File name:

vs_ultimate.exe

Full analysis: https://app.any.run/tasks/3496bb32-e004-44ed-b0ba-26a85762f404
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 26, 2020, 07:01:37
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

8E056C0378C8EFB1C7047397A75F075D

SHA1:

667D3F537292AFE42064374A12E2E957BC6EF844

SHA256:

526263E152EDBA557A10925F860B74EC7DB8CD127A603B07DA6314D48BE9B02B

SSDEEP:

24576:vGFsZ9PExxb3sgBiEyCOMBPGD9TtONk4U+VJzEX:YxwgBRdOMBO5T0m4UGJzs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • vs_ultimate.exe (PID: 3364)
      • explorer.exe (PID: 372)
      • SearchProtocolHost.exe (PID: 3640)

    • Starts Visual C# compiler

      • vs_ultimate.exe (PID: 3364)

    • Changes the autorun value in the registry

      • vs_ultimate.exe (PID: 2228)

    • Application was dropped or rewritten from another process

      • VS_PreClean_vs.exe (PID: 3260)
      • Preparation.exe (PID: 2012)

    • Loads the Task Scheduler COM API

      • ngen.exe (PID: 1916)
      • ngen.exe (PID: 1940)
      • ngen.exe (PID: 1196)
      • ngen.exe (PID: 1900)

    • Changes settings of System certificates

      • vs_ultimate.exe (PID: 2228)

  • SUSPICIOUS

    • Searches for installed software

      • vs_ultimate.exe (PID: 3364)
      • vs_ultimate.exe (PID: 2228)

    • Executed as Windows Service

      • PresentationFontCache.exe (PID: 3556)
      • vssvc.exe (PID: 1064)

    • Starts itself from another location

      • vs_ultimate.exe (PID: 3364)

    • Creates files in the program directory

      • vs_ultimate.exe (PID: 2228)

    • Creates a software uninstall entry

      • vs_ultimate.exe (PID: 2228)

    • Executable content was dropped or overwritten

      • vs_ultimate.exe (PID: 3364)
      • vs_ultimate.exe (PID: 2228)
      • msiexec.exe (PID: 1696)

    • Creates files in the Windows directory

      • msiexec.exe (PID: 1696)
      • ngen.exe (PID: 1916)
      • ngen.exe (PID: 1940)
      • ngen.exe (PID: 1900)
      • ngen.exe (PID: 1196)

    • Creates COM task schedule object

      • msiexec.exe (PID: 1696)

    • Adds / modifies Windows certificates

      • vs_ultimate.exe (PID: 2228)

  • INFO

    • Reads settings of System Certificates

      • vs_ultimate.exe (PID: 3364)
      • vs_ultimate.exe (PID: 2228)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 1064)

    • Application launched itself

      • msiexec.exe (PID: 1696)

    • Loads dropped or rewritten executable

      • msiexec.exe (PID: 1696)
      • MsiExec.exe (PID: 1028)
      • MsiExec.exe (PID: 3920)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • msiexec.exe (PID: 1696)

    • Dropped object may contain Bitcoin addresses

      • msiexec.exe (PID: 1696)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 1696)

    • Creates files in the program directory

      • msiexec.exe (PID: 1696)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2013:05:02 16:57:00+02:00
PEType: PE32
LinkerVersion: 10
CodeSize: 320000
InitializedDataSize: 131072
UninitializedDataSize: -
EntryPoint: 0x474b
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 11.0.50727.26
ProductVersionNumber: 11.0.50727.26
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Microsoft Corporation
FileDescription: Microsoft Visual Studio Ultimate 2012
FileVersion: 11.0.50727.26
InternalName: setup
LegalCopyright: Copyright (c) Microsoft Corporation. All rights reserved.
OriginalFileName: vs_ultimate.exe
ProductName: Microsoft Visual Studio Ultimate 2012
ProductVersion: 11.0.50727.26

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 02-May-2013 14:57:00
Detected languages:
  • English - United States
Debug artifacts:
  • E:\delivery\Dev\wix36_dev11\build\ship\x86\x86\burn.pdb
CompanyName: Microsoft Corporation
FileDescription: Microsoft Visual Studio Ultimate 2012
FileVersion: 11.0.50727.26
InternalName: setup
LegalCopyright: Copyright (c) Microsoft Corporation. All rights reserved.
OriginalFilename: vs_ultimate.exe
ProductName: Microsoft Visual Studio Ultimate 2012
ProductVersion: 11.0.50727.26

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 02-May-2013 14:57:00
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_NET_RUN_FROM_SWAP
  • IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0004E17A
0x0004E200
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.59947
.data
0x00050000
0x00002E7C
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.43369
.wixburn8
0x00053000
0x00000038
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
0.511301
.tls
0x00054000
0x00000009
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00055000
0x0001A9F0
0x0001AA00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
2.88238
.reloc
0x00070000
0x0000415E
0x00004200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
5.58068

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.3189
1174
Latin 1 / Western European
English - United States
RT_MANIFEST
2
2.48851
296
Latin 1 / Western European
English - United States
RT_ICON
3
2.2106
2216
Latin 1 / Western European
English - United States
RT_ICON
4
1.41906
1384
Latin 1 / Western European
English - United States
RT_ICON
5
7.71045
3835
Latin 1 / Western European
English - United States
RT_ICON
6
2.69789
9640
Latin 1 / Western European
English - United States
RT_ICON
7
2.94554
4264
Latin 1 / Western European
English - United States
RT_ICON
8
3.21075
1128
Latin 1 / Western European
English - United States
RT_ICON

Imports

ADVAPI32.dll
CRYPT32.dll
Cabinet.dll
GDI32.dll
KERNEL32.dll
OLEAUT32.dll
RPCRT4.dll
SHELL32.dll
USER32.dll
VERSION.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
95
Monitored processes
21
Malicious processes
7
Suspicious processes
4

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start vs_ultimate.exe csc.exe cvtres.exe no specs csc.exe cvtres.exe no specs presentationfontcache.exe no specs csc.exe cvtres.exe no specs vs_ultimate.exe vssvc.exe no specs vs_preclean_vs.exe no specs preparation.exe no specs msiexec.exe msiexec.exe no specs msiexec.exe no specs explorer.exe no specs searchprotocolhost.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs ngen.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
372C:\Windows\Explorer.EXEC:\Windows\explorer.exe——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1028C:\Windows\system32\MsiExec.exe -Embedding 29D743DF32574EA4BA1BD9DC34F8A0F4C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1064C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1196C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files\Common7\Tools\ProjectComponents\Microsoft.VisualStudio.ComponentModelHost.dll" /queue:3 /NoDependenciesC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
4.7.3062.0 built by: NET472REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\ngen.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcr120_clr0400.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
1692"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\admin\AppData\Local\Temp\1p0vust5.cmdline"C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
vs_ultimate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Visual C# Command Line Compiler
Exit code:
0
Version:
8.0.50727.4927 (NetFXspW7.050727-4900)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\csc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\user32.dll
1696C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1900C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe update /queueC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
4.7.3062.0 built by: NET472REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\ngen.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcr120_clr0400.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
1916C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "System.Threading.Tasks.Dataflow, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependenciesC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
4.7.3062.0 built by: NET472REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\ngen.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcr120_clr0400.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
1940C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "Microsoft.Build.CPPTasks.Common.v110, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" /queue:3 /NoDependenciesC:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe—MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Common Language Runtime native compiler
Exit code:
0
Version:
4.7.3062.0 built by: NET472REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\ngen.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcr120_clr0400.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
2012"C:\ProgramData\Package Cache\840104A2546080B219D56900C44E75F786239BB9\packages\Preparation.exe" /dC:\ProgramData\Package Cache\840104A2546080B219D56900C44E75F786239BB9\packages\Preparation.exe—vs_ultimate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual Studio 2012
Exit code:
0
Version:
11.0.50727.1 built by: RTMREL
Modules
Images
c:\programdata\package cache\840104a2546080b219d56900c44e75f786239bb9\packages\preparation.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msi.dll
c:\windows\system32\user32.dll
Total events
10 156
Read events
4 131
Write events
5 834
Delete events
191

Modification events

(PID) Process:(3364) vs_ultimate.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3364) vs_ultimate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Direct3D\MostRecentApplication
Operation:writeName:Name
Value:
vs_ultimate.exe
(PID) Process:(372) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:P:\Hfref\nqzva\NccQngn\Ybpny\Grzc\if_hygvzngr.rkr
Value:
00000000000000000100000000000000000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BFFFFFFFFF000000000000000000000000
(PID) Process:(372) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:HRZR_PGYFRFFVBA
Value:
000000003F00000050000000EAB325000A00000018000000868F0F007B00460033003800420046003400300034002D0031004400340033002D0034003200460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E0065007800650000005CE9ED0100000000000000000000000000000000480B20020000000005000000D80B200200000000340C200270E9ED01C0E9ED010000000000000000C0DB2002050000002000000000000000000000000100000064666C7464666C7400000000400000000459A377AD0501A70000000000000000010000000000000000000000B02D0C08A82C0C08A4E9ED013DA9D27600000000FBFFFF7FC8E9ED01987880574F8C6244BB6371042380B1090000000001100211FFFFFFFF000000000000000000000000371054065310540637105406000000000000000000000000080000002E006C006E006B0000006E006400200011000000483D3200403D32002E006C006E006B0000002F0080EA0000C85704AB34EAED018291D27680EAED01EC430000E45704AB48EAED01B69CD276F04311024C06000060EAED01603F11026CEAED0111000000483D3200403D320060EAED01803F1102D0EA0000BC5704AB80EAED018291D276D0EAED0184EAED012795D27600000000EC431102ACEAED01CD94D276EC43110258EBED01603F1102E194D27600000000603F110258EBED01B4EAED010A00000018000000868F0F007B00460033003800420046003400300034002D0031004400340033002D0034003200460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E0065007800650000005CE9ED0100000000000000000000000000000000480B20020000000005000000D80B200200000000340C200270E9ED01C0E9ED010000000000000000C0DB2002050000002000000000000000000000000100000064666C7464666C7400000000400000000459A377AD0501A70000000000000000010000000000000000000000B02D0C08A82C0C08A4E9ED013DA9D27600000000FBFFFF7FC8E9ED01987880574F8C6244BB6371042380B1090000000001100211FFFFFFFF000000000000000000000000371054065310540637105406000000000000000000000000080000002E006C006E006B0000006E006400200011000000483D3200403D32002E006C006E006B0000002F0080EA0000C85704AB34EAED018291D27680EAED01EC430000E45704AB48EAED01B69CD276F04311024C06000060EAED01603F11026CEAED0111000000483D3200403D320060EAED01803F1102D0EA0000BC5704AB80EAED018291D276D0EAED0184EAED012795D27600000000EC431102ACEAED01CD94D276EC43110258EBED01603F1102E194D27600000000603F110258EBED01B4EAED010A00000018000000868F0F007B00460033003800420046003400300034002D0031004400340033002D0034003200460032002D0039003300300035002D003600370044004500300042003200380046004300320033007D005C006500780070006C006F007200650072002E0065007800650000005CE9ED0100000000000000000000000000000000480B20020000000005000000D80B200200000000340C200270E9ED01C0E9ED010000000000000000C0DB2002050000002000000000000000000000000100000064666C7464666C7400000000400000000459A377AD0501A70000000000000000010000000000000000000000B02D0C08A82C0C08A4E9ED013DA9D27600000000FBFFFF7FC8E9ED01987880574F8C6244BB6371042380B1090000000001100211FFFFFFFF000000000000000000000000371054065310540637105406000000000000000000000000080000002E006C006E006B0000006E006400200011000000483D3200403D32002E006C006E006B0000002F0080EA0000C85704AB34EAED018291D27680EAED01EC430000E45704AB48EAED01B69CD276F04311024C06000060EAED01603F11026CEAED0111000000483D3200403D320060EAED01803F1102D0EA0000BC5704AB80EAED018291D276D0EAED0184EAED012795D27600000000EC431102ACEAED01CD94D276EC43110258EBED01603F1102E194D27600000000603F110258EBED01B4EAED01
(PID) Process:(3364) vs_ultimate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:Browse For Folder Width
Value:
318
(PID) Process:(3364) vs_ultimate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:Browse For Folder Height
Value:
288
(PID) Process:(3364) vs_ultimate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3364) vs_ultimate.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2228) vs_ultimate.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
400000000000000087975B963C03D601B408000094010000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2228) vs_ultimate.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4000000000000000ADBD5B963C03D601B408000094010000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
214
Suspicious files
107
Text files
2 076
Unknown types
137

Dropped files

PID
Process
Filename
Type
3364vs_ultimate.exeC:\Users\admin\AppData\Local\Temp\kpyiibcf.0.cs —
MD5:—
SHA256:—
3364vs_ultimate.exeC:\Users\admin\AppData\Local\Temp\kpyiibcf.cmdline —
MD5:—
SHA256:—
3052csc.exeC:\Users\admin\AppData\Local\Temp\CSC6EC0.tmp —
MD5:—
SHA256:—
3052csc.exeC:\Users\admin\AppData\Local\Temp\kpyiibcf.dll —
MD5:—
SHA256:—
2936cvtres.exeC:\Users\admin\AppData\Local\Temp\RES6EC1.tmp —
MD5:—
SHA256:—
3052csc.exeC:\Users\admin\AppData\Local\Temp\kpyiibcf.out —
MD5:—
SHA256:—
3364vs_ultimate.exeC:\Users\admin\AppData\Local\Temp\1p0vust5.0.cs —
MD5:—
SHA256:—
3364vs_ultimate.exeC:\Users\admin\AppData\Local\Temp\1p0vust5.cmdline —
MD5:—
SHA256:—
1692csc.exeC:\Users\admin\AppData\Local\Temp\CSC6FE9.tmp —
MD5:—
SHA256:—
2972cvtres.exeC:\Users\admin\AppData\Local\Temp\RES6FEA.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
235
TCP/UDP connections
3
DNS requests
3
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
302
23.77.210.216:80
http://go.microsoft.com/fwlink/?LinkId=250423&clcid=0x409
NL
—
—
whitelisted
—
—
HEAD
302
23.77.210.216:80
http://go.microsoft.com/fwlink/?LinkId=249911&clcid=0x409
NL
—
—
whitelisted
—
—
GET
302
23.77.210.216:80
http://go.microsoft.com/fwlink/?LinkId=249911&clcid=0x409
NL
—
—
whitelisted
—
—
HEAD
302
23.77.210.216:80
http://go.microsoft.com/fwlink/?LinkId=249910&clcid=0x409
NL
—
—
whitelisted
—
—
HEAD
200
95.101.184.143:80
http://download.microsoft.com/download/4/8/6/486B013C-3EDD-4AFF-84AD-F9752B2C9C28/enu_vs_common/clean/vs_preclean_vs.exe
unknown
—
—
whitelisted
—
—
HEAD
302
23.77.210.216:80
http://go.microsoft.com/fwlink/?LinkId=250371&clcid=0x409
NL
—
—
whitelisted
—
—
HEAD
302
23.77.210.216:80
http://go.microsoft.com/fwlink/?LinkId=250423&clcid=0x409
NL
—
—
whitelisted
—
—
GET
302
23.77.210.216:80
http://go.microsoft.com/fwlink/?LinkId=249910&clcid=0x409
NL
—
—
whitelisted
—
—
HEAD
302
23.77.210.216:80
http://go.microsoft.com/fwlink/?LinkId=249915&clcid=0x409
NL
—
—
whitelisted
—
—
GET
302
23.77.210.216:80
http://go.microsoft.com/fwlink/?LinkId=250371&clcid=0x409
NL
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
23.77.210.216:80
go.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
95.101.184.143:80
download.microsoft.com
CW Vodafone Group PLC
—
suspicious
2228
vs_ultimate.exe
23.55.110.193:80
crl.microsoft.com
NTT America, Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
go.microsoft.com
  • 23.77.210.216
whitelisted
download.microsoft.com
  • 95.101.184.143
whitelisted
crl.microsoft.com
  • 23.55.110.193
  • 23.55.110.211
whitelisted

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Misc activity
ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
—
—
Misc activity
ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
—
—
Potential Corporate Privacy Violation
POLICY [PTsecurity] Executable application_x-msi Download
—
—
Misc activity
ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
2 ETPRO signatures available at the full report
Process
Message
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
csc.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
vs_ultimate.exe