File name:

client.exe

Full analysis: https://app.any.run/tasks/3501b31f-9233-4276-a233-9256f42534bf
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: February 26, 2026, 07:05:54
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
rat
karstorat
ip-check
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 6 sections
MD5:

FE9DB3AED6A04C762472AFDF2FACE254

SHA1:

94E98B714BFB102D143957CF1E00BD45B5B8FA4D

SHA256:

07131E3FCB9E65C1E4D2E756EFDB9F263FD90080D3FF83FBCCA1F31A4890EBDB

SSDEEP:

6144:XnYpB6s6V8VHVc/AzAvaqycSDKDAKaQb111Q:XnYP6s6V8VHVcIlqycSDK8KaK111Q

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • KARSTORAT has been detected (YARA)

      • client.exe (PID: 7412)
      • client.exe (PID: 7192)
      • client.exe (PID: 4840)

  • SUSPICIOUS

    • There is functionality for capture public ip (YARA)

      • client.exe (PID: 7412)
      • client.exe (PID: 7192)
      • client.exe (PID: 4840)

    • Checks for external IP

      • client.exe (PID: 7192)
      • client.exe (PID: 7412)
      • client.exe (PID: 4840)

  • INFO

    • Checks supported languages

      • client.exe (PID: 7412)
      • client.exe (PID: 7192)
      • client.exe (PID: 4840)

    • Checks proxy server information

      • client.exe (PID: 7412)
      • client.exe (PID: 7192)
      • slui.exe (PID: 7760)
      • client.exe (PID: 4840)

    • Reads the computer name

      • client.exe (PID: 7412)
      • client.exe (PID: 7192)
      • client.exe (PID: 4840)

    • Reads security settings of Internet Explorer

      • client.exe (PID: 7412)
      • client.exe (PID: 7192)
      • client.exe (PID: 4840)

    • There is functionality for taking screenshot (YARA)

      • client.exe (PID: 7412)
      • client.exe (PID: 7192)
      • client.exe (PID: 4840)

    • Creates files or folders in the user directory

      • client.exe (PID: 7412)
      • client.exe (PID: 7192)
      • client.exe (PID: 4840)

    • Manual execution by a user

      • WINWORD.EXE (PID: 352)
      • client.exe (PID: 7192)
      • client.exe (PID: 4840)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2026:02:16 15:09:37+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.44
CodeSize: 99328
InitializedDataSize: 52736
UninitializedDataSize: -
EntryPoint: 0x178c0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
6
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #KARSTORAT client.exe winword.exe ai.exe no specs slui.exe #KARSTORAT client.exe #KARSTORAT client.exe

Process information

PID
CMD
Path
Indicators
Parent process
352"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\admin\Desktop\televisioncharacter.rtf" /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
672"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "0E38E77E-0CF0-4DEB-9987-4A7C477332C7" "9BA7D998-614E-446F-9D3F-F246CDC65E75" "352"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
c:\windows\system32\sechost.dll
c:\windows\system32\ole32.dll
4840"C:\Users\admin\AppData\Local\Temp\client.exe" C:\Users\admin\AppData\Local\Temp\client.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\client.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7192"C:\Users\admin\AppData\Local\Temp\client.exe" C:\Users\admin\AppData\Local\Temp\client.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\client.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7412"C:\Users\admin\AppData\Local\Temp\client.exe" C:\Users\admin\AppData\Local\Temp\client.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\client.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
7760C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
19 245
Read events
18 847
Write events
364
Delete events
34

Modification events

(PID) Process:(7412) client.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7412) client.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7412) client.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7412) client.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(7412) client.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(7412) client.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(7412) client.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(352) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\352
Operation:writeName:0
Value:
0B0E1039E8B1D9FE72AB4697B40085BCB64585230046A7D9D2AEE6DDA9EE016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C511E002D2120B770069006E0077006F00720064002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(352) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
2
(PID) Process:(352) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:de-de
Value:
2
Executable files
2
Suspicious files
35
Text files
1
Unknown types
146

Dropped files

PID
Process
Filename
Type
7412client.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\2FYVF6OU.txtbinary
MD5:0A47328A34A88185C77DDC70CBAA6178
SHA256:F1F9DC41BAB9BA048CAE9029E1FB4098DC50129672DF1C0291B7EA400F955FD0
352WINWORD.EXEC:\Users\admin\Desktop\~$levisioncharacter.rtfbinary
MD5:0A9737CD36D85AE41C8952A0C65BB59D
SHA256:9DCCFECBE142776CD80013A061E049C9E1CE1CE2EEBBC690354810B72657FEA7
352WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmbinary
MD5:EDCA5D7A23355F9B49CC30FA31998B64
SHA256:A989FA3C995C35370E8CF640937687725EAF4B430DD84E690EEDE3376C8E5CA0
352WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\0F99DCCD-5337-431E-BCB4-62E33238A4FEbinary
MD5:2392F7E9CF1A6544755CD9A06B7C2370
SHA256:8D5C92D52BE3643F99CAF12871EB54225263F1E161B8554E1FDB229D61C042CA
352WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.datbinary
MD5:69D39034E3816B396D0B3DB288ECDCF0
SHA256:353AF3A27ECD6A741BB1CC3008FA504409CB4C5F9D89A73D55EF38C0864CD7BB
352WINWORD.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDFbinary
MD5:D3B1FF98B0C4CEA7A11605802F3AB1EE
SHA256:92D1688CB11566616C0645C93773598B9A98A3F9A20D512A1403AF404CB9E628
352WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\Personalization\Governance\Anonymous\floodgatecampaigns.json.tmpbinary
MD5:A9D020B4B84168468AF78C112A1822CC
SHA256:FBD2EB40F64694FB61BCFEA2F4C9B8A4D40FA9FD1C4A2239C0FF9DEB0BD8DBB0
352WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_42.ttfbinary
MD5:8BDF396FED21EED0F788CB9A23775A1E
SHA256:BD6575CBCF808C13421BF03886E008624B85B6CE23651949BCFBD10EBD8452BE
352WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Jsontext
MD5:7C5578BC58BDE6DC855D5C929CF54232
SHA256:A48ACBE81F33E5918B096A6B89687E505DA0E79196F74DC48B6E068708378A3F
352WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbresbinary
MD5:D37F0431BB91A9A8DEBBCDD97476B3BF
SHA256:75B83EE42763BD19519F8EB3F583CC880DB6CAF35AA53788AEBEE435217B5EBA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
98
TCP/UDP connections
686
DNS requests
36
Threats
16

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5276
MoUsoCoreWorker.exe
GET
304
51.104.136.2:443
https://settings-win.data.microsoft.com/settings/v3.0/OneSettings/Client?OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&LocalDeviceID=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&AttrDataVer=186&OSUILocale=en-US&OSSkuId=48&App=WOSC&AppVer=&IsFlightingEnabled=0&TelemetryLevel=1&DeviceFamily=Windows.Desktop
US
—
—
whitelisted
352
WINWORD.EXE
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAsMayxGaRewR3PGR9SvwMg%3D
US
binary
471 b
whitelisted
5276
MoUsoCoreWorker.exe
GET
304
51.104.136.2:443
https://settings-win.data.microsoft.com/settings/v3.0/wsd/muse?ProcessorClockSpeed=3094&FlightIds=&UpdateOfferedDays=4294967295&BranchReadinessLevel=CB&OEMManufacturerName=DELL&IsCloudDomainJoined=0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&sku=48&ActivationChannel=Retail&AttrDataVer=186&IsMDMEnrolled=0&ProcessorCores=6&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&TotalPhysicalRAM=6144&PrimaryDiskType=4294967295&FlightingBranchName=&ChassisTypeId=1&OEMModelNumber=DELL&SystemVolumeTotalCapacity=260281&sampleId=95271487&deviceClass=Windows.Desktop&App=muse&DisableDualScan=0&AppVer=10.0&OEMSubModel=J5CR&locale=en-US&IsAlwaysOnAlwaysConnectedCapable=0&ms=0&DefaultUserRegion=244&UpdateServiceUrl=http%3A%2F%2Fneverupdatewindows10.com&osVer=10.0.19045.4046.amd64fre.vb_release.191206-1406&os=windows&deviceId=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&DeferQualityUpdatePeriodInDays=0&ring=Retail&DeferFeatureUpdatePeriodInDays=30
US
—
—
whitelisted
352
WINWORD.EXE
GET
200
184.86.251.137:443
https://omex.cdn.office.net/addinclassifier/officesharedentities
NL
—
314 Kb
whitelisted
7668
svchost.exe
GET
200
23.53.41.90:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
352
WINWORD.EXE
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBR0TBEVYklX7A9yLoLD9hqmCWDxFgQU3pGGSLehMVkx8UtfB6nciHnaqHYCEzMAAAAPMyBlN%2B5Crk8AAAAAAA8%3D
US
binary
2.23 Kb
whitelisted
2216
SIHClient.exe
GET
304
74.178.240.61:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
352
WINWORD.EXE
GET
200
52.123.128.14:443
https://ecs.office.com/config/v2/Office/word/16.0.16026.20146/Production/CC?&Clientid=%7bD61AB268-C26A-439D-BB15-2A0DEDFCA6A3%7d&Application=word&Platform=win32&Version=16.0.16026.20146&MsoVersion=16.0.16026.20002&SDX=fa000000002.2.0.1907.31003&SDX=fa000000005.1.0.1909.30011&SDX=fa000000006.1.0.1909.13002&SDX=fa000000008.1.0.1908.16006&SDX=fa000000009.1.0.1908.6002&SDX=fa000000016.1.0.1810.13001&SDX=fa000000029.1.0.1906.25001&SDX=fa000000033.1.0.1908.24001&SDX=wa104381125.1.0.1810.9001&ProcessName=winword.exe&Audience=Production&Build=ship&Architecture=x64&Language=en-US&SubscriptionLicense=false&PerpetualLicense=2019&LicenseCategory=6&LicenseSKU=Professional2019Retail&OsVersion=10.0&OsBuild=19045&Channel=CC&InstallType=C2R&SessionId=%7bD9B1E839-72FE-46AB-97B4-0085BCB64585%7d&LabMachine=false
US
—
352 Kb
unknown
352
WINWORD.EXE
POST
200
52.110.17.44:443
https://roaming.svc.cloud.microsoft/rs/RoamingSoapService.svc
US
text
654 b
unknown
7248
svchost.exe
POST
200
20.190.160.67:443
https://login.live.com/RST2.srf
US
binary
11.1 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
7668
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
5276
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5532
SearchApp.exe
2.16.241.201:443
www.bing.com
AKAMAI-ASN1
NL
whitelisted
2260
slui.exe
48.192.1.65:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7412
client.exe
172.67.74.152:80
api.ipify.org
CLOUDFLARENET
US
whitelisted
7412
client.exe
212.227.65.132:15144
—
IONOS-AS This is the joint network for IONOS, Fasthosts, Arsys, 1&1 Mail and Media and 1&1 Telecom. Formerly known as 1&1 Internet SE.
DE
unknown
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
7668
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7668
svchost.exe
23.53.41.90:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
whitelisted
www.bing.com
  • 2.16.241.201
  • 2.16.241.203
  • 2.16.241.209
  • 2.16.241.200
  • 2.16.241.211
  • 2.16.241.206
  • 2.16.241.212
  • 2.16.241.205
  • 2.16.241.207
whitelisted
activation-v2.sls.microsoft.com
  • 48.192.1.65
whitelisted
google.com
  • 142.251.127.139
  • 142.251.127.102
  • 142.251.127.138
  • 142.251.127.113
  • 142.251.127.100
  • 142.251.127.101
whitelisted
api.ipify.org
  • 172.67.74.152
  • 104.26.12.205
  • 104.26.13.205
whitelisted
self.events.data.microsoft.com
  • 13.89.179.11
whitelisted
crl.microsoft.com
  • 23.53.41.90
  • 23.53.40.178
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 23.59.18.102
  • 88.221.169.152
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.248
whitelisted
officeclient.microsoft.com
  • 52.110.17.17
  • 52.110.17.62
  • 52.110.17.67
  • 52.110.17.61
  • 52.110.17.38
  • 52.110.17.52
  • 52.110.17.39
  • 52.110.17.26
whitelisted

Threats

PID
Process
Class
Message
7412
client.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External IP Lookup by HTTP (api .ipify .org)
7412
client.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup api.ipify.org
2232
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
7412
client.exe
A Network Trojan was detected
RAT [ANY.RUN] KarstoRAT User-Agent observed (SecurityNotifier)
7412
client.exe
A Network Trojan was detected
RAT [ANY.RUN] KarstoRAT related IP address
7668
svchost.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
7412
client.exe
Device Retrieving External IP Address Detected
SUSPICIOUS [ANY.RUN] An IP address was received from the server as a result of an HTTP request
7192
client.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External IP Lookup by HTTP (api .ipify .org)
7192
client.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup api.ipify.org
7192
client.exe
A Network Trojan was detected
RAT [ANY.RUN] KarstoRAT User-Agent observed (SecurityNotifier)
Process
Message
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
client.exe