File name:

79629ab0850f3dd1f61b13a3fd69570425faca6b15a4b453b9a2e0834ee9728e

Full analysis: https://app.any.run/tasks/4de6a118-4af4-4779-9b2c-351fe75e9314
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 11, 2024, 19:47:18
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
github
loader
evasion
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 7 sections
MD5:

F5BD4BBC494017262A22785E5B53F316

SHA1:

EED0865613144EBA454454D91A2B92FC2717C068

SHA256:

79629AB0850F3DD1F61B13A3FD69570425FACA6B15A4B453B9A2E0834EE9728E

SSDEEP:

49152:TLMuqgNrzApjJdVxyTT+bKBtxbpNPEzP4gwki7MaLztzYtje:XMuqgNHARI++bpNPEzP4bk3sS

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts CMD.EXE for self-deleting

      • 79629ab0850f3dd1f61b13a3fd69570425faca6b15a4b453b9a2e0834ee9728e.exe (PID: 648)
      • curlapp64.exe (PID: 2212)
      • printui.exe (PID: 3620)
      • bav64.exe (PID: 2012)

    • Changes the autorun value in the registry

      • curlapp64.exe (PID: 2212)

    • Adds path to the Windows Defender exclusion list

      • printui.exe (PID: 3620)
      • cmd.exe (PID: 244)
      • cmd.exe (PID: 1476)
      • cmd.exe (PID: 880)
      • cmd.exe (PID: 3884)
      • bav64.exe (PID: 2012)
      • cmd.exe (PID: 644)
      • cmd.exe (PID: 5244)
      • cmd.exe (PID: 5496)
      • cmd.exe (PID: 4500)
      • cmd.exe (PID: 1348)
      • cmd.exe (PID: 5728)
      • cmd.exe (PID: 2572)
      • cmd.exe (PID: 5892)
      • cmd.exe (PID: 5128)
      • cmd.exe (PID: 5028)
      • cmd.exe (PID: 1616)
      • cmd.exe (PID: 4716)
      • cmd.exe (PID: 4056)
      • cmd.exe (PID: 5568)
      • svchost.exe (PID: 3188)
      • cmd.exe (PID: 3060)
      • cmd.exe (PID: 3820)
      • cmd.exe (PID: 3128)
      • cmd.exe (PID: 2456)

    • Uses Task Scheduler to autorun other applications

      • cmd.exe (PID: 1480)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 79629ab0850f3dd1f61b13a3fd69570425faca6b15a4b453b9a2e0834ee9728e.exe (PID: 648)
      • curlapp64.exe (PID: 2212)
      • printui.exe (PID: 3620)

    • Starts CMD.EXE for commands execution

      • 79629ab0850f3dd1f61b13a3fd69570425faca6b15a4b453b9a2e0834ee9728e.exe (PID: 648)
      • printui.exe (PID: 3620)
      • curlapp64.exe (PID: 2212)
      • bav64.exe (PID: 2012)
      • console_zero.exe (PID: 5000)
      • svchost.exe (PID: 3188)

    • Created directory related to system

      • cmd.exe (PID: 1744)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 3724)
      • cmd.exe (PID: 5304)
      • cmd.exe (PID: 4628)
      • cmd.exe (PID: 1480)
      • cmd.exe (PID: 5980)

    • Process drops legitimate windows executable

      • curlapp64.exe (PID: 2212)
      • printui.exe (PID: 3620)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 3928)
      • cmd.exe (PID: 244)
      • cmd.exe (PID: 880)
      • cmd.exe (PID: 1476)
      • cmd.exe (PID: 5244)
      • cmd.exe (PID: 2572)
      • cmd.exe (PID: 3884)
      • cmd.exe (PID: 644)
      • cmd.exe (PID: 5496)
      • cmd.exe (PID: 1348)
      • cmd.exe (PID: 4500)
      • cmd.exe (PID: 5728)
      • cmd.exe (PID: 5028)
      • cmd.exe (PID: 5892)
      • cmd.exe (PID: 1616)
      • cmd.exe (PID: 5128)
      • cmd.exe (PID: 5568)
      • cmd.exe (PID: 4716)
      • cmd.exe (PID: 4056)
      • cmd.exe (PID: 3060)
      • cmd.exe (PID: 3128)
      • cmd.exe (PID: 3820)
      • cmd.exe (PID: 2456)

    • Possibly malicious use of IEX has been detected

      • cmd.exe (PID: 3928)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 4544)

    • The process drops C-runtime libraries

      • printui.exe (PID: 3620)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 4872)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 4872)

    • Script adds exclusion path to Windows Defender

      • cmd.exe (PID: 244)
      • cmd.exe (PID: 1476)
      • cmd.exe (PID: 880)
      • cmd.exe (PID: 3884)
      • cmd.exe (PID: 644)
      • cmd.exe (PID: 5244)
      • cmd.exe (PID: 5496)
      • cmd.exe (PID: 2572)
      • cmd.exe (PID: 1348)
      • cmd.exe (PID: 4500)
      • cmd.exe (PID: 5728)
      • cmd.exe (PID: 5892)
      • cmd.exe (PID: 5028)
      • cmd.exe (PID: 1616)
      • cmd.exe (PID: 5128)
      • cmd.exe (PID: 4056)
      • cmd.exe (PID: 5568)
      • cmd.exe (PID: 4716)
      • cmd.exe (PID: 3060)
      • cmd.exe (PID: 3820)
      • cmd.exe (PID: 2456)
      • cmd.exe (PID: 3128)

    • The process deletes folder without confirmation

      • printui.exe (PID: 3620)

    • Connects to unusual port

      • svchost.exe (PID: 3188)

    • Checks for external IP

      • svchost.exe (PID: 2192)
      • svchost.exe (PID: 3188)

  • INFO

    • Checks supported languages

      • curlapp64.exe (PID: 2212)
      • printui.exe (PID: 3620)
      • 79629ab0850f3dd1f61b13a3fd69570425faca6b15a4b453b9a2e0834ee9728e.exe (PID: 648)
      • console_zero.exe (PID: 5000)

    • Creates a new folder

      • cmd.exe (PID: 1744)

    • Reads the computer name

      • curlapp64.exe (PID: 2212)

    • The process uses the downloaded file

      • cmd.exe (PID: 1144)

    • The sample compiled with english language support

      • curlapp64.exe (PID: 2212)
      • printui.exe (PID: 3620)
      • 79629ab0850f3dd1f61b13a3fd69570425faca6b15a4b453b9a2e0834ee9728e.exe (PID: 648)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 4544)
      • powershell.exe (PID: 5028)
      • powershell.exe (PID: 5732)
      • powershell.exe (PID: 5128)
      • powershell.exe (PID: 772)
      • powershell.exe (PID: 6096)
      • powershell.exe (PID: 2408)
      • powershell.exe (PID: 5732)
      • powershell.exe (PID: 1620)
      • powershell.exe (PID: 3920)
      • powershell.exe (PID: 5096)
      • powershell.exe (PID: 2776)
      • powershell.exe (PID: 5980)
      • powershell.exe (PID: 4668)
      • powershell.exe (PID: 5268)
      • powershell.exe (PID: 4020)
      • powershell.exe (PID: 4500)
      • powershell.exe (PID: 1448)
      • powershell.exe (PID: 1412)
      • powershell.exe (PID: 3952)
      • powershell.exe (PID: 488)
      • powershell.exe (PID: 5736)
      • powershell.exe (PID: 4944)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 4544)
      • powershell.exe (PID: 5028)
      • powershell.exe (PID: 5732)
      • powershell.exe (PID: 5128)
      • powershell.exe (PID: 772)
      • powershell.exe (PID: 6096)
      • powershell.exe (PID: 2408)
      • powershell.exe (PID: 5732)
      • powershell.exe (PID: 5096)
      • powershell.exe (PID: 2776)
      • powershell.exe (PID: 1620)
      • powershell.exe (PID: 3920)
      • powershell.exe (PID: 5980)
      • powershell.exe (PID: 4668)
      • powershell.exe (PID: 5268)
      • powershell.exe (PID: 4020)
      • powershell.exe (PID: 4500)
      • powershell.exe (PID: 1448)
      • powershell.exe (PID: 1412)
      • powershell.exe (PID: 488)
      • powershell.exe (PID: 5736)
      • powershell.exe (PID: 3952)
      • powershell.exe (PID: 4944)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:11:05 14:38:53+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.41
CodeSize: 182784
InitializedDataSize: 1517056
UninitializedDataSize: -
EntryPoint: 0x139d0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
212
Monitored processes
95
Malicious processes
8
Suspicious processes
23

Behavior graph

Click at the process to see the details
start 79629ab0850f3dd1f61b13a3fd69570425faca6b15a4b453b9a2e0834ee9728e.exe cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs curlapp64.exe timeout.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs printui.exe no specs printui.exe no specs printui.exe cmd.exe no specs conhost.exe no specs timeout.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs reg.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs console_zero.exe no specs cmd.exe no specs conhost.exe no specs bav64.exe no specs conhost.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs timeout.exe no specs cmd.exe no specs conhost.exe no specs timeout.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs timeout.exe no specs cmd.exe conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs svchost.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
236\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
244cmd.exe /c powershell -Command "Add-MpPreference -ExclusionPath '%SystemDrive%\Windows \System32'; Add-MpPreference -ExclusionPath '%SystemDrive%\Windows\System32';"C:\Windows\System32\cmd.exe—printui.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
488powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows \System32'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\atl.dll
536\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
556\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
644cmd.exe /c powershell -Command "Remove-MpPreference -ExclusionPath 'C:\ProgramData'"C:\Windows\System32\cmd.exe—bav64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
648"C:\Users\admin\Desktop\79629ab0850f3dd1f61b13a3fd69570425faca6b15a4b453b9a2e0834ee9728e.exe" C:\Users\admin\Desktop\79629ab0850f3dd1f61b13a3fd69570425faca6b15a4b453b9a2e0834ee9728e.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\79629ab0850f3dd1f61b13a3fd69570425faca6b15a4b453b9a2e0834ee9728e.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
772powershell -Command "Remove-MpPreference -ExclusionPath 'C:\Users\'"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
880cmd.exe /c powershell -Command "Remove-MpPreference -ExclusionPath 'C:\Users'"C:\Windows\System32\cmd.exe—bav64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1144cmd.exe /c start "" "C:\Windows \System32\printui.exe"C:\Windows\System32\cmd.exe—curlapp64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
Total events
123 919
Read events
123 908
Write events
6
Delete events
5

Modification events

(PID) Process:(2212) curlapp64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:curlapp64
Value:
C:\Users\admin\Desktop\curlapp64.exe
(PID) Process:(2212) curlapp64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:curlapp64
Value:
C:\Users\admin\Desktop\curlapp64.exe
(PID) Process:(3620) printui.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\PrinterInstallation
Operation:writeName:UIEntry
Value:
10
(PID) Process:(3620) printui.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\Power
Operation:writeName:HiberbootEnabled
Value:
0
(PID) Process:(3620) printui.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost
Operation:writeName:DcomLaunch
Value:
Power
(PID) Process:(1348) reg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\x783762\Parameters
Operation:writeName:ServiceDll
Value:
C:\Windows\System32\x783762.dat
(PID) Process:(2012) bav64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:MicrosoftEdgeAutoLaunch_29EBC4579851B72EE312C449CF839B1A
Value:
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
(PID) Process:(2012) bav64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:Skype for Desktop
Value:
C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
(PID) Process:(2012) bav64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:CCleaner Smart Cleaning
Value:
"C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
(PID) Process:(3620) printui.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\PrinterInstallation
Operation:delete keyName:(default)
Value:
Executable files
20
Suspicious files
3
Text files
54
Unknown types
0

Dropped files

PID
Process
Filename
Type
64879629ab0850f3dd1f61b13a3fd69570425faca6b15a4b453b9a2e0834ee9728e.exeC:\Users\admin\Desktop\libcurl.dllexecutable
MD5:18CE47F58B4C1A9CFC1EDF7C8BF49B7C
SHA256:36D97F1C254832CEE9698CEA2F1A63EA98D231641FD29715EF581BE103ACE602
3620printui.exeC:\Windows\System32\libssl-3-x64.dllexecutable
MD5:69D0FEE0CC47C3B255C317F08CE8D274
SHA256:BA979C2DBFB35D205D9D28D97D177F33D501D954C7187330F6893BB7D0858713
64879629ab0850f3dd1f61b13a3fd69570425faca6b15a4b453b9a2e0834ee9728e.exeC:\Users\admin\Desktop\curlapp64.exeexecutable
MD5:990DCC08D59B375A75DD575701DD2AA4
SHA256:13A8862BE683AD1298C8E60692C274B9F62C454A26A11841031D53F2B90BEDCC
3620printui.exeC:\Windows\System32\libwinpthread-1.dllexecutable
MD5:9DC829C2C8962347BC9ADF891C51AC05
SHA256:FFE2D56375BB4E8BDEE9037DF6BEFC5016DDD8871D0D85027314DD5792F8FDC9
4544powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:A50D3C69D0111163AF35151501FE4710
SHA256:D939A40FD892817445C4C238A45E2D7CF139CBCAF508F2B97D878B518DC5B22D
3620printui.exeC:\Windows\System32\libcrypto-3-x64.dllexecutable
MD5:158F0E7C4529E3867E07545C6D1174A9
SHA256:DCC1FA1A341597DDB1476E3B5B3952456F07870A26FC30B0C6E6312764BAA1FC
3620printui.exeC:\Windows\System32\libcurl.dllexecutable
MD5:18CE47F58B4C1A9CFC1EDF7C8BF49B7C
SHA256:36D97F1C254832CEE9698CEA2F1A63EA98D231641FD29715EF581BE103ACE602
3620printui.exeC:\Windows\System32\svcldr64.datexecutable
MD5:DC1130797B2661AC54DA728D9D26D433
SHA256:4121A5FBCA33176256997F4B6F23352D39D68EC13967A45A03A0CDA056FAFF3A
2212curlapp64.exeC:\Users\admin\Desktop\prnttemp.dllexecutable
MD5:A2D2E1A778727BB4D04F1186B3E35BFD
SHA256:5B9E8C091D03A9E0F078C9B949EB6650315ACA2AE6912A8885F1F4FA656700FE
2212curlapp64.exeC:\Windows \System32\printui.dllexecutable
MD5:A2D2E1A778727BB4D04F1186B3E35BFD
SHA256:5B9E8C091D03A9E0F078C9B949EB6650315ACA2AE6912A8885F1F4FA656700FE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
30
DNS requests
12
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
HEAD
302
140.82.121.4:443
https://github.com/botrunvd01/botdwl/raw/main/botprnt.dat
unknown
—
—
—
5892
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.138:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5892
svchost.exe
GET
200
23.48.23.138:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
HEAD
200
140.82.121.4:443
https://raw.githubusercontent.com/botrunvd01/botdwl/main/botprnt.dat
unknown
—
—
—
4712
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
302
140.82.121.4:443
https://github.com/botrunvd01/botdwl/raw/main/botprnt.dat
unknown
—
—
—
3188
svchost.exe
HEAD
404
45.94.31.128:80
http://unvdwl.com/un2/unvurestorehard.dat
unknown
—
—
malicious
3188
svchost.exe
HEAD
404
45.94.31.128:80
http://unvdwl.com/un2/unvurestorehard.dat
unknown
—
—
malicious
—
—
GET
200
34.117.59.81:443
https://ipinfo.io/json
unknown
binary
252 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5892
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
92.123.104.30:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2212
curlapp64.exe
140.82.121.4:443
github.com
GITHUB
US
shared
5892
svchost.exe
23.48.23.138:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.138:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5892
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
www.bing.com
  • 92.123.104.30
  • 92.123.104.32
  • 92.123.104.23
  • 92.123.104.22
  • 92.123.104.31
  • 92.123.104.11
  • 92.123.104.26
  • 92.123.104.38
  • 92.123.104.33
whitelisted
google.com
  • 142.250.186.46
whitelisted
github.com
  • 140.82.121.4
shared
crl.microsoft.com
  • 23.48.23.138
  • 23.48.23.137
  • 23.48.23.143
  • 23.48.23.162
  • 23.48.23.193
  • 23.48.23.183
  • 23.48.23.169
  • 23.48.23.194
  • 23.48.23.141
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
raw.githubusercontent.com
  • 185.199.108.133
  • 185.199.110.133
  • 185.199.111.133
  • 185.199.109.133
shared
self.events.data.microsoft.com
  • 20.50.201.204
whitelisted
rootunvbot.com
  • 188.116.21.204
unknown
ipinfo.io
  • 34.117.59.81
shared

Threats

PID
Process
Class
Message
2192
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
3188
svchost.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup SSL Cert Observed (ipinfo .io)
2192
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ipinfo .io)
3188
svchost.exe
Device Retrieving External IP Address Detected
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
3188
svchost.exe
Device Retrieving External IP Address Detected
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
3188
svchost.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup SSL Cert Observed (ipinfo .io)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
79629ab0850f3dd1f61b13a3fd69570425faca6b15a4b453b9a2e0834ee9728e