File name:

SeryCodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479

Full analysis: https://app.any.run/tasks/21b82661-6431-4af3-8cff-a9b133b2d35f
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: May 14, 2025, 01:21:10
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
github
telegram
evasion
auto-reg
stealer
milleniumrat
rat
ims-api
generic
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

241D322E38D9155141834F8E571BEB35

SHA1:

30877320FE56906A4584600167F8DCEB7B6129F9

SHA256:

710C10E169BC8D0BB92BE5750AA7DE0FAF1A0CC89D64FA6C9A4E44F0C87E6479

SSDEEP:

98304:2AwoYKV712RiCZXV3WWTDpudGZuBZ2S2flB2bz14tHq+U4ZtaPAcV7F8/7oqGOmg:teXV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • reg.exe (PID: 4208)

    • MILLENIUMRAT has been detected (YARA)

      • Update.exe (PID: 5352)

  • SUSPICIOUS

    • Malware-specific behavior: drops SQLite library (may be used to steal credentials)

      • SeryCodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479.exe (PID: 5056)

    • Executable content was dropped or overwritten

      • SeryCodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479.exe (PID: 5056)

    • Reads security settings of Internet Explorer

      • SeryCodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479.exe (PID: 5056)
      • Update.exe (PID: 5352)

    • Starts itself from another location

      • SeryCodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479.exe (PID: 5056)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • Update.exe (PID: 5352)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • Update.exe (PID: 5352)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 3020)
      • cmd.exe (PID: 5216)

    • Starts CMD.EXE for commands execution

      • Update.exe (PID: 5352)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • Update.exe (PID: 5352)

    • Multiple wallet extension IDs have been found

      • Update.exe (PID: 5352)

  • INFO

    • Create files in a temporary directory

      • SeryCodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479.exe (PID: 5056)

    • Reads the computer name

      • SeryCodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479.exe (PID: 5056)
      • Update.exe (PID: 5352)
      • Update.exe (PID: 720)

    • Checks supported languages

      • SeryCodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479.exe (PID: 5056)
      • Update.exe (PID: 5352)
      • Update.exe (PID: 720)

    • Disables trace logs

      • SeryCodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479.exe (PID: 5056)
      • Update.exe (PID: 5352)
      • Update.exe (PID: 720)

    • The sample compiled with english language support

      • SeryCodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479.exe (PID: 5056)

    • Checks proxy server information

      • SeryCodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479.exe (PID: 5056)
      • Update.exe (PID: 5352)
      • Update.exe (PID: 720)
      • slui.exe (PID: 5216)

    • Reads the machine GUID from the registry

      • SeryCodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479.exe (PID: 5056)
      • Update.exe (PID: 5352)
      • Update.exe (PID: 720)

    • Reads the software policy settings

      • SeryCodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479.exe (PID: 5056)
      • Update.exe (PID: 5352)
      • Update.exe (PID: 720)
      • slui.exe (PID: 5216)

    • Creates files or folders in the user directory

      • SeryCodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479.exe (PID: 5056)

    • Process checks computer location settings

      • SeryCodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479.exe (PID: 5056)
      • Update.exe (PID: 5352)

    • Auto-launch of the file from Registry key

      • reg.exe (PID: 4208)

    • Application launched itself

      • chrome.exe (PID: 5800)

    • Manual execution by a user

      • Update.exe (PID: 720)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

ims-api

(PID) Process(5352) Update.exe
Telegram-Tokens (1)7604645789:AAG6U0PQHBiAthwfv9X-Xm93s_azOHqSjdI
Telegram-Info-Links
7604645789:AAG6U0PQHBiAthwfv9X-Xm93s_azOHqSjdI
Get info about bothttps://api.telegram.org/bot7604645789:AAG6U0PQHBiAthwfv9X-Xm93s_azOHqSjdI/getMe
Get incoming updateshttps://api.telegram.org/bot7604645789:AAG6U0PQHBiAthwfv9X-Xm93s_azOHqSjdI/getUpdates
Get webhookhttps://api.telegram.org/bot7604645789:AAG6U0PQHBiAthwfv9X-Xm93s_azOHqSjdI/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot7604645789:AAG6U0PQHBiAthwfv9X-Xm93s_azOHqSjdI/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot7604645789:AAG6U0PQHBiAthwfv9X-Xm93s_azOHqSjdI/deleteWebhook?drop_pending_updates=true
Telegram-Requests
Token7604645789:AAG6U0PQHBiAthwfv9X-Xm93s_azOHqSjdI
End-PointgetMe
Args
Telegram-Responses
oktrue
result
id7604645789
is_bottrue
first_nameja ja tur ja bot
usernamejajaturbot
can_join_groupstrue
can_read_all_group_messagesfalse
supports_inline_queriesfalse
can_connect_to_businessfalse
has_main_web_appfalse
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2082:04:13 20:35:47+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 4200960
InitializedDataSize: 6144
UninitializedDataSize: -
EntryPoint: 0x4038ae
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
CompanyName: Microsoft
FileDescription: Runtime Broker
FileVersion: 1.0.0.0
InternalName: Runtime Broker.exe
LegalCopyright:
OriginalFileName: Runtime Broker.exe
ProductName: conhost
ProductVersion: 1.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
15
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start serycodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479.exe #MILLENIUMRAT update.exe svchost.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe chrome.exe no specs chrome.exe no specs update.exe chrome.exe no specs chrome.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
720C:\Users\admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exeC:\Users\admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe
explorer.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
Runtime Broker
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\googlechromeupdatelog\update.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
1056reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "ChromeUpdate" /fC:\Windows\SysWOW64\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3020"C:\Windows\System32\cmd.exe" /c reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "ChromeUpdate" /fC:\Windows\SysWOW64\cmd.exe—Update.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4208reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "ChromeUpdate" /t REG_SZ /d "C:\Users\admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe" /fC:\Windows\SysWOW64\reg.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5056"C:\Users\admin\Desktop\SeryCodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479.exe" C:\Users\admin\Desktop\SeryCodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479.exe
explorer.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
Runtime Broker
Exit code:
1
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\serycodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5216"C:\Windows\System32\cmd.exe" /c reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "ChromeUpdate" /t REG_SZ /d "C:\Users\admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe" /fC:\Windows\SysWOW64\cmd.exe—Update.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
5216C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5352"C:\Users\admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe" C:\Users\admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exe
SeryCodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
Runtime Broker
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\googlechromeupdatelog\update.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
ims-api
(PID) Process(5352) Update.exe
Telegram-Tokens (1)7604645789:AAG6U0PQHBiAthwfv9X-Xm93s_azOHqSjdI
Telegram-Info-Links
7604645789:AAG6U0PQHBiAthwfv9X-Xm93s_azOHqSjdI
Get info about bothttps://api.telegram.org/bot7604645789:AAG6U0PQHBiAthwfv9X-Xm93s_azOHqSjdI/getMe
Get incoming updateshttps://api.telegram.org/bot7604645789:AAG6U0PQHBiAthwfv9X-Xm93s_azOHqSjdI/getUpdates
Get webhookhttps://api.telegram.org/bot7604645789:AAG6U0PQHBiAthwfv9X-Xm93s_azOHqSjdI/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot7604645789:AAG6U0PQHBiAthwfv9X-Xm93s_azOHqSjdI/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot7604645789:AAG6U0PQHBiAthwfv9X-Xm93s_azOHqSjdI/deleteWebhook?drop_pending_updates=true
Telegram-Requests
Token7604645789:AAG6U0PQHBiAthwfv9X-Xm93s_azOHqSjdI
End-PointgetMe
Args
Telegram-Responses
oktrue
result
id7604645789
is_bottrue
first_nameja ja tur ja bot
usernamejajaturbot
can_join_groupstrue
can_read_all_group_messagesfalse
supports_inline_queriesfalse
can_connect_to_businessfalse
has_main_web_appfalse
5800"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --user-data-dir="C:\Users\admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default" --headless --disable-gpuC:\Program Files\Google\Chrome\Application\chrome.exe—Update.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
Total events
16 753
Read events
16 720
Write events
32
Delete events
1

Modification events

(PID) Process:(5056) SeryCodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5056) SeryCodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5056) SeryCodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(5056) SeryCodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(5056) SeryCodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(5056) SeryCodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(5056) SeryCodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(5056) SeryCodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5056) SeryCodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5056) SeryCodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
2
Suspicious files
2
Text files
12
Unknown types
0

Dropped files

PID
Process
Filename
Type
5800chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old~RF10f9f2.TMP —
MD5:—
SHA256:—
5800chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
5056SeryCodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479.exeC:\Users\admin\AppData\Local\Temp\Costura\EE2BCDDD717AB438EDB450C5E74983DD\32\sqlite.interop.dllexecutable
MD5:6F2FDECC48E7D72CA1EB7F17A97E59AD
SHA256:70E48EF5C14766F3601C97451B47859FDDCBE7F237E1C5200CEA8E7A7609D809
5800chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datbinary
MD5:FC81892AC822DCBB09441D3B58B47125
SHA256:FB077C966296D02D50CCBF7F761D2A3311A206A784A7496F331C2B0D6AD205C8
5800chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old~RF10f9e2.TMPtext
MD5:F96D0EF8D63094D714514A441F8CD3FB
SHA256:2083625CA1E32D366F0B664D9B87B591791EF2EA2B770F4FA6ABE13FECA01196
5800chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOGtext
MD5:D92244EA1534B0EE59F21EBD74E9A4F5
SHA256:DDCE0FFFD667659BA2A98025FDBDCC9A2933895929B91C6F3CBEA45A013A4839
5800chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\DevToolsActivePorttext
MD5:64EFA7D1ACB0860622FA82265113E6FF
SHA256:EE5AABD54E6ADBDEE94648CE8BA16AA07D15BBF953554BDC2B3C76B9CAE0384F
5800chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG.old~RF10fa02.TMPtext
MD5:668BAE5C0A00EF466FA52102A122346C
SHA256:A366BA8B2FD21BB25B17C6AC8A2C07428AEE94E6EA8CB14E204E4F77F61E2D40
5056SeryCodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479.exeC:\Users\admin\AppData\Roaming\GoogleChromeUpdateLog\Update.exeexecutable
MD5:241D322E38D9155141834F8E571BEB35
SHA256:710C10E169BC8D0BB92BE5750AA7DE0FAF1A0CC89D64FA6C9A4E44F0C87E6479
5800chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.oldtext
MD5:3E899D12905735FE8AE3AF5991813E81
SHA256:94EDEF99FC8A3A5CBB1F3C989E0C596BC07D308DA3DC9F9012CD397C29661B57
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
28
DNS requests
12
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
184.24.77.37:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6708
RUXIMICS.exe
GET
200
184.24.77.37:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6708
RUXIMICS.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5352
Update.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6708
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5056
SeryCodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479.exe
185.199.108.133:443
raw.githubusercontent.com
FASTLY
US
whitelisted
2104
svchost.exe
184.24.77.37:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6708
RUXIMICS.exe
184.24.77.37:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.110
whitelisted
raw.githubusercontent.com
  • 185.199.108.133
  • 185.199.111.133
  • 185.199.110.133
  • 185.199.109.133
whitelisted
crl.microsoft.com
  • 184.24.77.37
  • 184.24.77.35
  • 184.24.77.12
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
api.telegram.org
  • 149.154.167.220
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
  • 20.83.72.98
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
2196
svchost.exe
Misc activity
ET HUNTING Telegram API Domain in DNS Lookup
5352
Update.exe
Misc activity
ET HUNTING Observed Telegram API Domain (api .telegram .org in TLS SNI)
5352
Update.exe
Misc activity
ET HUNTING Telegram API Certificate Observed
—
—
Misc activity
ET HUNTING Telegram API Request (GET)
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
5352
Update.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SeryCodes_710c10e169bc8d0bb92be5750aa7de0faf1a0cc89d64fa6c9a4e44f0c87e6479