File name:

2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.exe

Full analysis: https://app.any.run/tasks/58e0407d-36f9-47ae-bd81-ea390b7eb989
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 11:35:39
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
valleyrat
winos
rat
silverfox
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

FE177C0868224A16BCA7B17381E74903

SHA1:

C1A3456E7D35E924CC395E7D012F7FCAEA15D677

SHA256:

2431EF60A5F5C610CDAB7AB95DE6A8D58A4A216042AA3150571D105E5C4B7917

SSDEEP:

98304:e+GPLJhzEvFS18NdiMVth5SvBd+EsoBJ0ER46k2XqhzhP87wrWYxDEdr+hpUSI4L:uob1fQ9QILvyHaikVuX/YN2XI1BOsk

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.exe (PID: 7232)
      • 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.exe (PID: 7340)

    • Registers / Runs the DLL via REGSVR32.EXE

      • TWjr.tmp (PID: 7752)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6724)

    • VALLEYRAT has been detected

      • regsvr32.exe (PID: 7852)

    • Changes powershell execution policy (Bypass)

      • xDxy_382.exe (PID: 7228)

    • Connects to the CnC server

      • regsvr32.exe (PID: 7852)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.exe (PID: 7232)
      • 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmp (PID: 7252)
      • 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.exe (PID: 7340)
      • TWjr.exe (PID: 7580)
      • TWjr.tmp (PID: 7604)
      • 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmp (PID: 7388)
      • TWjr.exe (PID: 7700)
      • TWjr.tmp (PID: 7752)
      • xDxy_382.exe (PID: 7228)
      • drvinst.exe (PID: 8136)
      • tapinstall.exe (PID: 5308)
      • drvinst.exe (PID: 4008)

    • Reads the Windows owner or organization settings

      • 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmp (PID: 7252)
      • 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmp (PID: 7388)
      • TWjr.tmp (PID: 7604)
      • TWjr.tmp (PID: 7752)

    • Process drops legitimate windows executable

      • 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmp (PID: 7252)
      • 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmp (PID: 7388)
      • TWjr.tmp (PID: 7752)
      • TWjr.tmp (PID: 7604)
      • xDxy_382.exe (PID: 7228)

    • Reads security settings of Internet Explorer

      • 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmp (PID: 7252)
      • 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmp (PID: 7388)
      • TWjr.tmp (PID: 7604)

    • The executable file from the user directory is run by the CMD process

      • xDxy_382.exe (PID: 7564)
      • TWjr.exe (PID: 7580)
      • xDxy_382.exe (PID: 7652)
      • xDxy_382.exe (PID: 7228)

    • Starts CMD.EXE for commands execution

      • 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmp (PID: 7388)
      • xDxy_382.exe (PID: 7228)

    • The process hide an interactive prompt from the user

      • regsvr32.exe (PID: 7852)

    • The process creates files with name similar to system file names

      • xDxy_382.exe (PID: 7228)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • xDxy_382.exe (PID: 7228)

    • Drops a system driver (possible attempt to evade defenses)

      • xDxy_382.exe (PID: 7228)
      • tapinstall.exe (PID: 5308)
      • drvinst.exe (PID: 8136)
      • drvinst.exe (PID: 4008)

    • The process bypasses the loading of PowerShell profile settings

      • regsvr32.exe (PID: 7852)

    • Starts POWERSHELL.EXE for commands execution

      • regsvr32.exe (PID: 7852)
      • xDxy_382.exe (PID: 7228)

    • Contacting a server suspected of hosting an CnC

      • regsvr32.exe (PID: 7852)

    • Connects to unusual port

      • regsvr32.exe (PID: 7852)

    • The process executes Powershell scripts

      • xDxy_382.exe (PID: 7228)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • cmd.exe (PID: 2108)
      • cmd.exe (PID: 5776)
      • cmd.exe (PID: 4152)
      • cmd.exe (PID: 8024)
      • cmd.exe (PID: 2908)

  • INFO

    • Create files in a temporary directory

      • 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.exe (PID: 7232)
      • 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmp (PID: 7252)
      • 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.exe (PID: 7340)
      • 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmp (PID: 7388)
      • TWjr.exe (PID: 7580)
      • TWjr.tmp (PID: 7604)
      • TWjr.exe (PID: 7700)
      • TWjr.tmp (PID: 7752)
      • regsvr32.exe (PID: 7852)
      • xDxy_382.exe (PID: 7228)

    • Checks supported languages

      • 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.exe (PID: 7232)
      • 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmp (PID: 7252)
      • 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.exe (PID: 7340)
      • 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmp (PID: 7388)
      • TWjr.exe (PID: 7580)
      • TWjr.tmp (PID: 7604)
      • TWjr.tmp (PID: 7752)
      • TWjr.exe (PID: 7700)
      • xDxy_382.exe (PID: 7228)
      • tapinstall.exe (PID: 7876)
      • tapinstall.exe (PID: 5308)

    • Reads the computer name

      • 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmp (PID: 7252)
      • 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmp (PID: 7388)
      • TWjr.tmp (PID: 7604)
      • TWjr.tmp (PID: 7752)
      • xDxy_382.exe (PID: 7228)

    • The sample compiled with english language support

      • 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmp (PID: 7252)
      • 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmp (PID: 7388)
      • TWjr.tmp (PID: 7752)
      • TWjr.tmp (PID: 7604)
      • xDxy_382.exe (PID: 7228)
      • tapinstall.exe (PID: 5308)
      • drvinst.exe (PID: 8136)
      • drvinst.exe (PID: 4008)

    • Process checks computer location settings

      • 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmp (PID: 7252)
      • 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmp (PID: 7388)
      • TWjr.tmp (PID: 7604)

    • Creates files or folders in the user directory

      • 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmp (PID: 7388)
      • TWjr.tmp (PID: 7752)
      • xDxy_382.exe (PID: 7228)

    • Creates a software uninstall entry

      • 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmp (PID: 7388)
      • TWjr.tmp (PID: 7752)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7940)
      • powershell.exe (PID: 5360)
      • powershell.exe (PID: 6724)

    • Creates files in the program directory

      • xDxy_382.exe (PID: 7228)
      • regsvr32.exe (PID: 7852)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6724)

    • Manual execution by a user

      • LetsPRO.exe (PID: 7660)
      • LetsPRO.exe (PID: 7960)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (77.7)
.exe | Win32 Executable Delphi generic (10)
.dll | Win32 Dynamic Link Library (generic) (4.6)
.exe | Win32 Executable (generic) (3.1)
.exe | Win16/32 Executable Delphi generic (1.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2002:11:02 16:24:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 37888
InitializedDataSize: 35328
UninitializedDataSize: -
EntryPoint: 0x9c40
OSVersion: 1
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Microsoft Corporation
FileDescription: Desktop Switch Utility Setup
FileVersion:
LegalCopyright: © Microsoft Corporation. All rights reserved.
ProductName: Desktop Switch Utility
ProductVersion: 10.0.22621.3233
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
190
Monitored processes
53
Malicious processes
12
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.exe 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmp 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.exe 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmp cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs xdxy_382.exe no specs twjr.exe twjr.tmp xdxy_382.exe no specs twjr.exe twjr.tmp regsvr32.exe no specs #VALLEYRAT regsvr32.exe powershell.exe no specs conhost.exe no specs xdxy_382.exe powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs tapinstall.exe no specs conhost.exe no specs tapinstall.exe conhost.exe no specs drvinst.exe drvinst.exe tapinstall.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs letspro.exe no specs letspro.exe no specs letspro.exe no specs letspro.exe letspro.exe no specs letspro.exe letspro.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
732"C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901C:\Program Files (x86)\letsvpn\driver\tapinstall.exe—xDxy_382.exe
User:
admin
Company:
Windows (R) Win 7 DDK provider
Integrity Level:
HIGH
Description:
Windows Setup API
Exit code:
0
Version:
6.1.7600.16385 built by: WinDDK
Modules
Images
c:\program files (x86)\letsvpn\driver\tapinstall.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1164\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1568\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1748"C:\Program Files (x86)\letsvpn\app-3.14.2\LetsPRO.exe" C:\Program Files (x86)\letsvpn\app-3.14.2\LetsPRO.exe
LetsPRO.exe
User:
admin
Integrity Level:
HIGH
Description:
LetsVPN
Version:
3.14.2
Modules
Images
c:\program files (x86)\letsvpn\app-3.14.2\letspro.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2040netsh advfirewall firewall Delete rule name=LetsVPNC:\Windows\SysWOW64\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2108cmd /c netsh advfirewall firewall Delete rule name=letsC:\Windows\SysWOW64\cmd.exe—xDxy_382.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2148\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—tapinstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2320"C:\Program Files (x86)\letsvpn\LetsPRO.exe"C:\Program Files (x86)\letsvpn\LetsPRO.exe—xDxy_382.exe
User:
admin
Integrity Level:
HIGH
Description:
LetsVPN
Exit code:
0
Version:
3.14.2
Modules
Images
c:\program files (x86)\letsvpn\letspro.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2772\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2908cmd /c netsh advfirewall firewall Delete rule name=LetsVPNC:\Windows\SysWOW64\cmd.exe—xDxy_382.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
34 852
Read events
34 702
Write events
134
Delete events
16

Modification events

(PID) Process:(7388) 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Desktop Switch Utility_is1
Operation:writeName:Inno Setup: Setup Version
Value:
5.5.0 (a)
(PID) Process:(7388) 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Desktop Switch Utility_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Users\admin\AppData\Local
(PID) Process:(7388) 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Desktop Switch Utility_is1
Operation:writeName:InstallLocation
Value:
C:\Users\admin\AppData\Local\
(PID) Process:(7388) 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Desktop Switch Utility_is1
Operation:writeName:Inno Setup: Icon Group
Value:
(Default)
(PID) Process:(7388) 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Desktop Switch Utility_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(7388) 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Desktop Switch Utility_is1
Operation:writeName:Inno Setup: Language
Value:
default
(PID) Process:(7388) 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Desktop Switch Utility_is1
Operation:writeName:DisplayName
Value:
Desktop Switch Utility version 10.0.22621.3233
(PID) Process:(7388) 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Desktop Switch Utility_is1
Operation:writeName:UninstallString
Value:
"C:\Users\admin\AppData\Local\unins000.exe"
(PID) Process:(7388) 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Desktop Switch Utility_is1
Operation:writeName:QuietUninstallString
Value:
"C:\Users\admin\AppData\Local\unins000.exe" /SILENT
(PID) Process:(7388) 2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Desktop Switch Utility_is1
Operation:writeName:DisplayVersion
Value:
10.0.22621.3233
Executable files
252
Suspicious files
26
Text files
17
Unknown types
0

Dropped files

PID
Process
Filename
Type
72322431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.exeC:\Users\admin\AppData\Local\Temp\is-MORIT.tmp\2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmpexecutable
MD5:C7C090D7CE5EB84A75459D5230AAB296
SHA256:83F3533BD4E55D1AF098C8929733E0FE01079A03AF87335DB292FCFD0250870D
73882431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmpC:\Users\admin\AppData\Roaming\TWjr.exeexecutable
MD5:AA07A92EA859CAE7426ADD3BEB2D3751
SHA256:84742F429E6E7FF5F9710B6DF3E93F3059B70FE7DBCA7EBEC64C06643914D448
7604TWjr.tmpC:\Users\admin\AppData\Local\Temp\is-UTADJ.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
73882431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmpC:\Users\admin\AppData\Local\unins000.datbinary
MD5:564EB7951565E2C213AE4F396B3B02E0
SHA256:248951C07F57145E84BCC69F59591F7196D12F49A3A8BA9D61BC21DF38C129BD
73882431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmpC:\Users\admin\AppData\Roaming\is-MQSF5.tmpexecutable
MD5:73E488B8090341EC8ED56A422462CD12
SHA256:3EF70AD5805B82BAAE9AA2ED92C1D2D463B0142166C7B0AC6578D2B8BCAD2D40
73882431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmpC:\Users\admin\AppData\Roaming\xDxy_382.exeexecutable
MD5:73E488B8090341EC8ED56A422462CD12
SHA256:3EF70AD5805B82BAAE9AA2ED92C1D2D463B0142166C7B0AC6578D2B8BCAD2D40
7604TWjr.tmpC:\Users\admin\AppData\Local\Temp\is-UTADJ.tmp\_isetup\_RegDLL.tmpexecutable
MD5:0EE914C6F0BB93996C75941E1AD629C6
SHA256:4DC09BAC0613590F1FAC8771D18AF5BE25A1E1CB8FDBF4031AA364F3057E74A2
72522431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmpC:\Users\admin\AppData\Local\Temp\is-I8QHS.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
72522431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmpC:\Users\admin\AppData\Local\Temp\is-I8QHS.tmp\_isetup\_RegDLL.tmpexecutable
MD5:0EE914C6F0BB93996C75941E1AD629C6
SHA256:4DC09BAC0613590F1FAC8771D18AF5BE25A1E1CB8FDBF4031AA364F3057E74A2
72522431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.tmpC:\Users\admin\AppData\Local\Temp\is-I8QHS.tmp\_isetup\_setup64.tmpexecutable
MD5:4FF75F505FDDCC6A9AE62216446205D9
SHA256:A4C86FC4836AC728D7BD96E7915090FD59521A9E74F1D06EF8E5A47C8695FD81
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
31
DNS requests
17
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5116
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5116
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
—
—
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 2.23.246.101
whitelisted
google.com
  • 142.250.185.142
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.159.0
  • 40.126.31.129
  • 40.126.31.2
  • 20.190.159.75
  • 40.126.31.71
  • 40.126.31.131
  • 20.190.159.23
  • 20.190.159.130
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted

Threats

PID
Process
Class
Message
7852
regsvr32.exe
Malware Command and Control Activity Detected
ET MALWARE Winos4.0 Framework CnC Login Message
7852
regsvr32.exe
Malware Command and Control Activity Detected
ET MALWARE Winos4.0 Framework CnC Login Message CnC Server Response
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
2431ef60a5f5c610cdab7ab95de6a8d58a4a216042aa3150571d105e5c4b7917.exe