File name:

bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe

Full analysis: https://app.any.run/tasks/510db7e2-7d9b-43a7-b4e9-de71edc7925b
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: January 29, 2025, 11:03:03
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

1C0DAEBCE9AADFE2DFDC37E99976534C

SHA1:

F03C15B9911BDCE2CD78A9A93BAF49A991FF6407

SHA256:

4B4B980C9519A92BD4FD55B78ABEC2D370471E3B5AFCA8EE9E2FDF7B2D89D4B4

SSDEEP:

98304:5JkLaE1mCE44fUVV6da1tmN8dXoqmks8TiuBywTn+rVJyinHuhHfCO1UbKwhMqkv:hCY63tR8BWf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • bomgar-scc.exe (PID: 6704)
      • bomgar-scc.exe (PID: 5240)

    • Steals credentials from Web Browsers

      • bomgar-scc.exe (PID: 6756)

    • Actions looks like stealing of personal data

      • bomgar-scc.exe (PID: 6756)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe (PID: 6512)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe (PID: 6512)

    • Reads security settings of Internet Explorer

      • bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe (PID: 6512)
      • bomgar-scc.exe (PID: 6672)
      • bomgar-scc.exe (PID: 6704)
      • bomgar-scc.exe (PID: 5240)
      • bomgar-scc.exe (PID: 5460)

    • Executing commands from ".cmd" file

      • bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe (PID: 6512)

    • Starts CMD.EXE for commands execution

      • bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe (PID: 6512)

    • The executable file from the user directory is run by the CMD process

      • spinner.exe (PID: 6648)

    • Executable content was dropped or overwritten

      • bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe (PID: 6512)
      • bomgar-scc.exe (PID: 6672)
      • bomgar-scc.exe (PID: 6704)

    • Process drops legitimate windows executable

      • bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe (PID: 6512)
      • bomgar-scc.exe (PID: 6672)

    • Starts itself from another location

      • bomgar-scc.exe (PID: 6672)

    • Checks Windows Trust Settings

      • bomgar-scc.exe (PID: 6672)
      • bomgar-scc.exe (PID: 6704)
      • bomgar-scc.exe (PID: 5460)
      • bomgar-scc.exe (PID: 5240)

    • Application launched itself

      • bomgar-scc.exe (PID: 6704)
      • bomgar-scc.exe (PID: 5460)

  • INFO

    • Process checks computer location settings

      • bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe (PID: 6512)

    • Checks supported languages

      • bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe (PID: 6512)
      • spinner.exe (PID: 6648)
      • bomgar-scc.exe (PID: 6672)
      • bomgar-scc.exe (PID: 6704)
      • bomgar-scc.exe (PID: 6956)
      • bomgar-scc.exe (PID: 5460)
      • bomgar-scc.exe (PID: 5240)
      • remove.exe (PID: 2436)

    • Reads the computer name

      • bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe (PID: 6512)
      • spinner.exe (PID: 6648)
      • bomgar-scc.exe (PID: 6672)
      • bomgar-scc.exe (PID: 6704)
      • bomgar-scc.exe (PID: 6956)
      • bomgar-scc.exe (PID: 5460)
      • bomgar-scc.exe (PID: 5240)

    • Create files in a temporary directory

      • bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe (PID: 6512)
      • bomgar-scc.exe (PID: 6672)
      • remove.exe (PID: 2436)

    • The sample compiled with english language support

      • bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe (PID: 6512)
      • bomgar-scc.exe (PID: 6672)

    • Reads product name

      • bomgar-scc.exe (PID: 6672)
      • bomgar-scc.exe (PID: 6704)
      • bomgar-scc.exe (PID: 6956)
      • bomgar-scc.exe (PID: 5460)
      • bomgar-scc.exe (PID: 5240)

    • Reads Environment values

      • bomgar-scc.exe (PID: 6672)
      • bomgar-scc.exe (PID: 6704)
      • bomgar-scc.exe (PID: 6956)
      • bomgar-scc.exe (PID: 5460)
      • bomgar-scc.exe (PID: 5240)

    • Reads the machine GUID from the registry

      • bomgar-scc.exe (PID: 6672)
      • bomgar-scc.exe (PID: 6704)
      • bomgar-scc.exe (PID: 6956)
      • bomgar-scc.exe (PID: 5460)
      • bomgar-scc.exe (PID: 5240)

    • Reads the software policy settings

      • bomgar-scc.exe (PID: 6672)
      • bomgar-scc.exe (PID: 5460)
      • bomgar-scc.exe (PID: 6704)
      • bomgar-scc.exe (PID: 5240)

    • Creates files in the program directory

      • bomgar-scc.exe (PID: 6704)
      • bomgar-scc.exe (PID: 6672)
      • bomgar-scc.exe (PID: 5460)

    • Creates files or folders in the user directory

      • bomgar-scc.exe (PID: 5460)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:04:02 03:20:09+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 24064
InitializedDataSize: 120320
UninitializedDataSize: 1024
EntryPoint: 0x326c
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 22.2.2.3087
ProductVersionNumber: 22.2.2.3087
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Windows, Latin1
CompanyName: bomgar
FileDescription: BeyondTrust Remote Support
FileVersion: 22.2.2.3087
LegalCopyright: Copyright (C) 2002-2022 BeyondTrust Corporation. Redistribution Prohibited. All Rights Reserved.
ProductName: BeyondTrust Remote Support
ProductVersion: 22.2.2 (3087-1d8542da51e0a5b20954e0a324023846367e17cb)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
11
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe cmd.exe no specs conhost.exe no specs spinner.exe bomgar-scc.exe bomgar-scc.exe bomgar-scc.exe bomgar-scc.exe no specs bomgar-scc.exe bomgar-scc.exe remove.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2436C:\ProgramData\bomgar-scc-0x679a0af2\remove.exe /OKC:\ProgramData\bomgar-scc-0x679a0af2\remove.exe—bomgar-scc.exe
User:
admin
Company:
bomgar
Integrity Level:
MEDIUM
Description:
BeyondTrust Remote Support
Exit code:
0
Version:
22.2.2.3087
Modules
Images
c:\programdata\bomgar-scc-0x679a0af2\remove.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5240C:\ProgramData\bomgar-scc-0x679a0af2\bomgar-scc.exe -uninstall silentC:\ProgramData\bomgar-scc-0x679a0af2\bomgar-scc.exe
bomgar-scc.exe
User:
admin
Company:
BeyondTrust
Integrity Level:
MEDIUM
Description:
Remote Support Customer Client
Exit code:
0
Version:
22.2.2 (3087-1d8542da51e0a5b20954e0a324023846367e17cb)
Modules
Images
c:\programdata\bomgar-scc-0x679a0af2\bomgar-scc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5460C:\ProgramData\bomgar-scc-0x679a0af2\bomgar-scc.exeC:\ProgramData\bomgar-scc-0x679a0af2\bomgar-scc.exe
bomgar-scc.exe
User:
admin
Company:
BeyondTrust
Integrity Level:
MEDIUM
Description:
Remote Support Customer Client
Exit code:
0
Version:
22.2.2 (3087-1d8542da51e0a5b20954e0a324023846367e17cb)
Modules
Images
c:\programdata\bomgar-scc-0x679a0af2\bomgar-scc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
6512"C:\Users\admin\AppData\Local\Temp\bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe" C:\Users\admin\AppData\Local\Temp\bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6572C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\nsc5D96.tmpspinner-$SPIN_INSTANCE\start.cmd" "C:\Windows\SysWOW64\cmd.exe—bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6596\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6648"C:\Users\admin\AppData\Local\Temp\nsc5D96.tmpspinner-$SPIN_INSTANCE\spinner.exe" --instance-id $SPIN_INSTANCE --icofile $SPIN_ICON C:\Users\admin\AppData\Local\Temp\nsc5D96.tmpspinner-$SPIN_INSTANCE\spinner.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Description:
spinner Module
Exit code:
0
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\appdata\local\temp\nsc5d96.tmpspinner-$spin_instance\spinner.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
6672"C:\Users\admin\AppData\Local\Temp\nsc5D96.tmpb\bomgar-scc.exe" "C:\Users\admin\AppData\Local\Temp\bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe" -install1 "C:\Users\admin\AppData\Local\Temp\bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe" --installer-pwd "C:\Users\admin\AppData\Local\Temp"C:\Users\admin\AppData\Local\Temp\nsc5D96.tmpb\bomgar-scc.exe
bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsc5d96.tmpb\bomgar-scc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
6704C:\ProgramData\bomgar-scc-0x679a0af2\bomgar-scc.exe C:\Users\admin\AppData\Local\Temp\bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe -install2 C:\Users\admin\AppData\Local\Temp\bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe C:\Users\admin\AppData\Local\Temp\nsc5D96.tmpb\ C:\ProgramData\bomgar-scc-0x679a0af2\ --installer-pwd C:\Users\admin\AppData\Local\TempC:\ProgramData\bomgar-scc-0x679a0af2\bomgar-scc.exe
bomgar-scc.exe
User:
admin
Company:
BeyondTrust
Integrity Level:
MEDIUM
Description:
Remote Support Customer Client
Exit code:
0
Version:
22.2.2 (3087-1d8542da51e0a5b20954e0a324023846367e17cb)
Modules
Images
c:\programdata\bomgar-scc-0x679a0af2\bomgar-scc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
6756C:\ProgramData\bomgar-scc-0x679a0af2\bomgar-scc.exe -proxydetectC:\ProgramData\bomgar-scc-0x679a0af2\bomgar-scc.exe
bomgar-scc.exe
User:
admin
Company:
BeyondTrust
Integrity Level:
MEDIUM
Description:
Remote Support Customer Client
Exit code:
0
Version:
22.2.2 (3087-1d8542da51e0a5b20954e0a324023846367e17cb)
Modules
Images
c:\programdata\bomgar-scc-0x679a0af2\bomgar-scc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
17 463
Read events
17 458
Write events
3
Delete events
2

Modification events

(PID) Process:(6704) bomgar-scc.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Bomgar_Cleanup_ZD127303126393
Value:
cmd.exe /C rd /S /Q "C:\Users\admin\AppData\Local\Temp\nsc5D96.tmpb" & reg.exe delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Bomgar_Cleanup_ZD127303126393 /f
(PID) Process:(6704) bomgar-scc.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Bomgar Support Reconnect [679A0AF2]
Value:
"C:\ProgramData\bomgar-scc-0x679a0af2\bomgar-scc.exe" -nomulti
(PID) Process:(5240) bomgar-scc.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:Bomgar Support Reconnect [679A0AF2]
Value:
"C:\ProgramData\bomgar-scc-0x679a0af2\bomgar-scc.exe" -nomulti
(PID) Process:(5240) bomgar-scc.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:Remote Support Jump Client Reconnect 679A0AF3
Value:
(PID) Process:(5240) bomgar-scc.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Bomgar_Cleanup_ZD128260922968
Value:
cmd.exe /C rd /S /Q "C:\ProgramData\bomgar-scc-0x679a0af2" & reg.exe delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Bomgar_Cleanup_ZD128260922968 /f
Executable files
23
Suspicious files
7
Text files
74
Unknown types
2

Dropped files

PID
Process
Filename
Type
6512bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exeC:\Users\admin\AppData\Local\Temp\nsc5D96.tmpb\spinner.exeexecutable
MD5:DCE851A46C7C021C1CDD18D62A55760F
SHA256:64B6A3167494D99B2D64571D4F04AD8D11FC609E19788FCA4C99F734333C6D45
6512bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exeC:\Users\admin\AppData\Local\Temp\nsc5D96.tmp\System.dllexecutable
MD5:D76DF4ED7A935E9E9EFFC492BFABD876
SHA256:2B7A5A8C98358AE32B0BCB468C7142C46CB2BAB5A1FDA11D3EE67D7013476925
6512bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exeC:\Users\admin\AppData\Local\Temp\nsc5D96.tmpb\startup_animation_2.bmpimage
MD5:0B312FD112C34504680ABCE9FE6EAA13
SHA256:EB3FF2CACD409461C6A8DDE65D278C296745401FAFFFD6ECDCF470E595C98008
6512bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exeC:\Users\admin\AppData\Local\Temp\nsc5D96.tmpb\startup_animation_3.bmpimage
MD5:915B8A9DE4CCEF690B17A5A66B945487
SHA256:BD8E3F9CCF7F108DEFDF28C74D238AFA01BD22F119A782497C1FFDCDB0CD0CC8
6512bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exeC:\Users\admin\AppData\Local\Temp\nsc5D96.tmpb\chat.wavwav
MD5:08071F39F4EB5F201776D297F16DD75D
SHA256:9D11DC231676F783BE1C370178CA63FDC3AAD5536B1791457AA2EEDF08553E34
6512bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exeC:\Users\admin\AppData\Local\Temp\nsc5D96.tmpb\startup_animation_4.bmpimage
MD5:EBCFFEA1A5E062435B12BAFA37509C9D
SHA256:B41EF27CDCDC734B675F6A057D0130DB083B232C1456DF89F6B29DDCF2E01C45
6512bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exeC:\Users\admin\AppData\Local\Temp\nsc5D96.tmpspinner-$SPIN_INSTANCE\spinner-5.bmpimage
MD5:0DB01E512C8B09FEA1C1BCB93DDF0650
SHA256:B42445F9D216CDEEBB1463F018616AB955FEF00B3F86548D88910CF60C7B5DE8
6512bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exeC:\Users\admin\AppData\Local\Temp\nsc5D96.tmpspinner-$SPIN_INSTANCE\spinner-4.bmpimage
MD5:EBCFFEA1A5E062435B12BAFA37509C9D
SHA256:B41EF27CDCDC734B675F6A057D0130DB083B232C1456DF89F6B29DDCF2E01C45
6512bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exeC:\Users\admin\AppData\Local\Temp\nsc5D96.tmpb\app_icon.pngimage
MD5:98868C7C2D6CD5750FD864CAC33C070C
SHA256:2D63C7268E4A056440813FC97F04FC5B9FD7F14C34FA85DACB3917F36A5B0838
6512bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exeC:\Users\admin\AppData\Local\Temp\nsc5D96.tmpspinner-$SPIN_INSTANCE\start.cmdtext
MD5:57138E62B85FA9AED589BB02653DA118
SHA256:6A1864DF89D57BF88B87E194C5A61E3F315A0288A2F361B8AFE701AC2889878F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
39
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
648
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
648
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6328
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1176
svchost.exe
20.190.160.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1076
svchost.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
6756
bomgar-scc.exe
140.90.144.92:443
emc2.omao.noaa.gov
NOAA-SILVERSPRING
US
whitelisted
5460
bomgar-scc.exe
140.90.144.92:443
emc2.omao.noaa.gov
NOAA-SILVERSPRING
US
whitelisted
5460
bomgar-scc.exe
3.233.108.128:443
license.bomgar.com
AMAZON-AES
US
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4428
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
login.live.com
  • 20.190.160.14
  • 40.126.32.76
  • 40.126.32.134
  • 20.190.160.17
  • 20.190.160.22
  • 40.126.32.136
  • 20.190.160.20
  • 40.126.32.138
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
emc2.omao.noaa.gov
  • 140.90.144.92
whitelisted
license.bomgar.com
  • 3.233.108.128
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
www.bing.com
  • 104.126.37.161
  • 104.126.37.177
  • 104.126.37.160
  • 104.126.37.170
  • 104.126.37.171
  • 104.126.37.162
  • 104.126.37.176
  • 104.126.37.163
  • 104.126.37.155
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted

Threats

No threats detected
Process
Message
spinner.exe
SPN(19fc):image C:\Users\admin\AppData\Local\Temp\nsc5D96.tmpspinner-$SPIN_INSTANCE\spinner-3.bmp
spinner.exe
SPN(19fc):image C:\Users\admin\AppData\Local\Temp\nsc5D96.tmpspinner-$SPIN_INSTANCE\spinner-5.bmp
spinner.exe
SPN(19fc):image C:\Users\admin\AppData\Local\Temp\nsc5D96.tmpspinner-$SPIN_INSTANCE\spinner-2.bmp
spinner.exe
SPN(19fc):image C:\Users\admin\AppData\Local\Temp\nsc5D96.tmpspinner-$SPIN_INSTANCE\spinner-1.bmp
spinner.exe
SPN(19fc):image C:\Users\admin\AppData\Local\Temp\nsc5D96.tmpspinner-$SPIN_INSTANCE\spinner-4.bmp
spinner.exe
SPN(19fc):>CMainWindow::CMainWindow
spinner.exe
SPN(19fc):>CMainWindow::Create
spinner.exe
SPN(19fc):<CMainWindow::CMainWindow
spinner.exe
SPN(19fc):>CMainWindow::OnCreate
spinner.exe
SPN(19fc):<CMainWindow::OnCreate
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe