File name:

9eeb1ff9590f0d56965dd0c3be237be5.exe

Full analysis: https://app.any.run/tasks/7ee4596a-6d93-4564-ba03-cb3567f873f4
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Analysis date: February 01, 2025, 07:56:46
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
autoit
rat
asyncrat
remote
autoit-loader
discordgrabber
generic
stealer
stormkitty
ims-api
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

9EEB1FF9590F0D56965DD0C3BE237BE5

SHA1:

64155D81FE03AF2725DCA920E7AAC156B6FA12E6

SHA256:

5F9656C4D140F6EE84DA24A9241E4C7E8DB9B98AB32E9D860731DFBAB2CF7477

SSDEEP:

98304:+7kJIvMKykU6rbb1wWnFTKyD1FfX9EaoZ/KyssleX98CLYvBByJ+H+pDSeSFu3yI:VvMOmXZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • AutoIt loader has been detected (YARA)

      • Voyeurweb.com (PID: 6912)
    • DISCORDGRABBER has been detected (YARA)

      • RegAsm.exe (PID: 4384)
    • ASYNCRAT has been detected (YARA)

      • RegAsm.exe (PID: 4384)
    • STORMKITTY has been detected (YARA)

      • RegAsm.exe (PID: 4384)
    • ASYNCRAT has been detected (SURICATA)

      • RegAsm.exe (PID: 4384)
  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 9eeb1ff9590f0d56965dd0c3be237be5.exe (PID: 6380)
    • Application launched itself

      • cmd.exe (PID: 6476)
    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 6476)
      • 9eeb1ff9590f0d56965dd0c3be237be5.exe (PID: 6380)
    • Starts application with an unusual extension

      • cmd.exe (PID: 6476)
    • The executable file from the user directory is run by the CMD process

      • Voyeurweb.com (PID: 6912)
    • There is functionality for taking screenshot (YARA)

      • 9eeb1ff9590f0d56965dd0c3be237be5.exe (PID: 6380)
      • Voyeurweb.com (PID: 6912)
    • The process creates files with name similar to system file names

      • Voyeurweb.com (PID: 6912)
    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 6476)
    • Executable content was dropped or overwritten

      • Voyeurweb.com (PID: 6912)
    • Process drops legitimate windows executable

      • Voyeurweb.com (PID: 6912)
    • Possible usage of Discord/Telegram API has been detected (YARA)

      • RegAsm.exe (PID: 4384)
    • Starts a Microsoft application from unusual location

      • RegAsm.exe (PID: 4384)
    • Searches for installed software

      • RegAsm.exe (PID: 4384)
    • Contacting a server suspected of hosting an CnC

      • RegAsm.exe (PID: 4384)
    • Connects to unusual port

      • RegAsm.exe (PID: 4384)
    • Get information on the list of running processes

      • cmd.exe (PID: 6476)
    • Executing commands from ".cmd" file

      • 9eeb1ff9590f0d56965dd0c3be237be5.exe (PID: 6380)
    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 6476)
  • INFO

    • Reads the computer name

      • 9eeb1ff9590f0d56965dd0c3be237be5.exe (PID: 6380)
      • Voyeurweb.com (PID: 6912)
      • RegAsm.exe (PID: 4384)
      • extrac32.exe (PID: 6736)
    • Checks supported languages

      • 9eeb1ff9590f0d56965dd0c3be237be5.exe (PID: 6380)
      • Voyeurweb.com (PID: 6912)
      • extrac32.exe (PID: 6736)
      • RegAsm.exe (PID: 4384)
    • The sample compiled with english language support

      • 9eeb1ff9590f0d56965dd0c3be237be5.exe (PID: 6380)
      • Voyeurweb.com (PID: 6912)
    • Process checks computer location settings

      • 9eeb1ff9590f0d56965dd0c3be237be5.exe (PID: 6380)
    • Create files in a temporary directory

      • 9eeb1ff9590f0d56965dd0c3be237be5.exe (PID: 6380)
      • extrac32.exe (PID: 6736)
      • Voyeurweb.com (PID: 6912)
    • Reads mouse settings

      • Voyeurweb.com (PID: 6912)
    • Manual execution by a user

      • RegAsm.exe (PID: 4384)
    • Reads the machine GUID from the registry

      • RegAsm.exe (PID: 4384)
    • Reads the software policy settings

      • RegAsm.exe (PID: 4384)
    • Creates a new folder

      • cmd.exe (PID: 6712)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

ims-api

(PID) Process(4384) RegAsm.exe
Discord-Webhook-Tokens (1)1016614786533969920/fMJOOjA1pZqjV8_s0JC86KN9Fa0FeGPEHaEak8WTADC18s5Xnk3vl2YBdVD37L0qTWnM
Discord-Info-Links
1016614786533969920/fMJOOjA1pZqjV8_s0JC86KN9Fa0FeGPEHaEak8WTADC18s5Xnk3vl2YBdVD37L0qTWnM
Get Webhook Infohttps://discord.com/api/webhooks/1016614786533969920/fMJOOjA1pZqjV8_s0JC86KN9Fa0FeGPEHaEak8WTADC18s5Xnk3vl2YBdVD37L0qTWnM

StormKitty

(PID) Process(4384) RegAsm.exe
C2 (1)199.247.17.239
Ports (2)4449
7000
VersionRAT + hVNC 6.0.6
Options
AutoRunfalse
Mutexhujgycdymekpvnldx
InstallFolder%PreLoadSQLite_TargetFramework%
Certificates
Cert1MIICLjCCAZegAwIBAgIVALUOFWk8z6RV3/uzZ3kIYN62YODHMA0GCSqGSIb3DQEBDQUAMGIxFTATBgNVBAMMDFZlbm9tIFNlcnZlcjESMBAGA1UECwwJYWxleGVpa3VuMRswGQYDVQQKDBJWZW5vbSBCeSBhbGV4ZWlrdW4xCzAJBgNVBAcMAlNIMQswCQYDVQQGEwJDTjAeFw0yNDA0MjExOTM2MTBaFw0zNTAxMjkxOTM2MTBaMBAxDjAMBgNVBAMMBVZlbm9tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB...
Server_SignatureJKs1n2pmINUnJBiEjCCF6dzHvOg6omq240M5kW9KJ9tXLm0WAxBwAM8rOIRwSsMXEdiIH9zARiKipi+SfS5gLXMCfLX4iri2GZA0eWVKVJ71GJylolpvYFKALnDRIkjMJa5oqfw7juLZs+YCcHHG5To4YvE/aLmaZu8LBlENflY=
Keys
AES36f5abb73fb838ac278f4e17115752c858ddf49bc8b924683a8889cf2b01dfd6
SaltVenomRATByVenom
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2011:09:26 13:21:28+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 28160
InitializedDataSize: 445952
UninitializedDataSize: 16896
EntryPoint: 0x3883
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 1.575.4.55894
ProductVersionNumber: 1.575.4.55894
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
ProductName: Guardian360X
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
15
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 9eeb1ff9590f0d56965dd0c3be237be5.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs voyeurweb.com choice.exe no specs #ASYNCRAT regasm.exe

Process information

PID
CMD
Path
Indicators
Parent process
4384C:\Users\admin\AppData\Local\Temp\279619\RegAsm.exe C:\Users\admin\AppData\Local\Temp\279619\RegAsm.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\users\admin\appdata\local\temp\279619\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
ims-api
(PID) Process(4384) RegAsm.exe
Discord-Webhook-Tokens (1)1016614786533969920/fMJOOjA1pZqjV8_s0JC86KN9Fa0FeGPEHaEak8WTADC18s5Xnk3vl2YBdVD37L0qTWnM
Discord-Info-Links
1016614786533969920/fMJOOjA1pZqjV8_s0JC86KN9Fa0FeGPEHaEak8WTADC18s5Xnk3vl2YBdVD37L0qTWnM
Get Webhook Infohttps://discord.com/api/webhooks/1016614786533969920/fMJOOjA1pZqjV8_s0JC86KN9Fa0FeGPEHaEak8WTADC18s5Xnk3vl2YBdVD37L0qTWnM
StormKitty
(PID) Process(4384) RegAsm.exe
C2 (1)199.247.17.239
Ports (2)4449
7000
VersionRAT + hVNC 6.0.6
Options
AutoRunfalse
Mutexhujgycdymekpvnldx
InstallFolder%PreLoadSQLite_TargetFramework%
Certificates
Cert1MIICLjCCAZegAwIBAgIVALUOFWk8z6RV3/uzZ3kIYN62YODHMA0GCSqGSIb3DQEBDQUAMGIxFTATBgNVBAMMDFZlbm9tIFNlcnZlcjESMBAGA1UECwwJYWxleGVpa3VuMRswGQYDVQQKDBJWZW5vbSBCeSBhbGV4ZWlrdW4xCzAJBgNVBAcMAlNIMQswCQYDVQQGEwJDTjAeFw0yNDA0MjExOTM2MTBaFw0zNTAxMjkxOTM2MTBaMBAxDjAMBgNVBAMMBVZlbm9tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB...
Server_SignatureJKs1n2pmINUnJBiEjCCF6dzHvOg6omq240M5kW9KJ9tXLm0WAxBwAM8rOIRwSsMXEdiIH9zARiKipi+SfS5gLXMCfLX4iri2GZA0eWVKVJ71GJylolpvYFKALnDRIkjMJa5oqfw7juLZs+YCcHHG5To4YvE/aLmaZu8LBlENflY=
Keys
AES36f5abb73fb838ac278f4e17115752c858ddf49bc8b924683a8889cf2b01dfd6
SaltVenomRATByVenom
6380"C:\Users\admin\AppData\Local\Temp\9eeb1ff9590f0d56965dd0c3be237be5.exe" C:\Users\admin\AppData\Local\Temp\9eeb1ff9590f0d56965dd0c3be237be5.exeexplorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\9eeb1ff9590f0d56965dd0c3be237be5.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6476"C:\Windows\System32\cmd.exe" /c copy Tricks Tricks.cmd & Tricks.cmdC:\Windows\SysWOW64\cmd.exe9eeb1ff9590f0d56965dd0c3be237be5.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6484\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6540tasklist C:\Windows\SysWOW64\tasklist.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6560findstr /I "opssvc wrsa" C:\Windows\SysWOW64\findstr.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6652tasklist C:\Windows\SysWOW64\tasklist.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6660findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" C:\Windows\SysWOW64\findstr.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6712cmd /c md 279619C:\Windows\SysWOW64\cmd.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6736extrac32 /Y /E KnightsC:\Windows\SysWOW64\extrac32.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® CAB File Extract Utility
Exit code:
0
Version:
5.00 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\extrac32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
4 489
Read events
4 489
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
47
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
63809eeb1ff9590f0d56965dd0c3be237be5.exeC:\Users\admin\AppData\Local\Temp\Larrybinary
MD5:0EB8B1E9EECD9D157454A5D74E02B453
SHA256:10A453C8031366AF738D2E4855E5B6953F31AF81C41F4CF2D09278CC9C3B4479
63809eeb1ff9590f0d56965dd0c3be237be5.exeC:\Users\admin\AppData\Local\Temp\Knightscompressed
MD5:A37F52340B365E198501AE40C6BFA6E4
SHA256:9EC82A5093B170216E3BFDD5A691EB9E05597E0E85451F8059706BA9E8189862
63809eeb1ff9590f0d56965dd0c3be237be5.exeC:\Users\admin\AppData\Local\Temp\Doorbinary
MD5:AB75EF3E70EF6FEBB742211489B92CD2
SHA256:12ED56BDF120AA7E964597599A681EAAFC4F27FC6475C65674C0300C188A7BE9
63809eeb1ff9590f0d56965dd0c3be237be5.exeC:\Users\admin\AppData\Local\Temp\Trickstext
MD5:DD10A26516CA1A7BF722C34E4A8E7C4D
SHA256:C07BA02B2CB284E1F2A0C9EF887643BC8B7C552969066153F2A6BB6283669413
63809eeb1ff9590f0d56965dd0c3be237be5.exeC:\Users\admin\AppData\Local\Temp\Investingbinary
MD5:AAC60CCF17DA69648A8A504AC2A3BB3A
SHA256:59AD54C60B817D472EB77C5A8C922D9FF944686732B05E555524666EC01BDD25
63809eeb1ff9590f0d56965dd0c3be237be5.exeC:\Users\admin\AppData\Local\Temp\Concentrationsbinary
MD5:DFE3DBAC85EB7A4C1816ED4B4C1F050D
SHA256:DAF2AD4D0F20FC9730724E837D6E126A7A5CD71025E1833E345B8EF4EA003645
63809eeb1ff9590f0d56965dd0c3be237be5.exeC:\Users\admin\AppData\Local\Temp\Masonbinary
MD5:330AF6D59D7A99E5F90D560ADFC6CC03
SHA256:B04BEB5E076EC9E7A5152880A4266123A6AE5327FE33457D6917E049E6C1470B
63809eeb1ff9590f0d56965dd0c3be237be5.exeC:\Users\admin\AppData\Local\Temp\Inductionbinary
MD5:D7F7A2F66A3322A22751BE72CB5840FC
SHA256:4AA7CA4A48DFC31D34D5AF4D5B7D1D24EF1A6D07626CEA1B8218D4DFD7BCC930
63809eeb1ff9590f0d56965dd0c3be237be5.exeC:\Users\admin\AppData\Local\Temp\Recordedbinary
MD5:FC01551A815B37FE2F0E927B71E36BF4
SHA256:6CC49E1B3199B22456B28B6E9D5D9A97F5C9F03E15DC9C29C10541FD9575C37D
63809eeb1ff9590f0d56965dd0c3be237be5.exeC:\Users\admin\AppData\Local\Temp\Roybinary
MD5:881CD371509187E7AE3C6D8E020C8DC8
SHA256:E91F36B2AF5EF90B038D2E02F56C6B6CEDF5EA323CE29820F9A3AC993FCEAC90
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
28
DNS requests
18
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1176
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
5464
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
whitelisted
836
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
836
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5064
SearchApp.exe
2.21.65.132:443
www.bing.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
20.73.194.208:443
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
20.190.160.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1076
svchost.exe
184.28.89.167:443
go.microsoft.com
AKAMAI-AS
US
whitelisted
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
whitelisted
5464
backgroundTaskHost.exe
20.31.169.57:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.46
whitelisted
www.bing.com
  • 2.21.65.132
  • 2.21.65.154
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 184.30.131.245
whitelisted
login.live.com
  • 20.190.160.131
  • 20.190.160.128
  • 20.190.160.14
  • 40.126.32.134
  • 20.190.160.3
  • 20.190.160.4
  • 40.126.32.140
  • 40.126.32.76
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
cfQPDFsZUvvOiqtcFSRe.cfQPDFsZUvvOiqtcFSRe
unknown
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
arc.msn.com
  • 20.31.169.57
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fd.api.iris.microsoft.com
  • 20.223.36.55
whitelisted

Threats

PID
Process
Class
Message
4384
RegAsm.exe
Domain Observed Used for C2 Detected
REMOTE [ANY.RUN] Possible AsyncRAT SSL Certificate
No debug info