File name:

SpecialK.exe

Full analysis: https://app.any.run/tasks/0c4d95f1-56c1-47a1-86e3-bd5165be5fbe
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: December 15, 2024, 15:45:34
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 11 sections
MD5:

AB6E96A99D79ED933413509A951D2F98

SHA1:

0A2CCED6921E314A2014AA876C578287F2AC9DB9

SHA256:

10E99D05AF3614573FD9038FEC197881434EDACF3180AE3C4325845E0B16B934

SSDEEP:

98304:Xrq3BdwmzoGIKg/g+TdbI4BtN9b7VE+qQBr9x3emV+alBTP8eGaBwdCQZDtPfmJY:CzP5gYZ1Yw9sVP4Q9kt

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE to view/change users localgroup

      • SpecialK.tmp (PID: 6412)
      • net.exe (PID: 7032)

    • Steals credentials from Web Browsers

      • CCleaner64.exe (PID: 5268)
      • CCleaner64.exe (PID: 6748)

    • Changes the autorun value in the registry

      • CCleaner64.exe (PID: 6748)

    • Loads dropped or rewritten executable

      • CCleaner64.exe (PID: 5268)
      • svchost.exe (PID: 1356)
      • sppsvc.exe (PID: 2216)
      • WaaSMedicAgent.exe (PID: 5472)
      • SKIF.exe (PID: 3420)
      • rundll32.exe (PID: 5268)
      • _setup64.tmp (PID: 7140)
      • RuntimeBroker.exe (PID: 6548)
      • CCleaner64.exe (PID: 7012)
      • conhost.exe (PID: 7040)
      • CCleaner64.exe (PID: 6748)
      • WmiPrvSE.exe (PID: 5472)
      • consent.exe (PID: 6996)
      • conhost.exe (PID: 3840)
      • MusNotifyIcon.exe (PID: 6800)
      • CompatTelRunner.exe (PID: 3172)
      • SKIFsvc64.exe (PID: 5488)
      • consent.exe (PID: 7032)
      • svchost.exe (PID: 5968)
      • conhost.exe (PID: 6540)
      • SIHClient.exe (PID: 6844)
      • WmiPrvSE.exe (PID: 6892)
      • conhost.exe (PID: 7148)
      • SKIFsvc64.exe (PID: 1540)
      • SKIFsvc64.exe (PID: 6632)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • SpecialK.exe (PID: 6388)
      • SpecialK.tmp (PID: 6412)
      • CCleaner64.exe (PID: 7012)
      • CCleaner64.exe (PID: 5268)
      • CCleaner64.exe (PID: 6748)

    • Reads the Windows owner or organization settings

      • SpecialK.tmp (PID: 6412)

    • Reads security settings of Internet Explorer

      • SpecialK.tmp (PID: 6412)
      • SKIF.exe (PID: 3420)
      • CCleaner64.exe (PID: 7012)
      • CCleaner64.exe (PID: 5268)
      • CCleaner64.exe (PID: 6748)

    • Reads the date of Windows installation

      • SKIF.exe (PID: 3420)
      • CCleaner64.exe (PID: 7012)
      • CCleaner64.exe (PID: 5268)

    • Uses RUNDLL32.EXE to load library

      • rundll32.exe (PID: 640)

    • Checks Windows Trust Settings

      • SKIF.exe (PID: 3420)
      • CCleaner64.exe (PID: 7012)
      • CCleaner64.exe (PID: 5268)
      • CCleaner64.exe (PID: 6748)

    • Searches for installed software

      • CompatTelRunner.exe (PID: 3172)
      • CCleaner64.exe (PID: 5268)
      • CCleaner64.exe (PID: 6748)

    • Creates file in the systems drive root

      • SKIF.exe (PID: 3420)

    • Application launched itself

      • CCleaner64.exe (PID: 7012)
      • CCleaner64.exe (PID: 5268)

    • Reads Internet Explorer settings

      • CCleaner64.exe (PID: 5268)
      • CCleaner64.exe (PID: 6748)

    • Process drops legitimate windows executable

      • CCleaner64.exe (PID: 7012)

    • The process verifies whether the antivirus software is installed

      • CCleaner64.exe (PID: 6748)

    • Checks for external IP

      • CCleaner64.exe (PID: 5268)

  • INFO

    • Checks supported languages

      • SpecialK.tmp (PID: 6412)
      • SpecialK.exe (PID: 6388)
      • _setup64.tmp (PID: 7140)
      • SKIF.exe (PID: 3420)
      • CCleaner64.exe (PID: 7012)
      • CCleaner.exe (PID: 5912)
      • SKIFsvc32.exe (PID: 4912)
      • SKIFsvc64.exe (PID: 5488)
      • CCleaner64.exe (PID: 5268)
      • CCleaner64.exe (PID: 6748)
      • SKIFsvc64.exe (PID: 1540)
      • SKIFsvc32.exe (PID: 3052)
      • SKIFsvc64.exe (PID: 6632)
      • SKIFsvc32.exe (PID: 6784)

    • Reads the computer name

      • SpecialK.tmp (PID: 6412)
      • SKIF.exe (PID: 3420)
      • SKIFsvc32.exe (PID: 4912)
      • CCleaner64.exe (PID: 7012)
      • SKIFsvc64.exe (PID: 5488)
      • CCleaner.exe (PID: 5912)
      • CCleaner64.exe (PID: 5268)
      • CCleaner64.exe (PID: 6748)
      • SKIFsvc64.exe (PID: 1540)
      • SKIFsvc32.exe (PID: 3052)
      • SKIFsvc64.exe (PID: 6632)
      • SKIFsvc32.exe (PID: 6784)

    • Create files in a temporary directory

      • SpecialK.exe (PID: 6388)
      • SpecialK.tmp (PID: 6412)

    • Reads security settings of Internet Explorer

      • RuntimeBroker.exe (PID: 6548)

    • Reads the time zone

      • WmiPrvSE.exe (PID: 6892)
      • MusNotifyIcon.exe (PID: 6800)

    • Creates files in the program directory

      • MusNotifyIcon.exe (PID: 6800)
      • CCleaner64.exe (PID: 5268)
      • CCleaner64.exe (PID: 6748)

    • Reads the software policy settings

      • SIHClient.exe (PID: 6844)
      • consent.exe (PID: 6996)
      • WaaSMedicAgent.exe (PID: 5472)
      • SKIF.exe (PID: 3420)
      • CCleaner64.exe (PID: 7012)
      • CompatTelRunner.exe (PID: 3172)
      • consent.exe (PID: 7032)
      • CCleaner64.exe (PID: 5268)
      • CCleaner64.exe (PID: 6748)

    • The process uses the downloaded file

      • SpecialK.tmp (PID: 6412)
      • consent.exe (PID: 6996)
      • CCleaner64.exe (PID: 7012)
      • consent.exe (PID: 7032)
      • CCleaner64.exe (PID: 5268)

    • Process checks computer location settings

      • SpecialK.tmp (PID: 6412)
      • SKIF.exe (PID: 3420)
      • CCleaner64.exe (PID: 7012)
      • CCleaner64.exe (PID: 5268)

    • The sample compiled with english language support

      • SpecialK.tmp (PID: 6412)
      • CCleaner64.exe (PID: 5268)
      • CCleaner64.exe (PID: 7012)
      • CCleaner64.exe (PID: 6748)

    • Creates a software uninstall entry

      • SpecialK.tmp (PID: 6412)

    • Checks proxy server information

      • SKIF.exe (PID: 3420)
      • CCleaner64.exe (PID: 7012)
      • CCleaner64.exe (PID: 5268)

    • Reads the machine GUID from the registry

      • SKIF.exe (PID: 3420)
      • CCleaner64.exe (PID: 7012)
      • CCleaner64.exe (PID: 5268)
      • CCleaner64.exe (PID: 6748)

    • Creates files or folders in the user directory

      • SKIF.exe (PID: 3420)
      • SpecialK.tmp (PID: 6412)
      • SKIFsvc64.exe (PID: 5488)
      • SKIFsvc32.exe (PID: 4912)
      • CCleaner64.exe (PID: 7012)
      • CCleaner64.exe (PID: 5268)

    • Reads Environment values

      • CCleaner.exe (PID: 5912)
      • CCleaner64.exe (PID: 7012)
      • CCleaner64.exe (PID: 6748)
      • CCleaner64.exe (PID: 5268)

    • Reads CPU info

      • CCleaner64.exe (PID: 5268)
      • CCleaner64.exe (PID: 6748)

    • Sends debugging messages

      • CCleaner64.exe (PID: 5268)
      • CCleaner64.exe (PID: 6748)

    • Reads product name

      • CCleaner64.exe (PID: 5268)
      • CCleaner64.exe (PID: 6748)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (67.7)
.exe | Win32 EXE PECompact compressed (generic) (25.6)
.exe | Win32 Executable (generic) (2.7)
.exe | Win16/32 Executable Delphi generic (1.2)
.exe | Generic Win/DOS Executable (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:12 07:26:53+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 2.25
CodeSize: 685056
InitializedDataSize: 267776
UninitializedDataSize: -
EntryPoint: 0xa83bc
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 24.12.12.0
ProductVersionNumber: 24.12.12.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: The Special K Group
FileDescription: Special K Setup
FileVersion: 24.12.12
LegalCopyright: Copyleft ?????? 2015-2023
OriginalFileName: SpecialK_24.12.12.exe
ProductName: Special K
ProductVersion: 24.12.12
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
150
Monitored processes
34
Malicious processes
9
Suspicious processes
3

Behavior graph

Click at the process to see the details
start specialk.exe specialk.tmp net.exe conhost.exe no specs net1.exe no specs _setup64.tmp no specs conhost.exe no specs rundll32.exe no specs rundll32.exe no specs skif.exe skifsvc32.exe no specs skifsvc64.exe no specs ccleaner.exe no specs ccleaner64.exe ccleaner64.exe ccleaner64.exe svchost.exe sppsvc.exe no specs compattelrunner.exe no specs conhost.exe no specs waasmedicagent.exe no specs wmiprvse.exe no specs svchost.exe no specs conhost.exe no specs runtimebroker.exe no specs musnotifyicon.exe no specs sihclient.exe wmiprvse.exe no specs consent.exe no specs consent.exe no specs skifsvc32.exe no specs skifsvc64.exe no specs skifsvc32.exe no specs skifsvc64.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
640"C:\Windows\System32\rundll32.exe" SpecialK64.dll,RunDLL_DisableGFEForSKIF silentC:\Windows\SysWOW64\rundll32.exe—SpecialK.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1356C:\WINDOWS\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvcC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\waasassessment.dll
c:\windows\system32\wosc.dll
c:\windows\system32\wintypes.dll
c:\windows\system32\utcutil.dll
c:\windows\system32\logoncli.dll
c:\windows\system32\dcntel.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\netutils.dll
c:\windows\system32\umpdc.dll
c:\windows\system32\aepic.dll
1540"C:\Users\admin\AppData\Local\Programs\Special K\Servlet\SKIFsvc64.exe" StopC:\Users\admin\AppData\Local\Programs\Special K\Servlet\SKIFsvc64.exe—SKIF.exe
User:
admin
Company:
The Special☆K Group
Integrity Level:
MEDIUM
Description:
Special K 64-bit Injection Service Host
Exit code:
0
Version:
1.0.3.2
Modules
Images
c:\users\admin\appdata\local\programs\special k\servlet\skifsvc64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2216C:\WINDOWS\system32\sppsvc.exeC:\Windows\System32\sppsvc.exe—services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Software Protection Platform Service
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\combase.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
3052"C:\Users\admin\AppData\Local\Programs\Special K\Servlet\SKIFsvc32.exe" StopC:\Users\admin\AppData\Local\Programs\Special K\Servlet\SKIFsvc32.exe—SKIF.exe
User:
admin
Company:
The Special☆K Group
Integrity Level:
MEDIUM
Description:
Special K 32-bit Injection Service Host
Exit code:
0
Version:
1.0.3.2
Modules
Images
c:\users\admin\appdata\local\programs\special k\servlet\skifsvc32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
3172C:\WINDOWS\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryWC:\Windows\System32\CompatTelRunner.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Compatibility Telemetry
Exit code:
0
Version:
10.0.19645.1102 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\compattelrunner.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3420"C:\Users\admin\AppData\Local\Programs\Special K\SKIF.exe"C:\Users\admin\AppData\Local\Programs\Special K\SKIF.exe
SpecialK.tmp
User:
admin
Company:
The Special☆K Group
Integrity Level:
MEDIUM
Description:
Special K Injection Frontend
Exit code:
0
Version:
1.1.12
Modules
Images
c:\users\admin\appdata\local\programs\special k\skif.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3840\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WaaSMedicAgent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4912"C:\Users\admin\AppData\Local\Programs\Special K\Servlet\SKIFsvc32.exe" StartC:\Users\admin\AppData\Local\Programs\Special K\Servlet\SKIFsvc32.exe—SKIF.exe
User:
admin
Company:
The Special☆K Group
Integrity Level:
MEDIUM
Description:
Special K 32-bit Injection Service Host
Exit code:
0
Version:
1.0.3.2
Modules
Images
c:\users\admin\appdata\local\programs\special k\servlet\skifsvc32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
5268"C:\Windows\System32\rundll32.exe" SpecialK64.dll,RunDLL_DisableGFEForSKIF silentC:\Windows\System32\rundll32.exe—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
Total events
88 157
Read events
87 484
Write events
603
Delete events
70

Modification events

(PID) Process:(1356) svchost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\WaaS\WaaSMedic\Configuration
Operation:delete valueName:ETag
Value:
(PID) Process:(1356) svchost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\WaaS\WaaSMedic\Configuration
Operation:writeName:refreshAfter
Value:
08176E94D14FDB01
(PID) Process:(1356) svchost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\WaaS\WaaSMedic\TaskStore
Operation:writeName:Schedule Work
Value:
Microsoft\Windows\UpdateOrchestrator
(PID) Process:(1356) svchost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\WaaS\WaaSMedic\TaskStore
Operation:writeName:Schedule Wake To Work
Value:
Microsoft\Windows\UpdateOrchestrator
(PID) Process:(1356) svchost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\WaaS\WaaSMedic\TaskStore
Operation:writeName:Schedule Maintenance Work
Value:
Microsoft\Windows\UpdateOrchestrator
(PID) Process:(6412) SpecialK.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveMovie\devenum\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device
Operation:writeName:FriendlyName
Value:
Default MidiOut Device
(PID) Process:(6412) SpecialK.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveMovie\devenum\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device
Operation:writeName:CLSID
Value:
{07B65360-C445-11CE-AFDE-00AA006C14F4}
(PID) Process:(6412) SpecialK.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveMovie\devenum\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device
Operation:writeName:FilterData
Value:
02000000000080000100000000000000307069330200000000000000010000000000000000000000307479330000000038000000480000006D69647300001000800000AA00389B7100000000000000000000000000000000
(PID) Process:(6412) SpecialK.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveMovie\devenum\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device
Operation:writeName:MidiOutId
Value:
(PID) Process:(6412) SpecialK.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\ActiveMovie\devenum\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device
Operation:writeName:FriendlyName
Value:
Default DirectSound Device
Executable files
30
Suspicious files
45
Text files
33
Unknown types
0

Dropped files

PID
Process
Filename
Type
6844SIHClient.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\51867C3735CFAECCDB556E146BB12C28binary
MD5:2EEDFC32E5C101E714DC379FC54A5291
SHA256:621E2249D2C779306F6CCCDCB4181BDD268FAB801FBAECBD11231126AE8437FC
6844SIHClient.exeC:\Windows\Logs\SIH\SIH.20241215.154609.521.1.etlbinary
MD5:5B634E3DD7496675226FCD05289A2AB8
SHA256:FE6B67B6F3FB9C9C12C1BBEB3CB791A8C88AC4CD53BAA2CFF3CC76F461D20B19
6800MusNotifyIcon.exeC:\ProgramData\USOShared\Logs\User\NotifyIcon.e81b4577-6abc-43a8-9d99-d93927212f91.1.etlbinary
MD5:8F9D16D85F97EE267B77F173C49B8DC1
SHA256:933163BEAB483C13806675FC03AA730291B08922C94BCE932A3FD3AC391DFB45
6412SpecialK.tmpC:\Users\admin\AppData\Local\Programs\Special K\SpecialK64.dllexecutable
MD5:3F2894B13FA5E22D67F2F0DE7D2B64B6
SHA256:0FBB98442A3B205B391570061A6768D2DD1D296042F1FA1801E8F04FCE75AD39
6412SpecialK.tmpC:\Users\admin\AppData\Local\Programs\Special K\Servlet\is-7DLDS.tmpexecutable
MD5:AB242DE2492E439CC959347EFA45C54D
SHA256:D9782DE3D60874F1697A53E20289328D2B8AE93DC404EF8A1EA1E508BF1B620A
6412SpecialK.tmpC:\Users\admin\AppData\Local\Programs\Special K\Servlet\is-2JNEG.tmpexecutable
MD5:7C9EA8C816BDEFF7ABBA9D5962AA4E12
SHA256:FFEF056E8C91DB03E82CE1132942B2D617367E91742203B931C379789FCD6217
6412SpecialK.tmpC:\Users\admin\AppData\Local\Programs\Special K\Servlet\is-9T23L.tmpexecutable
MD5:D8BA09BBDBD044C45534ED311E8C6309
SHA256:407280D258A251C4D3409B45C5833BF5B6EA8C5EC31E5F73D8B01A8AD4D31603
6844SIHClient.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9E94643DE99F5621BC288D045BEA85DDbinary
MD5:91B35CE21C848DC81B9E58AC4629EA3A
SHA256:560F021537710F9CDD7F94067B6174F25EA29CDC0F9D75EFC16E2A33D736C3B3
6844SIHClient.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9E94643DE99F5621BC288D045BEA85DDder
MD5:04D4955134563C4BA05FCAC8B79E6CE7
SHA256:E5B466AFA3A4B3FF93E617AA5763FA45B03F2F90E88B645A0ABB18A18474CC20
6412SpecialK.tmpC:\Users\admin\AppData\Local\Programs\Special K\Servlet\SKIFsvc64.exeexecutable
MD5:D8BA09BBDBD044C45534ED311E8C6309
SHA256:407280D258A251C4D3409B45C5833BF5B6EA8C5EC31E5F73D8B01A8AD4D31603
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
52
DNS requests
30
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.131:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6844
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6844
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5920
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
2892
svchost.exe
GET
200
2.23.197.184:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
5268
CCleaner64.exe
GET
200
2.19.126.142:80
http://ncc.avast.com/ncc.txt
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
2.16.164.131:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1356
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
2.23.209.149:443
www.bing.com
Akamai International B.V.
GB
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1176
svchost.exe
40.126.32.140:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted
crl.microsoft.com
  • 2.16.164.131
  • 2.16.164.104
  • 2.16.164.122
  • 2.16.164.113
  • 2.16.164.83
  • 2.16.164.130
  • 2.16.164.99
  • 2.16.164.105
  • 2.16.164.90
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 88.221.169.152
whitelisted
www.bing.com
  • 2.23.209.149
  • 2.23.209.177
  • 2.23.209.187
  • 2.23.209.182
  • 2.23.209.133
  • 2.23.209.148
  • 2.23.209.130
  • 2.23.209.176
  • 2.23.209.140
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.140
  • 40.126.32.136
  • 40.126.32.138
  • 40.126.32.76
  • 40.126.32.68
  • 40.126.32.133
  • 20.190.160.20
  • 20.190.160.17
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Misc activity
ET INFO External IP Lookup Service in DNS Query (ip-info .ff .avast .com)
5268
CCleaner64.exe
Misc activity
ET INFO Observed External IP Lookup Domain (ip-info .ff .avast .com) in TLS SNI
Process
Message
CCleaner64.exe
[2024-12-15 15:49:32.210] [error ] [settings ] [ 5268: 5544] [000000: 0] Failed to get program directory Exception: Unable to determine program folder of product 'piriform-cc'! Code: 0x000000c0 (192)
CCleaner64.exe
[2024-12-15 15:49:32.210] [error ] [ini_access ] [ 5268: 5544] [000000: 0] Incorrect ini_accessor configuration! Fixing relative input path to avoid recursion. Input was: Setup
CCleaner64.exe
Failed to open log file 'C:\Program Files\CCleaner'
CCleaner64.exe
OnLanguage - en
CCleaner64.exe
[2024-12-15 15:49:32.834] [error ] [settings ] [ 5268: 4164] [D2EC45: 356] Failed to get program directory Exception: Unable to determine program folder of product 'piriform-cc'! Code: 0x000000c0 (192)
CCleaner64.exe
[2024-12-15 15:49:32.850] [error ] [Burger ] [ 5268: 4164] [904E07: 253] [23.2.1118.0] [BurgerReporter.cpp] [253] asw::standalone_svc::BurgerReporter::BurgerSwitch: Could not read property BURGER_SETTINGS_PANCAKE_HOSTNAME (0x00000003)
CCleaner64.exe
[2024-12-15 15:49:32.850] [error ] [Burger ] [ 5268: 4164] [904E07: 253] [23.2.1118.0] [BurgerReporter.cpp] [253] asw::standalone_svc::BurgerReporter::BurgerSwitch: Could not read property BURGER_SETTINGS_PANCAKE_HOSTNAME (0x00000003)
CCleaner64.exe
file:///tis/optimizer.tis(1131) : warning :'await' should be used only inside 'async' or 'event'
CCleaner64.exe
file:///tis/optimizer.tis(1288) : warning :'async' does not contain any 'await'
CCleaner64.exe
startCheckingLicense()
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SpecialK.exe