File name:

fawkeshub.exe

Full analysis: https://app.any.run/tasks/3c50a063-e98f-4b1e-b337-b7b71dc6fa10
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: April 15, 2025, 21:50:56
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
casbaneiro
loader
qrcode
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

5F99BA1F8E506F00E060E293D54DF697

SHA1:

D733490E1397705FBCA76EDA0299B443D52A6218

SHA256:

190011E727ED67FB839CC08808339070351C6A3BB906D869781A6EA9D27BCC5B

SSDEEP:

6144:mSD/6X6gsLEif5o5+HevGX5wtWhwZoIRMWmdmWtHVoDBl:bCX6gsLEiRo5w8gc8wNR6a7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • fawkeshub.exe (PID: 4172)
      • fawkeshub.exe (PID: 1164)
      • Fawkes Hub_temp_installer.exe (PID: 6576)
      • launcher.exe (PID: 3240)
      • launcher.exe (PID: 2100)
      • launcher.exe (PID: 6728)
      • launcher.exe (PID: 3896)
      • launcher.exe (PID: 5588)
      • LauncherElectron.exe (PID: 5364)
      • launcher.exe (PID: 5556)
      • launcher.exe (PID: 472)
      • installer.exe (PID: 3016)
      • launcher.exe (PID: 1004)
      • launcher.exe (PID: 6248)
      • LauncherElectron.exe (PID: 5512)
      • launcher.exe (PID: 5304)

    • CASBANEIRO has been detected

      • cmd.exe (PID: 3888)

    • Changes the autorun value in the registry

      • rundll32.exe (PID: 3796)
      • ie4uinit.exe (PID: 5800)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • fawkeshub.exe (PID: 1164)
      • Fawkes Hub_temp_installer.exe (PID: 6576)
      • installer.exe (PID: 3016)

    • The process creates files with name similar to system file names

      • fawkeshub.exe (PID: 1164)
      • Fawkes Hub_temp_installer.exe (PID: 6576)
      • installer.exe (PID: 3016)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 5116)
      • cmd.exe (PID: 2152)
      • cmd.exe (PID: 6820)

    • Writes data into a file (POWERSHELL)

      • powershell.exe (PID: 3020)
      • powershell.exe (PID: 4120)
      • powershell.exe (PID: 728)

    • Reads security settings of Internet Explorer

      • fawkeshub.exe (PID: 1164)
      • Fawkes Hub_temp_installer.exe (PID: 6576)
      • elevate.exe (PID: 2340)
      • devcon.exe (PID: 3396)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 5116)
      • cmd.exe (PID: 2152)
      • cmd.exe (PID: 6820)

    • Application launched itself

      • cmd.exe (PID: 3888)
      • launcher.exe (PID: 3240)
      • launcher.exe (PID: 5556)

    • Starts CMD.EXE for commands execution

      • fawkeshub.exe (PID: 1164)
      • cmd.exe (PID: 3888)
      • Fawkes Hub_temp_installer.exe (PID: 6576)
      • launcher.exe (PID: 5556)

    • There is functionality for taking screenshot (YARA)

      • fawkeshub.exe (PID: 1164)
      • Fawkes Hub_temp_installer.exe (PID: 6576)

    • Executable content was dropped or overwritten

      • Fawkes Hub_temp_installer.exe (PID: 6576)
      • vc_redist.x64.exe (PID: 4528)
      • vc_redist.x64.exe (PID: 6252)
      • fawkeshub.exe (PID: 1164)
      • installer.exe (PID: 3016)
      • vc_redist.x64.exe (PID: 5556)
      • setup-kernel.exe (PID: 4776)
      • vc_redist.x64.exe (PID: 4212)
      • setup-kernel.tmp (PID: 3332)
      • expand.exe (PID: 2392)
      • expand.exe (PID: 7036)
      • rundll32.exe (PID: 3796)
      • drvinst.exe (PID: 1004)
      • devcon.exe (PID: 3396)
      • drvinst.exe (PID: 4996)
      • LauncherElectron.exe (PID: 5512)

    • Gets path to any of the special folders (POWERSHELL)

      • powershell.exe (PID: 4120)
      • powershell.exe (PID: 3020)
      • powershell.exe (PID: 728)

    • Process drops legitimate windows executable

      • Fawkes Hub_temp_installer.exe (PID: 6576)
      • vc_redist.x64.exe (PID: 6252)
      • installer.exe (PID: 3016)
      • vc_redist.x64.exe (PID: 4212)
      • setup-kernel.tmp (PID: 3332)
      • LauncherElectron.exe (PID: 5512)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 5304)

    • Starts a Microsoft application from unusual location

      • vc_redist.x64.exe (PID: 4528)
      • vc_redist.x64.exe (PID: 5556)

    • Searches for installed software

      • vc_redist.x64.exe (PID: 4528)
      • installer.exe (PID: 3016)
      • vc_redist.x64.exe (PID: 5556)

    • Drops 7-zip archiver for unpacking

      • Fawkes Hub_temp_installer.exe (PID: 6576)
      • installer.exe (PID: 3016)

    • Creates a software uninstall entry

      • fawkeshub.exe (PID: 1164)
      • Fawkes Hub_temp_installer.exe (PID: 6576)
      • installer.exe (PID: 3016)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • Fawkes Hub_temp_installer.exe (PID: 6576)

    • The process drops C-runtime libraries

      • installer.exe (PID: 3016)

    • Reads the Windows owner or organization settings

      • setup-kernel.tmp (PID: 3332)

    • Drops a system driver (possible attempt to evade defenses)

      • expand.exe (PID: 2392)
      • expand.exe (PID: 7036)
      • drvinst.exe (PID: 1004)
      • rundll32.exe (PID: 3796)
      • devcon.exe (PID: 3396)
      • drvinst.exe (PID: 4996)

    • Adds/modifies Windows certificates

      • certutil.exe (PID: 6248)

    • Uses RUNDLL32.EXE to load library

      • setup-kernel.tmp (PID: 3332)

    • Creates files in the driver directory

      • drvinst.exe (PID: 1004)
      • drvinst.exe (PID: 4996)

    • Creates or modifies Windows services

      • drvinst.exe (PID: 1324)
      • drvinst.exe (PID: 2692)

    • Starts SC.EXE for service management

      • setup-kernel.tmp (PID: 3332)

    • Windows service management via SC.EXE

      • sc.exe (PID: 776)

    • Image mount has been detect

      • drvinst.exe (PID: 2692)

  • INFO

    • Reads the computer name

      • fawkeshub.exe (PID: 1164)
      • pwsh.exe (PID: 1324)
      • pwsh.exe (PID: 4212)
      • vc_redist.x64.exe (PID: 4528)
      • launcher.exe (PID: 3240)
      • launcher.exe (PID: 3896)
      • Fawkes Hub_temp_installer.exe (PID: 6576)
      • LauncherElectron.exe (PID: 5364)
      • elevate.exe (PID: 2340)
      • installer.exe (PID: 3016)
      • pwsh.exe (PID: 2908)
      • vc_redist.x64.exe (PID: 5556)
      • launcher.exe (PID: 6728)
      • setup-kernel.tmp (PID: 3332)
      • drvinst.exe (PID: 1004)
      • drvinst.exe (PID: 1324)
      • devcon.exe (PID: 3396)
      • drvinst.exe (PID: 2692)
      • drvinst.exe (PID: 4996)
      • launcher.exe (PID: 5556)
      • launcher.exe (PID: 1004)
      • launcher.exe (PID: 6248)
      • LauncherElectron.exe (PID: 5512)

    • Manual execution by a user

      • cmd.exe (PID: 5116)
      • cmd.exe (PID: 3240)
      • cmd.exe (PID: 4920)
      • cmd.exe (PID: 2152)
      • launcher.exe (PID: 3240)
      • cmd.exe (PID: 4996)
      • cmd.exe (PID: 6820)
      • launcher.exe (PID: 5556)

    • Checks supported languages

      • fawkeshub.exe (PID: 1164)
      • Fawkes Hub_temp_installer.exe (PID: 6576)
      • pwsh.exe (PID: 4212)
      • vc_redist.x64.exe (PID: 6252)
      • vc_redist.x64.exe (PID: 4528)
      • pwsh.exe (PID: 1324)
      • launcher.exe (PID: 3240)
      • launcher.exe (PID: 2100)
      • launcher.exe (PID: 6728)
      • launcher.exe (PID: 3896)
      • launcher.exe (PID: 5588)
      • LauncherElectron.exe (PID: 5364)
      • installer.exe (PID: 3016)
      • elevate.exe (PID: 2340)
      • crashpad_handler.exe (PID: 1660)
      • pwsh.exe (PID: 2908)
      • vc_redist.x64.exe (PID: 4212)
      • vc_redist.x64.exe (PID: 5556)
      • setup-kernel.exe (PID: 4776)
      • setup-kernel.tmp (PID: 3332)
      • _setup64.tmp (PID: 6136)
      • expand.exe (PID: 2392)
      • expand.exe (PID: 7036)
      • drvinst.exe (PID: 1004)
      • drvinst.exe (PID: 1324)
      • devcon.exe (PID: 3396)
      • drvinst.exe (PID: 4996)
      • drvinst.exe (PID: 2692)
      • launcher.exe (PID: 472)
      • launcher.exe (PID: 6248)
      • launcher.exe (PID: 1004)
      • launcher.exe (PID: 5556)
      • launcher.exe (PID: 5304)
      • LauncherElectron.exe (PID: 5512)
      • crashpad_handler.exe (PID: 6068)

    • Create files in a temporary directory

      • fawkeshub.exe (PID: 1164)
      • Fawkes Hub_temp_installer.exe (PID: 6576)
      • vc_redist.x64.exe (PID: 4528)
      • launcher.exe (PID: 3240)
      • vc_redist.x64.exe (PID: 5556)
      • setup-kernel.exe (PID: 4776)
      • setup-kernel.tmp (PID: 3332)
      • rundll32.exe (PID: 3796)
      • devcon.exe (PID: 3396)
      • installer.exe (PID: 3016)
      • launcher.exe (PID: 5556)

    • Checks proxy server information

      • fawkeshub.exe (PID: 1164)
      • Fawkes Hub_temp_installer.exe (PID: 6576)
      • launcher.exe (PID: 3240)
      • LauncherElectron.exe (PID: 5364)
      • launcher.exe (PID: 5556)
      • slui.exe (PID: 2432)
      • LauncherElectron.exe (PID: 5512)

    • Creates files in the program directory

      • powershell.exe (PID: 3020)
      • powershell.exe (PID: 728)
      • setup-kernel.tmp (PID: 3332)
      • expand.exe (PID: 2392)
      • expand.exe (PID: 7036)

    • The sample compiled with english language support

      • fawkeshub.exe (PID: 1164)
      • Fawkes Hub_temp_installer.exe (PID: 6576)
      • vc_redist.x64.exe (PID: 6252)
      • vc_redist.x64.exe (PID: 4528)
      • installer.exe (PID: 3016)
      • vc_redist.x64.exe (PID: 5556)
      • vc_redist.x64.exe (PID: 4212)
      • setup-kernel.tmp (PID: 3332)
      • expand.exe (PID: 2392)
      • devcon.exe (PID: 3396)
      • drvinst.exe (PID: 4996)
      • LauncherElectron.exe (PID: 5512)

    • Process checks computer location settings

      • pwsh.exe (PID: 1324)
      • pwsh.exe (PID: 4212)
      • launcher.exe (PID: 3240)
      • launcher.exe (PID: 5588)
      • pwsh.exe (PID: 2908)
      • elevate.exe (PID: 2340)
      • launcher.exe (PID: 5556)
      • launcher.exe (PID: 5304)

    • Reads the machine GUID from the registry

      • fawkeshub.exe (PID: 1164)
      • Fawkes Hub_temp_installer.exe (PID: 6576)
      • launcher.exe (PID: 3240)
      • setup-kernel.tmp (PID: 3332)
      • expand.exe (PID: 2392)
      • expand.exe (PID: 7036)
      • drvinst.exe (PID: 1004)
      • drvinst.exe (PID: 4996)
      • launcher.exe (PID: 5556)
      • devcon.exe (PID: 3396)

    • Reads the software policy settings

      • fawkeshub.exe (PID: 1164)
      • Fawkes Hub_temp_installer.exe (PID: 6576)
      • slui.exe (PID: 1672)
      • drvinst.exe (PID: 1004)
      • devcon.exe (PID: 3396)
      • drvinst.exe (PID: 4996)
      • slui.exe (PID: 2432)
      • LauncherElectron.exe (PID: 5512)

    • Creates files or folders in the user directory

      • fawkeshub.exe (PID: 1164)
      • Fawkes Hub_temp_installer.exe (PID: 6576)
      • launcher.exe (PID: 3240)
      • launcher.exe (PID: 2100)
      • launcher.exe (PID: 5588)
      • launcher.exe (PID: 3896)
      • LauncherElectron.exe (PID: 5364)
      • crashpad_handler.exe (PID: 1660)
      • installer.exe (PID: 3016)
      • ie4uinit.exe (PID: 5800)
      • launcher.exe (PID: 472)
      • launcher.exe (PID: 5556)
      • LauncherElectron.exe (PID: 5512)
      • launcher.exe (PID: 1004)

    • Reads Environment values

      • launcher.exe (PID: 3240)
      • launcher.exe (PID: 5588)
      • launcher.exe (PID: 5556)
      • launcher.exe (PID: 5304)

    • Reads product name

      • launcher.exe (PID: 3240)
      • launcher.exe (PID: 5588)
      • launcher.exe (PID: 5556)
      • launcher.exe (PID: 5304)

    • Reads CPU info

      • LauncherElectron.exe (PID: 5364)
      • LauncherElectron.exe (PID: 5512)

    • Creates a software uninstall entry

      • setup-kernel.tmp (PID: 3332)

    • Reads the time zone

      • runonce.exe (PID: 516)

    • Reads security settings of Internet Explorer

      • runonce.exe (PID: 516)
      • ie4uinit.exe (PID: 5800)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:01:30 03:57:48+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 186368
UninitializedDataSize: 2048
EntryPoint: 0x338f
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
221
Monitored processes
81
Malicious processes
18
Suspicious processes
14

Behavior graph

Click at the process to see the details
start fawkeshub.exe cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs pwsh.exe no specs sppextcomobj.exe no specs slui.exe #CASBANEIRO cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs fawkes hub_temp_installer.exe cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs pwsh.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs vc_redist.x64.exe vc_redist.x64.exe netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs launcher.exe launcher.exe no specs launcher.exe no specs launcher.exe launcher.exe no specs launcherelectron.exe conhost.exe no specs slui.exe crashpad_handler.exe no specs elevate.exe no specs installer.exe cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs pwsh.exe no specs vc_redist.x64.exe vc_redist.x64.exe setup-kernel.exe setup-kernel.tmp _setup64.tmp no specs conhost.exe no specs expand.exe conhost.exe no specs expand.exe conhost.exe no specs certutil.exe no specs conhost.exe no specs rundll32.exe drvinst.exe drvinst.exe no specs runonce.exe no specs grpconv.exe no specs sc.exe no specs conhost.exe no specs devcon.exe conhost.exe no specs drvinst.exe drvinst.exe no specs launcher.exe launcher.exe no specs cmd.exe no specs conhost.exe no specs ie4uinit.exe launcher.exe no specs launcher.exe launcher.exe no specs launcherelectron.exe conhost.exe no specs crashpad_handler.exe no specs fawkeshub.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
472"C:\Fawkes Hub\launcher.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Roaming\Fawkes Hub" /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Roaming\Fawkes Hub\Crashpad" --url=https://sentry.xsolla.com/api/63/minidump/?sentry_key=caab4afe5abf4707808a52afbe2d46c4 "--annotation=_productName=Fawkes Hub" --annotation=_version=3.32.2-latest.98 --annotation=plat=Win64 --annotation=prod=Electron --annotation=sentry___initialScope={} --annotation=ver=27.1.3 --initial-client-data=0x544,0x548,0x54c,0x540,0x550,0x7ff6a887a9e0,0x7ff6a887a9f0,0x7ff6a887aa00C:\Fawkes Hub\launcher.exe—launcher.exe
User:
admin
Company:
Electron launcher
Integrity Level:
MEDIUM
Description:
Fawkes Hub
Version:
3.32.2-latest.98
Modules
Images
c:\fawkes hub\launcher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\fawkes hub\ffmpeg.dll
516"C:\WINDOWS\system32\runonce.exe" -rC:\Windows\System32\runonce.exe—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Run Once Wrapper
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\runonce.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\gdi32.dll
540\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
616\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
728powershell -NoProfile -Command "$ProgramData = [System.Environment]::GetFolderPath('CommonApplicationData'); $UserProfile = [System.Environment]::GetFolderPath('UserProfile'); [System.IO.File]::WriteAllText([System.IO.Path]::Combine($ProgramData, 'user_app_data_path.txt'), $UserProfile, [System.Text.Encoding]::Unicode)"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
776"C:\WINDOWS\system32\sc.exe" start dxfmC:\Windows\System32\sc.exe—setup-kernel.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
900\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1004DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{a95c0e78-5869-6f4d-a073-1e14dd1119ee}\dxfm.inf" "9" "449085c6f" "00000000000001CC" "WinSta0\Default" "00000000000001D8" "208" "C:\ProgramData\DACS\ROCKIT\kernel\dxfm"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
1004"C:\Fawkes Hub\launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\admin\AppData\Roaming\Fawkes Hub" --mojo-platform-channel-handle=2432 --field-trial-handle=2032,i,5119714882223497698,2223303083872420051,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8C:\Fawkes Hub\launcher.exe
launcher.exe
User:
admin
Company:
Electron launcher
Integrity Level:
MEDIUM
Description:
Fawkes Hub
Version:
3.32.2-latest.98
Modules
Images
c:\fawkes hub\launcher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1116C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
35 133
Read events
35 004
Write events
85
Delete events
44

Modification events

(PID) Process:(1164) fawkeshub.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1164) fawkeshub.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1164) fawkeshub.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6576) Fawkes Hub_temp_installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6576) Fawkes Hub_temp_installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6576) Fawkes Hub_temp_installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6576) Fawkes Hub_temp_installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\XSOLLA\Fawkes Hub_Launcher
Operation:writeName:uuid
Value:
43FB4FBC-E996-4364-A3FC-849177A76E7F
(PID) Process:(6576) Fawkes Hub_temp_installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\a00f76e1-bf91-4a74-9141-b1ad5ae9d955
Operation:writeName:InstallLocation
Value:
C:\Fawkes Hub
(PID) Process:(6576) Fawkes Hub_temp_installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\a00f76e1-bf91-4a74-9141-b1ad5ae9d955
Operation:writeName:DisplayName
Value:
Fawkes Hub
(PID) Process:(6576) Fawkes Hub_temp_installer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\a00f76e1-bf91-4a74-9141-b1ad5ae9d955
Operation:writeName:UninstallString
Value:
C:\Fawkes Hub\uninst.exe
Executable files
121
Suspicious files
198
Text files
184
Unknown types
3

Dropped files

PID
Process
Filename
Type
1164fawkeshub.exeC:\Users\admin\AppData\Local\Temp\nssB067.tmp\http.headersbinary
MD5:2916BED25F689776690210F269BEFD91
SHA256:E59D07B5CAA1D5624CD7958D5A1352351A49D6B1E0A5E6EDC78CF7CF05570BD9
1324pwsh.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_utagj30c.2px.ps1text
MD5:42FBC6B1285D8E97519C85118A3E43EE
SHA256:F84FFC5B46DC4C29402D256966B5A15FD311D2A36B1679705568548E0AECD1EF
1164fawkeshub.exeC:\Users\admin\AppData\Local\Temp\nssB067.tmp\INetC.dllexecutable
MD5:40D7ECA32B2F4D29DB98715DD45BFAC5
SHA256:85E03805F90F72257DD41BFDAA186237218BBB0EC410AD3B6576A88EA11DCCB9
1164fawkeshub.exeC:\Users\admin\AppData\Local\Temp\nssB067.tmp\System.dllexecutable
MD5:75ED96254FBF894E42058062B4B4F0D1
SHA256:A632D74332B3F08F834C732A103DAFEB09A540823A2217CA7F49159755E8F1D7
1164fawkeshub.exeC:\Users\admin\AppData\Local\Temp\Fawkes Hub_install.logtext
MD5:00292A0941054A36461E9E35ED9764D5
SHA256:B08874AA9BA41F3E59A4641B9557174B89CEBC612F0F0B2C2A200B18568F7203
1164fawkeshub.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_427CDB1C9AAC2BAE6B426DB11F126FA2binary
MD5:6DB14AF15F2C9F3BE44B4C7E1C8FEEFF
SHA256:BF892285881EE013772B10C8EA79FB1E530D4EF1C5A84A4EBBDEC43D38BB53E6
1164fawkeshub.exeC:\Users\admin\AppData\Local\Temp\nssB067.tmp\LangDLL.dllexecutable
MD5:3DD80DFF583544514EEB3A5ED851A519
SHA256:86CFF5EACA76C49F924CB123D242FDCFD45AB99C4B638D3B8F4A8CFB1970AB5B
1164fawkeshub.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\installer[1].exe —
MD5:—
SHA256:—
1164fawkeshub.exeC:\Users\admin\AppData\Local\Temp\nssB067.tmp\Fawkes Hub_temp_installer.exe —
MD5:—
SHA256:—
1164fawkeshub.exeC:\Users\admin\AppData\Local\Temp\nssB067.tmp\nsJSON.dllexecutable
MD5:F4D89D9A2A3E2F164AEA3E93864905C9
SHA256:64B3EFDF3DE54E338D4DB96B549A7BDB7237BB88A82A0A63AEF570327A78A6FB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
116
DNS requests
68
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1164
fawkeshub.exe
HEAD
200
92.223.124.62:80
http://installer.launcher.xsolla.com/xlauncher-builds/xsolla-launcher-update/10621/bin/installer.exe
unknown
—
—
whitelisted
1164
fawkeshub.exe
GET
200
2.17.190.73:80
http://status.thawte.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRzhKfQYsAHQZZDzb8RtQ5PgsTjQQQUpYz%2BMszrDyzUGcYIuAAkiF3DxbcCEAt4hX8nJJEIporirp%2FFaGA%3D
unknown
—
—
whitelisted
1164
fawkeshub.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAkO6MXeW%2Fpi0q4v9wl8SFc%3D
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
1164
fawkeshub.exe
GET
200
2.16.206.143:80
http://e6.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBTUejiAQejpjQc4fOz2ttjyD6VkMQQUDcXM%2FZvuFAWhTDCCpT5eisNYCdICEgXjpy1dEj%2FifrNLzeCxqLrhVg%3D%3D
unknown
—
—
whitelisted
6972
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1164
fawkeshub.exe
GET
200
2.16.252.233:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
6972
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
1164
fawkeshub.exe
92.223.124.62:80
installer.launcher.xsolla.com
G-Core Labs S.A.
DE
whitelisted
6544
svchost.exe
40.126.31.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1164
fawkeshub.exe
185.30.21.52:443
xmts.xsolla.com
Xsolla (USA), Inc
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
whitelisted
google.com
  • 142.250.186.174
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
installer.launcher.xsolla.com
  • 92.223.124.62
whitelisted
login.live.com
  • 40.126.31.0
  • 20.190.159.129
  • 20.190.159.4
  • 40.126.31.2
  • 40.126.31.73
  • 20.190.159.128
  • 20.190.159.75
  • 40.126.31.71
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
xmts.xsolla.com
  • 185.30.21.52
whitelisted
status.thawte.com
  • 2.17.190.73
whitelisted
x1.c.lencr.org
  • 2.16.252.233
whitelisted

Threats

PID
Process
Class
Message
1164
fawkeshub.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
fawkeshub.exe