File name:

Server.exe

Full analysis: https://app.any.run/tasks/f48fa5b7-c7be-48f1-8785-afe83bd16275
Verdict: Malicious activity
Threats:

DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common.

Malware Trends Tracker     >>>
Analysis date: April 26, 2025, 00:50:16
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
dcrat
rat
auto-sch
auto-reg
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

A071FA60D299DB1949ABB7C2B93E6BF4

SHA1:

6D3CF5D0ADDA91CFAEE746F4800CD21EA4753584

SHA256:

022BBC0ED556E8C2965D791FC035D6D9E956B12FB552BB8C2D4243317326104E

SSDEEP:

98304:62gq++D7D3r2nm5z+27PrVgbg2GYx7SecvUg5ODqquf2dzlJnbPWtV8sCQB2PT4v:sul

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • DCRAT mutex has been found

      • Chainbrowsermonitor.exe (PID: 7940)
      • Chainbrowsermonitor.exe (PID: 8100)
      • cmd.exe (PID: 5892)
      • uhssvc.exe (PID: 7532)
      • cmd.exe (PID: 5116)
      • Chainbrowsermonitor.exe (PID: 7252)
      • cmd.exe (PID: 7284)
      • StartMenuExperienceHost.exe (PID: 516)
      • slui.exe (PID: 7412)
      • cmd.exe (PID: 7280)
      • slui.exe (PID: 3884)
      • uhssvc.exe (PID: 4892)
      • Chainbrowsermonitor.exe (PID: 2140)
      • StartMenuExperienceHost.exe (PID: 6744)
      • cmd.exe (PID: 7148)
      • StartMenuExperienceHost.exe (PID: 4740)

    • Changes the login/logoff helper path in the registry

      • Chainbrowsermonitor.exe (PID: 8100)

    • Changes the autorun value in the registry

      • Chainbrowsermonitor.exe (PID: 8100)

    • Changes Windows Defender settings

      • Chainbrowsermonitor.exe (PID: 8100)

    • Adds path to the Windows Defender exclusion list

      • Chainbrowsermonitor.exe (PID: 8100)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 7612)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Server.exe (PID: 7416)
      • Server1.exe (PID: 7536)
      • Chainbrowsermonitor.exe (PID: 7940)
      • csc.exe (PID: 5056)
      • Chainbrowsermonitor.exe (PID: 8100)
      • csc.exe (PID: 5772)
      • csc.exe (PID: 960)
      • csc.exe (PID: 4944)
      • cmd.exe (PID: 5892)

    • Reads security settings of Internet Explorer

      • Server.exe (PID: 7416)
      • Server1.exe (PID: 7536)
      • Chainbrowsermonitor.exe (PID: 7940)
      • Chainbrowsermonitor.exe (PID: 8100)
      • cmd.exe (PID: 5892)

    • Reads the date of Windows installation

      • Server.exe (PID: 7416)
      • Chainbrowsermonitor.exe (PID: 7940)
      • Chainbrowsermonitor.exe (PID: 8100)
      • cmd.exe (PID: 5892)

    • Executes application which crashes

      • Server.exe (PID: 7520)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 7612)
      • Chainbrowsermonitor.exe (PID: 8100)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 7612)
      • Chainbrowsermonitor.exe (PID: 7940)
      • Chainbrowsermonitor.exe (PID: 8100)
      • cmd.exe (PID: 5892)

    • The process creates files with name similar to system file names

      • Chainbrowsermonitor.exe (PID: 8100)

    • Executed via WMI

      • schtasks.exe (PID: 1812)
      • schtasks.exe (PID: 5960)
      • schtasks.exe (PID: 6516)
      • schtasks.exe (PID: 7364)
      • schtasks.exe (PID: 7264)
      • schtasks.exe (PID: 4180)
      • schtasks.exe (PID: 7296)
      • schtasks.exe (PID: 6816)
      • schtasks.exe (PID: 900)
      • schtasks.exe (PID: 4920)
      • schtasks.exe (PID: 5332)
      • schtasks.exe (PID: 728)
      • schtasks.exe (PID: 6264)
      • schtasks.exe (PID: 7464)
      • schtasks.exe (PID: 7592)
      • schtasks.exe (PID: 7440)
      • schtasks.exe (PID: 7596)
      • schtasks.exe (PID: 7732)

    • Process drops legitimate windows executable

      • Chainbrowsermonitor.exe (PID: 8100)

    • Script adds exclusion path to Windows Defender

      • Chainbrowsermonitor.exe (PID: 8100)

    • Starts POWERSHELL.EXE for commands execution

      • Chainbrowsermonitor.exe (PID: 8100)

    • Starts application with an unusual extension

      • cmd.exe (PID: 8024)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 8024)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 7612)

  • INFO

    • Reads the computer name

      • Server.exe (PID: 7416)
      • Server.exe (PID: 7520)
      • Server1.exe (PID: 7536)
      • Chainbrowsermonitor.exe (PID: 7940)
      • Chainbrowsermonitor.exe (PID: 8100)
      • cmd.exe (PID: 5892)
      • StartMenuExperienceHost.exe (PID: 516)
      • uhssvc.exe (PID: 4892)
      • StartMenuExperienceHost.exe (PID: 6744)
      • slui.exe (PID: 3884)
      • Chainbrowsermonitor.exe (PID: 7252)
      • cmd.exe (PID: 5116)
      • cmd.exe (PID: 7280)
      • Chainbrowsermonitor.exe (PID: 2140)
      • uhssvc.exe (PID: 7532)
      • cmd.exe (PID: 7284)
      • slui.exe (PID: 7412)
      • StartMenuExperienceHost.exe (PID: 4740)
      • cmd.exe (PID: 7148)

    • Create files in a temporary directory

      • Server.exe (PID: 7416)
      • cvtres.exe (PID: 5404)
      • cvtres.exe (PID: 2600)
      • Chainbrowsermonitor.exe (PID: 8100)
      • cvtres.exe (PID: 4892)
      • cvtres.exe (PID: 2320)

    • Reads the machine GUID from the registry

      • Server.exe (PID: 7416)
      • Chainbrowsermonitor.exe (PID: 7940)
      • Chainbrowsermonitor.exe (PID: 8100)
      • csc.exe (PID: 5056)
      • csc.exe (PID: 5772)
      • csc.exe (PID: 960)
      • csc.exe (PID: 4944)
      • cmd.exe (PID: 5892)
      • StartMenuExperienceHost.exe (PID: 516)
      • StartMenuExperienceHost.exe (PID: 6744)
      • slui.exe (PID: 3884)
      • Chainbrowsermonitor.exe (PID: 7252)
      • cmd.exe (PID: 5116)
      • cmd.exe (PID: 7284)
      • Chainbrowsermonitor.exe (PID: 2140)
      • cmd.exe (PID: 7280)
      • slui.exe (PID: 7412)
      • uhssvc.exe (PID: 4892)
      • uhssvc.exe (PID: 7532)
      • cmd.exe (PID: 7148)
      • StartMenuExperienceHost.exe (PID: 4740)

    • Checks supported languages

      • Server.exe (PID: 7416)
      • Server.exe (PID: 7520)
      • Server1.exe (PID: 7536)
      • Chainbrowsermonitor.exe (PID: 7940)
      • csc.exe (PID: 5056)
      • csc.exe (PID: 5772)
      • cvtres.exe (PID: 5404)
      • cvtres.exe (PID: 2600)
      • csc.exe (PID: 960)
      • cvtres.exe (PID: 4892)
      • csc.exe (PID: 4944)
      • cvtres.exe (PID: 2320)
      • Chainbrowsermonitor.exe (PID: 8100)
      • chcp.com (PID: 1056)
      • cmd.exe (PID: 5892)
      • StartMenuExperienceHost.exe (PID: 516)
      • uhssvc.exe (PID: 4892)
      • StartMenuExperienceHost.exe (PID: 6744)
      • slui.exe (PID: 3884)
      • Chainbrowsermonitor.exe (PID: 7252)
      • cmd.exe (PID: 5116)
      • cmd.exe (PID: 7280)
      • uhssvc.exe (PID: 7532)
      • Chainbrowsermonitor.exe (PID: 2140)
      • cmd.exe (PID: 7284)
      • slui.exe (PID: 7412)
      • StartMenuExperienceHost.exe (PID: 4740)
      • cmd.exe (PID: 7148)

    • Process checks computer location settings

      • Server.exe (PID: 7416)
      • Server1.exe (PID: 7536)
      • Chainbrowsermonitor.exe (PID: 7940)
      • Chainbrowsermonitor.exe (PID: 8100)
      • cmd.exe (PID: 5892)

    • Drops encrypted VBS script (Microsoft Script Encoder)

      • Server1.exe (PID: 7536)

    • Reads Environment values

      • Chainbrowsermonitor.exe (PID: 7940)
      • Chainbrowsermonitor.exe (PID: 8100)
      • cmd.exe (PID: 5892)
      • uhssvc.exe (PID: 4892)
      • StartMenuExperienceHost.exe (PID: 6744)
      • slui.exe (PID: 3884)
      • Chainbrowsermonitor.exe (PID: 7252)
      • cmd.exe (PID: 5116)
      • cmd.exe (PID: 7284)
      • StartMenuExperienceHost.exe (PID: 516)
      • Chainbrowsermonitor.exe (PID: 2140)
      • uhssvc.exe (PID: 7532)
      • slui.exe (PID: 7412)
      • cmd.exe (PID: 7280)
      • cmd.exe (PID: 7148)
      • StartMenuExperienceHost.exe (PID: 4740)

    • Creates files in the program directory

      • Chainbrowsermonitor.exe (PID: 8100)
      • csc.exe (PID: 5772)
      • csc.exe (PID: 4944)
      • csc.exe (PID: 960)

    • The sample compiled with english language support

      • Chainbrowsermonitor.exe (PID: 8100)

    • Creates files or folders in the user directory

      • csc.exe (PID: 5056)
      • WerFault.exe (PID: 7752)

    • Auto-launch of the file from Registry key

      • Chainbrowsermonitor.exe (PID: 8100)

    • Changes the display of characters in the console

      • cmd.exe (PID: 8024)

    • Manual execution by a user

      • StartMenuExperienceHost.exe (PID: 516)
      • uhssvc.exe (PID: 4892)
      • cmd.exe (PID: 5892)
      • StartMenuExperienceHost.exe (PID: 6744)
      • slui.exe (PID: 3884)
      • Chainbrowsermonitor.exe (PID: 7252)
      • cmd.exe (PID: 5116)
      • uhssvc.exe (PID: 7532)
      • Chainbrowsermonitor.exe (PID: 2140)
      • cmd.exe (PID: 7280)
      • cmd.exe (PID: 7284)
      • slui.exe (PID: 7412)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7776)
      • powershell.exe (PID: 7768)
      • powershell.exe (PID: 7804)
      • powershell.exe (PID: 5956)
      • powershell.exe (PID: 7476)
      • powershell.exe (PID: 7488)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7488)
      • powershell.exe (PID: 7776)
      • powershell.exe (PID: 7804)
      • powershell.exe (PID: 7476)
      • powershell.exe (PID: 7768)
      • powershell.exe (PID: 5956)

    • Reads the software policy settings

      • slui.exe (PID: 7968)

    • Checks proxy server information

      • slui.exe (PID: 7968)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:02:17 15:50:21+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 2396160
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x24af2e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 1.0.0.0
InternalName: Server1.exe
LegalCopyright:
OriginalFileName: Server1.exe
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
207
Monitored processes
74
Malicious processes
21
Suspicious processes
2

Behavior graph

Click at the process to see the details
start server.exe server.exe server1.exe wscript.exe no specs werfault.exe no specs cmd.exe no specs conhost.exe no specs #DCRAT chainbrowsermonitor.exe cmd.exe conhost.exe no specs #DCRAT chainbrowsermonitor.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs csc.exe conhost.exe no specs cvtres.exe no specs csc.exe conhost.exe no specs cvtres.exe no specs csc.exe conhost.exe no specs cvtres.exe no specs csc.exe conhost.exe no specs cvtres.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs #DCRAT cmd.exe #DCRAT startmenuexperiencehost.exe no specs #DCRAT uhssvc.exe no specs #DCRAT startmenuexperiencehost.exe no specs #DCRAT slui.exe no specs #DCRAT chainbrowsermonitor.exe no specs #DCRAT cmd.exe no specs #DCRAT cmd.exe no specs #DCRAT chainbrowsermonitor.exe no specs #DCRAT uhssvc.exe no specs #DCRAT cmd.exe no specs #DCRAT slui.exe no specs cmd.exe conhost.exe no specs #DCRAT cmd.exe no specs #DCRAT startmenuexperiencehost.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
516"C:\Program Files\Java\jre1.8.0_271\StartMenuExperienceHost.exe"C:\Program Files\Java\jre1.8.0_271\StartMenuExperienceHost.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.2.7.1277
Modules
Images
c:\program files\java\jre1.8.0_271\startmenuexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
728schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Multimedia Platform\cmd.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
900schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\found.000\dir0000.chk\cmd.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
960"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\fgpibhpf\fgpibhpf.cmdline"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Chainbrowsermonitor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
1056chcp 65001C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
1280\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1324\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1812schtasks.exe /create /tn "slui" /sc ONLOGON /tr "'C:\Users\All Users\Documents\slui.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2088ping -n 10 localhost C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\dnsapi.dll
2140"C:\BridgeMs\Chainbrowsermonitor.exe"C:\BridgeMs\Chainbrowsermonitor.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.2.7.1277
Modules
Images
c:\bridgems\chainbrowsermonitor.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
44 964
Read events
44 940
Write events
24
Delete events
0

Modification events

(PID) Process:(7416) Server.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(7536) Server1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbe\OpenWithProgids
Operation:writeName:VBEFile
Value:
(PID) Process:(8100) Chainbrowsermonitor.exeKey:HKEY_CURRENT_USER\SOFTWARE\e1126e1ed8ac015af4f7d38fbac6a5fe330cdeb4
Operation:writeName:f4ffed6450cc9f11936205a4bc12f56e8163b66c
Value:
H4sIAAAAAAAEAIWOQWtCMRCE/8rDs4ToxeJNbUUKD4QiHlwpMVnf2zbJlk2i/nyjePDQ0tMO7Mw3sxsspgCbhJIAZt43D/nKtgSMucrkCym84GB4966FOzGhWZLH+n03JwPwJThSL0p/jicjAE8HAAqmuxlskcQ3ZOlTOtkn0pFLdEprDeBI6tXK9t81EdzffVuKjs+paYvPFNCRadbe5CNL+Cf529KPbCS3GMvb5QeFMFpcccpPkLmQ67Ct+UVvKB6klqMEjpRZ7r79FRkWyy1EAQAA
(PID) Process:(8100) Chainbrowsermonitor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:slui
Value:
"C:\Users\All Users\Documents\slui.exe"
(PID) Process:(8100) Chainbrowsermonitor.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:slui
Value:
"C:\Users\All Users\Documents\slui.exe"
(PID) Process:(8100) Chainbrowsermonitor.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Operation:writeName:Shell
Value:
explorer.exe, "C:\Users\All Users\Documents\slui.exe"
(PID) Process:(8100) Chainbrowsermonitor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Chainbrowsermonitor
Value:
"C:\BridgeMs\Chainbrowsermonitor.exe"
(PID) Process:(8100) Chainbrowsermonitor.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Chainbrowsermonitor
Value:
"C:\BridgeMs\Chainbrowsermonitor.exe"
(PID) Process:(8100) Chainbrowsermonitor.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Operation:writeName:Shell
Value:
explorer.exe, "C:\Users\All Users\Documents\slui.exe", "C:\Program Files\Java\jre1.8.0_271\lib\images\cursors\uhssvc.exe", "C:\found.000\dir0000.chk\cmd.exe", "C:\Program Files\Windows Multimedia Platform\cmd.exe", "C:\Program Files\Java\jre1.8.0_271\StartMenuExperienceHost.exe", "C:\BridgeMs\Chainbrowsermonitor.exe"
(PID) Process:(8100) Chainbrowsermonitor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:uhssvc
Value:
"C:\Program Files\Java\jre1.8.0_271\lib\images\cursors\uhssvc.exe"
Executable files
40
Suspicious files
12
Text files
34
Unknown types
0

Dropped files

PID
Process
Filename
Type
7752WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Server.exe_1847831f7d7af7711f7f7b0b237748acbb3da1_6699ed85_d9061a60-c1bf-483d-bda4-6b0a8e2e6ba2\Report.wer —
MD5:—
SHA256:—
7752WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\Server.exe.7520.dmp —
MD5:—
SHA256:—
7940Chainbrowsermonitor.exeC:\Users\admin\Desktop\zmTEsTaV.logexecutable
MD5:BBDE7073BAAC996447F749992D65FFBA
SHA256:1FAE639DF1C497A54C9F42A8366EDAE3C0A6FEB4EB917ECAD9323EF8D87393E8
7416Server.exeC:\Users\admin\AppData\Local\Temp\Server1.exeexecutable
MD5:36B12A9B796A9FA64E8E29DA34D0DF38
SHA256:35C08471684E1F0F8C27E342DE27BA18A20611BC87B580F03636BFCB03D03CEE
7536Server1.exeC:\BridgeMs\wZMeQSART5vxQUuEzwnVz3yo5uvssvPn5j6.battext
MD5:1FACE37F023E44F0B4FEF02366D4EAF7
SHA256:6F0D6C459E4A8F3B94CFD54EE56B353A83EA9E2F80BD0E764A75A7E16AF797F1
8100Chainbrowsermonitor.exeC:\Users\admin\Desktop\PbyUpxto.logexecutable
MD5:F4B38D0F95B7E844DD288B441EBC9AAF
SHA256:AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
7536Server1.exeC:\BridgeMs\Chainbrowsermonitor.exeexecutable
MD5:0DC023F9F826FB2668E53A2E8CC384D3
SHA256:6C02A9FFAA2F8B8F468C9DFACCB3459AB94C6572193ACA8DF36D0AF6D80584C6
7752WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD13D.tmp.WERInternalMetadata.xmlbinary
MD5:B9AE65D3446CD7D7AC7DA8D9CFEBE77E
SHA256:0D3019A317E128AFE6EB36511093B8CD2F986583156EFF5A5B318C38639C3900
7536Server1.exeC:\BridgeMs\xGhnO77DJDwrNgPYYjWz6KGAjI3dbP3q0vY.vbebinary
MD5:67B634872DA61FFC251423BC87B77EE3
SHA256:B804F3C3FA6C197938586767CDA32C28A33748D30708677806E24145C6C8C22C
7416Server.exeC:\Users\admin\AppData\Local\Temp\Server.exeexecutable
MD5:DD6667DB55ACAEFA2D7E99DCF5D97A26
SHA256:CE8FD5EC0B2EE4E5D87D35622EEAA022EE971801C97BCB3726CA6EBE4B576238
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
32
TCP/UDP connections
48
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
304
52.149.20.212:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
—
—
GET
200
52.149.20.212:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
6816
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
40.69.42.241:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
—
6816
SIHClient.exe
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
6816
SIHClient.exe
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
6816
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6816
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1196
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
  • 23.48.23.166
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.159.0
  • 20.190.159.71
  • 20.190.159.64
  • 40.126.31.130
  • 20.190.159.4
  • 40.126.31.2
  • 40.126.31.69
  • 20.190.159.2
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.43
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Server.exe