File name:

79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe

Full analysis: https://app.any.run/tasks/46c56856-8338-42cd-8d68-9c4608f835f2
Verdict: Malicious activity
Threats:

Quasar is a very popular RAT in the world thanks to its code being available in open-source. This malware can be used to control the victim’s computer remotely.

Malware Trends Tracker     >>>
Analysis date: June 21, 2025, 21:47:19
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
pastebin
evasion
quasar
rat
auto-sch
auto-reg
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

4C0C4B5A9B3DE7C19110E8554434BA2F

SHA1:

7FCA5EFB90FD37D7AA29458B387973848E71A64B

SHA256:

79084DEED7117F5A96644F8153934BA25569A3B47269DAE656872588811E7048

SSDEEP:

12288:DDCMfrLpUtvNC5zb+Htw5tha2CaHjifgNjFf:Dktehu0jNj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • QUASAR mutex has been found

      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6620)
      • PdeSCD.exe (PID: 3148)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 4412)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6344)
      • PdeSCD.exe (PID: 188)
      • PdeSCD.exe (PID: 1044)

    • Uses Task Scheduler to run other applications

      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6620)
      • PdeSCD.exe (PID: 3148)

    • Changes the autorun value in the registry

      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6620)
      • PdeSCD.exe (PID: 3148)

    • QUASAR has been detected (YARA)

      • PdeSCD.exe (PID: 3148)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6620)

    • Starts itself from another location

      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6620)

    • Checks for external IP

      • PdeSCD.exe (PID: 3148)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6620)
      • svchost.exe (PID: 2200)

    • Connects to unusual port

      • PdeSCD.exe (PID: 3148)

    • There is functionality for taking screenshot (YARA)

      • PdeSCD.exe (PID: 3148)

  • INFO

    • Reads Environment values

      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6620)
      • PdeSCD.exe (PID: 3148)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 4412)
      • PdeSCD.exe (PID: 188)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6344)
      • PdeSCD.exe (PID: 1044)

    • Disables trace logs

      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6620)
      • PdeSCD.exe (PID: 3148)
      • PdeSCD.exe (PID: 188)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 4412)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6344)
      • PdeSCD.exe (PID: 1044)

    • Reads the computer name

      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6620)
      • PdeSCD.exe (PID: 3148)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6344)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 4412)
      • PdeSCD.exe (PID: 188)
      • PdeSCD.exe (PID: 1044)

    • Checks proxy server information

      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6620)
      • PdeSCD.exe (PID: 3148)
      • PdeSCD.exe (PID: 188)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6344)
      • PdeSCD.exe (PID: 1044)
      • slui.exe (PID: 2552)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 4412)

    • Reads the machine GUID from the registry

      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6620)
      • PdeSCD.exe (PID: 3148)
      • PdeSCD.exe (PID: 188)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6344)
      • PdeSCD.exe (PID: 1044)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 4412)

    • Reads the software policy settings

      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6620)
      • PdeSCD.exe (PID: 3148)
      • PdeSCD.exe (PID: 188)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6344)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 4412)
      • PdeSCD.exe (PID: 1044)
      • slui.exe (PID: 2552)

    • Creates files or folders in the user directory

      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6620)
      • PdeSCD.exe (PID: 3148)

    • Checks supported languages

      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6620)
      • PdeSCD.exe (PID: 3148)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6344)
      • PdeSCD.exe (PID: 188)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 4412)
      • PdeSCD.exe (PID: 1044)

    • Launching a file from Task Scheduler

      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6620)
      • PdeSCD.exe (PID: 3148)

    • Launching a file from a Registry key

      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6620)
      • PdeSCD.exe (PID: 3148)

    • Manual execution by a user

      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6344)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 4412)
      • PdeSCD.exe (PID: 188)
      • PdeSCD.exe (PID: 1044)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:21 05:38:33+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 457216
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x71802
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.44.0.0
ProductVersionNumber: 3.44.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: -
FileVersion: 3.44.0.0
InternalName: Client.exe
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: Client.exe
ProductName: -
ProductVersion: 3.44.0.0
AssemblyVersion: 3.44.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
12
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #QUASAR 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe svchost.exe schtasks.exe no specs conhost.exe no specs #QUASAR pdescd.exe schtasks.exe no specs conhost.exe no specs #QUASAR 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe #QUASAR pdescd.exe #QUASAR 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe #QUASAR pdescd.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
188C:\Users\admin\AppData\Roaming\PdeSCD\PdeSCD.exeC:\Users\admin\AppData\Roaming\PdeSCD\PdeSCD.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
3.44.0.0
Modules
Images
c:\users\admin\appdata\roaming\pdescd\pdescd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
304\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
620"schtasks" /create /tn "ficeTelemetryAgentPdSCD" /SC MINUTE /MO 3 /tr "C:\Users\admin\AppData\Roaming\PdeSCD\PdeSCD.exe" /fC:\Windows\System32\schtasks.exe—PdeSCD.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1044"C:\Users\admin\AppData\Roaming\PdeSCD\PdeSCD.exe"C:\Users\admin\AppData\Roaming\PdeSCD\PdeSCD.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
3.44.0.0
Modules
Images
c:\users\admin\appdata\roaming\pdescd\pdescd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2200C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2552C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3148"C:\Users\admin\AppData\Roaming\PdeSCD\PdeSCD.exe"C:\Users\admin\AppData\Roaming\PdeSCD\PdeSCD.exe
79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe
User:
admin
Integrity Level:
MEDIUM
Version:
3.44.0.0
Modules
Images
c:\users\admin\appdata\roaming\pdescd\pdescd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4088"schtasks" /create /tn "ficeTelemetryAgentPdSCD" /SC MINUTE /MO 3 /tr "C:\Users\admin\Desktop\79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe" /fC:\Windows\System32\schtasks.exe—79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
4104\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4412"C:\Users\admin\Desktop\79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe"C:\Users\admin\Desktop\79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
3.44.0.0
Modules
Images
c:\users\admin\desktop\79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
28 366
Read events
28 336
Write events
30
Delete events
0

Modification events

(PID) Process:(6620) 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6620) 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6620) 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6620) 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6620) 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6620) 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6620) 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6620) 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6620) 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6620) 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
1
Suspicious files
1
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
662079084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exeC:\Users\admin\Desktop\settings.xmltext
MD5:55C372F228926185ED763B43EB5E65D3
SHA256:1817210B60AF5C7B01CE4DB68A7539097FECA5AF7329D1CDC64B502FE3163CB0
662079084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exeC:\Users\admin\AppData\Roaming\PdeSCD\PdeSCD.exeexecutable
MD5:4C0C4B5A9B3DE7C19110E8554434BA2F
SHA256:79084DEED7117F5A96644F8153934BA25569A3B47269DAE656872588811E7048
3148PdeSCD.exeC:\Users\admin\AppData\Roaming\PdeSCD\settings.xmltext
MD5:55C372F228926185ED763B43EB5E65D3
SHA256:1817210B60AF5C7B01CE4DB68A7539097FECA5AF7329D1CDC64B502FE3163CB0
3148PdeSCD.exeC:\Users\admin\AppData\Roaming\LetePdeSCD\06-21-2025binary
MD5:36D4C2D4839E43CF2363710937B2B4B6
SHA256:A11ABC3EECC6A9867D183A34810CC74E32A7C7024ADB1935BB9250D95EDCFCA7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
40
TCP/UDP connections
61
DNS requests
23
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
104.22.69.199:443
https://pastebin.com/raw/NAqDmMhy
unknown
text
377 b
whitelisted
1268
svchost.exe
GET
200
23.216.154.137:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4544
RUXIMICS.exe
GET
200
23.216.154.137:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.216.154.137:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6620
79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
104.121.237.231:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
104.121.237.231:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
104.22.68.199:443
https://pastebin.com/raw/NAqDmMhy
unknown
text
377 b
whitelisted
4544
RUXIMICS.exe
GET
200
104.121.237.231:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3148
PdeSCD.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4544
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6620
79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe
104.22.69.199:443
pastebin.com
CLOUDFLARENET
—
whitelisted
1268
svchost.exe
23.216.154.137:80
crl.microsoft.com
Akamai International B.V.
IE
whitelisted
5944
MoUsoCoreWorker.exe
23.216.154.137:80
crl.microsoft.com
Akamai International B.V.
IE
whitelisted
4544
RUXIMICS.exe
23.216.154.137:80
crl.microsoft.com
Akamai International B.V.
IE
whitelisted
6620
79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.206
whitelisted
pastebin.com
  • 104.22.69.199
  • 172.67.25.94
  • 104.22.68.199
whitelisted
crl.microsoft.com
  • 23.216.154.137
  • 23.216.154.128
  • 23.216.154.113
  • 23.216.154.138
  • 23.216.154.160
  • 23.216.154.147
  • 23.216.154.129
  • 23.216.154.154
  • 23.216.154.114
  • 184.25.50.10
  • 184.25.50.8
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
www.microsoft.com
  • 104.121.237.231
  • 95.101.149.131
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
login.live.com
  • 40.126.32.134
  • 20.190.160.17
  • 20.190.160.130
  • 40.126.32.138
  • 40.126.32.68
  • 20.190.160.67
  • 40.126.32.136
  • 20.190.160.131
whitelisted
client.wns.windows.com
  • 172.211.123.249
  • 172.211.123.248
whitelisted
perfect10.ddns.net
  • 69.167.9.113
malicious
nexusrules.officeapps.live.com
  • 52.111.227.14
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Online Pastebin Text Storage
2200
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2200
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
6620
79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
6620
79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe
A Network Trojan was detected
ET MALWARE Common RAT Connectivity Check Observed
3148
PdeSCD.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
3148
PdeSCD.exe
A Network Trojan was detected
ET MALWARE Common RAT Connectivity Check Observed
2200
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DNS Query to DynDNS Domain *.ddns .net
2200
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DNS Query to DynDNS Domain *.ddns .net
Process
Message
PdeSCD.exe
Client Fail - Exception Message: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 69.167.9.113:4443
PdeSCD.exe
Client Fail - Exception Message: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 69.167.9.113:4443
PdeSCD.exe
Client Fail - Exception Message: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 69.167.9.113:4443
PdeSCD.exe
Client Fail - Exception Message: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 69.167.9.113:4443
PdeSCD.exe
Client Fail - Exception Message: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 69.167.9.113:4443
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe