File name:

Inzector_protected.exe.exe

Full analysis: https://app.any.run/tasks/56eb0db9-3855-4d6f-80be-4d64c57fc032
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: May 18, 2025, 13:13:35
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
asyncrat
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

1FD76187F54AA3C9BDBACAE53BFCB7FC

SHA1:

4358189C49771D93CEF9666AA59EEDD6220657BE

SHA256:

B7C504732AE1530C48D6A3EAB3CDC4DDAAFD90F5D7FC31D08F1609CEF755909E

SSDEEP:

98304:sMwNeO2cDd8eiiVhcA7dT6I7g21RSOUl6Zgvc2bqb/kZX3mwQLCbBBQssK1n2T5B:k7wSbl1sReCEcl8moFS

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ASYNCRAT has been detected (YARA)

      • CTF LOADER.EXE (PID: 1072)

    • Changes the autorun value in the registry

      • CTF LOADER.EXE (PID: 1072)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • Inzector_protected.exe.exe (PID: 5176)

    • Starts a Microsoft application from unusual location

      • CTF LOADER.EXE (PID: 6048)
      • CTF LOADER.EXE (PID: 1072)
      • CTF LOADER.EXE (PID: 5640)
      • CTF LOADER.EXE (PID: 5384)
      • CTF LOADER.EXE (PID: 632)

    • Reads security settings of Internet Explorer

      • Inzector_protected.exe.exe (PID: 5176)

    • Executable content was dropped or overwritten

      • Inzector_protected.exe.exe (PID: 5176)

    • Reads the BIOS version

      • INZECTOR_PROTECTED.EXE (PID: 4976)

    • Application launched itself

      • CTF LOADER.EXE (PID: 6048)
      • CTF LOADER.EXE (PID: 5640)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 2196)

    • Connects to unusual port

      • CTF LOADER.EXE (PID: 1072)

  • INFO

    • Checks supported languages

      • Inzector_protected.exe.exe (PID: 5176)
      • CTF LOADER.EXE (PID: 6048)
      • INZECTOR_PROTECTED.EXE (PID: 4976)
      • CTF LOADER.EXE (PID: 1072)
      • CTF LOADER.EXE (PID: 5640)
      • CTF LOADER.EXE (PID: 632)

    • Reads the computer name

      • Inzector_protected.exe.exe (PID: 5176)
      • CTF LOADER.EXE (PID: 6048)
      • INZECTOR_PROTECTED.EXE (PID: 4976)
      • CTF LOADER.EXE (PID: 1072)
      • CTF LOADER.EXE (PID: 5640)
      • CTF LOADER.EXE (PID: 632)

    • Create files in a temporary directory

      • Inzector_protected.exe.exe (PID: 5176)

    • Process checks computer location settings

      • Inzector_protected.exe.exe (PID: 5176)

    • Process checks whether UAC notifications are on

      • INZECTOR_PROTECTED.EXE (PID: 4976)

    • Reads the machine GUID from the registry

      • CTF LOADER.EXE (PID: 6048)
      • CTF LOADER.EXE (PID: 1072)
      • CTF LOADER.EXE (PID: 5640)
      • CTF LOADER.EXE (PID: 632)

    • Auto-launch of the file from Registry key

      • CTF LOADER.EXE (PID: 1072)

    • Manual execution by a user

      • CTF LOADER.EXE (PID: 5640)

    • Reads the software policy settings

      • slui.exe (PID: 3180)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AsyncRat

(PID) Process(1072) CTF LOADER.EXE
C2 (1)lassi681-33233.portmap.io
Ports (1)33233
Version0.5.8
BotnetDefault
Options
AutoRuntrue
MutexTo5CG4ceYXAn
InstallFolder%Temp%
BSoDtrue
AntiVMtrue
Certificates
Cert1MIIE4DCCAsigAwIBAgIQAIoFSbzIYCbqoJkH+xAhKTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZGdWNrIFUwIBcNMjUwNDI0MDg1MDIzWhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBkZ1Y2sgVTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAIXSZf/fCCw47fzFN+GUVaKdv1NHBlGa0o1u4Bd85wTc4eFgEeOOqL8Mt2MuY+FsMvxfQDKmqFkQzdbNwMNlR3g2ejzIgsDp/iJ1...
Server_SignatureVRRCjrxNiT15Z+cl7IpqSQwO3B+G/007lzSwcKP2/wXLJdzZ6bw4hWFMYM0t45NUgw2ye4DbM/TPoUYQbrmEMHjdwI5XqnJ1EeKPlRzzypFIPy/OPhpP5U85/3x6cHe/0fzf4Wv0MRiNRHS1JoxUHxQ1H9l+YBMqJ7YB7AQh0k2eMD5aJHfxU93SVh5FPiuKGpLEBltiWEe5zV9tDOdYgPaPH+y1CtN4vWpSor5RlFHSEkqZLIJIcRR9aXnd9jQqdMPf/EQ7XoXHfRfzPKbGAq7NNmX8hLhtKWGEI6F7/IV+...
Keys
AESd3b8cb8c5919f855c37f6a01ed9697dfb970fcaaa5a1eadd2fa04c0bb4c86dd9
Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2011:07:03 09:05:04+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 31232
InitializedDataSize: 9703936
UninitializedDataSize: -
EntryPoint: 0x3248
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
13
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start inzector_protected.exe.exe ctf loader.exe no specs inzector_protected.exe no specs inzector_protected.exe conhost.exe no specs sppextcomobj.exe no specs slui.exe #ASYNCRAT ctf loader.exe svchost.exe ctf loader.exe no specs ctf loader.exe no specs ctf loader.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
632"C:\Users\admin\AppData\Local\Temp\CTF Loader.exe"C:\Users\admin\AppData\Local\Temp\CTF LOADER.EXE—CTF LOADER.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Corporation
Exit code:
0
Version:
6.2.100.100
Modules
Images
c:\users\admin\appdata\local\temp\ctf loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
1072"C:\Users\admin\AppData\Local\Temp\CTF LOADER.EXE"C:\Users\admin\AppData\Local\Temp\CTF LOADER.EXE
CTF LOADER.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Corporation
Version:
6.2.100.100
Modules
Images
c:\users\admin\appdata\local\temp\ctf loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
AsyncRat
(PID) Process(1072) CTF LOADER.EXE
C2 (1)lassi681-33233.portmap.io
Ports (1)33233
Version0.5.8
BotnetDefault
Options
AutoRuntrue
MutexTo5CG4ceYXAn
InstallFolder%Temp%
BSoDtrue
AntiVMtrue
Certificates
Cert1MIIE4DCCAsigAwIBAgIQAIoFSbzIYCbqoJkH+xAhKTANBgkqhkiG9w0BAQ0FADARMQ8wDQYDVQQDDAZGdWNrIFUwIBcNMjUwNDI0MDg1MDIzWhgPOTk5OTEyMzEyMzU5NTlaMBExDzANBgNVBAMMBkZ1Y2sgVTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAIXSZf/fCCw47fzFN+GUVaKdv1NHBlGa0o1u4Bd85wTc4eFgEeOOqL8Mt2MuY+FsMvxfQDKmqFkQzdbNwMNlR3g2ejzIgsDp/iJ1...
Server_SignatureVRRCjrxNiT15Z+cl7IpqSQwO3B+G/007lzSwcKP2/wXLJdzZ6bw4hWFMYM0t45NUgw2ye4DbM/TPoUYQbrmEMHjdwI5XqnJ1EeKPlRzzypFIPy/OPhpP5U85/3x6cHe/0fzf4Wv0MRiNRHS1JoxUHxQ1H9l+YBMqJ7YB7AQh0k2eMD5aJHfxU93SVh5FPiuKGpLEBltiWEe5zV9tDOdYgPaPH+y1CtN4vWpSor5RlFHSEkqZLIJIcRR9aXnd9jQqdMPf/EQ7XoXHfRfzPKbGAq7NNmX8hLhtKWGEI6F7/IV+...
Keys
AESd3b8cb8c5919f855c37f6a01ed9697dfb970fcaaa5a1eadd2fa04c0bb4c86dd9
Saltbfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
1164\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—INZECTOR_PROTECTED.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3180"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3332"C:\Users\admin\AppData\Local\Temp\INZECTOR_PROTECTED.EXE" C:\Users\admin\AppData\Local\Temp\INZECTOR_PROTECTED.EXE—Inzector_protected.exe.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\inzector_protected.exe
c:\windows\system32\ntdll.dll
4188C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4976"C:\Users\admin\AppData\Local\Temp\INZECTOR_PROTECTED.EXE" C:\Users\admin\AppData\Local\Temp\INZECTOR_PROTECTED.EXE
Inzector_protected.exe.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\inzector_protected.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5176"C:\Users\admin\AppData\Local\Temp\Inzector_protected.exe.exe" C:\Users\admin\AppData\Local\Temp\Inzector_protected.exe.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\inzector_protected.exe.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
5384"C:\Users\admin\AppData\Local\Temp\CTF Loader.exe"C:\Users\admin\AppData\Local\Temp\CTF LOADER.EXE—CTF LOADER.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Corporation
Exit code:
4294967295
Version:
6.2.100.100
Modules
Images
c:\users\admin\appdata\local\temp\ctf loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
2 075
Read events
2 074
Write events
1
Delete events
0

Modification events

(PID) Process:(1072) CTF LOADER.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:CTF Loader
Value:
"C:\Users\admin\AppData\Local\Temp\CTF Loader.exe"
Executable files
2
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
5176Inzector_protected.exe.exeC:\Users\admin\AppData\Local\Temp\CTF LOADER.EXEexecutable
MD5:65B33F9A12D31757EA023DC57D39EE9C
SHA256:8661AAF041EA3018F52AF20B5B42A4BC743E30457232DC48D1925B6EFD5C59F7
5176Inzector_protected.exe.exeC:\Users\admin\AppData\Local\Temp\INZECTOR_PROTECTED.EXEexecutable
MD5:C3CAAD438EA635EB12E5FFA9592D114C
SHA256:0D0DE6028C6629E4A8A4FBFE0E0DA75AAEB77F5923E621CC280B3954240DAA04
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
85
DNS requests
16
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1300
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1300
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.19.11.120
  • 2.19.11.105
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 172.217.18.14
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.159.73
  • 20.190.159.75
  • 20.190.159.0
  • 20.190.159.4
  • 20.190.159.130
  • 40.126.31.67
  • 40.126.31.131
  • 20.190.159.2
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
lassi681-33233.portmap.io
  • 193.161.193.99
malicious

Threats

PID
Process
Class
Message
2196
svchost.exe
Potential Corporate Privacy Violation
ET INFO DNS Query to a Reverse Proxy Service Observed
2196
svchost.exe
Misc activity
ET INFO DNS Query for Port Mapping/Tunneling Service Domain (.portmap .io)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Inzector_protected.exe.exe