File name:

loader.exe

Full analysis: https://app.any.run/tasks/a772a2f7-a6b9-4df5-9ab5-f478bbb7eaa8
Verdict: Malicious activity
Threats:

DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 15:58:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
netreactor
dcrat
ims-api
generic
wmi-base64
api-base64
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

EB562E873C0D6BA767964D0DE55AC5A9

SHA1:

B0CA748A3046D721EC2DEC8C3DBD0F204E01A165

SHA256:

E8E3CDDCC753E66757C3D6A47B63117F718103F03A039B40A4553849E04B8AEC

SSDEEP:

98304:5RzBxuwM6sx4qZ37UcDIDH8TZVMun8BtY+cnWFUsg5XYYYOGbj9/S3dtiw97Sic7:Wzqlp9EkB4F4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 1880)

    • DCRAT has been detected (YARA)

      • conhost.exe (PID: 1020)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • loader.exe (PID: 2848)
      • rhsgn_protected.exe (PID: 2364)
      • ARA.exe (PID: 1324)
      • Msblockreview.exe (PID: 268)

    • Executable content was dropped or overwritten

      • loader.exe (PID: 2848)
      • rhsgn_protected.exe (PID: 2364)
      • ARA.exe (PID: 1324)
      • Msblockreview.exe (PID: 268)

    • Reads the Internet Settings

      • loader.exe (PID: 2848)
      • rhsgn_protected.exe (PID: 2364)
      • ARA.exe (PID: 1324)
      • wscript.exe (PID: 1880)
      • Msblockreview.exe (PID: 268)
      • conhost.exe (PID: 1020)

    • Process drops legitimate windows executable

      • rhsgn_protected.exe (PID: 2364)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 1880)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 1880)
      • Msblockreview.exe (PID: 268)

    • Executed via WMI

      • schtasks.exe (PID: 2016)
      • schtasks.exe (PID: 2960)
      • schtasks.exe (PID: 2532)
      • schtasks.exe (PID: 2416)
      • schtasks.exe (PID: 3160)
      • schtasks.exe (PID: 2604)
      • schtasks.exe (PID: 1400)
      • schtasks.exe (PID: 1548)
      • schtasks.exe (PID: 2100)
      • schtasks.exe (PID: 2732)
      • schtasks.exe (PID: 2744)
      • schtasks.exe (PID: 3044)
      • schtasks.exe (PID: 1156)
      • schtasks.exe (PID: 1560)
      • schtasks.exe (PID: 1396)
      • schtasks.exe (PID: 2844)
      • schtasks.exe (PID: 2716)
      • schtasks.exe (PID: 3552)
      • schtasks.exe (PID: 3280)
      • schtasks.exe (PID: 3080)
      • schtasks.exe (PID: 3224)
      • schtasks.exe (PID: 3836)
      • schtasks.exe (PID: 3012)
      • schtasks.exe (PID: 3088)
      • schtasks.exe (PID: 3020)
      • schtasks.exe (PID: 3656)
      • schtasks.exe (PID: 3696)
      • schtasks.exe (PID: 3632)
      • schtasks.exe (PID: 3804)
      • schtasks.exe (PID: 3136)
      • schtasks.exe (PID: 2216)
      • schtasks.exe (PID: 2544)
      • schtasks.exe (PID: 3332)
      • schtasks.exe (PID: 2616)
      • schtasks.exe (PID: 2860)
      • schtasks.exe (PID: 3260)
      • schtasks.exe (PID: 3416)
      • schtasks.exe (PID: 2772)
      • schtasks.exe (PID: 3276)
      • schtasks.exe (PID: 3412)
      • schtasks.exe (PID: 2976)
      • schtasks.exe (PID: 2920)
      • schtasks.exe (PID: 3264)
      • schtasks.exe (PID: 3284)
      • schtasks.exe (PID: 3204)
      • schtasks.exe (PID: 3036)
      • schtasks.exe (PID: 3008)
      • schtasks.exe (PID: 3024)
      • schtasks.exe (PID: 2808)
      • schtasks.exe (PID: 2984)
      • schtasks.exe (PID: 3904)
      • schtasks.exe (PID: 4020)
      • schtasks.exe (PID: 4060)
      • schtasks.exe (PID: 3956)
      • schtasks.exe (PID: 3848)
      • schtasks.exe (PID: 3404)
      • schtasks.exe (PID: 764)

    • The executable file from the user directory is run by the CMD process

      • Msblockreview.exe (PID: 268)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 1880)
      • Msblockreview.exe (PID: 268)

    • Likely accesses (executes) a file from the Public directory

      • schtasks.exe (PID: 2532)
      • schtasks.exe (PID: 2416)
      • schtasks.exe (PID: 2100)
      • schtasks.exe (PID: 1548)
      • schtasks.exe (PID: 2732)
      • schtasks.exe (PID: 1156)
      • schtasks.exe (PID: 3956)
      • schtasks.exe (PID: 4060)
      • schtasks.exe (PID: 4020)
      • schtasks.exe (PID: 764)
      • schtasks.exe (PID: 3848)
      • schtasks.exe (PID: 3404)

    • The process creates files with name similar to system file names

      • Msblockreview.exe (PID: 268)

    • Probably delay the execution using 'w32tm.exe'

      • cmd.exe (PID: 4036)

    • There is functionality for taking screenshot (YARA)

      • conhost.exe (PID: 1020)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • conhost.exe (PID: 1020)

  • INFO

    • Reads the computer name

      • loader.exe (PID: 2848)
      • rhsgn_protected.exe (PID: 2364)
      • ARA.exe (PID: 1324)
      • Msblockreview.exe (PID: 268)
      • conhost.exe (PID: 1020)

    • Checks supported languages

      • loader.exe (PID: 2848)
      • rhsgn_protected.exe (PID: 2364)
      • ARA.exe (PID: 1324)
      • Msblockreview.exe (PID: 268)
      • conhost.exe (PID: 1020)

    • Create files in a temporary directory

      • loader.exe (PID: 2848)
      • rhsgn_protected.exe (PID: 2364)
      • Msblockreview.exe (PID: 268)

    • The sample compiled with english language support

      • rhsgn_protected.exe (PID: 2364)
      • ARA.exe (PID: 1324)
      • Msblockreview.exe (PID: 268)

    • Creates files or folders in the user directory

      • ARA.exe (PID: 1324)

    • Drops encrypted VBS script (Microsoft Script Encoder)

      • ARA.exe (PID: 1324)

    • Reads the machine GUID from the registry

      • Msblockreview.exe (PID: 268)
      • conhost.exe (PID: 1020)

    • Reads Environment values

      • Msblockreview.exe (PID: 268)
      • conhost.exe (PID: 1020)

    • Reads product name

      • Msblockreview.exe (PID: 268)
      • conhost.exe (PID: 1020)

    • Failed to create an executable file in Windows directory

      • Msblockreview.exe (PID: 268)

    • Potential dynamic function import (Base64 Encoded 'GetProcAddress')

      • conhost.exe (PID: 1020)

    • .NET Reactor protector has been detected

      • conhost.exe (PID: 1020)

    • Found Base64 encoded reference to AntiVirus WMI classes (YARA)

      • conhost.exe (PID: 1020)

    • Found Base64 encoded reference to WMI classes (YARA)

      • conhost.exe (PID: 1020)

    • Potential library load (Base64 Encoded 'LoadLibrary')

      • conhost.exe (PID: 1020)

    • Disables trace logs

      • conhost.exe (PID: 1020)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

DcRat

(PID) Process(1020) conhost.exe
C2 (1)http://23.227.193.58/trackwordpressdleCentral
Options
Tag#ARA 09.07
MutexDCR_MUTEX-Xz5X1RvNbk1VXCL5X1Ds
savebrowsersdatatosinglefilefalse
ignorepartiallyemptydatafalse
cookiestrue
passwordstrue
formstrue
cctrue
historyfalse
telegramtrue
steamtrue
discordtrue
filezillatrue
screenshottrue
clipboardtrue
sysinfotrue
searchpath%AppData% - Very Fast
Targetru
C2 (1)http://23.227.193.58/trackwordpressdleCentral
Options
MutexDCR_MUTEX-Xz5X1RvNbk1VXCL5X1Ds
Tag#ARA 09.07
Debugfalse
ServerConfigReplacementTable
0(
2@
H,
i$
k^
j>
I.
x)
l#
E%
g-
Z~
z
R!
o&
v|
p_
B<
d`
=*
G;
PluginConfigReplacementTable
1,
3|
d^
L%
l_
V>
T*
H$
N;
p~
U(
Y)
C<
w!
B#
R.
E&
m`
Q
J@
j-
GetWebcamsfalse
SleepTimeout5
InactivityTimeout2
CacheStorageRegistry
AutoRunSmart
StealerConfig
savebrowsersdatatosinglefilefalse
ignorepartiallyemptydatafalse
cookiestrue
passwordstrue
formstrue
cctrue
historyfalse
telegramtrue
steamtrue
discordtrue
filezillatrue
screenshottrue
clipboardtrue
sysinfotrue
searchpath%AppData% - Very Fast
StealerEnabledtrue
StealerOptionsfalse
SelfDeletefalse
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:03:03 13:16:04+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.3
CodeSize: 156160
InitializedDataSize: 115200
UninitializedDataSize: -
EntryPoint: 0x14220
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
100
Monitored processes
66
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start loader.exe rhsgn_protected.exe ara.exe wscript.exe no specs cmd.exe no specs msblockreview.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs w32tm.exe no specs #DCRAT conhost.exe

Process information

PID
CMD
Path
Indicators
Parent process
268"C:\Users\admin\AppData\Roaming\reviewintobrokerHost\Msblockreview.exe"C:\Users\admin\AppData\Roaming\reviewintobrokerHost\Msblockreview.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
5.15.2.0
Modules
Images
c:\users\admin\appdata\roaming\reviewintobrokerhost\msblockreview.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
764schtasks.exe /create /tn "csrssc" /sc MINUTE /mo 11 /tr "'C:\Users\Public\Downloads\csrss.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1020"C:\MSOCache\All Users\{90140000-00A1-0416-0000-0000000FF1CE}-C\conhost.exe" C:\MSOCache\All Users\{90140000-00A1-0416-0000-0000000FF1CE}-C\conhost.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Version:
5.15.2.0
Modules
Images
c:\msocache\all users\{90140000-00a1-0416-0000-0000000ff1ce}-c\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
DcRat
(PID) Process(1020) conhost.exe
C2 (1)http://23.227.193.58/trackwordpressdleCentral
Options
Tag#ARA 09.07
MutexDCR_MUTEX-Xz5X1RvNbk1VXCL5X1Ds
savebrowsersdatatosinglefilefalse
ignorepartiallyemptydatafalse
cookiestrue
passwordstrue
formstrue
cctrue
historyfalse
telegramtrue
steamtrue
discordtrue
filezillatrue
screenshottrue
clipboardtrue
sysinfotrue
searchpath%AppData% - Very Fast
Targetru
(PID) Process(1020) conhost.exe
C2 (1)http://23.227.193.58/trackwordpressdleCentral
Options
MutexDCR_MUTEX-Xz5X1RvNbk1VXCL5X1Ds
Tag#ARA 09.07
Debugfalse
ServerConfigReplacementTable
0(
2@
H,
i$
k^
j>
I.
x)
l#
E%
g-
Z~
z
R!
o&
v|
p_
B<
d`
=*
G;
PluginConfigReplacementTable
1,
3|
d^
L%
l_
V>
T*
H$
N;
p~
U(
Y)
C<
w!
B#
R.
E&
m`
Q
J@
j-
GetWebcamsfalse
SleepTimeout5
InactivityTimeout2
CacheStorageRegistry
AutoRunSmart
StealerConfig
savebrowsersdatatosinglefilefalse
ignorepartiallyemptydatafalse
cookiestrue
passwordstrue
formstrue
cctrue
historyfalse
telegramtrue
steamtrue
discordtrue
filezillatrue
screenshottrue
clipboardtrue
sysinfotrue
searchpath%AppData% - Very Fast
StealerEnabledtrue
StealerOptionsfalse
SelfDeletefalse
1156schtasks.exe /create /tn "conhostc" /sc MINUTE /mo 8 /tr "'C:\Users\Public\conhost.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1324"C:\Users\admin\AppData\Local\Temp\ARA.exe" C:\Users\admin\AppData\Local\Temp\ARA.exe
rhsgn_protected.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\ara.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24542_none_5c0717c7a00ddc6d\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1396schtasks.exe /create /tn "spoolsvs" /sc MINUTE /mo 8 /tr "'C:\Windows\Temp\Crashpad\attachments\spoolsv.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1400schtasks.exe /create /tn "IMEDICTUPDATEI" /sc MINUTE /mo 12 /tr "'C:\MSOCache\All Users\{90140000-0101-0410-0000-0000000FF1CE}-C\IMEDICTUPDATE.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1548schtasks.exe /create /tn "SearchProtocolHostS" /sc MINUTE /mo 14 /tr "'C:\Users\Public\Videos\SearchProtocolHost.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1560schtasks.exe /create /tn "ctfmonc" /sc MINUTE /mo 14 /tr "'C:\Windows\debug\WIA\ctfmon.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1880"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\reviewintobrokerHost\aUs3pwix5Vd1U6IYzTsfZ9E8dEV3MF.vbe" C:\Windows\System32\wscript.exe—ARA.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
5 605
Read events
5 552
Write events
53
Delete events
0

Modification events

(PID) Process:(2848) loader.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2848) loader.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2848) loader.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2848) loader.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2364) rhsgn_protected.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2364) rhsgn_protected.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2364) rhsgn_protected.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2364) rhsgn_protected.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1324) ARA.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1324) ARA.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
28
Suspicious files
1
Text files
22
Unknown types
0

Dropped files

PID
Process
Filename
Type
2364rhsgn_protected.exeC:\Users\admin\AppData\Local\Temp\DMON.dllexecutable
MD5:58F7761BE8678A189604E2B61C7D7AEB
SHA256:F759CEF48A4E798BEC5AC8BAF10376E1E024E0A128B4B4A5B45F289EE31207DF
2364rhsgn_protected.exeC:\Users\admin\AppData\Local\Temp\eamsi.dllexecutable
MD5:CCFE48E3AAF6A7ADF5643D90CDE3439C
SHA256:5E1F9CBC0F1CA645183F26E25463679AA89CD22A29D427C000AEA0E1E9C11903
2848loader.exeC:\Users\admin\AppData\Local\Temp\rhsgn_protected.exeexecutable
MD5:D0DE8273F957E0508F8B5A0897FECCE9
SHA256:B4144CFD46AD378183A9F1D0136B8465CE80DE44423343891400524CB6CC57EB
268Msblockreview.exeC:\MSOCache\All Users\{90140000-00A1-0411-0000-0000000FF1CE}-C\ctfmon.exeexecutable
MD5:8EBFB00F97E5120227605496DEE1BA2D
SHA256:72AC498F8D99DD2B4C4C4F68A2C709C97DD3F397AC02BE6AD1B5B874450C146E
2364rhsgn_protected.exeC:\Users\admin\AppData\Local\Temp\concrt140.dllexecutable
MD5:119DBAD74C457A2D692CE6765028E88B
SHA256:5F6A435A4A1DA4BBBF8ADB80BD7A81F263FF98D0193AF4ED8E15D39F803DE06E
2364rhsgn_protected.exeC:\Users\admin\AppData\Local\Temp\ebehmoni.dllexecutable
MD5:D9CE7153A878749C59AF90BE5952AEC2
SHA256:60EF7CDADC1778AA08855810233B6887741A9291F36296F20C024A2B2F44D18A
2364rhsgn_protected.exeC:\Users\admin\AppData\Local\Temp\ebehmonl.dllexecutable
MD5:2686070D4A4B5C7401B7AF185ABD71BF
SHA256:11F686ACA158EF40459B0CF92F117186B63765151BDF4295C268AE5DADCABE2A
1324ARA.exeC:\Users\admin\AppData\Roaming\reviewintobrokerHost\WJgXY0RCE6WdWGoPyLk7f.battext
MD5:62416939CBA1A6B6C67A4D907E563F09
SHA256:1BC255D6927643C2F628AE5AB09D83694B99992BC70B2289348FCA9C966D97AA
2364rhsgn_protected.exeC:\Users\admin\AppData\Local\Temp\cfgres.dllexecutable
MD5:F4C9CF4A73F3ACD5A4EF1F60F9297145
SHA256:81B4575928B6D753306848C2F9217BA076D3C0643CB20F378CD883CDB4FDD329
1324ARA.exeC:\Users\admin\AppData\Roaming\reviewintobrokerHost\aUs3pwix5Vd1U6IYzTsfZ9E8dEV3MF.vbebinary
MD5:5050104B6A1222B401DE71F0079FD122
SHA256:43C7B034403C39D71802A2EFC7558648C229544B3337D4298498A0D503151A46
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
7
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
1020
conhost.exe
23.227.193.58:80
—
HVC-AS
US
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.78
whitelisted
dns.msftncsi.com
  • 131.107.255.255
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
loader.exe