File name:

VasuisUly.exe

Full analysis: https://app.any.run/tasks/fa768270-04a6-4d4c-9aa2-2817843954d4
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: May 10, 2025, 06:32:02
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
telegram
stealer
vidar
loader
rat
quasar
remote
auto-reg
auto-startup
njrat
bladabindi
lumma
evasion
asyncrat
backdoor
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 12 sections
MD5:

3759F7A2DBFDEE59741BC96B35E571DB

SHA1:

23D8199312173AD16F2581F62521D91F9E7F0886

SHA256:

54A8987A34A03B4D5E95E7C076BB9EB1F8FB470C23EBB8DAAED7F4B5C42B6AE1

SSDEEP:

12288:d6kTZpJt2oybmS9NjDuu955H77EgXBq55H77EgXBI:d7TZpPlSjnuu9H77EgXBqH77EgXBI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • VasuisUly.exe (PID: 1276)
      • pz5x4wbas0.exe (PID: 8152)
      • je37900zu3.exe (PID: 728)
      • t2no8q9h4o.exe (PID: 2644)
      • jmo89zu3o8.exe (PID: 7936)

    • VIDAR mutex has been found

      • MSBuild.exe (PID: 6972)
      • MSBuild.exe (PID: 6828)

    • Actions looks like stealing of personal data

      • MSBuild.exe (PID: 6972)
      • MSBuild.exe (PID: 7720)
      • MSBuild.exe (PID: 6828)

    • Steals credentials from Web Browsers

      • MSBuild.exe (PID: 6972)
      • MSBuild.exe (PID: 7720)

    • VIDAR has been detected (YARA)

      • MSBuild.exe (PID: 6972)

    • Changes the autorun value in the registry

      • 90r90zukno.exe (PID: 7772)
      • QPMFYX.exe (PID: 7672)
      • Client.exe (PID: 7808)
      • 1ng4wbas0z.exe (PID: 7788)
      • MYFKKI.exe (PID: 1180)
      • LWNEYV.exe (PID: 4164)
      • GLMMKU.exe (PID: 2236)

    • Create files in the Startup directory

      • QPMFYX.exe (PID: 7672)
      • MYFKKI.exe (PID: 1180)
      • GLMMKU.exe (PID: 2236)
      • LWNEYV.exe (PID: 4164)

    • LUMMA mutex has been found

      • MSBuild.exe (PID: 7720)

    • NJRAT mutex has been found

      • srq1dtr1ng.exe (PID: 7920)
      • Dllhost.exe (PID: 4528)

    • QUASAR has been detected (SURICATA)

      • Client.exe (PID: 7808)

    • Connects to the CnC server

      • Client.exe (PID: 7808)
      • Dllhost.exe (PID: 4528)

    • ASYNCRAT has been detected (SURICATA)

      • Riot Games.exe (PID: 7620)

    • Uses Task Scheduler to run other applications

      • Dllhost.exe (PID: 4528)

    • QUASAR has been detected (YARA)

      • Client.exe (PID: 7808)

    • NJRAT has been detected (SURICATA)

      • Dllhost.exe (PID: 4528)

  • SUSPICIOUS

    • Starts a Microsoft application from unusual location

      • VasuisUly.exe (PID: 1276)

    • Process drops legitimate windows executable

      • VasuisUly.exe (PID: 1276)
      • MSBuild.exe (PID: 6972)
      • 1ng4wbas0z.exe (PID: 7788)
      • MSBuild.exe (PID: 6828)

    • Searches for installed software

      • MSBuild.exe (PID: 6972)
      • MSBuild.exe (PID: 7720)
      • MSBuild.exe (PID: 6828)

    • Reads security settings of Internet Explorer

      • MSBuild.exe (PID: 6972)
      • Client.exe (PID: 7808)
      • srq1dtr1ng.exe (PID: 7920)
      • MSBuild.exe (PID: 6828)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • MSBuild.exe (PID: 6972)
      • MSBuild.exe (PID: 6828)
      • MSBuild.exe (PID: 2552)

    • There is functionality for taking screenshot (YARA)

      • MSBuild.exe (PID: 6972)
      • Client.exe (PID: 7808)

    • Multiple wallet extension IDs have been found

      • MSBuild.exe (PID: 6972)

    • Potential Corporate Privacy Violation

      • MSBuild.exe (PID: 6972)
      • MSBuild.exe (PID: 6828)

    • Executable content was dropped or overwritten

      • MSBuild.exe (PID: 6972)
      • 90r90zukno.exe (PID: 7772)
      • 2nopzuasri.exe (PID: 4448)
      • FOUDSV.exe (PID: 2656)
      • 1ng4wbas0z.exe (PID: 7788)
      • srq1dtr1ng.exe (PID: 7920)
      • QPMFYX.exe (PID: 4944)
      • MYFKKI.exe (PID: 7324)
      • LWNEYV.exe (PID: 5008)
      • GLMMKU.exe (PID: 5048)
      • Dllhost.exe (PID: 4528)
      • MSBuild.exe (PID: 6828)
      • s0h4ohlx4e.exe (PID: 8172)
      • KVIXYG.exe (PID: 8152)

    • Start notepad (likely ransomware note)

      • MSBuild.exe (PID: 6972)
      • MSBuild.exe (PID: 6828)

    • Process requests binary or script from the Internet

      • MSBuild.exe (PID: 6972)
      • MSBuild.exe (PID: 6828)

    • Starts itself from another location

      • 90r90zukno.exe (PID: 7772)
      • 2nopzuasri.exe (PID: 4448)
      • FOUDSV.exe (PID: 2656)
      • srq1dtr1ng.exe (PID: 7920)
      • QPMFYX.exe (PID: 4944)
      • MYFKKI.exe (PID: 7324)
      • LWNEYV.exe (PID: 5008)
      • GLMMKU.exe (PID: 5048)
      • s0h4ohlx4e.exe (PID: 8172)
      • KVIXYG.exe (PID: 8152)

    • Executing commands from a ".bat" file

      • 1ng4wbas0z.exe (PID: 7788)

    • Starts CMD.EXE for commands execution

      • 1ng4wbas0z.exe (PID: 7788)
      • MSBuild.exe (PID: 6972)
      • MSBuild.exe (PID: 6828)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 900)
      • cmd.exe (PID: 6592)
      • cmd.exe (PID: 7968)

    • Checks for external IP

      • svchost.exe (PID: 2196)

    • Connects to unusual port

      • Client.exe (PID: 7808)
      • QPMFYX.exe (PID: 7672)
      • MYFKKI.exe (PID: 1180)
      • Riot Games.exe (PID: 7620)
      • GLMMKU.exe (PID: 2236)
      • DYKYDU.exe (PID: 8052)
      • LWNEYV.exe (PID: 4164)
      • YGXQWJ.exe (PID: 7488)
      • Dllhost.exe (PID: 4528)

    • Contacting a server suspected of hosting an CnC

      • Client.exe (PID: 7808)
      • Riot Games.exe (PID: 7620)
      • Dllhost.exe (PID: 4528)

    • The process creates files with name similar to system file names

      • srq1dtr1ng.exe (PID: 7920)

    • The executable file from the user directory is run by the CMD process

      • Riot Games.exe (PID: 7620)

    • The process executes via Task Scheduler

      • Server.exe (PID: 3156)

  • INFO

    • The sample compiled with english language support

      • VasuisUly.exe (PID: 1276)
      • MSBuild.exe (PID: 6972)
      • MSBuild.exe (PID: 6828)

    • Reads the computer name

      • MSBuild.exe (PID: 6972)
      • srq1dtr1ng.exe (PID: 7920)
      • 90r90zukno.exe (PID: 7772)
      • 1ng4wbas0z.exe (PID: 7788)
      • MSBuild.exe (PID: 7720)
      • Client.exe (PID: 7808)
      • QPMFYX.exe (PID: 7672)
      • MSBuild.exe (PID: 6828)
      • Dllhost.exe (PID: 4528)
      • Riot Games.exe (PID: 7620)
      • MYFKKI.exe (PID: 1180)
      • Client.exe (PID: 1676)
      • LWNEYV.exe (PID: 4164)
      • Riot Games.exe (PID: 4068)
      • GLMMKU.exe (PID: 2236)

    • Creates files in the program directory

      • MSBuild.exe (PID: 6972)
      • MSBuild.exe (PID: 6828)

    • Creates files or folders in the user directory

      • MSBuild.exe (PID: 6972)
      • 1ng4wbas0z.exe (PID: 7788)
      • 90r90zukno.exe (PID: 7772)
      • QPMFYX.exe (PID: 7672)
      • MYFKKI.exe (PID: 1180)
      • MSBuild.exe (PID: 6828)
      • LWNEYV.exe (PID: 4164)
      • GLMMKU.exe (PID: 2236)

    • Checks proxy server information

      • MSBuild.exe (PID: 6972)
      • Client.exe (PID: 7808)
      • MSBuild.exe (PID: 6828)

    • Reads the software policy settings

      • MSBuild.exe (PID: 6972)
      • MSBuild.exe (PID: 7720)
      • Client.exe (PID: 7808)
      • MSBuild.exe (PID: 6828)
      • Riot Games.exe (PID: 7620)

    • Reads Environment values

      • MSBuild.exe (PID: 6972)
      • 90r90zukno.exe (PID: 7772)
      • 1ng4wbas0z.exe (PID: 7788)
      • Client.exe (PID: 7808)
      • Riot Games.exe (PID: 7620)
      • Riot Games.exe (PID: 4068)
      • Client.exe (PID: 1676)
      • MSBuild.exe (PID: 6828)

    • Reads CPU info

      • MSBuild.exe (PID: 6972)
      • MSBuild.exe (PID: 6828)

    • Checks supported languages

      • VasuisUly.exe (PID: 1276)
      • MSBuild.exe (PID: 6972)
      • 90r90zukno.exe (PID: 7772)
      • pz5x4wbas0.exe (PID: 8152)
      • srq1dtr1ng.exe (PID: 7920)
      • 1ng4wbas0z.exe (PID: 7788)
      • Client.exe (PID: 7808)
      • MSBuild.exe (PID: 7720)
      • 2nopzuasri.exe (PID: 4448)
      • FOUDSV.exe (PID: 2656)
      • QPMFYX.exe (PID: 7672)
      • je37900zu3.exe (PID: 728)
      • Dllhost.exe (PID: 4528)
      • Riot Games.exe (PID: 7620)
      • QPMFYX.exe (PID: 4944)
      • MSBuild.exe (PID: 6828)
      • MYFKKI.exe (PID: 1180)
      • Riot Games.exe (PID: 4068)
      • Client.exe (PID: 1676)
      • MYFKKI.exe (PID: 7324)
      • LWNEYV.exe (PID: 4164)
      • LWNEYV.exe (PID: 5008)
      • GLMMKU.exe (PID: 2236)
      • GLMMKU.exe (PID: 5048)

    • Reads product name

      • MSBuild.exe (PID: 6972)
      • MSBuild.exe (PID: 6828)

    • Reads the machine GUID from the registry

      • MSBuild.exe (PID: 6972)
      • 90r90zukno.exe (PID: 7772)
      • 1ng4wbas0z.exe (PID: 7788)
      • Client.exe (PID: 7808)
      • Riot Games.exe (PID: 7620)
      • MSBuild.exe (PID: 6828)
      • Riot Games.exe (PID: 4068)
      • Client.exe (PID: 1676)

    • Attempting to use instant messaging service

      • MSBuild.exe (PID: 6972)
      • MSBuild.exe (PID: 6828)

    • Process checks computer location settings

      • MSBuild.exe (PID: 6972)
      • srq1dtr1ng.exe (PID: 7920)

    • Application launched itself

      • chrome.exe (PID: 7556)
      • msedge.exe (PID: 2600)
      • chrome.exe (PID: 2152)
      • msedge.exe (PID: 7432)
      • chrome.exe (PID: 536)

    • Auto-launch of the file from Registry key

      • 90r90zukno.exe (PID: 7772)
      • QPMFYX.exe (PID: 7672)
      • Client.exe (PID: 7808)
      • 1ng4wbas0z.exe (PID: 7788)
      • MYFKKI.exe (PID: 1180)
      • LWNEYV.exe (PID: 4164)
      • GLMMKU.exe (PID: 2236)

    • Create files in a temporary directory

      • 2nopzuasri.exe (PID: 4448)
      • FOUDSV.exe (PID: 2656)
      • 1ng4wbas0z.exe (PID: 7788)
      • srq1dtr1ng.exe (PID: 7920)
      • QPMFYX.exe (PID: 4944)
      • MYFKKI.exe (PID: 7324)
      • LWNEYV.exe (PID: 5008)
      • GLMMKU.exe (PID: 5048)

    • Auto-launch of the file from Startup directory

      • QPMFYX.exe (PID: 7672)
      • MYFKKI.exe (PID: 1180)
      • LWNEYV.exe (PID: 4164)
      • GLMMKU.exe (PID: 2236)

    • Disables trace logs

      • Client.exe (PID: 7808)

    • Manual execution by a user

      • QPMFYX.exe (PID: 4944)
      • Riot Games.exe (PID: 4068)
      • Client.exe (PID: 1676)
      • MYFKKI.exe (PID: 7324)
      • LWNEYV.exe (PID: 5008)
      • GLMMKU.exe (PID: 5048)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Vidar

(PID) Process(6972) MSBuild.exe
C2https://t.me/m00f3r
URLhttps://steamcommunity.com/profiles/76561199851454339
RC43333333333333333UUUUUUUUUUUUUUUU
Strings (1)

Quasar

(PID) Process(7808) Client.exe
Version1.4.1
C2 (2)213.209.150.210:8883
Sub_DirSubDir
Install_NameClient.exe
Mutex5ae9d9d1-c102-422b-846d-85bceea00d83
StartupUpo
TagOffice04
LogDirLogs
SignaturegfBHNcaynSkfNOpwQtpyv7JezWvwv+YcPv4WSFPg1YMv9OugUwdf0BuQVtPGzb32dxmDzEOH0eoB49blE1hycFq3knlaViiC/uYPO9h4CqmafG3SihfHSCi6C74a/9hh01uT8OSqnSU69zxro2xn3wR71XJpdwt3wzBssB7bzwvolTyEn88PfHPAz4HWafeOzgJCt/940MEuE7JgvQipk4ztGH8MnXUox8HpYVma6SQHWn8FuG2pKGSWsMRl4mRaKH49a2W+MNGyum9rZxmnM/lRXg5XDWJ7K3uwN0wgmAYS...
CertificateMIIE9DCCAtygAwIBAgIQAJoopC+uo/K0En/AuBDRvTANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI1MDUwNjEyMDk1NloYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA8pl7qFlzuo1TKr8dIFgKerutjyzUduuYxjGR5shcPeNMZmNO/zoXk1ICLc5a5zgZa6yZOluN...
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:05:08 15:10:22+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14
CodeSize: 418816
InitializedDataSize: 70656
UninitializedDataSize: -
EntryPoint: 0x514b8
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 10.0.19041.1
ProductVersionNumber: 10.0.19041.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: TCP/IP Netstat Command
FileVersion: 10.0.19041.1 (WinBuild.160101.0800)
InternalName: netstat.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: netstat.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 10.0.19041.1
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
238
Monitored processes
107
Malicious processes
22
Suspicious processes
3

Behavior graph

Click at the process to see the details
start vasuisuly.exe no specs #VIDAR msbuild.exe sppextcomobj.exe no specs slui.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs pz5x4wbas0.exe no specs #NJRAT srq1dtr1ng.exe msbuild.exe no specs msbuild.exe no specs msbuild.exe no specs #LUMMA msbuild.exe 90r90zukno.exe 1ng4wbas0z.exe #QUASAR client.exe 2nopzuasri.exe foudsv.exe qpmfyx.exe je37900zu3.exe no specs cmd.exe no specs conhost.exe no specs timeout.exe no specs cmd.exe no specs conhost.exe no specs timeout.exe no specs svchost.exe #VIDAR msbuild.exe #NJRAT dllhost.exe #ASYNCRAT riot games.exe qpmfyx.exe myfkki.exe riot games.exe no specs client.exe no specs myfkki.exe lwneyv.exe lwneyv.exe glmmku.exe glmmku.exe dykydu.exe schtasks.exe no specs conhost.exe no specs slui.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs jmo89zu3o8.exe no specs 0z58g4wlny.exe no specs gvk6phlxtj.exe no specs msbuild.exe no specs msbuild.exe f37g4ozm7y.exe no specs s0h4ohlx4e.exe kvixyg.exe ygxqwj.exe t2no8q9h4o.exe no specs cmd.exe no specs conhost.exe no specs timeout.exe no specs msbuild.exe server.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
536"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"C:\Program Files\Google\Chrome\Application\chrome.exe
MSBuild.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
664"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2316 --field-trial-handle=2320,i,7670155471083722893,10279445616332481820,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
680"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2832 --field-trial-handle=2440,i,7998301172052546555,6169524360926416546,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
728"C:\ProgramData\je37900zu3.exe" C:\ProgramData\je37900zu3.exe—MSBuild.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Netstat Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\programdata\je37900zu3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
900C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\tmp974B.tmp.bat""C:\Windows\System32\cmd.exe—1ng4wbas0z.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
900"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=4804 --field-trial-handle=1960,i,9140133397627988614,13903019391493653435,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1072"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1956 --field-trial-handle=1960,i,9140133397627988614,13903019391493653435,262144 --variations-seed-version /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1180C:\Users\admin\AppData\Local\Temp\JRHUSXNWYMX\MYFKKI.exe 4944C:\Users\admin\AppData\Local\Temp\JRHUSXNWYMX\MYFKKI.exe
QPMFYX.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\jrhusxnwymx\myfkki.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1276"C:\Users\admin\AppData\Local\Temp\VasuisUly.exe" C:\Users\admin\AppData\Local\Temp\VasuisUly.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Netstat Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\vasuisuly.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1568\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
43 586
Read events
43 081
Write events
505
Delete events
0

Modification events

(PID) Process:(6972) MSBuild.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6972) MSBuild.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6972) MSBuild.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7556) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(7556) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(7556) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(7556) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(7556) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(2600) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(2600) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
Executable files
67
Suspicious files
251
Text files
179
Unknown types
0

Dropped files

PID
Process
Filename
Type
7556chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old~RF10fdea.TMP —
MD5:—
SHA256:—
7556chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF10fdda.TMP —
MD5:—
SHA256:—
7556chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old~RF10fdea.TMP —
MD5:—
SHA256:—
7556chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old —
MD5:—
SHA256:—
7556chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
7556chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
7556chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RF10fdda.TMP —
MD5:—
SHA256:—
7556chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old~RF10fdf9.TMP —
MD5:—
SHA256:—
7556chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
7556chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
264
DNS requests
136
Threats
18

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6972
MSBuild.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
6972
MSBuild.exe
GET
200
18.66.192.53:80
http://e6.c.lencr.org/96.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5548
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5548
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6972
MSBuild.exe
GET
200
213.209.150.210:80
http://files.innovadentalkj.com/css/LisuasControl.exe
unknown
—
—
malicious
6972
MSBuild.exe
GET
200
213.209.150.210:80
http://files.innovadentalkj.com/js/nJack.exe
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.166:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6972
MSBuild.exe
149.154.167.99:443
t.me
Telegram Messenger Inc
GB
whitelisted
6972
MSBuild.exe
78.46.233.21:443
72.aa.4t.com
Hetzner Online GmbH
DE
unknown
6972
MSBuild.exe
69.192.161.44:80
x1.c.lencr.org
AKAMAI-AS
DE
whitelisted
6972
MSBuild.exe
18.66.192.53:80
e6.c.lencr.org
AMAZON-02
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.181.238
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.48.23.166
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
t.me
  • 149.154.167.99
whitelisted
72.aa.4t.com
  • 78.46.233.21
unknown
x1.c.lencr.org
  • 69.192.161.44
whitelisted
e6.c.lencr.org
  • 18.66.192.53
  • 18.66.192.44
  • 18.66.192.120
  • 18.66.192.84
whitelisted
login.live.com
  • 20.190.160.14
  • 20.190.160.5
  • 40.126.32.134
  • 20.190.160.130
  • 20.190.160.132
  • 20.190.160.64
  • 20.190.160.131
  • 40.126.32.68
whitelisted

Threats

PID
Process
Class
Message
—
—
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
—
—
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 57
—
—
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
—
—
Potentially Bad Traffic
ET INFO External IP Lookup Domain in DNS Lookup (ipwho .is)
—
—
Domain Observed Used for C2 Detected
ET MALWARE Generic AsyncRAT/zgRAT Style SSL Cert
—
—
Domain Observed Used for C2 Detected
ET MALWARE Observed Malicious SSL Cert (Quasar CnC)
—
—
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] QuasarRAT Successful Connection (GCM_SHA384)
—
—
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
—
—
Domain Observed Used for C2 Detected
REMOTE [ANY.RUN] AsyncRAT SSL certificate
—
—
Domain Observed Used for C2 Detected
ET MALWARE Observed Malicious SSL Cert (VenomRAT)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
VasuisUly.exe