File name:

AntiPublic_.exe

Full analysis: https://app.any.run/tasks/5ca1e397-db88-48e8-b8c5-e0614bca240a
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: June 21, 2025, 14:46:08
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
clipper
diamotrix
python
auto-reg
loader
arch-doc
yero
worm
pyinstaller
crypto-regex
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 6 sections
MD5:

BE450F415E14569788D93BC0AF8785A3

SHA1:

81D8967701E110AD72427C59E30797836E7C10D1

SHA256:

64D6B1E9814F0AE28468C8A27EFDFA1B9E2071129D1B52FF9FDC27C552EC5608

SSDEEP:

98304:l0BkU6AyTXOkOM860tXNmfZg8k5O5tmScZNd9bGQ7wHRQY0WCF0G8psqoM60Q6zL:lrl6Da1C6m1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • fgsdfgerds.exe (PID: 2604)
      • vbcvgfdgdf.exe (PID: 5496)
      • explorer.exe (PID: 4772)

    • Runs injected code in another process

      • vbcvgfdgdf.exe (PID: 5496)

    • Application was injected by another process

      • firefox.exe (PID: 2320)
      • explorer.exe (PID: 4772)
      • firefox.exe (PID: 4172)

    • YERO has been detected

      • systmdrv.exe (PID: 6664)

    • Loads dropped or rewritten executable

      • tmp9975.exe (PID: 2716)
      • notepad.exe (PID: 3476)
      • tmp9975.exe (PID: 6776)
      • MusNotifyIcon.exe (PID: 4888)
      • conhost.exe (PID: 7000)
      • WaaSMedicAgent.exe (PID: 1720)
      • notepad.exe (PID: 892)
      • tmp1360.exe (PID: 5244)
      • notepad.exe (PID: 2804)
      • tmp1360.exe (PID: 7072)
      • WINWORD.EXE (PID: 3724)
      • WINWORD.EXE (PID: 6304)
      • ai.exe (PID: 1204)
      • WINWORD.EXE (PID: 6868)
      • backgroundTaskHost.exe (PID: 6796)
      • RuntimeBroker.exe (PID: 2404)
      • backgroundTaskHost.exe (PID: 4312)
      • rundll32.exe (PID: 6368)
      • SIHClient.exe (PID: 6768)
      • slui.exe (PID: 1232)
      • svchost.exe (PID: 1564)

    • DIAMOTRIX has been detected (SURICATA)

      • systmdrv.exe (PID: 6664)
      • explorer.exe (PID: 4772)

    • Connects to the CnC server

      • sdgfxcvxc.exe (PID: 2148)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • AntiPublic_.exe (PID: 4748)
      • fgsdfgerds.exe (PID: 2604)
      • tmp9975.exe (PID: 6776)
      • tmp1360.exe (PID: 5244)

    • Executable content was dropped or overwritten

      • AntiPublic_.exe (PID: 4748)
      • fgsdfgerds.exe (PID: 2604)
      • vbcvgfdgdf.exe (PID: 5496)
      • systmdrv.exe (PID: 6664)
      • tmp9975.exe (PID: 6776)
      • tmp1360.exe (PID: 5244)

    • Reads security settings of Internet Explorer

      • AntiPublic_.exe (PID: 4748)
      • fgsdfgerds.exe (PID: 2604)
      • systmdrv.exe (PID: 6664)
      • sdgfxcvxc.exe (PID: 2148)

    • Reads the date of Windows installation

      • AntiPublic_.exe (PID: 4748)
      • fgsdfgerds.exe (PID: 2604)
      • systmdrv.exe (PID: 6664)

    • Starts CMD.EXE for commands execution

      • Anti Public.exe (PID: 4168)

    • Starts itself from another location

      • fgsdfgerds.exe (PID: 2604)

    • Loads Python modules

      • Anti Public.exe (PID: 4168)
      • tmp9975.exe (PID: 2716)
      • tmp1360.exe (PID: 7072)

    • Connects to unusual port

      • sdgfxcvxc.exe (PID: 2148)

    • Potential Corporate Privacy Violation

      • systmdrv.exe (PID: 6664)

    • Process drops python dynamic module

      • tmp9975.exe (PID: 6776)
      • tmp1360.exe (PID: 5244)

    • The process drops C-runtime libraries

      • tmp9975.exe (PID: 6776)
      • tmp1360.exe (PID: 5244)

    • Application launched itself

      • tmp9975.exe (PID: 6776)
      • tmp1360.exe (PID: 5244)

    • Process requests binary or script from the Internet

      • systmdrv.exe (PID: 6664)

    • Connects to the server without a host name

      • systmdrv.exe (PID: 6664)
      • sdgfxcvxc.exe (PID: 2148)
      • explorer.exe (PID: 4772)

    • Uses RUNDLL32.EXE to load library

      • explorer.exe (PID: 4772)

    • Contacting a server suspected of hosting an CnC

      • sdgfxcvxc.exe (PID: 2148)

    • Found regular expressions for crypto-addresses (YARA)

      • systmdrv.exe (PID: 6664)

  • INFO

    • The sample compiled with english language support

      • AntiPublic_.exe (PID: 4748)
      • fgsdfgerds.exe (PID: 2604)
      • tmp9975.exe (PID: 6776)
      • tmp1360.exe (PID: 5244)

    • Reads the computer name

      • AntiPublic_.exe (PID: 4748)
      • vbcvgfdgdf.exe (PID: 5496)
      • sdgfxcvxc.exe (PID: 2148)
      • fgsdfgerds.exe (PID: 2604)
      • systmdrv.exe (PID: 6664)
      • tmp9975.exe (PID: 6776)
      • tmp1360.exe (PID: 5244)

    • Checks supported languages

      • AntiPublic_.exe (PID: 4748)
      • fgsdfgerds.exe (PID: 2604)
      • sdgfxcvxc.exe (PID: 2148)
      • vbcvgfdgdf.exe (PID: 5496)
      • systmdrv.exe (PID: 6664)
      • bbeecafdaeec.exe (PID: 6868)
      • vbcvgfdgdf.exe (PID: 3672)
      • tmp9975.exe (PID: 6776)
      • systmdrv.exe (PID: 2864)
      • tmp9975.exe (PID: 2716)
      • tmp1360.exe (PID: 5244)
      • tmp1360.exe (PID: 7072)

    • Process checks computer location settings

      • AntiPublic_.exe (PID: 4748)
      • fgsdfgerds.exe (PID: 2604)
      • systmdrv.exe (PID: 6664)

    • Creates files or folders in the user directory

      • AntiPublic_.exe (PID: 4748)
      • fgsdfgerds.exe (PID: 2604)
      • systmdrv.exe (PID: 6664)
      • sdgfxcvxc.exe (PID: 2148)

    • Launching a file from a Registry key

      • fgsdfgerds.exe (PID: 2604)
      • vbcvgfdgdf.exe (PID: 5496)
      • explorer.exe (PID: 4772)

    • Creates files in the program directory

      • vbcvgfdgdf.exe (PID: 5496)
      • sdgfxcvxc.exe (PID: 2148)
      • MusNotificationUx.exe (PID: 6304)
      • MusNotifyIcon.exe (PID: 4888)

    • Reads the machine GUID from the registry

      • vbcvgfdgdf.exe (PID: 5496)
      • Anti Public.exe (PID: 4168)
      • bbeecafdaeec.exe (PID: 6868)
      • vbcvgfdgdf.exe (PID: 3672)
      • tmp9975.exe (PID: 2716)
      • tmp1360.exe (PID: 7072)

    • Reads the time zone

      • MusNotificationUx.exe (PID: 6304)
      • MusNotifyIcon.exe (PID: 4888)

    • Checks proxy server information

      • systmdrv.exe (PID: 6664)
      • explorer.exe (PID: 4772)
      • sdgfxcvxc.exe (PID: 2148)
      • slui.exe (PID: 1232)

    • Manual execution by a user

      • systmdrv.exe (PID: 2864)
      • bbeecafdaeec.exe (PID: 6868)
      • vbcvgfdgdf.exe (PID: 3672)
      • notepad.exe (PID: 3476)
      • notepad.exe (PID: 2804)
      • notepad.exe (PID: 892)
      • WINWORD.EXE (PID: 3724)
      • WINWORD.EXE (PID: 6304)
      • WINWORD.EXE (PID: 6868)
      • rundll32.exe (PID: 6368)

    • Create files in a temporary directory

      • systmdrv.exe (PID: 6664)
      • tmp9975.exe (PID: 6776)
      • tmp1360.exe (PID: 5244)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 4772)
      • notepad.exe (PID: 3476)
      • notepad.exe (PID: 892)
      • notepad.exe (PID: 2804)
      • backgroundTaskHost.exe (PID: 6796)
      • backgroundTaskHost.exe (PID: 4312)

    • Reads the software policy settings

      • WaaSMedicAgent.exe (PID: 1720)
      • SIHClient.exe (PID: 6768)
      • slui.exe (PID: 1232)

    • PyInstaller has been detected (YARA)

      • Anti Public.exe (PID: 4168)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (36.8)
.exe | Win32 Executable MS Visual C++ (generic) (26.6)
.exe | Win64 Executable (generic) (23.6)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:06:20 18:51:34+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.4
CodeSize: 55808
InitializedDataSize: 9199616
UninitializedDataSize: -
EntryPoint: 0x1dfc
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.2.1.1
ProductVersionNumber: 3.1.1.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: Ioxcv
FileVersion: 6.0.0.0
InternalName: Ioxcv.exe
LegalCopyright: (C) 2026
OriginalFileName: Ioxcv.exe
ProductName: Ioxcv
ProductVersion: 2.2.2.2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
162
Monitored processes
35
Malicious processes
8
Suspicious processes
4

Behavior graph

Click at the process to see the details
start antipublic_.exe fgsdfgerds.exe sdgfxcvxc.exe vbcvgfdgdf.exe anti public.exe no specs anti public.exe no specs #DIAMOTRIX systmdrv.exe systmdrv.exe no specs bbeecafdaeec.exe no specs vbcvgfdgdf.exe no specs tmp9975.exe tmp9975.exe no specs musnotificationux.exe no specs notepad.exe no specs notepad.exe no specs musnotifyicon.exe no specs conhost.exe no specs waasmedicagent.exe no specs notepad.exe no specs tmp1360.exe tmp1360.exe no specs winword.exe winword.exe no specs ai.exe no specs winword.exe no specs backgroundtaskhost.exe no specs runtimebroker.exe no specs backgroundtaskhost.exe no specs rundll32.exe no specs sihclient.exe slui.exe #DIAMOTRIX explorer.exe svchost.exe no specs firefox.exe firefox.exe

Process information

PID
CMD
Path
Indicators
Parent process
892"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\System_Info.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
1204"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "5A72506E-3553-4DEB-8087-FDA0E72DEB05" "FE02CA51-66E8-4F5F-A837-C6C9C6422873" "3724"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1232C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1332"C:\Users\admin\Desktop\Anti Public.exe" C:\Users\admin\Desktop\Anti Public.exe—AntiPublic_.exe
User:
admin
Integrity Level:
MEDIUM
1564C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s wuauservC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
1720C:\WINDOWS\System32\WaaSMedicAgent.exe 9f82130e86677709bf68d2b6ecb5ba08 OQE1537/YkGd47yzsfB6BQ.0.1.0.0.0C:\Windows\System32\WaaSMedicAgent.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
WaasMedic Agent Exe
Exit code:
0
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\waasmedicagent.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\combase.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcrypt.dll
2148"C:\Users\admin\AppData\Roaming\sdgfxcvxc.exe" C:\Users\admin\AppData\Roaming\sdgfxcvxc.exe
AntiPublic_.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\sdgfxcvxc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2320"C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask defaultagent do-task 308046B0AF4A39CBC:\Program Files\Mozilla Firefox\firefox.exe
default-browser-agent.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
136.0
Modules
Images
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\imm32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\psapi.dll
c:\windows\system32\wininet.dll
2404C:\Windows\System32\RuntimeBroker.exe -EmbeddingC:\Windows\System32\RuntimeBroker.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Runtime Broker
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\runtimebroker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\powrprof.dll
2604"C:\Users\admin\AppData\Roaming\fgsdfgerds.exe" C:\Users\admin\AppData\Roaming\fgsdfgerds.exe
AntiPublic_.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
System
Exit code:
0
Version:
10.0.19041.4842 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\roaming\fgsdfgerds.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
34 869
Read events
34 239
Write events
595
Delete events
35

Modification events

(PID) Process:(2604) fgsdfgerds.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Systmdrv
Value:
C:\Users\admin\AppData\Roaming\systmdrv.exe
(PID) Process:(5496) vbcvgfdgdf.exeKey:HKEY_CURRENT_USER\SOFTWARE\bbeecafdaeec
Operation:writeName:CurrentPath
Value:
C:\Users\admin\AppData\Roaming\vbcvgfdgdf.exe
(PID) Process:(5496) vbcvgfdgdf.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:bbeecafdaeec
Value:
"C:\ProgramData\bbeecafdaeec.exe"
(PID) Process:(4748) AntiPublic_.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000A032A
Operation:writeName:VirtualDesktop
Value:
10000000303044563096AFED4A643448A750FA41CFC7F708
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:bbeecafdaeec
Value:
"C:\Users\admin\AppData\Roaming\vbcvgfdgdf.exe"
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\bbeecafdaeec
Operation:writeName:CurrentPath
Value:
C:\Users\admin\AppData\Roaming\vbcvgfdgdf.exe
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run
Operation:delete keyName:(default)
Value:
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder
Operation:delete keyName:(default)
Value:
(PID) Process:(4772) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:bbeecafdaeec
Value:
"C:\ProgramData\bbeecafdaeec.exe"
Executable files
144
Suspicious files
171
Text files
33
Unknown types
0

Dropped files

PID
Process
Filename
Type
4748AntiPublic_.exeC:\Users\admin\AppData\Roaming\fgsdfgerds.exeexecutable
MD5:E9C28F27DDC04C563B80B013A2140B4C
SHA256:82ABA7497BE6CC024E37E74DE4DA89E6EC7E7A0EB3A447546AAEE762E159BA2A
4748AntiPublic_.exeC:\Users\admin\AppData\Roaming\sdgfxcvxc.exeexecutable
MD5:97CEAEF859A4B1640E7AB16D854BD669
SHA256:0B0E8348D188292067CA0E53D7266AAC83042D38B3DD00F02BB2BD8C26F2519E
2148sdgfxcvxc.exeC:\ProgramData\{65b178c1-239c-11ed-b4aa-806e6f6e6963}\Software_Info.txttext
MD5:AAB1B59AF386F4F63F9007EF79B3D07A
SHA256:1EB2569F1A69183A48F7D93B4AFB8BFF9D7972FB160D3649EEBD67B2C986ED1F
2148sdgfxcvxc.exeC:\ProgramData\{65b178c1-239c-11ed-b4aa-806e6f6e6963}\Browsers\Chrome_History.txt —
MD5:—
SHA256:—
4748AntiPublic_.exeC:\Users\admin\AppData\Roaming\vbcvgfdgdf.exeexecutable
MD5:7E340F84D63615BABF925884F25190A4
SHA256:CEE697C61780F010768937F57FE8D32E658471951936C7AC6AAE5B2FAF86CC2A
2148sdgfxcvxc.exeC:\ProgramData\{65b178c1-239c-11ed-b4aa-806e6f6e6963}\Browsers\Edge_History.txt —
MD5:—
SHA256:—
2148sdgfxcvxc.exeC:\ProgramData\{65b178c1-239c-11ed-b4aa-806e6f6e6963}\Browsers\Chrome_Downloads.txt —
MD5:—
SHA256:—
2148sdgfxcvxc.exeC:\ProgramData\{65b178c1-239c-11ed-b4aa-806e6f6e6963}\Browsers\Edge_Downloads.txt —
MD5:—
SHA256:—
4772explorer.exeC:\Users\admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.datbinary
MD5:E49C56350AEDF784BFE00E444B879672
SHA256:A8BD235303668981563DFB5AAE338CB802817C4060E2C199B7C84901D57B7E1E
2604fgsdfgerds.exeC:\Users\admin\AppData\Roaming\systmdrv.exeexecutable
MD5:E9C28F27DDC04C563B80B013A2140B4C
SHA256:82ABA7497BE6CC024E37E74DE4DA89E6EC7E7A0EB3A447546AAEE762E159BA2A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
117
TCP/UDP connections
124
DNS requests
33
Threats
19

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
2.18.121.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2228
RUXIMICS.exe
GET
200
2.18.121.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
2.18.121.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2228
RUXIMICS.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
200
185.156.72.89:80
http://185.156.72.89/nzcwzue/pqrfxn.php
unknown
—
—
unknown
—
—
POST
200
40.126.32.72:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
—
—
POST
200
20.190.160.131:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
16.7 Kb
whitelisted
6664
systmdrv.exe
GET
200
185.156.72.8:80
http://185.156.72.8/1.exe
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
2.18.121.139:80
crl.microsoft.com
AKAMAI-AS
FR
whitelisted
2228
RUXIMICS.exe
2.18.121.139:80
crl.microsoft.com
AKAMAI-AS
FR
whitelisted
5944
MoUsoCoreWorker.exe
2.18.121.139:80
crl.microsoft.com
AKAMAI-AS
FR
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
5944
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.78
whitelisted
crl.microsoft.com
  • 2.18.121.139
  • 2.18.121.147
  • 23.55.104.172
  • 23.55.104.190
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.64
  • 40.126.32.136
  • 40.126.32.74
  • 20.190.160.66
  • 20.190.160.131
  • 20.190.160.5
  • 40.126.32.138
  • 20.190.160.132
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.11
  • 52.111.243.31
whitelisted
officeclient.microsoft.com
  • 52.109.89.18
whitelisted
roaming.officeapps.live.com
  • 52.109.28.47
whitelisted
omex.cdn.office.net
  • 23.200.87.23
  • 23.200.86.240
whitelisted

Threats

PID
Process
Class
Message
6664
systmdrv.exe
A Network Trojan was detected
ET MALWARE Diamotrix POST Request M3
6664
systmdrv.exe
A Network Trojan was detected
ET MALWARE Single char EXE direct download likely trojan (multiple families)
6664
systmdrv.exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
6664
systmdrv.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
6664
systmdrv.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
6664
systmdrv.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
6664
systmdrv.exe
A Network Trojan was detected
ET MALWARE Single char EXE direct download likely trojan (multiple families)
6664
systmdrv.exe
Misc activity
INFO [ANY.RUN] USER_AGENTS Suspicious User-Agent (Mozilla/5.0)
6664
systmdrv.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
6664
systmdrv.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
Process
Message
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AntiPublic_.exe