File name:

reversheshellb64batTO.exe

Full analysis: https://app.any.run/tasks/2b1c050d-93b3-42df-be5d-0aec4e4edfe4
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 15:51:41
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
susp-powershell
asyncrat
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

AF0BFBA234BA8BB26D7349EB5F1E797D

SHA1:

3C89EC9A23D996413D54B8159AC537E80DC1899C

SHA256:

A0FAB6212630B0FC19E33BC1E161AFF13AF5719D86A2D12016CCB38B4AEB6A2F

SSDEEP:

3072:ezvOp90TY6SA20EvIVBJmyxCqsKKiWbMJJk:45ljEwPWiWbyJk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds path to the Windows Defender exclusion list

      • powershell.exe (PID: 1088)

    • Changes Windows Defender settings

      • powershell.exe (PID: 1088)

    • ASYNCRAT has been detected (YARA)

      • RuntimeBroker.exe (PID: 8096)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • reversheshellb64batTO.exe (PID: 7832)
      • reversheshellb64batTO.exe (PID: 900)

    • Executing commands from a ".bat" file

      • reversheshellb64batTO.exe (PID: 7832)
      • reversheshellb64batTO.exe (PID: 900)

    • Starts CMD.EXE for commands execution

      • reversheshellb64batTO.exe (PID: 7832)
      • reversheshellb64batTO.exe (PID: 900)

    • Starts process via Powershell

      • powershell.exe (PID: 4776)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 7908)
      • cmd.exe (PID: 2392)
      • powershell.exe (PID: 1088)

    • BASE64 encoded PowerShell command has been detected

      • cmd.exe (PID: 2392)

    • Base64-obfuscated command line is found

      • cmd.exe (PID: 2392)

    • Uses REG/REGEDIT.EXE to modify registry

      • powershell.exe (PID: 7540)

    • Script adds exclusion path to Windows Defender

      • powershell.exe (PID: 1088)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 7516)

    • Application launched itself

      • powershell.exe (PID: 1088)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 2196)

    • Connects to unusual port

      • RuntimeBroker.exe (PID: 8096)

  • INFO

    • The sample compiled with english language support

      • reversheshellb64batTO.exe (PID: 7832)

    • Create files in a temporary directory

      • reversheshellb64batTO.exe (PID: 7832)
      • reversheshellb64batTO.exe (PID: 900)

    • Checks supported languages

      • reversheshellb64batTO.exe (PID: 7832)
      • reversheshellb64batTO.exe (PID: 900)
      • RuntimeBroker.exe (PID: 8096)

    • Process checks computer location settings

      • reversheshellb64batTO.exe (PID: 7832)
      • reversheshellb64batTO.exe (PID: 900)

    • Reads the computer name

      • reversheshellb64batTO.exe (PID: 7832)
      • reversheshellb64batTO.exe (PID: 900)
      • RuntimeBroker.exe (PID: 8096)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 960)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 960)

    • Found Base64 encoded network access via PowerShell (YARA)

      • reversheshellb64batTO.exe (PID: 900)

    • Found Base64 encoded access to Windows Defender via PowerShell (YARA)

      • reversheshellb64batTO.exe (PID: 900)

    • Disables trace logs

      • powershell.exe (PID: 7516)

    • The executable file from the user directory is run by the Powershell process

      • RuntimeBroker.exe (PID: 8096)

    • Reads the machine GUID from the registry

      • RuntimeBroker.exe (PID: 8096)

    • Reads the software policy settings

      • slui.exe (PID: 2140)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AsyncRat

(PID) Process(8096) RuntimeBroker.exe
C2 (1)dadfsfsdfasdfasddfgssdfaafsd-63495.portmap.host
Ports (1)63495
Version0.5.8
BotnetDefault
Options
AutoRuntrue
MutexH7TcbOjJNF1N
InstallFolder%Temp%
BSoDtrue
AntiVMtrue
Certificates
Cert1MIIFDjCCAvagAwIBAgIQAKSvRUgpg1whRXulCVZ+ezANBgkqhkiG9w0BAQ0FADAoMSYwJAYDVQQDDB1CTEFCTEFCTEEgQkxFQkxFQkxFIEJMSUJMSUJMSTAgFw0yNTAzMjIxNDUwNTBaGA85OTk5MTIzMTIzNTk1OVowKDEmMCQGA1UEAwwdQkxBQkxBQkxBIEJMRUJMRUJMRSBCTElCTElCTEkwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDNX33928JbUiyPOsjNO6SUl45KYud4IQ+vU+uE...
Server_SignaturesrA1lfBkS52sigLZs9H/+hgnZy2y8foWMEjlJyp79prbAGFZJDXQgViF1qmLu6GYxKfIRN79QmF41DYthrdtd0YKjgUTjS5VaukgaEp/Q4YRtQG4kXq3YdBf7zY9SOBM6AUmhs/UwT/kWc9VOSLGf1ez1Zu28kq+KTYsVt99btws1mTF/0czX1F6gA7vUND+SqArgQZaW5dINmVTO12dE8P0MFyc9AaoOLUmIJ+I0GCONlFApjZctG+CH1FE1pghuuSz5Jny+yBUKrhbN9VF7hYZTJ4Gj7RajVSUMgeendCA...
Keys
AES0622877b94b2bd625d17ee01b17623bc594441c32b6f2d804d3d5a3c4297bf89
Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (41)
.exe | Win64 Executable (generic) (36.3)
.dll | Win32 Dynamic Link Library (generic) (8.6)
.exe | Win32 Executable (generic) (5.9)
.exe | Win16/32 Executable Delphi generic (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:07:30 08:52:50+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 2.5
CodeSize: 68608
InitializedDataSize: 20992
UninitializedDataSize: -
EntryPoint: 0x1000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: Debug, Pre-release, Private build
FileOS: Windows 16-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
ProductVersion: Runtime Broker
PrivateBuild: 1.1.1.1
SpecialBuild: 1.1.1.1
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
18
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start reversheshellb64batto.exe cmd.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs reversheshellb64batto.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs reg.exe no specs powershell.exe svchost.exe #ASYNCRAT runtimebroker.exe slui.exe reversheshellb64batto.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
900"C:\Users\admin\Desktop\reversheshellb64batTO.exe" am_admin C:\Users\admin\Desktop\reversheshellb64batTO.exe—powershell.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\reversheshellb64batto.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\user32.dll
960"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -command "Add-MpPreference -ExclusionPath " C:\C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
1088powershell -enc cABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACAALQBjAG8AbQBtAGEAbgBkACAAIgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAIgBDADoAXAANAAoAC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
2140C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2392"C:\WINDOWS\sysnative\cmd.exe" /c "C:\Users\admin\AppData\Local\Temp\E159.tmp\E15A.tmp\E15B.bat C:\Users\admin\Desktop\reversheshellb64batTO.exe am_admin"C:\Windows\System32\cmd.exe—reversheshellb64batTO.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
4776powershell -Command "Start-Process -Verb RunAs -FilePath 'C:\Users\admin\Desktop\reversheshellb64batTO.exe' -ArgumentList 'am_admin'"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
5164powershell -w h -command ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7224\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7480"C:\WINDOWS\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\C:\Windows\System32\reg.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
Total events
34 785
Read events
34 784
Write events
1
Delete events
0

Modification events

(PID) Process:(7480) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths
Operation:writeName:C:\
Value:
Executable files
1
Suspicious files
1
Text files
16
Unknown types
0

Dropped files

PID
Process
Filename
Type
960powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ioppquid.kl1.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4776powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_xqykmlpq.dvo.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7540powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_q30ajhr3.0xc.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7968powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_d1g2ja5r.guk.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5164powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_lvi2ximl.xal.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7832reversheshellb64batTO.exeC:\Users\admin\AppData\Local\Temp\C9DA.tmp\C9DB.tmp\C9DC.battext
MD5:2998887E3CAB9B4FE6676D591ED0A0D2
SHA256:F19B1B5A346272B65F293EC9B8186F1B09B5E6C19C619BA7BF2074394F0CEFA8
4776powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_p2xhlnnh.eet.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7968powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_wkk2vx3r.zn1.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
900reversheshellb64batTO.exeC:\Users\admin\AppData\Local\Temp\E159.tmp\E15A.tmp\E15B.battext
MD5:2998887E3CAB9B4FE6676D591ED0A0D2
SHA256:F19B1B5A346272B65F293EC9B8186F1B09B5E6C19C619BA7BF2074394F0CEFA8
7516powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ckgd0fup.n5d.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
36
TCP/UDP connections
52
DNS requests
19
Threats
13

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
304
20.109.210.53:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
7700
SIHClient.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
7700
SIHClient.exe
GET
200
23.209.214.100:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
7700
SIHClient.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
—
—
GET
200
20.31.169.57:443
https://arc.msn.com/v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:AC7699B0-48EA-FD22-C8DC-06A02098A0F0&ctry=US&time=20250324T155156Z&lc=en-US&pl=en-US&idtp=mid&uid=9115d6d1-9f4e-4053-9297-2a8c833b3912&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=ff269b8c980c46cf926537c28daa7cde&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.3636&currsel=137271744000000000&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.4046&disphorzres=1280&dispsize=15.3&dispvertres=720&fosver=16299&isu=0&lo=3967671&metered=false&nettype=ethernet&npid=sc-88000045&oemName=DELL&oemid=DELL&ossku=Professional&prevosver=15063&smBiosDm=DELL&stabedgever=122.0.2365.59&tl=2&tsu=1358201&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=2
unknown
binary
2.95 Kb
whitelisted
—
—
GET
200
20.105.99.58:443
https://arc.msn.com/v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:AC7699B0-48EA-FD22-C8DC-06A02098A0F0&ctry=US&time=20250324T155156Z&lc=en-US&pl=en-US&idtp=mid&uid=9115d6d1-9f4e-4053-9297-2a8c833b3912&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=308a13f6f14d4608a48e74b7da35a28d&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.3636&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.4046&disphorzres=1280&dispsize=15.3&dispvertres=720&fosver=16299&isu=0&lo=3967671&metered=false&nettype=ethernet&npid=sc-310091&oemName=DELL&oemid=DELL&ossku=Professional&prevosver=15063&rver=2&smBiosDm=DELL&stabedgever=122.0.2365.59&tl=2&tsu=1358201&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=2
unknown
binary
1.31 Kb
whitelisted
—
—
POST
400
40.126.31.0:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
400
40.126.31.130:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
GET
301
104.17.112.233:443
https://tinyurl.com/giteaRUNTIME
unknown
html
510 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
6544
svchost.exe
40.126.32.136:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7668
backgroundTaskHost.exe
20.105.99.58:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7516
powershell.exe
104.17.112.233:443
tinyurl.com
CLOUDFLARENET
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.110
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
  • 2.19.11.105
  • 2.19.11.120
whitelisted
login.live.com
  • 40.126.32.136
  • 40.126.32.74
  • 20.190.160.3
  • 20.190.160.132
  • 20.190.160.22
  • 40.126.32.140
  • 40.126.32.133
  • 20.190.160.14
whitelisted
arc.msn.com
  • 20.105.99.58
whitelisted
tinyurl.com
  • 104.17.112.233
  • 104.18.111.161
whitelisted
gitea.com
  • 34.217.253.146
unknown
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
www.microsoft.com
  • 23.209.214.100
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] URL Shortener TinyURL (tinyurl .com)
2196
svchost.exe
Misc activity
INFO [ANY.RUN] Possible short link service (tinyurl .com)
2196
svchost.exe
Potentially Bad Traffic
ET INFO Self-Hosted Git Service Domain in DNS Lookup (gitea .com)
—
—
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
—
—
Potentially Bad Traffic
ET INFO Referrer-Policy set to unsafe-url
7516
powershell.exe
Potentially Bad Traffic
ET INFO Observed Self-Hosted Git Service Domain (gitea .com in TLS SNI)
—
—
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
—
—
Misc activity
ET INFO Request for EXE via Powershell
—
—
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
—
—
Misc activity
ET INFO EXE CheckRemoteDebuggerPresent (Used in Malware Anti-Debugging)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
reversheshellb64batTO.exe