File name:

HitmanPro.exe

Full analysis: https://app.any.run/tasks/2373a449-8b35-4e05-aa7c-634064551f6c
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: June 25, 2025, 23:23:24
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 6 sections
MD5:

0CDABD52F745074BD258C99E68876117

SHA1:

8913CD6A807E3807C697B1BE4A8014712805FD1E

SHA256:

221EDE5696634B6F2BE0BFA6A5EA531BF93D78B7113FACF34185CE305891D66C

SSDEEP:

98304:966RXtarHl1oxhQ8ElMRHLgy6qTWDkFyStr3tE7saYLT8wiI3OjK5Wh3+MRl1/pk:jDZD8RAGtNePxPV86BknE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Steals credentials from Web Browsers

      • HitmanPro.exe (PID: 1136)

    • Actions looks like stealing of personal data

      • HitmanPro.exe (PID: 1136)

  • SUSPICIOUS

    • Executes as Windows Service

      • hmpsched.exe (PID: 5116)
      • VSSVC.exe (PID: 2148)

    • Drops a system driver (possible attempt to evade defenses)

      • HitmanPro.exe (PID: 1136)

    • Reads security settings of Internet Explorer

      • HitmanPro.exe (PID: 1136)

    • Creates a software uninstall entry

      • HitmanPro.exe (PID: 1136)

    • Creates files in the driver directory

      • HitmanPro.exe (PID: 1136)

    • Executable content was dropped or overwritten

      • HitmanPro.exe (PID: 1136)

    • Detected use of alternative data streams (AltDS)

      • HitmanPro.exe (PID: 1136)

    • Modifies hosts file to alter network resolution

      • HitmanPro.exe (PID: 1136)

    • Searches for installed software

      • HitmanPro.exe (PID: 1136)
      • dllhost.exe (PID: 6472)

    • Adds/modifies Windows certificates

      • HitmanPro.exe (PID: 1136)

    • Application launched itself

      • updater.exe (PID: 6724)

    • The process executes via Task Scheduler

      • updater.exe (PID: 6724)

    • Read startup parameters

      • HitmanPro.exe (PID: 1136)

  • INFO

    • Reads the computer name

      • HitmanPro.exe (PID: 1136)
      • hmpsched.exe (PID: 5116)
      • updater.exe (PID: 6724)

    • Creates files in the program directory

      • HitmanPro.exe (PID: 1136)

    • Reads the machine GUID from the registry

      • HitmanPro.exe (PID: 1136)

    • Checks supported languages

      • hmpsched.exe (PID: 5116)
      • HitmanPro.exe (PID: 1136)
      • updater.exe (PID: 6724)
      • updater.exe (PID: 4044)

    • Checks proxy server information

      • HitmanPro.exe (PID: 1136)
      • slui.exe (PID: 2716)

    • Reads the software policy settings

      • HitmanPro.exe (PID: 1136)
      • slui.exe (PID: 2716)

    • Manages system restore points

      • SrTasks.exe (PID: 2760)

    • Process checks whether UAC notifications are on

      • updater.exe (PID: 6724)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 EXE PECompact compressed (generic) (24.9)
.exe | Win32 Executable (generic) (2.7)
.exe | Generic Win/DOS Executable (1.2)
.exe | DOS Executable Generic (1.2)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:03:14 13:22:16+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 12
CodeSize: 3166720
InitializedDataSize: 11136512
UninitializedDataSize: -
EntryPoint: 0x2c3a08
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 3.8.44.340
ProductVersionNumber: 3.8.44.340
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Sophos B.V.
FileDescription: HitmanPro 3.8
FileVersion: 3, 8, 44, 340
InternalName: HitmanPro38
LegalCopyright: © 2006-2025 Sophos B.V.
OriginalFileName: HitmanPro.exe
ProductName: HitmanPro
ProductVersion: 3.8.44.340
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
10
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start hitmanpro.exe hmpsched.exe no specs slui.exe vssvc.exe no specs SPPSurrogate no specs srtasks.exe no specs conhost.exe no specs updater.exe no specs updater.exe no specs hitmanpro.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
320"C:\Users\admin\Desktop\HitmanPro.exe" C:\Users\admin\Desktop\HitmanPro.exe—explorer.exe
User:
admin
Company:
Sophos B.V.
Integrity Level:
MEDIUM
Description:
HitmanPro 3.8
Exit code:
3221226540
Version:
3, 8, 44, 340
Modules
Images
c:\users\admin\desktop\hitmanpro.exe
c:\windows\system32\ntdll.dll
1136"C:\Users\admin\Desktop\HitmanPro.exe" C:\Users\admin\Desktop\HitmanPro.exe
explorer.exe
User:
admin
Company:
Sophos B.V.
Integrity Level:
HIGH
Description:
HitmanPro 3.8
Exit code:
0
Version:
3, 8, 44, 340
Modules
Images
c:\users\admin\desktop\hitmanpro.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2148C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2716C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2760C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:12C:\Windows\System32\SrTasks.exe—dllhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4044"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=134.0.6985.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x29c,0x2a0,0x2a4,0x298,0x2a8,0xa3c460,0xa3c46c,0xa3c478C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe—updater.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\program files (x86)\google\googleupdater\134.0.6985.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
5116"C:\Program Files\HitmanPro\hmpsched.exe"C:\Program Files\HitmanPro\hmpsched.exe—services.exe
User:
SYSTEM
Company:
Sophos B.V.
Integrity Level:
SYSTEM
Description:
HitmanPro Scheduler
Version:
3, 8, 44, 340
Modules
Images
c:\program files\hitmanpro\hmpsched.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
5424\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6472C:\WINDOWS\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
6724"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --wake --systemC:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe—svchost.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\program files (x86)\google\googleupdater\134.0.6985.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
Total events
44 964
Read events
44 694
Write events
233
Delete events
37

Modification events

(PID) Process:(1136) HitmanPro.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\HitmanPro
Operation:writeName:UID
Value:
{0AE29DBB-3B66-4463-8CA0-92B4D243C101}
(PID) Process:(1136) HitmanPro.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\HitmanPro
Operation:writeName:LastCFU
Value:
2025-06-25 23:23:36
(PID) Process:(1136) HitmanPro.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\HitmanPro
Operation:writeName:EULA37
Value:
1
(PID) Process:(1136) HitmanPro.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HitmanPro38
Operation:writeName:DisplayName
Value:
HitmanPro 3.8
(PID) Process:(1136) HitmanPro.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HitmanPro38
Operation:writeName:InstallDate
Value:
20250625
(PID) Process:(1136) HitmanPro.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HitmanPro38
Operation:writeName:DisplayIcon
Value:
C:\Program Files\HitmanPro\HitmanPro.exe
(PID) Process:(1136) HitmanPro.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HitmanPro38
Operation:writeName:DisplayVersion
Value:
3.8.44.340
(PID) Process:(1136) HitmanPro.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HitmanPro38
Operation:writeName:InstallLocation
Value:
C:\Program Files\HitmanPro
(PID) Process:(1136) HitmanPro.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HitmanPro38
Operation:writeName:NoModify
Value:
1
(PID) Process:(1136) HitmanPro.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HitmanPro38
Operation:writeName:NoRepair
Value:
1
Executable files
3
Suspicious files
5
Text files
4
Unknown types
3

Dropped files

PID
Process
Filename
Type
6472dllhost.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
1136HitmanPro.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro\HitmanPro.lnklnk
MD5:487EDF53A9B9259F9992BFBEFC64C0E4
SHA256:AB131F735677CE7BBC6ED76C80047D78AC8CD7AC5C4B9D444D7DD3A4336E785F
1136HitmanPro.exeC:\Windows\System32\drivers\hitmanpro37.sysexecutable
MD5:55B9678F6281FF7CB41B8994DABF9E67
SHA256:EB5D9DF12AE2770D0E5558E8264CBB1867C618217D10B5115690AB4DCFE893C6
1136HitmanPro.exeC:\Windows\System32\drivers\etc\hosts.hitmanprotext
MD5:C40F0E533A52F202035621D27E732F5A
SHA256:408442168118E82FAF7D419AA4F0D8FA04F45A5E6D0E7065A9CDC723782C5AE3
4044updater.exeC:\Program Files (x86)\Google\GoogleUpdater\updater.logtext
MD5:60B35C0672ADAA2AE3E616E97FE6E7C5
SHA256:442874A853C2BD2DE90896D2C90B041BA07168C69D248581FF558D442B8D59D9
1136HitmanPro.exeC:\ProgramData\HitmanPro\Remnants.binbinary
MD5:8DED0B991DD6707E9F201486E0EAAB13
SHA256:6715B13D7103DA463432E2510C7AEC3C771606FD6D1BAD5B09023F4BA2E6780B
1136HitmanPro.exeC:\Program Files\HitmanPro\HitmanPro.exeexecutable
MD5:0CDABD52F745074BD258C99E68876117
SHA256:221EDE5696634B6F2BE0BFA6A5EA531BF93D78B7113FACF34185CE305891D66C
1136HitmanPro.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\places.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
1136HitmanPro.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro\Remove HitmanPro 3.8.lnklnk
MD5:6FD1D9C5090267009A1BB5A58CC2C827
SHA256:274FE9A8FD8F925837991197E5D4E0D4635E47225C8AF20B5339D59B9A10B921
1136HitmanPro.exeC:\Users\Public\Desktop\HitmanPro.lnklnk
MD5:7C58AF7AA465805E5CAEB166E455DA8D
SHA256:B93A7E1E9A48C319B0AFAB312B1DC62329565F46A1BA2932944B48EE2ACAE985
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
185
TCP/UDP connections
47
DNS requests
26
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
200
20.190.160.67:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
2.23.176.136:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
HEAD
200
185.105.204.28:443
https://files.surfright.nl/HitmanPro_x64.exe
unknown
—
—
—
1136
HitmanPro.exe
GET
200
52.174.35.5:80
http://scan.hitmanpro.com/banner.aspx?lc=en&v=3.8.44.340&c=
unknown
—
—
unknown
—
—
POST
200
20.190.160.67:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
16.7 Kb
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
200
20.190.160.17:443
https://login.live.com/RST2.srf
unknown
xml
11.1 Kb
whitelisted
—
—
POST
200
23.97.160.56:443
https://hash.hitmanpro.com/
unknown
text
1.64 Kb
—
—
—
POST
200
23.97.160.56:443
https://hash.hitmanpro.com/
unknown
text
1.64 Kb
—
—
—
POST
200
23.97.160.56:443
https://hash.hitmanpro.com/
unknown
text
1.64 Kb
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
2.23.176.136:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1136
HitmanPro.exe
185.105.204.28:443
files.surfright.nl
Signet B.V.
NL
whitelisted
1136
HitmanPro.exe
52.174.35.5:80
scan.hitmanpro.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
  • 51.124.78.146
whitelisted
google.com
  • 216.58.212.174
whitelisted
crl.microsoft.com
  • 2.23.176.136
  • 2.23.176.189
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 2.23.181.156
  • 95.101.149.131
whitelisted
scan.hitmanpro.com
  • 52.174.35.5
unknown
files.surfright.nl
  • 185.105.204.28
whitelisted
login.live.com
  • 20.190.159.23
  • 20.190.159.130
  • 20.190.159.0
  • 20.190.159.71
  • 20.190.159.68
  • 20.190.159.4
  • 40.126.31.131
  • 20.190.159.64
whitelisted
remnants.hitmanpro.com
  • 23.97.160.56
unknown
nexusrules.officeapps.live.com
  • 52.111.236.23
whitelisted
hash.hitmanpro.com
  • 23.97.160.56
unknown

Threats

No threats detected
Process
Message
HitmanPro.exe
ResetFileSecurity: C:\WINDOWS\system32\drivers\etc\hosts
HitmanPro.exe
> OK
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HitmanPro.exe