File name:

lossless scaling.zip

Full analysis: https://app.any.run/tasks/a4a46617-34d9-467d-b97a-3c5347a3cf0b
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: January 31, 2025, 13:41:14
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
rat
asyncrat
remote
stealer
fody
purecrypter
crypto-regex
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

11BF2E6ABB5FA3717ED2CC967F5FEA42

SHA1:

160186A702ECE19956AF6FBADDB5C7F16FC46039

SHA256:

3600628371F327A224A65A521AACE3A86AAADBC7B8A993840B097C593D090D66

SSDEEP:

98304:i6QSRXFI4umk5aJ/x+uggqN6y2mgniNZFW81ecxSDQHQT0HOwKkUp5pgpU95BZXK:2XkU+RMNlqTOuTo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 5392)
      • powershell.exe (PID: 1200)
      • powershell.exe (PID: 4444)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 5392)
      • powershell.exe (PID: 1200)
      • powershell.exe (PID: 4536)
      • powershell.exe (PID: 4504)
      • powershell.exe (PID: 3692)
      • powershell.exe (PID: 4444)
      • powershell.exe (PID: 2624)
      • powershell.exe (PID: 6952)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 4596)
      • cmd.exe (PID: 244)
      • wscript.exe (PID: 7020)
      • wscript.exe (PID: 7100)
      • wscript.exe (PID: 7056)
      • wscript.exe (PID: 6316)

    • Uses Task Scheduler to run other applications

      • powershell.exe (PID: 5392)

    • Dynamically loads an assembly (POWERSHELL)

      • powershell.exe (PID: 4536)
      • powershell.exe (PID: 4504)
      • powershell.exe (PID: 2624)
      • powershell.exe (PID: 6952)

    • ASYNCRAT has been detected (SURICATA)

      • aspnet_compiler.exe (PID: 1808)

    • Actions looks like stealing of personal data

      • aspnet_compiler.exe (PID: 1808)

    • PURECRYPTER has been detected (SURICATA)

      • MSBuild.exe (PID: 5872)

    • ASYNCRAT has been detected (YARA)

      • aspnet_compiler.exe (PID: 1808)

  • SUSPICIOUS

    • Starts NET.EXE to display or manage information about active sessions

      • cmd.exe (PID: 4328)
      • net.exe (PID: 4556)
      • cmd.exe (PID: 4596)
      • net.exe (PID: 1904)

    • Starts process via Powershell

      • powershell.exe (PID: 5604)
      • powershell.exe (PID: 3692)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 4328)
      • cmd.exe (PID: 4596)
      • cmd.exe (PID: 244)
      • wscript.exe (PID: 7020)
      • wscript.exe (PID: 7100)
      • cmd.exe (PID: 5320)
      • wscript.exe (PID: 7056)
      • wscript.exe (PID: 6316)

    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 5604)
      • Setup.exe (PID: 6892)
      • aspnet_compiler.exe (PID: 1808)

    • Executable content was dropped or overwritten

      • xcopy.exe (PID: 6288)
      • powershell.exe (PID: 1200)
      • aspnet_compiler.exe (PID: 1808)
      • hjfnql.exe (PID: 3744)

    • Likely accesses (executes) a file from the Public directory

      • xcopy.exe (PID: 6288)
      • powershell.exe (PID: 5392)
      • schtasks.exe (PID: 1684)
      • RAR.exe (PID: 5592)
      • RAR.exe (PID: 4932)
      • wscript.exe (PID: 7020)
      • powershell.exe (PID: 4536)
      • wscript.exe (PID: 7100)
      • powershell.exe (PID: 4504)
      • wscript.exe (PID: 7056)
      • powershell.exe (PID: 2624)
      • wscript.exe (PID: 6316)
      • powershell.exe (PID: 6952)

    • Executing commands from a ".bat" file

      • powershell.exe (PID: 5604)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 4596)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 4596)
      • cmd.exe (PID: 244)

    • Reads binary file using Get-Content

      • powershell.exe (PID: 5392)

    • Possibly malicious use of IEX has been detected

      • cmd.exe (PID: 4596)
      • wscript.exe (PID: 7020)
      • wscript.exe (PID: 7100)
      • wscript.exe (PID: 7056)
      • wscript.exe (PID: 6316)

    • The process hide an interactive prompt from the user

      • cmd.exe (PID: 244)

    • Reads the date of Windows installation

      • Setup.exe (PID: 6912)

    • Reads security settings of Internet Explorer

      • Setup.exe (PID: 6912)
      • aspnet_compiler.exe (PID: 1808)

    • Application launched itself

      • Setup.exe (PID: 6912)

    • Executes script without checking the security policy

      • powershell.exe (PID: 1200)

    • Gets path to any of the special folders (POWERSHELL)

      • powershell.exe (PID: 1200)
      • powershell.exe (PID: 5392)

    • Lists all scheduled tasks

      • schtasks.exe (PID: 1792)
      • schtasks.exe (PID: 5548)
      • schtasks.exe (PID: 6800)
      • schtasks.exe (PID: 7108)

    • The process verifies whether the antivirus software is installed

      • powershell.exe (PID: 5392)
      • powershell.exe (PID: 1200)

    • Executes application which crashes

      • LosslessScaling.exe (PID: 3060)

    • The process executes VB scripts

      • powershell.exe (PID: 5392)
      • powershell.exe (PID: 1200)
      • aspnet_compiler.exe (PID: 1808)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 7020)
      • wscript.exe (PID: 7100)
      • wscript.exe (PID: 7056)
      • wscript.exe (PID: 6316)

    • The process executes Powershell scripts

      • wscript.exe (PID: 7020)
      • wscript.exe (PID: 7100)
      • wscript.exe (PID: 7056)
      • wscript.exe (PID: 6316)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 7020)
      • wscript.exe (PID: 7100)
      • wscript.exe (PID: 7056)
      • wscript.exe (PID: 6316)

    • Converts a specified value to an integer (POWERSHELL)

      • powershell.exe (PID: 4536)
      • powershell.exe (PID: 4504)
      • powershell.exe (PID: 2624)
      • powershell.exe (PID: 6952)

    • Connects to unusual port

      • aspnet_compiler.exe (PID: 1808)
      • MSBuild.exe (PID: 5872)

    • Contacting a server suspected of hosting an CnC

      • aspnet_compiler.exe (PID: 1808)
      • MSBuild.exe (PID: 5872)

    • There is functionality for taking screenshot (YARA)

      • LosslessScaling.exe (PID: 4244)

    • The process executes via Task Scheduler

      • powershell.exe (PID: 4444)
      • wscript.exe (PID: 7056)
      • Certificate.exe (PID: 7032)
      • wscript.exe (PID: 6316)

    • Found regular expressions for crypto-addresses (YARA)

      • aspnet_compiler.exe (PID: 1808)

  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 6612)
      • xcopy.exe (PID: 6288)
      • powershell.exe (PID: 1200)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6612)

    • Manual execution by a user

      • cmd.exe (PID: 4328)
      • Setup.exe (PID: 6912)

    • Reads the computer name

      • Setup.exe (PID: 6912)
      • Setup.exe (PID: 6892)
      • LosslessScaling.exe (PID: 4244)
      • LosslessScaling.exe (PID: 3060)
      • aspnet_compiler.exe (PID: 1808)
      • aspnet_compiler.exe (PID: 6416)
      • hjfnql.exe (PID: 3744)
      • Certificate.exe (PID: 7032)
      • MSBuild.exe (PID: 5872)
      • aspnet_compiler.exe (PID: 2324)

    • Checks supported languages

      • Setup.exe (PID: 6912)
      • Setup.exe (PID: 6892)
      • LosslessScaling.exe (PID: 4244)
      • LosslessScaling.exe (PID: 3060)
      • RAR.exe (PID: 5592)
      • RAR.exe (PID: 4932)
      • mode.com (PID: 6816)
      • aspnet_compiler.exe (PID: 6416)
      • aspnet_compiler.exe (PID: 1808)
      • hjfnql.exe (PID: 3744)
      • Certificate.exe (PID: 7032)
      • MSBuild.exe (PID: 5872)
      • aspnet_compiler.exe (PID: 5888)

    • Process checks computer location settings

      • Setup.exe (PID: 6912)
      • aspnet_compiler.exe (PID: 1808)

    • Checks current location (POWERSHELL)

      • powershell.exe (PID: 1200)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 5392)
      • powershell.exe (PID: 1200)
      • powershell.exe (PID: 4536)
      • powershell.exe (PID: 4504)
      • powershell.exe (PID: 4444)
      • powershell.exe (PID: 2624)
      • powershell.exe (PID: 6952)

    • Creates files in the program directory

      • powershell.exe (PID: 1200)

    • Reads the machine GUID from the registry

      • LosslessScaling.exe (PID: 4244)
      • LosslessScaling.exe (PID: 3060)
      • RAR.exe (PID: 4932)
      • aspnet_compiler.exe (PID: 1808)
      • aspnet_compiler.exe (PID: 6416)
      • hjfnql.exe (PID: 3744)
      • Certificate.exe (PID: 7032)
      • MSBuild.exe (PID: 5872)
      • aspnet_compiler.exe (PID: 2324)
      • aspnet_compiler.exe (PID: 5888)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 1200)
      • powershell.exe (PID: 5392)
      • powershell.exe (PID: 4536)
      • powershell.exe (PID: 4504)
      • powershell.exe (PID: 4444)
      • powershell.exe (PID: 2624)
      • powershell.exe (PID: 6952)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 5392)
      • powershell.exe (PID: 1200)

    • Creates files or folders in the user directory

      • LosslessScaling.exe (PID: 4244)
      • WerFault.exe (PID: 6700)
      • hjfnql.exe (PID: 3744)

    • Detects Fody packer (YARA)

      • powershell.exe (PID: 5392)
      • LosslessScaling.exe (PID: 4244)

    • Checks proxy server information

      • WerFault.exe (PID: 6700)

    • Starts MODE.COM to configure console settings

      • mode.com (PID: 6816)

    • Create files in a temporary directory

      • aspnet_compiler.exe (PID: 1808)

    • The executable file from the user directory is run by the Powershell process

      • hjfnql.exe (PID: 3744)

    • Reads the software policy settings

      • aspnet_compiler.exe (PID: 1808)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AsyncRat

(PID) Process(1808) aspnet_compiler.exe
C2 (1)eg4x4.casacam.net
Ports (1)304
VersionA 14
Options
AutoRunfalse
MutexMaterxMutex_Egypt2
InstallFolder%AppData%
Certificates
Cert1MIIE8jCCAtqgAwIBAgIQAPeWQ4YJ3MvReCGwLzn7rTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjIwNDI1MDA0MTA5WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKT9nYYTjYTZhY+g1tekZ8/F29gsEIDgf/8odvCbCmYKGGZZi2yND9NjtBXEMANM9PAXCyMapGva...
Server_SignatureHFvuaaLQpoqpAubV8+PWzUt8djQZXJcvXPr4Kbq/U4RRbitA8ULztUj+UP+a51KrxbuLM3xiWkBqoF/W++thUctmw3e4y213f6brMcFhd8wzYKizkxlG+BiX9OJlZe2CqAoS7gFg8G9nhG51jJk4RTs7UYsWAGBh1RCNxDJwGGNByT9mP/7r00AzHMfq3fhHYjEpC+vuY6ADpYrQcsbqxYLauGOuKr0fGlmaUd0x2dzWuitD2h3TLCXxXKIp30EavfHJy/rLbD45JsHeDWHBwB+27l/0SAyLb8DMCuf90zs9...
Keys
AES8a741d0df21cf3b4fbc5bf4f34a9d6730c390a895088e0f7791e766f32693358
Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2025:01:31 02:48:34
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: lossless scaling/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
194
Monitored processes
64
Malicious processes
13
Suspicious processes
8

Behavior graph

Click at the process to see the details
start winrar.exe rundll32.exe no specs cmd.exe no specs conhost.exe no specs net.exe no specs net1.exe no specs powershell.exe no specs cmd.exe conhost.exe no specs net.exe no specs net1.exe no specs xcopy.exe reg.exe no specs powershell.exe no specs setup.exe no specs setup.exe cmd.exe no specs conhost.exe no specs powershell.exe losslessscaling.exe no specs schtasks.exe no specs schtasks.exe no specs losslessscaling.exe werfault.exe rar.exe no specs conhost.exe no specs schtasks.exe no specs rar.exe no specs conhost.exe no specs wscript.exe no specs schtasks.exe no specs mode.com no specs powershell.exe no specs conhost.exe no specs wscript.exe no specs schtasks.exe no specs powershell.exe no specs conhost.exe no specs #ASYNCRAT aspnet_compiler.exe aspnet_compiler.exe no specs svchost.exe cmd.exe no specs conhost.exe no specs powershell.exe no specs hjfnql.exe powershell.exe no specs conhost.exe no specs vbc.exe no specs vbc.exe no specs vbc.exe no specs vbc.exe no specs vbc.exe no specs certificate.exe no specs #PURECRYPTER msbuild.exe wscript.exe no specs powershell.exe no specs conhost.exe no specs aspnet_compiler.exe no specs aspnet_compiler.exe no specs aspnet_compiler.exe no specs wscript.exe no specs powershell.exe no specs conhost.exe no specs aspnet_compiler.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
244Cmd.exe /c POWeRSHeLL.eXe -NOP -WIND HIDDeN -eXeC BYPASS -NONI < language\Win.LanC:\Windows\System32\cmd.exe—Setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
640\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1200POWeRSHeLL.eXe -NOP -WIND HIDDeN -eXeC BYPASS -NONI C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
1572\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1684"C:\WINDOWS\system32\schtasks.exe" /create /tn administrator /sc minute /mo 2 /tr C:\Users\Public\IObitUnlocker\Loader.vbs /rl HIGHESTC:\Windows\System32\schtasks.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1792"C:\WINDOWS\system32\schtasks.exe" /query /tn administratorC:\Windows\System32\schtasks.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1808"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
aspnet_compiler.exe
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\aspnet_compiler.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
AsyncRat
(PID) Process(1808) aspnet_compiler.exe
C2 (1)eg4x4.casacam.net
Ports (1)304
VersionA 14
Options
AutoRunfalse
MutexMaterxMutex_Egypt2
InstallFolder%AppData%
Certificates
Cert1MIIE8jCCAtqgAwIBAgIQAPeWQ4YJ3MvReCGwLzn7rTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjIwNDI1MDA0MTA5WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKT9nYYTjYTZhY+g1tekZ8/F29gsEIDgf/8odvCbCmYKGGZZi2yND9NjtBXEMANM9PAXCyMapGva...
Server_SignatureHFvuaaLQpoqpAubV8+PWzUt8djQZXJcvXPr4Kbq/U4RRbitA8ULztUj+UP+a51KrxbuLM3xiWkBqoF/W++thUctmw3e4y213f6brMcFhd8wzYKizkxlG+BiX9OJlZe2CqAoS7gFg8G9nhG51jJk4RTs7UYsWAGBh1RCNxDJwGGNByT9mP/7r00AzHMfq3fhHYjEpC+vuY6ADpYrQcsbqxYLauGOuKr0fGlmaUd0x2dzWuitD2h3TLCXxXKIp30EavfHJy/rLbD45JsHeDWHBwB+27l/0SAyLb8DMCuf90zs9...
Keys
AES8a741d0df21cf3b4fbc5bf4f34a9d6730c390a895088e0f7791e766f32693358
Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
1904net session C:\Windows\System32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\mpr.dll
2088\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
Total events
68 096
Read events
68 050
Write events
43
Delete events
3

Modification events

(PID) Process:(6612) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6612) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6612) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6612) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\lossless scaling.zip
(PID) Process:(6612) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6612) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6612) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6612) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6612) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(4624) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Valve\Steam\Apps\993090
Operation:writeName:Installed
Value:
1
Executable files
87
Suspicious files
18
Text files
58
Unknown types
0

Dropped files

PID
Process
Filename
Type
6612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6612.21244\lossless scaling\install + Crack.batbinary
MD5:741BBEAE98E31E4AF6D4E07C63DFDF81
SHA256:66FBD40FF1411E3B4FEA4107E90C690AAD47BFCA38D70705BF2231552906A8E7
6612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6612.21244\lossless scaling\language\en-US\RU.dlltext
MD5:83BF9BA8BECAC139CB05C1AB68468E62
SHA256:7BFD69BDD83904D39A4E09C55FE6E380F027A2F13593C167ACF92160BB9CF125
6612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6612.21244\lossless scaling\How to run the program.pngbinary
MD5:5C932F935AE20FE79D779A8F03D58A09
SHA256:7CF3B5FE89C1DB2732AF19730AB1A1E91C9FBA9A1117E268578D4DC604152807
6612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6612.21244\lossless scaling\language\diagerr.xmlcsv
MD5:44317C4008BFB84314D098A68944A0D6
SHA256:DD43C2C0A8F53036AA4B346DE52DA6C0254C4747D129FE4130ECE4E078BB0A10
6612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6612.21244\lossless scaling\language\en-US\Lan.vbstext
MD5:49AF07D132592C9A62EAAEF421E3E589
SHA256:487985D63734CD4828EAF03284E0D1D2FA684AFC2D46DA489C99D498F31A83AB
6612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6612.21244\lossless scaling\language\en-US\RAR.exeexecutable
MD5:D3E9F98155C0FAAB869CCC74FB5E8A1E
SHA256:3E0FDB5C40336482DACEF3496116053D7772A51720900141B3C6F35C6E9B351B
6612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6612.21244\lossless scaling\language\en-US\Win.ps1text
MD5:DDB678262ED3C661E6DD1F6A07E65C44
SHA256:2B1351995D3434D3521417A696730C8A06864B283FEBEAB6008EF166639FE821
6612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6612.21244\lossless scaling\language\en-US\EN.dllcompressed
MD5:83663DB5670D46990660D5BC77D8234D
SHA256:5A56446709D211D66336E49FB0E56D4D2A66521F77E3A60B8CEC5E8FC57BF04B
6612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6612.21244\lossless scaling\language\uk-UA\ar\LosslessScaling.resources.dllexecutable
MD5:ED6F1B887ABD06C83ECB9C6AD4B6DDAE
SHA256:E078D3FE1E5C3EF3AE5A22DA414B33D29C3AE335397FD699A35F0B767E20AB29
6612WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6612.21244\lossless scaling\language\uk-UA\bg\LosslessScaling.resources.dllexecutable
MD5:82DEB57274920AD713665B7ECDD1F1B4
SHA256:2B62DF6F0D46492562A7F2CB04E45C429E09FCBE76FB2FAF7E275CBE29101CA3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
34
DNS requests
21
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
436
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
436
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6400
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6700
WerFault.exe
GET
200
23.48.23.145:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6700
WerFault.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
40.126.32.76:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1076
svchost.exe
184.28.89.167:443
go.microsoft.com
AKAMAI-AS
US
whitelisted
900
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
436
SIHClient.exe
4.245.163.56:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
436
SIHClient.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
login.live.com
  • 40.126.32.76
  • 20.190.160.14
  • 20.190.160.64
  • 20.190.160.4
  • 20.190.160.2
  • 40.126.32.138
  • 40.126.32.133
  • 20.190.160.66
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
fd.api.iris.microsoft.com
  • 20.223.36.55
whitelisted
watson.events.data.microsoft.com
  • 104.208.16.94
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.casacam .net Domain
1808
aspnet_compiler.exe
Domain Observed Used for C2 Detected
REMOTE [ANY.RUN] AsyncRAT SSL certificate
1808
aspnet_compiler.exe
Domain Observed Used for C2 Detected
ET MALWARE Generic AsyncRAT/zgRAT Style SSL Cert
1808
aspnet_compiler.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
1808
aspnet_compiler.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] AsyncRAT Successful Connection
2192
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.ddnsgeek .com Domain
5872
MSBuild.exe
Malware Command and Control Activity Detected
LOADER [ANY.RUN] PureLoader Reset Connection (RST)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
lossless scaling.zip