File name:

(大学校门的清纯美女被男友玩弄下体，粉嫩而且湿哒哒的。竟然是个白虎，完整视频_MP4).exe

Full analysis: https://app.any.run/tasks/1c70431b-7543-44aa-aff2-6723d368f315
Verdict: Malicious activity
Threats:

Gh0st RAT is a malware with advanced trojan functionality that enables attackers to establish full control over the victim’s system. The spying capabilities of Gh0st RAT made it a go-to tool for numerous criminal groups in high-profile attacks against government and corporate organizations. The most common vector of attack involving this malware begins with spam and phishing emails.

Malware Trends Tracker     >>>
Analysis date: March 15, 2025, 03:08:53
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
opendir
arch-exec
arch-doc
remote
rat
gh0st
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

0BC35438A436C6CC1E69C43F8A276E08

SHA1:

ACAAA2F39A5DEB7E9B78A9E28F9702E1D355D9E3

SHA256:

A4D6D4C90D5E120323A4686C8A521D83123016F6952D6AF78FAC0A45822777FB

SSDEEP:

12288:y+U5fL2PX55B2VbWGhyZKdJyzGFCwA/qT4:y+U5fKPX55B2VbWGhx6GFCxqT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GH0ST has been detected (SURICATA)

      • 6F9619FF.exe (PID: 6248)

  • SUSPICIOUS

    • The process drops C-runtime libraries

      • 1c70431b-7543-44aa-aff2-6723d368f315.exe (PID: 6724)

    • Reads security settings of Internet Explorer

      • 1c70431b-7543-44aa-aff2-6723d368f315.exe (PID: 6724)

    • Likely accesses (executes) a file from the Public directory

      • 6F9619FF.exe (PID: 6248)
      • 6F9619FF.exe (PID: 3240)

    • Executes application which crashes

      • 1c70431b-7543-44aa-aff2-6723d368f315.exe (PID: 6724)

    • Contacting a server suspected of hosting an CnC

      • 6F9619FF.exe (PID: 6248)

    • Connects to unusual port

      • 6F9619FF.exe (PID: 6248)

    • Executable content was dropped or overwritten

      • 1c70431b-7543-44aa-aff2-6723d368f315.exe (PID: 6724)

    • Process drops legitimate windows executable

      • 1c70431b-7543-44aa-aff2-6723d368f315.exe (PID: 6724)

  • INFO

    • Checks supported languages

      • 1c70431b-7543-44aa-aff2-6723d368f315.exe (PID: 6724)
      • 6F9619FF.exe (PID: 6248)

    • The sample compiled with chinese language support

      • 1c70431b-7543-44aa-aff2-6723d368f315.exe (PID: 6724)

    • The sample compiled with english language support

      • 1c70431b-7543-44aa-aff2-6723d368f315.exe (PID: 6724)

    • Process checks computer location settings

      • 1c70431b-7543-44aa-aff2-6723d368f315.exe (PID: 6724)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 1328)

    • Reads the computer name

      • 1c70431b-7543-44aa-aff2-6723d368f315.exe (PID: 6724)
      • 6F9619FF.exe (PID: 6248)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 1348)
      • BackgroundTransferHost.exe (PID: 1328)
      • BackgroundTransferHost.exe (PID: 6080)
      • notepad.exe (PID: 3124)
      • notepad.exe (PID: 1600)
      • notepad.exe (PID: 6044)
      • notepad.exe (PID: 5512)
      • notepad.exe (PID: 4572)
      • notepad.exe (PID: 5864)
      • BackgroundTransferHost.exe (PID: 5552)
      • BackgroundTransferHost.exe (PID: 6372)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 1328)
      • WerFault.exe (PID: 6584)
      • WerFault.exe (PID: 2240)

    • Reads the machine GUID from the registry

      • 6F9619FF.exe (PID: 6248)

    • Manual execution by a user

      • 6F9619FF.exe (PID: 1012)
      • 6F9619FF.exe (PID: 1616)
      • notepad.exe (PID: 3124)
      • notepad.exe (PID: 1600)
      • notepad.exe (PID: 5864)
      • notepad.exe (PID: 5512)
      • notepad.exe (PID: 4572)
      • OpenWith.exe (PID: 2140)
      • notepad.exe (PID: 6044)

    • Reads CPU info

      • 6F9619FF.exe (PID: 6248)

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 2140)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 1328)
      • slui.exe (PID: 6972)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (35.8)
.exe | Win64 Executable (generic) (31.7)
.scr | Windows screen saver (15)
.dll | Win32 Dynamic Link Library (generic) (7.5)
.exe | Win32 Executable (generic) (5.1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:03:12 12:48:07+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 286720
InitializedDataSize: 81920
UninitializedDataSize: -
EntryPoint: 0xebd4
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.16.4
ProductVersionNumber: 1.0.16.4
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: ASCII
Comments: 此安装程序由 Inno Setup 构建。
CompanyName: www.moage.com
FileDescription: 平板刷机王
FileVersion: 1.0.16.4
LegalCopyright: 版权所有 © 2012 www.moage.com
ProductName: 平板刷机王
ProductVersion: 1.0.16.4
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
161
Monitored processes
22
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 1c70431b-7543-44aa-aff2-6723d368f315.exe sppextcomobj.exe no specs slui.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs slui.exe no specs 6f9619ff.exe no specs #GH0ST 6f9619ff.exe werfault.exe no specs werfault.exe no specs 6f9619ff.exe no specs 6f9619ff.exe notepad.exe no specs notepad.exe no specs notepad.exe no specs notepad.exe no specs notepad.exe no specs notepad.exe no specs openwith.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1012"C:\Users\admin\Desktop\6F9619FF.exe" C:\Users\admin\Desktop\6F9619FF.exe
explorer.exe
User:
admin
Company:
巧课教育科技(深圳)有限公司
Integrity Level:
HIGH
Description:
巧课客户端
Version:
2.0.0.0
Modules
Images
c:\users\admin\desktop\6f9619ff.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1328"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
1348"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
1600"C:\WINDOWS\system32\NOTEPAD.EXE" "C:\Users\admin\Desktop\mysql connector.txt"C:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
1616"C:\Users\admin\Desktop\6F9619FF.exe" C:\Users\admin\Desktop\6F9619FF.exe—explorer.exe
User:
admin
Company:
巧课教育科技(深圳)有限公司
Integrity Level:
MEDIUM
Description:
巧课客户端
Exit code:
3221226540
Version:
2.0.0.0
Modules
Images
c:\users\admin\desktop\6f9619ff.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2140"C:\WINDOWS\System32\OpenWith.exe" C:\Users\admin\Desktop\task.datC:\Windows\System32\OpenWith.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
2147943623
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2240C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6724 -s 1412C:\Windows\SysWOW64\WerFault.exe—1c70431b-7543-44aa-aff2-6723d368f315.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
3124"C:\WINDOWS\system32\NOTEPAD.EXE" "C:\Users\admin\Desktop\directui license.txt"C:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
3240"C:\Users\Public\00C04FC964FF\6F9619FF.exe" C:\Users\Public\00C04FC964FF\6F9619FF.exe—1c70431b-7543-44aa-aff2-6723d368f315.exe
User:
admin
Company:
巧课教育科技(深圳)有限公司
Integrity Level:
MEDIUM
Description:
巧课客户端
Exit code:
3221226540
Version:
2.0.0.0
Modules
Images
c:\users\public\00c04fc964ff\6f9619ff.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4572"C:\WINDOWS\system32\NOTEPAD.EXE" "C:\Users\admin\Desktop\opencv license.txt"C:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
Total events
7 843
Read events
7 828
Write events
15
Delete events
0

Modification events

(PID) Process:(1348) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1348) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1348) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1328) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1328) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1328) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6080) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6080) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6080) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5552) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
45
Suspicious files
13
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
1328BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\81596368-018e-4a12-9d32-aee3cec7ce7f.down_data —
MD5:—
SHA256:—
67241c70431b-7543-44aa-aff2-6723d368f315.exeC:\Users\Public\ykhhdg.dat —
MD5:—
SHA256:—
1328BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:31B6B0A0AB7826FAB6E179D01CA4EDC7
SHA256:FC3311F12DE01AB6E5074D70A8A20838971187819403982625A4FE89FF643223
67241c70431b-7543-44aa-aff2-6723d368f315.exeC:\Users\Public\ky5stj.datcompressed
MD5:50188E3787EFA8BE08912B467CC01226
SHA256:1701D35636A126439A9E0A261DC3A3D9793635319E0F6A8BD467B3CAEB5EC45E
67241c70431b-7543-44aa-aff2-6723d368f315.exeC:\Users\Public\00C04FC964FF\api-ms-win-core-file-l1-2-0.dllexecutable
MD5:79EE4A2FCBE24E9A65106DE834CCDA4A
SHA256:9F7BDA59FAAFC8A455F98397A63A7F7D114EFC4E8A41808C791256EBF33C7613
1328BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:B215F2A815D78927A5C3FE4ED61B0491
SHA256:BD0A7453E7B6803784393EA71F0360F5168E9A82B22D6617B4F55C4AAA9F79FC
67241c70431b-7543-44aa-aff2-6723d368f315.exeC:\Users\Public\00C04FC964FF\alibabacloud-oss-cpp-sdk.dllexecutable
MD5:0AAEB781E651BE69F6D643A72B15C6CB
SHA256:E9359D5C42B6767D63525AE73EB194A88C3E68111CEE4EC1A2BDBB8ECF530BB9
67241c70431b-7543-44aa-aff2-6723d368f315.exeC:\Users\Public\00C04FC964FF\api-ms-win-core-synch-l1-2-0.dllexecutable
MD5:6E704280D632C2F8F2CADEFCAE25AD85
SHA256:758A2F9EF6908B51745DB50D89610FE1DE921D93B2DBEA919BFDBA813D5D8893
67241c70431b-7543-44aa-aff2-6723d368f315.exeC:\Users\Public\00C04FC964FF\api-ms-win-crt-heap-l1-1-0.dllexecutable
MD5:1776A2B85378B27825CF5E5A3A132D9A
SHA256:675B1B82DD485CC8C8A099272DB9241D0D2A7F45424901F35231B79186EC47EE
67241c70431b-7543-44aa-aff2-6723d368f315.exeC:\Users\Public\00C04FC964FF\api-ms-win-crt-filesystem-l1-1-0.dllexecutable
MD5:228C6BBE1BCE84315E4927392A3BAEE5
SHA256:AC0CEC8644340125507DD0BC9A90B1853A2D194EB60A049237FB5E752D349065
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
30
DNS requests
21
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6724
1c70431b-7543-44aa-aff2-6723d368f315.exe
GET
200
27.124.34.85:80
http://download.linuxroot.site/download/2825.dat
unknown
—
—
unknown
—
—
GET
200
23.216.77.18:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1324
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5988
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5988
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1328
BackgroundTransferHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.18:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6724
1c70431b-7543-44aa-aff2-6723d368f315.exe
27.124.34.85:80
download.linuxroot.site
BGPNET Global ASN
SG
unknown
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.216.77.18
  • 23.216.77.30
  • 23.216.77.19
whitelisted
google.com
  • 142.250.186.142
whitelisted
download.linuxroot.site
  • 27.124.34.85
unknown
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 20.190.160.131
  • 20.190.160.5
  • 20.190.160.128
  • 20.190.160.130
  • 40.126.32.134
  • 40.126.32.136
  • 20.190.160.3
  • 20.190.160.4
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
www.bing.com
  • 104.126.37.145
  • 104.126.37.131
  • 104.126.37.139
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted

Threats

PID
Process
Class
Message
6248
6F9619FF.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Gh0stRAT TCP Packet
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
(大学校门的清纯美女被男友玩弄下体，粉嫩而且湿哒哒的。竟然是个白虎，完整视频_MP4).exe