File name:

5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d

Full analysis: https://app.any.run/tasks/5e51e662-cfa7-4780-ab4f-a2b93f3b7dd8
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: October 05, 2022, 02:13:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
ransomware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

BE60E389A0108B2871DFF12DFBB542AC

SHA1:

14B4E0BFAC64EC0F837F84AB1780CA7CED8D670D

SHA256:

5D40615701C48A122E44F831E7C8643D07765629A83B15D090587F469C77693D

SSDEEP:

1536:QguHLgeS6umiCp31W4qYXgsLlOqrgB9GpF7LXdarTkCAKL5dsluhtvM4CoLT6QPg:D6seqCp31Hgsp9a9GTrda8CAKLTsWkyI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE for service management

      • 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe (PID: 3068)

    • Deletes shadow copies

      • 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe (PID: 3068)

    • Writes to a start menu file

      • 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe (PID: 3068)

  • SUSPICIOUS

    • Checks supported languages

      • 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe (PID: 3068)
      • cmd.exe (PID: 2200)
      • cmd.exe (PID: 2304)
      • cmd.exe (PID: 2212)

    • Reads the computer name

      • 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe (PID: 3068)

    • Starts SC.EXE for service management

      • 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe (PID: 3068)

    • Uses TASKKILL.EXE to kill process

      • 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe (PID: 3068)

    • Reads Environment values

      • 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe (PID: 3068)

    • Changes tracing settings of the file or console

      • 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe (PID: 3068)

    • Creates files in the user directory

      • 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe (PID: 3068)

    • Creates files like Ransomware instruction

      • 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe (PID: 3068)

    • Creates files in the program directory

      • 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe (PID: 3068)

    • Starts CMD.EXE for self-deleting

      • 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe (PID: 3068)

    • Starts CMD.EXE for commands execution

      • 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe (PID: 3068)

    • Starts CHOICE.EXE (used to create a delay)

      • cmd.exe (PID: 2212)

  • INFO

    • Checks supported languages

      • net1.exe (PID: 1396)
      • net.exe (PID: 116)
      • net.exe (PID: 3144)
      • net.exe (PID: 2044)
      • net.exe (PID: 1964)
      • net.exe (PID: 2784)
      • net1.exe (PID: 3100)
      • net1.exe (PID: 2452)
      • net.exe (PID: 3676)
      • net1.exe (PID: 2504)
      • net.exe (PID: 3688)
      • net1.exe (PID: 3040)
      • net.exe (PID: 2312)
      • net1.exe (PID: 2528)
      • net1.exe (PID: 3188)
      • net.exe (PID: 320)
      • net.exe (PID: 664)
      • net1.exe (PID: 2480)
      • net.exe (PID: 1744)
      • net1.exe (PID: 3228)
      • net1.exe (PID: 3140)
      • net1.exe (PID: 476)
      • net1.exe (PID: 3060)
      • net.exe (PID: 4028)
      • net.exe (PID: 3720)
      • net1.exe (PID: 3524)
      • net.exe (PID: 3556)
      • net.exe (PID: 1876)
      • net1.exe (PID: 4060)
      • net.exe (PID: 3760)
      • net1.exe (PID: 2656)
      • net1.exe (PID: 3784)
      • net1.exe (PID: 2472)
      • net.exe (PID: 1840)
      • net1.exe (PID: 1956)
      • net.exe (PID: 2792)
      • net.exe (PID: 3724)
      • net.exe (PID: 3664)
      • net.exe (PID: 2480)
      • net.exe (PID: 1056)
      • net1.exe (PID: 3032)
      • net1.exe (PID: 2684)
      • net.exe (PID: 1924)
      • net.exe (PID: 1232)
      • sc.exe (PID: 3676)
      • net.exe (PID: 2192)
      • net1.exe (PID: 956)
      • net1.exe (PID: 2896)
      • sc.exe (PID: 2520)
      • net.exe (PID: 3888)
      • net.exe (PID: 3088)
      • net.exe (PID: 2504)
      • sc.exe (PID: 2812)
      • net.exe (PID: 2176)
      • taskkill.exe (PID: 4032)
      • net.exe (PID: 916)
      • taskkill.exe (PID: 476)
      • taskkill.exe (PID: 4056)
      • net1.exe (PID: 2920)
      • sc.exe (PID: 3920)
      • net.exe (PID: 1068)
      • net1.exe (PID: 3216)
      • net.exe (PID: 3488)
      • net1.exe (PID: 2036)
      • net.exe (PID: 1716)
      • net.exe (PID: 2084)
      • vssadmin.exe (PID: 2200)
      • vssadmin.exe (PID: 1636)
      • net1.exe (PID: 1568)
      • net1.exe (PID: 1696)
      • net.exe (PID: 2244)
      • net1.exe (PID: 2452)
      • net1.exe (PID: 2964)
      • net1.exe (PID: 2168)
      • net.exe (PID: 2884)
      • net1.exe (PID: 3236)
      • vssadmin.exe (PID: 2624)
      • vssadmin.exe (PID: 1592)
      • vssadmin.exe (PID: 1384)
      • vssadmin.exe (PID: 3880)
      • vssadmin.exe (PID: 1744)
      • net1.exe (PID: 3984)
      • vssadmin.exe (PID: 3600)
      • vssadmin.exe (PID: 3748)
      • vssadmin.exe (PID: 2392)
      • net1.exe (PID: 2940)
      • vssadmin.exe (PID: 3608)
      • net1.exe (PID: 2656)
      • vssadmin.exe (PID: 2348)
      • net1.exe (PID: 2832)
      • net1.exe (PID: 3208)
      • notepad.exe (PID: 1440)
      • vssadmin.exe (PID: 2196)
      • vssadmin.exe (PID: 2936)
      • choice.exe (PID: 3508)
      • fsutil.exe (PID: 3056)
      • PING.EXE (PID: 3524)

    • Reads the computer name

      • net1.exe (PID: 3100)
      • net1.exe (PID: 1396)
      • net1.exe (PID: 2452)
      • net1.exe (PID: 3188)
      • net1.exe (PID: 3060)
      • net1.exe (PID: 3140)
      • net1.exe (PID: 3228)
      • net1.exe (PID: 476)
      • net1.exe (PID: 3040)
      • net1.exe (PID: 3216)
      • net1.exe (PID: 3524)
      • net1.exe (PID: 4060)
      • net1.exe (PID: 1956)
      • net1.exe (PID: 2656)
      • net1.exe (PID: 2472)
      • sc.exe (PID: 3676)
      • net1.exe (PID: 2684)
      • net1.exe (PID: 2896)
      • sc.exe (PID: 2520)
      • net1.exe (PID: 956)
      • net1.exe (PID: 3032)
      • sc.exe (PID: 2812)
      • net1.exe (PID: 2920)
      • sc.exe (PID: 3920)
      • taskkill.exe (PID: 476)
      • taskkill.exe (PID: 4056)
      • taskkill.exe (PID: 4032)
      • net1.exe (PID: 2480)
      • net1.exe (PID: 3784)
      • net1.exe (PID: 2036)
      • net1.exe (PID: 1568)
      • net1.exe (PID: 1696)
      • vssadmin.exe (PID: 2200)
      • vssadmin.exe (PID: 1636)
      • net1.exe (PID: 2452)
      • net1.exe (PID: 2964)
      • net1.exe (PID: 2168)
      • vssadmin.exe (PID: 1744)
      • vssadmin.exe (PID: 3880)
      • vssadmin.exe (PID: 1384)
      • vssadmin.exe (PID: 3600)
      • vssadmin.exe (PID: 1592)
      • vssadmin.exe (PID: 2624)
      • vssadmin.exe (PID: 2392)
      • vssadmin.exe (PID: 3748)
      • net1.exe (PID: 2940)
      • vssadmin.exe (PID: 2348)
      • net1.exe (PID: 2832)
      • vssadmin.exe (PID: 3608)
      • net1.exe (PID: 3236)
      • net1.exe (PID: 3984)
      • net1.exe (PID: 2656)
      • net1.exe (PID: 3208)
      • vssadmin.exe (PID: 2196)
      • vssadmin.exe (PID: 2936)
      • PING.EXE (PID: 3524)

    • Reads settings of System Certificates

      • 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe (PID: 3068)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 2020-Jul-08 21:24:12
FileDescription: Codemeter
FileVersion: 4.5.0.0
InternalName: aZnLma0ZpqTthmr
LegalCopyright: Copyright 2019 3fTddThVDVTaMx4
OriginalFilename: gCLianUocZKoeIY
ProductVersion: 4.5.0.0
Assembly Version: 4.5.0.0
ProductName: ntWB6ohspNIoCar
CompanyName: YOkBRITTKNBYLVa qNEQn0mbG2wNoNm
LegalTrademarks: PWWPh5jww0vweJe 4pFhUfFs2GJ1B5U

DOS Header

e_magic: MZ
e_cblp: 144
e_cp: 3
e_crlc: -
e_cparhdr: 4
e_minalloc: -
e_maxalloc: 65535
e_ss: -
e_sp: 184
e_csum: -
e_ip: -
e_cs: -
e_ovno: -
e_oemid: -
e_oeminfo: -
e_lfanew: 128

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
NumberofSections: 3
TimeDateStamp: 2020-Jul-08 21:24:12
PointerToSymbolTable: -
NumberOfSymbols: -
SizeOfOptionalHeader: 224
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
8192
89732
90112
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
5.50999
.rsrc
98304
1588
2048
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.71351
.reloc
106496
12
512
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
0.10191

Resources

Title
Entropy
Size
Codepage
Language
Type
1
3.54846
936
Latin 1 / Western European
UNKNOWN
RT_VERSION
1 (#2)
5.00112
490
Latin 1 / Western European
UNKNOWN
RT_MANIFEST

Imports

mscoree.dll
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
195
Monitored processes
101
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net1.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net1.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs net.exe no specs sc.exe no specs taskkill.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs taskkill.exe no specs taskkill.exe no specs net1.exe no specs net1.exe no specs vssadmin.exe no specs net1.exe no specs vssadmin.exe no specs vssadmin.exe no specs vssadmin.exe no specs vssadmin.exe no specs vssadmin.exe no specs vssadmin.exe no specs vssadmin.exe no specs vssadmin.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs vssadmin.exe no specs net1.exe no specs vssadmin.exe no specs vssadmin.exe no specs vssadmin.exe no specs vssadmin.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs cmd.exe no specs notepad.exe no specs cmd.exe no specs cmd.exe no specs ping.exe no specs choice.exe no specs fsutil.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"net.exe" stop BMR Boot Service /yC:\Windows\system32\net.exe—5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\mpr.dll
c:\windows\system32\browcli.dll
c:\windows\system32\netutils.dll
c:\windows\system32\samcli.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\wkscli.dll
320"net.exe" stop zhudongfangyu /yC:\Windows\system32\net.exe—5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
c:\windows\system32\samcli.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\srvcli.dll
476C:\Windows\system32\net1 stop QBFCService /yC:\Windows\system32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dsrole.dll
c:\windows\system32\netutils.dll
476"taskkill.exe" /IM mspub.exe /FC:\Windows\system32\taskkill.exe—5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
664"net.exe" stop ccEvtMgr /yC:\Windows\system32\net.exe—5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
916"net.exe" stop BackupExecAgentBrowser /yC:\Windows\system32\net.exe—5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\samcli.dll
c:\windows\system32\srvcli.dll
956C:\Windows\system32\net1 stop VeeamNFSSvc /yC:\Windows\system32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\netutils.dll
c:\windows\system32\logoncli.dll
c:\windows\system32\browcli.dll
c:\windows\system32\samcli.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\advapi32.dll
1056"net.exe" stop BackupExecDiveciMediaService /yC:\Windows\system32\net.exe—5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\samcli.dll
1068"net.exe" stop sophos /yC:\Windows\system32\net.exe—5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\browcli.dll
c:\windows\system32\netutils.dll
c:\windows\system32\samcli.dll
c:\windows\system32\srvcli.dll
1232"net.exe" stop VeeamNFSSvc /yC:\Windows\system32\net.exe—5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
Total events
4 642
Read events
4 608
Write events
34
Delete events
0

Modification events

(PID) Process:(3068) 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3068) 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3068) 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3068) 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(3068) 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3068) 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3068) 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3068) 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3068) 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3068) 5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
Executable files
0
Suspicious files
33
Text files
12
Unknown types
2

Dropped files

PID
Process
Filename
Type
30685d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeC:\Users\Public\Music\Sample Music\Kalimba.mp3.locked —
MD5:—
SHA256:—
30685d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeC:\Users\Public\Music\Sample Music\Sleep Away.mp3.locked —
MD5:—
SHA256:—
30685d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeC:\Users\admin\Downloads\gamesmessages.jpg.lockedbinary
MD5:—
SHA256:—
30685d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeC:\Users\admin\Pictures\joinsetting.png.lockedbinary
MD5:—
SHA256:—
30685d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeC:\ProgramData\Mozilla\updates\308046B0AF4A39CB\updates\backup-update.log.lockedvc
MD5:—
SHA256:—
30685d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeC:\Users\admin\Pictures\riskactions.jpg.lockedbinary
MD5:—
SHA256:—
30685d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeC:\ProgramData\Mozilla\updates\308046B0AF4A39CB\updates\last-update.log.lockedbinary
MD5:—
SHA256:—
30685d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeC:\Users\Public\Pictures\Sample Pictures\Desert.jpg.lockedbinary
MD5:4C90B57E0FBC29A08DBD2BA0C02EEF4D
SHA256:0BEB122323B878F057F8149DB2AA32A84462610C5C7D8EA1DED7B0219A4DC63D
30685d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeC:\Users\admin\Pictures\shipgrand.png.lockedbinary
MD5:—
SHA256:—
30685d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exeC:\Users\Public\Pictures\Sample Pictures\Tulips.jpg.lockedbinary
MD5:B6113A5204A25870C702FFA37462C7B7
SHA256:BDB54E45A6009EB27D0EFE4A839DB06E1F91F5F1175DD4E65C26D293BA721DA5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3068
5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d.exe
142.250.185.100:443
www.google.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
www.google.com
  • 142.250.185.100
malicious

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d