File name:

Hackus.exe

Full analysis: https://app.any.run/tasks/5dfc3e57-746f-4589-8010-1c158613a4f7
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: August 16, 2024, 21:59:37
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
asyncrat
rat
remote
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

1998FE239AB28012BE9514A004852D99

SHA1:

11FDC989F6BF8EC3BA72280DD6882F787258F7AA

SHA256:

83547C253DFB4A352D2FDFAB37F1F5C88CBD1EC6905F9885322E1DF4D15B1DE6

SSDEEP:

98304:9+7Z4hZJHMBH5BEMifWA/GIZzdSKX2lE0iM9pGzFlk90zk57mUaDigZgBU5uEFie:wLJA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ASYNCRAT has been detected (MUTEX)

      • svchost.exe (PID: 6520)

    • ASYNCRAT has been detected (YARA)

      • svchost.exe (PID: 6520)

    • Steals credentials from Web Browsers

      • svchost.exe (PID: 6520)

    • Create files in the Startup directory

      • ifyppl.exe (PID: 1488)

    • Actions looks like stealing of personal data

      • svchost.exe (PID: 6520)

    • ASYNCRAT has been detected (SURICATA)

      • svchost.exe (PID: 6520)

  • SUSPICIOUS

    • Reads the BIOS version

      • Hackus.exe (PID: 6464)

    • Process drops legitimate windows executable

      • Hackus.exe (PID: 6464)

    • Drops the executable file immediately after the start

      • Hackus.exe (PID: 6464)
      • svchost.exe (PID: 6520)
      • ifyppl.exe (PID: 1488)

    • Reads security settings of Internet Explorer

      • Hackus.exe (PID: 6464)
      • svchost.exe (PID: 6520)

    • Executable content was dropped or overwritten

      • Hackus.exe (PID: 6464)
      • svchost.exe (PID: 6520)
      • ifyppl.exe (PID: 1488)

    • The process creates files with name similar to system file names

      • Hackus.exe (PID: 6464)

    • Reads the date of Windows installation

      • Hackus.exe (PID: 6464)
      • svchost.exe (PID: 6520)

    • Executes application which crashes

      • Hackus .exe (PID: 6544)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 6520)

    • Connects to unusual port

      • svchost.exe (PID: 6520)

    • Executing commands from a ".bat" file

      • svchost.exe (PID: 6520)

    • Starts CMD.EXE for commands execution

      • svchost.exe (PID: 6520)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 6572)

  • INFO

    • Checks supported languages

      • Hackus.exe (PID: 6464)
      • svchost.exe (PID: 6520)
      • Hackus .exe (PID: 6544)
      • ifyppl.exe (PID: 1488)

    • Reads the computer name

      • Hackus.exe (PID: 6464)
      • svchost.exe (PID: 6520)
      • Hackus .exe (PID: 6544)
      • ifyppl.exe (PID: 1488)

    • Reads the machine GUID from the registry

      • Hackus.exe (PID: 6464)
      • svchost.exe (PID: 6520)
      • Hackus .exe (PID: 6544)

    • Creates files or folders in the user directory

      • Hackus.exe (PID: 6464)
      • WerFault.exe (PID: 6716)
      • ifyppl.exe (PID: 1488)

    • Process checks computer location settings

      • Hackus.exe (PID: 6464)
      • svchost.exe (PID: 6520)

    • Reads the software policy settings

      • WerFault.exe (PID: 6716)
      • svchost.exe (PID: 6520)

    • Reads Environment values

      • svchost.exe (PID: 6520)

    • Disables trace logs

      • svchost.exe (PID: 6520)

    • Create files in a temporary directory

      • Hackus.exe (PID: 6464)
      • svchost.exe (PID: 6520)

    • Checks proxy server information

      • WerFault.exe (PID: 6716)
      • svchost.exe (PID: 6520)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AsyncRat

(PID) Process(6520) svchost.exe
C2 (1)null
Ports (1)null
VersionAWS | 3Losh
Options
AutoRuntrue
MutexAsyncMutex_xGhost
InstallFolder%AppData%
Certificates
Cert1MIIE8jCCAtqgAwIBAgIQAPeWQ4YJ3MvReCGwLzn7rTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjIwNDI1MDA0MTA5WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKT9nYYTjYTZhY+g1tekZ8/F29gsEIDgf/8odvCbCmYKGGZZi2yND9NjtBXEMANM9PAXCyMapGva...
Server_SignatureWeczCffijE+KUrsgFlCmNiIgpnAjPfx7Sl3lWo2w2SCnweNTzy1zW4DMW+wLJv8CrBcM+BOoK8TMGagvaxgdPttQ3P67YKQm/0jZQfyWeentTCtqD/UjC1QclFvZkDKLp6G1Ucc2FTKEEBT5Caeo69F2BxjE7J5qgtsF5GmaSYaq1o4vhgRSLr2JPRDpAQdBpbe1VeNmrWt29LzP7/ayjCv6exxpb4389P9lxxkQIedJwmsijL7xpByOG1hWEeAga1uPvh94HKa43vZHFCwTLLD7Bmkdzg23cv1/nA5ADCkq...
Keys
AES47fa5d4a8394a9412b11370feb34149bcb9bc9929616ad10e505c58c6fc799b0
Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:05:15 00:59:56+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 1946112
InitializedDataSize: 307200
UninitializedDataSize: -
EntryPoint: 0x7c0108
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription: HMC 2.0
FileVersion: 1.0.0.0
InternalName: XBinderOutput.exe
LegalCopyright: Copyright © 2022
OriginalFileName: XBinderOutput.exe
ProductName: Hackus Mail Checker
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
138
Monitored processes
9
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start hackus.exe #ASYNCRAT svchost.exe hackus .exe werfault.exe svchost.exe ifyppl.exe cmd.exe no specs conhost.exe no specs timeout.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1488"C:\Users\admin\AppData\Local\Temp\ifyppl.exe" C:\Users\admin\AppData\Local\Temp\ifyppl.exe
svchost.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Google
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\ifyppl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2256C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
5052\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6464"C:\Users\admin\AppData\Local\Temp\Hackus.exe" C:\Users\admin\AppData\Local\Temp\Hackus.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
HMC 2.0
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\hackus.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\mscoree.dll
6520"C:\Users\admin\AppData\Roaming\svchost.exe" C:\Users\admin\AppData\Roaming\svchost.exe
Hackus.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Processus hôte pour les services Windows
Exit code:
0
Version:
6.2.19041.3636
Modules
Images
c:\users\admin\appdata\roaming\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
AsyncRat
(PID) Process(6520) svchost.exe
C2 (1)null
Ports (1)null
VersionAWS | 3Losh
Options
AutoRuntrue
MutexAsyncMutex_xGhost
InstallFolder%AppData%
Certificates
Cert1MIIE8jCCAtqgAwIBAgIQAPeWQ4YJ3MvReCGwLzn7rTANBgkqhkiG9w0BAQ0FADAaMRgwFgYDVQQDDA9Bc3luY1JBVCBTZXJ2ZXIwIBcNMjIwNDI1MDA0MTA5WhgPOTk5OTEyMzEyMzU5NTlaMBoxGDAWBgNVBAMMD0FzeW5jUkFUIFNlcnZlcjCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKT9nYYTjYTZhY+g1tekZ8/F29gsEIDgf/8odvCbCmYKGGZZi2yND9NjtBXEMANM9PAXCyMapGva...
Server_SignatureWeczCffijE+KUrsgFlCmNiIgpnAjPfx7Sl3lWo2w2SCnweNTzy1zW4DMW+wLJv8CrBcM+BOoK8TMGagvaxgdPttQ3P67YKQm/0jZQfyWeentTCtqD/UjC1QclFvZkDKLp6G1Ucc2FTKEEBT5Caeo69F2BxjE7J5qgtsF5GmaSYaq1o4vhgRSLr2JPRDpAQdBpbe1VeNmrWt29LzP7/ayjCv6exxpb4389P9lxxkQIedJwmsijL7xpByOG1hWEeAga1uPvh94HKa43vZHFCwTLLD7Bmkdzg23cv1/nA5ADCkq...
Keys
AES47fa5d4a8394a9412b11370feb34149bcb9bc9929616ad10e505c58c6fc799b0
Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
6544"C:\Users\admin\AppData\Local\Temp\Hackus .exe" C:\Users\admin\AppData\Local\Temp\Hackus .exe
Hackus.exe
User:
admin
Integrity Level:
MEDIUM
Description:
HMC 2.0
Exit code:
3762504530
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\hackus .exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6572C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\tmp239C.tmp.bat""C:\Windows\SysWOW64\cmd.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6716C:\WINDOWS\system32\WerFault.exe -u -p 6544 -s 824C:\Windows\System32\WerFault.exe
Hackus .exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
6836timeout 3 C:\Windows\SysWOW64\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
16 108
Read events
16 070
Write events
36
Delete events
2

Modification events

(PID) Process:(6464) Hackus.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6464) Hackus.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6464) Hackus.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6464) Hackus.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6464) Hackus.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(6520) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6520) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\svchost_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6520) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\svchost_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6520) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\svchost_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6520) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\svchost_RASAPI32
Operation:writeName:FileTracingMask
Value:
Executable files
4
Suspicious files
3
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
6716WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_Hackus .exe_61281ffaf9ed863d5c0bfdc97cbef1cf9145da_964c9d34_28a6b00a-eae0-428d-a747-7b24a376a7dd\Report.wer —
MD5:—
SHA256:—
6716WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\Hackus .exe.6544.dmp —
MD5:—
SHA256:—
6716WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER6ACD.tmp.xmlxml
MD5:86B589ED54DCC0F2CD3F5D04BFCAE744
SHA256:6CA9B2C69858BE8CF1609C9185A56E01EC0284A4B34D00DB34A0A67C8F10F445
6464Hackus.exeC:\Users\admin\AppData\Roaming\svchost.exeexecutable
MD5:BEF2A9E896A294424B518230BF249DD7
SHA256:EE36D61358DC3FBBBB52CCC625671C0215D6866BED336ADDC8F992920A72DBB2
6716WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER6A8E.tmp.WERInternalMetadata.xmlxml
MD5:C3F2A39075CA51418124F8DD3DA6CDF4
SHA256:8FE791D5BFEB031D752CC1576F75C1CD6DA5DA3FAE225F174B8790FF84366AFA
6464Hackus.exeC:\Users\admin\AppData\Local\Temp\Hackus .exeexecutable
MD5:B98582A96F3D102A3D45E7ED1111268B
SHA256:FB5518B93F5A75C4DDB033A5A1E8189D2E8177C863C8B86C0ADBB2DE90A928A3
6716WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:FB64A9EBEDF48D3895381D5B7D80743D
SHA256:EA21D495930AD76F267A33A0F593DBF0C7EA75E457FCAE49A29DAAD8BD920F42
6716WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER69B2.tmp.dmpdmp
MD5:2855728F59B6CC0CDF876EA685179E1B
SHA256:424CAF112D45BC8E12A4C79A67167CD3A5E39386B6395DE378D853400649BD7F
6520svchost.exeC:\Users\admin\AppData\Local\Temp\ifyppl.exeexecutable
MD5:D62F6BD7E602E89877D6FF04D303CB9F
SHA256:8DC2D56943E5AF5F844CEF7A18028045C31C6506393CF3740E8E8F8E3A5A8043
6716WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:82C30E45BF5F93A5DB1D5E47F913053B
SHA256:2C6BBFF9207065E8800C4AF0CB2748818ABB3CFFC0D6D518FE17F76A232F8967
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
50
DNS requests
18
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4436
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
4436
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
7120
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
US
binary
471 b
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
US
binary
312 b
whitelisted
5088
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
US
binary
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
5112
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2680
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6716
WerFault.exe
52.182.143.212:443
watson.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
6520
svchost.exe
104.20.3.235:443
pastebin.com
CLOUDFLARENET
—
unknown
6520
svchost.exe
41.251.15.251:67
peakypinkers.ddns.net
MT-MPLS
MA
unknown
5336
SearchApp.exe
2.23.209.189:443
www.bing.com
Akamai International B.V.
GB
unknown
5336
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.78
whitelisted
watson.events.data.microsoft.com
  • 52.182.143.212
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
  • 51.124.78.146
whitelisted
pastebin.com
  • 104.20.3.235
  • 104.20.4.235
  • 172.67.19.24
shared
peakypinkers.ddns.net
  • 41.251.15.251
malicious
www.bing.com
  • 2.23.209.189
  • 2.23.209.149
  • 2.23.209.130
  • 2.23.209.140
  • 2.23.209.135
  • 2.23.209.182
  • 2.23.209.185
  • 2.23.209.150
  • 2.23.209.158
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.31.69
  • 20.190.159.64
  • 20.190.159.71
  • 20.190.159.73
  • 20.190.159.68
  • 20.190.159.4
  • 20.190.159.23
  • 40.126.31.71
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
th.bing.com
  • 2.23.209.177
  • 2.23.209.130
  • 2.23.209.133
  • 2.23.209.185
  • 2.23.209.176
  • 2.23.209.140
  • 2.23.209.182
  • 2.23.209.189
  • 2.23.209.193
whitelisted

Threats

PID
Process
Class
Message
2256
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
6520
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Generic AsyncRAT Style SSL Cert
6520
svchost.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Malicious SSL Cert (AsyncRAT Server)
5 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Hackus.exe