File name:

FolderPainter_x64.exe

Full analysis: https://app.any.run/tasks/b13b85f3-109e-4d3a-9b95-2afdf28433a0
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: July 28, 2025, 14:27:14
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
autoit
auto-sch
sheetrat
rat
pastebin
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows, 2 sections
MD5:

E6A85CCFFA9749DF533FDA5D0D4345E9

SHA1:

04F9F5A398478F99EF32A9499EAFD7DB0DD074BB

SHA256:

78FC7C15DE71DBDE8305B1127B0A31CAA49AE65879569469409812F287C96C45

SSDEEP:

24576:neQi8iBqJc5/+WbD7rP0xQvlTNN/dvhyvJixMAkef6p9G9gA9AIidIiWJwPmsTD3:neQi8iBqJc5/+WbD7rP0xQvlTNN/dvhc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 5876)

    • Changes powershell execution policy (Bypass)

      • FolderPainter_x64.exe (PID: 3980)

    • Adds path to the Windows Defender exclusion list

      • FolderPainter_x64.exe (PID: 3980)

    • Changes Windows Defender settings

      • FolderPainter_x64.exe (PID: 3980)

    • Changes the autorun value in the registry

      • FolderPainter_x64.exe (PID: 3980)
      • Client.exe (PID: 4012)

    • Uses Task Scheduler to autorun other applications

      • cmd.exe (PID: 6180)

    • SHEETRAT mutex has been found

      • Client.exe (PID: 4012)
      • Client.exe (PID: 4520)

    • Changes the AppInit_DLLs value (autorun option)

      • Client.exe (PID: 4012)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 6224)
      • cmd.exe (PID: 5468)
      • cmd.exe (PID: 4112)
      • cmd.exe (PID: 1380)
      • cmd.exe (PID: 5348)
      • cmd.exe (PID: 6764)
      • cmd.exe (PID: 2400)
      • cmd.exe (PID: 6540)
      • cmd.exe (PID: 3944)
      • cmd.exe (PID: 1612)
      • cmd.exe (PID: 7000)
      • cmd.exe (PID: 6412)
      • cmd.exe (PID: 4684)
      • cmd.exe (PID: 1380)
      • cmd.exe (PID: 4768)
      • cmd.exe (PID: 1180)
      • cmd.exe (PID: 3960)
      • cmd.exe (PID: 6808)
      • cmd.exe (PID: 3860)
      • cmd.exe (PID: 2132)
      • cmd.exe (PID: 4688)
      • cmd.exe (PID: 6016)
      • cmd.exe (PID: 1576)
      • cmd.exe (PID: 2140)
      • cmd.exe (PID: 4844)
      • cmd.exe (PID: 5772)
      • cmd.exe (PID: 6680)
      • cmd.exe (PID: 5080)
      • cmd.exe (PID: 6332)
      • cmd.exe (PID: 2232)
      • cmd.exe (PID: 2504)
      • cmd.exe (PID: 3844)
      • cmd.exe (PID: 6036)
      • cmd.exe (PID: 2096)
      • cmd.exe (PID: 2848)
      • cmd.exe (PID: 6148)
      • cmd.exe (PID: 2880)
      • cmd.exe (PID: 5652)
      • cmd.exe (PID: 4024)

    • Changes the login/logoff helper path in the registry

      • Client.exe (PID: 4012)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • FolderPainter_x64.exe (PID: 3980)
      • FolderPainter_x64.exe (PID: 6956)
      • Client.exe (PID: 4012)

    • Reads the date of Windows installation

      • FolderPainter_x64.exe (PID: 3980)
      • FolderPainter_x64.exe (PID: 4944)
      • Client.exe (PID: 4476)
      • Client.exe (PID: 2276)

    • Reads security settings of Internet Explorer

      • FolderPainter_x64.exe (PID: 3980)
      • FolderPainter_x64.exe (PID: 4944)
      • FolderPainter_x64.exe (PID: 6956)
      • Client.exe (PID: 4476)
      • Client.exe (PID: 2276)

    • Script adds exclusion path to Windows Defender

      • FolderPainter_x64.exe (PID: 3980)

    • Starts POWERSHELL.EXE for commands execution

      • FolderPainter_x64.exe (PID: 3980)

    • Application launched itself

      • FolderPainter_x64.exe (PID: 4944)
      • Client.exe (PID: 4476)
      • Client.exe (PID: 2276)

    • Starts CMD.EXE for commands execution

      • Client.exe (PID: 4012)
      • Client.exe (PID: 4520)
      • xdwdNode.js.exe (PID: 5980)
      • xdwdMicrosoft Edge DevTools.exe (PID: 4888)

    • Connects to unusual port

      • Client.exe (PID: 4012)

  • INFO

    • Reads the machine GUID from the registry

      • FolderPainter_x64.exe (PID: 3980)
      • Client.exe (PID: 4476)
      • Client.exe (PID: 4012)

    • The sample compiled with english language support

      • FolderPainter_x64.exe (PID: 3980)
      • FolderPainter_x64.exe (PID: 6956)

    • Reads the computer name

      • FolderPainter_x64.exe (PID: 3980)
      • FolderPainter_x64.exe (PID: 4944)
      • FolderPainter_x64.exe (PID: 6956)
      • Client.exe (PID: 4476)
      • Client.exe (PID: 2276)
      • Client.exe (PID: 4012)
      • Client.exe (PID: 4520)
      • xdwdNode.js.exe (PID: 5980)
      • xdwdMicrosoft Edge DevTools.exe (PID: 4888)

    • Checks supported languages

      • FolderPainter_x64.exe (PID: 3980)
      • FolderPainter_x64.exe (PID: 4944)
      • FolderPainter_x64.exe (PID: 6956)
      • Client.exe (PID: 4476)
      • Client.exe (PID: 2276)
      • Client.exe (PID: 4012)
      • Client.exe (PID: 4520)
      • xdwdNode.js.exe (PID: 5980)
      • xdwdMicrosoft Edge DevTools.exe (PID: 4888)

    • Reads mouse settings

      • FolderPainter_x64.exe (PID: 4944)
      • FolderPainter_x64.exe (PID: 6956)

    • Create files in a temporary directory

      • FolderPainter_x64.exe (PID: 3980)
      • FolderPainter_x64.exe (PID: 4944)
      • FolderPainter_x64.exe (PID: 6956)

    • Process checks computer location settings

      • FolderPainter_x64.exe (PID: 3980)
      • FolderPainter_x64.exe (PID: 4944)
      • Client.exe (PID: 4476)
      • Client.exe (PID: 2276)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 5876)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 5876)

    • Launching a file from a Registry key

      • FolderPainter_x64.exe (PID: 3980)
      • Client.exe (PID: 4012)

    • Creates files in the program directory

      • FolderPainter_x64.exe (PID: 6956)
      • Client.exe (PID: 4012)

    • Manual execution by a user

      • Client.exe (PID: 2276)
      • xdwdNode.js.exe (PID: 5980)
      • xdwdMicrosoft Edge DevTools.exe (PID: 4888)

    • The process uses AutoIt

      • FolderPainter_x64.exe (PID: 6956)

    • Creates files or folders in the user directory

      • Client.exe (PID: 4012)

    • Launching a file from Task Scheduler

      • cmd.exe (PID: 6224)
      • cmd.exe (PID: 4112)
      • cmd.exe (PID: 5468)
      • cmd.exe (PID: 1380)
      • cmd.exe (PID: 5348)
      • cmd.exe (PID: 6764)
      • cmd.exe (PID: 1612)
      • cmd.exe (PID: 7000)
      • cmd.exe (PID: 2400)
      • cmd.exe (PID: 6540)
      • cmd.exe (PID: 3944)
      • cmd.exe (PID: 6412)
      • cmd.exe (PID: 4684)
      • cmd.exe (PID: 1380)
      • cmd.exe (PID: 4768)
      • cmd.exe (PID: 1180)
      • cmd.exe (PID: 3960)
      • cmd.exe (PID: 1576)
      • cmd.exe (PID: 6808)
      • cmd.exe (PID: 5772)
      • cmd.exe (PID: 4688)
      • cmd.exe (PID: 2132)
      • cmd.exe (PID: 6016)
      • cmd.exe (PID: 2140)
      • cmd.exe (PID: 4844)
      • cmd.exe (PID: 6036)
      • cmd.exe (PID: 5080)
      • cmd.exe (PID: 6332)
      • cmd.exe (PID: 2232)
      • cmd.exe (PID: 2504)
      • cmd.exe (PID: 3860)
      • cmd.exe (PID: 3844)
      • cmd.exe (PID: 6680)
      • cmd.exe (PID: 2880)
      • cmd.exe (PID: 6148)
      • cmd.exe (PID: 2096)
      • cmd.exe (PID: 5652)
      • cmd.exe (PID: 4024)
      • cmd.exe (PID: 2848)

    • Disables trace logs

      • Client.exe (PID: 4012)

    • Checks proxy server information

      • Client.exe (PID: 4012)
      • slui.exe (PID: 1216)

    • Reads the software policy settings

      • Client.exe (PID: 4012)
      • slui.exe (PID: 1216)

    • Reads Environment values

      • Client.exe (PID: 4012)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:07:28 14:10:03+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 11
CodeSize: 721408
InitializedDataSize: 57856
UninitializedDataSize: -
EntryPoint: 0x0000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 1.0.0.0
InternalName: XBinderOutput.exe
LegalCopyright:
OriginalFileName: XBinderOutput.exe
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
277
Monitored processes
139
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start folderpainter_x64.exe folderpainter_x64.exe no specs powershell.exe no specs conhost.exe no specs folderpainter_x64.exe client.exe no specs client.exe no specs #SHEETRAT client.exe #SHEETRAT client.exe cmd.exe conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs xdwdnode.js.exe no specs xdwdmicrosoft edge devtools.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs svchost.exe cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs slui.exe cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
432\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
768SchTaSKs /create /f /sc minute /mo -1 /tn "Google Chrome" /tr "C:\Program Files\xdwdNode.js.exe" /RL HIGHEST C:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
2147500037
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1180"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Chrome" /tr "C:\Program Files\xdwdNode.js.exe" /RL HIGHEST & exitC:\Windows\System32\cmd.exe—Client.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
2147500037
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1192SchTaSKs /create /f /sc minute /mo -1 /tn "Google Chrome" /tr "C:\Program Files\xdwdNode.js.exe" /RL HIGHEST C:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
2147500037
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1204SchTaSKs /create /f /sc minute /mo -1 /tn "Google Chrome" /tr "C:\Program Files\xdwdNode.js.exe" /RL HIGHEST C:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
2147500037
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1216C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1380"CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Sage 50 Update" /tr "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\xdwdMicrosoft Edge DevTools.exe" /RL HIGHEST & exitC:\Windows\System32\cmd.exe—Client.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1380"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Chrome" /tr "C:\Program Files\xdwdNode.js.exe" /RL HIGHEST & exitC:\Windows\System32\cmd.exe—Client.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
2147500037
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1576"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Chrome" /tr "C:\Program Files\xdwdNode.js.exe" /RL HIGHEST & exitC:\Windows\System32\cmd.exe—Client.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
2147500037
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1612"CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "Google Chrome" /tr "C:\Program Files\xdwdNode.js.exe" /RL HIGHEST & exitC:\Windows\System32\cmd.exe—Client.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
2147500037
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
Total events
23 336
Read events
22 856
Write events
300
Delete events
180

Modification events

(PID) Process:(3980) FolderPainter_x64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Client
Value:
C:\Users\admin\AppData\Local\Temp\Client.exe
(PID) Process:(6956) FolderPainter_x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\zFolderPainter_01
Operation:writeName:MUIVerb
Value:
Change Folder Icon
(PID) Process:(6956) FolderPainter_x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\zFolderPainter_01
Operation:writeName:SubCommands
Value:
(PID) Process:(6956) FolderPainter_x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\zFolderPainter_01
Operation:writeName:Icon
Value:
C:\Program Files\FolderPainter\Icons\Pack_01\00.ico
(PID) Process:(6956) FolderPainter_x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\zFolderPainter_01\shell\00
Operation:writeName:MUIVerb
Value:
&Default Folder Icon
(PID) Process:(6956) FolderPainter_x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\zFolderPainter_01\shell\00
Operation:writeName:Icon
Value:
%SystemRoot%\system32\shell32.dll,3
(PID) Process:(6956) FolderPainter_x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\zFolderPainter_01\shell\15
Operation:writeName:CommandFlags
Value:
32
(PID) Process:(6956) FolderPainter_x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\zFolderPainter_01\shell\15
Operation:writeName:MUIVerb
Value:
&Launch Folder Painter
(PID) Process:(6956) FolderPainter_x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory\shell\zFolderPainter_01\shell\15
Operation:writeName:Icon
Value:
C:\Program Files\FolderPainter\FolderPainter.exe
(PID) Process:(6956) FolderPainter_x64.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:GlobalAssocChangedCounter
Value:
19
Executable files
6
Suspicious files
3
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
3980FolderPainter_x64.exeC:\Users\admin\AppData\Local\Temp\FolderPainter_x64.exeexecutable
MD5:882119E099B8CF263918F1F7F3F475EE
SHA256:6587598990D5D107E3BC496801D55F4231CCDF5695B99A0F2AFD51343D4A4259
4944FolderPainter_x64.exeC:\Users\admin\AppData\Local\Temp\maexcmvtext
MD5:AA53576E58734C91BF7B941DA99B8CA5
SHA256:E6E212700136A61F53BA0E9E1B94A70C37B8E0B87255FEEF693135D0B9F9C6A4
5876powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_rrufscng.ogz.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5876powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_qbosnwuk.bri.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6956FolderPainter_x64.exeC:\Program Files\FolderPainter\FolderPainter.exeexecutable
MD5:882119E099B8CF263918F1F7F3F475EE
SHA256:6587598990D5D107E3BC496801D55F4231CCDF5695B99A0F2AFD51343D4A4259
6956FolderPainter_x64.exeC:\Users\admin\AppData\Local\Temp\autE308.tmpbinary
MD5:336B74425DAD07ABB2F75B76399D2DE7
SHA256:C6FCD28DAE3597F9C8BDB87308A5514A2BB313A772A818F85BDF980D2264CA32
3980FolderPainter_x64.exeC:\Users\admin\AppData\Local\Temp\Client.exeexecutable
MD5:01858E434CB77EA0DB00A60650700C03
SHA256:B4D21180C1F0DAF892FBAA8806BD37550BBD3FC2E8849397B557DE4F31E60596
6956FolderPainter_x64.exeC:\Users\admin\AppData\Local\Temp\vpkkmzetext
MD5:AA53576E58734C91BF7B941DA99B8CA5
SHA256:E6E212700136A61F53BA0E9E1B94A70C37B8E0B87255FEEF693135D0B9F9C6A4
4012Client.exeC:\Program Files\xdwdNode.js.exeexecutable
MD5:01858E434CB77EA0DB00A60650700C03
SHA256:B4D21180C1F0DAF892FBAA8806BD37550BBD3FC2E8849397B557DE4F31E60596
5876powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:7D7F5D5AD6B418A37F06B3698B88E0F0
SHA256:EE4C51FE9BA20DF74CDD48AACFC9F26A5E0A6ACFFB8837F069CAAD6D7A6A4E9E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
52
TCP/UDP connections
71
DNS requests
23
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5944
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3944
RUXIMICS.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5944
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3944
RUXIMICS.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
200
40.126.31.0:443
https://login.live.com/RST2.srf
unknown
xml
1.24 Kb
whitelisted
—
—
POST
400
20.190.160.14:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
400
40.126.32.72:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
—
—
POST
400
20.190.159.23:443
https://login.live.com/ppsecure/deviceaddcredential.srf
unknown
text
203 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3944
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3944
RUXIMICS.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5944
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
  • 20.73.194.208
whitelisted
google.com
  • 142.250.186.142
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
login.live.com
  • 40.126.31.71
  • 20.190.159.130
  • 20.190.159.131
  • 20.190.159.75
  • 40.126.31.0
  • 20.190.159.0
  • 20.190.159.2
  • 20.190.159.68
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
pastebin.com
  • 172.66.171.73
  • 104.20.29.150
whitelisted
group-rates.gl.at.ply.gg
  • 147.185.221.29
unknown
self.events.data.microsoft.com
  • 52.168.117.171
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Online Pastebin Text Storage
2200
svchost.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Suspected domain Associated with Malware Distribution (.ply .gg)
2200
svchost.exe
Potentially Bad Traffic
ET INFO playit .gg Tunneling Domain in DNS Lookup
2200
svchost.exe
Misc activity
ET TA_ABUSED_SERVICES Tunneling Service in DNS Lookup (* .ply .gg)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
FolderPainter_x64.exe