analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Activator.cmd

Full analysis: https://app.any.run/tasks/7fae8776-d4ae-45d0-9147-fd5e2328b36c
Verdict: Malicious activity
Analysis date: June 27, 2022, 10:03:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: text/x-msdos-batch
File info: DOS batch file, ASCII text, with very long lines, with CRLF line terminators
MD5:

40FA4448A78F5AC2CD035CA172FDF30C

SHA1:

0EABEFD14F50F9F0FFD2BF077F5EC3A3637D2C6E

SHA256:

755AD56525460AB71725B77797922BE622A3EA8AAFCBC49C489BDFE11A4852C4

SSDEEP:

49152:XMLDN/hZw3m99EkHDu5xnAHItDatbEANPpxU/:SEm8kHS56oEy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executes PowerShell scripts

      • cmd.exe (PID: 2820)
      • cmd.exe (PID: 2984)

  • SUSPICIOUS

    • Checks supported languages

      • cmd.exe (PID: 3488)
      • cmd.exe (PID: 2948)
      • cmd.exe (PID: 3396)
      • cmd.exe (PID: 3404)
      • cmd.exe (PID: 2176)
      • cscript.exe (PID: 1736)
      • cmd.exe (PID: 2820)
      • cmd.exe (PID: 3084)
      • mode.com (PID: 1128)
      • cmd.exe (PID: 2972)
      • mode.com (PID: 2776)
      • cmd.exe (PID: 644)
      • powershell.exe (PID: 2908)
      • cscript.exe (PID: 3724)
      • cmd.exe (PID: 3144)
      • cscript.exe (PID: 3820)
      • cmd.exe (PID: 3460)
      • cscript.exe (PID: 3440)
      • cmd.exe (PID: 1124)
      • mode.com (PID: 3596)
      • cscript.exe (PID: 2252)
      • mode.com (PID: 2832)
      • cscript.exe (PID: 3592)
      • cmd.exe (PID: 372)
      • cscript.exe (PID: 2124)
      • cscript.exe (PID: 1852)
      • cscript.exe (PID: 1972)
      • cmd.exe (PID: 1740)
      • cmd.exe (PID: 3720)
      • cscript.exe (PID: 2004)
      • cmd.exe (PID: 2984)
      • cmd.exe (PID: 3992)
      • cmd.exe (PID: 2680)
      • cmd.exe (PID: 2904)
      • mode.com (PID: 1368)
      • cmd.exe (PID: 3148)
      • mode.com (PID: 2872)
      • mode.com (PID: 3160)
      • cmd.exe (PID: 1204)
      • powershell.exe (PID: 848)
      • WMIC.exe (PID: 3684)
      • WMIC.exe (PID: 2936)
      • WMIC.exe (PID: 3056)
      • WMIC.exe (PID: 2968)
      • cmd.exe (PID: 4064)
      • WMIC.exe (PID: 1692)
      • cmd.exe (PID: 2392)
      • cmd.exe (PID: 2624)
      • WMIC.exe (PID: 3748)
      • WMIC.exe (PID: 3652)
      • cmd.exe (PID: 2124)
      • cmd.exe (PID: 3104)
      • cmd.exe (PID: 2508)
      • cmd.exe (PID: 3056)
      • WMIC.exe (PID: 2188)
      • cmd.exe (PID: 1808)
      • cmd.exe (PID: 3840)
      • mode.com (PID: 3476)
      • WMIC.exe (PID: 1040)
      • cmd.exe (PID: 3648)
      • cmd.exe (PID: 2176)
      • mode.com (PID: 1828)
      • mode.com (PID: 4088)
      • cmd.exe (PID: 3336)
      • powershell.exe (PID: 3708)
      • powershell.exe (PID: 3896)
      • mode.com (PID: 1124)
      • powershell.exe (PID: 4068)
      • cmd.exe (PID: 2928)
      • mode.com (PID: 3892)
      • mode.com (PID: 3364)
      • cscript.exe (PID: 2700)
      • cscript.exe (PID: 348)
      • cscript.exe (PID: 2284)
      • cscript.exe (PID: 3384)
      • mode.com (PID: 3780)
      • cscript.exe (PID: 4008)
      • cscript.exe (PID: 1636)
      • cscript.exe (PID: 3048)
      • cscript.exe (PID: 3740)
      • cscript.exe (PID: 780)
      • cscript.exe (PID: 3376)
      • cscript.exe (PID: 3888)
      • cscript.exe (PID: 2732)
      • cscript.exe (PID: 2804)
      • cscript.exe (PID: 2792)
      • cscript.exe (PID: 2428)
      • cscript.exe (PID: 1124)
      • cscript.exe (PID: 3648)
      • cscript.exe (PID: 892)
      • cscript.exe (PID: 3348)
      • cscript.exe (PID: 2348)
      • cscript.exe (PID: 1620)
      • cscript.exe (PID: 2604)
      • cscript.exe (PID: 3360)
      • cscript.exe (PID: 2108)
      • cscript.exe (PID: 3404)
      • cscript.exe (PID: 944)
      • cscript.exe (PID: 3696)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 2948)
      • cscript.exe (PID: 1736)
      • cmd.exe (PID: 2820)
      • cmd.exe (PID: 372)
      • cscript.exe (PID: 2004)
      • cmd.exe (PID: 2984)

    • Application launched itself

      • cmd.exe (PID: 2948)
      • cmd.exe (PID: 2820)
      • cmd.exe (PID: 372)
      • cmd.exe (PID: 2984)

    • Executes scripts

      • cmd.exe (PID: 2948)
      • cmd.exe (PID: 2820)
      • cmd.exe (PID: 372)
      • cmd.exe (PID: 2984)

    • Reads the computer name

      • cscript.exe (PID: 1736)
      • powershell.exe (PID: 2908)
      • cscript.exe (PID: 3724)
      • cscript.exe (PID: 3820)
      • cscript.exe (PID: 3440)
      • cscript.exe (PID: 2252)
      • cscript.exe (PID: 3592)
      • cscript.exe (PID: 1972)
      • cscript.exe (PID: 2124)
      • cscript.exe (PID: 1852)
      • cscript.exe (PID: 2004)
      • WMIC.exe (PID: 3684)
      • WMIC.exe (PID: 3056)
      • powershell.exe (PID: 848)
      • WMIC.exe (PID: 2968)
      • WMIC.exe (PID: 2936)
      • WMIC.exe (PID: 1692)
      • WMIC.exe (PID: 3652)
      • WMIC.exe (PID: 3748)
      • WMIC.exe (PID: 2188)
      • WMIC.exe (PID: 1040)
      • powershell.exe (PID: 3708)
      • powershell.exe (PID: 4068)
      • powershell.exe (PID: 3896)
      • cscript.exe (PID: 348)
      • cscript.exe (PID: 2700)
      • cscript.exe (PID: 3384)
      • cscript.exe (PID: 2284)
      • cscript.exe (PID: 4008)
      • cscript.exe (PID: 1636)
      • cscript.exe (PID: 3048)
      • cscript.exe (PID: 3740)
      • cscript.exe (PID: 3376)
      • cscript.exe (PID: 2804)
      • cscript.exe (PID: 780)
      • cscript.exe (PID: 3888)
      • cscript.exe (PID: 2732)
      • cscript.exe (PID: 2792)
      • cscript.exe (PID: 2428)
      • cscript.exe (PID: 1124)
      • cscript.exe (PID: 3648)
      • cscript.exe (PID: 892)
      • cscript.exe (PID: 2348)
      • cscript.exe (PID: 3348)
      • cscript.exe (PID: 2604)
      • cscript.exe (PID: 1620)
      • cscript.exe (PID: 3360)
      • cscript.exe (PID: 2108)
      • cscript.exe (PID: 3404)
      • cscript.exe (PID: 944)
      • cscript.exe (PID: 3696)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 2948)
      • cmd.exe (PID: 2820)
      • cmd.exe (PID: 3144)
      • cmd.exe (PID: 1124)
      • cmd.exe (PID: 3460)
      • cmd.exe (PID: 372)
      • cmd.exe (PID: 2984)

    • Starts CHOICE.EXE (used to create a delay)

      • cmd.exe (PID: 2820)
      • cmd.exe (PID: 2984)

    • Creates files in the Windows directory

      • cmd.exe (PID: 2820)
      • cmd.exe (PID: 2984)

    • Removes files from Windows directory

      • cmd.exe (PID: 2820)
      • cmd.exe (PID: 2984)

    • Uses WMIC.EXE to obtain a system information

      • cmd.exe (PID: 2984)
      • cmd.exe (PID: 2624)
      • cmd.exe (PID: 2124)
      • cmd.exe (PID: 3104)
      • cmd.exe (PID: 1808)
      • cmd.exe (PID: 3056)

    • Executed via COM

      • slui.exe (PID: 3248)

  • INFO

    • Checks supported languages

      • reg.exe (PID: 3740)
      • findstr.exe (PID: 3676)
      • findstr.exe (PID: 3116)
      • reg.exe (PID: 2108)
      • choice.exe (PID: 3504)
      • findstr.exe (PID: 1736)
      • reg.exe (PID: 3188)
      • reg.exe (PID: 600)
      • reg.exe (PID: 3612)
      • reg.exe (PID: 2124)
      • reg.exe (PID: 1580)
      • reg.exe (PID: 572)
      • choice.exe (PID: 2972)
      • findstr.exe (PID: 1584)
      • choice.exe (PID: 3060)
      • reg.exe (PID: 580)
      • findstr.exe (PID: 3628)
      • choice.exe (PID: 948)
      • findstr.exe (PID: 3500)
      • choice.exe (PID: 2104)
      • reg.exe (PID: 3548)
      • findstr.exe (PID: 3520)
      • findstr.exe (PID: 3076)
      • findstr.exe (PID: 3240)
      • findstr.exe (PID: 1120)
      • findstr.exe (PID: 2920)
      • findstr.exe (PID: 3432)
      • findstr.exe (PID: 3252)
      • findstr.exe (PID: 2380)
      • findstr.exe (PID: 2828)
      • choice.exe (PID: 528)
      • findstr.exe (PID: 3576)
      • choice.exe (PID: 3572)
      • findstr.exe (PID: 2428)
      • reg.exe (PID: 3424)
      • choice.exe (PID: 284)
      • findstr.exe (PID: 3144)
      • choice.exe (PID: 2988)
      • choice.exe (PID: 2772)
      • choice.exe (PID: 2932)
      • findstr.exe (PID: 2284)
      • slui.exe (PID: 3248)
      • find.exe (PID: 2708)

    • Checks Windows Trust Settings

      • cscript.exe (PID: 1736)
      • powershell.exe (PID: 2908)
      • cscript.exe (PID: 3724)
      • cscript.exe (PID: 3820)
      • cscript.exe (PID: 3440)
      • cscript.exe (PID: 2252)
      • cscript.exe (PID: 3592)
      • cscript.exe (PID: 1972)
      • cscript.exe (PID: 2124)
      • cscript.exe (PID: 1852)
      • cscript.exe (PID: 2004)
      • powershell.exe (PID: 848)
      • powershell.exe (PID: 3708)
      • powershell.exe (PID: 3896)
      • powershell.exe (PID: 4068)
      • cscript.exe (PID: 2700)
      • cscript.exe (PID: 348)
      • cscript.exe (PID: 3384)
      • cscript.exe (PID: 4008)
      • cscript.exe (PID: 2284)
      • cscript.exe (PID: 3740)
      • cscript.exe (PID: 1636)
      • cscript.exe (PID: 3048)
      • cscript.exe (PID: 3376)
      • cscript.exe (PID: 3888)
      • cscript.exe (PID: 780)
      • cscript.exe (PID: 2732)
      • cscript.exe (PID: 2792)
      • cscript.exe (PID: 2804)
      • cscript.exe (PID: 2428)
      • cscript.exe (PID: 3648)
      • cscript.exe (PID: 892)
      • cscript.exe (PID: 1124)
      • cscript.exe (PID: 2348)
      • cscript.exe (PID: 2604)
      • cscript.exe (PID: 3348)
      • cscript.exe (PID: 3360)
      • cscript.exe (PID: 1620)
      • cscript.exe (PID: 2108)
      • cscript.exe (PID: 3404)
      • cscript.exe (PID: 3696)
      • cscript.exe (PID: 944)

    • Reads Microsoft Office registry keys

      • reg.exe (PID: 3612)

    • Manual execution by user

      • cmd.exe (PID: 372)

    • Reads the computer name

      • slui.exe (PID: 3248)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
192
Monitored processes
142
Malicious processes
6
Suspicious processes
5

Behavior graph

Click at the process to see the details
start cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs findstr.exe no specs reg.exe no specs cscript.exe no specs cmd.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs findstr.exe no specs reg.exe no specs mode.com no specs choice.exe no specs mode.com no specs cmd.exe no specs findstr.exe no specs powershell.exe no specs cscript.exe no specs cscript.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cscript.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs mode.com no specs choice.exe no specs findstr.exe no specs mode.com no specs choice.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs findstr.exe no specs reg.exe no specs cscript.exe no specs cmd.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs findstr.exe no specs reg.exe no specs mode.com no specs choice.exe no specs mode.com no specs choice.exe no specs mode.com no specs cmd.exe no specs findstr.exe no specs powershell.exe no specs cmd.exe no specs wmic.exe no specs findstr.exe no specs wmic.exe no specs wmic.exe no specs findstr.exe no specs wmic.exe no specs findstr.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs wmic.exe no specs findstr.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs mode.com no specs choice.exe no specs findstr.exe no specs mode.com no specs choice.exe no specs mode.com no specs choice.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs findstr.exe no specs reg.exe no specs mode.com no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs mode.com no specs choice.exe no specs mode.com no specs choice.exe no specs findstr.exe no specs mode.com no specs choice.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs slui.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs cscript.exe no specs find.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2948C:\Windows\system32\cmd.exe /c ""C:\Users\admin\Desktop\Activator.cmd" "C:\Windows\system32\cmd.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3396C:\Windows\system32\cmd.exe /c verC:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3488C:\Windows\system32\cmd.exe /c "prompt #$H#$E# & echo on & for %b in (1) do rem"C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3404cmd /v:on /c echo(^!param^!C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3676findstr /R "[| ` ~ ! @ % \^ & ( ) \[ \] { } + = ; ' , |]*^"C:\Windows\system32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3740reg query HKU\S-1-5-19 C:\Windows\system32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1736cscript /nologo "C:\Users\admin\AppData\Local\Temp\elev.vbs" C:\Windows\system32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
2820"C:\Windows\System32\cmd.exe" /c set -ElevError=Y&call "C:\Users\admin\Desktop\Activator.cmd" C:\Windows\System32\cmd.exe
cscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
3221225547
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2176C:\Windows\system32\cmd.exe /c verC:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2972C:\Windows\system32\cmd.exe /c "prompt #$H#$E# & echo on & for %b in (1) do rem"C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Total events
7 760
Read events
7 742
Write events
18
Delete events
0

Modification events

(PID) Process:(1736) cscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1736) cscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1736) cscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1736) cscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2004) cscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2004) cscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2004) cscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2004) cscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3248) slui.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Activation
Operation:writeName:LastAction
Value:
B212CA1803000000
(PID) Process:(3248) slui.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Activation
Operation:writeName:ActionId
Value:
58
Executable files
0
Suspicious files
10
Text files
8
Unknown types
1

Dropped files

PID
Process
Filename
Type
2820cmd.exeC:\Windows\Temp\MAS\Check-Activation-Status.cmdtext
MD5:C71B873C8D90B2FBD7A304289FFAFBB4
SHA256:E9373C98310A341E3613B1A37414EE57A3B9889D4F2823A40EDE9E55036D8E0F
2984cmd.exeC:\Windows\Temp\MAS\Online_KMS_Activation.cmdtext
MD5:F7A98DB620C7C91455FB1E4EAB6374EF
SHA256:0BDADF65AC15257DAE28ACD0A95F3DEF0F081CDB32A27388FF4724B8E5B1CF25
2984cmd.exeC:\Windows\Temp\MAS\Check-Activation-Status-Alternative.cmdtext
MD5:AFE40D9F16B2D451E99420ED7AEEC91E
SHA256:C751A47E26DD21A1B60A02381841713EA373521AC040788D4B3945A7490A8E93
2908powershell.exeC:\Users\admin\AppData\Local\Temp\d4wtoftt.tho.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
2908powershell.exeC:\Users\admin\AppData\Local\Temp\5zfzksm1.ucr.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
848powershell.exeC:\Users\admin\AppData\Local\Temp\vvznbckx.5mi.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
4068powershell.exeC:\Users\admin\AppData\Local\Temp\3yu5yguu.gyc.psm1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
4068powershell.exeC:\Users\admin\AppData\Local\Temp\ooqmkxki.bqj.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
2820cmd.exeC:\Users\admin\AppData\Local\Temp\==== ERROR ====text
MD5:DF66FA563A2FAFDB93CC559DEB0A38C4
SHA256:3E39ED22DC63246937C4DBBF34CE4FB1CFE6B00DE7596B020CAD49AE50031351
3896powershell.exeC:\Users\admin\AppData\Local\Temp\qv3f3pgz.grw.ps1binary
MD5:C4CA4238A0B923820DCC509A6F75849B
SHA256:6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3232
sppsvc.exe
104.168.47.39:1688
kms7.MSGuides.com
ColoCrossing
US
unknown

DNS requests

Domain
IP
Reputation
kms7.MSGuides.com
  • 104.168.47.39
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Activator.cmd