File name:

Adobe Download Manager.exe

Full analysis: https://app.any.run/tasks/0268c1ed-efb2-4ea4-bc3d-46d73e329dbd
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Malware Trends Tracker     >>>
Analysis date: August 23, 2024, 16:28:46
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
rat
quasar
stealer
azorult
sinkhole
evasion
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

7648BEC482B7A6BB22407308C882CF12

SHA1:

EDB98D630998A2852DE05C4C2B5D9A3400F52418

SHA256:

2C6AB1EFE207F8A2F8528CE232DCD1E2FF0B0DD82C5B460F51457A7BF97F60D9

SSDEEP:

98304:GAGQX21RBt7QjTmcaTH/vU4do9Pcjq1GvXB1sg58N32+Rr181vWDZT3FcIwEAiRU:zQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops/Copies Quasar RAT executable

      • Adobe Download Manager.exe (PID: 6764)
      • windef.exe (PID: 6836)

    • Uses Task Scheduler to run other applications

      • Adobe Download Manager.exe (PID: 6764)
      • SystemPropertiesPerformance.exe (PID: 6212)

    • Changes the autorun value in the registry

      • windef.exe (PID: 6836)
      • winsock.exe (PID: 6152)
      • winsock.exe (PID: 6820)

    • AZORULT has been detected (SURICATA)

      • Adobe Download Manager.exe (PID: 6860)
      • SystemPropertiesPerformance.exe (PID: 6420)

    • Connects to the CnC server

      • Adobe Download Manager.exe (PID: 6860)
      • SystemPropertiesPerformance.exe (PID: 6420)

    • Request for a sinkholed resource

      • Adobe Download Manager.exe (PID: 6860)

    • QUASAR has been detected (YARA)

      • Adobe Download Manager.exe (PID: 6764)
      • winsock.exe (PID: 6152)
      • SystemPropertiesPerformance.exe (PID: 6212)
      • winsock.exe (PID: 6820)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • Adobe Download Manager.exe (PID: 6764)
      • Adobe Download Manager.exe (PID: 6860)
      • SystemPropertiesPerformance.exe (PID: 6420)
      • SystemPropertiesPerformance.exe (PID: 6212)
      • winsock.exe (PID: 6152)

    • Drops the executable file immediately after the start

      • Adobe Download Manager.exe (PID: 6764)
      • windef.exe (PID: 6836)

    • Reads the date of Windows installation

      • Adobe Download Manager.exe (PID: 6764)
      • SystemPropertiesPerformance.exe (PID: 6212)
      • winsock.exe (PID: 6152)

    • Executable content was dropped or overwritten

      • Adobe Download Manager.exe (PID: 6764)
      • windef.exe (PID: 6836)

    • Application launched itself

      • Adobe Download Manager.exe (PID: 6764)
      • SystemPropertiesPerformance.exe (PID: 6212)

    • Starts itself from another location

      • windef.exe (PID: 6836)

    • Executes application which crashes

      • vnc.exe (PID: 6804)
      • vnc.exe (PID: 6508)
      • winsock.exe (PID: 6152)

    • The process executes via Task Scheduler

      • SystemPropertiesPerformance.exe (PID: 6212)

    • Connects to unusual port

      • Adobe Download Manager.exe (PID: 6860)
      • SystemPropertiesPerformance.exe (PID: 6420)

    • Contacting a server suspected of hosting an CnC

      • Adobe Download Manager.exe (PID: 6860)
      • SystemPropertiesPerformance.exe (PID: 6420)

    • Checks for external IP

      • svchost.exe (PID: 2256)
      • windef.exe (PID: 6836)
      • winsock.exe (PID: 6152)
      • winsock.exe (PID: 6820)

    • Starts CMD.EXE for commands execution

      • winsock.exe (PID: 6152)

    • Executing commands from a ".bat" file

      • winsock.exe (PID: 6152)

    • Starts application with an unusual extension

      • cmd.exe (PID: 7088)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 7088)

    • The executable file from the user directory is run by the CMD process

      • winsock.exe (PID: 6820)

  • INFO

    • Reads mouse settings

      • Adobe Download Manager.exe (PID: 6764)
      • SystemPropertiesPerformance.exe (PID: 6212)

    • Checks supported languages

      • Adobe Download Manager.exe (PID: 6764)
      • vnc.exe (PID: 6804)
      • windef.exe (PID: 6836)
      • Adobe Download Manager.exe (PID: 6860)
      • winsock.exe (PID: 6152)
      • SystemPropertiesPerformance.exe (PID: 6212)
      • vnc.exe (PID: 6508)
      • windef.exe (PID: 6404)
      • SystemPropertiesPerformance.exe (PID: 6420)
      • chcp.com (PID: 3356)
      • winsock.exe (PID: 6820)

    • Reads the machine GUID from the registry

      • Adobe Download Manager.exe (PID: 6764)
      • Adobe Download Manager.exe (PID: 6860)
      • windef.exe (PID: 6836)
      • winsock.exe (PID: 6152)
      • SystemPropertiesPerformance.exe (PID: 6212)
      • SystemPropertiesPerformance.exe (PID: 6420)
      • windef.exe (PID: 6404)
      • winsock.exe (PID: 6820)

    • Create files in a temporary directory

      • Adobe Download Manager.exe (PID: 6764)
      • SystemPropertiesPerformance.exe (PID: 6212)
      • winsock.exe (PID: 6152)

    • Reads the computer name

      • Adobe Download Manager.exe (PID: 6764)
      • Adobe Download Manager.exe (PID: 6860)
      • windef.exe (PID: 6836)
      • winsock.exe (PID: 6152)
      • SystemPropertiesPerformance.exe (PID: 6212)
      • windef.exe (PID: 6404)
      • SystemPropertiesPerformance.exe (PID: 6420)
      • winsock.exe (PID: 6820)

    • Process checks computer location settings

      • Adobe Download Manager.exe (PID: 6764)
      • SystemPropertiesPerformance.exe (PID: 6212)
      • winsock.exe (PID: 6152)

    • Reads Environment values

      • Adobe Download Manager.exe (PID: 6860)
      • windef.exe (PID: 6836)
      • winsock.exe (PID: 6152)
      • SystemPropertiesPerformance.exe (PID: 6420)
      • winsock.exe (PID: 6820)

    • Checks proxy server information

      • Adobe Download Manager.exe (PID: 6860)
      • WerFault.exe (PID: 7096)
      • windef.exe (PID: 6836)
      • winsock.exe (PID: 6152)
      • SystemPropertiesPerformance.exe (PID: 6420)
      • WerFault.exe (PID: 6476)
      • WerFault.exe (PID: 7016)
      • winsock.exe (PID: 6820)

    • Reads the software policy settings

      • WerFault.exe (PID: 7096)
      • WerFault.exe (PID: 6476)
      • WerFault.exe (PID: 7016)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 7096)
      • windef.exe (PID: 6836)
      • winsock.exe (PID: 6152)
      • WerFault.exe (PID: 6476)
      • WerFault.exe (PID: 7016)

    • Disables trace logs

      • windef.exe (PID: 6836)
      • winsock.exe (PID: 6152)
      • winsock.exe (PID: 6820)

    • Changes the display of characters in the console

      • chcp.com (PID: 3356)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Quasar

(PID) Process(6152) winsock.exe
Version1.3.0.0
C2 (3)5.8.88.191:443
sockartek.icu:443
Sub_DirSubDir
Install_Namewinsock.exe
MutexQSR_MUTEX_0kBRNrRz5TDLEQouI0
Startupwin defender run
TagEbayProfiles
LogDirLogs
Signature
Certificate
(PID) Process(6820) winsock.exe
Version1.3.0.0
C2 (3)5.8.88.191:443
sockartek.icu:443
Sub_DirSubDir
Install_Namewinsock.exe
MutexQSR_MUTEX_0kBRNrRz5TDLEQouI0
Startupwin defender run
TagEbayProfiles
LogDirLogs
Signature
Certificate
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (17.3)
.dll | Win32 Dynamic Link Library (generic) (4.1)
.exe | Win32 Executable (generic) (2.8)
.exe | Generic Win/DOS Executable (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:03:12 13:38:44+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 581120
InitializedDataSize: 1527296
UninitializedDataSize: -
EntryPoint: 0x27dcd
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: Adobe Download Manager
OriginalFileName: Adobe Download Manager
CompanyName: Adobe Systems Incorporated
FileVersion: ...
LegalCopyright: Copyright 2018 Adobe Incorporated. All rights reserved.
ProductName: Adobe Download Manager
ProductVersion: ...
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
156
Monitored processes
24
Malicious processes
9
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #QUASAR adobe download manager.exe vnc.exe svchost.exe no specs windef.exe #AZORULT adobe download manager.exe schtasks.exe no specs conhost.exe no specs werfault.exe #QUASAR winsock.exe svchost.exe #QUASAR systempropertiesperformance.exe no specs vnc.exe svchost.exe no specs windef.exe no specs werfault.exe #AZORULT systempropertiesperformance.exe schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs werfault.exe ping.exe no specs #QUASAR winsock.exe

Process information

PID
CMD
Path
Indicators
Parent process
2256C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3356chcp 65001C:\Windows\SysWOW64\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6152"C:\Users\admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\admin\AppData\Roaming\SubDir\winsock.exe
windef.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
3762504530
Version:
1.3.0.0
Modules
Images
c:\users\admin\appdata\roaming\subdir\winsock.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Quasar
(PID) Process(6152) winsock.exe
Version1.3.0.0
C2 (3)5.8.88.191:443
sockartek.icu:443
Sub_DirSubDir
Install_Namewinsock.exe
MutexQSR_MUTEX_0kBRNrRz5TDLEQouI0
Startupwin defender run
TagEbayProfiles
LogDirLogs
Signature
Certificate
6212"C:\Users\admin\btpanui\SystemPropertiesPerformance.exe"C:\Users\admin\btpanui\SystemPropertiesPerformance.exe
svchost.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Download Manager
Version:
...
Modules
Images
c:\users\admin\btpanui\systempropertiesperformance.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\psapi.dll
c:\windows\syswow64\user32.dll
6404"C:\Users\admin\AppData\Local\Temp\windef.exe" C:\Users\admin\AppData\Local\Temp\windef.exe—SystemPropertiesPerformance.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.3.0.0
Modules
Images
c:\users\admin\appdata\local\temp\windef.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6420"C:\Users\admin\btpanui\SystemPropertiesPerformance.exe"C:\Users\admin\btpanui\SystemPropertiesPerformance.exe
SystemPropertiesPerformance.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Download Manager
Exit code:
0
Version:
...
Modules
Images
c:\users\admin\btpanui\systempropertiesperformance.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
6432C:\WINDOWS\system32\svchost.exe -kC:\Windows\System32\svchost.exe—vnc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
6476C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6508 -s 576C:\Windows\SysWOW64\WerFault.exe
vnc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
6508"C:\Users\admin\AppData\Local\Temp\vnc.exe" C:\Users\admin\AppData\Local\Temp\vnc.exe
SystemPropertiesPerformance.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\temp\vnc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
6620"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /FC:\Windows\SysWOW64\schtasks.exe—SystemPropertiesPerformance.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
Total events
29 637
Read events
29 555
Write events
82
Delete events
0

Modification events

(PID) Process:(6764) Adobe Download Manager.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6764) Adobe Download Manager.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6764) Adobe Download Manager.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6764) Adobe Download Manager.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6860) Adobe Download Manager.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6860) Adobe Download Manager.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6860) Adobe Download Manager.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6860) Adobe Download Manager.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6860) Adobe Download Manager.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6860) Adobe Download Manager.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
Executable files
4
Suspicious files
8
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
7096WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_vnc.exe_11dadb6a71afb88abcfcb9dd2dff3abfa557f294_c40a04ad_4bf38fd8-7572-4716-8b85-e5813c58184d\Report.wer —
MD5:—
SHA256:—
6476WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_vnc.exe_11dadb6a71afb88abcfcb9dd2dff3abfa557f294_c40a04ad_0e0eef27-2a28-4318-901c-18664512e183\Report.wer —
MD5:—
SHA256:—
7016WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_winsock.exe_4ec29f32368eb0b92941df6619f6579b4b16f5a8_e8bd1e0d_61f0f49f-e456-4aa4-bb3b-66b661ef3ab2\Report.wer —
MD5:—
SHA256:—
7016WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\winsock.exe.6152.dmp —
MD5:—
SHA256:—
6764Adobe Download Manager.exeC:\Users\admin\AppData\Local\Temp\vnc.exeexecutable
MD5:B8BA87EE4C3FC085A2FED0D839AADCE1
SHA256:4E8A99CD33C9E5C747A3CE8F1A3E17824846F4A8F7CB0631AEBD0815DB2CE3A4
6764Adobe Download Manager.exeC:\Users\admin\AppData\Local\Temp\windef.exeexecutable
MD5:B4A202E03D4135484D0E730173ABCC72
SHA256:7050608D53F80269DF951D00883ED79815C060CE7678A76B5C3F6A2A985BEEA9
6836windef.exeC:\Users\admin\AppData\Roaming\SubDir\winsock.exeexecutable
MD5:B4A202E03D4135484D0E730173ABCC72
SHA256:7050608D53F80269DF951D00883ED79815C060CE7678A76B5C3F6A2A985BEEA9
6764Adobe Download Manager.exeC:\Users\admin\btpanui\SystemPropertiesPerformance.exeexecutable
MD5:3E309F84A55A589CFD94475717728AC7
SHA256:7C7C576CCEC48293E32E51DC1A8E5EEADB4DA5601EABA27EA5D24A24A4B68679
7096WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:82C30E45BF5F93A5DB1D5E47F913053B
SHA256:2C6BBFF9207065E8800C4AF0CB2748818ABB3CFFC0D6D518FE17F76A232F8967
6152winsock.exeC:\Users\admin\AppData\Roaming\Logs\08-23-2024binary
MD5:97D5B22D044C183BE40043C6AEA6080A
SHA256:1FC46CE036739AF6ED6435A7C23A2E1B6BCDCFAD1D2D2A7C165016BC6C2F8ABC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
42
DNS requests
20
Threats
15

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6860
Adobe Download Manager.exe
POST
200
44.221.84.105:8000
http://0x21.in:8000/_az/
unknown
—
—
unknown
6860
Adobe Download Manager.exe
POST
—
44.221.84.105:8000
http://0x21.in:8000/_az/
unknown
—
—
unknown
6836
windef.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
—
—
shared
6820
winsock.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
—
—
shared
5904
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5904
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6760
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6732
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6152
winsock.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
—
—
shared
6420
SystemPropertiesPerformance.exe
POST
200
44.221.84.105:8000
http://0x21.in:8000/_az/
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6140
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2580
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6860
Adobe Download Manager.exe
44.221.84.105:8000
0x21.in
AMAZON-AES
US
unknown
7096
WerFault.exe
52.182.143.212:443
watson.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
6836
windef.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
unknown
6152
winsock.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
unknown
6152
winsock.exe
5.8.88.191:443
—
PINVDS OU
RU
malicious
6420
SystemPropertiesPerformance.exe
44.221.84.105:8000
0x21.in
AMAZON-AES
US
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.74.206
whitelisted
0x21.in
  • 44.221.84.105
unknown
watson.events.data.microsoft.com
  • 52.182.143.212
  • 52.168.117.173
whitelisted
ip-api.com
  • 208.95.112.1
shared
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
  • 40.127.240.158
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.160.22
  • 40.126.32.140
  • 40.126.32.136
  • 40.126.32.72
  • 20.190.160.20
  • 40.126.32.68
  • 40.126.32.134
  • 40.126.32.76
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
arc.msn.com
  • 20.74.47.205
whitelisted
slscr.update.microsoft.com
  • 40.127.169.103
whitelisted

Threats

PID
Process
Class
Message
6860
Adobe Download Manager.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/AZORult V3.2 Client Checkin M13
6860
Adobe Download Manager.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
6860
Adobe Download Manager.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst
6860
Adobe Download Manager.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/AZORult V3.2 Client Checkin M13
2256
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
6836
windef.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
2256
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
6836
windef.exe
A Network Trojan was detected
ET MALWARE Common RAT Connectivity Check Observed
6152
winsock.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
6152
winsock.exe
A Network Trojan was detected
ET MALWARE Common RAT Connectivity Check Observed
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Adobe Download Manager.exe