File name:

6ev8.pif.exe

Full analysis: https://app.any.run/tasks/2fed4653-aeee-4893-91fa-3fc9b570a66d
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: May 23, 2025, 16:01:08
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
api-base64
zerotrace
arch-doc
arch-html
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

3F4EA651B032374C8E3829B39E1E4D03

SHA1:

AF4C3C08C1424FF707AC6FD9684A6E20CA065120

SHA256:

0F67F24F04C5B2B70EA17AFF9311547CD51A7951C5701989EF821E41B47B0EA3

SSDEEP:

49152:ByOlJjyULcWg4q2vX9OLQTM+acHEGSEGGVju0yxFXj0ia+CtbQRfrYIvV8ARgzDJ:

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Steals credentials from Web Browsers

      • grpconv.exe (PID: 7928)
      • grpconv.exe (PID: 8020)
      • grpconv.exe (PID: 7284)
      • grpconv.exe (PID: 7332)
      • grpconv.exe (PID: 7232)
      • 6ev8.pif.exe (PID: 7588)

    • Actions looks like stealing of personal data

      • grpconv.exe (PID: 7928)
      • grpconv.exe (PID: 8020)
      • grpconv.exe (PID: 7284)
      • grpconv.exe (PID: 7332)
      • grpconv.exe (PID: 7204)
      • 6ev8.pif.exe (PID: 7588)
      • grpconv.exe (PID: 7232)

    • ZEROTRACE has been detected

      • 6ev8.pif.exe (PID: 7588)

    • Suspicious browser debugging (Possible cookie theft)

      • chrome.exe (PID: 672)
      • chrome.exe (PID: 7912)
      • msedge.exe (PID: 2240)
      • msedge.exe (PID: 8040)
      • msedge.exe (PID: 5232)
      • msedge.exe (PID: 3032)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 5304)

    • Changes powershell execution policy (Bypass)

      • 6ev8.pif.exe (PID: 7588)

  • SUSPICIOUS

    • Application launched itself

      • 6ev8.pif.exe (PID: 7444)

    • Reads security settings of Internet Explorer

      • 6ev8.pif.exe (PID: 7444)

    • Multiple wallet extension IDs have been found

      • 6ev8.pif.exe (PID: 7588)

    • The process executes Powershell scripts

      • 6ev8.pif.exe (PID: 7588)

    • Starts POWERSHELL.EXE for commands execution

      • 6ev8.pif.exe (PID: 7588)

    • MS Edge headless start

      • msedge.exe (PID: 5232)
      • msedge.exe (PID: 7788)
      • msedge.exe (PID: 2240)
      • msedge.exe (PID: 8040)
      • msedge.exe (PID: 1760)
      • msedge.exe (PID: 6048)
      • msedge.exe (PID: 6872)
      • msedge.exe (PID: 3032)

    • Connects to unusual port

      • 6ev8.pif.exe (PID: 7588)

  • INFO

    • Reads the computer name

      • 6ev8.pif.exe (PID: 7444)
      • 6ev8.pif.exe (PID: 7588)

    • Process checks computer location settings

      • 6ev8.pif.exe (PID: 7444)

    • Checks supported languages

      • 6ev8.pif.exe (PID: 7588)
      • 6ev8.pif.exe (PID: 7444)

    • Reads the machine GUID from the registry

      • 6ev8.pif.exe (PID: 7588)

    • Create files in a temporary directory

      • grpconv.exe (PID: 7728)
      • grpconv.exe (PID: 7776)
      • grpconv.exe (PID: 8020)
      • grpconv.exe (PID: 7232)
      • 6ev8.pif.exe (PID: 7588)

    • Creates files or folders in the user directory

      • grpconv.exe (PID: 7728)
      • grpconv.exe (PID: 7776)
      • grpconv.exe (PID: 7820)
      • grpconv.exe (PID: 7896)
      • grpconv.exe (PID: 7928)
      • grpconv.exe (PID: 7284)
      • grpconv.exe (PID: 8156)
      • grpconv.exe (PID: 8020)
      • grpconv.exe (PID: 4692)
      • grpconv.exe (PID: 7292)
      • grpconv.exe (PID: 7204)
      • grpconv.exe (PID: 7332)
      • grpconv.exe (PID: 7232)

    • Potential library load (Base64 Encoded 'LoadLibrary')

      • 6ev8.pif.exe (PID: 7588)

    • Potential dynamic function import (Base64 Encoded 'GetProcAddress')

      • 6ev8.pif.exe (PID: 7588)

    • Potential access to remote process (Base64 Encoded 'OpenProcess')

      • 6ev8.pif.exe (PID: 7588)

    • Reads Windows Product ID

      • grpconv.exe (PID: 7292)

    • Reads Microsoft Office registry keys

      • grpconv.exe (PID: 7292)

    • Potential remote process memory reading (Base64 Encoded 'ReadProcessMemory')

      • 6ev8.pif.exe (PID: 7588)

    • Reads security settings of Internet Explorer

      • grpconv.exe (PID: 7232)
      • notepad.exe (PID: 6036)
      • notepad.exe (PID: 5744)
      • notepad.exe (PID: 8176)
      • notepad.exe (PID: 5380)
      • notepad.exe (PID: 2096)
      • notepad.exe (PID: 4164)
      • notepad.exe (PID: 8096)
      • notepad.exe (PID: 2344)
      • notepad.exe (PID: 6808)
      • notepad.exe (PID: 7148)

    • Reads CPU info

      • 6ev8.pif.exe (PID: 7588)

    • Application launched itself

      • chrome.exe (PID: 672)
      • chrome.exe (PID: 7912)
      • msedge.exe (PID: 2240)
      • msedge.exe (PID: 3032)
      • msedge.exe (PID: 5232)
      • msedge.exe (PID: 8040)

    • Disables trace logs

      • powershell.exe (PID: 5304)

    • Checks proxy server information

      • powershell.exe (PID: 5304)
      • slui.exe (PID: 3968)

    • Manual execution by a user

      • msedge.exe (PID: 2240)
      • msedge.exe (PID: 3032)
      • notepad.exe (PID: 2096)
      • notepad.exe (PID: 5744)
      • notepad.exe (PID: 8176)
      • notepad.exe (PID: 5380)
      • notepad.exe (PID: 6036)
      • notepad.exe (PID: 4164)
      • notepad.exe (PID: 8096)
      • notepad.exe (PID: 2344)
      • notepad.exe (PID: 6808)
      • notepad.exe (PID: 7148)

    • Reads the software policy settings

      • slui.exe (PID: 3968)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2058:04:22 17:01:55+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 11232256
InitializedDataSize: 435200
UninitializedDataSize: -
EntryPoint: 0xab828e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: ZeroTraceOfficialStub
FileVersion: 1.0.0.0
InternalName: ZeroTraceOfficialStub.exe
LegalCopyright: Copyright © 2025
LegalTrademarks: -
OriginalFileName: ZeroTraceOfficialStub.exe
ProductName: ZeroTraceOfficialStub
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
204
Monitored processes
80
Malicious processes
15
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 6ev8.pif.exe no specs #ZEROTRACE 6ev8.pif.exe grpconv.exe no specs grpconv.exe no specs grpconv.exe no specs grpconv.exe no specs grpconv.exe no specs grpconv.exe grpconv.exe no specs grpconv.exe grpconv.exe no specs grpconv.exe no specs grpconv.exe no specs grpconv.exe grpconv.exe no specs grpconv.exe grpconv.exe grpconv.exe no specs grpconv.exe powershell.exe no specs conhost.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs slui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs notepad.exe no specs notepad.exe no specs notepad.exe no specs notepad.exe no specs notepad.exe no specs notepad.exe no specs notepad.exe no specs notepad.exe no specs notepad.exe no specs notepad.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
672"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" C:\Program Files\Google\Chrome\Application\chrome.exe
powershell.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome
Exit code:
4294967295
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
736"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --no-appcompat-clear --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3184 --field-trial-handle=2192,i,17382782689633802044,11497324023664496902,262144 --disable-features=PaintHolding --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
4294967295
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
896\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
904"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --no-appcompat-clear --mojo-platform-channel-handle=2348 --field-trial-handle=2192,i,17382782689633802044,11497324023664496902,262144 --disable-features=PaintHolding --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
4294967295
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1184"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --no-appcompat-clear --mojo-platform-channel-handle=2388 --field-trial-handle=2368,i,17095460802948089946,4091107555728805699,262144 --disable-features=PaintHolding --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1760"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2324 --field-trial-handle=2328,i,18234904564589682500,7099448578144487245,262144 --disable-features=PaintHolding --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2096"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\ProductKeys.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
2140"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2908 --field-trial-handle=1960,i,4761256375832022235,15904938237829247397,262144 --disable-features=PaintHolding --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome
Exit code:
4294967295
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2148"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --disable-quic --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --mojo-platform-channel-handle=1964 --field-trial-handle=1960,i,4761256375832022235,15904938237829247397,262144 --disable-features=PaintHolding --variations-seed-version /prefetch:3C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome
Exit code:
4294967295
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2240"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default --noerrdialogs --no-first-run --flag-switches-begin --flag-switches-end --do-not-de-elevateC:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
4294967295
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
23 157
Read events
23 096
Write events
61
Delete events
0

Modification events

(PID) Process:(7444) 6ev8.pif.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100005D54A9A2C2A0B4429708A0B2BADD77C87D000000
(PID) Process:(7444) 6ev8.pif.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A7803901000060B81DB4E48ED2119906E49FADC173CAAC000000
(PID) Process:(7444) 6ev8.pif.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E232827701000010901EF8A46ECE11A7FF00AA003CA9F6670100006078A409B011A54DAFA526D86198A7803901000060B81DB4E48ED2119906E49FADC173CAAC000000
(PID) Process:(7232) grpconv.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7232) grpconv.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7232) grpconv.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(672) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(672) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(672) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(672) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
12
Suspicious files
87
Text files
128
Unknown types
0

Dropped files

PID
Process
Filename
Type
7728grpconv.exeC:\Users\admin\AppData\Local\Temp\ecv54C.tmp —
MD5:—
SHA256:—
8020grpconv.exeC:\Users\admin\AppData\Local\Temp\bhv2D85.tmp —
MD5:—
SHA256:—
8020grpconv.exeC:\Users\admin\AppData\Local\Temp\sqp33B0.tmp —
MD5:—
SHA256:—
7232grpconv.exeC:\Users\admin\AppData\Local\Temp\bhv6510.tmp —
MD5:—
SHA256:—
7820grpconv.exeC:\Users\admin\AppData\Roaming\InstalledApps-output_20250523160129.txttext
MD5:CE4FA4FC43BE5D8FCB6EC440FD4F615F
SHA256:0EFA9ED04370A623CCC546F41BA0F31BD06AD6E1F41AD79B076C7F7CF8FDFC4F
7776grpconv.exeC:\Users\admin\AppData\Local\Temp\ckeDA9.tmpbinary
MD5:19BA68C3ECBCA72C2B90AFADDE745DC6
SHA256:8B3758EE2D2C0A07EE7003F902F0667ABE5D9667941F8617EDA3CDF94C78E7B8
4692grpconv.exeC:\Users\admin\AppData\Roaming\WorkingTasks-output_20250523160129.txttext
MD5:503D0D3226106E749600120B944B6C72
SHA256:CF742B9F16B6EAE94B90B9752651E3C681FBA5B087025B1D01AF35005B9D60D5
8020grpconv.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\places.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
8020grpconv.exeC:\Users\admin\AppData\Roaming\BrowserHistory-output_20250523160129.txttext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
7284grpconv.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\places.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
94
TCP/UDP connections
145
DNS requests
95
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
—
40.126.32.74:443
https://login.live.com/RST2.srf
unknown
—
—
whitelisted
—
—
POST
—
40.126.32.72:443
https://login.live.com/RST2.srf
unknown
—
—
whitelisted
—
—
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
200
40.126.32.74:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
—
—
POST
400
20.190.160.66:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
400
20.190.160.130:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
400
20.190.160.20:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
POST
400
40.126.32.133:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
400
20.190.160.5:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
—
—
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
—
—
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
6544
svchost.exe
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
  • 51.124.78.146
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.20
  • 20.190.160.22
  • 20.190.160.17
  • 20.190.160.67
  • 20.190.160.65
  • 20.190.160.132
  • 40.126.32.72
  • 40.126.32.140
whitelisted
google.com
  • 216.58.212.142
whitelisted
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
  • 23.216.77.21
  • 23.216.77.18
  • 23.216.77.22
  • 23.216.77.16
  • 23.216.77.20
  • 23.216.77.13
  • 23.216.77.11
  • 23.216.77.15
  • 23.216.77.9
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 95.101.149.131
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
clientservices.googleapis.com
  • 172.217.18.3
whitelisted
accounts.google.com
  • 74.125.71.84
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
6ev8.pif.exe