We're sorry but any.run reports doesn't work properly without JavaScript enabled. Please enable it to continue.
Analysis result
Behavior activities
Threats
Find similar analyses in TI Lookup
Analysis date (UTC):
30 July 2018, 02:52
Analysis environment:
Windows 7 Pro, build 7601, x86
RMActivate.exe
MD5:
D40C2DA3428D7E526ECD3670EADBD3F0
SHA1:
7FCE9E5654122FB26F0824FC79C8A1206FB479DE
SHA256:
052443AC4EA5F6E4EEDA13A7722B6FACE69D29238E54C4B7420A9B19E9E5AAB1
Analysis result
Threat level:
Suspicious activity
Full analysis:
Analysis RMActivate.exe (MD5: D40C2DA3428D7E526ECD3670EADBD3F0) Suspicious activity - Interactive analysis ANY.RUN
Behavior activities
MALICIOUS
Loads the Task Scheduler COM API
schtasks.exe (PID: 372)
Uses Task Scheduler to run other applications
RMActivate.exe (PID: 2228)
SUSPICIOUS
Creates files in the program directory
RMActivate.exe (PID: 2228)
Executable content was dropped or overwritten
RMActivate.exe (PID: 2228)
Uses WMIC.EXE to obtain a list of video controllers
hostdl.exe (PID: 1856)
INFO
No info indicators.
Threats
No threats detected