File name:

79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048

Full analysis: https://app.any.run/tasks/d824c3ed-126e-4a4f-9090-128c32d63e55
Verdict: Malicious activity
Threats:

Quasar is a very popular RAT in the world thanks to its code being available in open-source. This malware can be used to control the victim’s computer remotely.

Malware Trends Tracker     >>>
Analysis date: June 21, 2025, 21:42:52
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
pastebin
evasion
auto-sch
quasar
rat
auto-reg
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

4C0C4B5A9B3DE7C19110E8554434BA2F

SHA1:

7FCA5EFB90FD37D7AA29458B387973848E71A64B

SHA256:

79084DEED7117F5A96644F8153934BA25569A3B47269DAE656872588811E7048

SSDEEP:

12288:DDCMfrLpUtvNC5zb+Htw5tha2CaHjifgNjFf:Dktehu0jNj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • QUASAR mutex has been found

      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6684)
      • PdeSCD.exe (PID: 1480)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 2468)
      • PdeSCD.exe (PID: 7056)
      • PdeSCD.exe (PID: 4520)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 4100)

    • Uses Task Scheduler to run other applications

      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6684)
      • PdeSCD.exe (PID: 1480)

    • Changes the autorun value in the registry

      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6684)
      • PdeSCD.exe (PID: 1480)

    • QUASAR has been detected (YARA)

      • PdeSCD.exe (PID: 1480)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6684)

    • Starts itself from another location

      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6684)

    • Checks for external IP

      • PdeSCD.exe (PID: 1480)
      • svchost.exe (PID: 2200)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6684)

    • Connects to unusual port

      • PdeSCD.exe (PID: 1480)

    • There is functionality for taking screenshot (YARA)

      • PdeSCD.exe (PID: 1480)

  • INFO

    • Checks proxy server information

      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6684)
      • PdeSCD.exe (PID: 1480)
      • PdeSCD.exe (PID: 7056)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 2468)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 4100)
      • PdeSCD.exe (PID: 4520)
      • slui.exe (PID: 6292)

    • Reads the computer name

      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6684)
      • PdeSCD.exe (PID: 1480)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 2468)
      • PdeSCD.exe (PID: 4520)
      • PdeSCD.exe (PID: 7056)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 4100)

    • Create files in a temporary directory

      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6684)

    • Reads Environment values

      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6684)
      • PdeSCD.exe (PID: 1480)
      • PdeSCD.exe (PID: 7056)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 2468)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 4100)
      • PdeSCD.exe (PID: 4520)

    • Disables trace logs

      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6684)
      • PdeSCD.exe (PID: 1480)
      • PdeSCD.exe (PID: 7056)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 2468)
      • PdeSCD.exe (PID: 4520)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 4100)

    • Checks supported languages

      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6684)
      • PdeSCD.exe (PID: 1480)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 2468)
      • PdeSCD.exe (PID: 7056)
      • PdeSCD.exe (PID: 4520)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 4100)

    • Reads the software policy settings

      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6684)
      • PdeSCD.exe (PID: 1480)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 2468)
      • PdeSCD.exe (PID: 7056)
      • PdeSCD.exe (PID: 4520)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 4100)
      • slui.exe (PID: 6292)

    • Reads the machine GUID from the registry

      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6684)
      • PdeSCD.exe (PID: 1480)
      • PdeSCD.exe (PID: 7056)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 2468)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 4100)
      • PdeSCD.exe (PID: 4520)

    • Creates files or folders in the user directory

      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6684)
      • PdeSCD.exe (PID: 1480)

    • Launching a file from Task Scheduler

      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6684)
      • PdeSCD.exe (PID: 1480)

    • Launching a file from a Registry key

      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 6684)
      • PdeSCD.exe (PID: 1480)

    • Manual execution by a user

      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 2468)
      • PdeSCD.exe (PID: 7056)
      • PdeSCD.exe (PID: 4520)
      • 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe (PID: 4100)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:21 05:38:33+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 457216
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x71802
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.44.0.0
ProductVersionNumber: 3.44.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: -
FileVersion: 3.44.0.0
InternalName: Client.exe
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: Client.exe
ProductName: -
ProductVersion: 3.44.0.0
AssemblyVersion: 3.44.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
12
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #QUASAR 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe schtasks.exe no specs conhost.exe no specs #QUASAR pdescd.exe svchost.exe schtasks.exe no specs conhost.exe no specs #QUASAR 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe #QUASAR pdescd.exe #QUASAR pdescd.exe #QUASAR 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
1480"C:\Users\admin\AppData\Roaming\PdeSCD\PdeSCD.exe"C:\Users\admin\AppData\Roaming\PdeSCD\PdeSCD.exe
79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe
User:
admin
Integrity Level:
MEDIUM
Version:
3.44.0.0
Modules
Images
c:\users\admin\appdata\roaming\pdescd\pdescd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2200C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2468C:\Users\admin\AppData\Local\Temp\79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exeC:\Users\admin\AppData\Local\Temp\79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
3.44.0.0
Modules
Images
c:\users\admin\appdata\local\temp\79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3196"schtasks" /create /tn "ficeTelemetryAgentPdSCD" /SC MINUTE /MO 3 /tr "C:\Users\admin\AppData\Local\Temp\79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe" /fC:\Windows\System32\schtasks.exe—79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3964"schtasks" /create /tn "ficeTelemetryAgentPdSCD" /SC MINUTE /MO 3 /tr "C:\Users\admin\AppData\Roaming\PdeSCD\PdeSCD.exe" /fC:\Windows\System32\schtasks.exe—PdeSCD.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
4100"C:\Users\admin\AppData\Local\Temp\79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe"C:\Users\admin\AppData\Local\Temp\79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
3.44.0.0
Modules
Images
c:\users\admin\appdata\local\temp\79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4520C:\Users\admin\AppData\Roaming\PdeSCD\PdeSCD.exeC:\Users\admin\AppData\Roaming\PdeSCD\PdeSCD.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
3.44.0.0
Modules
Images
c:\users\admin\appdata\roaming\pdescd\pdescd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
4816\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6292C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6684"C:\Users\admin\AppData\Local\Temp\79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe" C:\Users\admin\AppData\Local\Temp\79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
3.44.0.0
Modules
Images
c:\users\admin\appdata\local\temp\79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
7 895
Read events
7 865
Write events
30
Delete events
0

Modification events

(PID) Process:(6684) 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6684) 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6684) 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6684) 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6684) 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6684) 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6684) 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6684) 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6684) 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6684) 79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
1
Suspicious files
1
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
1480PdeSCD.exeC:\Users\admin\AppData\Roaming\LetePdeSCD\06-21-2025binary
MD5:E946B106C60B3286EA4D1BF00B7A285F
SHA256:F34029430C5B8587512E1CCDDC7BD12F95A71D9C6644E806C590ECD67D4B975E
1480PdeSCD.exeC:\Users\admin\AppData\Roaming\PdeSCD\settings.xmltext
MD5:55C372F228926185ED763B43EB5E65D3
SHA256:1817210B60AF5C7B01CE4DB68A7539097FECA5AF7329D1CDC64B502FE3163CB0
668479084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exeC:\Users\admin\AppData\Roaming\PdeSCD\PdeSCD.exeexecutable
MD5:4C0C4B5A9B3DE7C19110E8554434BA2F
SHA256:79084DEED7117F5A96644F8153934BA25569A3B47269DAE656872588811E7048
668479084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exeC:\Users\admin\AppData\Local\Temp\settings.xmltext
MD5:55C372F228926185ED763B43EB5E65D3
SHA256:1817210B60AF5C7B01CE4DB68A7539097FECA5AF7329D1CDC64B502FE3163CB0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
39
DNS requests
20
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6684
79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
—
—
whitelisted
1480
PdeSCD.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
—
—
whitelisted
3588
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
184.25.50.8:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
7000
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7000
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6700
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6684
79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe
172.67.25.94:443
pastebin.com
CLOUDFLARENET
US
whitelisted
6684
79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted
1480
PdeSCD.exe
172.67.25.94:443
pastebin.com
CLOUDFLARENET
US
whitelisted
1480
PdeSCD.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted
1480
PdeSCD.exe
69.167.9.113:4443
perfect10.ddns.net
PARAD-40-ASN
US
malicious

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.46
whitelisted
pastebin.com
  • 172.67.25.94
  • 104.22.69.199
  • 104.22.68.199
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
perfect10.ddns.net
  • 69.167.9.113
malicious
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.17
  • 20.190.160.2
  • 20.190.160.5
  • 20.190.160.64
  • 20.190.160.131
  • 20.190.160.66
  • 20.190.160.67
  • 40.126.32.138
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 184.25.50.8
  • 184.25.50.10
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 2.23.246.101
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Online Pastebin Text Storage
2200
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
6684
79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
2200
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
6684
79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048.exe
A Network Trojan was detected
ET MALWARE Common RAT Connectivity Check Observed
1480
PdeSCD.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
1480
PdeSCD.exe
A Network Trojan was detected
ET MALWARE Common RAT Connectivity Check Observed
2200
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DNS Query to DynDNS Domain *.ddns .net
2200
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DNS Query to DynDNS Domain *.ddns .net
Process
Message
PdeSCD.exe
Client Fail - Exception Message: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 69.167.9.113:4443
PdeSCD.exe
Client Fail - Exception Message: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 69.167.9.113:4443
PdeSCD.exe
Client Fail - Exception Message: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 69.167.9.113:4443
PdeSCD.exe
Client Fail - Exception Message: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond 69.167.9.113:4443
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
79084deed7117f5a96644f8153934ba25569a3b47269dae656872588811e7048