File name:

RFQ.exe

Full analysis: https://app.any.run/tasks/f00bc4e8-9405-499a-ae53-f8bda79ff952
Verdict: Malicious activity
Analysis date: August 14, 2025, 11:09:33
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-startup
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

84C346BD696DC782CD77B96374890FFE

SHA1:

AC8AC042A4FB1B5901F1138F4969AD8F50B9DE59

SHA256:

6CE5F669F78D8C97F5F4348BB16DE41D166823A67726901E567A4E1D97F8E03E

SSDEEP:

98304:L7a+uJ6Q3dlSLvt9xPrxKEQ9D1Cxao4uBgg6TxEhYxDDFwZ7Zi8knj:ej

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • RFQ.exe (PID: 2972)

  • SUSPICIOUS

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 6420)

    • Executable content was dropped or overwritten

      • wscript.exe (PID: 6420)

    • The process checks if it is being run in the virtual environment

      • InstallUtil.exe (PID: 2532)

  • INFO

    • Checks supported languages

      • RFQ.exe (PID: 2972)
      • InstallUtil.exe (PID: 2532)

    • Creates files or folders in the user directory

      • RFQ.exe (PID: 2972)

    • Reads the machine GUID from the registry

      • RFQ.exe (PID: 2972)
      • InstallUtil.exe (PID: 2532)

    • Reads the computer name

      • RFQ.exe (PID: 2972)
      • InstallUtil.exe (PID: 2532)

    • Launching a file from the Startup directory

      • RFQ.exe (PID: 2972)

    • Manual execution by a user

      • wscript.exe (PID: 6420)
      • InstallUtil.exe (PID: 2532)

    • Checks proxy server information

      • slui.exe (PID: 5184)

    • Reads the software policy settings

      • slui.exe (PID: 5184)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:08:12 13:43:11+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 1441792
InitializedDataSize: 222720
UninitializedDataSize: -
EntryPoint: 0x161fbe
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.3923.24800
ProductVersionNumber: 1.0.3923.24800
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: RFQ
FileVersion: 1.0.3923.24800
InternalName: RFQ.exe
LegalCopyright: Copyright © 2010
LegalTrademarks: -
OriginalFileName: RFQ.exe
ProductName: RFQ
ProductVersion: 1.0.3923.24800
AssemblyVersion: 1.0.22.21788
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
4
Malicious processes
0
Suspicious processes
2

Behavior graph

Click at the process to see the details
start rfq.exe wscript.exe installutil.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
2532"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
.NET Framework installation utility
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\installutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2972"C:\Users\admin\AppData\Local\Temp\RFQ.exe" C:\Users\admin\AppData\Local\Temp\RFQ.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
RFQ
Exit code:
4294967295
Version:
1.0.3923.24800
Modules
Images
c:\users\admin\appdata\local\temp\rfq.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5184C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6420wscript "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XsdType.vbs"C:\Windows\System32\wscript.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
1 547
Read events
1 547
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
6420wscript.exeC:\Users\admin\AppData\Roaming\XsdType.exeexecutable
MD5:84C346BD696DC782CD77B96374890FFE
SHA256:6CE5F669F78D8C97F5F4348BB16DE41D166823A67726901E567A4E1D97F8E03E
2972RFQ.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XsdType.vbstext
MD5:6D36CA01F95A0D67287F0B35FC7C2FE0
SHA256:1A57733AF92D2F27977ACFACAE139B20DE3500D518E16C197303AFCD1D27122A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
31
DNS requests
20
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4412
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6508
SIHClient.exe
GET
200
23.3.109.244:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6508
SIHClient.exe
GET
200
23.3.109.244:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.216.77.4:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
23.3.109.48:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6732
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4412
svchost.exe
40.126.31.69:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4412
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6508
SIHClient.exe
74.178.76.128:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6508
SIHClient.exe
23.3.109.244:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
  • 51.104.136.2
whitelisted
google.com
  • 142.250.185.110
whitelisted
login.live.com
  • 40.126.31.69
  • 20.190.159.128
  • 20.190.159.130
  • 40.126.31.73
  • 20.190.159.2
  • 40.126.31.131
  • 40.126.31.129
  • 40.126.31.1
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
slscr.update.microsoft.com
  • 74.178.76.128
whitelisted
www.microsoft.com
  • 23.3.109.244
  • 95.101.149.131
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
crl.microsoft.com
  • 23.216.77.4
  • 23.216.77.16
  • 23.216.77.41
  • 23.216.77.36
  • 23.216.77.8
  • 23.216.77.11
  • 23.216.77.37
  • 23.216.77.42
  • 23.216.77.35
whitelisted
self.events.data.microsoft.com
  • 40.79.173.40
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
RFQ.exe