File name:

Server.exe

Full analysis: https://app.any.run/tasks/f48fa5b7-c7be-48f1-8785-afe83bd16275
Verdict: Malicious activity
Threats:

DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common.

Malware Trends Tracker     >>>
Analysis date: April 26, 2025, 00:50:16
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
dcrat
rat
auto-sch
auto-reg
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

A071FA60D299DB1949ABB7C2B93E6BF4

SHA1:

6D3CF5D0ADDA91CFAEE746F4800CD21EA4753584

SHA256:

022BBC0ED556E8C2965D791FC035D6D9E956B12FB552BB8C2D4243317326104E

SSDEEP:

98304:62gq++D7D3r2nm5z+27PrVgbg2GYx7SecvUg5ODqquf2dzlJnbPWtV8sCQB2PT4v:sul

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 7612)

    • DCRAT mutex has been found

      • Chainbrowsermonitor.exe (PID: 7940)
      • Chainbrowsermonitor.exe (PID: 8100)
      • cmd.exe (PID: 5892)
      • uhssvc.exe (PID: 7532)
      • cmd.exe (PID: 7284)
      • StartMenuExperienceHost.exe (PID: 516)
      • StartMenuExperienceHost.exe (PID: 6744)
      • Chainbrowsermonitor.exe (PID: 7252)
      • cmd.exe (PID: 7280)
      • cmd.exe (PID: 7148)
      • slui.exe (PID: 7412)
      • cmd.exe (PID: 5116)
      • slui.exe (PID: 3884)
      • Chainbrowsermonitor.exe (PID: 2140)
      • uhssvc.exe (PID: 4892)
      • StartMenuExperienceHost.exe (PID: 4740)

    • Changes the login/logoff helper path in the registry

      • Chainbrowsermonitor.exe (PID: 8100)

    • Changes the autorun value in the registry

      • Chainbrowsermonitor.exe (PID: 8100)

    • Changes Windows Defender settings

      • Chainbrowsermonitor.exe (PID: 8100)

    • Adds path to the Windows Defender exclusion list

      • Chainbrowsermonitor.exe (PID: 8100)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Server.exe (PID: 7416)
      • Server1.exe (PID: 7536)
      • Chainbrowsermonitor.exe (PID: 7940)
      • Chainbrowsermonitor.exe (PID: 8100)
      • csc.exe (PID: 5056)
      • csc.exe (PID: 5772)
      • csc.exe (PID: 960)
      • csc.exe (PID: 4944)
      • cmd.exe (PID: 5892)

    • Reads security settings of Internet Explorer

      • Server.exe (PID: 7416)
      • Server1.exe (PID: 7536)
      • Chainbrowsermonitor.exe (PID: 7940)
      • Chainbrowsermonitor.exe (PID: 8100)
      • cmd.exe (PID: 5892)

    • Reads the date of Windows installation

      • Server.exe (PID: 7416)
      • Chainbrowsermonitor.exe (PID: 7940)
      • Chainbrowsermonitor.exe (PID: 8100)
      • cmd.exe (PID: 5892)

    • Executes application which crashes

      • Server.exe (PID: 7520)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 7612)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 7612)
      • Chainbrowsermonitor.exe (PID: 8100)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 7612)
      • Chainbrowsermonitor.exe (PID: 7940)
      • Chainbrowsermonitor.exe (PID: 8100)
      • cmd.exe (PID: 5892)

    • Executed via WMI

      • schtasks.exe (PID: 1812)
      • schtasks.exe (PID: 6516)
      • schtasks.exe (PID: 5960)
      • schtasks.exe (PID: 5332)
      • schtasks.exe (PID: 7364)
      • schtasks.exe (PID: 7264)
      • schtasks.exe (PID: 4180)
      • schtasks.exe (PID: 7296)
      • schtasks.exe (PID: 6816)
      • schtasks.exe (PID: 900)
      • schtasks.exe (PID: 6264)
      • schtasks.exe (PID: 728)
      • schtasks.exe (PID: 7592)
      • schtasks.exe (PID: 7464)
      • schtasks.exe (PID: 7440)
      • schtasks.exe (PID: 4920)
      • schtasks.exe (PID: 7596)
      • schtasks.exe (PID: 7732)

    • Process drops legitimate windows executable

      • Chainbrowsermonitor.exe (PID: 8100)

    • The process creates files with name similar to system file names

      • Chainbrowsermonitor.exe (PID: 8100)

    • Script adds exclusion path to Windows Defender

      • Chainbrowsermonitor.exe (PID: 8100)

    • Starts POWERSHELL.EXE for commands execution

      • Chainbrowsermonitor.exe (PID: 8100)

    • Starts application with an unusual extension

      • cmd.exe (PID: 8024)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 8024)

  • INFO

    • Checks supported languages

      • Server.exe (PID: 7416)
      • Server.exe (PID: 7520)
      • Server1.exe (PID: 7536)
      • Chainbrowsermonitor.exe (PID: 7940)
      • cvtres.exe (PID: 5404)
      • csc.exe (PID: 5056)
      • csc.exe (PID: 5772)
      • cvtres.exe (PID: 2600)
      • cvtres.exe (PID: 2320)
      • cvtres.exe (PID: 4892)
      • csc.exe (PID: 4944)
      • csc.exe (PID: 960)
      • Chainbrowsermonitor.exe (PID: 8100)
      • chcp.com (PID: 1056)
      • cmd.exe (PID: 5892)
      • StartMenuExperienceHost.exe (PID: 516)
      • uhssvc.exe (PID: 4892)
      • StartMenuExperienceHost.exe (PID: 6744)
      • slui.exe (PID: 3884)
      • cmd.exe (PID: 5116)
      • cmd.exe (PID: 7280)
      • Chainbrowsermonitor.exe (PID: 2140)
      • Chainbrowsermonitor.exe (PID: 7252)
      • cmd.exe (PID: 7284)
      • slui.exe (PID: 7412)
      • uhssvc.exe (PID: 7532)
      • cmd.exe (PID: 7148)
      • StartMenuExperienceHost.exe (PID: 4740)

    • Reads the computer name

      • Server.exe (PID: 7416)
      • Server.exe (PID: 7520)
      • Server1.exe (PID: 7536)
      • Chainbrowsermonitor.exe (PID: 7940)
      • Chainbrowsermonitor.exe (PID: 8100)
      • cmd.exe (PID: 5892)
      • StartMenuExperienceHost.exe (PID: 516)
      • uhssvc.exe (PID: 4892)
      • StartMenuExperienceHost.exe (PID: 6744)
      • slui.exe (PID: 3884)
      • Chainbrowsermonitor.exe (PID: 7252)
      • cmd.exe (PID: 7280)
      • cmd.exe (PID: 5116)
      • cmd.exe (PID: 7284)
      • slui.exe (PID: 7412)
      • uhssvc.exe (PID: 7532)
      • Chainbrowsermonitor.exe (PID: 2140)
      • cmd.exe (PID: 7148)
      • StartMenuExperienceHost.exe (PID: 4740)

    • Create files in a temporary directory

      • Server.exe (PID: 7416)
      • cvtres.exe (PID: 5404)
      • cvtres.exe (PID: 2600)
      • Chainbrowsermonitor.exe (PID: 8100)
      • cvtres.exe (PID: 4892)
      • cvtres.exe (PID: 2320)

    • Reads the machine GUID from the registry

      • Server.exe (PID: 7416)
      • Chainbrowsermonitor.exe (PID: 7940)
      • Chainbrowsermonitor.exe (PID: 8100)
      • csc.exe (PID: 5056)
      • csc.exe (PID: 5772)
      • csc.exe (PID: 960)
      • csc.exe (PID: 4944)
      • cmd.exe (PID: 5892)
      • StartMenuExperienceHost.exe (PID: 6744)
      • slui.exe (PID: 3884)
      • Chainbrowsermonitor.exe (PID: 7252)
      • StartMenuExperienceHost.exe (PID: 516)
      • cmd.exe (PID: 7280)
      • Chainbrowsermonitor.exe (PID: 2140)
      • cmd.exe (PID: 5116)
      • uhssvc.exe (PID: 4892)
      • cmd.exe (PID: 7284)
      • uhssvc.exe (PID: 7532)
      • slui.exe (PID: 7412)
      • cmd.exe (PID: 7148)
      • StartMenuExperienceHost.exe (PID: 4740)

    • Process checks computer location settings

      • Server.exe (PID: 7416)
      • Server1.exe (PID: 7536)
      • Chainbrowsermonitor.exe (PID: 7940)
      • Chainbrowsermonitor.exe (PID: 8100)
      • cmd.exe (PID: 5892)

    • Drops encrypted VBS script (Microsoft Script Encoder)

      • Server1.exe (PID: 7536)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 7752)
      • csc.exe (PID: 5056)

    • Reads Environment values

      • Chainbrowsermonitor.exe (PID: 7940)
      • Chainbrowsermonitor.exe (PID: 8100)
      • cmd.exe (PID: 5892)
      • StartMenuExperienceHost.exe (PID: 516)
      • uhssvc.exe (PID: 4892)
      • StartMenuExperienceHost.exe (PID: 6744)
      • slui.exe (PID: 3884)
      • Chainbrowsermonitor.exe (PID: 7252)
      • Chainbrowsermonitor.exe (PID: 2140)
      • cmd.exe (PID: 7284)
      • cmd.exe (PID: 7280)
      • uhssvc.exe (PID: 7532)
      • slui.exe (PID: 7412)
      • cmd.exe (PID: 5116)
      • cmd.exe (PID: 7148)
      • StartMenuExperienceHost.exe (PID: 4740)

    • The sample compiled with english language support

      • Chainbrowsermonitor.exe (PID: 8100)

    • Creates files in the program directory

      • csc.exe (PID: 5772)
      • Chainbrowsermonitor.exe (PID: 8100)
      • csc.exe (PID: 960)
      • csc.exe (PID: 4944)

    • Auto-launch of the file from Registry key

      • Chainbrowsermonitor.exe (PID: 8100)

    • Changes the display of characters in the console

      • cmd.exe (PID: 8024)

    • Manual execution by a user

      • cmd.exe (PID: 5892)
      • StartMenuExperienceHost.exe (PID: 516)
      • uhssvc.exe (PID: 4892)
      • StartMenuExperienceHost.exe (PID: 6744)
      • slui.exe (PID: 3884)
      • Chainbrowsermonitor.exe (PID: 7252)
      • cmd.exe (PID: 5116)
      • uhssvc.exe (PID: 7532)
      • cmd.exe (PID: 7280)
      • Chainbrowsermonitor.exe (PID: 2140)
      • slui.exe (PID: 7412)
      • cmd.exe (PID: 7284)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7768)
      • powershell.exe (PID: 7776)
      • powershell.exe (PID: 7804)
      • powershell.exe (PID: 5956)
      • powershell.exe (PID: 7476)
      • powershell.exe (PID: 7488)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7804)
      • powershell.exe (PID: 7768)
      • powershell.exe (PID: 7488)
      • powershell.exe (PID: 7476)
      • powershell.exe (PID: 5956)
      • powershell.exe (PID: 7776)

    • Checks proxy server information

      • slui.exe (PID: 7968)

    • Reads the software policy settings

      • slui.exe (PID: 7968)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:02:17 15:50:21+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 2396160
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x24af2e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 1.0.0.0
InternalName: Server1.exe
LegalCopyright:
OriginalFileName: Server1.exe
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
207
Monitored processes
74
Malicious processes
21
Suspicious processes
2

Behavior graph

Click at the process to see the details
start server.exe server.exe server1.exe wscript.exe no specs werfault.exe no specs cmd.exe no specs conhost.exe no specs #DCRAT chainbrowsermonitor.exe cmd.exe conhost.exe no specs #DCRAT chainbrowsermonitor.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs csc.exe conhost.exe no specs cvtres.exe no specs csc.exe conhost.exe no specs cvtres.exe no specs csc.exe conhost.exe no specs cvtres.exe no specs csc.exe conhost.exe no specs cvtres.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs #DCRAT cmd.exe #DCRAT startmenuexperiencehost.exe no specs #DCRAT uhssvc.exe no specs #DCRAT startmenuexperiencehost.exe no specs #DCRAT slui.exe no specs #DCRAT chainbrowsermonitor.exe no specs #DCRAT cmd.exe no specs #DCRAT cmd.exe no specs #DCRAT chainbrowsermonitor.exe no specs #DCRAT uhssvc.exe no specs #DCRAT cmd.exe no specs #DCRAT slui.exe no specs cmd.exe conhost.exe no specs #DCRAT cmd.exe no specs #DCRAT startmenuexperiencehost.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
516"C:\Program Files\Java\jre1.8.0_271\StartMenuExperienceHost.exe"C:\Program Files\Java\jre1.8.0_271\StartMenuExperienceHost.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.2.7.1277
Modules
Images
c:\program files\java\jre1.8.0_271\startmenuexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
728schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 6 /tr "'C:\Program Files\Windows Multimedia Platform\cmd.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
900schtasks.exe /create /tn "cmdc" /sc MINUTE /mo 12 /tr "'C:\found.000\dir0000.chk\cmd.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
960"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\fgpibhpf\fgpibhpf.cmdline"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Chainbrowsermonitor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\csc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ole32.dll
1056chcp 65001C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
1280\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1324\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1812schtasks.exe /create /tn "slui" /sc ONLOGON /tr "'C:\Users\All Users\Documents\slui.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2088ping -n 10 localhost C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\dnsapi.dll
2140"C:\BridgeMs\Chainbrowsermonitor.exe"C:\BridgeMs\Chainbrowsermonitor.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.2.7.1277
Modules
Images
c:\bridgems\chainbrowsermonitor.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
44 964
Read events
44 940
Write events
24
Delete events
0

Modification events

(PID) Process:(7416) Server.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(7536) Server1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbe\OpenWithProgids
Operation:writeName:VBEFile
Value:
(PID) Process:(8100) Chainbrowsermonitor.exeKey:HKEY_CURRENT_USER\SOFTWARE\e1126e1ed8ac015af4f7d38fbac6a5fe330cdeb4
Operation:writeName:f4ffed6450cc9f11936205a4bc12f56e8163b66c
Value:
H4sIAAAAAAAEAIWOQWtCMRCE/8rDs4ToxeJNbUUKD4QiHlwpMVnf2zbJlk2i/nyjePDQ0tMO7Mw3sxsspgCbhJIAZt43D/nKtgSMucrkCym84GB4966FOzGhWZLH+n03JwPwJThSL0p/jicjAE8HAAqmuxlskcQ3ZOlTOtkn0pFLdEprDeBI6tXK9t81EdzffVuKjs+paYvPFNCRadbe5CNL+Cf529KPbCS3GMvb5QeFMFpcccpPkLmQ67Ct+UVvKB6klqMEjpRZ7r79FRkWyy1EAQAA
(PID) Process:(8100) Chainbrowsermonitor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:slui
Value:
"C:\Users\All Users\Documents\slui.exe"
(PID) Process:(8100) Chainbrowsermonitor.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:slui
Value:
"C:\Users\All Users\Documents\slui.exe"
(PID) Process:(8100) Chainbrowsermonitor.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Operation:writeName:Shell
Value:
explorer.exe, "C:\Users\All Users\Documents\slui.exe"
(PID) Process:(8100) Chainbrowsermonitor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Chainbrowsermonitor
Value:
"C:\BridgeMs\Chainbrowsermonitor.exe"
(PID) Process:(8100) Chainbrowsermonitor.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Chainbrowsermonitor
Value:
"C:\BridgeMs\Chainbrowsermonitor.exe"
(PID) Process:(8100) Chainbrowsermonitor.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Operation:writeName:Shell
Value:
explorer.exe, "C:\Users\All Users\Documents\slui.exe", "C:\Program Files\Java\jre1.8.0_271\lib\images\cursors\uhssvc.exe", "C:\found.000\dir0000.chk\cmd.exe", "C:\Program Files\Windows Multimedia Platform\cmd.exe", "C:\Program Files\Java\jre1.8.0_271\StartMenuExperienceHost.exe", "C:\BridgeMs\Chainbrowsermonitor.exe"
(PID) Process:(8100) Chainbrowsermonitor.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:uhssvc
Value:
"C:\Program Files\Java\jre1.8.0_271\lib\images\cursors\uhssvc.exe"
Executable files
40
Suspicious files
12
Text files
34
Unknown types
0

Dropped files

PID
Process
Filename
Type
7752WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Server.exe_1847831f7d7af7711f7f7b0b237748acbb3da1_6699ed85_d9061a60-c1bf-483d-bda4-6b0a8e2e6ba2\Report.wer —
MD5:—
SHA256:—
7752WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\Server.exe.7520.dmp —
MD5:—
SHA256:—
7416Server.exeC:\Users\admin\AppData\Local\Temp\Server1.exeexecutable
MD5:36B12A9B796A9FA64E8E29DA34D0DF38
SHA256:35C08471684E1F0F8C27E342DE27BA18A20611BC87B580F03636BFCB03D03CEE
7752WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD16D.tmp.xmlxml
MD5:DEE7F935EBFC0BD5F7620C99BEBCDBE5
SHA256:2C50F3CF46DC7A5A8E4DD2CF996BB0D5C035ECE49D076C3D234974C3CA5C6B04
7536Server1.exeC:\BridgeMs\wZMeQSART5vxQUuEzwnVz3yo5uvssvPn5j6.battext
MD5:1FACE37F023E44F0B4FEF02366D4EAF7
SHA256:6F0D6C459E4A8F3B94CFD54EE56B353A83EA9E2F80BD0E764A75A7E16AF797F1
7752WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD13D.tmp.WERInternalMetadata.xmlbinary
MD5:B9AE65D3446CD7D7AC7DA8D9CFEBE77E
SHA256:0D3019A317E128AFE6EB36511093B8CD2F986583156EFF5A5B318C38639C3900
7940Chainbrowsermonitor.exeC:\Users\admin\Desktop\SDGkMYlk.logexecutable
MD5:E9CE850DB4350471A62CC24ACB83E859
SHA256:7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
7752WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD052.tmp.dmpbinary
MD5:7ADA9ABA64AF26087B716E5724F9F99A
SHA256:CFEAC4D3A124EC1D644DDCC89474DC406B52E11DFECB6DE1996A3065C616AD74
7940Chainbrowsermonitor.exeC:\Users\admin\Desktop\xjgWWkWa.logexecutable
MD5:D8BF2A0481C0A17A634D066A711C12E9
SHA256:2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
7940Chainbrowsermonitor.exeC:\Users\admin\Desktop\KaxvceVD.logexecutable
MD5:F4B38D0F95B7E844DD288B441EBC9AAF
SHA256:AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
32
TCP/UDP connections
48
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
304
52.149.20.212:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
unknown
—
—
GET
200
52.149.20.212:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
unknown
—
—
GET
200
40.69.42.241:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
unknown
6816
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
6816
SIHClient.exe
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
6816
SIHClient.exe
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
6816
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6816
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1196
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
  • 23.48.23.166
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.159.0
  • 20.190.159.71
  • 20.190.159.64
  • 40.126.31.130
  • 20.190.159.4
  • 40.126.31.2
  • 40.126.31.69
  • 20.190.159.2
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.43
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Server.exe