File name:

253f2f81c335265caba1ce6c1f3cd725.exe

Full analysis: https://app.any.run/tasks/364ce799-da66-486f-be04-2d89d63f4fb3
Verdict: Malicious activity
Threats:

DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 05:36:01
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
dcrat
rat
rust
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

253F2F81C335265CABA1CE6C1F3CD725

SHA1:

EC2D48687FEF55B2735062424A84F85E51E01D04

SHA256:

51F0400E2DAC0B9542DCE9098E261E151E6CF3EA693EB943DF3ADBAA33889634

SSDEEP:

49152:vH7tKJcvDWTqCVjp+yOtJaJsEsPCdaFvbjcin+ygJ4yNgCLm4LFxtKFd:T4aLCVjpZsJaJsEVd+bb+JBN1q4PkFd

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • 253f2f81c335265caba1ce6c1f3cd725.tmp (PID: 7428)

    • DCRAT mutex has been found

      • regsvr32.exe (PID: 7484)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 253f2f81c335265caba1ce6c1f3cd725.exe (PID: 7344)
      • 253f2f81c335265caba1ce6c1f3cd725.tmp (PID: 7364)
      • 253f2f81c335265caba1ce6c1f3cd725.tmp (PID: 7428)
      • 253f2f81c335265caba1ce6c1f3cd725.exe (PID: 7400)

    • Reads the Windows owner or organization settings

      • 253f2f81c335265caba1ce6c1f3cd725.tmp (PID: 7364)
      • 253f2f81c335265caba1ce6c1f3cd725.tmp (PID: 7428)

    • Reads security settings of Internet Explorer

      • 253f2f81c335265caba1ce6c1f3cd725.tmp (PID: 7364)

    • Process drops legitimate windows executable

      • 253f2f81c335265caba1ce6c1f3cd725.tmp (PID: 7364)
      • 253f2f81c335265caba1ce6c1f3cd725.tmp (PID: 7428)

    • Starts POWERSHELL.EXE for commands execution

      • regsvr32.exe (PID: 7484)

    • The process bypasses the loading of PowerShell profile settings

      • regsvr32.exe (PID: 7484)

    • The process executes via Task Scheduler

      • regsvr32.exe (PID: 5056)
      • regsvr32.exe (PID: 1072)

    • Connects to unusual port

      • regsvr32.exe (PID: 7484)

    • The process hide an interactive prompt from the user

      • regsvr32.exe (PID: 7484)

    • Reads the date of Windows installation

      • 253f2f81c335265caba1ce6c1f3cd725.tmp (PID: 7364)

  • INFO

    • Reads the computer name

      • 253f2f81c335265caba1ce6c1f3cd725.tmp (PID: 7364)
      • 253f2f81c335265caba1ce6c1f3cd725.tmp (PID: 7428)

    • Create files in a temporary directory

      • 253f2f81c335265caba1ce6c1f3cd725.exe (PID: 7344)
      • 253f2f81c335265caba1ce6c1f3cd725.tmp (PID: 7428)
      • 253f2f81c335265caba1ce6c1f3cd725.tmp (PID: 7364)
      • 253f2f81c335265caba1ce6c1f3cd725.exe (PID: 7400)

    • Checks supported languages

      • 253f2f81c335265caba1ce6c1f3cd725.exe (PID: 7344)
      • 253f2f81c335265caba1ce6c1f3cd725.tmp (PID: 7364)
      • 253f2f81c335265caba1ce6c1f3cd725.exe (PID: 7400)
      • 253f2f81c335265caba1ce6c1f3cd725.tmp (PID: 7428)

    • Process checks computer location settings

      • 253f2f81c335265caba1ce6c1f3cd725.tmp (PID: 7364)

    • The sample compiled with english language support

      • 253f2f81c335265caba1ce6c1f3cd725.tmp (PID: 7364)
      • 253f2f81c335265caba1ce6c1f3cd725.tmp (PID: 7428)

    • Creates files or folders in the user directory

      • 253f2f81c335265caba1ce6c1f3cd725.tmp (PID: 7428)

    • Application based on Rust

      • regsvr32.exe (PID: 7484)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7504)
      • powershell.exe (PID: 7972)

    • Checks proxy server information

      • slui.exe (PID: 6744)

    • Reads the software policy settings

      • slui.exe (PID: 6744)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (81.5)
.exe | Win32 Executable Delphi generic (10.5)
.exe | Win32 Executable (generic) (3.3)
.exe | Win16/32 Executable Delphi generic (1.5)
.exe | Generic Win/DOS Executable (1.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2004:03:11 20:09:15+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 86016
InitializedDataSize: 214016
UninitializedDataSize: -
EntryPoint: 0x16478
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: Program Compatibility Assistant User Interface Setup
FileVersion:
LegalCopyright:
ProductName: Program Compatibility Assistant User Interface
ProductVersion: 10.0.19041.928
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
13
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start 253f2f81c335265caba1ce6c1f3cd725.exe 253f2f81c335265caba1ce6c1f3cd725.tmp 253f2f81c335265caba1ce6c1f3cd725.exe 253f2f81c335265caba1ce6c1f3cd725.tmp regsvr32.exe no specs #DCRAT regsvr32.exe powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs slui.exe regsvr32.exe no specs regsvr32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1072"C:\WINDOWS\system32\regsvr32.EXE" /s /i:INSTALL "C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\InputRoutingProxy1.pfx"C:\Windows\System32\regsvr32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
4
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
5056"C:\WINDOWS\system32\regsvr32.EXE" /s /i:INSTALL "C:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\InputRoutingProxy1.pfx"C:\Windows\System32\regsvr32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
4
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6744C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7344"C:\Users\admin\Desktop\253f2f81c335265caba1ce6c1f3cd725.exe" C:\Users\admin\Desktop\253f2f81c335265caba1ce6c1f3cd725.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Program Compatibility Assistant User Interface Setup
Exit code:
1
Version:
Modules
Images
c:\users\admin\desktop\253f2f81c335265caba1ce6c1f3cd725.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
7364"C:\Users\admin\AppData\Local\Temp\is-95EFE.tmp\253f2f81c335265caba1ce6c1f3cd725.tmp" /SL5="$80294,663797,301056,C:\Users\admin\Desktop\253f2f81c335265caba1ce6c1f3cd725.exe" C:\Users\admin\AppData\Local\Temp\is-95EFE.tmp\253f2f81c335265caba1ce6c1f3cd725.tmp
253f2f81c335265caba1ce6c1f3cd725.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\is-95efe.tmp\253f2f81c335265caba1ce6c1f3cd725.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
7400"C:\Users\admin\Desktop\253f2f81c335265caba1ce6c1f3cd725.exe" /VERYSILENTC:\Users\admin\Desktop\253f2f81c335265caba1ce6c1f3cd725.exe
253f2f81c335265caba1ce6c1f3cd725.tmp
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Program Compatibility Assistant User Interface Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\desktop\253f2f81c335265caba1ce6c1f3cd725.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
7428"C:\Users\admin\AppData\Local\Temp\is-SRMAH.tmp\253f2f81c335265caba1ce6c1f3cd725.tmp" /SL5="$90294,663797,301056,C:\Users\admin\Desktop\253f2f81c335265caba1ce6c1f3cd725.exe" /VERYSILENTC:\Users\admin\AppData\Local\Temp\is-SRMAH.tmp\253f2f81c335265caba1ce6c1f3cd725.tmp
253f2f81c335265caba1ce6c1f3cd725.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\is-srmah.tmp\253f2f81c335265caba1ce6c1f3cd725.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
7448"regsvr32.exe" /s /i:INSTALL "C:\Users\admin\AppData\Roaming\microsoft\systemcertificates\\InputRoutingProxy1.pfx"C:\Windows\SysWOW64\regsvr32.exe—253f2f81c335265caba1ce6c1f3cd725.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7484 /s /i:INSTALL "C:\Users\admin\AppData\Roaming\microsoft\systemcertificates\\InputRoutingProxy1.pfx"C:\Windows\System32\regsvr32.exe
regsvr32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
7504"powershell" -Command "if (Get-ScheduledTask | Where-Object { $_.Actions.Execute -eq 'regsvr32' -and $_.Actions.Arguments -eq '/s /i:INSTALL \"%APPDATA%\Microsoft\SystemCertificates\InputRoutingProxy1.pfx\"' }) { exit 0 } else { exit 1 }"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—regsvr32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
16 993
Read events
16 971
Write events
14
Delete events
8

Modification events

(PID) Process:(7364) 253f2f81c335265caba1ce6c1f3cd725.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
C41C0000DED8AA9CC8B8DB01
(PID) Process:(7364) 253f2f81c335265caba1ce6c1f3cd725.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
859DDBA80768A1FE9A0257026A1F718EBBEF30C5A59BB8A55FF02287DE1C443C
(PID) Process:(7364) 253f2f81c335265caba1ce6c1f3cd725.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(7364) 253f2f81c335265caba1ce6c1f3cd725.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(7364) 253f2f81c335265caba1ce6c1f3cd725.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(7364) 253f2f81c335265caba1ce6c1f3cd725.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(7364) 253f2f81c335265caba1ce6c1f3cd725.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(7364) 253f2f81c335265caba1ce6c1f3cd725.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:delete valueName:Sequence
Value:

(PID) Process:(7364) 253f2f81c335265caba1ce6c1f3cd725.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:delete valueName:SessionHash
Value:
鶅꣛标ﺡʚɗὪ蹱씰鮥ꖸ蜢᳞㱄
(PID) Process:(7364) 253f2f81c335265caba1ce6c1f3cd725.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:delete valueName:Owner
Value:
᳄
Executable files
8
Suspicious files
1
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
7364253f2f81c335265caba1ce6c1f3cd725.tmpC:\Users\admin\AppData\Local\Temp\is-KRC3B.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
7428253f2f81c335265caba1ce6c1f3cd725.tmpC:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\is-V6U03.tmpexecutable
MD5:62E92C80024292D4EAC7E5CFE1E8D28B
SHA256:5BBD562FA6FC5F04F7D6F89FFA006DEE0263CFC18FB36C41F82436CD5A42962B
7400253f2f81c335265caba1ce6c1f3cd725.exeC:\Users\admin\AppData\Local\Temp\is-SRMAH.tmp\253f2f81c335265caba1ce6c1f3cd725.tmpexecutable
MD5:6DF089CB3D0CB1185858BE22DE4B332B
SHA256:E330A5728740C87ABDC13C0E4C54C2C3EA319617EFD885AB9B082E7C173DD5BF
7428253f2f81c335265caba1ce6c1f3cd725.tmpC:\Users\admin\AppData\Local\Temp\is-2ES36.tmp\_isetup\_setup64.tmpexecutable
MD5:4FF75F505FDDCC6A9AE62216446205D9
SHA256:A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
7428253f2f81c335265caba1ce6c1f3cd725.tmpC:\Users\admin\AppData\Local\Temp\is-2ES36.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
7364253f2f81c335265caba1ce6c1f3cd725.tmpC:\Users\admin\AppData\Local\Temp\is-KRC3B.tmp\_isetup\_setup64.tmpexecutable
MD5:4FF75F505FDDCC6A9AE62216446205D9
SHA256:A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
7504powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_prrkojg4.1xw.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7344253f2f81c335265caba1ce6c1f3cd725.exeC:\Users\admin\AppData\Local\Temp\is-95EFE.tmp\253f2f81c335265caba1ce6c1f3cd725.tmpexecutable
MD5:6DF089CB3D0CB1185858BE22DE4B332B
SHA256:E330A5728740C87ABDC13C0E4C54C2C3EA319617EFD885AB9B082E7C173DD5BF
7972powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_40hlr5mo.1mg.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7428253f2f81c335265caba1ce6c1f3cd725.tmpC:\Users\admin\AppData\Roaming\Microsoft\SystemCertificates\InputRoutingProxy1.pfxexecutable
MD5:62E92C80024292D4EAC7E5CFE1E8D28B
SHA256:5BBD562FA6FC5F04F7D6F89FFA006DEE0263CFC18FB36C41F82436CD5A42962B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
47
DNS requests
5
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6456
RUXIMICS.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6456
RUXIMICS.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
6456
RUXIMICS.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
2104
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7484
regsvr32.exe
176.65.144.19:8848
—
—
DE
malicious

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.18.14
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.120
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

PID
Process
Class
Message
7484
regsvr32.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 30
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
253f2f81c335265caba1ce6c1f3cd725.exe