File name:

.exe

Full analysis: https://app.any.run/tasks/63a12023-3cd4-444a-915a-1cb70aad6aef
Verdict: Malicious activity
Analysis date: June 21, 2025, 17:33:04
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 5 sections
MD5:

ACCFB2712ECBFA60A9B9A5AA1EB12A07

SHA1:

CD3A21CAE837B1576280E94FEC3486CB5E80C78C

SHA256:

4BFE96B6C3D7EC44672FDBE51821061ECCA2D93D3D35E358897CB7464EAFA697

SSDEEP:

24576:RKFLyZtgCdktulbWPJcGJuIY3R2sfiLqmcfo8C:RKFLyZtgCdktulbWPJcGJuIYh2sfiLqc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was injected by another process

      • sihost.exe (PID: 4180)
      • svchost.exe (PID: 4248)
      • explorer.exe (PID: 4772)
      • StartMenuExperienceHost.exe (PID: 5160)
      • svchost.exe (PID: 4204)
      • svchost.exe (PID: 5048)
      • RuntimeBroker.exe (PID: 5224)
      • dllhost.exe (PID: 2484)
      • RuntimeBroker.exe (PID: 7092)
      • taskhostw.exe (PID: 4760)
      • firefox.exe (PID: 3876)
      • default-browser-agent.exe (PID: 1760)
      • firefox.exe (PID: 2368)
      • RuntimeBroker.exe (PID: 5448)
      • SearchApp.exe (PID: 5328)
      • dllhost.exe (PID: 5604)
      • RuntimeBroker.exe (PID: 4376)
      • ApplicationFrameHost.exe (PID: 5096)
      • UserOOBEBroker.exe (PID: 5936)
      • svchost.exe (PID: 6984)
      • TextInputHost.exe (PID: 2772)

    • Runs injected code in another process

      • 63a12023-3cd4-444a-915a-1cb70aad6aef.exe (PID: 1044)

    • Changes the autorun value in the registry

      • 63a12023-3cd4-444a-915a-1cb70aad6aef.exe (PID: 1044)
      • explorer.exe (PID: 4772)

  • SUSPICIOUS

    • Connects to the server without a host name

      • explorer.exe (PID: 4772)

    • Executable content was dropped or overwritten

      • 63a12023-3cd4-444a-915a-1cb70aad6aef.exe (PID: 1044)

  • INFO

    • Checks supported languages

      • 63a12023-3cd4-444a-915a-1cb70aad6aef.exe (PID: 1044)
      • default-browser-agent.exe (PID: 1760)

    • Reads the machine GUID from the registry

      • StartMenuExperienceHost.exe (PID: 5160)
      • 63a12023-3cd4-444a-915a-1cb70aad6aef.exe (PID: 1044)
      • default-browser-agent.exe (PID: 1760)
      • TextInputHost.exe (PID: 2772)

    • Reads the computer name

      • 63a12023-3cd4-444a-915a-1cb70aad6aef.exe (PID: 1044)

    • Creates files in the program directory

      • 63a12023-3cd4-444a-915a-1cb70aad6aef.exe (PID: 1044)

    • Launching a file from a Registry key

      • 63a12023-3cd4-444a-915a-1cb70aad6aef.exe (PID: 1044)
      • explorer.exe (PID: 4772)

    • Checks proxy server information

      • explorer.exe (PID: 4772)

    • Reads security settings of Internet Explorer

      • taskhostw.exe (PID: 4760)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:06:21 17:34:56+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.4
CodeSize: 55808
InitializedDataSize: 540160
UninitializedDataSize: -
EntryPoint: 0x1e78
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
22
Malicious processes
3
Suspicious processes
19

Behavior graph

Click at the process to see the details
start 63a12023-3cd4-444a-915a-1cb70aad6aef.exe explorer.exe default-browser-agent.exe firefox.exe dllhost.exe textinputhost.exe firefox.exe sihost.exe svchost.exe svchost.exe runtimebroker.exe taskhostw.exe svchost.exe applicationframehost.exe startmenuexperiencehost.exe runtimebroker.exe searchapp.exe runtimebroker.exe dllhost.exe useroobebroker.exe svchost.exe runtimebroker.exe

Process information

PID
CMD
Path
Indicators
Parent process
1044"C:\Users\admin\AppData\Local\Temp\63a12023-3cd4-444a-915a-1cb70aad6aef.exe" C:\Users\admin\AppData\Local\Temp\63a12023-3cd4-444a-915a-1cb70aad6aef.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\63a12023-3cd4-444a-915a-1cb70aad6aef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1760"C:\Program Files\Mozilla Firefox\default-browser-agent.exe" do-task "308046B0AF4A39CB"C:\Program Files\Mozilla Firefox\default-browser-agent.exe
svchost.exe
User:
admin
Company:
Mozilla Foundation
Integrity Level:
MEDIUM
Exit code:
0
Version:
136.0
Modules
Images
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\psapi.dll
c:\windows\system32\wininet.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\shcore.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\netutils.dll
c:\program files\mozilla firefox\default-browser-agent.exe
2368"C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask defaultagent do-task 308046B0AF4A39CBC:\Program Files\Mozilla Firefox\firefox.exe
default-browser-agent.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
136.0
Modules
Images
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\imm32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\psapi.dll
c:\windows\system32\wininet.dll
2484C:\WINDOWS\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}C:\Windows\System32\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\shell32.dll
c:\windows\system32\psapi.dll
c:\windows\system32\wininet.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\netutils.dll
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
2772"C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Version:
123.26505.0.0
Modules
Images
c:\windows\system32\shell32.dll
c:\windows\system32\psapi.dll
c:\windows\system32\wininet.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
3876"C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask defaultagent do-task 308046B0AF4A39CBC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msvcp140.dll
c:\windows\system32\vcruntime140.dll
4180sihost.exeC:\Windows\System32\sihost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Shell Infrastructure Host
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\shell32.dll
c:\windows\system32\psapi.dll
c:\windows\system32\wininet.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\netutils.dll
c:\windows\system32\sihost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
4204C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvcC:\Windows\System32\svchost.exe
services.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\psapi.dll
c:\windows\system32\wininet.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\netutils.dll
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
4248C:\WINDOWS\system32\svchost.exe -k UnistackSvcGroup -s WpnUserServiceC:\Windows\System32\svchost.exe
services.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\psapi.dll
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
4376C:\Windows\System32\RuntimeBroker.exe -EmbeddingC:\Windows\System32\RuntimeBroker.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Runtime Broker
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\psapi.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\netutils.dll
c:\windows\system32\runtimebroker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
Total events
1 612
Read events
1 567
Write events
41
Delete events
4

Modification events

(PID) Process:(4760) taskhostw.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CloudStore\Store\DefaultAccount\Current\default$windows.data.apps.appleveltileinfo$appleveltilelist\windows.data.apps.appleveltileinfo$w~microsoft.skype.skypedesktop
Operation:writeName:Data
Value:
434201000A0201002A06EAD9DBC2062A000000
(PID) Process:(4760) taskhostw.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\AppListBackup\ListOfTaskBackedUpTiles_2475499347
Operation:writeName:ListOfTaskBackedUpTiles_2475499347
Value:
{"tileId":"W~Microsoft.Skype.SkypeDesktop", "appIconLightAssetId":"", "appIconDarkAssetId":"", "displayName":"", "sortName":"", "suiteName":"", "packageId":"", "action":"2", "shortcutArgs":"", "targetPath":""}
(PID) Process:(1044) 63a12023-3cd4-444a-915a-1cb70aad6aef.exeKey:HKEY_CURRENT_USER\SOFTWARE\bbeecafdaeec
Operation:writeName:CurrentPath
Value:
C:\Users\admin\AppData\Local\Temp\63a12023-3cd4-444a-915a-1cb70aad6aef.exe
(PID) Process:(1044) 63a12023-3cd4-444a-915a-1cb70aad6aef.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:bbeecafdaeec
Value:
"C:\ProgramData\bbeecafdaeec.exe"
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:bbeecafdaeec
Value:
"C:\ProgramData\bbeecafdaeec.exe"
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:bbeecafdaeec
Value:
"C:\Users\admin\AppData\Local\Temp\63a12023-3cd4-444a-915a-1cb70aad6aef.exe"
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\bbeecafdaeec
Operation:writeName:CurrentPath
Value:
C:\Users\admin\AppData\Local\Temp\63a12023-3cd4-444a-915a-1cb70aad6aef.exe
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run
Operation:delete keyName:(default)
Value:
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder
Operation:delete keyName:(default)
Value:
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
Operation:writeName:LastUpdate
Value:
EBEC566800000000
Executable files
1
Suspicious files
6
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
3876firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\93u99co2.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\datareporting\glean\db\data.safe.binbinary
MD5:9826C1A108FB6F717F6DA6E801794ABA
SHA256:E407264BB876E87DC7517146B6D8B252906BA3BEE18B3058AD03BA8708BE8381
3876firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\93u99co2.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\datareporting\glean\db\data.safe.tmpbinary
MD5:9826C1A108FB6F717F6DA6E801794ABA
SHA256:E407264BB876E87DC7517146B6D8B252906BA3BEE18B3058AD03BA8708BE8381
104463a12023-3cd4-444a-915a-1cb70aad6aef.exeC:\ProgramData\bbeecafdaeec.exeexecutable
MD5:ACCFB2712ECBFA60A9B9A5AA1EB12A07
SHA256:4BFE96B6C3D7EC44672FDBE51821061ECCA2D93D3D35E358897CB7464EAFA697
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
24
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3944
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.55.104.172:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2220
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4772
explorer.exe
POST
200
185.156.72.89:80
http://185.156.72.89/nzcwzue/pqrfxn.php
unknown
—
—
unknown
2220
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4708
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2336
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
3944
svchost.exe
20.190.159.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3944
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
23.55.104.172:80
crl.microsoft.com
Akamai International B.V.
US
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
google.com
  • 142.250.185.110
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.2
  • 20.190.159.23
  • 20.190.159.64
  • 40.126.31.1
  • 20.190.159.75
  • 20.190.159.130
  • 40.126.31.129
  • 40.126.31.2
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
crl.microsoft.com
  • 23.55.104.172
  • 23.55.104.190
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.43
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

No threats detected
No debug info