File name:

4363463463464363463463463.exe

Full analysis: https://app.any.run/tasks/6bd6c754-1855-4fa5-b3f7-edb73b70e099
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: May 20, 2025, 19:52:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
hausbomber
github
auto
quasarrat
metasploit
backdoor
meterpreter
payload
cobaltstrike
lumma
stealer
generic
stealc
donutloader
inno
installer
redline
asyncrat
rat
evasion
delphi
possible-phishing
botnet
phorpiex
njrat
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

2A94F3960C58C6E70826495F76D00B85

SHA1:

E2A1A5641295F5EBF01A37AC1C170AC0814BB71A

SHA256:

2FCAD226B17131DA4274E1B9F8F31359BDD325C9568665F08FD1F6C5D06A23CE

SSDEEP:

192:2we8sGKE6MqyG7c20L7BIW12n/ePSmzkTInu8stYcFwVc03KY:9e8sGKfMqyGg20PKn/cRaInuptYcFwVY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • HAUSBOMBER has been detected (YARA)

      • 4363463463464363463463463.exe (PID: 2576)

    • QUASARRAT has been found (auto)

      • 4363463463464363463463463.exe (PID: 2576)
      • svhost.exe (PID: 3096)

    • Uses Task Scheduler to autorun other applications

      • svhost.exe (PID: 3096)
      • svhost.exe (PID: 2872)

    • COBALTSTRIKE has been found (auto)

      • 4363463463464363463463463.exe (PID: 2576)

    • STEALER has been found (auto)

      • 4363463463464363463463463.exe (PID: 2576)
      • 4363463463464363463463463.exe (PID: 2576)

    • METASPLOIT has been detected (SURICATA)

      • 4363463463464363463463463.exe (PID: 2576)

    • METERPRETER has been detected (SURICATA)

      • 4363463463464363463463463.exe (PID: 2576)

    • GENERIC has been found (auto)

      • 4363463463464363463463463.exe (PID: 2576)
      • 4363463463464363463463463.exe (PID: 2576)

    • Script downloads file (POWERSHELL)

      • powershell.exe (PID: 3688)

    • Changes Windows Defender settings

      • XClient.exe (PID: 3072)
      • VClientssss.exe (PID: 4060)
      • Trojan.Malpack.Themida%20(Anti%20VM).exe (PID: 2760)

    • Changes powershell execution policy (Bypass)

      • XClient.exe (PID: 3072)
      • VClientssss.exe (PID: 4060)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 3292)
      • powershell.exe (PID: 3644)
      • powershell.exe (PID: 2880)
      • powershell.exe (PID: 1588)
      • powershell.exe (PID: 1884)
      • powershell.exe (PID: 2236)
      • powershell.exe (PID: 1996)
      • powershell.exe (PID: 2956)

    • Adds path to the Windows Defender exclusion list

      • XClient.exe (PID: 3072)
      • VClientssss.exe (PID: 4060)

    • RAT has been found (auto)

      • 4363463463464363463463463.exe (PID: 2576)
      • 4363463463464363463463463.exe (PID: 2576)

    • Adds process to the Windows Defender exclusion list

      • XClient.exe (PID: 3072)
      • VClientssss.exe (PID: 4060)

    • Changes settings for sending potential threat samples to Microsoft servers

      • powershell.exe (PID: 3912)

    • Changes settings for checking scripts for malicious actions

      • powershell.exe (PID: 3912)

    • Changes Controlled Folder Access settings

      • powershell.exe (PID: 3912)

    • Changes settings for real-time protection

      • powershell.exe (PID: 3912)

    • Changes antivirus protection settings for downloading files from the Internet (IOAVProtection)

      • powershell.exe (PID: 3912)

    • Changes settings for reporting to Microsoft Active Protection Service (MAPS)

      • powershell.exe (PID: 3912)

    • Changes settings for protection against network attacks (IPS)

      • powershell.exe (PID: 3912)

    • Create files in the Startup directory

      • Trojan.Malpack.Themida%20(Anti%20VM).exe (PID: 2760)
      • XClient.exe (PID: 3072)

    • Actions looks like stealing of personal data

      • Trojan.Malpack.Themida%20(Anti%20VM).exe (PID: 2760)

    • Uses Task Scheduler to run other applications

      • XClient.exe (PID: 3072)
      • VClientssss.exe (PID: 4060)

    • Steals credentials from Web Browsers

      • Trojan.Malpack.Themida%20(Anti%20VM).exe (PID: 2760)

    • Changes the autorun value in the registry

      • newtpp.exe (PID: 288)
      • XClient.exe (PID: 3072)

    • PHORPIEX has been detected (SURICATA)

      • syscrondvr.exe (PID: 2868)

    • Executing a file with an untrusted certificate

      • _na.exe (PID: 2088)

    • Connects to the CnC server

      • syscrondvr.exe (PID: 2868)

  • SUSPICIOUS

    • Process requests binary or script from the Internet

      • 4363463463464363463463463.exe (PID: 2576)

    • Reads settings of System Certificates

      • 4363463463464363463463463.exe (PID: 2576)
      • Trojan.Malpack.Themida%20(Anti%20VM).exe (PID: 2760)

    • Adds/modifies Windows certificates

      • 4363463463464363463463463.exe (PID: 2576)
      • Trojan.Malpack.Themida%20(Anti%20VM).exe (PID: 2760)

    • Connects to unusual port

      • 4363463463464363463463463.exe (PID: 2576)
      • svhost.exe (PID: 2872)
      • CPDB.exe (PID: 3204)
      • XClient.exe (PID: 3072)
      • systempreter.exe (PID: 2460)
      • VClientssss.exe (PID: 4060)
      • Microsoft_Hardware_Launch.exe (PID: 2968)

    • Executable content was dropped or overwritten

      • wnbsqv3008.exe (PID: 2564)
      • 4363463463464363463463463.exe (PID: 2576)
      • svhost.exe (PID: 3096)
      • powershell.exe (PID: 3688)
      • XClient.exe (PID: 3072)
      • Trojan.Malpack.Themida%20(Anti%20VM).exe (PID: 2760)
      • FreeYoutubeDownloader.exe (PID: 3804)
      • newtpp.exe (PID: 288)
      • wnbsqv3008.tmp (PID: 3856)
      • VClientssss.exe (PID: 4060)
      • rundll32.exe (PID: 1832)
      • 444.exe (PID: 1060)

    • Reads the Internet Settings

      • 4363463463464363463463463.exe (PID: 2576)
      • client.exe (PID: 3684)
      • powershell.exe (PID: 3688)
      • XClient.exe (PID: 3072)
      • powershell.exe (PID: 3292)
      • powershell.exe (PID: 3644)
      • WMIC.exe (PID: 1196)
      • powershell.exe (PID: 2880)
      • VClientssss.exe (PID: 4060)
      • Trojan.Malpack.Themida%20(Anti%20VM).exe (PID: 2760)
      • powershell.exe (PID: 1588)
      • powershell.exe (PID: 1884)
      • powershell.exe (PID: 2236)
      • powershell.exe (PID: 1996)

    • Creates file in the systems drive root

      • ntvdm.exe (PID: 1460)

    • Reads the Windows owner or organization settings

      • wnbsqv3008.tmp (PID: 3856)

    • Potential Corporate Privacy Violation

      • 4363463463464363463463463.exe (PID: 2576)

    • Reads security settings of Internet Explorer

      • 4363463463464363463463463.exe (PID: 2576)
      • client.exe (PID: 3684)
      • XClient.exe (PID: 3072)
      • VClientssss.exe (PID: 4060)

    • The process creates files with name similar to system file names

      • 4363463463464363463463463.exe (PID: 2576)
      • svhost.exe (PID: 3096)

    • Checks for Java to be installed

      • eeq.exe (PID: 3116)

    • Starts itself from another location

      • svhost.exe (PID: 3096)
      • newtpp.exe (PID: 288)
      • 444.exe (PID: 1060)

    • BASE64 encoded PowerShell command has been detected

      • client.exe (PID: 3684)

    • Reads the BIOS version

      • Trojan.Malpack.Themida%20(Anti%20VM).exe (PID: 2760)

    • Connects to the server without a host name

      • 4363463463464363463463463.exe (PID: 2576)
      • syscrondvr.exe (PID: 2868)

    • Windows Defender mutex has been found

      • vtoroy.exe (PID: 3820)
      • tretiy.exe (PID: 3304)

    • Starts POWERSHELL.EXE for commands execution

      • client.exe (PID: 3684)
      • XClient.exe (PID: 3072)
      • VClientssss.exe (PID: 4060)
      • Trojan.Malpack.Themida%20(Anti%20VM).exe (PID: 2760)

    • Base64-obfuscated command line is found

      • client.exe (PID: 3684)

    • Script adds exclusion path to Windows Defender

      • XClient.exe (PID: 3072)
      • VClientssss.exe (PID: 4060)

    • Using PowerShell to operate with local accounts

      • powershell.exe (PID: 3292)
      • powershell.exe (PID: 3644)
      • powershell.exe (PID: 2880)
      • powershell.exe (PID: 1588)
      • powershell.exe (PID: 1884)
      • powershell.exe (PID: 2236)

    • Process drops legitimate windows executable

      • 4363463463464363463463463.exe (PID: 2576)

    • Script adds exclusion process to Windows Defender

      • XClient.exe (PID: 3072)
      • VClientssss.exe (PID: 4060)

    • Uses WMIC.EXE to obtain Windows Installer data

      • Trojan.Malpack.Themida%20(Anti%20VM).exe (PID: 2760)

    • Accesses product unique identifier via WMI (SCRIPT)

      • WMIC.exe (PID: 1196)

    • Uses ATTRIB.EXE to modify file attributes

      • Trojan.Malpack.Themida%20(Anti%20VM).exe (PID: 2760)

    • Script disables Windows Defender's IPS

      • Trojan.Malpack.Themida%20(Anti%20VM).exe (PID: 2760)

    • Script disables Windows Defender's real-time protection

      • Trojan.Malpack.Themida%20(Anti%20VM).exe (PID: 2760)

    • Checks for external IP

      • Trojan.Malpack.Themida%20(Anti%20VM).exe (PID: 2760)
      • VClientssss.exe (PID: 4060)
      • svchost.exe (PID: 1080)

    • Modifies hosts file to alter network resolution

      • Trojan.Malpack.Themida%20(Anti%20VM).exe (PID: 2760)

    • Drops a system driver (possible attempt to evade defenses)

      • wnbsqv3008.tmp (PID: 3856)

    • The process executes via Task Scheduler

      • Terraria-Multiplayer-Fix-Online.exe (PID: 4028)

    • Application launched itself

      • msiexec.exe (PID: 3560)

    • Uses RUNDLL32.EXE to load library

      • msiexec.exe (PID: 2908)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • Microsoft_Hardware_Launch.exe (PID: 2968)

    • Contacting a server suspected of hosting an CnC

      • syscrondvr.exe (PID: 2868)

    • Executes as Windows Service

      • VSSVC.exe (PID: 2392)

  • INFO

    • Checks supported languages

      • 4363463463464363463463463.exe (PID: 2576)
      • wnbsqv3008.exe (PID: 2564)
      • wnbsqv3008.tmp (PID: 3856)
      • eeq.exe (PID: 3116)
      • javaw.exe (PID: 2024)
      • steamerx.exe (PID: 2384)
      • svhost.exe (PID: 3096)
      • poY.exe (PID: 1548)
      • svhost.exe (PID: 2872)
      • Trojan.Malpack.Themida%20(Anti%20VM).exe (PID: 2760)
      • vtoroy.exe (PID: 3820)
      • winbox.exe (PID: 3344)
      • client.exe (PID: 3684)
      • XClient.exe (PID: 3072)
      • donut.exe (PID: 3656)
      • tretiy.exe (PID: 3304)
      • sigmasigma.exe (PID: 2780)
      • PAETools.exe (PID: 3276)
      • CPDB.exe (PID: 3204)
      • VClientssss.exe (PID: 4060)
      • FreeYoutubeDownloader.exe (PID: 3804)
      • syscrondvr.exe (PID: 2868)
      • newtpp.exe (PID: 288)

    • Disables trace logs

      • 4363463463464363463463463.exe (PID: 2576)
      • powershell.exe (PID: 3688)
      • Trojan.Malpack.Themida%20(Anti%20VM).exe (PID: 2760)
      • VClientssss.exe (PID: 4060)

    • Reads the computer name

      • 4363463463464363463463463.exe (PID: 2576)
      • wnbsqv3008.tmp (PID: 3856)
      • javaw.exe (PID: 2024)
      • steamerx.exe (PID: 2384)
      • svhost.exe (PID: 3096)
      • poY.exe (PID: 1548)
      • svhost.exe (PID: 2872)
      • vtoroy.exe (PID: 3820)
      • client.exe (PID: 3684)
      • XClient.exe (PID: 3072)
      • tretiy.exe (PID: 3304)
      • sigmasigma.exe (PID: 2780)
      • CPDB.exe (PID: 3204)
      • VClientssss.exe (PID: 4060)
      • Trojan.Malpack.Themida%20(Anti%20VM).exe (PID: 2760)

    • Reads the software policy settings

      • 4363463463464363463463463.exe (PID: 2576)
      • Trojan.Malpack.Themida%20(Anti%20VM).exe (PID: 2760)

    • Reads Environment values

      • 4363463463464363463463463.exe (PID: 2576)
      • svhost.exe (PID: 3096)
      • svhost.exe (PID: 2872)
      • sigmasigma.exe (PID: 2780)
      • Trojan.Malpack.Themida%20(Anti%20VM).exe (PID: 2760)
      • VClientssss.exe (PID: 4060)

    • Reads the machine GUID from the registry

      • 4363463463464363463463463.exe (PID: 2576)
      • javaw.exe (PID: 2024)
      • steamerx.exe (PID: 2384)
      • svhost.exe (PID: 3096)
      • svhost.exe (PID: 2872)
      • Trojan.Malpack.Themida%20(Anti%20VM).exe (PID: 2760)
      • XClient.exe (PID: 3072)
      • sigmasigma.exe (PID: 2780)
      • CPDB.exe (PID: 3204)
      • VClientssss.exe (PID: 4060)

    • Create files in a temporary directory

      • wnbsqv3008.exe (PID: 2564)
      • javaw.exe (PID: 2024)
      • Trojan.Malpack.Themida%20(Anti%20VM).exe (PID: 2760)
      • FreeYoutubeDownloader.exe (PID: 3804)

    • Creates files in the program directory

      • javaw.exe (PID: 2024)
      • Trojan.Malpack.Themida%20(Anti%20VM).exe (PID: 2760)

    • Creates files or folders in the user directory

      • svhost.exe (PID: 3096)
      • XClient.exe (PID: 3072)

    • Compiled with Borland Delphi (YARA)

      • wnbsqv3008.tmp (PID: 3856)

    • Detects InnoSetup installer (YARA)

      • wnbsqv3008.exe (PID: 2564)
      • wnbsqv3008.tmp (PID: 3856)

    • Process checks whether UAC notifications are on

      • Trojan.Malpack.Themida%20(Anti%20VM).exe (PID: 2760)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 3292)
      • powershell.exe (PID: 3644)
      • powershell.exe (PID: 2880)
      • powershell.exe (PID: 1588)
      • powershell.exe (PID: 3912)
      • powershell.exe (PID: 1884)
      • powershell.exe (PID: 2236)
      • powershell.exe (PID: 1996)
      • powershell.exe (PID: 1760)

    • The sample compiled with english language support

      • 4363463463464363463463463.exe (PID: 2576)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 2456)

    • The sample compiled with chinese language support

      • wnbsqv3008.tmp (PID: 3856)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:12:22 08:29:10+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 80
CodeSize: 5632
InitializedDataSize: 4608
UninitializedDataSize: -
EntryPoint: 0x3552
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 0.0.0.0
InternalName: 4363463463464363463463463.exe
LegalCopyright:
OriginalFileName: 4363463463464363463463463.exe
ProductVersion: 0.0.0.0
AssemblyVersion: 0.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
128
Monitored processes
62
Malicious processes
9
Suspicious processes
10

Behavior graph

Click at the process to see the details
start #HAUSBOMBER 4363463463464363463463463.exe ntvdm.exe no specs wnbsqv3008.exe wnbsqv3008.tmp eeq.exe no specs javaw.exe no specs icacls.exe no specs steamerx.exe no specs #QUASARRAT svhost.exe poy.exe no specs schtasks.exe no specs svhost.exe schtasks.exe no specs trojan.malpack.themida%20(anti%20vm).exe winbox.exe no specs vtoroy.exe no specs client.exe no specs powershell.exe xclient.exe donut.exe no specs tretiy.exe no specs sigmasigma.exe no specs paetools.exe no specs powershell.exe no specs cpdb.exe powershell.exe no specs vclientssss.exe powershell.exe no specs wmic.exe no specs powershell.exe no specs attrib.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs schtasks.exe no specs powershell.exe no specs newtpp.exe powershell.exe no specs powershell.exe no specs freeyoutubedownloader.exe powershell.exe no specs #PHORPIEX syscrondvr.exe free youtube downloader.exe no specs microsoft_hardware_launch.exe schtasks.exe no specs terraria-multiplayer-fix-online.exe no specs cabal.exe important%20document.exe no specs msiexec.exe ntvdm.exe no specs 444.exe msiexec.exe no specs msiexec.exe no specs rundll32.exe systempreter.exe netsh.exe no specs _na.exe no specs 2714712914.exe no specs conhost.exe no specs vssvc.exe no specs svchost.exe 4363463463464363463463463.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
288"C:\Users\admin\Desktop\Files\newtpp.exe" C:\Users\admin\Desktop\Files\newtpp.exe
4363463463464363463463463.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\files\newtpp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
752"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Terraria-Multiplayer-Fix-Online" /tr "C:\Users\admin\AppData\Local\Terraria-Multiplayer-Fix-Online.exe"C:\Windows\System32\schtasks.exe—XClient.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1020"C:\Users\admin\Desktop\Files\Important%20Document.exe" C:\Users\admin\Desktop\Files\Important%20Document.exe—4363463463464363463463463.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\files\important%20document.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1060"C:\Users\admin\Desktop\Files\444.exe" C:\Users\admin\Desktop\Files\444.exe
4363463463464363463463463.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\files\444.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1080C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1196"wmic.exe" csproduct get uuidC:\Windows\System32\wbem\WMIC.exe—Trojan.Malpack.Themida%20(Anti%20VM).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1408netsh firewall add allowedprogram "C:\Users\admin\Desktop\Files\Microsoft_Hardware_Launch.exe" "Microsoft_Hardware_Launch.exe" ENABLEC:\Windows\System32\netsh.exe—Microsoft_Hardware_Launch.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1460"C:\Windows\system32\ntvdm.exe" -i1 C:\Windows\System32\ntvdm.exe—4363463463464363463463463.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
NTVDM.EXE
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntvdm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1548"C:\Users\admin\Desktop\Files\poY.exe" C:\Users\admin\Desktop\Files\poY.exe—4363463463464363463463463.exe
User:
admin
Integrity Level:
HIGH
Description:
Client
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\files\poy.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1588"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Terraria-Multiplayer-Fix-Online.exe'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—XClient.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
Total events
43 085
Read events
42 630
Write events
439
Delete events
16

Modification events

(PID) Process:(2576) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2576) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2576) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2576) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(2576) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2576) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2576) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2576) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2576) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASMANCS
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2576) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\4363463463464363463463463_RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
Executable files
67
Suspicious files
40
Text files
12
Unknown types
0

Dropped files

PID
Process
Filename
Type
25764363463463464363463463463.exeC:\Users\admin\Desktop\Files\svchost.exeexecutable
MD5:92C75C7EEB885C33599830C4DC54FED6
SHA256:9839824613DDB8E89AC5EE022058AC7C2950252692757767D10A94FF8D5D958B
1460ntvdm.exeC:\Users\admin\AppData\Local\Temp\scs2229.tmptext
MD5:8CF6DDB5AA59B49F34B967CD46F013B6
SHA256:EE06792197C3E025B84860A72460EAF628C66637685F8C52C5A08A9CC35D376C
25764363463463464363463463463.exeC:\Users\admin\Desktop\Files\svhost.exeexecutable
MD5:E3CFE28100238A1001C8CCA4AF39C574
SHA256:78F9C811E589FF1F25D363080CE8D338FA68F6D2A220B1DD0360E799BBC17A12
3096svhost.exeC:\Users\admin\AppData\Roaming\svhost\svhost.exeexecutable
MD5:E3CFE28100238A1001C8CCA4AF39C574
SHA256:78F9C811E589FF1F25D363080CE8D338FA68F6D2A220B1DD0360E799BBC17A12
2564wnbsqv3008.exeC:\Users\admin\AppData\Local\Temp\is-CGB5M.tmp\wnbsqv3008.tmpexecutable
MD5:1AFBD25DB5C9A90FE05309F7C4FBCF09
SHA256:3BB0EE5569FE5453C6B3FA25AA517B925D4F8D1F7BA3475E58FA09C46290658C
25764363463463464363463463463.exeC:\Users\admin\Desktop\Files\Trojan.Malpack.Themida%20(Anti%20VM).exeexecutable
MD5:922246D2938C77B783E112830796AA9F
SHA256:C7ABFF0928C85D80FCAAD1CA24ECFE50A979F377652B96F25E3574A2ECA772BF
1460ntvdm.exeC:\Users\admin\AppData\Local\Temp\scs223A.tmptext
MD5:4C361DEA398F7AEEF49953BDC0AB4A9B
SHA256:06D61C23E6CA59B9DDAD1796ECCC42C032CD8F6F424AF6CFEE5D085D36FF7DFD
25764363463463464363463463463.exeC:\Users\admin\Desktop\Files\eeq.exeexecutable
MD5:0D98176B534852FF9B44EA2B6B0DD223
SHA256:E02CDA46CEB82557B52CCA99D31D2F62F743EB9333BA67E9CB482357767AC773
25764363463463464363463463463.exeC:\Users\admin\Desktop\Files\TORRENTOLD-1.exeexecutable
MD5:949102FCD293934060C6F3572ADC46FE
SHA256:796CE3E06BC10916427B847A1B6C2F1EAA9904F95DB66E35C28CEBEC34EFC9C5
25764363463463464363463463463.exeC:\Users\admin\Desktop\Files\wnbsqv3008.exeexecutable
MD5:BC8CACD01AA943FBFBF9880D970C56AB
SHA256:6AB14C6E948BA0DF9AE1C257A15F84F206A23726337FF740CD47858237FE1EE7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
24
TCP/UDP connections
46
DNS requests
27
Threats
64

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2868
syscrondvr.exe
GET
200
185.156.72.39:80
http://185.156.72.39/2
unknown
—
—
malicious
2576
4363463463464363463463463.exe
GET
200
154.29.78.35:80
http://tirtasentosa.com/give/prin001.exe
unknown
—
—
—
2576
4363463463464363463463463.exe
GET
200
47.116.181.251:1111
http://47.116.181.251:1111/02.08.2022.exe
unknown
—
—
—
2576
4363463463464363463463463.exe
GET
200
196.251.66.192:80
http://gdx.o7lab.me/1.exe
unknown
—
—
malicious
2576
4363463463464363463463463.exe
GET
200
117.72.36.133:80
http://e4l4.com/beacon_x64.exe
unknown
—
—
—
2576
4363463463464363463463463.exe
GET
200
87.121.84.254:80
http://fox-news-checker.cc/1337/TORRENTOLD-1.exe
unknown
—
—
—
2576
4363463463464363463463463.exe
GET
200
176.122.27.90:9999
http://176.122.27.90:9999/sup.exe
unknown
—
—
malicious
2576
4363463463464363463463463.exe
GET
301
140.82.121.3:80
http://github.com/rimase12/urika/raw/refs/heads/main/vtoroy.exe
unknown
—
—
whitelisted
2576
4363463463464363463463463.exe
GET
200
103.123.98.86:80
http://103.123.98.86/winbox/winbox.exe
unknown
—
—
—
2576
4363463463464363463463463.exe
GET
301
140.82.121.3:80
http://github.com/auracodersigmatoilete/storage/raw/refs/heads/main/download/client.exe
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
2576
4363463463464363463463463.exe
151.101.66.49:443
urlhaus.abuse.ch
FASTLY
US
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
2576
4363463463464363463463463.exe
47.116.181.251:1111
—
Hangzhou Alibaba Advertising Co.,Ltd.
CN
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
2576
4363463463464363463463463.exe
117.24.12.150:443
soft.wsyhn.com
Quanzhou
CN
unknown
2576
4363463463464363463463463.exe
87.121.84.254:80
fox-news-checker.cc
SKAT TV Ltd.
BG
unknown
2576
4363463463464363463463463.exe
89.163.145.170:443
envs.sh
myLoc managed IT AG
DE
unknown
2576
4363463463464363463463463.exe
47.79.66.205:443
a12xxx1.oss-cn-hongkong.aliyuncs.com
WINDSTREAM
US
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.78
whitelisted
urlhaus.abuse.ch
  • 151.101.66.49
  • 151.101.130.49
  • 151.101.194.49
  • 151.101.2.49
whitelisted
soft.wsyhn.com
  • 117.24.12.150
malicious
fox-news-checker.cc
  • 87.121.84.254
unknown
envs.sh
  • 89.163.145.170
unknown
a12xxx1.oss-cn-hongkong.aliyuncs.com
  • 47.79.66.205
unknown
raw.githubusercontent.com
  • 185.199.108.133
  • 185.199.110.133
  • 185.199.109.133
  • 185.199.111.133
whitelisted
gdx.o7lab.me
  • 196.251.66.192
malicious
e4l4.com
  • 117.72.36.133
unknown
github.com
  • 140.82.121.4
  • 140.82.121.3
whitelisted

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
—
—
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
—
—
Misc activity
ET INFO Packed Executable Download
—
—
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
—
—
Misc activity
ET INFO DNS Query to Alibaba Cloud CDN Domain (aliyuncs .com)
—
—
Misc activity
ET INFO Observed Alibaba Cloud CDN Domain (aliyuncs .com in TLS SNI)
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
—
—
A Network Trojan was detected
ET MALWARE Single char EXE direct download likely trojan (multiple families)
—
—
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 42
Process
Message
4363463463464363463463463.exe
The specified executable is not a valid application for this OS platform.
4363463463464363463463463.exe
The specified executable is not a valid application for this OS platform.
4363463463464363463463463.exe
The specified executable is not a valid application for this OS platform.
4363463463464363463463463.exe
The specified executable is not a valid application for this OS platform.
4363463463464363463463463.exe
The specified executable is not a valid application for this OS platform.
4363463463464363463463463.exe
The underlying connection was closed: An unexpected error occurred on a send.
4363463463464363463463463.exe
The specified executable is not a valid application for this OS platform.
4363463463464363463463463.exe
The specified executable is not a valid application for this OS platform.
4363463463464363463463463.exe
The specified executable is not a valid application for this OS platform.
4363463463464363463463463.exe
The specified executable is not a valid application for this OS platform.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
4363463463464363463463463.exe