File name:

WOMicClientSetup6.1.exe

Full analysis: https://app.any.run/tasks/8cebf1d7-5d6b-4260-a224-4f16fab1784a
Verdict: Malicious activity
Analysis date: July 06, 2025, 04:44:50
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

880A67CBF94ED6D3C62045C1CF2D94A8

SHA1:

9BB67C0B515234A1452E2DCC48CBCC332A631F15

SHA256:

28F0C4F4EC7135700BDA47F306AD121BD48E866F16F8C74224FE4E0CF06A9C26

SSDEEP:

49152:8e3Mscof5Ch/NTpd94tc6dnsZMV9lN7XvpArIpnRR+eAkrh6YdBPdZCaZ7Yczu9L:8e8snmN1d94t5dMWBpAyRR+AF6YdEYzA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • WOMicClientSetup6.1.exe (PID: 1944)

    • The process creates files with name similar to system file names

      • WOMicClientSetup6.1.exe (PID: 1944)

    • Executable content was dropped or overwritten

      • WOMicClientSetup6.1.exe (PID: 1944)
      • devcon.exe (PID: 304)
      • drvinst.exe (PID: 3648)
      • drvinst.exe (PID: 2124)

    • There is functionality for taking screenshot (YARA)

      • WOMicClientSetup6.1.exe (PID: 1944)

    • Process drops legitimate windows executable

      • WOMicClientSetup6.1.exe (PID: 1944)

    • Creates a software uninstall entry

      • WOMicClientSetup6.1.exe (PID: 1944)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • WOMicClientSetup6.1.exe (PID: 1944)

    • Drops a system driver (possible attempt to evade defenses)

      • WOMicClientSetup6.1.exe (PID: 1944)
      • devcon.exe (PID: 304)
      • drvinst.exe (PID: 3648)
      • drvinst.exe (PID: 2124)

    • Reads security settings of Internet Explorer

      • devcon.exe (PID: 304)

    • Creates files in the driver directory

      • drvinst.exe (PID: 3648)
      • drvinst.exe (PID: 2124)

    • The process executes via Task Scheduler

      • updater.exe (PID: 3556)
      • PLUGScheduler.exe (PID: 4116)

    • Creates or modifies Windows services

      • drvinst.exe (PID: 2124)

    • Application launched itself

      • updater.exe (PID: 3556)

  • INFO

    • Reads the computer name

      • WOMicClientSetup6.1.exe (PID: 1944)
      • devcon.exe (PID: 304)
      • drvinst.exe (PID: 3648)
      • drvinst.exe (PID: 2124)
      • updater.exe (PID: 3556)
      • PLUGScheduler.exe (PID: 4116)

    • Checks supported languages

      • WOMicClientSetup6.1.exe (PID: 1944)
      • devcon.exe (PID: 304)
      • drvinst.exe (PID: 3648)
      • updater.exe (PID: 3556)
      • drvinst.exe (PID: 2124)
      • updater.exe (PID: 4984)

    • Create files in a temporary directory

      • WOMicClientSetup6.1.exe (PID: 1944)
      • devcon.exe (PID: 304)

    • Creates files in the program directory

      • WOMicClientSetup6.1.exe (PID: 1944)
      • PLUGScheduler.exe (PID: 4116)

    • Creates files or folders in the user directory

      • WOMicClientSetup6.1.exe (PID: 1944)

    • The sample compiled with english language support

      • WOMicClientSetup6.1.exe (PID: 1944)
      • devcon.exe (PID: 304)
      • drvinst.exe (PID: 3648)
      • drvinst.exe (PID: 2124)

    • Reads the software policy settings

      • devcon.exe (PID: 304)
      • drvinst.exe (PID: 3648)

    • Reads the machine GUID from the registry

      • devcon.exe (PID: 304)
      • drvinst.exe (PID: 3648)

    • Process checks whether UAC notifications are on

      • updater.exe (PID: 3556)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:04:03 20:19:02+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 25600
InitializedDataSize: 186368
UninitializedDataSize: 2048
EntryPoint: 0x32a0
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
280
Monitored processes
17
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
304devcon.exe install womic.inf Root\WOMicC:\Program Files (x86)\WOMic\driver\devcon.exe
WOMicClientSetup6.1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Device Console
Exit code:
0
Version:
10.0.19041.685 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\womic\driver\devcon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
684C:\WINDOWS\system32\netsh.exe advfirewall firewall add rule name="WOMic" profile=any dir=in action=allow program="C:\Program Files (x86)\WOMic\womicclient.exe" enable=yes protocol=TCPC:\Windows\SysWOW64\netsh.exe—WOMicClientSetup6.1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1132\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1944"C:\Users\admin\Desktop\WOMicClientSetup6.1.exe" C:\Users\admin\Desktop\WOMicClientSetup6.1.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\womicclientsetup6.1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2124DrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\WINDOWS\INF\oem1.inf" "oem1.inf:ed86ca11fdcda04c:InstallWOMic:2.1.0.0:root\womic," "46d27e6e7" "00000000000001D8"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
2800C:\WINDOWS\system32\netsh.exe advfirewall firewall add rule name="WOMic" profile=any dir=out action=allow program="C:\Program Files (x86)\WOMic\womicclient.exe" enable=yes protocol=UDPC:\Windows\SysWOW64\netsh.exe—WOMicClientSetup6.1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3556"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --wake --systemC:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe—svchost.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\windows\syswow64\winhttp.dll
c:\windows\syswow64\winmm.dll
c:\windows\syswow64\uxtheme.dll
c:\windows\syswow64\version.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_a863d714867441db\comctl32.dll
c:\windows\syswow64\sspicli.dll
c:\windows\syswow64\bcryptprimitives.dll
c:\windows\syswow64\shcore.dll
c:\windows\syswow64\windows.storage.dll
c:\windows\syswow64\wldp.dll
3648DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{61ac0a3b-e23a-3247-8ca6-80a17822886c}\womic.inf" "9" "46d27e6e7" "00000000000001CC" "WinSta0\Default" "00000000000001DC" "208" "c:\program files (x86)\womic\driver"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
3688\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—devcon.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4116"C:\Program Files\RUXIM\PLUGscheduler.exe"C:\Program Files\RUXIM\PLUGScheduler.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Update LifeCycle Component Scheduler
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\clbcatq.dll
c:\windows\system32\taskschd.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\xmllite.dll
Total events
9 442
Read events
8 798
Write events
637
Delete events
7

Modification events

(PID) Process:(1944) WOMicClientSetup6.1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Wolicheng\WOMic
Operation:writeName:language
Value:
1033
(PID) Process:(1944) WOMicClientSetup6.1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Wolicheng\WOMic
Operation:writeName:bluetoothDevice
Value:
00:00:00:00:00:00
(PID) Process:(1944) WOMicClientSetup6.1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Wolicheng\WOMic
Operation:writeName:hotSpot
Value:
192.168.43.1
(PID) Process:(1944) WOMicClientSetup6.1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Wolicheng\WOMic
Operation:writeName:wifiAddr
Value:
192.168.1.101
(PID) Process:(1944) WOMicClientSetup6.1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Wolicheng\WOMic
Operation:writeName:transport
Value:
3
(PID) Process:(1944) WOMicClientSetup6.1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Wolicheng\WOMic
Operation:writeName:bufferSize
Value:
5
(PID) Process:(1944) WOMicClientSetup6.1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Wolicheng\WOMic
Operation:writeName:controlPort
Value:
8125
(PID) Process:(1944) WOMicClientSetup6.1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Wolicheng\WOMic
Operation:writeName:mediaPort
Value:
60000
(PID) Process:(1944) WOMicClientSetup6.1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Wolicheng\WOMic
Operation:writeName:x
Value:
500
(PID) Process:(1944) WOMicClientSetup6.1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Wolicheng\WOMic
Operation:writeName:y
Value:
200
Executable files
21
Suspicious files
55
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
1944WOMicClientSetup6.1.exeC:\Program Files (x86)\WOMic\WOMicClient.exeexecutable
MD5:5EEFA4D101F7B5113C9C1A5DB84EBE96
SHA256:BB833DD94D7922AD43EBDBB2805015446FB0D69124C640637DCA754B75068F4C
1944WOMicClientSetup6.1.exeC:\Users\admin\AppData\Local\Temp\nsb5E8C.tmp\nsExec.dllexecutable
MD5:01E76FE9D2033606A48D4816BD9C2D9D
SHA256:EE052FD5141BF769B841846170AABF0D7C2BB922C74C623C3F109344534F7A70
1944WOMicClientSetup6.1.exeC:\Program Files (x86)\WOMic\AdbWinApi.dllexecutable
MD5:ED5A809DC0024D83CBAB4FB9933D598D
SHA256:D60103A5E99BC9888F786EE916F5D6E45493C3247972CB053833803DE7E95CF9
1944WOMicClientSetup6.1.exeC:\Program Files (x86)\WOMic\driver\devcon.exeexecutable
MD5:816C4E245B286B4E4903131F75A94948
SHA256:ACA1BDA08690DCCA930254F96F9185C776671A85A58FFA1B59CF16017546F218
1944WOMicClientSetup6.1.exeC:\Program Files (x86)\WOMic\uninstall.exeexecutable
MD5:F548C566E4ACE1155B6DFE365173611F
SHA256:0F77E97EB9A54DB50C883532A020D4300597075556BF4ED933E9E6F598981810
1944WOMicClientSetup6.1.exeC:\Program Files (x86)\WOMic\AdbWinUsbApi.dllexecutable
MD5:0E24119DAF1909E398FA1850B6112077
SHA256:25207C506D29C4E8DCEB61B4BD50E8669BA26012988A43FBF26A890B1E60FC97
1944WOMicClientSetup6.1.exeC:\Program Files (x86)\WOMic\driver\womic.sysexecutable
MD5:DCF7F591C326A86495F8A6FD031F4E96
SHA256:75F080F206FF0C13701FF66388C4A404529D9EC71B2BA0F1FADD4B71481C0475
1944WOMicClientSetup6.1.exeC:\Program Files (x86)\WOMic\Resource_ru.dllexecutable
MD5:7E2CB6A75EACA4D4B18D472F2DA65732
SHA256:A239418A6F98BEE9036666375CF216390F4B942A003D1C7E9294FD7FBDD6C604
304devcon.exeC:\Windows\INF\setupapi.dev.logtext
MD5:F8558170F94A19EE71B38E5D75888B4E
SHA256:0E899946CBD8175E83DA0EC366C156AA197BAEA4EC1BAC062AC5ED0A5299FC9C
1944WOMicClientSetup6.1.exeC:\Program Files (x86)\WOMic\driver\womic.infbinary
MD5:C32CEE4C141EE4C679211964C309DBEF
SHA256:8F2F3339A3CFD98742295B9C5864CE40922C1F6C783AAF70CE31A8DEFC720764
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
83
TCP/UDP connections
62
DNS requests
26
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
400
20.190.159.0:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
text
203 b
whitelisted
—
—
POST
400
40.126.31.0:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
text
203 b
whitelisted
756
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
NL
binary
814 b
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
NL
binary
814 b
whitelisted
—
—
POST
200
40.126.31.0:443
https://login.live.com/RST2.srf
US
xml
1.24 Kb
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
NL
binary
814 b
whitelisted
1268
svchost.exe
GET
200
2.20.245.137:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
756
RUXIMICS.exe
GET
200
2.20.245.137:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
—
—
POST
200
20.190.159.68:443
https://login.live.com/RST2.srf
US
xml
10.3 Kb
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
2.20.245.137:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
756
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
2.20.245.137:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
1268
svchost.exe
2.20.245.137:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
756
RUXIMICS.exe
2.20.245.137:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5944
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
google.com
  • 142.250.186.110
whitelisted
crl.microsoft.com
  • 2.20.245.137
  • 2.20.245.139
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
login.live.com
  • 40.126.31.129
  • 20.190.159.130
  • 40.126.31.71
  • 20.190.159.128
  • 40.126.31.3
  • 20.190.159.73
  • 40.126.31.0
  • 20.190.159.64
whitelisted
go.microsoft.com
  • 95.100.186.9
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
nexusrules.officeapps.live.com
  • 52.111.236.23
  • 52.111.227.11
whitelisted
watson.events.data.microsoft.com
  • 20.42.65.92
whitelisted
self.events.data.microsoft.com
  • 20.50.80.210
  • 20.189.173.2
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WOMicClientSetup6.1.exe