File name:

RuntimeBroker.exe

Full analysis: https://app.any.run/tasks/1805ae34-a578-4c35-b9bd-057d71280e60
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: March 29, 2025, 21:20:24
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
asyncrat
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

7A984E3A8EF99E429CEEF1F1DDC144F4

SHA1:

581DD32AF3C53B1DC7B8A95AA2805EE0E8F44190

SHA256:

4D8C876B969CAF2449F169F89EC257F5E1412E23B609AB4F7C7EE72CD4B0DE60

SSDEEP:

1536:EjWDdwwm1YmGbzDHIO4U75OYbt9/XH3bsXjyj69QmhdJ:EjWDdwwm1YVHIW/H3bs+W9PdJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • RuntimeBroker.exe (PID: 7528)

    • ASYNCRAT has been detected (YARA)

      • RuntimeBroker.exe (PID: 7732)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • RuntimeBroker.exe (PID: 7528)

    • Starts a Microsoft application from unusual location

      • RuntimeBroker.exe (PID: 7528)

    • Executing commands from a ".bat" file

      • RuntimeBroker.exe (PID: 7528)

    • Starts CMD.EXE for commands execution

      • RuntimeBroker.exe (PID: 7528)

    • Executable content was dropped or overwritten

      • RuntimeBroker.exe (PID: 7528)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 7632)

    • The executable file from the user directory is run by the CMD process

      • RuntimeBroker.exe (PID: 7732)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 2196)

    • Connects to unusual port

      • RuntimeBroker.exe (PID: 7732)

  • INFO

    • Create files in a temporary directory

      • RuntimeBroker.exe (PID: 7528)

    • Checks supported languages

      • RuntimeBroker.exe (PID: 7528)
      • RuntimeBroker.exe (PID: 7732)

    • Reads the computer name

      • RuntimeBroker.exe (PID: 7528)
      • RuntimeBroker.exe (PID: 7732)

    • Creates files or folders in the user directory

      • RuntimeBroker.exe (PID: 7528)

    • Reads the machine GUID from the registry

      • RuntimeBroker.exe (PID: 7528)
      • RuntimeBroker.exe (PID: 7732)

    • Checks proxy server information

      • slui.exe (PID: 8068)

    • Reads the software policy settings

      • slui.exe (PID: 8068)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AsyncRat

(PID) Process(7732) RuntimeBroker.exe
C2 (1)holefo2785-22820.portmap.host
Ports (2)22820
6606
Version0.5.8
BotnetDefault
Options
AutoRuntrue
MutexI674w9YbNo4n
InstallFolder%AppData%
BSoDfalse
AntiVMfalse
Certificates
Cert1MIIFDjCCAvagAwIBAgIQAKSvRUgpg1whRXulCVZ+ezANBgkqhkiG9w0BAQ0FADAoMSYwJAYDVQQDDB1CTEFCTEFCTEEgQkxFQkxFQkxFIEJMSUJMSUJMSTAgFw0yNTAzMjIxNDUwNTBaGA85OTk5MTIzMTIzNTk1OVowKDEmMCQGA1UEAwwdQkxBQkxBQkxBIEJMRUJMRUJMRSBCTElCTElCTEkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDNX33928JbUiyPOsjNO6SUl45KYud4IQ+vU+uE...
Server_SignatureFapg4Zz9P6v0xX+WDBwzIfpFjoz5GKwPU7Kg93UbnusOc0deeKhP6etfxnxjRrRfafn0aZ4SYkxvqNE4Lahciur4dxueaxp+Nrx+S8nqk3afQ2HEUQ8NmMptHCZQM5MrovRyG/2bed2SfWpJhDtu+3UOFlYlfmaQjWPfzhOkrmQhqzzph33vBZeFo5UTkn7rrMbBrfaAU40kTH6SajP2nwyZy2SeJ7uolWNGM17zGRlswuPcKVUVutb7YGmaUvwj00miHc28sv6OGbO1585C008yYMVFPDSTqy8dzWp1tsvP...
Keys
AESfb03d778aa322bfcafc8559d48e5d818c8343440ba3b9382835a06fd1857d7eb
Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:10:16 21:40:53+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 43008
InitializedDataSize: 3072
UninitializedDataSize: -
EntryPoint: 0xc78e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 6.2.26100.3323
ProductVersionNumber: 6.2.26100.3323
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: Microsoft Corporation
FileDescription: Runtime Broker
FileVersion: 6.2.26100.3323
InternalName: RuntimeBroker.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
LegalTrademarks: -
OriginalFileName: RuntimeBroker.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 6.2.26100.3323
AssemblyVersion: 6.2.26100.3323
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
131
Monitored processes
8
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start runtimebroker.exe cmd.exe no specs conhost.exe no specs timeout.exe no specs #ASYNCRAT runtimebroker.exe svchost.exe slui.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3216C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s WpnServiceC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
7528"C:\Users\admin\Desktop\RuntimeBroker.exe" C:\Users\admin\Desktop\RuntimeBroker.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Runtime Broker
Exit code:
0
Version:
6.2.26100.3323
Modules
Images
c:\users\admin\desktop\runtimebroker.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7632C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\tmpF4D2.tmp.bat""C:\Windows\SysWOW64\cmd.exe—RuntimeBroker.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7640\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7688timeout 3 C:\Windows\SysWOW64\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7732"C:\Users\admin\AppData\Roaming\RuntimeBroker.exe" C:\Users\admin\AppData\Roaming\RuntimeBroker.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Runtime Broker
Version:
6.2.26100.3323
Modules
Images
c:\users\admin\appdata\roaming\runtimebroker.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
AsyncRat
(PID) Process(7732) RuntimeBroker.exe
C2 (1)holefo2785-22820.portmap.host
Ports (2)22820
6606
Version0.5.8
BotnetDefault
Options
AutoRuntrue
MutexI674w9YbNo4n
InstallFolder%AppData%
BSoDfalse
AntiVMfalse
Certificates
Cert1MIIFDjCCAvagAwIBAgIQAKSvRUgpg1whRXulCVZ+ezANBgkqhkiG9w0BAQ0FADAoMSYwJAYDVQQDDB1CTEFCTEFCTEEgQkxFQkxFQkxFIEJMSUJMSUJMSTAgFw0yNTAzMjIxNDUwNTBaGA85OTk5MTIzMTIzNTk1OVowKDEmMCQGA1UEAwwdQkxBQkxBQkxBIEJMRUJMRUJMRSBCTElCTElCTEkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDNX33928JbUiyPOsjNO6SUl45KYud4IQ+vU+uE...
Server_SignatureFapg4Zz9P6v0xX+WDBwzIfpFjoz5GKwPU7Kg93UbnusOc0deeKhP6etfxnxjRrRfafn0aZ4SYkxvqNE4Lahciur4dxueaxp+Nrx+S8nqk3afQ2HEUQ8NmMptHCZQM5MrovRyG/2bed2SfWpJhDtu+3UOFlYlfmaQjWPfzhOkrmQhqzzph33vBZeFo5UTkn7rrMbBrfaAU40kTH6SajP2nwyZy2SeJ7uolWNGM17zGRlswuPcKVUVutb7YGmaUvwj00miHc28sv6OGbO1585C008yYMVFPDSTqy8dzWp1tsvP...
Keys
AESfb03d778aa322bfcafc8559d48e5d818c8343440ba3b9382835a06fd1857d7eb
Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
8068C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
4 219
Read events
4 214
Write events
5
Delete events
0

Modification events

(PID) Process:(7528) RuntimeBroker.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:RuntimeBroker
Value:
"C:\Users\admin\AppData\Roaming\RuntimeBroker.exe"
(PID) Process:(3216) svchost.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D80D1001-5B38-49E9-9D34-EC9B84779189}
Operation:writeName:DeviceTicket
Value:
0100000001000000D08C9DDF0115D1118C7A00C04FC297EB0100000027AC8F1C7900264CA433DB27300F44310000000002000000000010660000000100002000000016E7DA6A837090AD42AB423242C8BD414C7562D237A401AD18B2947B59EE0854000000000E80000000020000200000003612755A4CB2EF168B71033307B62B79B72E2376B0AE4575F64FD9590AECE4BF400A00009A860B101C810C3D6D73B4E0E2BE7CE610994632FFD621B03659F39A9CC8ADB50D2AD9210CAD6F11C4E2BEC2B323EC0A187FCB2FDAE24C512D6F157F3D88C71904C35007A819A80AD2ACD2C97C42F1BEC7C4F34ECA87608F986E0291FC29685455687C74CDDA4BA82810A55BAA9A5C8C5E63C391E2A7B85BFCF9666ED4E1B58AFE55C8CC8B01EA29C23C9B8D41E310970C8BD4B6496F072A632021AC8F3BB2D47ACBD91DC575A265ACD53B0A63364B4805E83F243C3112184EE98A117C67384CD45F4E75591F2AC0A5EBA2E4CBF2C398CFF016A094A039F9AEED7A090A44ECC30511225D940AE90C0C04322D97C95E442081E320EAC7B5962AA2D18EE89433B3857CC14A405F9E41FC5FA994E8CD5EA3D93E5FC97412D3EA9BA0B86712EADB0B7661746107C4F309BA184CE5E6B2177A82797426B5B65F9E45ADA8259BC6F659B039B4A65933FC407F5852AC9E43E9A1885C634AFD6CBEC77A86DD222CC94219A5061E7C5AF42A883F04DE14756CA327E605B61C47276034EA28A97B46D0B50B6A2FB08C5F157450AAF68E21FBF471EBF8AA77CCF2DC5A7BFD65A94041FF3744B89ECA62CA318A174D21A62975B4934F700B70CE62CD52E9E0858DB0B8928DD50330F620C97477225D8AAF24452A163FF0E61BF8B1516E64284795C122C4CEC0403962745E7C420925EE7E54CE29A6243F061F5CBCF783D045997A42F8AB86DCCEFA27F1D016897E85E7E9655C65294809C53CE02D7EAD7A1C3C401DCC09519B088E648ACDFAA9837B9C2A13E42D143E547F4FE0DAD8DD2DD02F2473FD8A5801C0FA86DB7F778BAD48799B162A05174CE83E0859A0AF69EEA80AD6115A54BCEC9B43DCD514676AF0312F97582A490395988C566CBC01D6AF108E2F09F189F2C35D9EA8B1D5BCDD2330D21DA449E88905086B629080AD4988153CBE56D5D7D248D2DD0370CCFA2A75C7E134B71C31940DC8D32C91D3415249E8F3EE503A955102548B49E5D2FF24E5192C2CD3B13F9868BB36E8CE9F261600A40608B871B3A2B5D37C8E30BEF12895F8E0E825CDA3D71FC2B1C93571CF6A1BEC3334753BFCAB10233AEC527750F8BE261F21E5A3ED6D43743C8139A956928DF30B833E49A0BAC8B126A74E31ECA49082B83E139D5B3E4B0442F7040649B7DE5FF44D4836F4854C00DC71A1B4E0D20F6474225F446CC6ADE4E6C0627D1C3547A3FF7822446ECC0FFF6CD8AA57CC9BDFA4564D536A48E9042C346FA58692DF462EBD1BA65F0C2A8458DF21FF32CD6501CBA50ACBFD32C5FD97C00072D03831EC2437C9CE9F8B8801E3A7319ADF36FBFCFFBB4483E6ACEA25B902E2B3CB010AF2FD9ECE37A7AFE5DDA6D98176B73A12CF1C8E2DB168EBB482DC30832E60D89BF5DBD2844D94ABDBD043F57B099B220AA1F977DB5C6BD44EAE6CD516F28E301431585B01E8D4B483CAA216445284B3A324C023D081822F6106AB24C3485CD1B061F673EA9ADD9791F32B2C62F8B9FDA513D3FB740AB850F59017AF86BD8D6C1DE92CA28A6AE13A8A4B77491DB245367AC4057D558459FD2CEDBCD43A41978B8B588E7F4C545113CAB4502069E6DA54943D819FC1573BD81E8D83706A784916C25EE50A39F231D6FEB772F04BB08ADF275279B96592FCB1395DB0AD8EBCED4400FF85B0F9D11C508AEB173C3DEFC9012707B7FE0B395A3097550916D4039E855C98B271E9B8F20A33A2474C99FAF9AA167EE53D7E493D5763BE0C2EAA781511BCD0990C79B6A2A7DE9077E3BE632F1A04E8FABB9A148A33B0B559044E282449B5A1D58CBB66BB2EB7364C2106ECD1495470B9BAA471C8E90E95941503DC22B47B9F74F142102D8E76B85F764613B270ACD398DAC29DF595B0A6C9319796014CB378163660346FD053803DE7B33DBF61388D07E0BC8428841EA78AFC8FD4B724F3E942513D5FF5C585718232FEF8CCE31655CE0107FFEB373F264B75335DC89F591C66F2A492D0AC21785E704782DD8EA076DC03F059F9DB8FD5E71A79E8ECF93417D952D973579D199E8227A275D1484C0C2570F3C93BA7C93FDF72C8CE5A01CCD1ACF21A628BEFD4A364D8FB42D6AC89B1F07F22D17CC2E7EC753D6E10B7A45DD561F4CE7F11A01B95A853D21D2DFD6FD6DF709FD3C736DAE583DCB9F174EA481FEB92BF33957E25A63843B2F27AD041B08FC76FB68823E8C1B1C025AC1386525B5A5FDC47FC5783FF1B0187424839B80EABD7AF8AA0B6DCE1F28B08892F240C9061A4A8E690E676280450F172047A06C1790C81F164D8FC6D27A6B254F566A40B43424534DB3A83C084F95BD693B0D8371414D7942CD5BF10C9E116D529709B64EB58E6BFAC1064E8B7CFDA264C99DBD6A1256B9C597D480781AE4FE243E5E2E8E7FEB7FF5D2F1D889C7E8940622606707B96EF00E427A27CE9CD753E065789391E24E0B2F9124DD84F7A99F72B562D65E365533E9265A61391B59597DC76162C7E12A07BBA7574D7383CC74779244492601DB201B0B46C18F87085D9691E1127CB0849E378046726795DBFF5D51E083E27BEF2CC6A590759BB0D0095E80D3187AEE1E1AF730D6E84A0DE1E0F7EB74529D768D4A9C31A8D53B68A56D1BFD212DC3B914D5102C050E8542507E1BF68258869753BC68457EC6966EB01FFA5B60D624C240420A981957BFC9DAF6C76C1F28D18F998916CE4B2632FE2D353971A74BF0F8BF393671F736DA26DF0A58E65D42C3C8867D5B7C271F3A8DE5397C78AEDDA211C2F2658FA3976FF390AD49B89AE8B6686DE315E61213ABC2DADEBEE243182F0AC26BA0B58E13C7D90CA2749E00C99CA53EF047BFD94CFF13C92B1701E4EE7BD77FC14FFD6DEB369EBF4D511659A7DB0C6302471FE15CED98E252D7D9D1452AD5C84C10AEB8EC04BB20EEAFF114E3156CF1B0B2C26AC6D1F24C76436D93478646EA861D7160AA9C8BD17CD67CB893A99A564C422E189C82A9A0B2EC5D4501BD7890B59DB8C69899868D63AD8FC5B743282BE7FEF9983FC395FFC22FA88778F75406AD1E9346A04149D473B158387A1FB5A3D5A7DC514E51D5362D01C5881C9C74B0E76BADA2A68DA1DB5A4CF323AD9F40021BCC670268D82E039BA65D9CE9D94B39F256C9F63307E3B3796A1D818924918636821E451F6D6D8F18052728A3D478CCBFDA4467D1C2DCE8C97C3752BF9419D064ACF3632B5C2FAAE871C6EFF970F26986B0D89FBD4BAD3FE90EF36C1966B35C290097501453310595CB645DA4B83311910B696DAAAF9411589C1F55F392A7FFD464635DC35E471639D2F3159DBCF1B55EE773B173CE342AF027643DF136A857F2735F03C293A4524D1BDE520655C34891660591F8589F94AB2EBCC47B0449BAF6BC991F0EEE4ED37A766564B95F31A1C88B8B4E8BAD1CAB26FBDA22C45C6702058012427CC86E0F40DD348556CD43322F2BE5AE19186068362D6144F1EB902C8F4988767B565DC32D848D712DD39C13D5FC5E59B2DF8908F5571424216B0FCD450CF7F4F2B99E90089C87769E3B89B720BC04A74E86CFB1ED2BCA1C94A2F3ED9C273C74D52691CBC8D637F0C0666F0C54C8AD1A239B9E01FB048F37774BEF6554BA3FE26B76118137BB9C61B66D40FF1908BF27C8872A70AB10625C2C30E7DF72CA7521A4A932B9D8B64714CB217041CA3426588C644A16DEA17D34287E5B3FE8BED2D511B86AB6861F77F0DDC029B5BBE6F235573400000005525F07CA098BAD909BC6EB23BDC5935F55D91D6578437DA5595C226027BBBB76D1A6CD7FECD801095B2C876AFFE367CDAFC1DF92140B7936219053FFC65BCC1
(PID) Process:(3216) svchost.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D80D1001-5B38-49E9-9D34-EC9B84779189}
Operation:writeName:DeviceId
Value:
001840121DE1DCC1
(PID) Process:(3216) svchost.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D80D1001-5B38-49E9-9D34-EC9B84779189}
Operation:writeName:ApplicationFlags
Value:
1
(PID) Process:(3216) svchost.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\001840121DE1DCC1\0
Operation:writeName:LastMsgIdForTestConnection
Value:
0000000000000000
Executable files
1
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
7528RuntimeBroker.exeC:\Users\admin\AppData\Local\Temp\tmpF4D2.tmp.battext
MD5:21D93E309A1D954D6B28A9720104F910
SHA256:5890287404682A4433C25984E31805322A25278ED8295026A099FA458ECBA45C
7528RuntimeBroker.exeC:\Users\admin\AppData\Roaming\RuntimeBroker.exeexecutable
MD5:7A984E3A8EF99E429CEEF1F1DDC144F4
SHA256:4D8C876B969CAF2449F169F89EC257F5E1412E23B609AB4F7C7EE72CD4B0DE60
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
31
TCP/UDP connections
83
DNS requests
17
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
976
RUXIMICS.exe
GET
200
23.48.23.161:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
304
52.149.20.212:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
—
—
GET
200
52.149.20.212:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
7900
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
7900
SIHClient.exe
GET
200
23.48.23.180:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
7900
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
7900
SIHClient.exe
GET
200
23.48.23.180:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
7900
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7900
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
—
—
GET
200
52.149.20.212:443
https://slscr.update.microsoft.com/sls/ping
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
976
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
172.172.255.216:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6544
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
976
RUXIMICS.exe
23.48.23.161:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.172.255.216:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7732
RuntimeBroker.exe
193.161.193.99:22820
holefo2785-22820.portmap.host
OOO Bitree Networks
RU
malicious

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
login.live.com
  • 20.190.159.0
  • 40.126.31.2
  • 20.190.159.75
  • 40.126.31.1
  • 40.126.31.128
  • 20.190.159.23
  • 20.190.159.130
  • 20.190.159.128
whitelisted
client.wns.windows.com
  • 172.172.255.216
  • 172.172.255.218
whitelisted
google.com
  • 142.250.185.110
whitelisted
crl.microsoft.com
  • 23.48.23.161
  • 23.48.23.147
  • 23.48.23.158
  • 23.48.23.137
  • 23.48.23.141
  • 23.48.23.146
  • 23.48.23.138
  • 23.48.23.159
  • 23.48.23.162
  • 23.48.23.180
  • 23.48.23.143
  • 23.48.23.194
  • 23.48.23.177
  • 23.48.23.173
  • 23.48.23.166
  • 23.48.23.156
  • 23.48.23.193
whitelisted
holefo2785-22820.portmap.host
  • 193.161.193.99
malicious
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 2.16.253.202
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
  • 20.83.72.98
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Potential Corporate Privacy Violation
ET INFO DNS Query to a Reverse Proxy Service Observed
2196
svchost.exe
Misc activity
ET INFO DNS Query for Port Mapping/Tunneling Service Domain (.portmap .host)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
RuntimeBroker.exe