File name:

HitmanPro.exe

Full analysis: https://app.any.run/tasks/2373a449-8b35-4e05-aa7c-634064551f6c
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: June 25, 2025, 23:23:24
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 6 sections
MD5:

0CDABD52F745074BD258C99E68876117

SHA1:

8913CD6A807E3807C697B1BE4A8014712805FD1E

SHA256:

221EDE5696634B6F2BE0BFA6A5EA531BF93D78B7113FACF34185CE305891D66C

SSDEEP:

98304:966RXtarHl1oxhQ8ElMRHLgy6qTWDkFyStr3tE7saYLT8wiI3OjK5Wh3+MRl1/pk:jDZD8RAGtNePxPV86BknE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • HitmanPro.exe (PID: 1136)

    • Steals credentials from Web Browsers

      • HitmanPro.exe (PID: 1136)

  • SUSPICIOUS

    • Creates a software uninstall entry

      • HitmanPro.exe (PID: 1136)

    • Executable content was dropped or overwritten

      • HitmanPro.exe (PID: 1136)

    • Executes as Windows Service

      • hmpsched.exe (PID: 5116)
      • VSSVC.exe (PID: 2148)

    • Creates files in the driver directory

      • HitmanPro.exe (PID: 1136)

    • Drops a system driver (possible attempt to evade defenses)

      • HitmanPro.exe (PID: 1136)

    • Reads security settings of Internet Explorer

      • HitmanPro.exe (PID: 1136)

    • Read startup parameters

      • HitmanPro.exe (PID: 1136)

    • Detected use of alternative data streams (AltDS)

      • HitmanPro.exe (PID: 1136)

    • Adds/modifies Windows certificates

      • HitmanPro.exe (PID: 1136)

    • Searches for installed software

      • HitmanPro.exe (PID: 1136)
      • dllhost.exe (PID: 6472)

    • Modifies hosts file to alter network resolution

      • HitmanPro.exe (PID: 1136)

    • The process executes via Task Scheduler

      • updater.exe (PID: 6724)

    • Application launched itself

      • updater.exe (PID: 6724)

  • INFO

    • Reads the computer name

      • HitmanPro.exe (PID: 1136)
      • hmpsched.exe (PID: 5116)
      • updater.exe (PID: 6724)

    • Checks supported languages

      • hmpsched.exe (PID: 5116)
      • HitmanPro.exe (PID: 1136)
      • updater.exe (PID: 6724)
      • updater.exe (PID: 4044)

    • Checks proxy server information

      • HitmanPro.exe (PID: 1136)
      • slui.exe (PID: 2716)

    • Reads the machine GUID from the registry

      • HitmanPro.exe (PID: 1136)

    • Creates files in the program directory

      • HitmanPro.exe (PID: 1136)

    • Reads the software policy settings

      • HitmanPro.exe (PID: 1136)
      • slui.exe (PID: 2716)

    • Manages system restore points

      • SrTasks.exe (PID: 2760)

    • Process checks whether UAC notifications are on

      • updater.exe (PID: 6724)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 EXE PECompact compressed (generic) (24.9)
.exe | Win32 Executable (generic) (2.7)
.exe | Generic Win/DOS Executable (1.2)
.exe | DOS Executable Generic (1.2)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:03:14 13:22:16+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 12
CodeSize: 3166720
InitializedDataSize: 11136512
UninitializedDataSize: -
EntryPoint: 0x2c3a08
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 3.8.44.340
ProductVersionNumber: 3.8.44.340
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Sophos B.V.
FileDescription: HitmanPro 3.8
FileVersion: 3, 8, 44, 340
InternalName: HitmanPro38
LegalCopyright: © 2006-2025 Sophos B.V.
OriginalFileName: HitmanPro.exe
ProductName: HitmanPro
ProductVersion: 3.8.44.340
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
10
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start hitmanpro.exe hmpsched.exe no specs slui.exe vssvc.exe no specs SPPSurrogate no specs srtasks.exe no specs conhost.exe no specs updater.exe no specs updater.exe no specs hitmanpro.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
320"C:\Users\admin\Desktop\HitmanPro.exe" C:\Users\admin\Desktop\HitmanPro.exe—explorer.exe
User:
admin
Company:
Sophos B.V.
Integrity Level:
MEDIUM
Description:
HitmanPro 3.8
Exit code:
3221226540
Version:
3, 8, 44, 340
Modules
Images
c:\users\admin\desktop\hitmanpro.exe
c:\windows\system32\ntdll.dll
1136"C:\Users\admin\Desktop\HitmanPro.exe" C:\Users\admin\Desktop\HitmanPro.exe
explorer.exe
User:
admin
Company:
Sophos B.V.
Integrity Level:
HIGH
Description:
HitmanPro 3.8
Exit code:
0
Version:
3, 8, 44, 340
Modules
Images
c:\users\admin\desktop\hitmanpro.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2148C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2716C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2760C:\WINDOWS\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:12C:\Windows\System32\SrTasks.exe—dllhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft® Windows System Protection background tasks.
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\srtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4044"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=134.0.6985.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x29c,0x2a0,0x2a4,0x298,0x2a8,0xa3c460,0xa3c46c,0xa3c478C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe—updater.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\program files (x86)\google\googleupdater\134.0.6985.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
5116"C:\Program Files\HitmanPro\hmpsched.exe"C:\Program Files\HitmanPro\hmpsched.exe—services.exe
User:
SYSTEM
Company:
Sophos B.V.
Integrity Level:
SYSTEM
Description:
HitmanPro Scheduler
Version:
3, 8, 44, 340
Modules
Images
c:\program files\hitmanpro\hmpsched.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
5424\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6472C:\WINDOWS\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
6724"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --wake --systemC:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe—svchost.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\program files (x86)\google\googleupdater\134.0.6985.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
Total events
44 964
Read events
44 694
Write events
233
Delete events
37

Modification events

(PID) Process:(1136) HitmanPro.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\HitmanPro
Operation:writeName:UID
Value:
{0AE29DBB-3B66-4463-8CA0-92B4D243C101}
(PID) Process:(1136) HitmanPro.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\HitmanPro
Operation:writeName:LastCFU
Value:
2025-06-25 23:23:36
(PID) Process:(1136) HitmanPro.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\HitmanPro
Operation:writeName:EULA37
Value:
1
(PID) Process:(1136) HitmanPro.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HitmanPro38
Operation:writeName:DisplayName
Value:
HitmanPro 3.8
(PID) Process:(1136) HitmanPro.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HitmanPro38
Operation:writeName:InstallDate
Value:
20250625
(PID) Process:(1136) HitmanPro.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HitmanPro38
Operation:writeName:DisplayIcon
Value:
C:\Program Files\HitmanPro\HitmanPro.exe
(PID) Process:(1136) HitmanPro.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HitmanPro38
Operation:writeName:DisplayVersion
Value:
3.8.44.340
(PID) Process:(1136) HitmanPro.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HitmanPro38
Operation:writeName:InstallLocation
Value:
C:\Program Files\HitmanPro
(PID) Process:(1136) HitmanPro.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HitmanPro38
Operation:writeName:NoModify
Value:
1
(PID) Process:(1136) HitmanPro.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HitmanPro38
Operation:writeName:NoRepair
Value:
1
Executable files
3
Suspicious files
5
Text files
4
Unknown types
3

Dropped files

PID
Process
Filename
Type
6472dllhost.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
1136HitmanPro.exeC:\Program Files\HitmanPro\HitmanPro.exeexecutable
MD5:0CDABD52F745074BD258C99E68876117
SHA256:221EDE5696634B6F2BE0BFA6A5EA531BF93D78B7113FACF34185CE305891D66C
1136HitmanPro.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro\HitmanPro.lnklnk
MD5:487EDF53A9B9259F9992BFBEFC64C0E4
SHA256:AB131F735677CE7BBC6ED76C80047D78AC8CD7AC5C4B9D444D7DD3A4336E785F
1136HitmanPro.exeC:\Program Files\HitmanPro\hmpsched.exeexecutable
MD5:9A7DCA9D602BEDF990DF2FEB79B6CA2F
SHA256:88144D909CEE7894D382F7411B06D2F1EBB909E9C5E0D2FE44FDB7993478E6F4
1136HitmanPro.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\places.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
1136HitmanPro.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cookies.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
6472dllhost.exeC:\System Volume Information\SPP\snapshot-2binary
MD5:9196A32237E4A2B445D07636B872EB92
SHA256:8ABF2598F5B6846BBFF2231FCFBF67B908CBEE9337CF2A1F322D3CF74EBBB683
1136HitmanPro.exeC:\ProgramData\HitmanPro\Remnants.binbinary
MD5:8DED0B991DD6707E9F201486E0EAAB13
SHA256:6715B13D7103DA463432E2510C7AEC3C771606FD6D1BAD5B09023F4BA2E6780B
6472dllhost.exeC:\System Volume Information\SPP\OnlineMetadataCache\{fff1b342-29bd-4cab-87ef-ce5cc330028a}_OnDiskSnapshotPropbinary
MD5:9196A32237E4A2B445D07636B872EB92
SHA256:8ABF2598F5B6846BBFF2231FCFBF67B908CBEE9337CF2A1F322D3CF74EBBB683
4044updater.exeC:\Program Files (x86)\Google\GoogleUpdater\updater.logtext
MD5:60B35C0672ADAA2AE3E616E97FE6E7C5
SHA256:442874A853C2BD2DE90896D2C90B041BA07168C69D248581FF558D442B8D59D9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
185
TCP/UDP connections
47
DNS requests
26
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
2.23.176.136:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
HEAD
200
185.105.204.28:443
https://files.surfright.nl/HitmanPro_x64.exe
unknown
—
—
unknown
1136
HitmanPro.exe
GET
200
52.174.35.5:80
http://scan.hitmanpro.com/banner.aspx?lc=en&v=3.8.44.340&c=
unknown
—
—
unknown
—
—
POST
200
20.190.160.67:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
16.7 Kb
whitelisted
—
—
GET
200
23.97.160.56:443
https://remnants.hitmanpro.com/remnant.ashx?v=3.8.44.340
unknown
binary
478 Kb
unknown
—
—
POST
200
20.190.160.67:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
—
—
POST
200
23.97.160.56:443
https://hash.hitmanpro.com/
unknown
text
1.64 Kb
unknown
—
—
POST
200
23.97.160.56:443
https://hash.hitmanpro.com/
unknown
text
1.64 Kb
unknown
—
—
POST
200
23.97.160.56:443
https://hash.hitmanpro.com/
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
2.23.176.136:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1136
HitmanPro.exe
185.105.204.28:443
files.surfright.nl
Signet B.V.
NL
whitelisted
1136
HitmanPro.exe
52.174.35.5:80
scan.hitmanpro.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
  • 51.124.78.146
whitelisted
google.com
  • 216.58.212.174
whitelisted
crl.microsoft.com
  • 2.23.176.136
  • 2.23.176.189
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 2.23.181.156
  • 95.101.149.131
whitelisted
scan.hitmanpro.com
  • 52.174.35.5
unknown
files.surfright.nl
  • 185.105.204.28
whitelisted
login.live.com
  • 20.190.159.23
  • 20.190.159.130
  • 20.190.159.0
  • 20.190.159.71
  • 20.190.159.68
  • 20.190.159.4
  • 40.126.31.131
  • 20.190.159.64
whitelisted
remnants.hitmanpro.com
  • 23.97.160.56
unknown
nexusrules.officeapps.live.com
  • 52.111.236.23
whitelisted
hash.hitmanpro.com
  • 23.97.160.56
unknown

Threats

No threats detected
Process
Message
HitmanPro.exe
ResetFileSecurity: C:\WINDOWS\system32\drivers\etc\hosts
HitmanPro.exe
> OK
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HitmanPro.exe