File name:

main.bat

Full analysis: https://app.any.run/tasks/47f4ee4b-5d4a-40a4-b4fc-aef0d36acd44
Verdict: Malicious activity
Analysis date: July 05, 2025, 22:29:27
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: text/x-msdos-batch
File info: DOS batch file, Unicode text, UTF-8 text, with CRLF line terminators
MD5:

79C7765D6388FA991D30DFF5DB93FB8D

SHA1:

0B44A17C3D359EF2D36892D0C552B76547B636F3

SHA256:

6C84B56C59DD149857603BE66D45A344BC02E628F8E53F863848ADA52134E569

SSDEEP:

96:bVehI8ocEWYbQjUnSXfeWaNLTtI5tcc7XPM7SF8q4RzzKMs0UsqQ6l9o7:bVehILenSLqdQT/hFUsT6fs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE for service management

      • cmd.exe (PID: 7052)
      • net.exe (PID: 2804)
      • cmd.exe (PID: 4932)
      • net.exe (PID: 3584)

    • Create files in the Startup directory

      • cmd.exe (PID: 7052)

    • Starts NET.EXE to view/add/change user profiles

      • cmd.exe (PID: 7052)
      • net.exe (PID: 1192)
      • net.exe (PID: 3588)
      • net.exe (PID: 3564)
      • net.exe (PID: 2076)
      • net.exe (PID: 6868)
      • net.exe (PID: 3780)
      • net.exe (PID: 4788)
      • net.exe (PID: 6256)
      • net.exe (PID: 6552)
      • net.exe (PID: 3588)
      • net.exe (PID: 4880)
      • net.exe (PID: 4880)
      • net.exe (PID: 6336)
      • net.exe (PID: 3980)
      • net.exe (PID: 4828)
      • net.exe (PID: 6868)
      • net.exe (PID: 7048)
      • net.exe (PID: 3564)
      • net.exe (PID: 4788)
      • net.exe (PID: 6552)
      • net.exe (PID: 1948)
      • net.exe (PID: 3980)
      • net.exe (PID: 6336)
      • net.exe (PID: 3160)
      • net.exe (PID: 4960)
      • net.exe (PID: 7136)
      • net.exe (PID: 3388)
      • net.exe (PID: 1332)
      • net.exe (PID: 6668)
      • net.exe (PID: 2132)
      • net.exe (PID: 2716)
      • net.exe (PID: 6256)
      • net.exe (PID: 3688)
      • net.exe (PID: 4684)
      • net.exe (PID: 1512)
      • net.exe (PID: 3740)
      • net.exe (PID: 6868)
      • net.exe (PID: 5436)
      • net.exe (PID: 6680)
      • net.exe (PID: 3564)
      • net.exe (PID: 6552)
      • net.exe (PID: 6936)
      • net.exe (PID: 5576)
      • net.exe (PID: 4664)
      • net.exe (PID: 3672)
      • net.exe (PID: 5552)
      • net.exe (PID: 6796)
      • net.exe (PID: 3980)
      • net.exe (PID: 868)
      • net.exe (PID: 7156)
      • net.exe (PID: 1028)
      • net.exe (PID: 5720)
      • net.exe (PID: 2464)
      • net.exe (PID: 1564)
      • net.exe (PID: 2800)
      • net.exe (PID: 2120)
      • net.exe (PID: 6900)
      • net.exe (PID: 1128)
      • net.exe (PID: 5168)
      • net.exe (PID: 2356)
      • net.exe (PID: 1356)
      • net.exe (PID: 6936)
      • net.exe (PID: 2220)
      • net.exe (PID: 1212)
      • net.exe (PID: 1332)
      • net.exe (PID: 4760)
      • net.exe (PID: 2180)
      • net.exe (PID: 5780)
      • net.exe (PID: 6668)
      • net.exe (PID: 2132)
      • net.exe (PID: 3584)
      • net.exe (PID: 6780)
      • net.exe (PID: 3688)
      • net.exe (PID: 4684)
      • net.exe (PID: 6200)
      • net.exe (PID: 2180)
      • net.exe (PID: 6948)
      • net.exe (PID: 6140)
      • net.exe (PID: 6868)
      • net.exe (PID: 4788)
      • net.exe (PID: 1984)
      • net.exe (PID: 2536)
      • net.exe (PID: 5184)
      • net.exe (PID: 6796)
      • net.exe (PID: 6348)
      • net.exe (PID: 4552)
      • net.exe (PID: 4860)
      • net.exe (PID: 2132)
      • net.exe (PID: 856)
      • net.exe (PID: 4960)
      • net.exe (PID: 6264)
      • net.exe (PID: 3028)
      • net.exe (PID: 6256)
      • net.exe (PID: 3964)
      • net.exe (PID: 6348)
      • net.exe (PID: 4860)
      • net.exe (PID: 3672)
      • net.exe (PID: 2220)
      • net.exe (PID: 6164)
      • net.exe (PID: 2320)
      • net.exe (PID: 2696)
      • net.exe (PID: 6264)

    • Disables task manager

      • reg.exe (PID: 7048)

  • SUSPICIOUS

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 2492)
      • cmd.exe (PID: 5772)
      • cmd.exe (PID: 888)
      • cmd.exe (PID: 3620)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 2492)
      • cmd.exe (PID: 5772)
      • cmd.exe (PID: 888)
      • cmd.exe (PID: 7052)
      • cmd.exe (PID: 3620)

    • The process executes VB scripts

      • cmd.exe (PID: 6724)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 6724)
      • cmd.exe (PID: 5772)
      • cmd.exe (PID: 7052)
      • cmd.exe (PID: 4932)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 2492)

    • Application launched itself

      • cmd.exe (PID: 5772)
      • cmd.exe (PID: 888)
      • cmd.exe (PID: 7052)
      • cmd.exe (PID: 3620)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 7052)
      • cmd.exe (PID: 4932)

    • Uses NETSH.EXE to change the status of the firewall

      • cmd.exe (PID: 7052)
      • cmd.exe (PID: 4932)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 7052)

    • Executing commands from ".cmd" file

      • cmd.exe (PID: 7052)

    • Uses WMIC.EXE to obtain CPU information

      • cmd.exe (PID: 7052)

    • Starts application with an unusual extension

      • cmd.exe (PID: 684)

    • Uses NETSH.EXE to obtain data on the network

      • cmd.exe (PID: 7052)

    • Process uses IPCONFIG to get network configuration information

      • cmd.exe (PID: 7052)

    • Uses WMIC.EXE to obtain physical disk drive information

      • cmd.exe (PID: 7052)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • cmd.exe (PID: 7052)

    • Uses SYSTEMINFO.EXE to read the environment

      • cmd.exe (PID: 7052)

    • Uses RUNDLL32.EXE to load library

      • cmd.exe (PID: 7052)

    • Windows service management via SC.EXE

      • sc.exe (PID: 5960)

    • Starts a Microsoft application from unusual location

      • DismHost.exe (PID: 6472)
      • DismHost.exe (PID: 1192)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 7052)

    • Executable content was dropped or overwritten

      • Dism.exe (PID: 1332)
      • cmd.exe (PID: 7052)

    • The process creates files with name similar to system file names

      • Dism.exe (PID: 1332)

    • Starts NET.EXE to display or manage information about active sessions

      • cmd.exe (PID: 7052)
      • net.exe (PID: 2388)

    • Creates or modifies Windows services

      • reg.exe (PID: 2680)

    • Stops a currently running service

      • sc.exe (PID: 4960)

    • Process drops legitimate windows executable

      • cmd.exe (PID: 7052)

    • The process drops C-runtime libraries

      • cmd.exe (PID: 7052)

    • The process checks if it is being run in the virtual environment

      • cmd.exe (PID: 7052)

    • Creates file in the systems drive root

      • cmd.exe (PID: 7052)
      • cmd.exe (PID: 2800)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2800)

  • INFO

    • Launching a file from the Startup directory

      • cmd.exe (PID: 7052)

    • Checks supported languages

      • mode.com (PID: 3620)
      • scrnsave.scr (PID: 2716)
      • DismHost.exe (PID: 6472)
      • DismHost.exe (PID: 1192)

    • Starts MODE.COM to configure console settings

      • mode.com (PID: 3620)

    • Reads the computer name

      • scrnsave.scr (PID: 2716)
      • DismHost.exe (PID: 6472)
      • DismHost.exe (PID: 1192)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 6948)
      • WMIC.exe (PID: 2044)

    • Create files in a temporary directory

      • Dism.exe (PID: 1332)

    • The sample compiled with english language support

      • Dism.exe (PID: 1332)
      • cmd.exe (PID: 7052)

    • The sample compiled with korean language support

      • cmd.exe (PID: 7052)

    • The sample compiled with french language support

      • cmd.exe (PID: 7052)

    • The sample compiled with japanese language support

      • cmd.exe (PID: 7052)

    • The sample compiled with russian language support

      • cmd.exe (PID: 7052)

    • The sample compiled with chinese language support

      • cmd.exe (PID: 7052)

    • The sample compiled with german language support

      • cmd.exe (PID: 7052)

    • The sample compiled with Italian language support

      • cmd.exe (PID: 7052)

    • The sample compiled with spanish language support

      • cmd.exe (PID: 7052)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
469
Monitored processes
331
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start cmd.exe no specs conhost.exe no specs cacls.exe no specs wscript.exe no specs cmd.exe conhost.exe no specs cacls.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe conhost.exe no specs cacls.exe no specs reg.exe no specs reg.exe no specs net.exe no specs net1.exe no specs netsh.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs tskill.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs attrib.exe no specs cmd.exe no specs conhost.exe no specs net.exe no specs net1.exe no specs mode.com no specs scrnsave.scr no specs netsh.exe no specs ipconfig.exe no specs ipconfig.exe no specs find.exe no specs wmic.exe no specs wmic.exe no specs systeminfo.exe no specs tiworker.exe no specs netsh.exe no specs netsh.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs net.exe no specs net1.exe no specs reg.exe no specs rundll32.exe no specs reg.exe no specs sc.exe no specs sc.exe no specs dism.exe dismhost.exe no specs dismhost.exe no specs net.exe no specs net1.exe no specs reg.exe no specs reg.exe no specs net.exe no specs net1.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs diskpart.exe no specs cacls.exe no specs vdsldr.exe no specs reg.exe no specs reg.exe no specs net.exe no specs taskkill.exe no specs net1.exe no specs netsh.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
516find /i "IPv4"C:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (grep) Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
516C:\WINDOWS\system32\net1 user 27026 14513 /addC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\samcli.dll
c:\windows\system32\netutils.dll
632tskill /A anti*C:\Windows\System32\tskill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Remote Desktop Services End Process Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tskill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\winsta.dll
c:\windows\system32\msvcp_win.dll
684C:\WINDOWS\system32\cmd.exe /K bsod.cmdC:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
728C:\WINDOWS\system32\net1 user 25920 2809 /addC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\samcli.dll
c:\windows\system32\ucrtbase.dll
728C:\WINDOWS\system32\net1 user 29063 19975 /addC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\samcli.dll
c:\windows\system32\netutils.dll
856net user 12782 22265 /addC:\Windows\System32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\mpr.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
856reg delete "HKEY_LOCAL_MACHINE\system\CurrentControlSet\Services\Mouclass" /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
868net user 12705 2713 /addC:\Windows\System32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\netutils.dll
868C:\WINDOWS\system32\net1 user 26731 19536 /addC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\samcli.dll
c:\windows\system32\ucrtbase.dll
Total events
11 460
Read events
11 453
Write events
5
Delete events
2

Modification events

(PID) Process:(6724) cmd.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbs\OpenWithProgids
Operation:writeName:VBSFile
Value:
(PID) Process:(3196) TiWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing
Operation:writeName:SessionIdHigh
Value:
31190524
(PID) Process:(3196) TiWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing
Operation:writeName:SessionIdLow
Value:
(PID) Process:(7048) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:DisableTaskMgr
Value:
1
(PID) Process:(2680) reg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Mouclass
Operation:writeName:Start
Value:
4
(PID) Process:(856) reg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mouclass\Enum
Operation:delete keyName:(default)
Value:
(PID) Process:(856) reg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mouclass
Operation:delete keyName:(default)
Value:
Executable files
154
Suspicious files
6
Text files
28
Unknown types
0

Dropped files

PID
Process
Filename
Type
7052cmd.exeC:\Users\admin\AppData\Local\Temp\windowswimn32.battext
MD5:9905E5A33C6EDD8EB5F59780AFBF74DE
SHA256:C134B2F85415BA5CFCE3E3FE4745688335745A9BB22152AC8F5C77F190D8AEE3
6724cmd.exeC:\Users\admin\AppData\Local\Temp\getadmin.vbstext
MD5:D14A6C18536B08C2D91CC10129CEC2CA
SHA256:88F0E55BE41422957E8F4FEC8CAF0F9ED4E68D1F0290171BA8F4BD26C19FA17D
7052cmd.exeC:\Users\admin\AppData\Local\Temp\rest.battext
MD5:52D75448C46016F3F860076C2472FCE8
SHA256:29C6A4EDF2D211C6F583AB051A579FC0E8D72F2C88959BFB7FD36380425F9CFE
7052cmd.exeC:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rest.battext
MD5:96DD21A13A959DBDE9B32EE41DBB7E21
SHA256:0B4CD78BEA7B71D32ADDCB6AD47880529959D897ED74B8494226842195744048
7052cmd.exeC:\Users\admin\AppData\Local\Temp\9K21JM10B.logtext
MD5:995F43DB4634D90C81AB3B716FAA1FF5
SHA256:1AECC13A454167B47D503E8B9576A04DB3E8C4C7510AE8077140DC8EF17E5145
1332Dism.exeC:\Users\admin\AppData\Local\Temp\822C6C98-4296-40D6-8A76-EE78945D0A18\DmiProvider.dllexecutable
MD5:0C2E5696F987350B0AE36E692D10FFB2
SHA256:52FD26A88D386B906CD1034DF69618195E98A3A2743FE4AA185C461B24D5EBA3
7052cmd.exeC:\Users\admin\AppData\Local\Temp\kill.txttext
MD5:995F43DB4634D90C81AB3B716FAA1FF5
SHA256:1AECC13A454167B47D503E8B9576A04DB3E8C4C7510AE8077140DC8EF17E5145
3196TiWorker.exeC:\Windows\Logs\CBS\CBS.logtext
MD5:E0686496E44806099666EB03A66D302D
SHA256:9FBBDF08F333DAE845FFF9DAF7FFE831D07753D8EA07DA6069FB67D6FE5BAFB5
7052cmd.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rest.battext
MD5:96DD21A13A959DBDE9B32EE41DBB7E21
SHA256:0B4CD78BEA7B71D32ADDCB6AD47880529959D897ED74B8494226842195744048
7052cmd.exeC:\Users\admin\AppData\Local\Temp\bsod.cmdtext
MD5:995F43DB4634D90C81AB3B716FAA1FF5
SHA256:1AECC13A454167B47D503E8B9576A04DB3E8C4C7510AE8077140DC8EF17E5145
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
37
DNS requests
22
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
95.100.181.32:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3948
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4648
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3692
svchost.exe
239.255.255.250:3702
—
—
—
whitelisted
4140
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3948
svchost.exe
40.126.32.74:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3948
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
95.100.181.32:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.184.206
whitelisted
login.live.com
  • 40.126.32.74
  • 40.126.32.140
  • 20.190.160.17
  • 20.190.160.20
  • 20.190.160.4
  • 20.190.160.65
  • 20.190.160.2
  • 40.126.32.138
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
crl.microsoft.com
  • 95.100.181.32
  • 95.100.181.23
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 95.101.149.131
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.43
whitelisted
officeclient.microsoft.com
  • 52.109.28.46
whitelisted
ecs.office.com
  • 52.123.128.14
  • 52.123.129.14
whitelisted

Threats

No threats detected
Process
Message
Dism.exe
PID=1332 TID=5952 Provider has not previously been encountered. Attempting to initialize the provider. - CDISMProviderStore::Internal_GetProvider
Dism.exe
PID=1332 TID=5952 Initializing a provider store for the LOCAL session type. - CDISMProviderStore::Final_OnConnect
Dism.exe
PID=1332 TID=5952 Connecting to the provider located at C:\WINDOWS\system32\Dism\LogProvider.dll. - CDISMProviderStore::Internal_LoadProvider
Dism.exe
PID=1332 TID=5952 Attempting to initialize the logger from the Image Session. - CDISMProviderStore::Final_OnConnect
Dism.exe
PID=1332 TID=5952 Loading Provider from location C:\WINDOWS\system32\Dism\LogProvider.dll - CDISMProviderStore::Internal_GetProvider
Dism.exe
PID=1332 TID=5952 Instantiating the Provider Store. - CDISMImageSession::get_ProviderStore
Dism.exe
PID=1332 TID=5952 Encountered a loaded provider DISMLogger. - CDISMProviderStore::Internal_DisconnectProvider
Dism.exe
PID=1332 TID=5952 Disconnecting the provider store - CDISMImageSession::Final_OnDisconnect
Dism.exe
PID=1332 TID=5952 Disconnecting Provider: DISMLogger - CDISMProviderStore::Internal_DisconnectProvider
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
main.bat