File name:

1 (1220)

Full analysis: https://app.any.run/tasks/968d5c85-2971-4021-8812-ecc3677f3787
Verdict: Malicious activity
Analysis date: March 24, 2025, 11:03:53
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
MD5:

A223782A1366232BBF3798461BEA1660

SHA1:

7CC37A5E30358E526C29975542C6E682169C17FD

SHA256:

54BB0FEB36D025865235339AA41AE1AB7FC3B9260F2A12E31D5618D603449E0E

SSDEEP:

24576:4oE4BacwNqAJC4pbiGmwXX+67IQRQkZWv9k:4oEmacwNqAJfZiGmMX+rmQkZE9k

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • reg.exe (PID: 5608)
      • reg.exe (PID: 2096)
      • reg.exe (PID: 2340)
      • reg.exe (PID: 4896)
      • reg.exe (PID: 6712)
      • reg.exe (PID: 1128)
      • reg.exe (PID: 3240)
      • reg.exe (PID: 3096)
      • reg.exe (PID: 2984)
      • reg.exe (PID: 7156)
      • reg.exe (PID: 1328)
      • reg.exe (PID: 1228)
      • reg.exe (PID: 6068)
      • reg.exe (PID: 5576)
      • reg.exe (PID: 4488)
      • reg.exe (PID: 3888)
      • reg.exe (PID: 5232)
      • reg.exe (PID: 4628)
      • reg.exe (PID: 2240)
      • reg.exe (PID: 4244)
      • reg.exe (PID: 4844)
      • reg.exe (PID: 4980)
      • reg.exe (PID: 4920)
      • reg.exe (PID: 5984)
      • reg.exe (PID: 5352)
      • reg.exe (PID: 968)
      • reg.exe (PID: 6820)
      • reg.exe (PID: 6068)
      • reg.exe (PID: 5304)
      • reg.exe (PID: 5200)
      • reg.exe (PID: 3828)
      • reg.exe (PID: 6372)
      • reg.exe (PID: 5136)
      • reg.exe (PID: 5328)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • 1 (1220).exe (PID: 2284)
      • service.exe (PID: 4608)
      • service.exe (PID: 3304)
      • service.exe (PID: 5680)
      • service.exe (PID: 1188)
      • service.exe (PID: 2552)
      • service.exe (PID: 5328)
      • service.exe (PID: 5384)
      • service.exe (PID: 7156)
      • service.exe (PID: 4488)
      • service.exe (PID: 1324)
      • service.exe (PID: 6036)
      • service.exe (PID: 1072)
      • service.exe (PID: 1012)
      • service.exe (PID: 5868)
      • service.exe (PID: 5392)
      • service.exe (PID: 780)
      • service.exe (PID: 2644)
      • service.exe (PID: 2320)
      • service.exe (PID: 872)
      • service.exe (PID: 5984)
      • service.exe (PID: 4172)
      • service.exe (PID: 5048)
      • service.exe (PID: 4980)
      • service.exe (PID: 6044)
      • service.exe (PID: 5776)
      • service.exe (PID: 1764)
      • service.exe (PID: 2152)
      • service.exe (PID: 5112)
      • service.exe (PID: 3304)
      • service.exe (PID: 6272)
      • service.exe (PID: 5188)
      • service.exe (PID: 7012)
      • service.exe (PID: 6564)
      • service.exe (PID: 5176)
      • service.exe (PID: 1012)
      • service.exe (PID: 6660)
      • service.exe (PID: 4056)
      • service.exe (PID: 6248)
      • service.exe (PID: 1616)
      • service.exe (PID: 2908)
      • service.exe (PID: 3976)
      • service.exe (PID: 5384)
      • service.exe (PID: 6752)
      • service.exe (PID: 5740)
      • service.exe (PID: 3620)
      • service.exe (PID: 3828)

    • Executing commands from a ".bat" file

      • 1 (1220).exe (PID: 2284)
      • service.exe (PID: 4608)
      • service.exe (PID: 3304)
      • service.exe (PID: 5680)
      • service.exe (PID: 1188)
      • service.exe (PID: 2552)
      • service.exe (PID: 5328)
      • service.exe (PID: 5384)
      • service.exe (PID: 7156)
      • service.exe (PID: 4488)
      • service.exe (PID: 1324)
      • service.exe (PID: 6036)
      • service.exe (PID: 1072)
      • service.exe (PID: 1012)
      • service.exe (PID: 5868)
      • service.exe (PID: 5392)
      • service.exe (PID: 780)
      • service.exe (PID: 2320)
      • service.exe (PID: 2644)
      • service.exe (PID: 872)
      • service.exe (PID: 5984)
      • service.exe (PID: 4172)
      • service.exe (PID: 5048)
      • service.exe (PID: 4980)
      • service.exe (PID: 5776)
      • service.exe (PID: 6044)
      • service.exe (PID: 1764)
      • service.exe (PID: 2152)
      • service.exe (PID: 5112)
      • service.exe (PID: 3304)
      • service.exe (PID: 5188)
      • service.exe (PID: 6272)
      • service.exe (PID: 7012)
      • service.exe (PID: 5176)
      • service.exe (PID: 6564)
      • service.exe (PID: 1012)
      • service.exe (PID: 6660)
      • service.exe (PID: 4056)
      • service.exe (PID: 6248)
      • service.exe (PID: 2908)
      • service.exe (PID: 1616)
      • service.exe (PID: 5384)
      • service.exe (PID: 3976)
      • service.exe (PID: 6752)
      • service.exe (PID: 3620)
      • service.exe (PID: 5740)
      • service.exe (PID: 3828)

    • Reads security settings of Internet Explorer

      • 1 (1220).exe (PID: 2284)
      • service.exe (PID: 4608)
      • service.exe (PID: 3304)
      • service.exe (PID: 1188)
      • service.exe (PID: 5680)
      • service.exe (PID: 2552)
      • service.exe (PID: 5328)
      • service.exe (PID: 5384)
      • service.exe (PID: 7156)
      • service.exe (PID: 4488)
      • service.exe (PID: 1324)
      • service.exe (PID: 6036)
      • service.exe (PID: 1012)
      • service.exe (PID: 1072)
      • service.exe (PID: 5868)
      • service.exe (PID: 780)
      • service.exe (PID: 5392)
      • service.exe (PID: 2644)
      • service.exe (PID: 2320)
      • service.exe (PID: 872)
      • service.exe (PID: 4172)
      • service.exe (PID: 5984)
      • service.exe (PID: 5048)
      • service.exe (PID: 4980)
      • service.exe (PID: 5776)
      • service.exe (PID: 6044)
      • service.exe (PID: 1764)
      • service.exe (PID: 2152)
      • service.exe (PID: 3304)
      • service.exe (PID: 5112)
      • service.exe (PID: 6272)
      • service.exe (PID: 5188)
      • service.exe (PID: 7012)
      • service.exe (PID: 6564)
      • service.exe (PID: 5176)
      • service.exe (PID: 1012)
      • service.exe (PID: 4056)
      • service.exe (PID: 6660)
      • service.exe (PID: 6248)
      • service.exe (PID: 2908)
      • service.exe (PID: 5384)
      • service.exe (PID: 1616)
      • service.exe (PID: 6752)
      • service.exe (PID: 3620)
      • service.exe (PID: 3976)
      • service.exe (PID: 5740)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 6540)
      • cmd.exe (PID: 6540)
      • cmd.exe (PID: 5640)
      • cmd.exe (PID: 5024)
      • cmd.exe (PID: 1128)
      • cmd.exe (PID: 736)
      • cmd.exe (PID: 2140)
      • cmd.exe (PID: 5756)
      • cmd.exe (PID: 5964)
      • cmd.exe (PID: 1760)
      • cmd.exe (PID: 6324)
      • cmd.exe (PID: 2340)
      • cmd.exe (PID: 780)
      • cmd.exe (PID: 3096)
      • cmd.exe (PID: 4068)
      • cmd.exe (PID: 6808)
      • cmd.exe (PID: 2096)
      • cmd.exe (PID: 6488)
      • cmd.exe (PID: 5364)
      • cmd.exe (PID: 4180)
      • cmd.exe (PID: 1040)
      • cmd.exe (PID: 2392)
      • cmd.exe (PID: 5436)
      • cmd.exe (PID: 644)
      • cmd.exe (PID: 1056)
      • cmd.exe (PID: 3024)
      • cmd.exe (PID: 3020)
      • cmd.exe (PID: 3176)
      • cmd.exe (PID: 968)
      • cmd.exe (PID: 5020)
      • cmd.exe (PID: 5756)
      • cmd.exe (PID: 4628)
      • cmd.exe (PID: 2108)
      • cmd.exe (PID: 3332)
      • cmd.exe (PID: 856)
      • cmd.exe (PID: 7104)
      • cmd.exe (PID: 1628)
      • cmd.exe (PID: 5796)
      • cmd.exe (PID: 2516)
      • cmd.exe (PID: 732)
      • cmd.exe (PID: 6268)
      • cmd.exe (PID: 780)
      • cmd.exe (PID: 7100)
      • cmd.exe (PID: 5256)
      • cmd.exe (PID: 5116)
      • cmd.exe (PID: 6468)
      • cmd.exe (PID: 4920)

    • Executable content was dropped or overwritten

      • 1 (1220).exe (PID: 2284)
      • service.exe (PID: 4608)
      • service.exe (PID: 3304)
      • service.exe (PID: 1188)
      • service.exe (PID: 5680)
      • service.exe (PID: 2552)
      • service.exe (PID: 5328)
      • service.exe (PID: 5384)
      • service.exe (PID: 7156)
      • service.exe (PID: 4488)
      • service.exe (PID: 1324)
      • service.exe (PID: 6036)
      • service.exe (PID: 1072)
      • service.exe (PID: 1012)
      • service.exe (PID: 5868)
      • service.exe (PID: 5392)
      • service.exe (PID: 780)
      • service.exe (PID: 2644)
      • service.exe (PID: 2320)
      • service.exe (PID: 872)
      • service.exe (PID: 5984)
      • service.exe (PID: 4172)
      • service.exe (PID: 5048)
      • service.exe (PID: 4980)
      • service.exe (PID: 5776)
      • service.exe (PID: 6044)
      • service.exe (PID: 1764)
      • service.exe (PID: 2152)
      • service.exe (PID: 3304)
      • service.exe (PID: 5112)
      • service.exe (PID: 6272)
      • service.exe (PID: 5188)
      • service.exe (PID: 7012)
      • service.exe (PID: 6564)
      • service.exe (PID: 5176)
      • service.exe (PID: 1012)
      • service.exe (PID: 4056)
      • service.exe (PID: 6248)
      • service.exe (PID: 6660)
      • service.exe (PID: 2908)
      • service.exe (PID: 1616)
      • service.exe (PID: 3976)
      • service.exe (PID: 5384)
      • service.exe (PID: 6752)
      • service.exe (PID: 3620)
      • service.exe (PID: 5740)

    • Starts itself from another location

      • 1 (1220).exe (PID: 2284)
      • service.exe (PID: 4608)
      • service.exe (PID: 3304)
      • service.exe (PID: 1188)
      • service.exe (PID: 5680)
      • service.exe (PID: 2552)
      • service.exe (PID: 5328)
      • service.exe (PID: 5384)
      • service.exe (PID: 7156)
      • service.exe (PID: 4488)
      • service.exe (PID: 1324)
      • service.exe (PID: 6036)
      • service.exe (PID: 1072)
      • service.exe (PID: 1012)
      • service.exe (PID: 5868)
      • service.exe (PID: 5392)
      • service.exe (PID: 780)
      • service.exe (PID: 2644)
      • service.exe (PID: 2320)
      • service.exe (PID: 872)
      • service.exe (PID: 5984)
      • service.exe (PID: 4172)
      • service.exe (PID: 4980)
      • service.exe (PID: 5048)
      • service.exe (PID: 5776)
      • service.exe (PID: 1764)
      • service.exe (PID: 6044)
      • service.exe (PID: 2152)
      • service.exe (PID: 5112)
      • service.exe (PID: 3304)
      • service.exe (PID: 6272)
      • service.exe (PID: 5188)
      • service.exe (PID: 7012)
      • service.exe (PID: 6564)
      • service.exe (PID: 5176)
      • service.exe (PID: 1012)
      • service.exe (PID: 4056)
      • service.exe (PID: 6660)
      • service.exe (PID: 6248)
      • service.exe (PID: 2908)
      • service.exe (PID: 1616)
      • service.exe (PID: 5384)
      • service.exe (PID: 3976)
      • service.exe (PID: 6752)
      • service.exe (PID: 3620)
      • service.exe (PID: 5740)

  • INFO

    • The sample compiled with english language support

      • 1 (1220).exe (PID: 2284)
      • service.exe (PID: 780)
      • service.exe (PID: 2644)
      • service.exe (PID: 2320)
      • service.exe (PID: 872)
      • service.exe (PID: 5984)
      • service.exe (PID: 4172)
      • service.exe (PID: 5048)
      • service.exe (PID: 4980)
      • service.exe (PID: 5776)
      • service.exe (PID: 1764)
      • service.exe (PID: 6044)
      • service.exe (PID: 2152)
      • service.exe (PID: 5112)
      • service.exe (PID: 3304)
      • service.exe (PID: 6272)
      • service.exe (PID: 5188)
      • service.exe (PID: 7012)
      • service.exe (PID: 6564)
      • service.exe (PID: 1012)
      • service.exe (PID: 5176)
      • service.exe (PID: 4056)
      • service.exe (PID: 6248)
      • service.exe (PID: 6660)
      • service.exe (PID: 2908)
      • service.exe (PID: 1616)
      • service.exe (PID: 5384)
      • service.exe (PID: 6752)
      • service.exe (PID: 3976)
      • service.exe (PID: 3620)
      • service.exe (PID: 5740)

    • Creates files or folders in the user directory

      • 1 (1220).exe (PID: 2284)
      • service.exe (PID: 4608)
      • service.exe (PID: 3304)
      • service.exe (PID: 1188)
      • service.exe (PID: 5680)
      • service.exe (PID: 5328)
      • service.exe (PID: 2552)
      • service.exe (PID: 5384)
      • service.exe (PID: 7156)
      • service.exe (PID: 4488)
      • service.exe (PID: 1324)
      • service.exe (PID: 6036)
      • service.exe (PID: 1012)
      • service.exe (PID: 1072)
      • service.exe (PID: 5868)
      • service.exe (PID: 5392)
      • service.exe (PID: 2320)
      • service.exe (PID: 2644)
      • service.exe (PID: 872)
      • service.exe (PID: 5984)
      • service.exe (PID: 4172)
      • service.exe (PID: 5048)
      • service.exe (PID: 5776)
      • service.exe (PID: 4980)
      • service.exe (PID: 6044)
      • service.exe (PID: 1764)
      • service.exe (PID: 2152)
      • service.exe (PID: 5112)
      • service.exe (PID: 3304)
      • service.exe (PID: 6272)
      • service.exe (PID: 5188)
      • service.exe (PID: 6564)
      • service.exe (PID: 1012)
      • service.exe (PID: 4056)
      • service.exe (PID: 1616)
      • service.exe (PID: 6752)
      • service.exe (PID: 5740)

    • Process checks computer location settings

      • 1 (1220).exe (PID: 2284)
      • service.exe (PID: 4608)
      • service.exe (PID: 3304)
      • service.exe (PID: 1188)
      • service.exe (PID: 2552)
      • service.exe (PID: 5328)
      • service.exe (PID: 5680)
      • service.exe (PID: 5384)
      • service.exe (PID: 7156)
      • service.exe (PID: 4488)
      • service.exe (PID: 1324)
      • service.exe (PID: 6036)
      • service.exe (PID: 1072)
      • service.exe (PID: 1012)
      • service.exe (PID: 5868)
      • service.exe (PID: 5392)
      • service.exe (PID: 780)
      • service.exe (PID: 2644)
      • service.exe (PID: 2320)
      • service.exe (PID: 872)
      • service.exe (PID: 4172)
      • service.exe (PID: 5984)
      • service.exe (PID: 5048)
      • service.exe (PID: 4980)
      • service.exe (PID: 5776)
      • service.exe (PID: 1764)
      • service.exe (PID: 6044)
      • service.exe (PID: 2152)
      • service.exe (PID: 3304)
      • service.exe (PID: 5112)
      • service.exe (PID: 6272)
      • service.exe (PID: 7012)
      • service.exe (PID: 5188)
      • service.exe (PID: 5176)
      • service.exe (PID: 6564)
      • service.exe (PID: 1012)
      • service.exe (PID: 4056)
      • service.exe (PID: 6660)
      • service.exe (PID: 6248)
      • service.exe (PID: 2908)
      • service.exe (PID: 5384)
      • service.exe (PID: 3976)
      • service.exe (PID: 1616)
      • service.exe (PID: 6752)
      • service.exe (PID: 3620)
      • service.exe (PID: 5740)
      • service.exe (PID: 3828)

    • Reads the computer name

      • 1 (1220).exe (PID: 2284)
      • service.exe (PID: 4608)
      • service.exe (PID: 1188)
      • service.exe (PID: 5328)
      • service.exe (PID: 5384)
      • service.exe (PID: 7156)
      • service.exe (PID: 1324)
      • service.exe (PID: 6036)
      • service.exe (PID: 1072)
      • service.exe (PID: 5868)
      • service.exe (PID: 5392)
      • service.exe (PID: 4172)
      • service.exe (PID: 5048)
      • service.exe (PID: 4980)
      • service.exe (PID: 6044)
      • service.exe (PID: 2152)
      • service.exe (PID: 5112)
      • service.exe (PID: 3304)
      • service.exe (PID: 5188)
      • service.exe (PID: 6272)
      • service.exe (PID: 7012)
      • service.exe (PID: 6564)
      • service.exe (PID: 5176)
      • service.exe (PID: 1012)
      • service.exe (PID: 4056)
      • service.exe (PID: 6660)
      • service.exe (PID: 6248)
      • service.exe (PID: 2908)
      • service.exe (PID: 6752)
      • service.exe (PID: 3620)
      • service.exe (PID: 3828)

    • Checks supported languages

      • 1 (1220).exe (PID: 2284)
      • service.exe (PID: 4608)
      • service.exe (PID: 3304)
      • service.exe (PID: 1188)
      • service.exe (PID: 5680)
      • service.exe (PID: 2552)
      • service.exe (PID: 5328)
      • service.exe (PID: 5384)
      • service.exe (PID: 7156)
      • service.exe (PID: 4488)
      • service.exe (PID: 1324)
      • service.exe (PID: 6036)
      • service.exe (PID: 1012)
      • service.exe (PID: 1072)
      • service.exe (PID: 5868)
      • service.exe (PID: 5392)
      • service.exe (PID: 780)
      • service.exe (PID: 2644)
      • service.exe (PID: 2320)
      • service.exe (PID: 872)
      • service.exe (PID: 5984)
      • service.exe (PID: 4172)
      • service.exe (PID: 5048)
      • service.exe (PID: 4980)
      • service.exe (PID: 5776)
      • service.exe (PID: 6044)
      • service.exe (PID: 1764)
      • service.exe (PID: 2152)
      • service.exe (PID: 3304)
      • service.exe (PID: 6272)
      • service.exe (PID: 5112)
      • service.exe (PID: 5188)
      • service.exe (PID: 7012)
      • service.exe (PID: 5176)
      • service.exe (PID: 6564)
      • service.exe (PID: 1012)
      • service.exe (PID: 4056)
      • service.exe (PID: 6660)
      • service.exe (PID: 6248)
      • service.exe (PID: 2908)
      • service.exe (PID: 1616)
      • service.exe (PID: 5384)
      • service.exe (PID: 3976)
      • service.exe (PID: 6752)
      • service.exe (PID: 5740)
      • service.exe (PID: 3620)
      • service.exe (PID: 3828)

    • Create files in a temporary directory

      • 1 (1220).exe (PID: 2284)
      • service.exe (PID: 4608)
      • service.exe (PID: 3304)
      • service.exe (PID: 1188)
      • service.exe (PID: 5680)
      • service.exe (PID: 2552)
      • service.exe (PID: 5328)
      • service.exe (PID: 5384)
      • service.exe (PID: 7156)
      • service.exe (PID: 4488)
      • service.exe (PID: 1324)
      • service.exe (PID: 6036)
      • service.exe (PID: 1072)
      • service.exe (PID: 5868)
      • service.exe (PID: 1012)
      • service.exe (PID: 5392)
      • service.exe (PID: 780)
      • service.exe (PID: 2644)
      • service.exe (PID: 872)
      • service.exe (PID: 2320)
      • service.exe (PID: 5984)
      • service.exe (PID: 4172)
      • service.exe (PID: 5048)
      • service.exe (PID: 4980)
      • service.exe (PID: 6044)
      • service.exe (PID: 5776)
      • service.exe (PID: 5112)
      • service.exe (PID: 2152)
      • service.exe (PID: 3304)
      • service.exe (PID: 5188)
      • service.exe (PID: 1012)
      • service.exe (PID: 5176)
      • service.exe (PID: 6660)
      • service.exe (PID: 6248)
      • service.exe (PID: 1616)
      • service.exe (PID: 6752)
      • service.exe (PID: 5740)

    • Reads the software policy settings

      • slui.exe (PID: 3676)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Microsoft Visual Basic 6 (84.4)
.dll | Win32 Dynamic Link Library (generic) (6.7)
.exe | Win32 Executable (generic) (4.6)
.exe | Generic Win/DOS Executable (2)
.exe | DOS Executable Generic (2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2011:07:14 23:24:23+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 53248
InitializedDataSize: 471040
UninitializedDataSize: -
EntryPoint: 0x17fc
OSVersion: 4
ImageVersion: 4.5
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 7.5.0.5255
ProductVersionNumber: 7.5.0.5255
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: ICQ, LLC.
FileDescription: ICQ
FileVersion: 7.5.0.5255
InternalName: ICQ
LegalCopyright: Copyright (c) 1998-2010 ICQ, LLC.
LegalTrademarks: -
OriginalFileName: ICQ.exe
ProductName: ICQ
ProductVersion: 7.5.0.5255
DistId: 30012
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
327
Monitored processes
191
Malicious processes
39
Suspicious processes
48

Behavior graph

Click at the process to see the details
start 1 (1220).exe sppextcomobj.exe no specs slui.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe no specs service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe no specs service.exe cmd.exe no specs conhost.exe no specs reg.exe no specs service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe no specs service.exe cmd.exe no specs conhost.exe no specs reg.exe no specs service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe no specs service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe no specs service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe slui.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe no specs service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe no specs service.exe cmd.exe no specs conhost.exe no specs reg.exe no specs service.exe cmd.exe no specs conhost.exe no specs reg.exe no specs service.exe cmd.exe no specs conhost.exe no specs reg.exe no specs service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe no specs cmd.exe no specs conhost.exe no specs reg.exe

Process information

PID
CMD
Path
Indicators
Parent process
644C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\TempJSOWO.bat" "C:\Windows\SysWOW64\cmd.exe—service.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
660\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
684\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
732\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
732C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\TempSQATI.bat" "C:\Windows\SysWOW64\cmd.exe—service.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
736C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\TempGUTFN.bat" "C:\Windows\SysWOW64\cmd.exe—service.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
780C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\TempERQDL.bat" "C:\Windows\SysWOW64\cmd.exe—service.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
780"C:\Users\admin\AppData\Local\Temp\HKWWAXSQXTIWENE\service.exe" C:\Users\admin\AppData\Local\Temp\HKWWAXSQXTIWENE\service.exe
service.exe
User:
admin
Company:
ICQ, LLC.
Integrity Level:
MEDIUM
Description:
ICQ
Exit code:
0
Version:
7.5.0.5255
Modules
Images
c:\users\admin\appdata\local\temp\hkwwaxsqxtiwene\service.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
780C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\TempPBJAE.bat" "C:\Windows\SysWOW64\cmd.exe—service.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
856\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
17 146
Read events
17 099
Write events
47
Delete events
0

Modification events

(PID) Process:(5608) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:QMLYFOYWGCNGHXQ
Value:
C:\Users\admin\AppData\Local\Temp\PHXGOCCDYDUPCJE\service.exe
(PID) Process:(2340) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:MVTEAYLEYFVORSY
Value:
C:\Users\admin\AppData\Local\Temp\ENXFBPUFGEMEJYA\service.exe
(PID) Process:(2096) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:TXUIUFEIVXJPWWH
Value:
C:\Users\admin\AppData\Local\Temp\WCVFRQSNLSODRYH\service.exe
(PID) Process:(4896) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:PQLJMBPWFRWGSEC
Value:
C:\Users\admin\AppData\Local\Temp\HRIFTXJKHQCINAD\service.exe
(PID) Process:(1096) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:AXLXIHLYCMSKBBD
Value:
C:\Users\admin\AppData\Local\Temp\TSCOOPKIPLAOVFQ\service.exe
(PID) Process:(6712) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:QEIDBSXQGGIDBKY
Value:
C:\Users\admin\AppData\Local\Temp\JETYRHRLJMYCHVU\service.exe
(PID) Process:(1128) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:HRNIYRDSCRSPYKQ
Value:
C:\Users\admin\AppData\Local\Temp\KGVTJTNLODJWWIQ\service.exe
(PID) Process:(3240) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:XCVUQREJQRCVVKT
Value:
C:\Users\admin\AppData\Local\Temp\FOFXOLGAAPQNWIO\service.exe
(PID) Process:(3332) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:GEPNLPDHCARWPFF
Value:
C:\Users\admin\AppData\Local\Temp\XEXHTSTPNUPFSAJ\service.exe
(PID) Process:(2096) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:JLDKKTPXODMYVUY
Value:
C:\Users\admin\AppData\Local\Temp\HQIESXJKHPBIMAD\service.exe
Executable files
92
Suspicious files
0
Text files
94
Unknown types
0

Dropped files

PID
Process
Filename
Type
22841 (1220).exeC:\Users\admin\AppData\Local\Temp\PHXGOCCDYDUPCJE\service.txtexecutable
MD5:A223782A1366232BBF3798461BEA1660
SHA256:54BB0FEB36D025865235339AA41AE1AB7FC3B9260F2A12E31D5618D603449E0E
4608service.exeC:\Users\admin\AppData\Local\TempEFCLD.battext
MD5:762ACE042AF6114D3ECCBA91EC5D43EF
SHA256:A5923A7F7030AD8DA1606E803CA2F294B4DE5EDDB5E5740A1DA00EE04049FAD2
22841 (1220).exeC:\Users\admin\AppData\Local\Temp\PHXGOCCDYDUPCJE\service.exeexecutable
MD5:1B8B04C7967E8D798E9C1408E5FEA81A
SHA256:C1867A53334D522F0B8AD1CA3EFEC61ED8271518C681E4F77E41E008764BC2D9
22841 (1220).exeC:\Users\admin\AppData\Local\TempUVHIF.txttext
MD5:867274F2B0DA0F6035A336BBD48AC266
SHA256:574DA0AB7BAFA4258CAF7E827B8A065938F4F7FE7CBDC3F5FB811923B9D6DC24
1188service.exeC:\Users\admin\AppData\Local\TempGYYUU.txttext
MD5:D1571434A2128FBAD7B8E0E66AF792E9
SHA256:8BC83E5F4BC9EEAD63F3D0FB9846B1C5B384B351938C0FB74BA7CD3F929DB15A
1188service.exeC:\Users\admin\AppData\Local\Temp\HRIFTXJKHQCINAD\service.exeexecutable
MD5:3E2C333367CC41DA8695FE2D684AFEFF
SHA256:D3CEBB77CE9380C9C12D6CCEA454F32A1558EB9172BE077FB03111DF91960BEB
1188service.exeC:\Users\admin\AppData\Local\TempGYYUU.battext
MD5:D1571434A2128FBAD7B8E0E66AF792E9
SHA256:8BC83E5F4BC9EEAD63F3D0FB9846B1C5B384B351938C0FB74BA7CD3F929DB15A
1188service.exeC:\Users\admin\AppData\Local\Temp\HRIFTXJKHQCINAD\service.txtexecutable
MD5:8260306E67F33755B982762F4DA72AE2
SHA256:9C973C727283FA5CF5BB5821E5D3D29FE70BF8DCCADA091600FACAA60FCF5575
5680service.exeC:\Users\admin\AppData\Local\TempESAON.battext
MD5:991EB502FBA341A12676DC40E54A19DE
SHA256:F88F4F8E5BA15E620D2993A1DC86FBC613A7E9FC8800159548AE7E8D9006E818
5680service.exeC:\Users\admin\AppData\Local\TempESAON.txttext
MD5:991EB502FBA341A12676DC40E54A19DE
SHA256:F88F4F8E5BA15E620D2993A1DC86FBC613A7E9FC8800159548AE7E8D9006E818
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
24
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
88.221.110.122:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4920
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4920
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1628
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
88.221.110.122:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
20.190.159.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1628
backgroundTaskHost.exe
20.31.169.57:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.78
whitelisted
crl.microsoft.com
  • 88.221.110.122
  • 88.221.110.114
whitelisted
login.live.com
  • 20.190.159.64
  • 40.126.31.0
  • 20.190.159.71
  • 40.126.31.128
  • 40.126.31.1
  • 40.126.31.129
  • 40.126.31.67
  • 20.190.159.130
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
arc.msn.com
  • 20.31.169.57
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
www.microsoft.com
  • 23.219.150.101
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
1 (1220)