File name:

DropCheats.exe

Full analysis: https://app.any.run/tasks/29588925-9596-4e3e-b82e-5d29b02adec7
Verdict: Malicious activity
Threats:

Stealc is a stealer malware that targets victims’ sensitive data, which it exfiltrates from browsers, messaging apps, and other software. The malware is equipped with advanced features, including fingerprinting, control panel, evasion mechanisms, string obfuscation, etc. Stealc establishes persistence and communicates with its C2 server through HTTP POST requests.

Malware Trends Tracker     >>>
Analysis date: May 21, 2025, 04:53:44
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autoit
telegram
vidar
stealer
stealc
autoit-loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

D801099E442A9D38B186D05ECE829C43

SHA1:

49C7E0DCECB7B731E8CC362CA1232EDAC8D05299

SHA256:

3530D670BA6DD0313904E051B06007475657E9FB3CF1967673E72EC01A915AB9

SSDEEP:

98304:UG8hsfizgxH09lRIwLLqZtgabP5u9pplI2:hw7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AutoIt loader has been detected (YARA)

      • Greatly.com (PID: 7892)

    • VIDAR mutex has been found

      • Greatly.com (PID: 7892)

    • Actions looks like stealing of personal data

      • Greatly.com (PID: 7892)

    • Steals credentials from Web Browsers

      • Greatly.com (PID: 7892)

  • SUSPICIOUS

    • Starts application with an unusual extension

      • cmd.exe (PID: 7476)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 7476)
      • DropCheats.exe (PID: 7412)

    • Application launched itself

      • cmd.exe (PID: 7476)

    • Get information on the list of running processes

      • cmd.exe (PID: 7476)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 7476)

    • Executing commands from a ".bat" file

      • DropCheats.exe (PID: 7412)

    • Reads security settings of Internet Explorer

      • DropCheats.exe (PID: 7412)
      • Greatly.com (PID: 7892)

    • The executable file from the user directory is run by the CMD process

      • Greatly.com (PID: 7892)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 7476)

    • There is functionality for taking screenshot (YARA)

      • Greatly.com (PID: 7892)

    • Searches for installed software

      • Greatly.com (PID: 7892)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • Greatly.com (PID: 7892)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 1052)
      • powershell.exe (PID: 7924)

    • Gets content of a file (POWERSHELL)

      • powershell.exe (PID: 1052)
      • powershell.exe (PID: 7924)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 7872)
      • csc.exe (PID: 2268)
      • csc.exe (PID: 5332)
      • csc.exe (PID: 4488)
      • csc.exe (PID: 4164)
      • csc.exe (PID: 1764)
      • csc.exe (PID: 7604)
      • csc.exe (PID: 6676)
      • csc.exe (PID: 7152)
      • csc.exe (PID: 7828)
      • csc.exe (PID: 6372)
      • csc.exe (PID: 6208)
      • csc.exe (PID: 4164)
      • csc.exe (PID: 4868)

    • BASE64 encoded PowerShell command has been detected

      • Greatly.com (PID: 7892)

    • Starts POWERSHELL.EXE for commands execution

      • Greatly.com (PID: 7892)

    • The process hide an interactive prompt from the user

      • Greatly.com (PID: 7892)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 2268)
      • csc.exe (PID: 7872)
      • csc.exe (PID: 6676)
      • csc.exe (PID: 4488)
      • csc.exe (PID: 4164)
      • csc.exe (PID: 7604)
      • csc.exe (PID: 5332)
      • csc.exe (PID: 6372)
      • csc.exe (PID: 7828)
      • csc.exe (PID: 7152)
      • csc.exe (PID: 6208)
      • csc.exe (PID: 1764)
      • csc.exe (PID: 4164)
      • csc.exe (PID: 4868)

    • The process bypasses the loading of PowerShell profile settings

      • Greatly.com (PID: 7892)

    • Base64-obfuscated command line is found

      • Greatly.com (PID: 7892)

  • INFO

    • Creates a new folder

      • cmd.exe (PID: 7792)

    • Reads the computer name

      • extrac32.exe (PID: 7812)
      • DropCheats.exe (PID: 7412)
      • Greatly.com (PID: 7892)

    • Checks supported languages

      • extrac32.exe (PID: 7812)
      • DropCheats.exe (PID: 7412)
      • Greatly.com (PID: 7892)
      • cvtres.exe (PID: 1388)
      • csc.exe (PID: 7872)
      • cvtres.exe (PID: 1388)
      • csc.exe (PID: 2268)

    • Process checks computer location settings

      • DropCheats.exe (PID: 7412)

    • Create files in a temporary directory

      • DropCheats.exe (PID: 7412)
      • extrac32.exe (PID: 7812)
      • powershell.exe (PID: 1052)
      • cvtres.exe (PID: 1388)
      • csc.exe (PID: 7872)
      • Greatly.com (PID: 7892)
      • csc.exe (PID: 2268)
      • cvtres.exe (PID: 1388)
      • powershell.exe (PID: 7924)

    • Reads mouse settings

      • Greatly.com (PID: 7892)

    • Reads the software policy settings

      • Greatly.com (PID: 7892)
      • powershell.exe (PID: 1052)
      • powershell.exe (PID: 7924)
      • powershell.exe (PID: 7940)

    • Creates files in the program directory

      • Greatly.com (PID: 7892)

    • Checks proxy server information

      • Greatly.com (PID: 7892)

    • Reads Environment values

      • Greatly.com (PID: 7892)

    • Reads the machine GUID from the registry

      • Greatly.com (PID: 7892)
      • csc.exe (PID: 7872)
      • csc.exe (PID: 2268)

    • Creates files or folders in the user directory

      • Greatly.com (PID: 7892)

    • Reads CPU info

      • Greatly.com (PID: 7892)

    • Reads product name

      • Greatly.com (PID: 7892)

    • Reads security settings of Internet Explorer

      • powershell.exe (PID: 1052)
      • powershell.exe (PID: 7924)

    • Application launched itself

      • chrome.exe (PID: 1164)
      • chrome.exe (PID: 7460)
      • chrome.exe (PID: 4408)
      • chrome.exe (PID: 7952)
      • chrome.exe (PID: 1228)
      • chrome.exe (PID: 1512)
      • chrome.exe (PID: 4728)
      • chrome.exe (PID: 5728)
      • chrome.exe (PID: 6156)
      • chrome.exe (PID: 5376)
      • chrome.exe (PID: 7484)
      • chrome.exe (PID: 5596)
      • chrome.exe (PID: 2192)
      • chrome.exe (PID: 1328)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:04:10 12:19:23+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 25600
InitializedDataSize: 431104
UninitializedDataSize: 16896
EntryPoint: 0x33e9
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
347
Monitored processes
219
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start dropcheats.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs #VIDAR greatly.com choice.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs slui.exe chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
232"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3076 --field-trial-handle=1976,i,5218622623068398080,10148179456555333414,262144 --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
444"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1896 --field-trial-handle=1900,i,14925772340159457577,16317982053454734619,262144 --variations-seed-version /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
536"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3128 --field-trial-handle=1884,i,6905460921731230727,16771475211715482626,262144 --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
540"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=3864 --field-trial-handle=2040,i,4434271697836709945,13281434689309758284,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
616"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2080 --field-trial-handle=2084,i,2160831649805590530,1714582705313708372,262144 --variations-seed-version /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
632\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
680C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES3DFB.tmp" "c:\Users\admin\AppData\Local\Temp\CSC3375CBF1FBC94C5B86B0F543CFB10A1.TMP"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.32.31326.0
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_1_clr0400.dll
684"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3356 --field-trial-handle=1924,i,16343822255578338634,11527711338574306460,262144 --variations-seed-version /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
720"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3088 --field-trial-handle=2000,i,15062661976491841848,15421139762026876140,262144 --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
732"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4192 --field-trial-handle=1916,i,17863046980529779024,16449743194753265432,262144 --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
120 139
Read events
120 070
Write events
69
Delete events
0

Modification events

(PID) Process:(7892) Greatly.comKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7892) Greatly.comKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7892) Greatly.comKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1164) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(1164) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(1164) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(1164) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(1164) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(7460) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(7460) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
14
Suspicious files
159
Text files
400
Unknown types
0

Dropped files

PID
Process
Filename
Type
7412DropCheats.exeC:\Users\admin\AppData\Local\Temp\Colleges.mp4text
MD5:68A28C7E27EE194FCE5AE4D97DAA520E
SHA256:E62AA14095A248EB180FCF5917A92B298B554D2184ED7E58D0B3D9333562FF75
7412DropCheats.exeC:\Users\admin\AppData\Local\Temp\Vector.mp4binary
MD5:8A9288DB35755925765E53CFAE16BE88
SHA256:E0564C4FCD3C391E3E6C99FACAFF39908C551D5618D6DE1C4A2EA60848EA08BB
7412DropCheats.exeC:\Users\admin\AppData\Local\Temp\Religions.mp4binary
MD5:55C8E5D733F35128728FABDC72D6F99C
SHA256:472ED4FC571F92C7E286B764E5FCFCFE2796B3EDAEB91D76DD80EAE315D46E19
7412DropCheats.exeC:\Users\admin\AppData\Local\Temp\Non.mp4compressed
MD5:CE4CA437654819750EBA646A52B4D135
SHA256:B7CD6D4D7BC95D7EC7CC71DE0495A2D4153D7137CE2CC0E83D3938EF31DD7FA8
7412DropCheats.exeC:\Users\admin\AppData\Local\Temp\Create.mp4binary
MD5:72EB7BDFC05FD67C7DBF55E312A639C3
SHA256:6958AE9C0CBAE0AAFFF1426A5A68625FB765825284B2E5B7A5660EBFB9DFC2AA
7812extrac32.exeC:\Users\admin\AppData\Local\Temp\Delaysbinary
MD5:259A84CE39FCD9E09223EB606A26E49E
SHA256:D33E9302DBBE729468A657628E9ABA0C103F205C9948E004EF1D7AABA42B5922
7812extrac32.exeC:\Users\admin\AppData\Local\Temp\Asianbinary
MD5:C47C609387F3A168B410095E84E2233B
SHA256:295AFAD0CA0AA8A7DC50288F7E60A1F18C2F4C96F3F3FFDDF641B925BC9A954F
7812extrac32.exeC:\Users\admin\AppData\Local\Temp\Seekerbinary
MD5:845761807A86E89CB98956F63326E35F
SHA256:66200A1D0C1DAA23611D0798E9FB1BE602C1178A33C7DE31D1F858B95667E7D0
7476cmd.exeC:\Users\admin\AppData\Local\Temp\Colleges.mp4.battext
MD5:68A28C7E27EE194FCE5AE4D97DAA520E
SHA256:E62AA14095A248EB180FCF5917A92B298B554D2184ED7E58D0B3D9333562FF75
7812extrac32.exeC:\Users\admin\AppData\Local\Temp\Interpretationbinary
MD5:26486FA7B85F27F4308F9EFE1B773046
SHA256:D623A23B971B256F15243FC156DB45965CB248305563EA4B5D1E4F1B7C8EEE48
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
204
DNS requests
169
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5452
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
5452
SIHClient.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5452
SIHClient.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
5452
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5452
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
5452
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
5452
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6404
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.68
  • 20.190.159.2
  • 20.190.159.4
  • 40.126.31.67
  • 40.126.31.1
  • 40.126.31.71
  • 20.190.159.128
  • 20.190.159.23
whitelisted
QnTuQrkNLTkxxgMEkzMH.QnTuQrkNLTkxxgMEkzMH
  • —
unknown
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
t.me
  • 149.154.167.99
whitelisted

Threats

PID
Process
Class
Message
7892
Greatly.com
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
—
—
A Network Trojan was detected
ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1
—
—
Malware Command and Control Activity Detected
ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2
—
—
Malware Command and Control Activity Detected
ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1
—
—
Malware Command and Control Activity Detected
ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DropCheats.exe