A0BE65DCA21805D42B10133D12916CF
2928Microsoft.exeC:\Users\admin\AppData\Local\Temp\p6of5sEv6Tbinary
MD5:A5B55EF875A290F8739655274B5CFAE6
SHA256:3C6E069A7DF07EE5ECA265821545BD9B5A0BE65DCA21805D42B10133D12916CF
2928Microsoft.exeC:\Users\admin\AppData\Local\Temp\QDYL6TKSqkbinary
MD5:C6BA1CC62D2EB388E2998BEC2D03ABAC
SHA256:F5D028F3C77174AF630C0EF470273754400C49B54AB023AAB9E24A9E32A1EA5C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
8
DNS requests
2
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2928
Microsoft.exe
GET
—
94.131.112.229:80
http://94.131.112.229/b1e57687.php?9wqw6DfNUvaZEhgV5Cc=mAdRNKxcY6jClCs9nEU3L&8d217a380a2b0a4c6866905b74e17a20=kFGZlZ2M1YTYzMWOmVGN1IWO3YWYjdzY5UTO2Q2M0UDOxYGZkRWN2MjN1UDN1EDOzITO1kTN&19c7d55e76eb5f2989514a767abccb1a=gY2kTO4IDN0QmYwMWM0QTNmZWN5MWOlNzNlRGZ3MGZ5gTY4QWN2YjM&000f87d4164c8737a1e81f7f9c9fda31=0VfiIiOiQWY1QzMhVjZ4gTZmZmNmNmZkljYiZmNlFmZyMGOxYWMiwiIkJGZhFDZ4ADNkVTOlZDOwkTMklDNidTYwQmZxAjYiBzMlljM4QDOiJiOiMGOjNDM5AjMjJ2Y4AzYzIGMhFzYldDOxAjYhVTMkJ2YiwiImZmNhJjY4IWMmVWOkR2Y2UmY4YWMkNmZjJWZ4ImZjNGO2QDN5ETNzIiOikTYzIWOiNjZidjZ3QDMiZmYxQTOllTOhZmN3kzMxQWNis3W
unknown
—
—
—
2928
Microsoft.exe
GET
—
94.131.112.229:80
http://94.131.112.229/b1e57687.php?9wqw6DfNUvaZEhgV5Cc=mAdRNKxcY6jClCs9nEU3L&8d217a380a2b0a4c6866905b74e17a20=kFGZlZ2M1YTYzMWOmVGN1IWO3YWYjdzY5UTO2Q2M0UDOxYGZkRWN2MjN1UDN1EDOzITO1kTN&19c7d55e76eb5f2989514a767abccb1a=gY2kTO4IDN0QmYwMWM0QTNmZWN5MWOlNzNlRGZ3MGZ5gTY4QWN2YjM&b302823833ae322b8e9ce4b7812a8d9a=d1nIilDO1YzN5YWYxIGM4IWY1ATO0MjYwUTYwYzNxUmYzQWZ2gTMzEmZ0IiOiMGOjNDM5AjMjJ2Y4AzYzIGMhFzYldDOxAjYhVTMkJ2YiwiImZmNhJjY4IWMmVWOkR2Y2UmY4YWMkNmZjJWZ4ImZjNGO2QDN5ETNzIiOikTYzIWOiNjZidjZ3QDMiZmYxQTOllTOhZmN3kzMxQWNis3W
unknown
—
—
—
2928
Microsoft.exe
GET
200
94.131.112.229:80
http://94.131.112.229/b1e57687.php?9wqw6DfNUvaZEhgV5Cc=mAdRNKxcY6jClCs9nEU3L&8d217a380a2b0a4c6866905b74e17a20=kFGZlZ2M1YTYzMWOmVGN1IWO3YWYjdzY5UTO2Q2M0UDOxYGZkRWN2MjN1UDN1EDOzITO1kTN&19c7d55e76eb5f2989514a767abccb1a=gY2kTO4IDN0QmYwMWM0QTNmZWN5MWOlNzNlRGZ3MGZ5gTY4QWN2YjM&b302823833ae322b8e9ce4b7812a8d9a=d1nIjVmZzQ2YklDNiRmMmJWMmRDMlBDNmdDNkF2Y5cDOiVmM5QTZlVTNiJiOiMGOjNDM5AjMjJ2Y4AzYzIGMhFzYldDOxAjYhVTMkJ2YiwiImZmNhJjY4IWMmVWOkR2Y2UmY4YWMkNmZjJWZ4ImZjNGO2QDN5ETNzIiOikTYzIWOiNjZidjZ3QDMiZmYxQTOllTOhZmN3kzMxQWNis3W&000f87d4164c8737a1e81f7f9c9fda31=d1nIiojIkFWN0MTY1YGO4UmZmZjZjZGZ5ImYmZTZhZmMjhTMmFjIsIyYlZ2MkNGZ5QjYkJjZiFjZ0ATZwQjZ3QDZhNWO3gjYlJTO0UWZ1UjYiojIjhzYzATOwIzYiNGOwM2MiBTYxMWZ3gTMwIWY1EDZiNmIsIiZmZTYyIGOiFjZllDZkNmNlJGOmFDZjZ2YiVGOiZ2YjhjN0QTOxUzMiojI5E2MiljYzYmY3Y2N0AjYmJWM0kTZ5kTYmZzN5MTMkVjI7xSfiElZ5oUaUl2bqlUMFR0T0UVbNNTVE5UaKdkWrpFVZNTVXp1MFpXT1EFVPNTRE50aoRUT3VERNhmVH1keVd0T0k0QMlGNrlkNJNkTxkleZlmT6l1aSRlWxUlaOlGaqlVeJRlWzU0VPVTVH1UejpWWtZkeOVTRH90dJJjT1kFVNl2dpl0TKl2TpdmaNtmTX5EMNJTT1UkMZdXRH1EMNd1T3FVbaxmRU1EaCRVT0U0RN1GZE5EbaRVWoZ0RPhXWtl0cJlGVp9maJlmUEpVasRUTqp1VZpGbU5EbORlWx0EVZtmVyk1aGdkW5l1VPh3aUllMZJjTpZlaZpXSt1UbKNETpRzaJZTSppleZdlW5l1RapmWX9ENJ1WW3lERahmRH1EbkpnT000VNlmUt1UenRlTpZEVPRTSU5EMBpWWpdXaJ9kSp9UarRVWopFVNdXVqpVNVJjT0MGRPJTSH9UboRlTxklMNxmRU5UNZRkT0smaNhXWq5UeRRVWs5kaJNXSpRVavpWSspkaaBTQ61kaGRUTs50RaNTV65UeZRVWtJkaaRzZU5kMFJjTphmaNdXSX1UeVpWT6FkaalXSDxUa0sWS2k0UZNTUq50MVR0T1EFVPJTTtpFenpXW4FERadXS65EakpXT6VUbORTVU9EaKd1T1MGVOBTUtlVa3lWSPpUaPlWRUpVMVpWW3VUbOJTRq5ENFdVT1UleOpGbE1UeRpXTyElaZd3YUpFeFpWT5lleOFTQU5UbWpWSzlUaUl2bqlUenpXT00EVOdXQUlVNJdkWtpFRNpGaU90aGRVW0U0Ra1mQqlVbWJTTop0RN1mTXp1aKR1T5l0QMlGNrlkNJNkT4l0RNhmUtl1MRR1TwUFVahXRqpFbOJTT1sGRNJTStpFbCpmW6VFVOlXUt10aKRUT6FkeOl2dpl0TKl2TplFVZlXWt5kMRpXTwUlMN1mWU1UNnRkW5VlaOpmVH9keR1WW4FFVNhmRU1ENRdkTspFVZVTVql0cJlGVp9maJNTVU50aopXTy0EVZh3ZUlFejpWT4VlaatmQE50akRkWphmaNVTTE9keZ1WTopERPpXVy4EMJNETpRzaJZTSD90dF1WWqJERPlXTt5EMVR0Tz0kMZJTSX9UMFRlTwkFRNxmW65UMFd0TsxmaZVzYU1EaOdkTpdXaJ9kSp9UaJdlWoZ0RPRTSH10dFdkWzMmaZBTQUlFbSpnT6tmaOlXRq1UeVRVWyUFVNFTUHpFbWpmTopVbJNXSpRVavpWSyEFVZhmRykFejpnTppFRNpmUE1UNJR1T4lFVPl3ZUl1MFRVWtZ1RPtmUq1UMJRVTr5UbNxmSDxUa0sWS2kUaNJTRUlleNdVW5FkaZpmQq50aWdVWohmeNpXWHpVNrpXT3l0RNlXWy4ENBRlWwkERNtmVtlVa3lWSPpUaPlWTE1UbkpWWq50RNNTU61UeZdlTsp1RPdXUtlVMNRUTrZlaNh3ZU90dJRVTq50VadXW610MZpWSzlUaUl2bql0aKRVWqJkeO1mUX1UNN1WT000RNpmVE1kaoRVWzkkeNVTWtpFMjpnTsZFROFza6lleJ1WW4l0QMlGNrlkNJNlT5F1VapmTt1EMFRVW4VlaOlmT610MrRVTyMGVPlmWq5kMZRVWtJ1VPJTVtpVbaRVW0U1VNl2dplUavpWSyUFRaVTTtpVaSRlTrJlaNJTWE90aWRUT3l0VPRTSUlFNVpXTsp1RaRTUq1kaad0TrZlaNVTSDxUaBpWS2k0QNRTUX50aSdUT4FkaNFzZU9EbOdVWrRmaadXVH9EbGdVTo5keOpXWE9UbaRkT1UERaNTQU1Ua3lWSPpUaPlWUql1MV1WWqZ1VNpmV61kMBpnTrxGVNpmSH9UbSdkTyklMNhXTUpVeVRVTzkFVNRTWH90MnpWS3AnaJhmUYlVRShUZsp0QMFzbqlEMWNjYsFzVhVlQYpFb4JTVpdXaJxmWYFGMOdVUp9maJpnVIRGaSNTV1IFWhJDbHRmaGtWSzl0QjBHcuxUM0M0TnlFSJlnVHNGdWhkUndXVVRlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUarxWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S6FUeaVHbHN2dWdEZUJ0QOhXQDJGbSJjYOJUaOd2aIJGcxcVWHJ0QOJzZIt0Zvh0UIJkeOVXSElUQCNlVR5URJdXQE5kMwMlTwJ0UL5kUGtEbKNjYEJ0ULNFaDJGbS5mYKpUaPlWVXJGa1UlVR50aJNXSTtkQ5kGVvFUajxmUINGaSdVUn10MZBHaHNGaKNjUnVEMSdlQDpVeGdkW1Z0RkRlSp9UaVdlYoVTVWFFZrl0cJlGVp9maJVHbXJ2aGBzYwp0QMlWSp9UajVVUVp0QMlWUYF2QClWT6F0QihWNyIGcONzYsplMilnQGl0MBl3YzkzRaVHbyYVavpWS5ZVbWVHbyYVa3NlZpNWbjFTOtlFdWdUZxgHMMxmQzIWeWhlUp9maJxWNyImNWdlYwJlbJNXSD10dBRUT3FkaJZTSDJGaSNzY2JkbJNXS5pVeWNjYpFzVaRjVIR1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWUU9UeFpGTycXeNhXRq5UdrRkTp9maJpWOHJWa3lWSWh3aJZTSTVWeS5mYxkjMZl2dplkbKhFZ2p0VixGaYRWTKl2TpRjMiBHZXpVeKNETpNWbjFTOtlFdWdUZxg3aJZTSTVGMsJTWpdXaJd3ZU1UdNRVT1tGRPhHN550dFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQWY1QzMhVjZ4gTZmZmNmNmZkljYiZmNlFmZyMGOxYWMiwiIiJDM2IjZ1YjMjZjNjZjM0ETN3kTYwYGOhdTNhZjZzUWMjV2MlBjNkJiOiMGOjNDM5AjMjJ2Y4AzYzIGMhFzYldDOxAjYhVTMkJ2YiwiImZmNhJjY4IWMmVWOkR2Y2UmY4YWMkNmZjJWZ4ImZjNGO2QDN5ETNzIiOikTYzIWOiNjZidjZ3QDMiZmYxQTOllTOhZmN3kzMxQWNis3W
unknown
text
104 b
—
2928
Microsoft.exe
GET
200
94.131.112.229:80
http://94.131.112.229/b1e57687.php?9wqw6DfNUvaZEhgV5Cc=mAdRNKxcY6jClCs9nEU3L&8d217a380a2b0a4c6866905b74e17a20=kFGZlZ2M1YTYzMWOmVGN1IWO3YWYjdzY5UTO2Q2M0UDOxYGZkRWN2MjN1UDN1EDOzITO1kTN&19c7d55e76eb5f2989514a767abccb1a=gY2kTO4IDN0QmYwMWM0QTNmZWN5MWOlNzNlRGZ3MGZ5gTY4QWN2YjM&da30cd2ff4bf14e7c7e2a05392524306=d1nILBTQNJiOiQWY1QzMhVjZ4gTZmZmNmNmZkljYiZmNlFmZyMGOxYWMiwiIkJGZhFDZ4ADNkVTOlZDOwkTMklDNidTYwQmZxAjYiBzMlljM4QDOiJiOiMGOjNDM5AjMjJ2Y4AzYzIGMhFzYldDOxAjYhVTMkJ2YiwiImZmNhJjY4IWMmVWOkR2Y2UmY4YWMkNmZjJWZ4ImZjNGO2QDN5ETNzIiOikTYzIWOiNjZidjZ3QDMiZmYxQTOllTOhZmN3kzMxQWNis3W
unknown
text
104 b
—
2928
Microsoft.exe
GET
200
94.131.112.229:80
http://94.131.112.229/b1e57687.php?9wqw6DfNUvaZEhgV5Cc=mAdRNKxcY6jClCs9nEU3L&8d217a380a2b0a4c6866905b74e17a20=kFGZlZ2M1YTYzMWOmVGN1IWO3YWYjdzY5UTO2Q2M0UDOxYGZkRWN2MjN1UDN1EDOzITO1kTN&19c7d55e76eb5f2989514a767abccb1a=gY2kTO4IDN0QmYwMWM0QTNmZWN5MWOlNzNlRGZ3MGZ5gTY4QWN2YjM&b302823833ae322b8e9ce4b7812a8d9a=d1nIjVmZzQ2YklDNiRmMmJWMmRDMlBDNmdDNkF2Y5cDOiVmM5QTZlVTNiJiOiMGOjNDM5AjMjJ2Y4AzYzIGMhFzYldDOxAjYhVTMkJ2YiwiImZmNhJjY4IWMmVWOkR2Y2UmY4YWMkNmZjJWZ4ImZjNGO2QDN5ETNzIiOikTYzIWOiNjZidjZ3QDMiZmYxQTOllTOhZmN3kzMxQWNis3W&000f87d4164c8737a1e81f7f9c9fda31=d1nIiojIkFWN0MTY1YGO4UmZmZjZjZGZ5ImYmZTZhZmMjhTMmFjIsIyYlZ2MkNGZ5QjYkJjZiFjZ0ATZwQjZ3QDZhNWO3gjYlJTO0UWZ1UjYiojIjhzYzATOwIzYiNGOwM2MiBTYxMWZ3gTMwIWY1EDZiNmIsIiZmZTYyIGOiFjZllDZkNmNlJGOmFDZjZ2YiVGOiZ2YjhjN0QTOxUzMiojI5E2MiljYzYmY3Y2N0AjYmJWM0kTZ5kTYmZzN5MTMkVjI7xSfikTMulUavpWSyUFRaVTTtpVaSRlTrJlaNJTWE90aWRUT3l0VPRTSUlFNVpXTsp1RaRTUq1kaad0TrZlaNVTSDxUaBpWS2k0QNRTUX50aSdUT4FkaNFzZU9EbOdVWrRmaadXVH9EbGdVTo5keOpXWE9UbaRkT1UERaNTQU1Ua3lWSvkUaPlWUql1MV1WWqZ1VNpmV61kMBpnTrxGVNpmSH9UbSdkTyklMNhXTUpVeVRVTzkFVNRTWH90MnpWS3AnaJhmUYlVRShUZsp0QMFzbqlEMWNjYsFzVhVlQYpFb4JTVpdXaJxmWYFGMOdVUp9maJpnVIRGaSNTV1IFWhJDbHRmaGtWSzl0QjBHcuxUM0M0TnlFSJlnVHNGdWhkUndXVVRlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUarxWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S6FUeaVHbHN2dWdEZUJ0QOhXQDJGbSJjYOJUaOd2aIJGcxcVWHJ0QOJzZIt0Zvh0UIJkeOVXSElUQCNlVR5URJdXQE5kMwMlTwJ0UL5kUGtEbKNjYEJ0ULNFaDJGbS5mYKpUaPlWVXJGa1UlVR50aJNXSTtkQ5kGVvFUajxmUINGaSdVUn10MZBHaHNGaKNjUnVEMSdlQDpVeGdkW1Z0RkRlSp9UaVdlYoVTVWFFZrl0cJlGVp9maJVHbXJ2aGBzYwp0QMlWSp9UajVVUVp0QMlWUYF2QClWT6F0QihWNyIGcONzYsplMilnQGl0MBl3YzkzRaVHbyYVavpWS5ZVbWVHbyYVa3NlZpNWbjFTOtlFdWdUZxgHMMxmQzIWeWhlUp9maJxWNyImNWdlYwJlbJNXSD10dBRUT3FkaJZTSDJGaSNzY2JkbJNXS5pVeWNjYpFzVaRjVIR1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWUU9UeFpGTycXeNhXRq5UdrRkTp9maJpWOHJWa3lWSWh3aJZTSTVWeS5mYxkjMZl2dplkbKhFZ2p0VixGaYRWTKl2TpRjMiBHZXpVeKNETpNWbjFTOtlFdWdUZxg3aJZTSTVGMsJTWpdXaJd3ZU1UdNRVT1tGRPhHN550dFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQWY1QzMhVjZ4gTZmZmNmNmZkljYiZmNlFmZyMGOxYWMiwiIiJDM2IjZ1YjMjZjNjZjM0ETN3kTYwYGOhdTNhZjZzUWMjV2MlBjNkJiOiMGOjNDM5AjMjJ2Y4AzYzIGMhFzYldDOxAjYhVTMkJ2YiwiImZmNhJjY4IWMmVWOkR2Y2UmY4YWMkNmZjJWZ4ImZjNGO2QDN5ETNzIiOikTYzIWOiNjZidjZ3QDMiZmYxQTOllTOhZmN3kzMxQWNis3W
unknown
text
104 b
—
2928
Microsoft.exe
GET
200
94.131.112.229:80
http://94.131.112.229/b1e57687.php?9wqw6DfNUvaZEhgV5Cc=mAdRNKxcY6jClCs9nEU3L&8d217a380a2b0a4c6866905b74e17a20=kFGZlZ2M1YTYzMWOmVGN1IWO3YWYjdzY5UTO2Q2M0UDOxYGZkRWN2MjN1UDN1EDOzITO1kTN&19c7d55e76eb5f2989514a767abccb1a=gY2kTO4IDN0QmYwMWM0QTNmZWN5MWOlNzNlRGZ3MGZ5gTY4QWN2YjM&000f87d4164c8737a1e81f7f9c9fda31=0VfiIiOiQWY1QzMhVjZ4gTZmZmNmNmZkljYiZmNlFmZyMGOxYWMiwiIilDO1YzN5YWYxIGM4IWY1ATO0MjYwUTYwYzNxUmYzQWZ2gTMzEmZ0IiOiMGOjNDM5AjMjJ2Y4AzYzIGMhFzYldDOxAjYhVTMkJ2YiwiImZmNhJjY4IWMmVWOkR2Y2UmY4YWMkNmZjJWZ4ImZjNGO2QDN5ETNzIiOikTYzIWOiNjZidjZ3QDMiZmYxQTOllTOhZmN3kzMxQWNis3W
unknown
text
104 b
—
2928
Microsoft.exe
GET
200
94.131.112.229:80
http://94.131.112.229/b1e57687.php?9wqw6DfNUvaZEhgV5Cc=mAdRNKxcY6jClCs9nEU3L&8d217a380a2b0a4c6866905b74e17a20=kFGZlZ2M1YTYzMWOmVGN1IWO3YWYjdzY5UTO2Q2M0UDOxYGZkRWN2MjN1UDN1EDOzITO1kTN&19c7d55e76eb5f2989514a767abccb1a=gY2kTO4IDN0QmYwMWM0QTNmZWN5MWOlNzNlRGZ3MGZ5gTY4QWN2YjM&da30cd2ff4bf14e7c7e2a05392524306=QX9JCNr9EMWdkYzZkMWdGOHR2ds52YEJUejhGarNkT0s2TwY1RiNnRyY1ZRNzYxoESWtEMnRlNRhlWzh3VZhlQTFmdKNjYaBXUE9EcERGb4dkYoRmRJlmVyY1Z0ADVVBXUE9EcERGb4dkYoRmRJRXOHRWdGdUYRBXUE9EcERGb4dkYoRmRJlmVyY1ZVJTW1ZUbiBnSrNkT0s2TwY1RiNnRyY1Z0cVY1lTbVtEMnRlNRhlWzh3VZhlQ5FWdsdEV1lTbjVFcRR0TwREZsh3RihGZGlkcOhVWOZ0RkxWMrNkT0s2TwY1RiNnRyY1ZnJzYo5UbXtEMnRlNRhlWzh3VZhlQ5JWeW1mY2FzaD5ENr9EMWdkYzZkMWdWVtNmdOtmYwljMZxmUYFWTwFFRPBHRkxGeHJGakZUS6ZFSaZHaYJ1SwcGV2EFWaNHeXlFWCNlYxYVbjxGaHRmRwFFRPBHRkxGeHJGakZUS0ZlbjBjTXp1cWt2QORzaPBjVHJ2cGJjVnVVbjZnTFFmeGdkULBzZUZTUYp1c4dVWYJUaiBXOykFbShVZDBXUE9EcERGb4dkYoRmRJxmSzIGR1cVY250RkBnSrNkT0s2TwY1RiNnRyY1ZNdVY0lzRkJEcRR0TwREZsh3RihGZGlUNKNjY0pEWRtEMnRlNRhlWzh3VZhlQTpla1cVW1xWbRJiOiQWY1QzMhVjZ4gTZmZmNmNmZkljYiZmNlFmZyMGOxYWMiwiIilDO1YzN5YWYxIGM4IWY1ATO0MjYwUTYwYzNxUmYzQWZ2gTMzEmZ0IiOiMGOjNDM5AjMjJ2Y4AzYzIGMhFzYldDOxAjYhVTMkJ2YiwiImZmNhJjY4IWMmVWOkR2Y2UmY4YWMkNmZjJWZ4ImZjNGO2QDN5ETNzIiOikTYzIWOiNjZidjZ3QDMiZmYxQTOllTOhZmN3kzMxQWNis3W
unknown
text
104 b
—
2928
Microsoft.exe
GET
200
94.131.112.229:80
http://94.131.112.229/b1e57687.php?9wqw6DfNUvaZEhgV5Cc=mAdRNKxcY6jClCs9nEU3L&8d217a380a2b0a4c6866905b74e17a20=kFGZlZ2M1YTYzMWOmVGN1IWO3YWYjdzY5UTO2Q2M0UDOxYGZkRWN2MjN1UDN1EDOzITO1kTN&19c7d55e76eb5f2989514a767abccb1a=gY2kTO4IDN0QmYwMWM0QTNmZWN5MWOlNzNlRGZ3MGZ5gTY4QWN2YjM&b302823833ae322b8e9ce4b7812a8d9a=d1nIkJGZhFDZ4ADNkVTOlZDOwkTMklDNidTYwQmZxAjYiBzMlljM4QDOiJiOiMGOjNDM5AjMjJ2Y4AzYzIGMhFzYldDOxAjYhVTMkJ2YiwiImZmNhJjY4IWMmVWOkR2Y2UmY4YWMkNmZjJWZ4ImZjNGO2QDN5ETNzIiOikTYzIWOiNjZidjZ3QDMiZmYxQTOllTOhZmN3kzMxQWNis3W
unknown
text
104 b
—
2928
Microsoft.exe
GET
200
94.131.112.229:80
http://94.131.112.229/b1e57687.php?9wqw6DfNUvaZEhgV5Cc=mAdRNKxcY6jClCs9nEU3L&8d217a380a2b0a4c6866905b74e17a20=kFGZlZ2M1YTYzMWOmVGN1IWO3YWYjdzY5UTO2Q2M0UDOxYGZkRWN2MjN1UDN1EDOzITO1kTN&19c7d55e76eb5f2989514a767abccb1a=gY2kTO4IDN0QmYwMWM0QTNmZWN5MWOlNzNlRGZ3MGZ5gTY4QWN2YjM&000f87d4164c8737a1e81f7f9c9fda31=QX9JSUNJiOiQWY1QzMhVjZ4gTZmZmNmNmZkljYiZmNlFmZyMGOxYWMiwiI3MTN3AjMlJmZmZmYiJmM3kDZhlTYyQjY1YGM4MzNzgTN2kjM2cjMmJiOiMGOjNDM5AjMjJ2Y4AzYzIGMhFzYldDOxAjYhVTMkJ2YiwiImZmNhJjY4IWMmVWOkR2Y2UmY4YWMkNmZjJWZ4ImZjNGO2QDN5ETNzIiOikTYzIWOiNjZidjZ3QDMiZmYxQTOllTOhZmN3kzMxQWNis3W
unknown
text
104 b
—
2928
Microsoft.exe
GET
200
94.131.112.229:80
http://94.131.112.229/b1e57687.php?9wqw6DfNUvaZEhgV5Cc=mAdRNKxcY6jClCs9nEU3L&8d217a380a2b0a4c6866905b74e17a20=kFGZlZ2M1YTYzMWOmVGN1IWO3YWYjdzY5UTO2Q2M0UDOxYGZkRWN2MjN1UDN1EDOzITO1kTN&19c7d55e76eb5f2989514a767abccb1a=gY2kTO4IDN0QmYwMWM0QTNmZWN5MWOlNzNlRGZ3MGZ5gTY4QWN2YjM&b302823833ae322b8e9ce4b7812a8d9a=d1nIjVmZzQ2YklDNiRmMmJWMmRDMlBDNmdDNkF2Y5cDOiVmM5QTZlVTNiJiOiMGOjNDM5AjMjJ2Y4AzYzIGMhFzYldDOxAjYhVTMkJ2YiwiImZmNhJjY4IWMmVWOkR2Y2UmY4YWMkNmZjJWZ4ImZjNGO2QDN5ETNzIiOikTYzIWOiNjZidjZ3QDMiZmYxQTOllTOhZmN3kzMxQWNis3W&000f87d4164c8737a1e81f7f9c9fda31=d1nIiojIkFWN0MTY1YGO4UmZmZjZjZGZ5ImYmZTZhZmMjhTMmFjIsIyYlZ2MkNGZ5QjYkJjZiFjZ0ATZwQjZ3QDZhNWO3gjYlJTO0UWZ1UjYiojIjhzYzATOwIzYiNGOwM2MiBTYxMWZ3gTMwIWY1EDZiNmIsIiZmZTYyIGOiFjZllDZkNmNlJGOmFDZjZ2YiVGOiZ2YjhjN0QTOxUzMiojI5E2MiljYzYmY3Y2N0AjYmJWM0kTZ5kTYmZzN5MTMkVjI7xSfiElZ5oUaUl2bqlUMFR0T0UVbNNTVE5UaKdkWrpFVZNTVXp1MFpXT1EFVPNTRE50aoRUT3VERNhmVH1keVd0T0k0QMlGNrlkNJNkTxkleZlmT6l1aSRlWxUlaOlGaqlVeJRlWzU0VPVTVH1UejpWWtZkeOVTRH90dJJjT1kFVNl2dpl0TKl2TpdmaNtmTX5EMNJTT1UkMZdXRH1EMNd1T3FVbaxmRU1EaCRVT0U0RN1GZE5EbaRVWoZ0RPhXWtl0cJlGVp9maJlmUEpVasRUTqp1VZpGbU5EbORlWx0EVZtmVyk1aGdkW5l1VPh3aUllMZJjTpZlaZpXSt1UbKNETpRzaJZTSppleZdlW5l1RapmWX9ENJ1WW3lERahmRH1EbkpnT000VNlmUt1UenRlTpZEVPRTSU5EMBpWWpdXaJ9kSp9UarRVWopFVNdXVqpVNVJjT0MGRPJTSH9UboRlTxklMNxmRU5UNZRkT0smaNhXWq5UeRRVWs5kaJNXSpRVavpWSspkaaBTQ61kaGRUTs50RaNTV65UeZRVWtJkaaRzZU5kMFJjTphmaNdXSX1UeVpWT6FkaalXSDxUa0sWS2k0UZNTUq50MVR0T1EFVPJTTtpFenpXW4FERadXS65EakpXT6VUbORTVU9EaKd1T1MGVOBTUtlVa3lWSPpUaPlWRUpVMVpWW3VUbOJTRq5ENFdVT1UleOpGbE1UeRpXTyElaZd3YUpFeFpWT5lleOFTQU5UbWpWSzlUaUl2bqlUenpXT00EVOdXQUlVNJdkWtpFRNpGaU90aGRVW0U0Ra1mQqlVbWJTTop0RN1mTXp1aKR1T5l0QMlGNrlkNJNkT4l0RNhmUtl1MRR1TwUFVahXRqpFbOJTT1sGRNJTStpFbCpmW6VFVOlXUt10aKRUT6FkeOl2dpl0TKl2TplFVZlXWt5kMRpXTwUlMN1mWU1UNnRkW5VlaOpmVH9keR1WW4FFVNhmRU1ENRdkTspFVZVTVql0cJlGVp9maJNTVU50aopXTy0EVZh3ZUlFejpWT4VlaatmQE50akRkWphmaNVTTE9keZ1WTopERPpXVy4EMJNETpRzaJZTSD90dF1WWqJERPlXTt5EMVR0Tz0kMZJTSX9UMFRlTwkFRNxmW65UMFd0TsxmaZVzYU1EaOdkTpdXaJ9kSp9UaJdlWoZ0RPRTSH10dFdkWzMmaZBTQUlFbSpnT6tmaOlXRq1UeVRVWyUFVNFTUHpFbWpmTopVbJNXSpRVavpWSyEFVZhmRykFejpnTppFRNpmUE1UNJR1T4lFVPl3ZUl1MFRVWtZ1RPtmUq1UMJRVTr5UbNxmSDxUa0sWS2kUaNJTRUlleNdVW5FkaZpmQq50aWdVWohmeNpXWHpVNrpXT3l0RNlXWy4ENBRlWwkERNtmVtlVa3lWSPpUaPlWTE1UbkpWWq50RNNTU61UeZdlTsp1RPdXUtlVMNRUTrZlaNh3ZU90dJRVTq50VadXW610MZpWSzlUaUl2bql0aKRVWqJkeO1mUX1UNN1WT000RNpmVE1kaoRVWzkkeNVTWtpFMjpnTsZFROFza6lleJ1WW4l0QMlGNrlkNJNlT5F1VapmTt1EMFRVW4VlaOlmT610MrRVTyMGVPlmWq5kMZRVWtJ1VPJTVtpVbaRVW0U1VNl2dplUavpWSyUFRaVTTtpVaSRlTrJlaNJTWE90aWRUT3l0VPRTSUlFNVpXTsp1RaRTUq1kaad0TrZlaNVTSDxUaBpWS2k0QNRTUX50aSdUT4FkaNFzZU9EbOdVWrRmaadXVH9EbGdVTo5keOpXWE9UbaRkT1UERaNTQU1Ua3lWSPpUaPlWUql1MV1WWqZ1VNpmV61kMBpnTrxGVNpmSH9UbSdkTyklMNhXTUpVeVRVTzkFVNRTWH90MnpWS3AnaJhmUYlVRShUZsp0QMFzbqlEMWNjYsFzVhVlQYpFb4JTVpdXaJxmWYFGMOdVUp9maJpnVIRGaSNTV1IFWhJDbHRmaGtWSzl0QjBHcuxUM0M0TnlFSJlnVHNGdWhkUndXVVRlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUarxWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S6FUeaVHbHN2dWdEZUJ0QOhXQDJGbSJjYOJUaOd2aIJGcxcVWHJ0QOJzZIt0Zvh0UIJkeOVXSElUQCNlVR5URJdXQE5kMwMlTwJ0UL5kUGtEbKNjYEJ0ULNFaDJGbS5mYKpUaPlWVXJGa1UlVR50aJNXSTtkQ5kGVvFUajxmUINGaSdVUn10MZBHaHNGaKNjUnVEMSdlQDpVeGdkW1Z0RkRlSp9UaVdlYoVTVWFFZrl0cJlGVp9maJVHbXJ2aGBzYwp0QMlWSp9UajVVUVp0QMlWUYF2QClWT6F0QihWNyIGcONzYsplMilnQGl0MBl3YzkzRaVHbyYVavpWS5ZVbWVHbyYVa3NlZpNWbjFTOtlFdWdUZxgHMMxmQzIWeWhlUp9maJxWNyImNWdlYwJlbJNXSD10dBRUT3FkaJZTSDJGaSNzY2JkbJNXS5pVeWNjYpFzVaRjVIR1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWUU9UeFpGTycXeNhXRq5UdrRkTp9maJpWOHJWa3lWSWh3aJZTSTVWeS5mYxkjMZl2dplkbKhFZ2p0VixGaYRWTKl2TpRjMiBHZXpVeKNETpNWbjFTOtlFdWdUZxg3aJZTSTVGMsJTWpdXaJd3ZU1UdNRVT1tGRPhHN550dFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQWY1QzMhVjZ4gTZmZmNmNmZkljYiZmNlFmZyMGOxYWMiwiIiJDM2IjZ1YjMjZjNjZjM0ETN3kTYwYGOhdTNhZjZzUWMjV2MlBjNkJiOiMGOjNDM5AjMjJ2Y4AzYzIGMhFzYldDOxAjYhVTMkJ2YiwiImZmNhJjY4IWMmVWOkR2Y2UmY4YWMkNmZjJWZ4ImZjNGO2QDN5ETNzIiOikTYzIWOiNjZidjZ3QDMiZmYxQTOllTOhZmN3kzMxQWNis3W
unknown
text
104 b
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
unknown
2588
svchost.exe
239.255.255.250:1900
—
—
—
unknown
2928
Microsoft.exe
104.20.67.143:443
pastebin.com
CLOUDFLARENET
—
unknown
2928
Microsoft.exe
94.131.112.229:80
—
ZAYO-6461
US
unknown

DNS requests

Domain
IP
Reputation
pastebin.com
  • 104.20.67.143
unknown

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
ET MALWARE DCRAT Activity (GET)
—
—
A Network Trojan was detected
ET HUNTING Observed Malicious Filename in Outbound POST Request (Information.txt)
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
SQL Dumper v 8.5.zip