File name:

bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe

Full analysis: https://app.any.run/tasks/510db7e2-7d9b-43a7-b4e9-de71edc7925b
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: January 29, 2025, 11:03:03
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

1C0DAEBCE9AADFE2DFDC37E99976534C

SHA1:

F03C15B9911BDCE2CD78A9A93BAF49A991FF6407

SHA256:

4B4B980C9519A92BD4FD55B78ABEC2D370471E3B5AFCA8EE9E2FDF7B2D89D4B4

SSDEEP:

98304:5JkLaE1mCE44fUVV6da1tmN8dXoqmks8TiuBywTn+rVJyinHuhHfCO1UbKwhMqkv:hCY63tR8BWf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • bomgar-scc.exe (PID: 6704)
      • bomgar-scc.exe (PID: 5240)

    • Actions looks like stealing of personal data

      • bomgar-scc.exe (PID: 6756)

    • Steals credentials from Web Browsers

      • bomgar-scc.exe (PID: 6756)

  • SUSPICIOUS

    • The executable file from the user directory is run by the CMD process

      • spinner.exe (PID: 6648)

    • Executable content was dropped or overwritten

      • bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe (PID: 6512)
      • bomgar-scc.exe (PID: 6672)
      • bomgar-scc.exe (PID: 6704)

    • The process creates files with name similar to system file names

      • bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe (PID: 6512)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe (PID: 6512)

    • Starts CMD.EXE for commands execution

      • bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe (PID: 6512)

    • Executing commands from ".cmd" file

      • bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe (PID: 6512)

    • Reads security settings of Internet Explorer

      • bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe (PID: 6512)
      • bomgar-scc.exe (PID: 6672)
      • bomgar-scc.exe (PID: 5460)
      • bomgar-scc.exe (PID: 6704)
      • bomgar-scc.exe (PID: 5240)

    • Process drops legitimate windows executable

      • bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe (PID: 6512)
      • bomgar-scc.exe (PID: 6672)

    • Starts itself from another location

      • bomgar-scc.exe (PID: 6672)

    • Checks Windows Trust Settings

      • bomgar-scc.exe (PID: 6672)
      • bomgar-scc.exe (PID: 6704)
      • bomgar-scc.exe (PID: 5460)
      • bomgar-scc.exe (PID: 5240)

    • Application launched itself

      • bomgar-scc.exe (PID: 6704)
      • bomgar-scc.exe (PID: 5460)

  • INFO

    • Process checks computer location settings

      • bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe (PID: 6512)

    • Checks supported languages

      • bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe (PID: 6512)
      • spinner.exe (PID: 6648)
      • bomgar-scc.exe (PID: 6672)
      • bomgar-scc.exe (PID: 6704)
      • bomgar-scc.exe (PID: 6956)
      • bomgar-scc.exe (PID: 5460)
      • bomgar-scc.exe (PID: 5240)
      • remove.exe (PID: 2436)

    • Reads the computer name

      • bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe (PID: 6512)
      • spinner.exe (PID: 6648)
      • bomgar-scc.exe (PID: 6672)
      • bomgar-scc.exe (PID: 6704)
      • bomgar-scc.exe (PID: 6956)
      • bomgar-scc.exe (PID: 5460)
      • bomgar-scc.exe (PID: 5240)

    • Create files in a temporary directory

      • bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe (PID: 6512)
      • bomgar-scc.exe (PID: 6672)
      • remove.exe (PID: 2436)

    • The sample compiled with english language support

      • bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe (PID: 6512)
      • bomgar-scc.exe (PID: 6672)

    • Reads Environment values

      • bomgar-scc.exe (PID: 6672)
      • bomgar-scc.exe (PID: 6704)
      • bomgar-scc.exe (PID: 5460)
      • bomgar-scc.exe (PID: 6956)
      • bomgar-scc.exe (PID: 5240)

    • Reads product name

      • bomgar-scc.exe (PID: 6672)
      • bomgar-scc.exe (PID: 6704)
      • bomgar-scc.exe (PID: 6956)
      • bomgar-scc.exe (PID: 5460)
      • bomgar-scc.exe (PID: 5240)

    • Creates files in the program directory

      • bomgar-scc.exe (PID: 6672)
      • bomgar-scc.exe (PID: 6704)
      • bomgar-scc.exe (PID: 5460)

    • Reads the software policy settings

      • bomgar-scc.exe (PID: 6672)
      • bomgar-scc.exe (PID: 6704)
      • bomgar-scc.exe (PID: 5460)
      • bomgar-scc.exe (PID: 5240)

    • Reads the machine GUID from the registry

      • bomgar-scc.exe (PID: 6672)
      • bomgar-scc.exe (PID: 6704)
      • bomgar-scc.exe (PID: 5460)
      • bomgar-scc.exe (PID: 6956)
      • bomgar-scc.exe (PID: 5240)

    • Creates files or folders in the user directory

      • bomgar-scc.exe (PID: 5460)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2016:04:02 03:20:09+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 24064
InitializedDataSize: 120320
UninitializedDataSize: 1024
EntryPoint: 0x326c
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 22.2.2.3087
ProductVersionNumber: 22.2.2.3087
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Windows, Latin1
CompanyName: bomgar
FileDescription: BeyondTrust Remote Support
FileVersion: 22.2.2.3087
LegalCopyright: Copyright (C) 2002-2022 BeyondTrust Corporation. Redistribution Prohibited. All Rights Reserved.
ProductName: BeyondTrust Remote Support
ProductVersion: 22.2.2 (3087-1d8542da51e0a5b20954e0a324023846367e17cb)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
11
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe cmd.exe no specs conhost.exe no specs spinner.exe bomgar-scc.exe bomgar-scc.exe bomgar-scc.exe bomgar-scc.exe no specs bomgar-scc.exe bomgar-scc.exe remove.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2436C:\ProgramData\bomgar-scc-0x679a0af2\remove.exe /OKC:\ProgramData\bomgar-scc-0x679a0af2\remove.exe—bomgar-scc.exe
User:
admin
Company:
bomgar
Integrity Level:
MEDIUM
Description:
BeyondTrust Remote Support
Exit code:
0
Version:
22.2.2.3087
Modules
Images
c:\programdata\bomgar-scc-0x679a0af2\remove.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
5240C:\ProgramData\bomgar-scc-0x679a0af2\bomgar-scc.exe -uninstall silentC:\ProgramData\bomgar-scc-0x679a0af2\bomgar-scc.exe
bomgar-scc.exe
User:
admin
Company:
BeyondTrust
Integrity Level:
MEDIUM
Description:
Remote Support Customer Client
Exit code:
0
Version:
22.2.2 (3087-1d8542da51e0a5b20954e0a324023846367e17cb)
Modules
Images
c:\programdata\bomgar-scc-0x679a0af2\bomgar-scc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5460C:\ProgramData\bomgar-scc-0x679a0af2\bomgar-scc.exeC:\ProgramData\bomgar-scc-0x679a0af2\bomgar-scc.exe
bomgar-scc.exe
User:
admin
Company:
BeyondTrust
Integrity Level:
MEDIUM
Description:
Remote Support Customer Client
Exit code:
0
Version:
22.2.2 (3087-1d8542da51e0a5b20954e0a324023846367e17cb)
Modules
Images
c:\programdata\bomgar-scc-0x679a0af2\bomgar-scc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
6512"C:\Users\admin\AppData\Local\Temp\bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe" C:\Users\admin\AppData\Local\Temp\bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6572C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\nsc5D96.tmpspinner-$SPIN_INSTANCE\start.cmd" "C:\Windows\SysWOW64\cmd.exe—bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6596\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6648"C:\Users\admin\AppData\Local\Temp\nsc5D96.tmpspinner-$SPIN_INSTANCE\spinner.exe" --instance-id $SPIN_INSTANCE --icofile $SPIN_ICON C:\Users\admin\AppData\Local\Temp\nsc5D96.tmpspinner-$SPIN_INSTANCE\spinner.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Description:
spinner Module
Exit code:
0
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\appdata\local\temp\nsc5d96.tmpspinner-$spin_instance\spinner.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
6672"C:\Users\admin\AppData\Local\Temp\nsc5D96.tmpb\bomgar-scc.exe" "C:\Users\admin\AppData\Local\Temp\bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe" -install1 "C:\Users\admin\AppData\Local\Temp\bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe" --installer-pwd "C:\Users\admin\AppData\Local\Temp"C:\Users\admin\AppData\Local\Temp\nsc5D96.tmpb\bomgar-scc.exe
bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsc5d96.tmpb\bomgar-scc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
6704C:\ProgramData\bomgar-scc-0x679a0af2\bomgar-scc.exe C:\Users\admin\AppData\Local\Temp\bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe -install2 C:\Users\admin\AppData\Local\Temp\bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe C:\Users\admin\AppData\Local\Temp\nsc5D96.tmpb\ C:\ProgramData\bomgar-scc-0x679a0af2\ --installer-pwd C:\Users\admin\AppData\Local\TempC:\ProgramData\bomgar-scc-0x679a0af2\bomgar-scc.exe
bomgar-scc.exe
User:
admin
Company:
BeyondTrust
Integrity Level:
MEDIUM
Description:
Remote Support Customer Client
Exit code:
0
Version:
22.2.2 (3087-1d8542da51e0a5b20954e0a324023846367e17cb)
Modules
Images
c:\programdata\bomgar-scc-0x679a0af2\bomgar-scc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
6756C:\ProgramData\bomgar-scc-0x679a0af2\bomgar-scc.exe -proxydetectC:\ProgramData\bomgar-scc-0x679a0af2\bomgar-scc.exe
bomgar-scc.exe
User:
admin
Company:
BeyondTrust
Integrity Level:
MEDIUM
Description:
Remote Support Customer Client
Exit code:
0
Version:
22.2.2 (3087-1d8542da51e0a5b20954e0a324023846367e17cb)
Modules
Images
c:\programdata\bomgar-scc-0x679a0af2\bomgar-scc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
17 463
Read events
17 458
Write events
3
Delete events
2

Modification events

(PID) Process:(6704) bomgar-scc.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Bomgar_Cleanup_ZD127303126393
Value:
cmd.exe /C rd /S /Q "C:\Users\admin\AppData\Local\Temp\nsc5D96.tmpb" & reg.exe delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Bomgar_Cleanup_ZD127303126393 /f
(PID) Process:(6704) bomgar-scc.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Bomgar Support Reconnect [679A0AF2]
Value:
"C:\ProgramData\bomgar-scc-0x679a0af2\bomgar-scc.exe" -nomulti
(PID) Process:(5240) bomgar-scc.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:Bomgar Support Reconnect [679A0AF2]
Value:
"C:\ProgramData\bomgar-scc-0x679a0af2\bomgar-scc.exe" -nomulti
(PID) Process:(5240) bomgar-scc.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:Remote Support Jump Client Reconnect 679A0AF3
Value:
(PID) Process:(5240) bomgar-scc.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Bomgar_Cleanup_ZD128260922968
Value:
cmd.exe /C rd /S /Q "C:\ProgramData\bomgar-scc-0x679a0af2" & reg.exe delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Bomgar_Cleanup_ZD128260922968 /f
Executable files
23
Suspicious files
7
Text files
74
Unknown types
2

Dropped files

PID
Process
Filename
Type
6512bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exeC:\Users\admin\AppData\Local\Temp\nsc5D96.tmpb\startup_animation_2.bmpimage
MD5:0B312FD112C34504680ABCE9FE6EAA13
SHA256:EB3FF2CACD409461C6A8DDE65D278C296745401FAFFFD6ECDCF470E595C98008
6512bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exeC:\Users\admin\AppData\Local\Temp\nsc5D96.tmpb\startup_animation_3.bmpimage
MD5:915B8A9DE4CCEF690B17A5A66B945487
SHA256:BD8E3F9CCF7F108DEFDF28C74D238AFA01BD22F119A782497C1FFDCDB0CD0CC8
6512bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exeC:\Users\admin\AppData\Local\Temp\nsc5D96.tmpspinner-$SPIN_INSTANCE\spinner-1.bmpimage
MD5:7604363A3DB0D8202ABFD9C16D154D4E
SHA256:D732DD994C232E710145E43062E5E085E3897B885ACFB5422B6C395E3295042D
6512bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exeC:\Users\admin\AppData\Local\Temp\nsc5D96.tmpb\startup_animation_4.bmpimage
MD5:EBCFFEA1A5E062435B12BAFA37509C9D
SHA256:B41EF27CDCDC734B675F6A057D0130DB083B232C1456DF89F6B29DDCF2E01C45
6512bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exeC:\Users\admin\AppData\Local\Temp\nsc5D96.tmpb\app_icon.pngimage
MD5:98868C7C2D6CD5750FD864CAC33C070C
SHA256:2D63C7268E4A056440813FC97F04FC5B9FD7F14C34FA85DACB3917F36A5B0838
6512bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exeC:\Users\admin\AppData\Local\Temp\nsc5D96.tmpb\startup_animation_5.bmpimage
MD5:0DB01E512C8B09FEA1C1BCB93DDF0650
SHA256:B42445F9D216CDEEBB1463F018616AB955FEF00B3F86548D88910CF60C7B5DE8
6512bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exeC:\Users\admin\AppData\Local\Temp\nsc5D96.tmpspinner-$SPIN_INSTANCE\spinner-2.bmpimage
MD5:0B312FD112C34504680ABCE9FE6EAA13
SHA256:EB3FF2CACD409461C6A8DDE65D278C296745401FAFFFD6ECDCF470E595C98008
6512bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exeC:\Users\admin\AppData\Local\Temp\nsc5D96.tmpspinner-$SPIN_INSTANCE\spinner-4.bmpimage
MD5:EBCFFEA1A5E062435B12BAFA37509C9D
SHA256:B41EF27CDCDC734B675F6A057D0130DB083B232C1456DF89F6B29DDCF2E01C45
6512bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exeC:\Users\admin\AppData\Local\Temp\nsc5D96.tmpb\preload-en-us.rdfbinary
MD5:48028F062A4F100DFD21C23C42DD22F6
SHA256:2E4ACF173DAC5DEED8C8F4F0FA84F41F2807E6253880F78403E8AE13EEEC5003
6512bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exeC:\Users\admin\AppData\Local\Temp\nsc5D96.tmpb\server.licbinary
MD5:10EEC2CC601B1AE1F57E9255929EFBA5
SHA256:EC7FEDB878507A4BE9C03A4E64AECBA94E47105012BE4B053B5A32C4DA451757
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
39
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
648
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6328
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
648
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1176
svchost.exe
20.190.160.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1076
svchost.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
6756
bomgar-scc.exe
140.90.144.92:443
emc2.omao.noaa.gov
NOAA-SILVERSPRING
US
whitelisted
5460
bomgar-scc.exe
140.90.144.92:443
emc2.omao.noaa.gov
NOAA-SILVERSPRING
US
whitelisted
5460
bomgar-scc.exe
3.233.108.128:443
license.bomgar.com
AMAZON-AES
US
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4428
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
login.live.com
  • 20.190.160.14
  • 40.126.32.76
  • 40.126.32.134
  • 20.190.160.17
  • 20.190.160.22
  • 40.126.32.136
  • 20.190.160.20
  • 40.126.32.138
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
emc2.omao.noaa.gov
  • 140.90.144.92
whitelisted
license.bomgar.com
  • 3.233.108.128
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
www.bing.com
  • 104.126.37.161
  • 104.126.37.177
  • 104.126.37.160
  • 104.126.37.170
  • 104.126.37.171
  • 104.126.37.162
  • 104.126.37.176
  • 104.126.37.163
  • 104.126.37.155
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted

Threats

No threats detected
Process
Message
spinner.exe
SPN(19fc):image C:\Users\admin\AppData\Local\Temp\nsc5D96.tmpspinner-$SPIN_INSTANCE\spinner-3.bmp
spinner.exe
SPN(19fc):image C:\Users\admin\AppData\Local\Temp\nsc5D96.tmpspinner-$SPIN_INSTANCE\spinner-5.bmp
spinner.exe
SPN(19fc):image C:\Users\admin\AppData\Local\Temp\nsc5D96.tmpspinner-$SPIN_INSTANCE\spinner-2.bmp
spinner.exe
SPN(19fc):image C:\Users\admin\AppData\Local\Temp\nsc5D96.tmpspinner-$SPIN_INSTANCE\spinner-1.bmp
spinner.exe
SPN(19fc):image C:\Users\admin\AppData\Local\Temp\nsc5D96.tmpspinner-$SPIN_INSTANCE\spinner-4.bmp
spinner.exe
SPN(19fc):>CMainWindow::CMainWindow
spinner.exe
SPN(19fc):>CMainWindow::Create
spinner.exe
SPN(19fc):<CMainWindow::CMainWindow
spinner.exe
SPN(19fc):>CMainWindow::OnCreate
spinner.exe
SPN(19fc):<CMainWindow::OnCreate
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
bomgar-scc-w05c30if6jix1df1i1yydw85811xd87he1zfjec40jc90.exe