File name:

DropCheats.exe

Full analysis: https://app.any.run/tasks/29588925-9596-4e3e-b82e-5d29b02adec7
Verdict: Malicious activity
Threats:

Stealc is a stealer malware that targets victims’ sensitive data, which it exfiltrates from browsers, messaging apps, and other software. The malware is equipped with advanced features, including fingerprinting, control panel, evasion mechanisms, string obfuscation, etc. Stealc establishes persistence and communicates with its C2 server through HTTP POST requests.

Malware Trends Tracker     >>>
Analysis date: May 21, 2025, 04:53:44
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autoit
telegram
vidar
stealer
stealc
autoit-loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

D801099E442A9D38B186D05ECE829C43

SHA1:

49C7E0DCECB7B731E8CC362CA1232EDAC8D05299

SHA256:

3530D670BA6DD0313904E051B06007475657E9FB3CF1967673E72EC01A915AB9

SSDEEP:

98304:UG8hsfizgxH09lRIwLLqZtgabP5u9pplI2:hw7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AutoIt loader has been detected (YARA)

      • Greatly.com (PID: 7892)

    • VIDAR mutex has been found

      • Greatly.com (PID: 7892)

    • Actions looks like stealing of personal data

      • Greatly.com (PID: 7892)

    • Steals credentials from Web Browsers

      • Greatly.com (PID: 7892)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • DropCheats.exe (PID: 7412)
      • Greatly.com (PID: 7892)

    • Executing commands from a ".bat" file

      • DropCheats.exe (PID: 7412)

    • Starts CMD.EXE for commands execution

      • DropCheats.exe (PID: 7412)
      • cmd.exe (PID: 7476)

    • Get information on the list of running processes

      • cmd.exe (PID: 7476)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 7476)

    • Application launched itself

      • cmd.exe (PID: 7476)

    • The executable file from the user directory is run by the CMD process

      • Greatly.com (PID: 7892)

    • Starts application with an unusual extension

      • cmd.exe (PID: 7476)

    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 7476)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • Greatly.com (PID: 7892)

    • There is functionality for taking screenshot (YARA)

      • Greatly.com (PID: 7892)

    • Searches for installed software

      • Greatly.com (PID: 7892)

    • BASE64 encoded PowerShell command has been detected

      • Greatly.com (PID: 7892)

    • CSC.EXE is used to compile C# code

      • csc.exe (PID: 7872)
      • csc.exe (PID: 2268)
      • csc.exe (PID: 6676)
      • csc.exe (PID: 4488)
      • csc.exe (PID: 4164)
      • csc.exe (PID: 7604)
      • csc.exe (PID: 5332)
      • csc.exe (PID: 6372)
      • csc.exe (PID: 7152)
      • csc.exe (PID: 7828)
      • csc.exe (PID: 6208)
      • csc.exe (PID: 1764)
      • csc.exe (PID: 4164)
      • csc.exe (PID: 4868)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 1052)
      • powershell.exe (PID: 7924)

    • Gets content of a file (POWERSHELL)

      • powershell.exe (PID: 1052)
      • powershell.exe (PID: 7924)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 2268)
      • csc.exe (PID: 7872)
      • csc.exe (PID: 6676)
      • csc.exe (PID: 4488)
      • csc.exe (PID: 7604)
      • csc.exe (PID: 5332)
      • csc.exe (PID: 4164)
      • csc.exe (PID: 7828)
      • csc.exe (PID: 6208)
      • csc.exe (PID: 1764)
      • csc.exe (PID: 6372)
      • csc.exe (PID: 7152)
      • csc.exe (PID: 4868)
      • csc.exe (PID: 4164)

    • The process bypasses the loading of PowerShell profile settings

      • Greatly.com (PID: 7892)

    • Starts POWERSHELL.EXE for commands execution

      • Greatly.com (PID: 7892)

    • The process hide an interactive prompt from the user

      • Greatly.com (PID: 7892)

    • Base64-obfuscated command line is found

      • Greatly.com (PID: 7892)

  • INFO

    • Checks supported languages

      • DropCheats.exe (PID: 7412)
      • extrac32.exe (PID: 7812)
      • Greatly.com (PID: 7892)
      • cvtres.exe (PID: 1388)
      • csc.exe (PID: 7872)
      • csc.exe (PID: 2268)
      • cvtres.exe (PID: 1388)

    • Create files in a temporary directory

      • DropCheats.exe (PID: 7412)
      • extrac32.exe (PID: 7812)
      • powershell.exe (PID: 1052)
      • cvtres.exe (PID: 1388)
      • Greatly.com (PID: 7892)
      • powershell.exe (PID: 7924)
      • csc.exe (PID: 2268)
      • cvtres.exe (PID: 1388)
      • csc.exe (PID: 7872)

    • Reads the computer name

      • DropCheats.exe (PID: 7412)
      • extrac32.exe (PID: 7812)
      • Greatly.com (PID: 7892)

    • Process checks computer location settings

      • DropCheats.exe (PID: 7412)

    • Creates a new folder

      • cmd.exe (PID: 7792)

    • Reads mouse settings

      • Greatly.com (PID: 7892)

    • Creates files in the program directory

      • Greatly.com (PID: 7892)

    • Checks proxy server information

      • Greatly.com (PID: 7892)

    • Reads the software policy settings

      • Greatly.com (PID: 7892)
      • powershell.exe (PID: 1052)
      • powershell.exe (PID: 7924)
      • powershell.exe (PID: 7940)

    • Reads Environment values

      • Greatly.com (PID: 7892)

    • Reads the machine GUID from the registry

      • Greatly.com (PID: 7892)
      • csc.exe (PID: 7872)
      • csc.exe (PID: 2268)

    • Creates files or folders in the user directory

      • Greatly.com (PID: 7892)

    • Reads CPU info

      • Greatly.com (PID: 7892)

    • Reads product name

      • Greatly.com (PID: 7892)

    • Application launched itself

      • chrome.exe (PID: 1164)
      • chrome.exe (PID: 7460)
      • chrome.exe (PID: 4408)
      • chrome.exe (PID: 7952)
      • chrome.exe (PID: 1228)
      • chrome.exe (PID: 4728)
      • chrome.exe (PID: 1512)
      • chrome.exe (PID: 2192)
      • chrome.exe (PID: 6156)
      • chrome.exe (PID: 5376)
      • chrome.exe (PID: 7484)
      • chrome.exe (PID: 5728)
      • chrome.exe (PID: 5596)
      • chrome.exe (PID: 1328)

    • Reads security settings of Internet Explorer

      • powershell.exe (PID: 1052)
      • powershell.exe (PID: 7924)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:04:10 12:19:23+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 25600
InitializedDataSize: 431104
UninitializedDataSize: 16896
EntryPoint: 0x33e9
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
347
Monitored processes
219
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start dropcheats.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs extrac32.exe no specs findstr.exe no specs cmd.exe no specs #VIDAR greatly.com choice.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs slui.exe chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs chrome.exe powershell.exe no specs conhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs csc.exe cvtres.exe no specs chrome.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
232"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3076 --field-trial-handle=1976,i,5218622623068398080,10148179456555333414,262144 --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
444"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1896 --field-trial-handle=1900,i,14925772340159457577,16317982053454734619,262144 --variations-seed-version /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
536"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3128 --field-trial-handle=1884,i,6905460921731230727,16771475211715482626,262144 --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
540"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=3864 --field-trial-handle=2040,i,4434271697836709945,13281434689309758284,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
616"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2080 --field-trial-handle=2084,i,2160831649805590530,1714582705313708372,262144 --variations-seed-version /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
632\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
680C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\admin\AppData\Local\Temp\RES3DFB.tmp" "c:\Users\admin\AppData\Local\Temp\CSC3375CBF1FBC94C5B86B0F543CFB10A1.TMP"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Resource File To COFF Object Conversion Utility
Exit code:
0
Version:
14.32.31326.0
Modules
Images
c:\windows\microsoft.net\framework64\v4.0.30319\cvtres.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\vcruntime140_1_clr0400.dll
684"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3356 --field-trial-handle=1924,i,16343822255578338634,11527711338574306460,262144 --variations-seed-version /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
720"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3088 --field-trial-handle=2000,i,15062661976491841848,15421139762026876140,262144 --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
732"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4192 --field-trial-handle=1916,i,17863046980529779024,16449743194753265432,262144 --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
120 139
Read events
120 070
Write events
69
Delete events
0

Modification events

(PID) Process:(7892) Greatly.comKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7892) Greatly.comKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7892) Greatly.comKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1164) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(1164) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(1164) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(1164) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(1164) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(7460) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(7460) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
14
Suspicious files
159
Text files
400
Unknown types
0

Dropped files

PID
Process
Filename
Type
7412DropCheats.exeC:\Users\admin\AppData\Local\Temp\Vector.mp4binary
MD5:8A9288DB35755925765E53CFAE16BE88
SHA256:E0564C4FCD3C391E3E6C99FACAFF39908C551D5618D6DE1C4A2EA60848EA08BB
7412DropCheats.exeC:\Users\admin\AppData\Local\Temp\Create.mp4binary
MD5:72EB7BDFC05FD67C7DBF55E312A639C3
SHA256:6958AE9C0CBAE0AAFFF1426A5A68625FB765825284B2E5B7A5660EBFB9DFC2AA
7412DropCheats.exeC:\Users\admin\AppData\Local\Temp\Colleges.mp4text
MD5:68A28C7E27EE194FCE5AE4D97DAA520E
SHA256:E62AA14095A248EB180FCF5917A92B298B554D2184ED7E58D0B3D9333562FF75
7412DropCheats.exeC:\Users\admin\AppData\Local\Temp\Religions.mp4binary
MD5:55C8E5D733F35128728FABDC72D6F99C
SHA256:472ED4FC571F92C7E286B764E5FCFCFE2796B3EDAEB91D76DD80EAE315D46E19
7412DropCheats.exeC:\Users\admin\AppData\Local\Temp\Non.mp4compressed
MD5:CE4CA437654819750EBA646A52B4D135
SHA256:B7CD6D4D7BC95D7EC7CC71DE0495A2D4153D7137CE2CC0E83D3938EF31DD7FA8
7476cmd.exeC:\Users\admin\AppData\Local\Temp\Colleges.mp4.battext
MD5:68A28C7E27EE194FCE5AE4D97DAA520E
SHA256:E62AA14095A248EB180FCF5917A92B298B554D2184ED7E58D0B3D9333562FF75
7812extrac32.exeC:\Users\admin\AppData\Local\Temp\Attributesbinary
MD5:3B6EB5EC6E1B41B1F846B6B1E17AD7BB
SHA256:DE6D19577F6E5D08325BBF7772756A2FE433E7328001138B74672C389F63D02E
7812extrac32.exeC:\Users\admin\AppData\Local\Temp\Seekerbinary
MD5:845761807A86E89CB98956F63326E35F
SHA256:66200A1D0C1DAA23611D0798E9FB1BE602C1178A33C7DE31D1F858B95667E7D0
7412DropCheats.exeC:\Users\admin\AppData\Local\Temp\Wyoming.mp4binary
MD5:0DA479E8524B112E5A085D4D4C6CF437
SHA256:414276DD6DCBA2AE72EF2061ACD38ADCA5761221EE8C2A77AC0A976F796F26C5
7812extrac32.exeC:\Users\admin\AppData\Local\Temp\Revisionbinary
MD5:E5500F6B12AC70ADD5D8B2575EDC25C3
SHA256:6B5ECD06CDCCAB47050B487D16204E3D587EBF33F02475248086CA63ECC634BB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
204
DNS requests
169
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5452
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5452
SIHClient.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5452
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
5452
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5452
SIHClient.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
5452
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
5452
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6404
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.68
  • 20.190.159.2
  • 20.190.159.4
  • 40.126.31.67
  • 40.126.31.1
  • 40.126.31.71
  • 20.190.159.128
  • 20.190.159.23
whitelisted
QnTuQrkNLTkxxgMEkzMH.QnTuQrkNLTkxxgMEkzMH
  • —
unknown
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
t.me
  • 149.154.167.99
whitelisted

Threats

PID
Process
Class
Message
7892
Greatly.com
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
—
—
A Network Trojan was detected
ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M1
—
—
Malware Command and Control Activity Detected
ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2
—
—
Malware Command and Control Activity Detected
ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config M1
—
—
Malware Command and Control Activity Detected
ET MALWARE Win32/Stealc/Vidar Stealer Style Headers In HTTP POST M2
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DropCheats.exe