File name:

59ed7a26c56a644bf3f5ba45459965be8a6e6b79dcf4f90a5c51f2bb12190bf9.exe

Full analysis: https://app.any.run/tasks/f16e00ba-993a-4ce1-9b9a-2bfcb7b86354
Verdict: Malicious activity
Analysis date: June 15, 2025, 23:26:04
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
sfx
dropper
lunam
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, RAR self-extracting archive, 5 sections
MD5:

D06F3948AEC51684A26A75DBE9DCD581

SHA1:

AF72AF7676E74CC4C4B8E67C43F005C850E60267

SHA256:

59ED7A26C56A644BF3F5BA45459965BE8A6E6B79DCF4F90A5C51F2BB12190BF9

SSDEEP:

24576:eKhaZllT6XL9T/2lzhk2xv3lrP9bw/JRyYJ:eKha1T6XL9T/2lzhk2xv3xPRw/JRyYJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • SFX dropper has been detected

      • 59ed7a26c56a644bf3f5ba45459965be8a6e6b79dcf4f90a5c51f2bb12190bf9.exe (PID: 2044)

    • LUNAM has been detected

      • reg.exe (PID: 4312)

    • Changes the autorun value in the registry

      • reg.exe (PID: 1028)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 59ed7a26c56a644bf3f5ba45459965be8a6e6b79dcf4f90a5c51f2bb12190bf9.exe (PID: 2044)
      • 59ed7a26c56a644bf3f5ba45459965be8a6e6b79dcf4f90a5c51f2bb12190bf9.exe (PID: 6128)

    • Application launched itself

      • 59ed7a26c56a644bf3f5ba45459965be8a6e6b79dcf4f90a5c51f2bb12190bf9.exe (PID: 2044)

    • Executable content was dropped or overwritten

      • 59ed7a26c56a644bf3f5ba45459965be8a6e6b79dcf4f90a5c51f2bb12190bf9.exe (PID: 6128)
      • dcomcnfgui.exe (PID: 236)

    • Hides command output

      • PING.EXE (PID: 4104)
      • PING.EXE (PID: 4084)
      • PING.EXE (PID: 3048)
      • PING.EXE (PID: 5528)
      • PING.EXE (PID: 5628)
      • PING.EXE (PID: 2192)
      • PING.EXE (PID: 2760)
      • PING.EXE (PID: 3488)
      • PING.EXE (PID: 4688)
      • PING.EXE (PID: 3652)

    • There is functionality for taking screenshot (YARA)

      • 59ed7a26c56a644bf3f5ba45459965be8a6e6b79dcf4f90a5c51f2bb12190bf9.exe (PID: 2044)

    • Executes as Windows Service

      • ucsvcsh.exe (PID: 2972)
      • dcomcnfgui.exe (PID: 236)

    • The process creates files with name similar to system file names

      • dcomcnfgui.exe (PID: 236)

    • Uses REG/REGEDIT.EXE to modify registry

      • dcomcnfgui.exe (PID: 236)

    • Creates file in the systems drive root

      • aescrypter.exe (PID: 4172)
      • dcomcnfgui.exe (PID: 236)

  • INFO

    • Reads the computer name

      • 59ed7a26c56a644bf3f5ba45459965be8a6e6b79dcf4f90a5c51f2bb12190bf9.exe (PID: 2044)
      • 59ed7a26c56a644bf3f5ba45459965be8a6e6b79dcf4f90a5c51f2bb12190bf9.exe (PID: 6128)
      • ucsvcsh.exe (PID: 6516)
      • ucsvcsh.exe (PID: 2876)
      • ucsvcsh.exe (PID: 2972)
      • dcomcnfgui.exe (PID: 5692)
      • dcomcnfgui.exe (PID: 236)
      • dcomcnfgui.exe (PID: 4036)

    • Checks supported languages

      • 59ed7a26c56a644bf3f5ba45459965be8a6e6b79dcf4f90a5c51f2bb12190bf9.exe (PID: 2044)
      • dcomcnfgui.exe (PID: 5692)
      • ucsvcsh.exe (PID: 6516)
      • 59ed7a26c56a644bf3f5ba45459965be8a6e6b79dcf4f90a5c51f2bb12190bf9.exe (PID: 6128)
      • ucsvcsh.exe (PID: 2876)
      • dcomcnfgui.exe (PID: 4036)
      • dcomcnfgui.exe (PID: 236)
      • aescrypter.exe (PID: 4476)
      • aescrypter.exe (PID: 4808)
      • ucsvcsh.exe (PID: 2972)
      • aescrypter.exe (PID: 2532)
      • aescrypter.exe (PID: 4804)
      • aescrypter.exe (PID: 5928)
      • aescrypter.exe (PID: 4172)
      • aescrypter.exe (PID: 4648)
      • aescrypter.exe (PID: 4380)
      • aescrypter.exe (PID: 4884)
      • aescrypter.exe (PID: 3820)
      • aescrypter.exe (PID: 4808)
      • aescrypter.exe (PID: 4708)
      • aescrypter.exe (PID: 4036)
      • aescrypter.exe (PID: 2804)
      • aescrypter.exe (PID: 1352)
      • aescrypter.exe (PID: 4576)
      • aescrypter.exe (PID: 4864)
      • aescrypter.exe (PID: 5904)
      • aescrypter.exe (PID: 6876)
      • aescrypter.exe (PID: 3676)
      • aescrypter.exe (PID: 320)
      • aescrypter.exe (PID: 2348)
      • aescrypter.exe (PID: 4752)
      • aescrypter.exe (PID: 3460)
      • aescrypter.exe (PID: 6160)
      • aescrypter.exe (PID: 3608)
      • aescrypter.exe (PID: 4232)
      • aescrypter.exe (PID: 4868)
      • aescrypter.exe (PID: 5020)
      • aescrypter.exe (PID: 3556)
      • aescrypter.exe (PID: 3160)
      • aescrypter.exe (PID: 6956)
      • aescrypter.exe (PID: 4764)
      • aescrypter.exe (PID: 1204)
      • aescrypter.exe (PID: 5468)
      • aescrypter.exe (PID: 2168)
      • aescrypter.exe (PID: 6748)
      • aescrypter.exe (PID: 3948)
      • aescrypter.exe (PID: 1216)
      • aescrypter.exe (PID: 2076)
      • aescrypter.exe (PID: 3644)
      • aescrypter.exe (PID: 6420)
      • aescrypter.exe (PID: 1896)
      • aescrypter.exe (PID: 5124)
      • aescrypter.exe (PID: 3652)
      • aescrypter.exe (PID: 3960)
      • aescrypter.exe (PID: 4768)
      • aescrypter.exe (PID: 2632)
      • aescrypter.exe (PID: 856)
      • aescrypter.exe (PID: 1352)
      • aescrypter.exe (PID: 480)
      • aescrypter.exe (PID: 3780)
      • aescrypter.exe (PID: 5560)
      • aescrypter.exe (PID: 4476)
      • aescrypter.exe (PID: 2804)
      • aescrypter.exe (PID: 4808)
      • aescrypter.exe (PID: 4544)
      • aescrypter.exe (PID: 3580)
      • aescrypter.exe (PID: 4648)
      • aescrypter.exe (PID: 4380)
      • aescrypter.exe (PID: 4884)
      • aescrypter.exe (PID: 5780)
      • aescrypter.exe (PID: 4528)
      • aescrypter.exe (PID: 2628)
      • aescrypter.exe (PID: 4232)
      • aescrypter.exe (PID: 4752)
      • aescrypter.exe (PID: 4868)
      • aescrypter.exe (PID: 6360)
      • aescrypter.exe (PID: 4764)
      • aescrypter.exe (PID: 6956)
      • aescrypter.exe (PID: 3676)
      • aescrypter.exe (PID: 3756)
      • aescrypter.exe (PID: 1204)
      • aescrypter.exe (PID: 7076)
      • aescrypter.exe (PID: 6940)
      • aescrypter.exe (PID: 5368)
      • aescrypter.exe (PID: 4844)
      • aescrypter.exe (PID: 6420)
      • aescrypter.exe (PID: 2168)
      • aescrypter.exe (PID: 6748)
      • aescrypter.exe (PID: 3160)
      • aescrypter.exe (PID: 3852)
      • aescrypter.exe (PID: 3780)
      • aescrypter.exe (PID: 480)
      • aescrypter.exe (PID: 4012)
      • aescrypter.exe (PID: 4312)
      • aescrypter.exe (PID: 3948)
      • aescrypter.exe (PID: 6868)
      • aescrypter.exe (PID: 7008)
      • aescrypter.exe (PID: 4760)
      • aescrypter.exe (PID: 4680)
      • aescrypter.exe (PID: 316)
      • aescrypter.exe (PID: 6340)
      • aescrypter.exe (PID: 3608)
      • aescrypter.exe (PID: 1148)
      • aescrypter.exe (PID: 3732)
      • aescrypter.exe (PID: 5928)

    • Process checks computer location settings

      • 59ed7a26c56a644bf3f5ba45459965be8a6e6b79dcf4f90a5c51f2bb12190bf9.exe (PID: 2044)
      • 59ed7a26c56a644bf3f5ba45459965be8a6e6b79dcf4f90a5c51f2bb12190bf9.exe (PID: 6128)

    • The sample compiled with english language support

      • 59ed7a26c56a644bf3f5ba45459965be8a6e6b79dcf4f90a5c51f2bb12190bf9.exe (PID: 6128)
      • dcomcnfgui.exe (PID: 236)

    • Creates files in the program directory

      • dcomcnfgui.exe (PID: 236)
      • ucsvcsh.exe (PID: 2972)
      • aescrypter.exe (PID: 2532)
      • aescrypter.exe (PID: 4804)
      • aescrypter.exe (PID: 3460)
      • aescrypter.exe (PID: 3820)
      • aescrypter.exe (PID: 3608)
      • aescrypter.exe (PID: 4036)
      • aescrypter.exe (PID: 4576)
      • aescrypter.exe (PID: 4808)
      • aescrypter.exe (PID: 6876)
      • aescrypter.exe (PID: 5904)
      • aescrypter.exe (PID: 2804)
      • aescrypter.exe (PID: 4864)
      • aescrypter.exe (PID: 4708)
      • aescrypter.exe (PID: 1352)
      • aescrypter.exe (PID: 6160)
      • aescrypter.exe (PID: 4648)
      • aescrypter.exe (PID: 4380)
      • aescrypter.exe (PID: 4884)
      • aescrypter.exe (PID: 3676)
      • aescrypter.exe (PID: 4232)
      • aescrypter.exe (PID: 320)
      • aescrypter.exe (PID: 2348)
      • aescrypter.exe (PID: 4752)
      • aescrypter.exe (PID: 4868)
      • aescrypter.exe (PID: 5020)
      • aescrypter.exe (PID: 4764)
      • aescrypter.exe (PID: 6956)
      • aescrypter.exe (PID: 3556)
      • aescrypter.exe (PID: 3160)
      • aescrypter.exe (PID: 1204)
      • aescrypter.exe (PID: 5468)
      • aescrypter.exe (PID: 2168)
      • aescrypter.exe (PID: 6420)
      • aescrypter.exe (PID: 6748)
      • aescrypter.exe (PID: 1216)
      • aescrypter.exe (PID: 3948)
      • aescrypter.exe (PID: 2076)
      • aescrypter.exe (PID: 3644)
      • aescrypter.exe (PID: 1896)
      • aescrypter.exe (PID: 3652)
      • aescrypter.exe (PID: 856)
      • aescrypter.exe (PID: 5560)
      • aescrypter.exe (PID: 2632)
      • aescrypter.exe (PID: 3960)
      • aescrypter.exe (PID: 4768)
      • aescrypter.exe (PID: 1352)
      • aescrypter.exe (PID: 3780)
      • aescrypter.exe (PID: 480)
      • aescrypter.exe (PID: 5124)
      • aescrypter.exe (PID: 4476)
      • aescrypter.exe (PID: 2804)
      • aescrypter.exe (PID: 3580)
      • aescrypter.exe (PID: 4808)
      • aescrypter.exe (PID: 4544)
      • aescrypter.exe (PID: 5780)
      • aescrypter.exe (PID: 4648)
      • aescrypter.exe (PID: 4380)
      • aescrypter.exe (PID: 2628)
      • aescrypter.exe (PID: 4232)
      • aescrypter.exe (PID: 4528)
      • aescrypter.exe (PID: 4752)
      • aescrypter.exe (PID: 4868)
      • aescrypter.exe (PID: 6360)
      • aescrypter.exe (PID: 4764)
      • aescrypter.exe (PID: 4884)
      • aescrypter.exe (PID: 3676)
      • aescrypter.exe (PID: 7076)
      • aescrypter.exe (PID: 1204)
      • aescrypter.exe (PID: 5368)
      • aescrypter.exe (PID: 4844)
      • aescrypter.exe (PID: 6420)
      • aescrypter.exe (PID: 6940)
      • aescrypter.exe (PID: 2168)
      • aescrypter.exe (PID: 6956)
      • aescrypter.exe (PID: 3160)
      • aescrypter.exe (PID: 3756)
      • aescrypter.exe (PID: 6748)
      • aescrypter.exe (PID: 3948)
      • aescrypter.exe (PID: 3852)
      • aescrypter.exe (PID: 3780)
      • aescrypter.exe (PID: 4012)
      • aescrypter.exe (PID: 6868)
      • aescrypter.exe (PID: 480)
      • aescrypter.exe (PID: 3608)
      • aescrypter.exe (PID: 1148)
      • aescrypter.exe (PID: 3732)
      • aescrypter.exe (PID: 4760)
      • aescrypter.exe (PID: 5928)
      • aescrypter.exe (PID: 7008)
      • aescrypter.exe (PID: 4680)
      • aescrypter.exe (PID: 4312)
      • aescrypter.exe (PID: 6340)

    • Launching a file from a Registry key

      • reg.exe (PID: 1028)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:02:17 14:55:21+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 73216
InitializedDataSize: 113152
UninitializedDataSize: -
EntryPoint: 0xb583
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
377
Monitored processes
242
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #DROPPER 59ed7a26c56a644bf3f5ba45459965be8a6e6b79dcf4f90a5c51f2bb12190bf9.exe no specs 59ed7a26c56a644bf3f5ba45459965be8a6e6b79dcf4f90a5c51f2bb12190bf9.exe dcomcnfgui.exe no specs ucsvcsh.exe no specs ping.exe no specs conhost.exe no specs ping.exe no specs conhost.exe no specs ping.exe no specs conhost.exe no specs ping.exe no specs conhost.exe no specs ping.exe no specs conhost.exe no specs ping.exe no specs conhost.exe no specs ping.exe no specs conhost.exe no specs ping.exe no specs conhost.exe no specs ping.exe no specs conhost.exe no specs ping.exe no specs conhost.exe no specs dcomcnfgui.exe no specs ucsvcsh.exe no specs ucsvcsh.exe no specs dcomcnfgui.exe reg.exe #LUNAM reg.exe no specs conhost.exe no specs conhost.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs slui.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs aescrypter.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188"\ProgramData\local\aescrypter.exe" a "C:\Program Files\FileZilla FTP Client\resources\classic\16x16\download.png.aes" "C:\Program Files\FileZilla FTP Client\resources\classic\16x16\download.png" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -yC:\ProgramData\local\aescrypter.exe—dcomcnfgui.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\programdata\local\aescrypter.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
236C:\WINDOWS\SysWOW64\dcomcnfgui.exeC:\Windows\SysWOW64\dcomcnfgui.exe
services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Modules
Images
c:\windows\syswow64\dcomcnfgui.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
316"\ProgramData\local\aescrypter.exe" a "C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\file.png.aes" "C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\file.png" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -yC:\ProgramData\local\aescrypter.exe—dcomcnfgui.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\programdata\local\aescrypter.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
320"\ProgramData\local\aescrypter.exe" a "C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\bookmarks.png.aes" "C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\bookmarks.png" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -yC:\ProgramData\local\aescrypter.exe—dcomcnfgui.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\programdata\local\aescrypter.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
472"\ProgramData\local\aescrypter.exe" a "C:\Program Files\FileZilla FTP Client\resources\classic\16x16\upload.png.aes" "C:\Program Files\FileZilla FTP Client\resources\classic\16x16\upload.png" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -yC:\ProgramData\local\aescrypter.exe—dcomcnfgui.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\programdata\local\aescrypter.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
480"\ProgramData\local\aescrypter.exe" a "C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\remotetreeview.png.aes" "C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\remotetreeview.png" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -yC:\ProgramData\local\aescrypter.exe—dcomcnfgui.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\programdata\local\aescrypter.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
480"\ProgramData\local\aescrypter.exe" a "C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\uploadadd.png.aes" "C:\Program Files\FileZilla FTP Client\resources\blukis\32x32\uploadadd.png" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -yC:\ProgramData\local\aescrypter.exe—dcomcnfgui.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\programdata\local\aescrypter.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
536"\ProgramData\local\aescrypter.exe" a "C:\Program Files\FileZilla FTP Client\resources\classic\16x16\downloadadd.png.aes" "C:\Program Files\FileZilla FTP Client\resources\classic\16x16\downloadadd.png" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -yC:\ProgramData\local\aescrypter.exe—dcomcnfgui.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\programdata\local\aescrypter.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
856"\ProgramData\local\aescrypter.exe" a "C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\uploadadd.png.aes" "C:\Program Files\FileZilla FTP Client\resources\blukis\16x16\uploadadd.png" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -yC:\ProgramData\local\aescrypter.exe—dcomcnfgui.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\programdata\local\aescrypter.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
868"\ProgramData\local\aescrypter.exe" a "C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\help.png.aes" "C:\Program Files\FileZilla FTP Client\resources\blukis\48x48\help.png" -ep2 -hp1a2vn57b348741t92451sst0a391ba72 -m0 -yC:\ProgramData\local\aescrypter.exe—dcomcnfgui.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\programdata\local\aescrypter.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
Total events
12 240
Read events
12 222
Write events
2
Delete events
16

Modification events

(PID) Process:(2044) 59ed7a26c56a644bf3f5ba45459965be8a6e6b79dcf4f90a5c51f2bb12190bf9.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR SFX
Operation:writeName:C%%WINDOWS%system32%
Value:
C:\WINDOWS\system32\
(PID) Process:(1028) reg.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:svchost
Value:
C:\ProgramData\local\svchost.exe
(PID) Process:(4312) reg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc
Operation:delete keyName:(default)
Value:
(PID) Process:(4312) reg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys
Operation:delete keyName:(default)
Value:
(PID) Process:(4312) reg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power
Operation:delete keyName:(default)
Value:
(PID) Process:(4312) reg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc
Operation:delete keyName:(default)
Value:
(PID) Process:(4312) reg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys
Operation:delete keyName:(default)
Value:
(PID) Process:(4312) reg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager
Operation:delete keyName:(default)
Value:
(PID) Process:(4312) reg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend
Operation:delete keyName:(default)
Value:
(PID) Process:(4312) reg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Network\CBDHSvc
Operation:delete keyName:(default)
Value:
Executable files
8
Suspicious files
210
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
612859ed7a26c56a644bf3f5ba45459965be8a6e6b79dcf4f90a5c51f2bb12190bf9.exeC:\Windows\SysWOW64\ucsvcsh.exeexecutable
MD5:625BA9CF557DBB1FFAC001E2A0300D32
SHA256:D80ADAFE8C367753DD7E6CB282EF55AF4257B6A9D06AC8AA1300F2CDA9ADE46C
2972ucsvcsh.exeC:\ProgramData\local\vpkswnhisp.dlltext
MD5:F2AE40AE7BCF6E72DC05A8BC4DE8D534
SHA256:180738E1426936FCBE6EE8699066596C05401DD244C8F5C7D6B3FEF41621C438
612859ed7a26c56a644bf3f5ba45459965be8a6e6b79dcf4f90a5c51f2bb12190bf9.exeC:\Windows\SysWOW64\dcomcnfgui.exeexecutable
MD5:17FA49E023CB95CDFE365ABC0D7290D0
SHA256:EC855BEFA1B088809F15CF08266AE576D1885CB8374F69FCB936094341AE7675
236dcomcnfgui.exeC:\Windows\SysWOW64\wcmtstcsys.ssstext
MD5:D5CB8E4FA6F54BC38446FC8912BCEA50
SHA256:CD83C7C6B3FF1250E744EAA3C35EF5B977B3AACCB6CDC9E1FF93AD05A719E354
612859ed7a26c56a644bf3f5ba45459965be8a6e6b79dcf4f90a5c51f2bb12190bf9.exeC:\Windows\SysWOW64\tracerpts.exeexecutable
MD5:53894890DC01BBCACE449F6590A1597B
SHA256:2F3F037B07737101076F50664EA3AF10F76970FEBDCBA4BD0E38D5A0ECA4F6DD
236dcomcnfgui.exeC:\ProgramData\local\svchost.exeexecutable
MD5:6F36E46B83A61A5E251460AD825F425E
SHA256:35E03B690797208E0BEDAA29A6DECF78AC43236E89DD7F98F96962F8DF86037E
236dcomcnfgui.exeC:\decrypt\decrypt.exeexecutable
MD5:9225773AA6641D29AC88CA5EB6BAECCF
SHA256:7AE63718B10429D82D5C510ED03AD855D7B997A32F74BBB3062C7DEA01EA7C0C
236dcomcnfgui.exeC:\ProgramData\local\aescrypter.exeexecutable
MD5:53894890DC01BBCACE449F6590A1597B
SHA256:2F3F037B07737101076F50664EA3AF10F76970FEBDCBA4BD0E38D5A0ECA4F6DD
4804aescrypter.exeC:\Program Files\CCleaner\Data\StateHistory\DUState 24-02-06 12-40-53.dat.aescompressed
MD5:C35DDE6F20F71C5DA2384C9BCA90822E
SHA256:19388281F25EC42C4487F5AE20A34F7FFEC3457989E77869C5EB37FCBE2616AE
236dcomcnfgui.exeC:\how to decrypt aes files.lnkbinary
MD5:7B9AC32B3D33E6459D0E01ADA73A19D2
SHA256:8DBDC345BFE1FB72C2F532DD65DFF147AFB534838EB549AA71FC9864FBCD87F1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
22
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2976
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2976
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
2288
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4864
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
2976
SIHClient.exe
20.109.210.53:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2976
SIHClient.exe
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.78
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 2.23.181.156
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
login.live.com
  • 20.190.159.4
  • 40.126.31.2
  • 20.190.159.75
  • 40.126.31.130
  • 40.126.31.1
  • 20.190.159.131
  • 20.190.159.128
  • 40.126.31.3
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
59ed7a26c56a644bf3f5ba45459965be8a6e6b79dcf4f90a5c51f2bb12190bf9.exe