File name:

dControl.exe

Full analysis: https://app.any.run/tasks/3ae11c83-050a-4989-a399-51b98d3d849a
Verdict: Malicious activity
Analysis date: June 04, 2025, 19:29:22
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
defendercontrol
tool
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections
MD5:

58008524A6473BDF86C1040A9A9E39C3

SHA1:

CB704D2E8DF80FD3500A5B817966DC262D80DDB8

SHA256:

1EF6C1A4DFDC39B63BFE650CA81AB89510DE6C0D3D7C608AC5BE80033E559326

SSDEEP:

6144:Vzv+kSn74iCmfianQGDM3OXTWRDy9GYQDUmJFXIXHrsUBnBTF8JJCYrYNsQJzfgu:Vzcn7EanlQiWtYhmJFSwUBLcQZfgiD

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • dControl.exe (PID: 4892)
      • dControl.exe (PID: 6240)
      • dControl.exe (PID: 6300)
      • dControl.exe (PID: 1452)
      • dControl.exe (PID: 8008)

    • Creates or modifies Windows services

      • dControl.exe (PID: 1452)

    • Disables Windows Defender

      • dControl.exe (PID: 1452)

    • Changes image file execution options

      • dControl.exe (PID: 1452)

  • SUSPICIOUS

    • Application launched itself

      • dControl.exe (PID: 6240)
      • dControl.exe (PID: 6300)
      • dControl.exe (PID: 1452)

    • Creates or modifies Windows services

      • dControl.exe (PID: 1452)

    • Explorer used for Indirect Command Execution

      • explorer.exe (PID: 7960)

  • INFO

    • The sample compiled with english language support

      • dControl.exe (PID: 6240)

    • Reads mouse settings

      • dControl.exe (PID: 6240)
      • dControl.exe (PID: 6300)
      • dControl.exe (PID: 1452)
      • dControl.exe (PID: 8008)

    • Checks supported languages

      • dControl.exe (PID: 6240)
      • dControl.exe (PID: 6300)
      • dControl.exe (PID: 1452)
      • dControl.exe (PID: 8008)
      • MpCmdRun.exe (PID: 7200)

    • Reads the computer name

      • dControl.exe (PID: 6240)
      • dControl.exe (PID: 6300)
      • dControl.exe (PID: 1452)
      • dControl.exe (PID: 8008)
      • MpCmdRun.exe (PID: 7200)

    • DEFENDERCONTROL has been detected

      • dControl.exe (PID: 6240)
      • dControl.exe (PID: 6300)
      • dControl.exe (PID: 1452)

    • Create files in a temporary directory

      • dControl.exe (PID: 6240)
      • dControl.exe (PID: 1452)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 7328)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (28.6)
.exe | UPX compressed Win32 Executable (28)
.exe | Win32 EXE Yoda's Crypter (27.5)
.dll | Win32 Dynamic Link Library (generic) (6.8)
.exe | Win32 Executable (generic) (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2011:12:23 10:59:31+00:00
ImageFileCharacteristics: No relocs, Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 270336
InitializedDataSize: 61440
UninitializedDataSize: 503808
EntryPoint: 0xbd650
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 2.1.0.0
ProductVersionNumber: 2.1.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
FileVersion: 2.1.0.0
Comments: dControl v2.1
FileDescription: dControl v2.1
LegalCopyright: Copyright © 2015-2022 www.sordum.org All Rights Reserved.
CompanyName: www.sordum.org
ProductVersion: 2.1.0.0
OriginalFileName: dControl.exe
Coder: By BlueLife
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
153
Monitored processes
12
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start dcontrol.exe sppextcomobj.exe no specs slui.exe no specs dcontrol.exe dcontrol.exe explorer.exe no specs dcontrol.exe no specs mpcmdrun.exe no specs conhost.exe no specs explorer.exe no specs securityhealthsystray.exe no specs dcontrol.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1452"C:\Users\admin\AppData\Local\Temp\dControl.exe" /TI C:\Users\admin\AppData\Local\Temp\dControl.exe
dControl.exe
User:
SYSTEM
Company:
www.sordum.org
Integrity Level:
SYSTEM
Description:
dControl v2.1
Exit code:
0
Version:
2.1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\dcontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
4892"C:\Users\admin\AppData\Local\Temp\dControl.exe" C:\Users\admin\AppData\Local\Temp\dControl.exe—explorer.exe
User:
admin
Company:
www.sordum.org
Integrity Level:
MEDIUM
Description:
dControl v2.1
Exit code:
3221226540
Version:
2.1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\dcontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
5116"C:\Windows\System32\SecurityHealthSystray.exe" C:\Windows\System32\SecurityHealthSystray.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Security notification icon
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\securityhealthsystray.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6240"C:\Users\admin\AppData\Local\Temp\dControl.exe" C:\Users\admin\AppData\Local\Temp\dControl.exe
explorer.exe
User:
admin
Company:
www.sordum.org
Integrity Level:
HIGH
Description:
dControl v2.1
Exit code:
0
Version:
2.1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\dcontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6300C:\Users\admin\AppData\Local\Temp\dControl.exeC:\Users\admin\AppData\Local\Temp\dControl.exe
dControl.exe
User:
SYSTEM
Company:
www.sordum.org
Integrity Level:
SYSTEM
Description:
dControl v2.1
Exit code:
0
Version:
2.1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\dcontrol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6584"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7200"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenableC:\Program Files\Windows Defender\MpCmdRun.exe—dControl.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Malware Protection Command Line Utility
Exit code:
2147942405
Version:
4.18.1909.6 (WinBuild.160101.0800)
Modules
Images
c:\program files\windows defender\mpcmdrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
7328C:\WINDOWS\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\shcore.dll
7484C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7960"C:\WINDOWS\Explorer.exe" C:\WINDOWS\System32\SecurityHealthSystray.exeC:\Windows\explorer.exe—dControl.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\shcore.dll
Total events
1 227
Read events
1 182
Write events
32
Delete events
13

Modification events

(PID) Process:(1452) dControl.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WdFilter
Operation:writeName:Start
Value:
0
(PID) Process:(1452) dControl.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv
Operation:writeName:Start
Value:
3
(PID) Process:(1452) dControl.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc
Operation:writeName:Start
Value:
3
(PID) Process:(1452) dControl.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Policy Manager
Operation:delete keyName:(default)
Value:
(PID) Process:(1452) dControl.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
Operation:delete keyName:(default)
Value:
(PID) Process:(1452) dControl.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet
Operation:delete keyName:(default)
Value:
(PID) Process:(1452) dControl.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender
Operation:delete keyName:(default)
Value:
(PID) Process:(1452) dControl.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender
Operation:delete valueName:DisableAntiSpyware
Value:
(PID) Process:(1452) dControl.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender
Operation:delete valueName:DisableAntiVirus
Value:
(PID) Process:(1452) dControl.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection
Operation:delete valueName:DisableRealtimeMonitoring
Value:
Executable files
0
Suspicious files
13
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
6240dControl.exeC:\Users\admin\AppData\Local\Temp\6i2v4i0a.tmptext
MD5:E00DCC76E4DCD90994587375125DE04B
SHA256:C8709F5A8B971D136E2273D66E65449791CA8EBA1F47DD767733EA52EE635447
1452dControl.exeC:\Windows\System32\GroupPolicy\Machine\Registry.polbinary
MD5:B6624E6BBE442A34AD53B000128297E4
SHA256:70BBF229F9BD344BAA8B762C3BC6AD3959D9F9C95A7963ECADA9C88C022EFEEF
6300dControl.exeC:\Windows\Temp\autFA2C.tmpbinary
MD5:9D5A0EF18CC4BB492930582064C5330F
SHA256:8F5BBCC572BC62FEB13A669F856D21886A61888FD6288AFD066272A27EA79BB3
6300dControl.exeC:\Windows\Temp\autFA4D.tmpbinary
MD5:ECFFD3E81C5F2E3C62BCDC122442B5F2
SHA256:9874AB363B07DCC7E9CD6022A380A64102C1814343642295239A9F120CB941C5
6300dControl.exeC:\Windows\Temp\autFA4C.tmpbinary
MD5:EFE44D9F6E4426A05E39F99AD407D3E7
SHA256:5EA3B26C6B1B71EDAEF17CE365D50BE963AE9F4CB79B39EC723FE6E9E4054366
1452dControl.exeC:\Windows\Temp\autFAE7.tmpbinary
MD5:9D5A0EF18CC4BB492930582064C5330F
SHA256:8F5BBCC572BC62FEB13A669F856D21886A61888FD6288AFD066272A27EA79BB3
1452dControl.exeC:\Windows\Temp\1i4v5i2a.tmptext
MD5:E00DCC76E4DCD90994587375125DE04B
SHA256:C8709F5A8B971D136E2273D66E65449791CA8EBA1F47DD767733EA52EE635447
1452dControl.exeC:\Windows\Temp\autFAE8.tmpbinary
MD5:EFE44D9F6E4426A05E39F99AD407D3E7
SHA256:5EA3B26C6B1B71EDAEF17CE365D50BE963AE9F4CB79B39EC723FE6E9E4054366
1452dControl.exeC:\Windows\Temp\autFAE9.tmpbinary
MD5:ECFFD3E81C5F2E3C62BCDC122442B5F2
SHA256:9874AB363B07DCC7E9CD6022A380A64102C1814343642295239A9F120CB941C5
6300dControl.exeC:\Windows\Temp\6i3v0i0a.tmptext
MD5:E00DCC76E4DCD90994587375125DE04B
SHA256:C8709F5A8B971D136E2273D66E65449791CA8EBA1F47DD767733EA52EE635447
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
23
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.19.198.194:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
864
svchost.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.22.98.7:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7904
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7904
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5496
MoUsoCoreWorker.exe
2.19.198.194:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
864
svchost.exe
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3176
RUXIMICS.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
864
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2196
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
2196
svchost.exe
224.0.0.251:5353
—
—
—
unknown

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.19.198.194
  • 23.32.238.34
whitelisted
google.com
  • 142.250.186.46
whitelisted
www.microsoft.com
  • 2.23.181.156
  • 2.23.246.101
whitelisted
login.live.com
  • 40.126.32.136
  • 40.126.32.72
  • 40.126.32.138
  • 20.190.160.131
  • 20.190.160.67
  • 40.126.32.140
  • 20.190.160.17
  • 40.126.32.68
whitelisted
ocsp.digicert.com
  • 2.22.98.7
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
dControl.exe