File name:

1.exe

Full analysis: https://app.any.run/tasks/cdd6c5aa-a073-4a4e-9c3f-c526f1b595ba
Verdict: Malicious activity
Threats:

DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common.

Malware Trends Tracker     >>>
Analysis date: July 05, 2025, 23:24:22
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
rat
dcrat
remote
darkcrystal
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

3CB864B79656FF23B6B43315B1016AAF

SHA1:

336AF4397618C0A7A014AA0BEF90702B8BF0EBB9

SHA256:

FB3F40376CC7890EFA0138C46C4553EEED341F6700309F97B9779DAC411D4973

SSDEEP:

98304:/fLIQ/AcJl6ZrQym90T0kfROMkjn2PetSojhUw+Ye4Hk//njdtAMOFnUIqFnodaN:TEi9uCaA8KS5o2AAn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • lithjmeaf.exe (PID: 3800)

    • DARKCRYSTAL has been detected (SURICATA)

      • lithjmeaf.exe (PID: 3800)

    • Steals credentials from Web Browsers

      • lithjmeaf.exe (PID: 3800)

    • Actions looks like stealing of personal data

      • lithjmeaf.exe (PID: 3800)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 1.exe (PID: 1212)
      • AutoBuyGifts.exe (PID: 6124)
      • autoupdate.exe (PID: 4060)
      • mixworld.exe (PID: 6336)

    • Executable content was dropped or overwritten

      • 1.exe (PID: 1212)
      • AutoBuyGifts.exe (PID: 6124)
      • autoupdate.exe (PID: 4060)
      • mixworld.exe (PID: 6336)
      • lithjmeaf.exe (PID: 3800)

    • The executable file from the user directory is run by the CMD process

      • AutoBuyGifts.exe (PID: 6124)
      • autoupdate.exe (PID: 4060)
      • mixworld.exe (PID: 6336)

    • Executing commands from a ".bat" file

      • 1.exe (PID: 1212)
      • AutoBuyGifts.exe (PID: 6124)
      • autoupdate.exe (PID: 4060)

    • Starts CMD.EXE for commands execution

      • AutoBuyGifts.exe (PID: 6124)
      • 1.exe (PID: 1212)
      • autoupdate.exe (PID: 4060)

    • Reads the date of Windows installation

      • autoupdate.exe (PID: 4060)
      • mixworld.exe (PID: 6336)

    • Connects to the server without a host name

      • lithjmeaf.exe (PID: 3800)

    • Loads DLL from Mozilla Firefox

      • lithjmeaf.exe (PID: 3800)

  • INFO

    • Reads the computer name

      • 1.exe (PID: 1212)
      • AutoBuyGifts.exe (PID: 6124)
      • autoupdate.exe (PID: 4060)
      • mixworld.exe (PID: 6336)
      • lithjmeaf.exe (PID: 3800)

    • Create files in a temporary directory

      • 1.exe (PID: 1212)
      • AutoBuyGifts.exe (PID: 6124)
      • autoupdate.exe (PID: 4060)
      • mixworld.exe (PID: 6336)
      • lithjmeaf.exe (PID: 3800)

    • Checks supported languages

      • 1.exe (PID: 1212)
      • AutoBuyGifts.exe (PID: 6124)
      • autoupdate.exe (PID: 4060)
      • mixworld.exe (PID: 6336)
      • lithjmeaf.exe (PID: 3800)

    • Process checks computer location settings

      • 1.exe (PID: 1212)
      • AutoBuyGifts.exe (PID: 6124)
      • autoupdate.exe (PID: 4060)
      • mixworld.exe (PID: 6336)

    • Reads the machine GUID from the registry

      • lithjmeaf.exe (PID: 3800)

    • Disables trace logs

      • lithjmeaf.exe (PID: 3800)

    • Checks proxy server information

      • lithjmeaf.exe (PID: 3800)

    • Reads Environment values

      • lithjmeaf.exe (PID: 3800)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 7104)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:10:03 07:51:19+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.33
CodeSize: 214528
InitializedDataSize: 137728
UninitializedDataSize: -
EntryPoint: 0x21d50
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
149
Monitored processes
13
Malicious processes
4
Suspicious processes
3

Behavior graph

Click at the process to see the details
start 1.exe cmd.exe no specs conhost.exe no specs autobuygifts.exe cmd.exe no specs conhost.exe no specs autoupdate.exe cmd.exe no specs conhost.exe no specs mixworld.exe #DARKCRYSTAL lithjmeaf.exe notepad.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
984\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1212"C:\Users\admin\AppData\Local\Temp\1.exe" C:\Users\admin\AppData\Local\Temp\1.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
1296C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\run_my_app.bat" "C:\Windows\SysWOW64\cmd.exe—AutoBuyGifts.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2132\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3400C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3800"C:\Users\admin\AppData\Local\Temp\RarSFX2\lithjmeaf.exe" C:\Users\admin\AppData\Local\Temp\RarSFX2\lithjmeaf.exe
mixworld.exe
User:
admin
Integrity Level:
MEDIUM
Version:
16.10.31418.88
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx2\lithjmeaf.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4060autoupdate.exe C:\Users\admin\AppData\Local\Temp\autoupdate.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\autoupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6124AutoBuyGifts.exe -paLPakalokomortpoeaC:\Users\admin\AppData\Local\Temp\RarSFX0\AutoBuyGifts.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\autobuygifts.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
6336mixworld.exe -priverdDC:\Users\admin\AppData\Local\Temp\RarSFX1\mixworld.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx1\mixworld.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6360\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
5 325
Read events
5 309
Write events
16
Delete events
0

Modification events

(PID) Process:(3800) lithjmeaf.exeKey:HKEY_CURRENT_USER\SOFTWARE\56f4a74f9b0de1abf8e9277e39f0b116d9430d96
Operation:writeName:087da62af53768ea17a2e4d5a48df3e8a85ee0d8
Value:
H4sIAAAAAAAEAItWcraKiQktTi0qjolJTMnNzIuJcSwocEksSYyJ8clPTsyJiQlJzS2IiQlKLAp2izCKicnJLMnIyk1NTNNLrUhVigUAZ0HxIEIAAAA=
(PID) Process:(3800) lithjmeaf.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\lithjmeaf_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3800) lithjmeaf.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\lithjmeaf_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(3800) lithjmeaf.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\lithjmeaf_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3800) lithjmeaf.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\lithjmeaf_RASMANCS
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3800) lithjmeaf.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\lithjmeaf_RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(3800) lithjmeaf.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\lithjmeaf_RASMANCS
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3800) lithjmeaf.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\lithjmeaf_RASMANCS
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3800) lithjmeaf.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\lithjmeaf_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3800) lithjmeaf.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\lithjmeaf_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
11
Suspicious files
22
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
12121.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\AutoBuyGifts.exeexecutable
MD5:78E404B7182FEA6FF85389F8DC7ACCCB
SHA256:A3E9B98A9B5840400C2839CF4AF9D140DB56054EA952F77BC648B7379F357FA2
6124AutoBuyGifts.exeC:\Users\admin\AppData\Local\Temp\data\json\history.jsontext
MD5:A878F461A69AE7F396307350F1FD69F5
SHA256:E658E188909C6AF9DAB3A92B40D69A6BAE2D6066A29B4886CFC91EBCAA42CBB5
6124AutoBuyGifts.exeC:\Users\admin\AppData\Local\Temp\data\config.pytext
MD5:2111769BDA005EF426BFF376A1A9F838
SHA256:590CD4EDA57F88C0EC5FF8CF65D1CC922C54E9DB82A6435700EE0B3DDCFB810D
6124AutoBuyGifts.exeC:\Users\admin\AppData\Local\Temp\data\json\info.jsonbinary
MD5:FFAFDADB871EAADAA159D3D7D3318030
SHA256:EC2D77DE89A72D082823926ED248408D2930A000F286AE7C5561731D54E72066
6124AutoBuyGifts.exeC:\Users\admin\AppData\Local\Temp\main.exeexecutable
MD5:95080F2B0EC7C60C6BEEC677F83BA2D0
SHA256:F7520C86937502CBBF6D0964FC68349490F10CE5D354BD1455A0B510D7B3CE9E
3800lithjmeaf.exeC:\Users\admin\AppData\Local\Temp\u2mKlqLkchbinary
MD5:A5B55EF875A290F8739655274B5CFAE6
SHA256:3C6E069A7DF07EE5ECA265821545BD9B5A0BE65DCA21805D42B10133D12916CF
6336mixworld.exeC:\Users\admin\AppData\Local\Temp\RarSFX2\lithjmeaf.exeexecutable
MD5:A31C18F2AAED9E93F183F1F2EF34F4D2
SHA256:D35A0EEC2BAB18AD74628021638A51CD318C3BDC6DB1FF89793D4C0E899FAA7D
3800lithjmeaf.exeC:\Users\admin\Desktop\svXaVJVR.logexecutable
MD5:F4B38D0F95B7E844DD288B441EBC9AAF
SHA256:AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
3800lithjmeaf.exeC:\Users\admin\AppData\Local\Temp\B904SuwbDIbinary
MD5:9F6D153D934BCC50E8BC57E7014B201A
SHA256:2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
3800lithjmeaf.exeC:\Users\admin\AppData\Local\Temp\dpJpEamOLDbinary
MD5:1AA08FF2105515DE3602F503E87DFF1A
SHA256:D7446E2F307027C9BDA2A92D1DF1C13C376581372F6AE8708F4D5BACCB2E6813
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
62
TCP/UDP connections
24
DNS requests
16
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3800
lithjmeaf.exe
POST
200
38.180.165.153:80
http://38.180.165.153/7providerLinux/cdngenerator/JsPacketUpdateProcessorServerprotectTrafficTestdatalifeUploads.php
unknown
—
—
malicious
3800
lithjmeaf.exe
POST
200
38.180.165.153:80
http://38.180.165.153/7providerLinux/cdngenerator/JsPacketUpdateProcessorServerprotectTrafficTestdatalifeUploads.php
unknown
—
—
malicious
3800
lithjmeaf.exe
POST
200
38.180.165.153:80
http://38.180.165.153/7providerLinux/cdngenerator/JsPacketUpdateProcessorServerprotectTrafficTestdatalifeUploads.php
unknown
—
—
malicious
3800
lithjmeaf.exe
POST
200
38.180.165.153:80
http://38.180.165.153/7providerLinux/cdngenerator/JsPacketUpdateProcessorServerprotectTrafficTestdatalifeUploads.php
unknown
—
—
malicious
3800
lithjmeaf.exe
POST
200
38.180.165.153:80
http://38.180.165.153/7providerLinux/cdngenerator/JsPacketUpdateProcessorServerprotectTrafficTestdatalifeUploads.php
unknown
—
—
malicious
3800
lithjmeaf.exe
POST
200
38.180.165.153:80
http://38.180.165.153/7providerLinux/cdngenerator/JsPacketUpdateProcessorServerprotectTrafficTestdatalifeUploads.php
unknown
—
—
malicious
3800
lithjmeaf.exe
POST
200
38.180.165.153:80
http://38.180.165.153/7providerLinux/cdngenerator/JsPacketUpdateProcessorServerprotectTrafficTestdatalifeUploads.php
unknown
—
—
malicious
3800
lithjmeaf.exe
POST
200
38.180.165.153:80
http://38.180.165.153/7providerLinux/cdngenerator/JsPacketUpdateProcessorServerprotectTrafficTestdatalifeUploads.php
unknown
—
—
malicious
3800
lithjmeaf.exe
POST
200
38.180.165.153:80
http://38.180.165.153/7providerLinux/cdngenerator/JsPacketUpdateProcessorServerprotectTrafficTestdatalifeUploads.php
unknown
—
—
malicious
3800
lithjmeaf.exe
POST
200
38.180.165.153:80
http://38.180.165.153/7providerLinux/cdngenerator/JsPacketUpdateProcessorServerprotectTrafficTestdatalifeUploads.php
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4372
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3800
lithjmeaf.exe
38.180.165.153:80
—
COGENT-174
US
malicious
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
23.32.238.107:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
2520
svchost.exe
20.190.159.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 142.250.184.206
whitelisted
crl.microsoft.com
  • 23.32.238.107
  • 23.32.238.112
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
login.live.com
  • 20.190.159.64
  • 20.190.159.71
  • 20.190.159.0
  • 40.126.31.71
  • 40.126.31.67
  • 40.126.31.69
  • 40.126.31.128
  • 20.190.159.129
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
nexusrules.officeapps.live.com
  • 52.111.236.22
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

PID
Process
Class
Message
3800
lithjmeaf.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)
3800
lithjmeaf.exe
A Network Trojan was detected
REMOTE [ANY.RUN] DarkCrystal Rat Check-in (POST)
No debug info