File name:

Prodivm.exe

Full analysis: https://app.any.run/tasks/c847dc09-4aa5-4e86-925f-d65fe32a9e90
Verdict: Malicious activity
Threats:

Crypto mining malware is a resource-intensive threat that infiltrates computers with the purpose of mining cryptocurrencies. This type of threat can be deployed either on an infected machine or a compromised website. In both cases the miner will utilize the computing power of the device and its network bandwidth.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 17:12:01
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
github
telegram
evasion
miner
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows, 2 sections
MD5:

319FAC4C11CA28FE3AD1961160E55259

SHA1:

9B993AC9726EDE452A1953D48CACD113B84CF283

SHA256:

1513D84CC84D420ABBC04411EF74D82FCAAD4AD20D2D412F982A420B4193B0C7

SSDEEP:

49152:esBQv0y7ZtNEFdZR6vLgljrKKmSM9bW8+Pm0IvSxELEhBch4N0J9uhCpKl1Cqhig:7BQv0yNbEX6vLg96STRPmPS+g0fuhyKp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • Prodivm.exe (PID: 7324)

    • Uses Task Scheduler to run other applications

      • aspnet_compiler.exe (PID: 7796)

    • MINER has been detected (SURICATA)

      • svchost.exe (PID: 2196)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • Prodivm.exe (PID: 7324)

    • Starts a Microsoft application from unusual location

      • Prodivm.exe (PID: 7324)

    • The process checks if it is being run in the virtual environment

      • aspnet_compiler.exe (PID: 7796)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • aspnet_compiler.exe (PID: 7796)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • aspnet_compiler.exe (PID: 7796)

    • Crypto Currency Mining Activity Detected

      • svchost.exe (PID: 2196)

    • Executable content was dropped or overwritten

      • aspnet_compiler.exe (PID: 7796)

    • Reads security settings of Internet Explorer

      • aspnet_compiler.exe (PID: 7796)

    • Reads the date of Windows installation

      • aspnet_compiler.exe (PID: 7796)

    • Executes application which crashes

      • aspnet_compiler.exe (PID: 7796)

  • INFO

    • Manual execution by a user

      • aspnet_compiler.exe (PID: 7796)

    • Checks supported languages

      • Prodivm.exe (PID: 7324)
      • aspnet_compiler.exe (PID: 7796)
      • AddInUtil.exe (PID: 2136)

    • Reads the computer name

      • Prodivm.exe (PID: 7324)
      • aspnet_compiler.exe (PID: 7796)
      • AddInUtil.exe (PID: 2136)

    • Reads the machine GUID from the registry

      • Prodivm.exe (PID: 7324)
      • aspnet_compiler.exe (PID: 7796)

    • Reads Environment values

      • Prodivm.exe (PID: 7324)
      • aspnet_compiler.exe (PID: 7796)

    • Disables trace logs

      • aspnet_compiler.exe (PID: 7796)

    • Creates files or folders in the user directory

      • aspnet_compiler.exe (PID: 7796)
      • WerFault.exe (PID: 5608)
      • WerFault.exe (PID: 6712)

    • Checks proxy server information

      • aspnet_compiler.exe (PID: 7796)

    • Creates files in the program directory

      • aspnet_compiler.exe (PID: 7796)

    • Reads the software policy settings

      • aspnet_compiler.exe (PID: 7796)

    • Process checks computer location settings

      • aspnet_compiler.exe (PID: 7796)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:05:14 01:24:40+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 8
CodeSize: 1043968
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x0000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 4.18.2104.5
ProductVersionNumber: 4.18.2104.5
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Microsoft Malware Protection Command Line Utility
CompanyName: Microsoft Corporation
FileDescription: Microsoft Malware Protection Command Line Utility
FileVersion: 4.18.2104.5
InternalName: Zznfkdjztj.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
LegalTrademarks: -
OriginalFileName: Zznfkdjztj.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 4.18.2104.5
AssemblyVersion: 4.18.2104.5
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
11
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start prodivm.exe no specs sppextcomobj.exe no specs slui.exe no specs aspnet_compiler.exe schtasks.exe no specs conhost.exe no specs addinutil.exe conhost.exe no specs #MINER svchost.exe werfault.exe no specs werfault.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2136C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe -opool.hashvault.pro:443 -u 4385GdKcYysbDy9ka41iHpGscHtJvcZNZ7tWyqfetbJCPwGXxBLJD7RE1oVjCZ8CZU52whodv8btgTz7SZL43ePe7ZuPNVb.mousetir -k --tlsC:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
aspnet_compiler.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
AddInUtil.exe
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\addinutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
5608C:\WINDOWS\system32\WerFault.exe -u -p 7796 -s 2472C:\Windows\System32\WerFault.exe—aspnet_compiler.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
6712C:\WINDOWS\system32\WerFault.exe -u -p 7796 -s 2216C:\Windows\System32\WerFault.exe—aspnet_compiler.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
7316\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—AddInUtil.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7324"C:\Users\admin\Desktop\Prodivm.exe" C:\Users\admin\Desktop\Prodivm.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Malware Protection Command Line Utility
Exit code:
4294967295
Version:
4.18.2104.5
Modules
Images
c:\users\admin\desktop\prodivm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
7508C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7544"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7796"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
aspnet_compiler.exe
Exit code:
3221226505
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\aspnet_compiler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
7964"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 3 /tn "MicrosoftEdgeUpdate" /tr "C:\ProgramData\WindowsNotification\driverquery.exe" /fC:\Windows\System32\schtasks.exe—aspnet_compiler.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
Total events
7 627
Read events
7 613
Write events
14
Delete events
0

Modification events

(PID) Process:(7796) aspnet_compiler.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\aspnet_compiler_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7796) aspnet_compiler.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\aspnet_compiler_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7796) aspnet_compiler.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\aspnet_compiler_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(7796) aspnet_compiler.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\aspnet_compiler_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(7796) aspnet_compiler.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\aspnet_compiler_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(7796) aspnet_compiler.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\aspnet_compiler_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(7796) aspnet_compiler.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\aspnet_compiler_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(7796) aspnet_compiler.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\aspnet_compiler_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7796) aspnet_compiler.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\aspnet_compiler_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7796) aspnet_compiler.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\aspnet_compiler_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
1
Suspicious files
5
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
5608WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_aspnet_compiler._c07f553560a7b527d2dfa3e6c369f8eca0c5b1c6_873cb6f7_60aee453-b3af-4b07-bade-9de07ab0ca28\Report.wer —
MD5:—
SHA256:—
5608WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\aspnet_compiler.exe.7796.dmp —
MD5:—
SHA256:—
6712WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_aspnet_compiler._189b1d7d9cb0e879c236469d889c42e53d4ebf_873cb6f7_4d6bae2e-6e57-4689-ab55-06b616f652bd\Report.wer —
MD5:—
SHA256:—
6712WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\aspnet_compiler.exe(1).7796.dmp —
MD5:—
SHA256:—
5608WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER413D.tmp.WERInternalMetadata.xmlbinary
MD5:6E17CC4B6BCD155E395CFC9A7A31A29B
SHA256:3D2A5F7B0AF121CE77BDC299C4EBCD2746D0A601AA04680E4AB48D056FAEA9FE
7796aspnet_compiler.exeC:\ProgramData\WindowsNotification\driverquery.exeexecutable
MD5:D1BB2938C1FE863E49EADA61FDF239D4
SHA256:4A27D421D67E3DDF430397E64B2B200DC98C08FA974AD0E8D102D45DD6AC1FED
5608WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER3DC1.tmp.dmpbinary
MD5:25E5935A08D54359FC9F31F41F88F23A
SHA256:197EA271F22FB35A1F50B97F8335194F8C663D34DB5DC6A239E5D3F03DA4B305
6712WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER5283.tmp.WERInternalMetadata.xmlbinary
MD5:76C028277FE649C2D65B423EB8CFCF18
SHA256:966B7810E60AEC37C46C217E11D6E0FDF4A36BB0F4492C4E5AEECC37355833E1
5608WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER416D.tmp.xmlxml
MD5:9FBB80C17FBFD3C07D1A366E4159581B
SHA256:783988ACF998E1A826901B250BB70577C09946ACB9CE9EE73851279C6FCE3DE2
7796aspnet_compiler.exeC:\Users\admin\AppData\Local\WindowsUpdate\screen.jpgbinary
MD5:5583954BE49EB79172B1B07FBD00B38C
SHA256:F3F4417DF0AB784D44D264CCAF40AAD6D8E3EC079D7BC72554FE64665D2C19B0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
29
DNS requests
19
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6032
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6032
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
5496
MoUsoCoreWorker.exe
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.19.11.120
  • 2.19.11.105
whitelisted
google.com
  • 142.250.185.142
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 95.101.149.131
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.32.68
  • 20.190.160.64
  • 20.190.160.22
  • 20.190.160.130
  • 20.190.160.20
  • 20.190.160.66
  • 40.126.32.74
  • 20.190.160.2
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
github.com
  • 140.82.121.3
whitelisted
raw.githubusercontent.com
  • 185.199.108.133
  • 185.199.110.133
  • 185.199.111.133
  • 185.199.109.133
whitelisted
api.ipify.org
  • 104.26.12.205
  • 104.26.13.205
  • 172.67.74.152
shared

Threats

PID
Process
Class
Message
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
2196
svchost.exe
Misc activity
SUSPICIOUS [ANY.RUN] Possible sending an external IP address to Telegram
2196
svchost.exe
Misc activity
ET HUNTING Telegram API Domain in DNS Lookup
2196
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
7796
aspnet_compiler.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
7796
aspnet_compiler.exe
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
7796
aspnet_compiler.exe
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
7796
aspnet_compiler.exe
Misc activity
ET HUNTING Telegram API Certificate Observed
7796
aspnet_compiler.exe
Misc activity
ET HUNTING Telegram API Certificate Observed
2196
svchost.exe
Crypto Currency Mining Activity Detected
ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Prodivm.exe