File name:

svchost.exe

Full analysis: https://app.any.run/tasks/48d7c520-928f-4cce-932f-93b5f5724934
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: June 13, 2025, 17:12:55
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
discord
exfiltration
stealer
remote
xworm
ims-api
generic
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

1CF266A720760B0D7D596A080E8544CA

SHA1:

037DADDEFFFF948EF2D75D00FC9FED5EF38A95F2

SHA256:

39391D8C534CD9C216D8F3CF940261C3B2F3BCA01CB94C44849F40822F8BB751

SSDEEP:

3072:hCy3/iP9MnYc9c3E1T+VpmnaqEHBAnpK37nXb8+05MQ7W/F2st4DyHm6gznn555V:d3/GOnY+JApmn083I/FwP6t3z1N

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Known privilege escalation attack

      • dllhost.exe (PID: 6388)

    • XWORM has been detected (SURICATA)

      • unsecapp.exe (PID: 3572)

    • Create files in the Startup directory

      • unsecapp.exe (PID: 3572)

    • XWORM has been detected (YARA)

      • unsecapp.exe (PID: 3572)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • svchost.exe (PID: 1496)

    • Reads security settings of Internet Explorer

      • svchost.exe (PID: 1496)

    • Probably UAC bypass using CMSTP.exe (Connection Manager service profile)

      • svchost.exe (PID: 1496)

    • Starts CMD.EXE for commands execution

      • mshta.exe (PID: 5904)

    • The executable file from the user directory is run by the CMD process

      • svchost.exe (PID: 504)

    • Runs shell command (SCRIPT)

      • mshta.exe (PID: 5904)
      • mshta.exe (PID: 6700)

    • Checks for external IP

      • svchost.exe (PID: 504)
      • svchost.exe (PID: 2200)

    • The process connected to a server suspected of theft

      • svchost.exe (PID: 504)

    • Executable content was dropped or overwritten

      • svchost.exe (PID: 504)
      • unsecapp.exe (PID: 3572)

    • The process executes via Task Scheduler

      • unsecapp.exe (PID: 3572)

    • Uses TASKKILL.EXE to kill process

      • mshta.exe (PID: 6700)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 2200)

    • Reads the BIOS version

      • unsecapp.exe (PID: 3572)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • unsecapp.exe (PID: 3572)

    • Contacting a server suspected of hosting an CnC

      • unsecapp.exe (PID: 3572)

    • Connects to unusual port

      • unsecapp.exe (PID: 3572)

  • INFO

    • Reads the machine GUID from the registry

      • svchost.exe (PID: 1496)
      • svchost.exe (PID: 504)
      • unsecapp.exe (PID: 3572)

    • Checks supported languages

      • svchost.exe (PID: 1496)
      • svchost.exe (PID: 504)
      • unsecapp.exe (PID: 3572)

    • Reads the computer name

      • svchost.exe (PID: 1496)
      • svchost.exe (PID: 504)
      • unsecapp.exe (PID: 3572)

    • Disables trace logs

      • cmstp.exe (PID: 2192)
      • svchost.exe (PID: 504)

    • Process checks computer location settings

      • svchost.exe (PID: 1496)

    • Checks transactions between databases Windows and Oracle

      • cmstp.exe (PID: 2192)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 5904)
      • mshta.exe (PID: 6700)

    • Reads Environment values

      • svchost.exe (PID: 504)

    • Checks proxy server information

      • svchost.exe (PID: 504)
      • slui.exe (PID: 5764)

    • Reads the software policy settings

      • svchost.exe (PID: 504)
      • slui.exe (PID: 5764)

    • Creates files in the program directory

      • dllhost.exe (PID: 6388)

    • Create files in a temporary directory

      • svchost.exe (PID: 504)
      • unsecapp.exe (PID: 3572)

    • Creates files or folders in the user directory

      • unsecapp.exe (PID: 3572)

    • Manual execution by a user

      • Taskmgr.exe (PID: 3836)
      • Taskmgr.exe (PID: 3956)

    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 3836)

    • Launching a file from the Startup directory

      • unsecapp.exe (PID: 3572)

    • Reads CPU info

      • unsecapp.exe (PID: 3572)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:06:04 15:11:23+00:00
ImageFileCharacteristics: Executable
PEType: PE32
LinkerVersion: 8
CodeSize: 228864
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x39d8e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 1.0.0.0
InternalName: injection.exe
LegalCopyright:
OriginalFileName: injection.exe
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
162
Monitored processes
16
Malicious processes
2
Suspicious processes
4

Behavior graph

Click at the process to see the details
start svchost.exe no specs cmstp.exe no specs CMSTPLUA mshta.exe no specs cmd.exe no specs conhost.exe no specs svchost.exe mshta.exe no specs taskkill.exe no specs conhost.exe no specs svchost.exe #XWORM unsecapp.exe taskmgr.exe no specs taskmgr.exe rundll32.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
504"C:\Users\admin\AppData\Local\Temp\svchost.exe" C:\Users\admin\AppData\Local\Temp\svchost.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1332"C:\Windows\System32\cmd.exe" /c start "" "C:\Users\admin\AppData\Local\Temp\svchost.exe"C:\Windows\System32\cmd.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1496"C:\Users\admin\AppData\Local\Temp\svchost.exe" C:\Users\admin\AppData\Local\Temp\svchost.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1828\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2192"C:\WINDOWS\system32\cmstp.exe" /au C:\WINDOWS\temp\yzsp21iq.infC:\Windows\System32\cmstp.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Connection Manager Profile Installer
Exit code:
1
Version:
7.2.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmstp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2200C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3572"C:\Users\admin\AppData\Local\Temp\unsecapp.exe"C:\Users\admin\AppData\Local\Temp\unsecapp.exe
svchost.exe
User:
admin
Integrity Level:
HIGH
Description:
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\unsecapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3628\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—taskkill.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3836"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Manager
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\combase.dll
3956"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Manager
Exit code:
3221226540
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
Total events
9 373
Read events
9 336
Write events
36
Delete events
1

Modification events

(PID) Process:(2192) cmstp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CMSTP
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2192) cmstp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CMSTP
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(2192) cmstp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CMSTP
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2192) cmstp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CMSTP
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2192) cmstp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CMSTP
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(2192) cmstp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CMSTP
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2192) cmstp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\CMSTP
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(1496) svchost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1496) svchost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1496) svchost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
Executable files
3
Suspicious files
1
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
504svchost.exeC:\Users\admin\AppData\Local\Temp\unsecapp.exeexecutable
MD5:1CF266A720760B0D7D596A080E8544CA
SHA256:39391D8C534CD9C216D8F3CF940261C3B2F3BCA01CB94C44849F40822F8BB751
3572unsecapp.exeC:\Users\admin\AppData\Local\Temp\Log.tmptext
MD5:F4220D91E9161577385A440C08BD9EF3
SHA256:0400004FC06763039057B56DF712FD8961D3FC7D7FD54E1C7306BB31EA0C8F36
3572unsecapp.exeC:\Users\admin\AppData\Local\unsecapp.exeexecutable
MD5:1CF266A720760B0D7D596A080E8544CA
SHA256:39391D8C534CD9C216D8F3CF940261C3B2F3BCA01CB94C44849F40822F8BB751
3572unsecapp.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\unsecapp.lnkbinary
MD5:8C3B1D9AA5BE48A8A6E7E06F9C62F8B8
SHA256:C8361DFB6423C9373EFC8B51EC5CEB97AA30EBEA894F03E7200E56D6869051DB
1496svchost.exeC:\Windows\Temp\yzsp21iq.inftext
MD5:6BC3B048B83ACA583379E087B37D7A83
SHA256:4B6AC3C048132F90494F763344A3EE2EFC284A77A338AB0D9860C62BA66CD612
3836Taskmgr.exeC:\Users\admin\AppData\Local\D3DSCache\3534848bb9f4cb71\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.locktext
MD5:F49655F856ACB8884CC0ACE29216F511
SHA256:7852FCE59C67DDF1D6B8B997EAA1ADFAC004A9F3A91C37295DE9223674011FBA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
47
DNS requests
25
Threats
29

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2668
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
504
svchost.exe
GET
200
208.95.112.1:80
http://ip-api.com/csv/?fields=status,query
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2552
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2552
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7096
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
2.16.252.233:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
6680
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4648
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
504
svchost.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted
504
svchost.exe
162.159.136.232:443
discord.com
CLOUDFLARENET
—
whitelisted
2668
svchost.exe
20.190.160.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2668
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.110
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
discord.com
  • 162.159.136.232
  • 162.159.138.232
  • 162.159.128.233
  • 162.159.137.232
  • 162.159.135.232
whitelisted
login.live.com
  • 20.190.160.128
  • 20.190.160.131
  • 20.190.160.20
  • 40.126.32.133
  • 40.126.32.68
  • 40.126.32.134
  • 20.190.160.3
  • 20.190.160.22
  • 20.190.160.17
  • 40.126.32.136
  • 40.126.32.76
  • 20.190.160.66
  • 40.126.32.74
  • 20.190.160.65
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 2.17.190.73
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
whitelisted
www.microsoft.com
  • 23.219.150.101
  • 2.23.181.156
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.19
whitelisted

Threats

PID
Process
Class
Message
504
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
2200
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2200
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
504
svchost.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
2200
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
2200
svchost.exe
Misc activity
ET INFO Discord Chat Service Domain in DNS Lookup (discord .com)
504
svchost.exe
Misc activity
ET INFO Observed Discord Service Domain (discord .com) in TLS SNI
504
svchost.exe
Successful Credential Theft Detected
STEALER [ANY.RUN] Attempt to exfiltrate via Discord
2200
svchost.exe
Potential Corporate Privacy Violation
ET INFO DNS Query to a Reverse Proxy Service Observed
2200
svchost.exe
Misc activity
ET INFO DNS Query for Port Mapping/Tunneling Service Domain (.portmap .io)
Process
Message
unsecapp.exe
UnspecifiedError calling waveInOpen
unsecapp.exe
System.ArgumentException: Parameter is not valid. at System.Drawing.Bitmap..ctor(Int32 width, Int32 height, PixelFormat format) at System.Drawing.Bitmap..ctor(Image original, Int32 width, Int32 height) at System.Drawing.Bitmap..ctor(Image original, Size newSize) at Plugin.RemoteDesktop.Capture(Size size, Int32 Q)
unsecapp.exe
System.ArgumentException: Parameter is not valid. at System.Drawing.Bitmap..ctor(Int32 width, Int32 height, PixelFormat format) at System.Drawing.Bitmap..ctor(Image original, Int32 width, Int32 height) at System.Drawing.Bitmap..ctor(Image original, Size newSize) at Plugin.RemoteDesktop.Capture(Size size, Int32 Q)
unsecapp.exe
System.ArgumentException: Parameter is not valid. at System.Drawing.Bitmap..ctor(Int32 width, Int32 height, PixelFormat format) at System.Drawing.Bitmap..ctor(Image original, Int32 width, Int32 height) at System.Drawing.Bitmap..ctor(Image original, Size newSize) at Plugin.RemoteDesktop.Capture(Size size, Int32 Q)
unsecapp.exe
System.ArgumentException: Parameter is not valid. at System.Drawing.Bitmap..ctor(Int32 width, Int32 height, PixelFormat format) at System.Drawing.Bitmap..ctor(Image original, Int32 width, Int32 height) at System.Drawing.Bitmap..ctor(Image original, Size newSize) at Plugin.RemoteDesktop.Capture(Size size, Int32 Q)
unsecapp.exe
System.ArgumentException: Parameter is not valid. at System.Drawing.Bitmap..ctor(Int32 width, Int32 height, PixelFormat format) at System.Drawing.Bitmap..ctor(Image original, Int32 width, Int32 height) at System.Drawing.Bitmap..ctor(Image original, Size newSize) at Plugin.RemoteDesktop.Capture(Size size, Int32 Q)
unsecapp.exe
System.ArgumentException: Parameter is not valid. at System.Drawing.Bitmap..ctor(Int32 width, Int32 height, PixelFormat format) at System.Drawing.Bitmap..ctor(Image original, Int32 width, Int32 height) at System.Drawing.Bitmap..ctor(Image original, Size newSize) at Plugin.RemoteDesktop.Capture(Size size, Int32 Q)
unsecapp.exe
System.ArgumentException: Parameter is not valid. at System.Drawing.Bitmap..ctor(Int32 width, Int32 height, PixelFormat format) at System.Drawing.Bitmap..ctor(Image original, Int32 width, Int32 height) at System.Drawing.Bitmap..ctor(Image original, Size newSize) at Plugin.RemoteDesktop.Capture(Size size, Int32 Q)
unsecapp.exe
System.ArgumentException: Parameter is not valid. at System.Drawing.Bitmap..ctor(Int32 width, Int32 height, PixelFormat format) at System.Drawing.Bitmap..ctor(Image original, Int32 width, Int32 height) at System.Drawing.Bitmap..ctor(Image original, Size newSize) at Plugin.RemoteDesktop.Capture(Size size, Int32 Q)
unsecapp.exe
System.ArgumentException: Parameter is not valid. at System.Drawing.Bitmap..ctor(Int32 width, Int32 height, PixelFormat format) at System.Drawing.Bitmap..ctor(Image original, Int32 width, Int32 height) at System.Drawing.Bitmap..ctor(Image original, Size newSize) at Plugin.RemoteDesktop.Capture(Size size, Int32 Q)
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
svchost.exe