download:

/a.txt

Full analysis: https://app.any.run/tasks/d7de978e-221b-4c86-9c60-8925c64d7be0
Verdict: Malicious activity
Threats:

Quasar is a very popular RAT in the world thanks to its code being available in open-source. This malware can be used to control the victim’s computer remotely.

Malware Trends Tracker     >>>
Analysis date: May 10, 2025, 03:15:14
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-scr
rat
quasar
remote
evasion
api-base64
Indicators:
MIME: text/plain
File info: Unicode text, UTF-8 text, with CRLF line terminators
MD5:

58A7D973F891FBC97465297658DF8A09

SHA1:

017111C6D444DC3918E2A6CB5CE51BAD27531B87

SHA256:

FA5F135ED7A868A15E0F79EE4CEBAD77428E8B24B99E90900F14CABEEA4F2060

SSDEEP:

48:Ye/ihbbM5oM92zKu2Gldw4bvfEQ/V3SpdfcSaFAzSGOgrHMu/mPROc59HeF:1ih/qowuN1LE5bfcSaFMSGO+F/mPEcQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 3100)
      • powershell.exe (PID: 1676)
      • powershell.exe (PID: 6080)
      • powershell.exe (PID: 1188)

    • Changes powershell execution policy (Bypass)

      • powershell.exe (PID: 3100)
      • powershell.exe (PID: 1676)
      • msiexec.exe (PID: 3800)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6080)

    • Changes Windows Defender settings

      • cmd.exe (PID: 1272)
      • cmd.exe (PID: 4056)
      • cmd.exe (PID: 5124)

    • Changes settings for sending potential threat samples to Microsoft servers

      • powershell.exe (PID: 6660)

    • Adds path to the Windows Defender exclusion list

      • powershell.exe (PID: 1188)
      • cmd.exe (PID: 4056)
      • Launch.exe (PID: 5156)
      • cmd.exe (PID: 5124)

    • Uses Task Scheduler to autorun other applications

      • cmd.exe (PID: 6944)

    • Starts REAGENTC.EXE to disable the Windows Recovery Environment

      • ReAgentc.exe (PID: 5312)

    • Connects to the CnC server

      • communication.exe (PID: 2840)

    • QUASAR has been detected (SURICATA)

      • communication.exe (PID: 2840)

  • SUSPICIOUS

    • Gets path to any of the special folders (POWERSHELL)

      • powershell.exe (PID: 3100)

    • Uses ATTRIB.EXE to modify file attributes

      • powershell.exe (PID: 3100)
      • powershell.exe (PID: 1188)

    • Gets file extension (POWERSHELL)

      • powershell.exe (PID: 3100)

    • Checks a user's role membership (POWERSHELL)

      • powershell.exe (PID: 3100)

    • Possibly malicious use of IEX has been detected

      • powershell.exe (PID: 3100)
      • powershell.exe (PID: 1676)
      • msiexec.exe (PID: 3800)

    • Starts POWERSHELL.EXE for commands execution

      • powershell.exe (PID: 3100)
      • powershell.exe (PID: 6080)
      • msiexec.exe (PID: 3800)
      • cmd.exe (PID: 1272)
      • cmd.exe (PID: 4056)
      • powershell.exe (PID: 1676)
      • cmd.exe (PID: 5124)
      • wcm.exe (PID: 3956)

    • Application launched itself

      • powershell.exe (PID: 1676)
      • powershell.exe (PID: 6080)
      • powershell.exe (PID: 3100)

    • PowerShell delay command usage (probably sleep evasion)

      • powershell.exe (PID: 6080)

    • Starts CMD.EXE for commands execution

      • powershell.exe (PID: 6080)
      • powershell.exe (PID: 1188)
      • Launch.exe (PID: 5156)
      • wcm.exe (PID: 3956)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 5964)
      • cmd.exe (PID: 5608)
      • cmd.exe (PID: 4572)
      • cmd.exe (PID: 4120)
      • cmd.exe (PID: 660)
      • cmd.exe (PID: 1600)
      • cmd.exe (PID: 3760)
      • cmd.exe (PID: 2096)
      • cmd.exe (PID: 4376)
      • cmd.exe (PID: 6512)
      • cmd.exe (PID: 6228)
      • cmd.exe (PID: 900)
      • cmd.exe (PID: 1764)
      • cmd.exe (PID: 5848)
      • cmd.exe (PID: 4944)
      • cmd.exe (PID: 5292)
      • cmd.exe (PID: 4728)
      • cmd.exe (PID: 4120)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 6080)

    • The process hides Powershell's copyright startup banner

      • powershell.exe (PID: 6080)

    • The process bypasses the loading of PowerShell profile settings

      • powershell.exe (PID: 6080)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 1244)
      • msiexec.exe (PID: 3800)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 1244)

    • Runs shell command (SCRIPT)

      • msiexec.exe (PID: 3800)

    • Creates new GUID (POWERSHELL)

      • powershell.exe (PID: 1188)

    • Script adds exclusion path to Windows Defender

      • cmd.exe (PID: 4056)
      • cmd.exe (PID: 5124)

    • Found strings related to reading or modifying Windows Defender settings

      • powershell.exe (PID: 1188)
      • wcm.exe (PID: 3956)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 1188)
      • Launch.exe (PID: 5156)
      • wcm.exe (PID: 3956)

    • The executable file from the user directory is run by the CMD process

      • wcm.exe (PID: 3956)
      • communication.exe (PID: 2840)

    • Probably fake Windows Update

      • cmd.exe (PID: 5308)
      • netsh.exe (PID: 3020)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • cmd.exe (PID: 5308)

    • Stops a currently running service

      • sc.exe (PID: 3800)
      • sc.exe (PID: 5328)
      • sc.exe (PID: 6964)
      • sc.exe (PID: 5860)
      • sc.exe (PID: 5520)

    • Windows service management via SC.EXE

      • sc.exe (PID: 7152)
      • sc.exe (PID: 5936)
      • sc.exe (PID: 6744)
      • sc.exe (PID: 5344)
      • sc.exe (PID: 1452)

    • Modifies existing scheduled task

      • schtasks.exe (PID: 3364)
      • schtasks.exe (PID: 5964)
      • schtasks.exe (PID: 6708)
      • schtasks.exe (PID: 2268)
      • schtasks.exe (PID: 920)
      • schtasks.exe (PID: 6476)
      • schtasks.exe (PID: 7000)
      • schtasks.exe (PID: 2408)

    • Contacting a server suspected of hosting an CnC

      • communication.exe (PID: 2840)

    • Checks for external IP

      • svchost.exe (PID: 2196)

    • Connects to unusual port

      • communication.exe (PID: 2840)

    • Query Microsoft Defender preferences

      • wcm.exe (PID: 3956)

  • INFO

    • Gets or sets the time when the file was last written to (POWERSHELL)

      • powershell.exe (PID: 3100)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 3100)

    • Disables trace logs

      • powershell.exe (PID: 3100)
      • powershell.exe (PID: 6080)
      • powershell.exe (PID: 3364)
      • powershell.exe (PID: 1676)

    • Checks proxy server information

      • powershell.exe (PID: 3100)
      • slui.exe (PID: 5212)
      • powershell.exe (PID: 6080)
      • powershell.exe (PID: 3364)
      • powershell.exe (PID: 1676)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 3100)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 3100)
      • powershell.exe (PID: 6660)
      • powershell.exe (PID: 5624)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 3100)

    • Reads the software policy settings

      • slui.exe (PID: 3900)
      • slui.exe (PID: 5212)
      • msiexec.exe (PID: 1244)

    • Reads the computer name

      • msiexec.exe (PID: 1244)
      • msiexec.exe (PID: 3800)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 1244)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 1244)

    • Checks supported languages

      • msiexec.exe (PID: 1244)
      • msiexec.exe (PID: 3800)

    • Process checks computer location settings

      • msiexec.exe (PID: 3800)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6660)
      • powershell.exe (PID: 5624)

    • Potential access to remote process (Base64 Encoded 'OpenProcess')

      • powershell.exe (PID: 1188)

    • Potential remote process memory writing (Base64 Encoded 'WriteProcessMemory')

      • powershell.exe (PID: 1188)

    • Potential remote process memory reading (Base64 Encoded 'ReadProcessMemory')

      • powershell.exe (PID: 1188)

    • The executable file from the user directory is run by the Powershell process

      • Launch.exe (PID: 5156)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
297
Monitored processes
162
Malicious processes
13
Suspicious processes
3

Behavior graph

Click at the process to see the details
start powershell.exe conhost.exe no specs attrib.exe no specs sppextcomobj.exe no specs slui.exe powershell.exe powershell.exe slui.exe cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs powershell.exe conhost.exe no specs msiexec.exe msiexec.exe msiexec.exe no specs powershell.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs attrib.exe no specs cmd.exe conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs attrib.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs launch.exe cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs wcm.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs sc.exe no specs conhost.exe no specs cmd.exe no specs sc.exe no specs conhost.exe no specs cmd.exe no specs sc.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs reagentc.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs reagentc.exe no specs cmd.exe no specs conhost.exe no specs #QUASAR communication.exe svchost.exe cmd.exe no specs conhost.exe no specs reagentc.exe no specs cmd.exe no specs conhost.exe no specs reagentc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
240\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
444REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /fC:\Windows\SysWOW64\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\advapi32.dll
660"C:\WINDOWS\system32\cmd.exe" /c reg add "HKCU\Software\Microsoft" /v "Version" /t REG_SZ /d f6247d2f2d /f C:\Windows\SysWOW64\cmd.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
736reagentc /infoC:\Windows\SysWOW64\ReAgentc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Windows Recovery Agent
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reagentc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
744REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v "DisableWindowsUpdateAccess" /t REG_DWORD /d 1 /fC:\Windows\SysWOW64\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\advapi32.dll
776\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
788reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Recovery" /v "Rollback" /t REG_DWORD /d 0 /fC:\Windows\SysWOW64\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\advapi32.dll
788"C:\Windows\SysWOW64\cmd.exe" /c "sc stop WaaSMedicSvc"C:\Windows\SysWOW64\cmd.exe—wcm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1062
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
840"C:\Windows\SysWOW64\cmd.exe" /c "schtasks /Change /TN "Microsoft\Windows\WindowsUpdate\Scheduled Start" /Disable"C:\Windows\SysWOW64\cmd.exe—wcm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
900"C:\Windows\SysWOW64\cmd.exe" /c "REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" /v "NoAutoUpdate" /t REG_DWORD /d 1 /f"C:\Windows\SysWOW64\cmd.exe—wcm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
64 352
Read events
64 100
Write events
174
Delete events
78

Modification events

(PID) Process:(6080) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell
Operation:writeName:ExecutionPolicy
Value:
Bypass
(PID) Process:(2332) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft
Operation:writeName:App
Value:
crypto
(PID) Process:(5056) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft
Operation:writeName:Application
Value:
Yes
(PID) Process:(1244) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1244) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1244) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1244) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1244) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
DC040000C6A8DD195AC1DB01
(PID) Process:(1244) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
469EC4D63FDFFA04E236C0FB170A5FCE960D5391918EFFC3600FE5E28DE6A16B
(PID) Process:(1244) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
Executable files
5
Suspicious files
27
Text files
36
Unknown types
0

Dropped files

PID
Process
Filename
Type
3100powershell.exeC:\Users\admin\AppData\Roaming\CheckExtension\h.js —
MD5:—
SHA256:—
3100powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7HNR3LP0FQFAKLTM03LB.tempbinary
MD5:F2204848F88032740B374709C37405D6
SHA256:EC66948F342D5672FCA157B702B46B8DA7D7714F1FECBE91DC5F9CA914A1D19E
3100powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF10b901.TMPbinary
MD5:D040F64E9E7A2BB91ABCA5613424598E
SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670
3100powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msbinary
MD5:F2204848F88032740B374709C37405D6
SHA256:EC66948F342D5672FCA157B702B46B8DA7D7714F1FECBE91DC5F9CA914A1D19E
3100powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_wm5ikr0i.x0z.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3100powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_psoq2jth.3p3.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3100powershell.exeC:\Users\admin\AppData\Local\Temp\extension.zipcompressed
MD5:52F32B331CD5BBE5D6C9650A7507EEC2
SHA256:18263C5BC3E5B8FB5C9DBBF74BB1E33606085F068986CC354284E3FD3639091B
3100powershell.exeC:\Users\admin\AppData\Roaming\CheckExtension\manifest.jsonbinary
MD5:6FA1FEE1DF920D495850CD243D3C8838
SHA256:A87D9892AB2130894081A8AE2C3B948E14812ADEC93CC194D9B8A3F5CCDAFABA
3100powershell.exeC:\Users\admin\AppData\Roaming\CheckExtension\injected.jsbinary
MD5:D27B34A314E362B6AB34F765A114F61F
SHA256:234BD31617000B0665244164371028F870711241B9C70FA38DDA03BC449274DE
3100powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnkbinary
MD5:9270FDDB40791A02A1A4A2744B823AB0
SHA256:39F25126451D4ADDD7DB145D9D06BA5131B3B20D80B7959AEFDD8E5305FF5F4C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
90
DNS requests
26
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.31:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6512
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6512
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.31:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
40.126.31.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3100
powershell.exe
66.29.153.87:443
solidity.bot
NAMECHEAP-NET
US
unknown
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.216.77.31
  • 23.216.77.38
  • 23.216.77.41
  • 23.216.77.35
  • 23.216.77.26
  • 23.216.77.5
  • 23.216.77.21
  • 23.216.77.22
whitelisted
google.com
  • 142.250.186.46
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
login.live.com
  • 40.126.31.73
  • 20.190.159.64
  • 40.126.31.130
  • 40.126.31.0
  • 20.190.159.0
  • 20.190.159.128
  • 20.190.159.68
  • 40.126.31.67
  • 20.190.160.65
  • 20.190.160.67
  • 20.190.160.17
  • 40.126.32.76
  • 40.126.32.134
  • 40.126.32.72
  • 40.126.32.133
  • 40.126.32.140
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
solidity.bot
  • 66.29.153.87
unknown
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.43
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO External IP Lookup Domain in DNS Lookup (ipwho .is)
—
—
Domain Observed Used for C2 Detected
ET MALWARE Generic AsyncRAT/zgRAT Style SSL Cert
—
—
Domain Observed Used for C2 Detected
ET MALWARE Observed Malicious SSL Cert (Quasar CnC)
—
—
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] QuasarRAT Successful Connection (GCM_SHA384)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
/a.txt