File name:

1 (1324)

Full analysis: https://app.any.run/tasks/727383f4-c071-470b-9bf3-a0e2c6b701ee
Verdict: Malicious activity
Analysis date: March 24, 2025, 12:48:36
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 2 sections
MD5:

BEE7953C5FC29DA2F1975029EBF868B0

SHA1:

389D614A40E616459CBF96274B724833DCD888AA

SHA256:

3AB538A8164AAC41BC50460D9E74ED4C2DDD45AA1C207F6C782317376CDF8787

SSDEEP:

6144:uSbGLxoHq0Ds7XSh6Dfo7WsoQ9uObNcE2uu7b3xo/os5o:PSxaRs7XSh6Dfo7W/Ot2uu7b3K/Zo

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • 1 (1324).exe (PID: 6028)
      • 1 (1324).exe (PID: 7284)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 1 (1324).exe (PID: 6028)
      • 1 (1324).exe (PID: 7284)

    • Uses REG/REGEDIT.EXE to modify registry

      • 1 (1324).exe (PID: 6028)

    • Reads security settings of Internet Explorer

      • 1 (1324).exe (PID: 6028)
      • 1 (1324).exe (PID: 7284)

    • Application launched itself

      • 1 (1324).exe (PID: 6028)

  • INFO

    • Creates files or folders in the user directory

      • 1 (1324).exe (PID: 6028)
      • 1 (1324).exe (PID: 7284)
      • BackgroundTransferHost.exe (PID: 6436)

    • Failed to create an executable file in Windows directory

      • 1 (1324).exe (PID: 6028)
      • 1 (1324).exe (PID: 7284)

    • Reads the computer name

      • 1 (1324).exe (PID: 6028)
      • 1 (1324).exe (PID: 7284)

    • Checks supported languages

      • 1 (1324).exe (PID: 6028)
      • 1 (1324).exe (PID: 7284)

    • Checks proxy server information

      • 1 (1324).exe (PID: 6028)
      • 1 (1324).exe (PID: 7284)
      • BackgroundTransferHost.exe (PID: 6436)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 8172)
      • BackgroundTransferHost.exe (PID: 2108)
      • BackgroundTransferHost.exe (PID: 1532)
      • BackgroundTransferHost.exe (PID: 6436)
      • BackgroundTransferHost.exe (PID: 6392)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 6436)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2008:03:24 17:31:42+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 6
CodeSize: 16384
InitializedDataSize: 4096
UninitializedDataSize: 172032
EntryPoint: 0x31122
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
12
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 1 (1324).exe reg.exe no specs conhost.exe no specs 1 (1324).exe sppextcomobj.exe no specs slui.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
856C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1532"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
2108"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
4812\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—reg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5960reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /fC:\Windows\SysWOW64\reg.exe—1 (1324).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6028"C:\Users\admin\AppData\Local\Temp\1 (1324).exe" C:\Users\admin\AppData\Local\Temp\1 (1324).exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\1 (1324).exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6392"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
6436"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
7284"C:\Users\admin\AppData\Local\Temp\1 (1324).exe"C:\Users\admin\AppData\Local\Temp\1 (1324).exe
1 (1324).exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3765269347
Modules
Images
c:\users\admin\appdata\local\temp\1 (1324).exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7404C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
3 056
Read events
3 027
Write events
29
Delete events
0

Modification events

(PID) Process:(6028) 1 (1324).exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:ntuser
Value:
C:\WINDOWS\system32\drivers\spools.exe
(PID) Process:(6028) 1 (1324).exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:autoload
Value:
C:\Users\admin\Local Settings\Application Data\cftmon.exe
(PID) Process:(6028) 1 (1324).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:ntuser
Value:
C:\WINDOWS\system32\drivers\spools.exe
(PID) Process:(6028) 1 (1324).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:autoload
Value:
C:\Users\admin\Local Settings\Application Data\cftmon.exe
(PID) Process:(6028) 1 (1324).exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6028) 1 (1324).exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6028) 1 (1324).exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7284) 1 (1324).exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:ntuser
Value:
C:\WINDOWS\system32\drivers\spools.exe
(PID) Process:(7284) 1 (1324).exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:autoload
Value:
C:\Users\admin\Local Settings\Application Data\cftmon.exe
(PID) Process:(7284) 1 (1324).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:ntuser
Value:
C:\WINDOWS\system32\drivers\spools.exe
Executable files
2
Suspicious files
6
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6436BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\ed9b33b3-2e2d-4761-ac5e-d844ac96db0d.down_data —
MD5:—
SHA256:—
60281 (1324).exeC:\Users\admin\AppData\Local\cftmon.exeexecutable
MD5:BEE7953C5FC29DA2F1975029EBF868B0
SHA256:3AB538A8164AAC41BC50460D9E74ED4C2DDD45AA1C207F6C782317376CDF8787
72841 (1324).exeC:\Users\admin\AppData\Local\VirtualStore\stopbinary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:—
6436BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\ed9b33b3-2e2d-4761-ac5e-d844ac96db0d.479a1539-7f90-4d34-a59f-91eec63d063b.down_metabinary
MD5:B4AFA85CF043CE4857FC3BB033106C66
SHA256:D2285B3F2F164A31C203235D8E0DB22EE4C8D73DFB0E40AA1AF5EF65E4B5E273
6436BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:41AFBF35398FF289BA32A4AF4516CC99
SHA256:EADADF327D26E1D046712F21B3A098A2BD9C5982BA5BF545EAF3F4195260D79F
6436BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\d8f16bcd-4a38-495d-86f3-ad4ac5ec935b.479a1539-7f90-4d34-a59f-91eec63d063b.down_metabinary
MD5:B4AFA85CF043CE4857FC3BB033106C66
SHA256:D2285B3F2F164A31C203235D8E0DB22EE4C8D73DFB0E40AA1AF5EF65E4B5E273
72841 (1324).exeC:\Users\admin\AppData\Local\cftmon.exeexecutable
MD5:BEE7953C5FC29DA2F1975029EBF868B0
SHA256:3AB538A8164AAC41BC50460D9E74ED4C2DDD45AA1C207F6C782317376CDF8787
6436BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:4872BABAF39AA62B8D32695EBB7E9173
SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999
6436BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\d8f16bcd-4a38-495d-86f3-ad4ac5ec935b.up_meta_securebinary
MD5:810A64114B2C291A7C8B0223F468FAD8
SHA256:A425AF1693023A60092D7E8A76E33B3D7DB8DE2F4E711A6060AC8CAA8B532DD7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
28
DNS requests
19
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8080
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7284
1 (1324).exe
GET
—
193.166.255.171:80
http://bublikiadministrator.com/?&v=old_load&s=14733
unknown
—
—
malicious
6436
BackgroundTransferHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7320
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
8080
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6028
1 (1324).exe
193.166.255.171:80
bublikiadministrator.com
Tieteen tietotekniikan keskus Oy
FI
malicious
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.131:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
7284
1 (1324).exe
193.166.255.171:80
bublikiadministrator.com
Tieteen tietotekniikan keskus Oy
FI
malicious
7320
backgroundTaskHost.exe
20.105.99.58:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.174
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
whitelisted
bublikiadministrator.com
  • 193.166.255.171
malicious
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 20.190.160.131
  • 20.190.160.3
  • 20.190.160.4
  • 20.190.160.22
  • 20.190.160.5
  • 20.190.160.14
  • 20.190.160.132
  • 40.126.32.136
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
bublikimanager.com
  • —
whitelisted
arc.msn.com
  • 20.105.99.58
whitelisted
www.bing.com
  • 104.126.37.153
  • 104.126.37.138
  • 104.126.37.146
  • 104.126.37.131
  • 104.126.37.160
  • 104.126.37.139
  • 104.126.37.130
  • 104.126.37.144
  • 104.126.37.128
whitelisted

Threats

PID
Process
Class
Message
7284
1 (1324).exe
A Network Trojan was detected
ET HUNTING Suspicious User Agent (_)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
1 (1324)