File name:

64510EEC0795EFB825E99FE86ABE84C5.exe

Full analysis: https://app.any.run/tasks/e78745fb-287c-45d2-819a-bc209a26db57
Verdict: Malicious activity
Threats:

DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common.

Malware Trends Tracker     >>>
Analysis date: June 18, 2025, 13:03:16
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
auto-reg
miner
xmrig
auto-sch
rat
dcrat
remote
darkcrystal
netreactor
susp-powershell
wmi-base64
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

64510EEC0795EFB825E99FE86ABE84C5

SHA1:

1FD7B85B3923E120C3D03BD43376EC05FE79BD08

SHA256:

BF631D84ADB64C5976FFFFF2E1729671E50E61C2625173486F3BC3965896F739

SSDEEP:

6144:KWj+GbJ4DwY36Ao3vb7WqwGsLzlBUzpAvQylMkmraJi61z:KWjrbJ4JAhwGclSzWvQyakmuf1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Vulnerable driver has been detected

      • pered.exe (PID: 2716)

    • Changes the autorun value in the registry

      • pered.exe (PID: 2716)
      • msblocksvc.exe (PID: 5504)

    • XMRig has been detected

      • xmrig.exe (PID: 1336)

    • Connects to the CnC server

      • xmrig.exe (PID: 1336)
      • smss.exe (PID: 6212)

    • XMRIG has been detected (YARA)

      • xmrig.exe (PID: 1336)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 5876)

    • MINER has been detected (SURICATA)

      • xmrig.exe (PID: 1336)

    • DARKCRYSTAL has been detected (SURICATA)

      • smss.exe (PID: 6212)

    • DCRAT has been detected (YARA)

      • smss.exe (PID: 6212)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • 64510EEC0795EFB825E99FE86ABE84C5.exe (PID: 2952)
      • msblocksvc.exe (PID: 5504)

    • Executable content was dropped or overwritten

      • 64510EEC0795EFB825E99FE86ABE84C5.exe (PID: 2952)
      • peredd.exe (PID: 1496)
      • pered.exe (PID: 2716)
      • msblocksvc.exe (PID: 5504)
      • csc.exe (PID: 4836)
      • csc.exe (PID: 3148)
      • smss.exe (PID: 6212)

    • Reads security settings of Internet Explorer

      • peredd.exe (PID: 1496)
      • 64510EEC0795EFB825E99FE86ABE84C5.exe (PID: 2952)
      • msblocksvc.exe (PID: 5504)

    • Potential Corporate Privacy Violation

      • 64510EEC0795EFB825E99FE86ABE84C5.exe (PID: 2952)
      • xmrig.exe (PID: 1336)

    • Process requests binary or script from the Internet

      • 64510EEC0795EFB825E99FE86ABE84C5.exe (PID: 2952)

    • Connects to unusual port

      • 64510EEC0795EFB825E99FE86ABE84C5.exe (PID: 2952)
      • pered.exe (PID: 2716)
      • xmrig.exe (PID: 1336)

    • Drops a system driver (possible attempt to evade defenses)

      • pered.exe (PID: 2716)

    • Get information on the list of running processes

      • pered.exe (PID: 2716)
      • pered.exe (PID: 1128)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 5876)
      • msblocksvc.exe (PID: 5504)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 5876)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 5876)
      • msblocksvc.exe (PID: 5504)

    • Executed via WMI

      • schtasks.exe (PID: 2716)
      • schtasks.exe (PID: 4216)
      • schtasks.exe (PID: 3652)
      • schtasks.exe (PID: 5928)
      • schtasks.exe (PID: 3624)
      • schtasks.exe (PID: 5744)
      • schtasks.exe (PID: 1332)
      • schtasks.exe (PID: 3740)
      • schtasks.exe (PID: 316)
      • schtasks.exe (PID: 2536)
      • schtasks.exe (PID: 2620)
      • schtasks.exe (PID: 1136)
      • schtasks.exe (PID: 5424)
      • schtasks.exe (PID: 3620)
      • schtasks.exe (PID: 1668)

    • The process creates files with name similar to system file names

      • msblocksvc.exe (PID: 5504)

    • Process drops legitimate windows executable

      • msblocksvc.exe (PID: 5504)

    • Likely accesses (executes) a file from the Public directory

      • schtasks.exe (PID: 3652)
      • schtasks.exe (PID: 5424)
      • schtasks.exe (PID: 3624)
      • Idle.exe (PID: 5780)
      • Idle.exe (PID: 6220)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 5904)

    • Starts application with an unusual extension

      • cmd.exe (PID: 5904)

    • Connects to the server without a host name

      • smss.exe (PID: 6212)

  • INFO

    • Checks supported languages

      • 64510EEC0795EFB825E99FE86ABE84C5.exe (PID: 2952)
      • peredd.exe (PID: 1496)
      • pered.exe (PID: 2716)
      • pered.exe (PID: 1128)
      • xmrig.exe (PID: 1336)
      • csc.exe (PID: 4836)
      • cvtres.exe (PID: 3480)
      • csc.exe (PID: 3148)
      • cvtres.exe (PID: 2324)
      • msblocksvc.exe (PID: 5504)
      • chcp.com (PID: 7092)
      • smss.exe (PID: 6212)
      • Idle.exe (PID: 5780)
      • ctfmon.exe (PID: 864)
      • SearchApp.exe (PID: 4920)
      • smss.exe (PID: 6336)
      • ctfmon.exe (PID: 3460)
      • SystemSettings.exe (PID: 4752)
      • SystemSettings.exe (PID: 5168)
      • ctfmon.exe (PID: 7048)
      • SearchApp.exe (PID: 4216)
      • Idle.exe (PID: 6220)

    • Reads the computer name

      • 64510EEC0795EFB825E99FE86ABE84C5.exe (PID: 2952)
      • peredd.exe (PID: 1496)
      • xmrig.exe (PID: 1336)
      • msblocksvc.exe (PID: 5504)
      • Idle.exe (PID: 5780)
      • ctfmon.exe (PID: 864)
      • SearchApp.exe (PID: 4920)
      • ctfmon.exe (PID: 3460)
      • SystemSettings.exe (PID: 4752)
      • smss.exe (PID: 6336)
      • SystemSettings.exe (PID: 5168)
      • Idle.exe (PID: 6220)

    • Reads Environment values

      • 64510EEC0795EFB825E99FE86ABE84C5.exe (PID: 2952)
      • msblocksvc.exe (PID: 5504)
      • smss.exe (PID: 6212)
      • Idle.exe (PID: 5780)
      • ctfmon.exe (PID: 864)
      • SearchApp.exe (PID: 4920)
      • smss.exe (PID: 6336)
      • SystemSettings.exe (PID: 4752)
      • ctfmon.exe (PID: 3460)
      • ctfmon.exe (PID: 7048)
      • SearchApp.exe (PID: 4216)
      • Idle.exe (PID: 6220)

    • Disables trace logs

      • 64510EEC0795EFB825E99FE86ABE84C5.exe (PID: 2952)
      • smss.exe (PID: 6212)

    • Reads the machine GUID from the registry

      • 64510EEC0795EFB825E99FE86ABE84C5.exe (PID: 2952)
      • msblocksvc.exe (PID: 5504)
      • csc.exe (PID: 3148)
      • csc.exe (PID: 4836)
      • smss.exe (PID: 6212)
      • Idle.exe (PID: 5780)
      • ctfmon.exe (PID: 864)
      • SystemSettings.exe (PID: 4752)
      • smss.exe (PID: 6336)
      • ctfmon.exe (PID: 3460)
      • SearchApp.exe (PID: 4920)
      • ctfmon.exe (PID: 7048)
      • SearchApp.exe (PID: 4216)
      • Idle.exe (PID: 6220)

    • Create files in a temporary directory

      • 64510EEC0795EFB825E99FE86ABE84C5.exe (PID: 2952)
      • msblocksvc.exe (PID: 5504)
      • cvtres.exe (PID: 3480)
      • cvtres.exe (PID: 2324)
      • csc.exe (PID: 3148)

    • Checks proxy server information

      • 64510EEC0795EFB825E99FE86ABE84C5.exe (PID: 2952)
      • smss.exe (PID: 6212)

    • Process checks computer location settings

      • 64510EEC0795EFB825E99FE86ABE84C5.exe (PID: 2952)
      • peredd.exe (PID: 1496)
      • msblocksvc.exe (PID: 5504)

    • Drops encrypted VBS script (Microsoft Script Encoder)

      • peredd.exe (PID: 1496)

    • Creates files or folders in the user directory

      • pered.exe (PID: 2716)
      • csc.exe (PID: 4836)

    • The sample compiled with japanese language support

      • pered.exe (PID: 2716)

    • Launching a file from a Registry key

      • pered.exe (PID: 2716)
      • msblocksvc.exe (PID: 5504)

    • Drops encrypted JS script (Microsoft Script Encoder)

      • pered.exe (PID: 2716)
      • pered.exe (PID: 1128)

    • Manual execution by a user

      • pered.exe (PID: 1128)
      • Idle.exe (PID: 5780)
      • smss.exe (PID: 6212)
      • ctfmon.exe (PID: 864)
      • SearchApp.exe (PID: 4920)
      • smss.exe (PID: 6336)
      • ctfmon.exe (PID: 3460)
      • SystemSettings.exe (PID: 4752)
      • SystemSettings.exe (PID: 5168)
      • SearchApp.exe (PID: 4216)
      • Idle.exe (PID: 6220)

    • Failed to create an executable file in Windows directory

      • msblocksvc.exe (PID: 5504)

    • Creates files in the program directory

      • msblocksvc.exe (PID: 5504)

    • The sample compiled with english language support

      • msblocksvc.exe (PID: 5504)

    • Changes the display of characters in the console

      • cmd.exe (PID: 5904)

    • .NET Reactor protector has been detected

      • smss.exe (PID: 6212)

    • Found Base64 encoded access to Windows Defender via PowerShell (YARA)

      • smss.exe (PID: 6212)

    • Found Base64 encoded reference to WMI classes (YARA)

      • smss.exe (PID: 6212)

    • Reads the software policy settings

      • slui.exe (PID: 724)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

DcRat

(PID) Process(6212) smss.exe
C2 (1)http://91.92.46.53/providervideolineapigeneratordatalifeDlepublicCdntemporary
Options
Version5.0.4
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:06:14 14:12:35+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 356864
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x591be
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 0.0.0.0
InternalName: UdL8upewPakNw61ll3jB8TWhBAW1SeGR.exe
LegalCopyright:
OriginalFileName: UdL8upewPakNw61ll3jB8TWhBAW1SeGR.exe
ProductVersion: 0.0.0.0
AssemblyVersion: 0.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
187
Monitored processes
51
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 64510eec0795efb825e99fe86abe84c5.exe peredd.exe wscript.exe no specs THREAT pered.exe tasklist.exe no specs conhost.exe no specs #MINER xmrig.exe conhost.exe no specs pered.exe no specs tasklist.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs msblocksvc.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs csc.exe conhost.exe no specs cvtres.exe no specs csc.exe conhost.exe no specs cvtres.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs idle.exe no specs #DCRAT smss.exe ctfmon.exe no specs searchapp.exe no specs smss.exe no specs ctfmon.exe no specs systemsettings.exe no specs ctfmon.exe no specs searchapp.exe no specs slui.exe systemsettings.exe no specs idle.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
316schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\All Users\smss.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
724C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
864C:\webWin\ctfmon.exeC:\webWin\ctfmon.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
16.10.31418.88
Modules
Images
c:\webwin\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1052\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—tasklist.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1128C:\Users\admin\AppData\Local\Temp\pered.exeC:\Users\admin\AppData\Local\Temp\pered.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\pered.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\umpdc.dll
c:\windows\system32\ws2_32.dll
1136schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\webWin\SearchApp.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1332schtasks.exe /create /tn "SystemSettingsS" /sc MINUTE /mo 12 /tr "'C:\webWin\SystemSettings.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1336C:\Users\admin\AppData\Local\heguiherg\heguiherg\xmrig.exe --coin=XMR --url=xmr.kryptex.network:7777 --user=asdwqtgxi@ya.ru/ih5re08biz --cpu-max-threads-hint=20 --backgroundC:\Users\admin\AppData\Local\heguiherg\heguiherg\xmrig.exe
pered.exe
User:
admin
Company:
www.xmrig.com
Integrity Level:
MEDIUM
Description:
XMRig miner
Version:
6.22.3
Modules
Images
c:\users\admin\appdata\local\heguiherg\heguiherg\xmrig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1380\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—xmrig.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1496"C:\Users\admin\AppData\Local\Temp\peredd.exe" C:\Users\admin\AppData\Local\Temp\peredd.exe
64510EEC0795EFB825E99FE86ABE84C5.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\peredd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
Total events
7 915
Read events
7 878
Write events
37
Delete events
0

Modification events

(PID) Process:(2952) 64510EEC0795EFB825E99FE86ABE84C5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\64510EEC0795EFB825E99FE86ABE84C5_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2952) 64510EEC0795EFB825E99FE86ABE84C5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\64510EEC0795EFB825E99FE86ABE84C5_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(2952) 64510EEC0795EFB825E99FE86ABE84C5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\64510EEC0795EFB825E99FE86ABE84C5_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2952) 64510EEC0795EFB825E99FE86ABE84C5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\64510EEC0795EFB825E99FE86ABE84C5_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2952) 64510EEC0795EFB825E99FE86ABE84C5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\64510EEC0795EFB825E99FE86ABE84C5_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(2952) 64510EEC0795EFB825E99FE86ABE84C5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\64510EEC0795EFB825E99FE86ABE84C5_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2952) 64510EEC0795EFB825E99FE86ABE84C5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\64510EEC0795EFB825E99FE86ABE84C5_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2952) 64510EEC0795EFB825E99FE86ABE84C5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\64510EEC0795EFB825E99FE86ABE84C5_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2952) 64510EEC0795EFB825E99FE86ABE84C5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\64510EEC0795EFB825E99FE86ABE84C5_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(2952) 64510EEC0795EFB825E99FE86ABE84C5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\64510EEC0795EFB825E99FE86ABE84C5_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
18
Suspicious files
2
Text files
15
Unknown types
5

Dropped files

PID
Process
Filename
Type
1496peredd.exeC:\webWin\msblocksvc.exeexecutable
MD5:A13D83D538694F2D3D82FAB7AEBE944A
SHA256:7F64BC605EEBE122BDB3A58BEC834C93D92103B2B09D825CCF73CFC931B82C51
2716pered.exeC:\Users\admin\AppData\Local\heguiherg\heguiherg\xmrig.exeexecutable
MD5:5FB59EFD14651E2D750A817B7FCFA690
SHA256:71AA7D419B24BFCE6AD7D5ED9F293ABB373274C9EF4168A53C42CD289D926C2A
2716pered.exeC:\Users\admin\AppData\Local\heguiherg\heguiherg\WinRing0x64.sysexecutable
MD5:0C0195C48B6B8582FA6F6373032118DA
SHA256:11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
2716pered.exeC:\Users\admin\AppData\Local\heguiherg\heguiherg\publish.zipcompressed
MD5:D91880A460AADE24A567ACECCFD80566
SHA256:6190716645F35EDF00E1BDB9F9EC214C5E22873C22B317E1BB13061A2173F0F8
5504msblocksvc.exeC:\Users\Public\Downloads\6ccacd8608530ftext
MD5:5A36584A7E19E826495964089554359B
SHA256:FC4C60EE362D24D5B197EB3343A34999035957FB1FF319D55261E5F92BC47104
2716pered.exeC:\Users\admin\AppData\Local\heguiherg\heguiherg\config.jsonbinary
MD5:4D0A3C7B1D91B72C63EA5F8D4BC90FC1
SHA256:D707A022E8C7873DA268FDB5F0E98699A557244B82860BAA93284D23089268B4
1496peredd.exeC:\webWin\eyIIChjWheJURJMR2WxJsRsE54cyAZbzuy9wGhN0yDrGskYysZStx0Ko6.battext
MD5:433530BBCB8998E42884C76AADA8A37B
SHA256:8DBB9776915B3F108A926874DC9EACC81F86E9835512B5361CF257E927EC0E49
2716pered.exeC:\Users\admin\AppData\Local\heguiherg\heguiherg\key.txttext
MD5:F9FA7ADE4BCA93DD039F5477590FBDA6
SHA256:3E67DA15BEB5FE776E5FF4EEADBC26BBA3336130072B7C2155D2733C882EB5D8
5504msblocksvc.exeC:\Users\admin\Desktop\xaMbWIyp.logexecutable
MD5:D8BF2A0481C0A17A634D066A711C12E9
SHA256:2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
5504msblocksvc.exeC:\webWin\ctfmon.exeexecutable
MD5:A13D83D538694F2D3D82FAB7AEBE944A
SHA256:7F64BC605EEBE122BDB3A58BEC834C93D92103B2B09D825CCF73CFC931B82C51
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
88
TCP/UDP connections
32
DNS requests
16
Threats
18

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2952
64510EEC0795EFB825E99FE86ABE84C5.exe
GET
200
91.92.46.53:8085
http://91.92.46.53:8085/peredd.exe
unknown
—
—
malicious
2716
pered.exe
GET
—
91.92.46.53:8083
http://91.92.46.53:8083/publish.zip
unknown
—
—
malicious
2952
64510EEC0795EFB825E99FE86ABE84C5.exe
GET
—
91.92.46.53:8084
http://91.92.46.53:8084/pered.exe
unknown
—
—
malicious
3676
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2632
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2632
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6212
smss.exe
POST
200
91.92.46.53:80
http://91.92.46.53/providervideolineapigeneratordatalifeDlepublicCdntemporary.php
unknown
—
—
malicious
6212
smss.exe
POST
200
91.92.46.53:80
http://91.92.46.53/providervideolineapigeneratordatalifeDlepublicCdntemporary.php
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2324
RUXIMICS.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2952
64510EEC0795EFB825E99FE86ABE84C5.exe
91.92.46.53:8085
—
SPRINTLINK
US
malicious
2952
64510EEC0795EFB825E99FE86ABE84C5.exe
91.92.46.53:8084
—
SPRINTLINK
US
malicious
2716
pered.exe
91.92.46.53:8083
—
SPRINTLINK
US
malicious
3676
svchost.exe
40.126.31.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3676
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
login.live.com
  • 40.126.31.73
  • 40.126.31.130
  • 40.126.31.1
  • 40.126.31.131
  • 40.126.31.69
  • 40.126.31.3
  • 40.126.31.0
  • 20.190.159.4
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
xmr.kryptex.network
  • 157.90.32.66
unknown
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.13
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

PID
Process
Class
Message
2952
64510EEC0795EFB825E99FE86ABE84C5.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 14
2952
64510EEC0795EFB825E99FE86ABE84C5.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
2952
64510EEC0795EFB825E99FE86ABE84C5.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
2952
64510EEC0795EFB825E99FE86ABE84C5.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2952
64510EEC0795EFB825E99FE86ABE84C5.exe
Misc activity
ET INFO EXE - Served Attached HTTP
2952
64510EEC0795EFB825E99FE86ABE84C5.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
2952
64510EEC0795EFB825E99FE86ABE84C5.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
2952
64510EEC0795EFB825E99FE86ABE84C5.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2952
64510EEC0795EFB825E99FE86ABE84C5.exe
Misc activity
ET INFO EXE - Served Attached HTTP
2952
64510EEC0795EFB825E99FE86ABE84C5.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
64510EEC0795EFB825E99FE86ABE84C5.exe