File name:

filmyzilla.in.net.exe

Full analysis: https://app.any.run/tasks/1b317953-f4b9-4c1d-aa72-b6f022a7505d
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: March 12, 2026, 18:32:04
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
rat
asyncrat
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

F2E3209B3FA64AC9D630B8B2D7451205

SHA1:

08B3CB5C3C203A056204BEE8C48BB75C4E752583

SHA256:

6458F0DDF0BF9DAA4E7D04AFBDB7204FE5DAB7A6A52C3854D6BC197F76D92D4B

SSDEEP:

1536:+SSZOeDgpCQb7tQnnlSGbbRw+hSBW66VclN:+SSZOTpCQb7tSlSGbbR2IY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • filmyzilla.in.net.exe (PID: 4128)

    • ASYNCRAT has been detected (YARA)

      • filmyzilla.in.net.exe (PID: 6472)

  • SUSPICIOUS

    • Executing commands from a ".bat" file

      • filmyzilla.in.net.exe (PID: 4128)

    • Starts CMD.EXE for commands execution

      • filmyzilla.in.net.exe (PID: 4128)

    • Executable content was dropped or overwritten

      • filmyzilla.in.net.exe (PID: 4128)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 8412)

    • The executable file from the user directory is run by the CMD process

      • filmyzilla.in.net.exe (PID: 8716)

  • INFO

    • Checks supported languages

      • filmyzilla.in.net.exe (PID: 4128)
      • filmyzilla.in.net.exe (PID: 6472)
      • filmyzilla.in.net.exe (PID: 8716)

    • Reads the computer name

      • filmyzilla.in.net.exe (PID: 4128)
      • filmyzilla.in.net.exe (PID: 6472)
      • filmyzilla.in.net.exe (PID: 8716)

    • Launching a file from a Registry key

      • filmyzilla.in.net.exe (PID: 4128)

    • Create files in a temporary directory

      • filmyzilla.in.net.exe (PID: 4128)

    • Reads the machine GUID from the registry

      • filmyzilla.in.net.exe (PID: 4128)
      • filmyzilla.in.net.exe (PID: 8716)
      • filmyzilla.in.net.exe (PID: 6472)

    • Creates files or folders in the user directory

      • filmyzilla.in.net.exe (PID: 4128)

    • Manual execution by a user

      • filmyzilla.in.net.exe (PID: 6472)

    • Reads Environment values

      • filmyzilla.in.net.exe (PID: 6472)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AsyncRat

(PID) Process(6472) filmyzilla.in.net.exe
C2 (1)filmyzilla.in.net
Ports (6)443
80
8080
4782
8888
8848
Version1.0.7
Options
AutoRuntrue
MutexBearUltra
InstallFolder%AppData%
Certificates
Cert1MIICMDCCAZmgAwIBAgIVAMCkoZTZNI3ZZ34cnBMGc/s4e6Y5MA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTI1MDUxMDA3NDI1MFoXDTM2MDIxNzA3NDI1MFowEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0A...
Server_SignatureTfdhlbQX/d3JqpkWfR+I0u5IcVBrjSJdsvR1/hHmy2rEg6pPRyqLdRbJLbddu2CnyMQJbWRLCiGxqFbtgUNhvqawqa150bbtKfL5p4sMjJBrFT/dWM8Ku6NRDFMOxJU7U3t4Pq8nj/N3rjXY050N6AvNwQxc7ogHGdH3pPur3lM=
Keys
AES02ff6ec91c7c64352e65e6de81bebfe517d3abf8201a9bd65bba30e436e3ac04
SaltDcRatByqwqdanchun
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:01:12 03:47:42+00:00
ImageFileCharacteristics: Executable
PEType: PE32
LinkerVersion: 8
CodeSize: 59904
InitializedDataSize: 4608
UninitializedDataSize: -
EntryPoint: 0x109be
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 145.0.3800.97
ProductVersionNumber: 145.0.3800.97
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: Microsoft Corporation
FileDescription: Microsoft Edge
FileVersion: 145.0.3800.97
InternalName: filmyzilla.in.net
LegalCopyright: Copyright Microsoft Corporation. All rights reserved.
LegalTrademarks: -
OriginalFileName: filmyzilla.in.net
ProductName: Microsoft Edge
ProductVersion: 145.0.3800.97
AssemblyVersion: 145.0.3800.97
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
7
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start filmyzilla.in.net.exe cmd.exe no specs conhost.exe no specs timeout.exe no specs #ASYNCRAT filmyzilla.in.net.exe filmyzilla.in.net.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
3944C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4128"C:\Users\admin\Desktop\filmyzilla.in.net.exe" C:\Users\admin\Desktop\filmyzilla.in.net.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
145.0.3800.97
Modules
Images
c:\users\admin\desktop\filmyzilla.in.net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4856timeout 3 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
6472"C:\Users\admin\AppData\Roaming\filmyzilla.in.net.exe"C:\Users\admin\AppData\Roaming\filmyzilla.in.net.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
145.0.3800.97
Modules
Images
c:\users\admin\appdata\roaming\filmyzilla.in.net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
AsyncRat
(PID) Process(6472) filmyzilla.in.net.exe
C2 (1)filmyzilla.in.net
Ports (6)443
80
8080
4782
8888
8848
Version1.0.7
Options
AutoRuntrue
MutexBearUltra
InstallFolder%AppData%
Certificates
Cert1MIICMDCCAZmgAwIBAgIVAMCkoZTZNI3ZZ34cnBMGc/s4e6Y5MA0GCSqGSIb3DQEBDQUAMGQxFTATBgNVBAMMDERjUmF0IFNlcnZlcjETMBEGA1UECwwKcXdxZGFuY2h1bjEcMBoGA1UECgwTRGNSYXQgQnkgcXdxZGFuY2h1bjELMAkGA1UEBwwCU0gxCzAJBgNVBAYTAkNOMB4XDTI1MDUxMDA3NDI1MFoXDTM2MDIxNzA3NDI1MFowEDEOMAwGA1UEAwwFRGNSYXQwgZ8wDQYJKoZIhvcNAQEBBQADgY0A...
Server_SignatureTfdhlbQX/d3JqpkWfR+I0u5IcVBrjSJdsvR1/hHmy2rEg6pPRyqLdRbJLbddu2CnyMQJbWRLCiGxqFbtgUNhvqawqa150bbtKfL5p4sMjJBrFT/dWM8Ku6NRDFMOxJU7U3t4Pq8nj/N3rjXY050N6AvNwQxc7ogHGdH3pPur3lM=
Keys
AES02ff6ec91c7c64352e65e6de81bebfe517d3abf8201a9bd65bba30e436e3ac04
SaltDcRatByqwqdanchun
7896\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
8412C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\tmp66B7.tmp.bat""C:\Windows\System32\cmd.exe—filmyzilla.in.net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
8716"C:\Users\admin\AppData\Roaming\filmyzilla.in.net.exe" C:\Users\admin\AppData\Roaming\filmyzilla.in.net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
145.0.3800.97
Modules
Images
c:\users\admin\appdata\roaming\filmyzilla.in.net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
4 452
Read events
4 451
Write events
1
Delete events
0

Modification events

(PID) Process:(4128) filmyzilla.in.net.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:filmyzilla.in.net
Value:
"C:\Users\admin\AppData\Roaming\filmyzilla.in.net.exe"
Executable files
1
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
4128filmyzilla.in.net.exeC:\Users\admin\AppData\Local\Temp\tmp66B7.tmp.battext
MD5:954C6BB88C51D4FF360BFC54BA8092CD
SHA256:4F114CBDADDBEB2B2EEA39D37F2AF278984F48D7C853400AAC699E0368D35D68
4128filmyzilla.in.net.exeC:\Users\admin\AppData\Roaming\filmyzilla.in.net.exeexecutable
MD5:F2E3209B3FA64AC9D630B8B2D7451205
SHA256:6458F0DDF0BF9DAA4E7D04AFBDB7204FE5DAB7A6A52C3854D6BC197F76D92D4B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
81
TCP/UDP connections
68
DNS requests
24
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
8756
RUXIMICS.exe
GET
304
20.73.194.208:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/RUXIM?os=Windows&osVer=10.0.19045.4046.amd64fre.vb_release.191206-1406&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&sampleId=s:95271487&appVer=10.0.19041.3623&OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&FlightRing=Retail&AttrDataVer=186&App=RUXIM&AppVer=&DeviceFamily=Windows.Desktop
US
—
—
whitelisted
6768
MoUsoCoreWorker.exe
GET
304
20.73.194.208:443
https://settings-win.data.microsoft.com/settings/v3.0/wsd/muse?ProcessorClockSpeed=3094&FlightIds=&UpdateOfferedDays=4294967295&BranchReadinessLevel=CB&OEMManufacturerName=DELL&IsCloudDomainJoined=0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&sku=48&ActivationChannel=Retail&AttrDataVer=186&IsMDMEnrolled=0&ProcessorCores=6&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&TotalPhysicalRAM=6144&PrimaryDiskType=4294967295&FlightingBranchName=&ChassisTypeId=1&OEMModelNumber=DELL&SystemVolumeTotalCapacity=260281&sampleId=95271487&deviceClass=Windows.Desktop&App=muse&DisableDualScan=0&AppVer=10.0&OEMSubModel=J5CR&locale=en-US&IsAlwaysOnAlwaysConnectedCapable=0&ms=0&DefaultUserRegion=244&UpdateServiceUrl=http%3A%2F%2Fneverupdatewindows10.com&osVer=10.0.19045.4046.amd64fre.vb_release.191206-1406&os=windows&deviceId=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&DeferQualityUpdatePeriodInDays=0&ring=Retail&DeferFeatureUpdatePeriodInDays=30
US
—
—
whitelisted
8756
RUXIMICS.exe
GET
200
2.16.164.51:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
2328
svchost.exe
GET
200
23.59.18.102:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
6768
MoUsoCoreWorker.exe
GET
200
2.16.164.51:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
—
—
POST
200
40.126.31.71:443
https://login.live.com/RST2.srf
US
xml
1.24 Kb
whitelisted
2328
svchost.exe
GET
200
20.73.194.208:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/WaasMedic?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&appVer=10.0.19041.3758&ring=Retail&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4
US
—
3.41 Kb
whitelisted
356
svchost.exe
POST
200
20.190.159.130:443
https://login.live.com/RST2.srf
US
xml
1.24 Kb
whitelisted
356
svchost.exe
POST
400
20.190.159.130:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
—
203 b
whitelisted
—
—
POST
400
20.190.160.130:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
binary
203 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
8756
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
6768
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2328
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
2328
svchost.exe
2.16.164.51:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
8756
RUXIMICS.exe
2.16.164.51:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
6768
MoUsoCoreWorker.exe
2.16.164.51:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
2328
svchost.exe
23.59.18.102:80
www.microsoft.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
self.events.data.microsoft.com
  • 20.52.64.200
  • 20.42.65.85
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
google.com
  • 172.217.22.46
whitelisted
crl.microsoft.com
  • 2.16.164.51
  • 2.16.164.120
  • 2.16.164.9
  • 2.16.164.43
  • 2.16.164.81
  • 2.16.164.18
  • 2.16.164.114
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 23.59.18.102
  • 88.221.169.152
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
  • 51.124.78.146
whitelisted
login.live.com
  • 20.190.159.130
  • 40.126.31.73
  • 20.190.159.0
  • 40.126.31.71
  • 20.190.159.2
  • 20.190.159.23
  • 40.126.31.128
  • 20.190.159.129
  • 20.190.160.65
  • 40.126.32.133
  • 40.126.32.72
  • 40.126.32.138
  • 20.190.160.128
  • 20.190.160.14
  • 40.126.32.68
  • 20.190.160.2
whitelisted
filmyzilla.in.net
  • 172.67.129.182
  • 104.21.2.214
unknown
slscr.update.microsoft.com
  • 74.178.76.128
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 135.233.95.135
whitelisted

Threats

PID
Process
Class
Message
2328
svchost.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
6472
filmyzilla.in.net.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Win32/Common RAT related JA3 hash observed
6472
filmyzilla.in.net.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Win32/Common RAT related JA3 hash observed
6472
filmyzilla.in.net.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Win32/Common RAT related JA3 hash observed
6472
filmyzilla.in.net.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Win32/Common RAT related JA3 hash observed
6472
filmyzilla.in.net.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Win32/Common RAT related JA3 hash observed
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
filmyzilla.in.net.exe