File name:

64510EEC0795EFB825E99FE86ABE84C5.exe

Full analysis: https://app.any.run/tasks/e78745fb-287c-45d2-819a-bc209a26db57
Verdict: Malicious activity
Threats:

DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common.

Malware Trends Tracker     >>>
Analysis date: June 18, 2025, 13:03:16
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
auto-reg
miner
xmrig
auto-sch
rat
dcrat
remote
darkcrystal
netreactor
susp-powershell
wmi-base64
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

64510EEC0795EFB825E99FE86ABE84C5

SHA1:

1FD7B85B3923E120C3D03BD43376EC05FE79BD08

SHA256:

BF631D84ADB64C5976FFFFF2E1729671E50E61C2625173486F3BC3965896F739

SSDEEP:

6144:KWj+GbJ4DwY36Ao3vb7WqwGsLzlBUzpAvQylMkmraJi61z:KWjrbJ4JAhwGclSzWvQyakmuf1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Vulnerable driver has been detected

      • pered.exe (PID: 2716)

    • Changes the autorun value in the registry

      • pered.exe (PID: 2716)
      • msblocksvc.exe (PID: 5504)

    • MINER has been detected (SURICATA)

      • xmrig.exe (PID: 1336)

    • Connects to the CnC server

      • xmrig.exe (PID: 1336)
      • smss.exe (PID: 6212)

    • XMRig has been detected

      • xmrig.exe (PID: 1336)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 5876)

    • XMRIG has been detected (YARA)

      • xmrig.exe (PID: 1336)

    • DARKCRYSTAL has been detected (SURICATA)

      • smss.exe (PID: 6212)

    • DCRAT has been detected (YARA)

      • smss.exe (PID: 6212)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • peredd.exe (PID: 1496)
      • 64510EEC0795EFB825E99FE86ABE84C5.exe (PID: 2952)
      • msblocksvc.exe (PID: 5504)

    • Executable content was dropped or overwritten

      • 64510EEC0795EFB825E99FE86ABE84C5.exe (PID: 2952)
      • peredd.exe (PID: 1496)
      • pered.exe (PID: 2716)
      • msblocksvc.exe (PID: 5504)
      • csc.exe (PID: 4836)
      • csc.exe (PID: 3148)
      • smss.exe (PID: 6212)

    • Potential Corporate Privacy Violation

      • 64510EEC0795EFB825E99FE86ABE84C5.exe (PID: 2952)
      • xmrig.exe (PID: 1336)

    • Process requests binary or script from the Internet

      • 64510EEC0795EFB825E99FE86ABE84C5.exe (PID: 2952)

    • Reads the date of Windows installation

      • 64510EEC0795EFB825E99FE86ABE84C5.exe (PID: 2952)
      • msblocksvc.exe (PID: 5504)

    • Connects to unusual port

      • 64510EEC0795EFB825E99FE86ABE84C5.exe (PID: 2952)
      • pered.exe (PID: 2716)
      • xmrig.exe (PID: 1336)

    • Drops a system driver (possible attempt to evade defenses)

      • pered.exe (PID: 2716)

    • Get information on the list of running processes

      • pered.exe (PID: 1128)
      • pered.exe (PID: 2716)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 5876)
      • msblocksvc.exe (PID: 5504)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 5876)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 5876)
      • msblocksvc.exe (PID: 5504)

    • The process creates files with name similar to system file names

      • msblocksvc.exe (PID: 5504)

    • Executed via WMI

      • schtasks.exe (PID: 4216)
      • schtasks.exe (PID: 5928)
      • schtasks.exe (PID: 2716)
      • schtasks.exe (PID: 3652)
      • schtasks.exe (PID: 5744)
      • schtasks.exe (PID: 3624)
      • schtasks.exe (PID: 1332)
      • schtasks.exe (PID: 3620)
      • schtasks.exe (PID: 3740)
      • schtasks.exe (PID: 316)
      • schtasks.exe (PID: 2536)
      • schtasks.exe (PID: 1668)
      • schtasks.exe (PID: 2620)
      • schtasks.exe (PID: 1136)
      • schtasks.exe (PID: 5424)

    • Process drops legitimate windows executable

      • msblocksvc.exe (PID: 5504)

    • Likely accesses (executes) a file from the Public directory

      • schtasks.exe (PID: 3652)
      • schtasks.exe (PID: 3624)
      • schtasks.exe (PID: 5424)
      • Idle.exe (PID: 5780)
      • Idle.exe (PID: 6220)

    • Starts application with an unusual extension

      • cmd.exe (PID: 5904)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 5904)

    • Connects to the server without a host name

      • smss.exe (PID: 6212)

  • INFO

    • Reads Environment values

      • 64510EEC0795EFB825E99FE86ABE84C5.exe (PID: 2952)
      • msblocksvc.exe (PID: 5504)
      • smss.exe (PID: 6212)
      • Idle.exe (PID: 5780)
      • SearchApp.exe (PID: 4920)
      • ctfmon.exe (PID: 3460)
      • ctfmon.exe (PID: 864)
      • smss.exe (PID: 6336)
      • SystemSettings.exe (PID: 4752)
      • ctfmon.exe (PID: 7048)
      • SearchApp.exe (PID: 4216)
      • Idle.exe (PID: 6220)

    • Checks supported languages

      • 64510EEC0795EFB825E99FE86ABE84C5.exe (PID: 2952)
      • peredd.exe (PID: 1496)
      • xmrig.exe (PID: 1336)
      • pered.exe (PID: 1128)
      • pered.exe (PID: 2716)
      • csc.exe (PID: 4836)
      • cvtres.exe (PID: 3480)
      • csc.exe (PID: 3148)
      • cvtres.exe (PID: 2324)
      • msblocksvc.exe (PID: 5504)
      • chcp.com (PID: 7092)
      • Idle.exe (PID: 5780)
      • smss.exe (PID: 6212)
      • ctfmon.exe (PID: 864)
      • SearchApp.exe (PID: 4920)
      • SystemSettings.exe (PID: 4752)
      • smss.exe (PID: 6336)
      • ctfmon.exe (PID: 3460)
      • ctfmon.exe (PID: 7048)
      • SearchApp.exe (PID: 4216)
      • Idle.exe (PID: 6220)
      • SystemSettings.exe (PID: 5168)

    • Reads the computer name

      • 64510EEC0795EFB825E99FE86ABE84C5.exe (PID: 2952)
      • peredd.exe (PID: 1496)
      • xmrig.exe (PID: 1336)
      • msblocksvc.exe (PID: 5504)
      • Idle.exe (PID: 5780)
      • ctfmon.exe (PID: 864)
      • ctfmon.exe (PID: 3460)
      • SearchApp.exe (PID: 4920)
      • smss.exe (PID: 6336)
      • SystemSettings.exe (PID: 4752)
      • SystemSettings.exe (PID: 5168)
      • Idle.exe (PID: 6220)

    • Checks proxy server information

      • 64510EEC0795EFB825E99FE86ABE84C5.exe (PID: 2952)
      • smss.exe (PID: 6212)

    • Process checks computer location settings

      • 64510EEC0795EFB825E99FE86ABE84C5.exe (PID: 2952)
      • peredd.exe (PID: 1496)
      • msblocksvc.exe (PID: 5504)

    • Reads the machine GUID from the registry

      • 64510EEC0795EFB825E99FE86ABE84C5.exe (PID: 2952)
      • msblocksvc.exe (PID: 5504)
      • csc.exe (PID: 4836)
      • csc.exe (PID: 3148)
      • Idle.exe (PID: 5780)
      • smss.exe (PID: 6212)
      • SearchApp.exe (PID: 4920)
      • ctfmon.exe (PID: 3460)
      • smss.exe (PID: 6336)
      • ctfmon.exe (PID: 864)
      • ctfmon.exe (PID: 7048)
      • SearchApp.exe (PID: 4216)
      • SystemSettings.exe (PID: 4752)
      • Idle.exe (PID: 6220)

    • Drops encrypted VBS script (Microsoft Script Encoder)

      • peredd.exe (PID: 1496)

    • Create files in a temporary directory

      • 64510EEC0795EFB825E99FE86ABE84C5.exe (PID: 2952)
      • msblocksvc.exe (PID: 5504)
      • cvtres.exe (PID: 3480)
      • cvtres.exe (PID: 2324)
      • csc.exe (PID: 3148)

    • Disables trace logs

      • 64510EEC0795EFB825E99FE86ABE84C5.exe (PID: 2952)
      • smss.exe (PID: 6212)

    • Creates files or folders in the user directory

      • pered.exe (PID: 2716)
      • csc.exe (PID: 4836)

    • Drops encrypted JS script (Microsoft Script Encoder)

      • pered.exe (PID: 1128)
      • pered.exe (PID: 2716)

    • The sample compiled with japanese language support

      • pered.exe (PID: 2716)

    • Creates files in the program directory

      • msblocksvc.exe (PID: 5504)

    • Launching a file from a Registry key

      • pered.exe (PID: 2716)
      • msblocksvc.exe (PID: 5504)

    • Manual execution by a user

      • pered.exe (PID: 1128)
      • Idle.exe (PID: 5780)
      • ctfmon.exe (PID: 864)
      • SearchApp.exe (PID: 4920)
      • smss.exe (PID: 6212)
      • smss.exe (PID: 6336)
      • SystemSettings.exe (PID: 4752)
      • ctfmon.exe (PID: 3460)
      • SearchApp.exe (PID: 4216)
      • SystemSettings.exe (PID: 5168)
      • Idle.exe (PID: 6220)

    • Failed to create an executable file in Windows directory

      • msblocksvc.exe (PID: 5504)

    • The sample compiled with english language support

      • msblocksvc.exe (PID: 5504)

    • Changes the display of characters in the console

      • cmd.exe (PID: 5904)

    • .NET Reactor protector has been detected

      • smss.exe (PID: 6212)

    • Reads the software policy settings

      • slui.exe (PID: 724)

    • Found Base64 encoded access to Windows Defender via PowerShell (YARA)

      • smss.exe (PID: 6212)

    • Found Base64 encoded reference to WMI classes (YARA)

      • smss.exe (PID: 6212)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

DcRat

(PID) Process(6212) smss.exe
C2 (1)http://91.92.46.53/providervideolineapigeneratordatalifeDlepublicCdntemporary
Options
Version5.0.4
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:06:14 14:12:35+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 356864
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x591be
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 0.0.0.0
InternalName: UdL8upewPakNw61ll3jB8TWhBAW1SeGR.exe
LegalCopyright:
OriginalFileName: UdL8upewPakNw61ll3jB8TWhBAW1SeGR.exe
ProductVersion: 0.0.0.0
AssemblyVersion: 0.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
187
Monitored processes
51
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 64510eec0795efb825e99fe86abe84c5.exe peredd.exe wscript.exe no specs THREAT pered.exe tasklist.exe no specs conhost.exe no specs #MINER xmrig.exe conhost.exe no specs pered.exe no specs tasklist.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs msblocksvc.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs csc.exe conhost.exe no specs cvtres.exe no specs csc.exe conhost.exe no specs cvtres.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs idle.exe no specs #DCRAT smss.exe ctfmon.exe no specs searchapp.exe no specs smss.exe no specs ctfmon.exe no specs systemsettings.exe no specs ctfmon.exe no specs searchapp.exe no specs slui.exe systemsettings.exe no specs idle.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
316schtasks.exe /create /tn "smss" /sc ONLOGON /tr "'C:\Users\All Users\smss.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
724C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
864C:\webWin\ctfmon.exeC:\webWin\ctfmon.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
16.10.31418.88
Modules
Images
c:\webwin\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1052\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—tasklist.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1128C:\Users\admin\AppData\Local\Temp\pered.exeC:\Users\admin\AppData\Local\Temp\pered.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\pered.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\umpdc.dll
c:\windows\system32\ws2_32.dll
1136schtasks.exe /create /tn "SearchAppS" /sc MINUTE /mo 10 /tr "'C:\webWin\SearchApp.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1332schtasks.exe /create /tn "SystemSettingsS" /sc MINUTE /mo 12 /tr "'C:\webWin\SystemSettings.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1336C:\Users\admin\AppData\Local\heguiherg\heguiherg\xmrig.exe --coin=XMR --url=xmr.kryptex.network:7777 --user=asdwqtgxi@ya.ru/ih5re08biz --cpu-max-threads-hint=20 --backgroundC:\Users\admin\AppData\Local\heguiherg\heguiherg\xmrig.exe
pered.exe
User:
admin
Company:
www.xmrig.com
Integrity Level:
MEDIUM
Description:
XMRig miner
Version:
6.22.3
Modules
Images
c:\users\admin\appdata\local\heguiherg\heguiherg\xmrig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1380\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—xmrig.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1496"C:\Users\admin\AppData\Local\Temp\peredd.exe" C:\Users\admin\AppData\Local\Temp\peredd.exe
64510EEC0795EFB825E99FE86ABE84C5.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\peredd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
Total events
7 915
Read events
7 878
Write events
37
Delete events
0

Modification events

(PID) Process:(2952) 64510EEC0795EFB825E99FE86ABE84C5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\64510EEC0795EFB825E99FE86ABE84C5_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2952) 64510EEC0795EFB825E99FE86ABE84C5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\64510EEC0795EFB825E99FE86ABE84C5_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(2952) 64510EEC0795EFB825E99FE86ABE84C5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\64510EEC0795EFB825E99FE86ABE84C5_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2952) 64510EEC0795EFB825E99FE86ABE84C5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\64510EEC0795EFB825E99FE86ABE84C5_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2952) 64510EEC0795EFB825E99FE86ABE84C5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\64510EEC0795EFB825E99FE86ABE84C5_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(2952) 64510EEC0795EFB825E99FE86ABE84C5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\64510EEC0795EFB825E99FE86ABE84C5_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2952) 64510EEC0795EFB825E99FE86ABE84C5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\64510EEC0795EFB825E99FE86ABE84C5_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2952) 64510EEC0795EFB825E99FE86ABE84C5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\64510EEC0795EFB825E99FE86ABE84C5_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2952) 64510EEC0795EFB825E99FE86ABE84C5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\64510EEC0795EFB825E99FE86ABE84C5_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(2952) 64510EEC0795EFB825E99FE86ABE84C5.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\64510EEC0795EFB825E99FE86ABE84C5_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
18
Suspicious files
2
Text files
15
Unknown types
5

Dropped files

PID
Process
Filename
Type
5504msblocksvc.exeC:\Users\admin\Desktop\xaMbWIyp.logexecutable
MD5:D8BF2A0481C0A17A634D066A711C12E9
SHA256:2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
1496peredd.exeC:\webWin\eyIIChjWheJURJMR2WxJsRsE54cyAZbzuy9wGhN0yDrGskYysZStx0Ko6.battext
MD5:433530BBCB8998E42884C76AADA8A37B
SHA256:8DBB9776915B3F108A926874DC9EACC81F86E9835512B5361CF257E927EC0E49
2716pered.exeC:\Users\admin\AppData\Local\heguiherg\heguiherg\xmrig.exeexecutable
MD5:5FB59EFD14651E2D750A817B7FCFA690
SHA256:71AA7D419B24BFCE6AD7D5ED9F293ABB373274C9EF4168A53C42CD289D926C2A
5504msblocksvc.exeC:\Users\admin\Desktop\kBCUfjsO.logexecutable
MD5:5420053AF2D273C456FB46C2CDD68F64
SHA256:A4DFD8B1735598699A410538B8B2ACE6C9A68631D2A26FBF8089D6537DBB30F2
5504msblocksvc.exeC:\webWin\ctfmon.exeexecutable
MD5:A13D83D538694F2D3D82FAB7AEBE944A
SHA256:7F64BC605EEBE122BDB3A58BEC834C93D92103B2B09D825CCF73CFC931B82C51
5504msblocksvc.exeC:\webWin\26c12092da979ctext
MD5:BB3673DA25A1CD8C1ED5DD125F3CE185
SHA256:DB2A22180A227074F34BE0218D195E28DC79F774B2996642C7855DDDC9B0F1DA
5504msblocksvc.exeC:\webWin\SystemSettings.exeexecutable
MD5:A13D83D538694F2D3D82FAB7AEBE944A
SHA256:7F64BC605EEBE122BDB3A58BEC834C93D92103B2B09D825CCF73CFC931B82C51
1496peredd.exeC:\webWin\msblocksvc.exeexecutable
MD5:A13D83D538694F2D3D82FAB7AEBE944A
SHA256:7F64BC605EEBE122BDB3A58BEC834C93D92103B2B09D825CCF73CFC931B82C51
295264510EEC0795EFB825E99FE86ABE84C5.exeC:\Users\admin\AppData\Local\Temp\peredd.exeexecutable
MD5:77C2A4EBD85B7D32A7300DCBECE6C5E5
SHA256:AAC4D9353BC1CB9C2347720265F1370A2BF29E3613DAC75A8BA47079C5A60E21
5504msblocksvc.exeC:\Users\Public\Downloads\Idle.exeexecutable
MD5:A13D83D538694F2D3D82FAB7AEBE944A
SHA256:7F64BC605EEBE122BDB3A58BEC834C93D92103B2B09D825CCF73CFC931B82C51
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
88
TCP/UDP connections
32
DNS requests
16
Threats
18

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2952
64510EEC0795EFB825E99FE86ABE84C5.exe
GET
200
91.92.46.53:8085
http://91.92.46.53:8085/peredd.exe
unknown
—
—
malicious
2952
64510EEC0795EFB825E99FE86ABE84C5.exe
GET
—
91.92.46.53:8084
http://91.92.46.53:8084/pered.exe
unknown
—
—
malicious
2716
pered.exe
GET
—
91.92.46.53:8083
http://91.92.46.53:8083/publish.zip
unknown
—
—
malicious
3676
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2632
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2632
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6212
smss.exe
POST
200
91.92.46.53:80
http://91.92.46.53/providervideolineapigeneratordatalifeDlepublicCdntemporary.php
unknown
—
—
malicious
6212
smss.exe
POST
200
91.92.46.53:80
http://91.92.46.53/providervideolineapigeneratordatalifeDlepublicCdntemporary.php
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2324
RUXIMICS.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2952
64510EEC0795EFB825E99FE86ABE84C5.exe
91.92.46.53:8085
—
SPRINTLINK
US
malicious
2952
64510EEC0795EFB825E99FE86ABE84C5.exe
91.92.46.53:8084
—
SPRINTLINK
US
malicious
2716
pered.exe
91.92.46.53:8083
—
SPRINTLINK
US
malicious
3676
svchost.exe
40.126.31.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3676
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
login.live.com
  • 40.126.31.73
  • 40.126.31.130
  • 40.126.31.1
  • 40.126.31.131
  • 40.126.31.69
  • 40.126.31.3
  • 40.126.31.0
  • 20.190.159.4
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
xmr.kryptex.network
  • 157.90.32.66
unknown
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.13
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

PID
Process
Class
Message
2952
64510EEC0795EFB825E99FE86ABE84C5.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 14
2952
64510EEC0795EFB825E99FE86ABE84C5.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
2952
64510EEC0795EFB825E99FE86ABE84C5.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
2952
64510EEC0795EFB825E99FE86ABE84C5.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2952
64510EEC0795EFB825E99FE86ABE84C5.exe
Misc activity
ET INFO EXE - Served Attached HTTP
2952
64510EEC0795EFB825E99FE86ABE84C5.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
2952
64510EEC0795EFB825E99FE86ABE84C5.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
2952
64510EEC0795EFB825E99FE86ABE84C5.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2952
64510EEC0795EFB825E99FE86ABE84C5.exe
Misc activity
ET INFO EXE - Served Attached HTTP
2952
64510EEC0795EFB825E99FE86ABE84C5.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
64510EEC0795EFB825E99FE86ABE84C5.exe