File name:

wireguard.exe

Full analysis: https://app.any.run/tasks/c9feb9c2-7dce-45ee-a0a3-d62b3adab0ec
Verdict: Malicious activity
Threats:

Tycoon 2FA is a phishing-as-a-service (PhaaS) platform designed to bypass multi-factor authentication (MFA) protections, particularly targeting Microsoft 365 and Gmail accounts. Its advanced evasion techniques and modular architecture make it a significant threat to organizations relying on MFA for security.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 13:03:13
OS: Windows 11 Professional (build: 22000, 64 bit)
Tags:
golang
smtp
phishing
apt
darkhydrus
storm1747
tycoon
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows, 12 sections
MD5:

A9EFC986F53B7808DA07422528B5541F

SHA1:

94EBFE425F164C08041C256896BA4482171A1024

SHA256:

1CEA3D9EFA3A875F105ED4C628D082BC34ABC139FA2EE9C290D77090BCE843B3

SSDEEP:

98304:o01pRAhKVEI0ZZl8JlLQClUSEJs4T08z/kDRHzPaOhozLWVBmZdsloxUhPtpKXM+:yQytGu7FfZEtH8icxu2Ya

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • wireguard.exe (PID: 1172)
      • wireguard.exe (PID: 5672)
      • wireguard.exe (PID: 5104)
      • wireguard.exe (PID: 508)
      • wireguard.exe (PID: 1692)
      • wireguard.exe (PID: 3656)
      • wireguard.exe (PID: 5224)
      • wireguard.exe (PID: 2348)
      • wireguard.exe (PID: 1660)
      • wireguard.exe (PID: 616)
      • wireguard.exe (PID: 5088)
      • wireguard.exe (PID: 3704)
      • wireguard.exe (PID: 5008)
      • wireguard.exe (PID: 5116)
      • wireguard.exe (PID: 5656)
      • wireguard.exe (PID: 1800)
      • wireguard.exe (PID: 2592)
      • wireguard.exe (PID: 2524)
      • wireguard.exe (PID: 2472)
      • wireguard.exe (PID: 3568)
      • wireguard.exe (PID: 2560)
      • wireguard.exe (PID: 4656)
      • wireguard.exe (PID: 5252)
      • wireguard.exe (PID: 4564)
      • wireguard.exe (PID: 4616)
      • wireguard.exe (PID: 4048)
      • wireguard.exe (PID: 3460)
      • wireguard.exe (PID: 6396)
      • wireguard.exe (PID: 6732)
      • wireguard.exe (PID: 7096)
      • wireguard.exe (PID: 2448)
      • wireguard.exe (PID: 6320)

    • PHISHING has been detected (SURICATA)

      • svchost.exe (PID: 1664)

  • SUSPICIOUS

    • Uses WMIC.EXE to obtain BIOS management information

      • cmd.exe (PID: 5088)
      • cmd.exe (PID: 1164)
      • cmd.exe (PID: 1216)
      • cmd.exe (PID: 3424)
      • cmd.exe (PID: 2336)
      • cmd.exe (PID: 2800)
      • cmd.exe (PID: 5220)
      • cmd.exe (PID: 3984)
      • cmd.exe (PID: 5312)
      • cmd.exe (PID: 2612)
      • cmd.exe (PID: 1216)
      • cmd.exe (PID: 1856)
      • cmd.exe (PID: 2592)
      • cmd.exe (PID: 1560)
      • cmd.exe (PID: 4424)
      • cmd.exe (PID: 4916)
      • cmd.exe (PID: 3356)
      • cmd.exe (PID: 4136)
      • cmd.exe (PID: 1784)
      • cmd.exe (PID: 4916)
      • cmd.exe (PID: 3532)
      • cmd.exe (PID: 5580)
      • cmd.exe (PID: 1984)
      • cmd.exe (PID: 5300)
      • cmd.exe (PID: 2964)
      • cmd.exe (PID: 4908)
      • cmd.exe (PID: 2840)
      • cmd.exe (PID: 6764)
      • cmd.exe (PID: 5360)
      • cmd.exe (PID: 6428)
      • cmd.exe (PID: 6492)
      • cmd.exe (PID: 7128)

    • Reads the Internet Settings

      • WMIC.exe (PID: 1304)
      • WMIC.exe (PID: 4788)
      • WMIC.exe (PID: 4580)
      • wireguard.exe (PID: 1172)
      • WMIC.exe (PID: 3976)
      • WMIC.exe (PID: 5952)
      • WMIC.exe (PID: 2440)
      • WMIC.exe (PID: 5212)
      • WMIC.exe (PID: 2864)
      • WMIC.exe (PID: 4504)
      • WMIC.exe (PID: 3324)
      • WMIC.exe (PID: 5860)
      • WMIC.exe (PID: 4616)
      • WMIC.exe (PID: 5128)
      • WMIC.exe (PID: 1988)
      • WMIC.exe (PID: 3520)
      • WMIC.exe (PID: 4680)
      • WMIC.exe (PID: 2996)
      • WMIC.exe (PID: 2424)
      • WMIC.exe (PID: 1228)
      • WMIC.exe (PID: 920)
      • WMIC.exe (PID: 5664)
      • WMIC.exe (PID: 2276)
      • WMIC.exe (PID: 4292)
      • WMIC.exe (PID: 5952)
      • WMIC.exe (PID: 5368)
      • WMIC.exe (PID: 5452)
      • WMIC.exe (PID: 3056)
      • WMIC.exe (PID: 4128)

    • Uses WMIC.EXE to obtain physical disk drive information

      • cmd.exe (PID: 1952)
      • cmd.exe (PID: 2104)
      • cmd.exe (PID: 1296)
      • cmd.exe (PID: 3708)
      • cmd.exe (PID: 600)
      • cmd.exe (PID: 4012)
      • cmd.exe (PID: 5888)
      • cmd.exe (PID: 2524)
      • cmd.exe (PID: 5860)
      • cmd.exe (PID: 5656)
      • cmd.exe (PID: 3700)
      • cmd.exe (PID: 2740)
      • cmd.exe (PID: 3796)
      • cmd.exe (PID: 5580)
      • cmd.exe (PID: 4012)
      • cmd.exe (PID: 4124)
      • cmd.exe (PID: 1216)
      • cmd.exe (PID: 3700)
      • cmd.exe (PID: 5180)
      • cmd.exe (PID: 3700)
      • cmd.exe (PID: 3544)
      • cmd.exe (PID: 3872)
      • cmd.exe (PID: 4268)
      • cmd.exe (PID: 2112)
      • cmd.exe (PID: 5580)
      • cmd.exe (PID: 3984)
      • cmd.exe (PID: 3460)
      • cmd.exe (PID: 6192)
      • cmd.exe (PID: 6864)
      • cmd.exe (PID: 6528)
      • cmd.exe (PID: 6588)
      • cmd.exe (PID: 6184)

    • Starts CMD.EXE for commands execution

      • wireguard.exe (PID: 1172)
      • wireguard.exe (PID: 5672)
      • wireguard.exe (PID: 5104)
      • wireguard.exe (PID: 508)
      • wireguard.exe (PID: 1692)
      • wireguard.exe (PID: 3656)
      • wireguard.exe (PID: 5224)
      • wireguard.exe (PID: 1660)
      • wireguard.exe (PID: 2348)
      • wireguard.exe (PID: 616)
      • wireguard.exe (PID: 5116)
      • wireguard.exe (PID: 3704)
      • wireguard.exe (PID: 5008)
      • wireguard.exe (PID: 5088)
      • wireguard.exe (PID: 5656)
      • wireguard.exe (PID: 1800)
      • wireguard.exe (PID: 2592)
      • wireguard.exe (PID: 3568)
      • wireguard.exe (PID: 2472)
      • wireguard.exe (PID: 2524)
      • wireguard.exe (PID: 4656)
      • wireguard.exe (PID: 5252)
      • wireguard.exe (PID: 4564)
      • wireguard.exe (PID: 2560)
      • wireguard.exe (PID: 4048)
      • wireguard.exe (PID: 3460)
      • wireguard.exe (PID: 4616)
      • wireguard.exe (PID: 6732)
      • wireguard.exe (PID: 6396)
      • wireguard.exe (PID: 2448)
      • wireguard.exe (PID: 6320)
      • wireguard.exe (PID: 7096)

    • Uses WMIC.EXE to obtain CPU information

      • cmd.exe (PID: 3500)
      • cmd.exe (PID: 4988)
      • cmd.exe (PID: 2344)
      • cmd.exe (PID: 2116)
      • cmd.exe (PID: 1560)
      • cmd.exe (PID: 4712)
      • cmd.exe (PID: 444)
      • cmd.exe (PID: 6124)
      • cmd.exe (PID: 2448)
      • cmd.exe (PID: 5580)
      • cmd.exe (PID: 1904)
      • cmd.exe (PID: 3416)
      • cmd.exe (PID: 708)
      • cmd.exe (PID: 3356)
      • cmd.exe (PID: 1840)
      • cmd.exe (PID: 1096)
      • cmd.exe (PID: 4088)
      • cmd.exe (PID: 3808)
      • cmd.exe (PID: 2664)
      • cmd.exe (PID: 2664)
      • cmd.exe (PID: 5580)
      • cmd.exe (PID: 4908)
      • cmd.exe (PID: 3552)
      • cmd.exe (PID: 1480)
      • cmd.exe (PID: 5932)
      • cmd.exe (PID: 4396)
      • cmd.exe (PID: 6292)
      • cmd.exe (PID: 6632)
      • cmd.exe (PID: 6968)
      • cmd.exe (PID: 3544)
      • cmd.exe (PID: 6228)
      • cmd.exe (PID: 6708)

    • Reads the date of Windows installation

      • wireguard.exe (PID: 1172)

    • Reads security settings of Internet Explorer

      • wireguard.exe (PID: 1172)

    • Application launched itself

      • wireguard.exe (PID: 1172)

    • Connects to SMTP port

      • wireguard.exe (PID: 5672)

  • INFO

    • The sample compiled with english language support

      • wireguard.exe (PID: 1172)

    • Drops encrypted JS script (Microsoft Script Encoder)

      • wireguard.exe (PID: 1172)
      • wireguard.exe (PID: 5672)
      • wireguard.exe (PID: 5104)
      • wireguard.exe (PID: 508)
      • wireguard.exe (PID: 1692)
      • wireguard.exe (PID: 3656)
      • wireguard.exe (PID: 5224)
      • wireguard.exe (PID: 1660)
      • wireguard.exe (PID: 2348)
      • wireguard.exe (PID: 616)

    • Checks supported languages

      • wireguard.exe (PID: 1172)
      • wireguard.exe (PID: 5104)
      • wireguard.exe (PID: 5672)
      • wireguard.exe (PID: 508)
      • wireguard.exe (PID: 1692)
      • wireguard.exe (PID: 3656)
      • wireguard.exe (PID: 5224)
      • wireguard.exe (PID: 2348)
      • wireguard.exe (PID: 1660)
      • wireguard.exe (PID: 616)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 1304)
      • WMIC.exe (PID: 4788)
      • WMIC.exe (PID: 4580)
      • WMIC.exe (PID: 5952)
      • WMIC.exe (PID: 3976)
      • WMIC.exe (PID: 2440)
      • WMIC.exe (PID: 2864)
      • WMIC.exe (PID: 5212)
      • WMIC.exe (PID: 4504)
      • WMIC.exe (PID: 5860)
      • WMIC.exe (PID: 3324)
      • WMIC.exe (PID: 4616)
      • WMIC.exe (PID: 1988)
      • WMIC.exe (PID: 5128)
      • WMIC.exe (PID: 3520)
      • WMIC.exe (PID: 4680)
      • WMIC.exe (PID: 2996)
      • WMIC.exe (PID: 2424)
      • WMIC.exe (PID: 1228)
      • WMIC.exe (PID: 920)
      • WMIC.exe (PID: 2276)
      • WMIC.exe (PID: 4292)
      • WMIC.exe (PID: 5664)
      • WMIC.exe (PID: 5952)
      • WMIC.exe (PID: 5368)
      • WMIC.exe (PID: 5452)
      • WMIC.exe (PID: 3056)
      • WMIC.exe (PID: 4128)

    • Reads the computer name

      • wireguard.exe (PID: 1172)
      • wireguard.exe (PID: 5672)
      • wireguard.exe (PID: 5104)
      • wireguard.exe (PID: 508)
      • wireguard.exe (PID: 1692)
      • wireguard.exe (PID: 3656)
      • wireguard.exe (PID: 1660)
      • wireguard.exe (PID: 5224)
      • wireguard.exe (PID: 2348)

    • Application based on Golang

      • wireguard.exe (PID: 1172)
      • wireguard.exe (PID: 5672)
      • wireguard.exe (PID: 5104)
      • wireguard.exe (PID: 508)
      • wireguard.exe (PID: 1692)
      • wireguard.exe (PID: 3656)
      • wireguard.exe (PID: 5224)
      • wireguard.exe (PID: 1660)
      • wireguard.exe (PID: 5656)
      • wireguard.exe (PID: 2348)
      • wireguard.exe (PID: 2592)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Large address aware, No debug
PEType: PE32+
LinkerVersion: 2.43
CodeSize: 6771200
InitializedDataSize: 10886144
UninitializedDataSize: 356352
EntryPoint: 0x13d0
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 0.5.3.0
ProductVersionNumber: 0.5.3.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: -
CompanyName: Jason A. Donenf
FileDescription: WireGuard: Fast, Modern, Secure VPN
FileVersion: 0.5.3
InternalName: WireGuard
LegalCopyright: Copyright (c) 2015-2021 Jason A. Donenf
LegalTrademarks: WireGuard
OriginalFileName: wireguard.exe
PrivateBuild: -
ProductName: WireGuard
ProductVersion: 0.5.3
SpecialBuild: -
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
421
Monitored processes
321
Malicious processes
33
Suspicious processes
0

Behavior graph

Click at the process to see the details
start wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs wireguard.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs #PHISHING svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
296\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
296WMIC CPU GET ProcessorIDC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
296WMIC DISKDRIVE GET SERIALNUMBERC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
444CMD /C "WMIC CPU GET ProcessorID"C:\Windows\System32\cmd.exe—wireguard.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
508"C:\Users\admin\Desktop\wireguard.exe" --detachedC:\Users\admin\Desktop\wireguard.exe
wireguard.exe
User:
admin
Company:
Jason A. Donenf
Integrity Level:
MEDIUM
Description:
WireGuard: Fast, Modern, Secure VPN
Exit code:
2
Version:
0.5.3
Modules
Images
c:\users\admin\desktop\wireguard.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\umpdc.dll
600CMD /C "WMIC DISKDRIVE GET SERIALNUMBER"C:\Windows\System32\cmd.exe—wireguard.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
600WMIC DISKDRIVE GET SERIALNUMBERC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
616"C:\Users\admin\Desktop\wireguard.exe" --detachedC:\Users\admin\Desktop\wireguard.exe
wireguard.exe
User:
admin
Company:
Jason A. Donenf
Integrity Level:
MEDIUM
Description:
WireGuard: Fast, Modern, Secure VPN
Exit code:
2
Version:
0.5.3
Modules
Images
c:\users\admin\desktop\wireguard.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\umpdc.dll
632WMIC DISKDRIVE GET SERIALNUMBERC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
708CMD /C "WMIC CPU GET ProcessorID"C:\Windows\System32\cmd.exe—wireguard.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
Total events
234 686
Read events
234 432
Write events
254
Delete events
0

Modification events

(PID) Process:(1172) wireguard.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1172) wireguard.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1172) wireguard.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1172) wireguard.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(5672) wireguard.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\4c\52C64B7E
Operation:writeName:C:\Windows\system32\,@tzres.dll,-2182
Value:
Astrakhan Standard Time
(PID) Process:(5672) wireguard.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\4c\52C64B7E
Operation:writeName:C:\Windows\system32\,@tzres.dll,-2181
Value:
Astrakhan Daylight Time
(PID) Process:(5672) wireguard.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\4c\52C64B7E
Operation:writeName:C:\Windows\system32\,@tzres.dll,-452
Value:
Caucasus Standard Time
(PID) Process:(5672) wireguard.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\4c\52C64B7E
Operation:writeName:C:\Windows\system32\,@tzres.dll,-451
Value:
Caucasus Daylight Time
(PID) Process:(5672) wireguard.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\4c\52C64B7E
Operation:writeName:C:\Windows\system32\,@tzres.dll,-662
Value:
Cen. Australia Standard Time
(PID) Process:(5672) wireguard.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\4c\52C64B7E
Operation:writeName:C:\Windows\system32\,@tzres.dll,-661
Value:
Cen. Australia Daylight Time
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
71
TCP/UDP connections
12 829
DNS requests
9 804
Threats
220

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1660
wireguard.exe
GET
200
88.119.165.84:8080
http://towerbingobongoboom.com:8080/updater?for=D29476568E8640B286A671E377C7C4EB
unknown
—
—
malicious
5656
wireguard.exe
GET
200
88.119.165.84:8080
http://towerbingobongoboom.com:8080/updater?for=D29476568E8640B286A671E377C7C4EB
unknown
—
—
malicious
5088
wireguard.exe
GET
200
88.119.165.84:8080
http://towerbingobongoboom.com:8080/updater?for=D29476568E8640B286A671E377C7C4EB
unknown
—
—
malicious
5008
wireguard.exe
GET
200
88.119.165.84:8080
http://towerbingobongoboom.com:8080/updater?for=D29476568E8640B286A671E377C7C4EB
unknown
—
—
malicious
3704
wireguard.exe
GET
200
88.119.165.84:8080
http://towerbingobongoboom.com:8080/updater?for=D29476568E8640B286A671E377C7C4EB
unknown
—
—
malicious
5116
wireguard.exe
GET
200
88.119.165.84:8080
http://towerbingobongoboom.com:8080/updater?for=D29476568E8640B286A671E377C7C4EB
unknown
—
—
malicious
5468
smartscreen.exe
GET
200
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?abe0a5c8c299ffd9
unknown
—
—
whitelisted
5468
smartscreen.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
3640
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1172
wireguard.exe
GET
200
88.119.165.84:8080
http://towerbingobongoboom.com:8080/updater?for=D29476568E8640B286A671E377C7C4EB
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1352
svchost.exe
184.24.77.4:80
—
Akamai International B.V.
DE
unknown
5468
smartscreen.exe
48.209.162.134:443
checkappexec.microsoft.com
—
US
whitelisted
5468
smartscreen.exe
199.232.214.172:80
ctldl.windowsupdate.com
FASTLY
US
whitelisted
5468
smartscreen.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
1172
wireguard.exe
88.119.165.84:8080
towerbingobongoboom.com
Informacines sistemos ir technologijos, UAB
LT
malicious
5336
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3640
svchost.exe
40.126.32.72:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3640
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2776
svchost.exe
20.189.173.8:443
v10.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1352
svchost.exe
184.24.77.24:80
—
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.78
whitelisted
checkappexec.microsoft.com
  • 48.209.162.134
whitelisted
ctldl.windowsupdate.com
  • 199.232.214.172
  • 199.232.210.172
  • 91.136.8.165
  • 208.89.74.29
  • 208.89.74.21
  • 208.89.74.31
  • 208.89.74.19
  • 208.89.74.23
  • 208.89.74.27
  • 208.89.74.17
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
towerbingobongoboom.com
  • 88.119.165.84
malicious
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
login.live.com
  • 40.126.32.72
  • 20.190.160.14
  • 40.126.32.138
  • 40.126.32.134
  • 20.190.160.131
  • 20.190.160.128
  • 20.190.160.22
  • 40.126.32.140
whitelisted
v10.events.data.microsoft.com
  • 20.189.173.8
whitelisted
fs.microsoft.com
  • 104.102.63.189
whitelisted
self.events.data.microsoft.com
  • 52.168.112.67
whitelisted

Threats

PID
Process
Class
Message
1172
wireguard.exe
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
1172
wireguard.exe
Misc activity
ET INFO Go-http-client User-Agent Observed Outbound
1352
svchost.exe
Misc activity
ET INFO Microsoft Connection Test
5672
wireguard.exe
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
5672
wireguard.exe
Misc activity
ET INFO Go-http-client User-Agent Observed Outbound
5104
wireguard.exe
Misc activity
ET INFO Go-http-client User-Agent Observed Outbound
5104
wireguard.exe
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
508
wireguard.exe
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
508
wireguard.exe
Misc activity
ET INFO Go-http-client User-Agent Observed Outbound
1692
wireguard.exe
Misc activity
ET INFO Go-http-client User-Agent Observed Outbound
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
wireguard.exe