File name:

9eeb1ff9590f0d56965dd0c3be237be5.exe

Full analysis: https://app.any.run/tasks/7ee4596a-6d93-4564-ba03-cb3567f873f4
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Analysis date: February 01, 2025, 07:56:46
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
autoit
rat
asyncrat
remote
autoit-loader
discordgrabber
generic
stealer
stormkitty
ims-api
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

9EEB1FF9590F0D56965DD0C3BE237BE5

SHA1:

64155D81FE03AF2725DCA920E7AAC156B6FA12E6

SHA256:

5F9656C4D140F6EE84DA24A9241E4C7E8DB9B98AB32E9D860731DFBAB2CF7477

SSDEEP:

98304:+7kJIvMKykU6rbb1wWnFTKyD1FfX9EaoZ/KyssleX98CLYvBByJ+H+pDSeSFu3yI:VvMOmXZ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • AutoIt loader has been detected (YARA)

      • Voyeurweb.com (PID: 6912)
    • DISCORDGRABBER has been detected (YARA)

      • RegAsm.exe (PID: 4384)
    • ASYNCRAT has been detected (YARA)

      • RegAsm.exe (PID: 4384)
    • STORMKITTY has been detected (YARA)

      • RegAsm.exe (PID: 4384)
    • ASYNCRAT has been detected (SURICATA)

      • RegAsm.exe (PID: 4384)
  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 9eeb1ff9590f0d56965dd0c3be237be5.exe (PID: 6380)
    • Executing commands from ".cmd" file

      • 9eeb1ff9590f0d56965dd0c3be237be5.exe (PID: 6380)
    • Get information on the list of running processes

      • cmd.exe (PID: 6476)
    • Starts CMD.EXE for commands execution

      • 9eeb1ff9590f0d56965dd0c3be237be5.exe (PID: 6380)
      • cmd.exe (PID: 6476)
    • Application launched itself

      • cmd.exe (PID: 6476)
    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 6476)
    • Starts application with an unusual extension

      • cmd.exe (PID: 6476)
    • The executable file from the user directory is run by the CMD process

      • Voyeurweb.com (PID: 6912)
    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 6476)
    • There is functionality for taking screenshot (YARA)

      • Voyeurweb.com (PID: 6912)
      • 9eeb1ff9590f0d56965dd0c3be237be5.exe (PID: 6380)
    • Process drops legitimate windows executable

      • Voyeurweb.com (PID: 6912)
    • The process creates files with name similar to system file names

      • Voyeurweb.com (PID: 6912)
    • Executable content was dropped or overwritten

      • Voyeurweb.com (PID: 6912)
    • Starts a Microsoft application from unusual location

      • RegAsm.exe (PID: 4384)
    • Possible usage of Discord/Telegram API has been detected (YARA)

      • RegAsm.exe (PID: 4384)
    • Contacting a server suspected of hosting an CnC

      • RegAsm.exe (PID: 4384)
    • Connects to unusual port

      • RegAsm.exe (PID: 4384)
    • Searches for installed software

      • RegAsm.exe (PID: 4384)
  • INFO

    • Create files in a temporary directory

      • 9eeb1ff9590f0d56965dd0c3be237be5.exe (PID: 6380)
      • extrac32.exe (PID: 6736)
      • Voyeurweb.com (PID: 6912)
    • The sample compiled with english language support

      • 9eeb1ff9590f0d56965dd0c3be237be5.exe (PID: 6380)
      • Voyeurweb.com (PID: 6912)
    • Reads the computer name

      • 9eeb1ff9590f0d56965dd0c3be237be5.exe (PID: 6380)
      • extrac32.exe (PID: 6736)
      • Voyeurweb.com (PID: 6912)
      • RegAsm.exe (PID: 4384)
    • Process checks computer location settings

      • 9eeb1ff9590f0d56965dd0c3be237be5.exe (PID: 6380)
    • Checks supported languages

      • 9eeb1ff9590f0d56965dd0c3be237be5.exe (PID: 6380)
      • extrac32.exe (PID: 6736)
      • Voyeurweb.com (PID: 6912)
      • RegAsm.exe (PID: 4384)
    • Creates a new folder

      • cmd.exe (PID: 6712)
    • Reads mouse settings

      • Voyeurweb.com (PID: 6912)
    • Manual execution by a user

      • RegAsm.exe (PID: 4384)
    • Reads the software policy settings

      • RegAsm.exe (PID: 4384)
    • Reads the machine GUID from the registry

      • RegAsm.exe (PID: 4384)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

ims-api

(PID) Process(4384) RegAsm.exe
Discord-Webhook-Tokens (1)1016614786533969920/fMJOOjA1pZqjV8_s0JC86KN9Fa0FeGPEHaEak8WTADC18s5Xnk3vl2YBdVD37L0qTWnM
Discord-Info-Links
1016614786533969920/fMJOOjA1pZqjV8_s0JC86KN9Fa0FeGPEHaEak8WTADC18s5Xnk3vl2YBdVD37L0qTWnM
Get Webhook Infohttps://discord.com/api/webhooks/1016614786533969920/fMJOOjA1pZqjV8_s0JC86KN9Fa0FeGPEHaEak8WTADC18s5Xnk3vl2YBdVD37L0qTWnM

StormKitty

(PID) Process(4384) RegAsm.exe
C2 (1)199.247.17.239
Ports (2)4449
7000
VersionRAT + hVNC 6.0.6
Options
AutoRunfalse
Mutexhujgycdymekpvnldx
InstallFolder%PreLoadSQLite_TargetFramework%
Certificates
Cert1MIICLjCCAZegAwIBAgIVALUOFWk8z6RV3/uzZ3kIYN62YODHMA0GCSqGSIb3DQEBDQUAMGIxFTATBgNVBAMMDFZlbm9tIFNlcnZlcjESMBAGA1UECwwJYWxleGVpa3VuMRswGQYDVQQKDBJWZW5vbSBCeSBhbGV4ZWlrdW4xCzAJBgNVBAcMAlNIMQswCQYDVQQGEwJDTjAeFw0yNDA0MjExOTM2MTBaFw0zNTAxMjkxOTM2MTBaMBAxDjAMBgNVBAMMBVZlbm9tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB...
Server_SignatureJKs1n2pmINUnJBiEjCCF6dzHvOg6omq240M5kW9KJ9tXLm0WAxBwAM8rOIRwSsMXEdiIH9zARiKipi+SfS5gLXMCfLX4iri2GZA0eWVKVJ71GJylolpvYFKALnDRIkjMJa5oqfw7juLZs+YCcHHG5To4YvE/aLmaZu8LBlENflY=
Keys
AES36f5abb73fb838ac278f4e17115752c858ddf49bc8b924683a8889cf2b01dfd6
SaltVenomRATByVenom
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2011:09:26 13:21:28+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 28160
InitializedDataSize: 445952
UninitializedDataSize: 16896
EntryPoint: 0x3883
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 1.575.4.55894
ProductVersionNumber: 1.575.4.55894
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
ProductName: Guardian360X
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
15
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 9eeb1ff9590f0d56965dd0c3be237be5.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs voyeurweb.com choice.exe no specs #ASYNCRAT regasm.exe

Process information

PID
CMD
Path
Indicators
Parent process
4384C:\Users\admin\AppData\Local\Temp\279619\RegAsm.exe C:\Users\admin\AppData\Local\Temp\279619\RegAsm.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Assembly Registration Utility
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\users\admin\appdata\local\temp\279619\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
ims-api
(PID) Process(4384) RegAsm.exe
Discord-Webhook-Tokens (1)1016614786533969920/fMJOOjA1pZqjV8_s0JC86KN9Fa0FeGPEHaEak8WTADC18s5Xnk3vl2YBdVD37L0qTWnM
Discord-Info-Links
1016614786533969920/fMJOOjA1pZqjV8_s0JC86KN9Fa0FeGPEHaEak8WTADC18s5Xnk3vl2YBdVD37L0qTWnM
Get Webhook Infohttps://discord.com/api/webhooks/1016614786533969920/fMJOOjA1pZqjV8_s0JC86KN9Fa0FeGPEHaEak8WTADC18s5Xnk3vl2YBdVD37L0qTWnM
StormKitty
(PID) Process(4384) RegAsm.exe
C2 (1)199.247.17.239
Ports (2)4449
7000
VersionRAT + hVNC 6.0.6
Options
AutoRunfalse
Mutexhujgycdymekpvnldx
InstallFolder%PreLoadSQLite_TargetFramework%
Certificates
Cert1MIICLjCCAZegAwIBAgIVALUOFWk8z6RV3/uzZ3kIYN62YODHMA0GCSqGSIb3DQEBDQUAMGIxFTATBgNVBAMMDFZlbm9tIFNlcnZlcjESMBAGA1UECwwJYWxleGVpa3VuMRswGQYDVQQKDBJWZW5vbSBCeSBhbGV4ZWlrdW4xCzAJBgNVBAcMAlNIMQswCQYDVQQGEwJDTjAeFw0yNDA0MjExOTM2MTBaFw0zNTAxMjkxOTM2MTBaMBAxDjAMBgNVBAMMBVZlbm9tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB...
Server_SignatureJKs1n2pmINUnJBiEjCCF6dzHvOg6omq240M5kW9KJ9tXLm0WAxBwAM8rOIRwSsMXEdiIH9zARiKipi+SfS5gLXMCfLX4iri2GZA0eWVKVJ71GJylolpvYFKALnDRIkjMJa5oqfw7juLZs+YCcHHG5To4YvE/aLmaZu8LBlENflY=
Keys
AES36f5abb73fb838ac278f4e17115752c858ddf49bc8b924683a8889cf2b01dfd6
SaltVenomRATByVenom
6380"C:\Users\admin\AppData\Local\Temp\9eeb1ff9590f0d56965dd0c3be237be5.exe" C:\Users\admin\AppData\Local\Temp\9eeb1ff9590f0d56965dd0c3be237be5.exeexplorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\9eeb1ff9590f0d56965dd0c3be237be5.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6476"C:\Windows\System32\cmd.exe" /c copy Tricks Tricks.cmd & Tricks.cmdC:\Windows\SysWOW64\cmd.exe9eeb1ff9590f0d56965dd0c3be237be5.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6484\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6540tasklist C:\Windows\SysWOW64\tasklist.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6560findstr /I "opssvc wrsa" C:\Windows\SysWOW64\findstr.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6652tasklist C:\Windows\SysWOW64\tasklist.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6660findstr "AvastUI AVGUI bdservicehost nsWscSvc ekrn SophosHealth" C:\Windows\SysWOW64\findstr.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6712cmd /c md 279619C:\Windows\SysWOW64\cmd.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6736extrac32 /Y /E KnightsC:\Windows\SysWOW64\extrac32.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® CAB File Extract Utility
Exit code:
0
Version:
5.00 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\extrac32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
4 489
Read events
4 489
Write events
0
Delete events
0

Modification events

No data
Executable files
2
Suspicious files
47
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
63809eeb1ff9590f0d56965dd0c3be237be5.exeC:\Users\admin\AppData\Local\Temp\Masonbinary
MD5:330AF6D59D7A99E5F90D560ADFC6CC03
SHA256:B04BEB5E076EC9E7A5152880A4266123A6AE5327FE33457D6917E049E6C1470B
63809eeb1ff9590f0d56965dd0c3be237be5.exeC:\Users\admin\AppData\Local\Temp\Knightscompressed
MD5:A37F52340B365E198501AE40C6BFA6E4
SHA256:9EC82A5093B170216E3BFDD5A691EB9E05597E0E85451F8059706BA9E8189862
63809eeb1ff9590f0d56965dd0c3be237be5.exeC:\Users\admin\AppData\Local\Temp\Trickstext
MD5:DD10A26516CA1A7BF722C34E4A8E7C4D
SHA256:C07BA02B2CB284E1F2A0C9EF887643BC8B7C552969066153F2A6BB6283669413
63809eeb1ff9590f0d56965dd0c3be237be5.exeC:\Users\admin\AppData\Local\Temp\Sitesbinary
MD5:38965933CDB8B73F94CD0763FE2AB77B
SHA256:F67A2AC2B8ED7724B513ACC76C46E41224C2FF1793E73E1E0B0DF1C4652E6D4F
63809eeb1ff9590f0d56965dd0c3be237be5.exeC:\Users\admin\AppData\Local\Temp\Connectbinary
MD5:E9AD10C7D571B262F745F4C5CA98D374
SHA256:F3E3D12AAE7DBDDB4E9D18DCEC38F811E24F0C3300814D737F2889867C9FB7BF
63809eeb1ff9590f0d56965dd0c3be237be5.exeC:\Users\admin\AppData\Local\Temp\Wantbinary
MD5:3A217E8AFDB0927D567E0D32F474D3B4
SHA256:3D6337FC70FF503D7FB244ECC59109548AD32CE9C7A2ECD446435B7BC6EEF265
63809eeb1ff9590f0d56965dd0c3be237be5.exeC:\Users\admin\AppData\Local\Temp\Concentrationsbinary
MD5:DFE3DBAC85EB7A4C1816ED4B4C1F050D
SHA256:DAF2AD4D0F20FC9730724E837D6E126A7A5CD71025E1833E345B8EF4EA003645
63809eeb1ff9590f0d56965dd0c3be237be5.exeC:\Users\admin\AppData\Local\Temp\Cpbinary
MD5:6315E46F7F635A001F040626A26C420B
SHA256:358E9FDF00B1967792FFFC97795F1363C9C5457B9DE6E4D182A8FF0854D8D95C
63809eeb1ff9590f0d56965dd0c3be237be5.exeC:\Users\admin\AppData\Local\Temp\Recordedbinary
MD5:FC01551A815B37FE2F0E927B71E36BF4
SHA256:6CC49E1B3199B22456B28B6E9D5D9A97F5C9F03E15DC9C29C10541FD9575C37D
63809eeb1ff9590f0d56965dd0c3be237be5.exeC:\Users\admin\AppData\Local\Temp\Herbbinary
MD5:695D3DAB8617F2859E3B64C29EEDFE5E
SHA256:05043D8DAA392E9923BC67BEC7B64FA078B6ADA6F9E59BC58082D61E55BCCFE9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
28
DNS requests
18
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1176
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
whitelisted
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
whitelisted
5464
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
whitelisted
836
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
836
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5064
SearchApp.exe
2.21.65.132:443
www.bing.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
whitelisted
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
20.73.194.208:443
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
20.190.160.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1076
svchost.exe
184.28.89.167:443
go.microsoft.com
AKAMAI-AS
US
whitelisted
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
whitelisted
5464
backgroundTaskHost.exe
20.31.169.57:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.46
whitelisted
www.bing.com
  • 2.21.65.132
  • 2.21.65.154
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 184.30.131.245
whitelisted
login.live.com
  • 20.190.160.131
  • 20.190.160.128
  • 20.190.160.14
  • 40.126.32.134
  • 20.190.160.3
  • 20.190.160.4
  • 40.126.32.140
  • 40.126.32.76
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
cfQPDFsZUvvOiqtcFSRe.cfQPDFsZUvvOiqtcFSRe
unknown
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
arc.msn.com
  • 20.31.169.57
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fd.api.iris.microsoft.com
  • 20.223.36.55
whitelisted

Threats

PID
Process
Class
Message
4384
RegAsm.exe
Domain Observed Used for C2 Detected
REMOTE [ANY.RUN] Possible AsyncRAT SSL Certificate
No debug info