File name:

447c03cc63a420c07875132d35ef027adec98e7bd446cf4f7c9d45b6af40ea2b.exe

Full analysis: https://app.any.run/tasks/5c54b828-e0d3-40c0-bb4b-8c5855650e90
Verdict: Malicious activity
Threats:

Raccoon is an info stealer type malware available as a Malware as a Service. It can be obtained for a subscription and costs $200 per month. Raccoon malware has already infected over 100,000 devices and became one of the most mentioned viruses on the underground forums in 2019.

Malware Trends Tracker     >>>
Analysis date: June 27, 2025, 09:24:41
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
raccoon
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 9 sections
MD5:

E2ABF4955A35D2F6BFEB21200EA1F836

SHA1:

BE5D778D38688A5DB52A3D72ADF76A59433975CA

SHA256:

447C03CC63A420C07875132D35EF027ADEC98E7BD446CF4F7C9D45B6AF40EA2B

SSDEEP:

98304:56MXSVkxjzcqbsaZ8pAcYNgxUeqHVwfee6ryfwtJjMwdl5jx+wvhh33sYQqBfy69:MCe5e

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 447c03cc63a420c07875132d35ef027adec98e7bd446cf4f7c9d45b6af40ea2b.exe (PID: 6652)

    • RACCOON has been detected (YARA)

      • AppLaunch.exe (PID: 4500)

  • SUSPICIOUS

    • Executes application which crashes

      • 447c03cc63a420c07875132d35ef027adec98e7bd446cf4f7c9d45b6af40ea2b.exe (PID: 6652)

    • There is functionality for taking screenshot (YARA)

      • AppLaunch.exe (PID: 4500)

    • The process executes via Task Scheduler

      • updater.exe (PID: 6140)

    • Application launched itself

      • updater.exe (PID: 6140)

    • Connects to the server without a host name

      • AppLaunch.exe (PID: 4500)

  • INFO

    • Reads the computer name

      • AppLaunch.exe (PID: 4500)
      • updater.exe (PID: 6140)

    • Checks supported languages

      • 447c03cc63a420c07875132d35ef027adec98e7bd446cf4f7c9d45b6af40ea2b.exe (PID: 6652)
      • AppLaunch.exe (PID: 4500)
      • updater.exe (PID: 6140)
      • updater.exe (PID: 592)

    • Checks proxy server information

      • WerFault.exe (PID: 3656)
      • slui.exe (PID: 440)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 3656)

    • Reads the software policy settings

      • WerFault.exe (PID: 3656)
      • AppLaunch.exe (PID: 4500)
      • slui.exe (PID: 440)

    • Reads the machine GUID from the registry

      • AppLaunch.exe (PID: 4500)

    • Process checks whether UAC notifications are on

      • updater.exe (PID: 6140)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.dll | Win32 Dynamic Link Library (generic) (43.5)
.exe | Win32 Executable (generic) (29.8)
.exe | Generic Win/DOS Executable (13.2)
.exe | DOS Executable Generic (13.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:01:22 18:52:30+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 14.29
CodeSize: 140288
InitializedDataSize: 667136
UninitializedDataSize: -
EntryPoint: 0x1000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
7
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 447c03cc63a420c07875132d35ef027adec98e7bd446cf4f7c9d45b6af40ea2b.exe #RACCOON applaunch.exe werfault.exe svchost.exe slui.exe updater.exe no specs updater.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
440C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
592"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=134.0.6985.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x111c460,0x111c46c,0x111c478C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe—updater.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\program files (x86)\google\googleupdater\134.0.6985.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
2200C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3656C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6652 -s 492C:\Windows\SysWOW64\WerFault.exe
447c03cc63a420c07875132d35ef027adec98e7bd446cf4f7c9d45b6af40ea2b.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
4500"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
447c03cc63a420c07875132d35ef027adec98e7bd446cf4f7c9d45b6af40ea2b.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET ClickOnce Launch Utility
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
6140"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --wake --systemC:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe—svchost.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\program files (x86)\google\googleupdater\134.0.6985.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
6652"C:\Users\admin\Desktop\447c03cc63a420c07875132d35ef027adec98e7bd446cf4f7c9d45b6af40ea2b.exe" C:\Users\admin\Desktop\447c03cc63a420c07875132d35ef027adec98e7bd446cf4f7c9d45b6af40ea2b.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\desktop\447c03cc63a420c07875132d35ef027adec98e7bd446cf4f7c9d45b6af40ea2b.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
12 900
Read events
12 900
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
1
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
3656WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_447c03cc63a420c0_43bf1ff4ee796d12cb77b93e6f15923870a2eaa8_1bebdfed_0709f3c3-29cc-4eff-b865-d9ecf33aa49c\Report.wer —
MD5:—
SHA256:—
3656WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\447c03cc63a420c07875132d35ef027adec98e7bd446cf4f7c9d45b6af40ea2b.exe.6652.dmp —
MD5:—
SHA256:—
3656WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER7030.tmp.xmlxml
MD5:10499383DA950B26A20CF0229E978362
SHA256:295116F0142D962A8EC50621374E3BD07E38A5CD6DB133757B018A3D1B0C30A8
3656WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER6C37.tmp.dmpbinary
MD5:67EFC90ABFB0765AFEFA9586D68AE47C
SHA256:E380A987D04D522BE32E1E4E29323B053B6804F904005CC7BBE4D841B3CE4D94
3656WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER7010.tmp.WERInternalMetadata.xmlxml
MD5:65F7EECC3F9B7934FC4C039EA5EE5FFA
SHA256:018B30961D16C75E04DE30F25F2DBB9A9B04915174BA5300ED55B9434CD5EF17
592updater.exeC:\Program Files (x86)\Google\GoogleUpdater\updater.logtext
MD5:6E45D043B5D77A26481400593A61AF0C
SHA256:5A439A77B8BFF81C044BF5A7AAE8CBA434DE46987588AFBF275BA3D1205ECEC1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
58
TCP/UDP connections
58
DNS requests
23
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4500
AppLaunch.exe
GET
404
188.166.1.115:80
http://188.166.1.115/starmivoscloud
unknown
—
—
unknown
4500
AppLaunch.exe
GET
404
188.166.1.115:80
http://188.166.1.115/starmivoscloud
unknown
—
—
unknown
4500
AppLaunch.exe
GET
404
188.166.1.115:80
http://188.166.1.115/starmivoscloud
unknown
—
—
unknown
—
—
POST
200
20.190.160.64:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
4500
AppLaunch.exe
GET
404
188.166.1.115:80
http://188.166.1.115/starmivoscloud
unknown
—
—
unknown
—
—
POST
400
20.190.160.64:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
4500
AppLaunch.exe
GET
404
188.166.1.115:80
http://188.166.1.115/starmivoscloud
unknown
—
—
unknown
—
—
POST
400
20.190.160.131:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
400
20.190.160.14:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4512
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4500
AppLaunch.exe
188.166.1.115:80
—
DIGITALOCEAN-ASN
NL
unknown
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3656
WerFault.exe
104.208.16.94:443
watson.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2764
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
  • 51.104.136.2
whitelisted
google.com
  • 142.250.184.238
whitelisted
watson.events.data.microsoft.com
  • 104.208.16.94
whitelisted
login.live.com
  • 20.190.159.73
  • 20.190.159.130
  • 20.190.159.75
  • 20.190.159.68
  • 40.126.31.73
  • 20.190.159.4
  • 40.126.31.131
  • 20.190.159.0
whitelisted
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
img.vulpecular.icu
  • 104.21.91.115
  • 172.67.216.180
unknown
nexusrules.officeapps.live.com
  • 52.111.243.30
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted

Threats

PID
Process
Class
Message
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
2200
svchost.exe
Potentially Bad Traffic
ET INFO DNS Query for Suspicious .icu Domain
4500
AppLaunch.exe
Potentially Bad Traffic
ET INFO Suspicious Domain (*.icu) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
447c03cc63a420c07875132d35ef027adec98e7bd446cf4f7c9d45b6af40ea2b.exe