0

When I was running fiddler I've discovered that I have a suspicious GET request running in background that's using iexplore.exe. It runs every couple of seconds and has encoded data in the request URL

One of the requests:

http://136.243.24.246/H7giAGAb/nJO4fqhPN6Q0UaltIOnMwqpGp2YnmvJeK34G1j3FP7Mh20+HQ+JSX2MdaWMkMtdTgfIzJgZM/ZcbB7HhdSMwLAC30LyZSgi5UFEXeDr+gqxX7LLdeYrZwQRIKjynuRhCirWGQGkj1uAkwL5A2EpWP4`

By looking at the contents of the IP in the browser it doesn't look like it's something "official" of Internet Explorer.

What can it be and how can I decode that request? My guess is that it somehow steals my data.

enter image description here

ADDED:

I did some further digging and it seems like it's because of m.exe malware:

https://cymon.io/136.243.24.4

http://vxvault.net/ViriFiche.php?ID=28404

Still, is there any way to decode the message?

Jan Doggen
  • 4,657

0 Answers0