File name:

DefenderRemover.exe

Full analysis: https://app.any.run/tasks/1779db99-dd46-4c4b-88fd-789939dffbe2
Verdict: Malicious activity
Analysis date: April 25, 2025, 13:35:14
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

29DF6172DA4B804F803E8987F6DF4CEA

SHA1:

301CC52CB52207712FAC2E287D1E4ED8B17E253B

SHA256:

7D5785C1760909AC5DC68CE57AABCF86AF2444AE42E19B568EB1E32D8A414913

SSDEEP:

24576:ghUhnNLVkbQOLIArg79Ie2cLKifsRHFhU4Ccqpzz4hzhm:ghUhnNLVkcOLIArg79Ie2cLKifsRHFhu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 2096)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 4620)

    • Changes Security Center notification settings

      • regedit.exe (PID: 1628)
      • regedit.exe (PID: 2772)

    • Disables Windows Defender

      • regedit.exe (PID: 1628)
      • regedit.exe (PID: 2772)

    • UAC/LUA settings modification

      • regedit.exe (PID: 5528)

  • SUSPICIOUS

    • Executing commands from a ".bat" file

      • DefenderRemover.exe (PID: 4776)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 2096)

    • Executable content was dropped or overwritten

      • DefenderRemover.exe (PID: 4776)
      • powershell.exe (PID: 4620)

    • The process executes Powershell scripts

      • cmd.exe (PID: 2096)

    • Detected use of alternative data streams (AltDS)

      • powershell.exe (PID: 4620)

    • The process creates files with name similar to system file names

      • powershell.exe (PID: 4620)

    • Process drops legitimate windows executable

      • powershell.exe (PID: 4620)

    • The executable file from the user directory is run by the CMD process

      • PowerRun.exe (PID: 3896)
      • PowerRun.exe (PID: 3300)
      • PowerRun.exe (PID: 2800)
      • PowerRun.exe (PID: 5352)
      • PowerRun.exe (PID: 3008)
      • PowerRun.exe (PID: 6744)
      • PowerRun.exe (PID: 4652)
      • PowerRun.exe (PID: 4040)
      • PowerRun.exe (PID: 4696)
      • PowerRun.exe (PID: 780)
      • PowerRun.exe (PID: 1180)
      • PowerRun.exe (PID: 2552)
      • PowerRun.exe (PID: 6676)
      • PowerRun.exe (PID: 6108)
      • PowerRun.exe (PID: 1240)
      • PowerRun.exe (PID: 6004)
      • PowerRun.exe (PID: 644)
      • PowerRun.exe (PID: 6808)
      • PowerRun.exe (PID: 1096)
      • PowerRun.exe (PID: 5260)
      • PowerRun.exe (PID: 6828)
      • PowerRun.exe (PID: 6184)
      • PowerRun.exe (PID: 5936)
      • PowerRun.exe (PID: 736)
      • PowerRun.exe (PID: 6468)
      • PowerRun.exe (PID: 856)
      • PowerRun.exe (PID: 4620)
      • PowerRun.exe (PID: 6252)
      • PowerRun.exe (PID: 2984)
      • PowerRun.exe (PID: 5892)
      • PowerRun.exe (PID: 5084)
      • PowerRun.exe (PID: 5136)
      • PowerRun.exe (PID: 1452)
      • PowerRun.exe (PID: 632)
      • PowerRun.exe (PID: 5400)
      • PowerRun.exe (PID: 4436)
      • PowerRun.exe (PID: 4528)
      • PowerRun.exe (PID: 6080)
      • PowerRun.exe (PID: 864)
      • PowerRun.exe (PID: 4652)
      • PowerRun.exe (PID: 5360)
      • PowerRun.exe (PID: 5360)
      • PowerRun.exe (PID: 2552)
      • PowerRun.exe (PID: 5280)
      • PowerRun.exe (PID: 4220)
      • PowerRun.exe (PID: 960)
      • PowerRun.exe (PID: 3020)
      • PowerRun.exe (PID: 4436)
      • PowerRun.exe (PID: 6872)
      • PowerRun.exe (PID: 5380)
      • PowerRun.exe (PID: 3896)
      • PowerRun.exe (PID: 5212)
      • PowerRun.exe (PID: 4696)
      • PowerRun.exe (PID: 6112)
      • PowerRun.exe (PID: 5260)
      • PowerRun.exe (PID: 1912)
      • PowerRun.exe (PID: 2420)
      • PowerRun.exe (PID: 5304)
      • PowerRun.exe (PID: 856)
      • PowerRun.exe (PID: 872)
      • PowerRun.exe (PID: 6828)
      • PowerRun.exe (PID: 1272)
      • PowerRun.exe (PID: 4164)

    • Application launched itself

      • PowerRun.exe (PID: 3896)
      • PowerRun.exe (PID: 3300)
      • PowerRun.exe (PID: 5304)
      • PowerRun.exe (PID: 5384)
      • PowerRun.exe (PID: 960)
      • PowerRun.exe (PID: 5352)
      • PowerRun.exe (PID: 5360)
      • PowerRun.exe (PID: 3008)
      • PowerRun.exe (PID: 2800)
      • PowerRun.exe (PID: 780)
      • PowerRun.exe (PID: 4400)
      • PowerRun.exe (PID: 4652)
      • PowerRun.exe (PID: 5324)
      • PowerRun.exe (PID: 4040)
      • PowerRun.exe (PID: 4696)
      • PowerRun.exe (PID: 6744)
      • PowerRun.exe (PID: 5304)
      • PowerRun.exe (PID: 968)
      • PowerRun.exe (PID: 780)
      • PowerRun.exe (PID: 6080)
      • PowerRun.exe (PID: 1180)
      • PowerRun.exe (PID: 4188)
      • PowerRun.exe (PID: 2552)
      • PowerRun.exe (PID: 4400)
      • PowerRun.exe (PID: 6676)
      • PowerRun.exe (PID: 2600)
      • PowerRun.exe (PID: 6108)
      • PowerRun.exe (PID: 5008)
      • PowerRun.exe (PID: 1240)
      • PowerRun.exe (PID: 5984)
      • PowerRun.exe (PID: 6004)
      • PowerRun.exe (PID: 904)
      • PowerRun.exe (PID: 644)
      • PowerRun.exe (PID: 5780)
      • PowerRun.exe (PID: 5260)
      • PowerRun.exe (PID: 6808)
      • PowerRun.exe (PID: 5008)
      • PowerRun.exe (PID: 1228)
      • PowerRun.exe (PID: 1096)
      • PowerRun.exe (PID: 1628)
      • PowerRun.exe (PID: 6828)
      • PowerRun.exe (PID: 5304)
      • PowerRun.exe (PID: 6184)
      • PowerRun.exe (PID: 5936)
      • PowerRun.exe (PID: 904)
      • PowerRun.exe (PID: 4880)
      • PowerRun.exe (PID: 736)
      • PowerRun.exe (PID: 4040)
      • PowerRun.exe (PID: 6468)
      • PowerRun.exe (PID: 3300)
      • PowerRun.exe (PID: 856)
      • PowerRun.exe (PID: 6252)
      • PowerRun.exe (PID: 1764)
      • PowerRun.exe (PID: 4620)
      • PowerRun.exe (PID: 2420)
      • PowerRun.exe (PID: 904)
      • PowerRun.exe (PID: 5892)
      • PowerRun.exe (PID: 6184)
      • PowerRun.exe (PID: 2984)
      • PowerRun.exe (PID: 1096)
      • PowerRun.exe (PID: 5084)
      • PowerRun.exe (PID: 5380)
      • PowerRun.exe (PID: 4436)
      • PowerRun.exe (PID: 3332)
      • PowerRun.exe (PID: 1452)
      • PowerRun.exe (PID: 4068)
      • PowerRun.exe (PID: 5228)
      • PowerRun.exe (PID: 632)
      • PowerRun.exe (PID: 5400)
      • PowerRun.exe (PID: 5136)
      • PowerRun.exe (PID: 5892)
      • PowerRun.exe (PID: 6372)
      • PowerRun.exe (PID: 6080)
      • PowerRun.exe (PID: 4528)
      • PowerRun.exe (PID: 5400)
      • PowerRun.exe (PID: 6660)
      • PowerRun.exe (PID: 864)
      • PowerRun.exe (PID: 5528)
      • PowerRun.exe (PID: 5544)
      • PowerRun.exe (PID: 5360)
      • PowerRun.exe (PID: 5360)
      • PowerRun.exe (PID: 2552)
      • PowerRun.exe (PID: 6112)
      • PowerRun.exe (PID: 660)
      • PowerRun.exe (PID: 4652)
      • PowerRun.exe (PID: 6108)
      • PowerRun.exe (PID: 1052)
      • PowerRun.exe (PID: 4436)
      • PowerRun.exe (PID: 5576)
      • PowerRun.exe (PID: 4220)
      • PowerRun.exe (PID: 1240)
      • PowerRun.exe (PID: 960)
      • PowerRun.exe (PID: 5280)
      • PowerRun.exe (PID: 3020)
      • PowerRun.exe (PID: 5380)
      • PowerRun.exe (PID: 6872)
      • PowerRun.exe (PID: 4400)
      • PowerRun.exe (PID: 6028)
      • PowerRun.exe (PID: 2268)
      • PowerRun.exe (PID: 2656)
      • PowerRun.exe (PID: 5212)
      • PowerRun.exe (PID: 4736)
      • PowerRun.exe (PID: 5084)
      • PowerRun.exe (PID: 4844)
      • PowerRun.exe (PID: 4696)
      • PowerRun.exe (PID: 6112)
      • PowerRun.exe (PID: 3896)
      • PowerRun.exe (PID: 5304)
      • PowerRun.exe (PID: 5260)
      • PowerRun.exe (PID: 968)
      • PowerRun.exe (PID: 1912)
      • PowerRun.exe (PID: 2064)
      • PowerRun.exe (PID: 1132)
      • PowerRun.exe (PID: 4728)
      • PowerRun.exe (PID: 5984)
      • PowerRun.exe (PID: 856)
      • PowerRun.exe (PID: 1764)
      • PowerRun.exe (PID: 872)
      • PowerRun.exe (PID: 2420)
      • PowerRun.exe (PID: 5136)
      • PowerRun.exe (PID: 1272)
      • PowerRun.exe (PID: 4880)
      • PowerRun.exe (PID: 6036)
      • PowerRun.exe (PID: 4164)
      • PowerRun.exe (PID: 1052)
      • PowerRun.exe (PID: 6828)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 2096)

    • Starts CMD.EXE for commands execution

      • DefenderRemover.exe (PID: 4776)
      • PowerRun.exe (PID: 644)
      • PowerRun.exe (PID: 5132)
      • PowerRun.exe (PID: 4188)
      • PowerRun.exe (PID: 5008)
      • PowerRun.exe (PID: 1452)
      • PowerRun.exe (PID: 4652)
      • PowerRun.exe (PID: 864)
      • PowerRun.exe (PID: 6372)
      • PowerRun.exe (PID: 4696)
      • PowerRun.exe (PID: 3332)
      • PowerRun.exe (PID: 1096)
      • PowerRun.exe (PID: 7156)
      • PowerRun.exe (PID: 5344)
      • PowerRun.exe (PID: 1764)
      • PowerRun.exe (PID: 6068)
      • PowerRun.exe (PID: 5720)
      • PowerRun.exe (PID: 856)
      • PowerRun.exe (PID: 1096)
      • PowerRun.exe (PID: 2800)
      • PowerRun.exe (PID: 5936)
      • PowerRun.exe (PID: 6184)
      • PowerRun.exe (PID: 6108)
      • PowerRun.exe (PID: 5544)
      • PowerRun.exe (PID: 3008)
      • PowerRun.exe (PID: 4728)
      • PowerRun.exe (PID: 4164)
      • PowerRun.exe (PID: 6828)
      • PowerRun.exe (PID: 2420)
      • PowerRun.exe (PID: 5528)
      • PowerRun.exe (PID: 960)
      • PowerRun.exe (PID: 6112)
      • PowerRun.exe (PID: 6468)
      • PowerRun.exe (PID: 5512)
      • PowerRun.exe (PID: 5212)
      • PowerRun.exe (PID: 6640)
      • PowerRun.exe (PID: 5228)
      • PowerRun.exe (PID: 5380)
      • PowerRun.exe (PID: 4436)
      • PowerRun.exe (PID: 2420)
      • PowerRun.exe (PID: 864)
      • PowerRun.exe (PID: 4736)
      • PowerRun.exe (PID: 4728)
      • PowerRun.exe (PID: 1132)
      • PowerRun.exe (PID: 3896)
      • PowerRun.exe (PID: 1168)
      • PowerRun.exe (PID: 5512)
      • PowerRun.exe (PID: 5408)
      • PowerRun.exe (PID: 1272)
      • PowerRun.exe (PID: 2644)
      • PowerRun.exe (PID: 5008)
      • PowerRun.exe (PID: 664)
      • PowerRun.exe (PID: 2644)
      • PowerRun.exe (PID: 3032)
      • PowerRun.exe (PID: 6660)
      • PowerRun.exe (PID: 3020)
      • PowerRun.exe (PID: 2288)
      • PowerRun.exe (PID: 5892)
      • PowerRun.exe (PID: 6080)
      • PowerRun.exe (PID: 6872)

    • Starts a Microsoft application from unusual location

      • DismHost.exe (PID: 6080)

    • Uses REG/REGEDIT.EXE to modify registry

      • PowerRun.exe (PID: 4696)
      • cmd.exe (PID: 2096)
      • PowerRun.exe (PID: 5084)
      • PowerRun.exe (PID: 1128)
      • PowerRun.exe (PID: 1616)

    • Reads security settings of Internet Explorer

      • PowerRun.exe (PID: 4696)
      • PowerRun.exe (PID: 5084)
      • PowerRun.exe (PID: 1128)
      • PowerRun.exe (PID: 1616)
      • PowerRun.exe (PID: 644)
      • PowerRun.exe (PID: 5132)
      • PowerRun.exe (PID: 4188)
      • PowerRun.exe (PID: 5008)
      • PowerRun.exe (PID: 1452)
      • PowerRun.exe (PID: 4652)
      • PowerRun.exe (PID: 864)
      • PowerRun.exe (PID: 6372)
      • PowerRun.exe (PID: 4696)
      • PowerRun.exe (PID: 3332)
      • PowerRun.exe (PID: 1096)
      • PowerRun.exe (PID: 7156)
      • PowerRun.exe (PID: 5344)
      • PowerRun.exe (PID: 856)
      • PowerRun.exe (PID: 1096)
      • PowerRun.exe (PID: 2800)
      • PowerRun.exe (PID: 5936)
      • PowerRun.exe (PID: 6184)
      • PowerRun.exe (PID: 5544)
      • PowerRun.exe (PID: 6108)
      • PowerRun.exe (PID: 3008)
      • PowerRun.exe (PID: 4164)
      • PowerRun.exe (PID: 4728)

    • Reads the date of Windows installation

      • PowerRun.exe (PID: 4696)
      • PowerRun.exe (PID: 5084)
      • PowerRun.exe (PID: 1128)
      • PowerRun.exe (PID: 1616)
      • PowerRun.exe (PID: 644)
      • PowerRun.exe (PID: 5132)
      • PowerRun.exe (PID: 4188)
      • PowerRun.exe (PID: 5008)
      • PowerRun.exe (PID: 1452)
      • PowerRun.exe (PID: 4652)
      • PowerRun.exe (PID: 864)
      • PowerRun.exe (PID: 4696)
      • PowerRun.exe (PID: 3332)
      • PowerRun.exe (PID: 1096)
      • PowerRun.exe (PID: 5344)
      • PowerRun.exe (PID: 1764)
      • PowerRun.exe (PID: 6068)
      • PowerRun.exe (PID: 856)
      • PowerRun.exe (PID: 1096)
      • PowerRun.exe (PID: 2800)
      • PowerRun.exe (PID: 5936)
      • PowerRun.exe (PID: 5544)
      • PowerRun.exe (PID: 6108)
      • PowerRun.exe (PID: 4728)

    • The process deletes folder without confirmation

      • PowerRun.exe (PID: 6640)
      • PowerRun.exe (PID: 5228)
      • PowerRun.exe (PID: 4436)
      • PowerRun.exe (PID: 2420)
      • PowerRun.exe (PID: 864)
      • PowerRun.exe (PID: 4736)
      • PowerRun.exe (PID: 3896)
      • PowerRun.exe (PID: 4728)
      • PowerRun.exe (PID: 1272)
      • PowerRun.exe (PID: 1132)
      • PowerRun.exe (PID: 5512)
      • PowerRun.exe (PID: 5408)
      • PowerRun.exe (PID: 1168)
      • PowerRun.exe (PID: 5008)
      • PowerRun.exe (PID: 664)
      • PowerRun.exe (PID: 2644)
      • PowerRun.exe (PID: 6660)
      • PowerRun.exe (PID: 2644)
      • PowerRun.exe (PID: 3032)
      • PowerRun.exe (PID: 3020)
      • PowerRun.exe (PID: 2288)
      • PowerRun.exe (PID: 5892)
      • PowerRun.exe (PID: 6080)
      • PowerRun.exe (PID: 6872)

    • Found strings related to reading or modifying Windows Defender settings

      • PowerRun.exe (PID: 6640)
      • PowerRun.exe (PID: 5228)
      • PowerRun.exe (PID: 864)
      • PowerRun.exe (PID: 2420)
      • PowerRun.exe (PID: 1132)
      • PowerRun.exe (PID: 1272)
      • PowerRun.exe (PID: 2644)
      • PowerRun.exe (PID: 5008)
      • PowerRun.exe (PID: 664)
      • PowerRun.exe (PID: 6660)
      • PowerRun.exe (PID: 2644)
      • PowerRun.exe (PID: 3032)
      • PowerRun.exe (PID: 5892)
      • PowerRun.exe (PID: 6872)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 2096)

    • The system shut down or reboot

      • cmd.exe (PID: 2096)

  • INFO

    • Reads the computer name

      • DefenderRemover.exe (PID: 4776)
      • DismHost.exe (PID: 6080)
      • PowerRun.exe (PID: 3896)
      • PowerRun.exe (PID: 5304)
      • PowerRun.exe (PID: 3300)
      • PowerRun.exe (PID: 4696)
      • PowerRun.exe (PID: 5384)
      • PowerRun.exe (PID: 960)
      • PowerRun.exe (PID: 2800)
      • PowerRun.exe (PID: 5084)
      • PowerRun.exe (PID: 1128)
      • PowerRun.exe (PID: 5352)
      • PowerRun.exe (PID: 5360)
      • PowerRun.exe (PID: 3008)
      • PowerRun.exe (PID: 1616)
      • PowerRun.exe (PID: 644)
      • PowerRun.exe (PID: 780)
      • PowerRun.exe (PID: 6744)
      • PowerRun.exe (PID: 4400)
      • PowerRun.exe (PID: 4652)
      • PowerRun.exe (PID: 5132)
      • PowerRun.exe (PID: 5324)
      • PowerRun.exe (PID: 4040)
      • PowerRun.exe (PID: 4188)
      • PowerRun.exe (PID: 5304)
      • PowerRun.exe (PID: 4696)
      • PowerRun.exe (PID: 968)
      • PowerRun.exe (PID: 5008)
      • PowerRun.exe (PID: 780)
      • PowerRun.exe (PID: 1452)
      • PowerRun.exe (PID: 1180)
      • PowerRun.exe (PID: 6080)
      • PowerRun.exe (PID: 4652)
      • PowerRun.exe (PID: 2552)
      • PowerRun.exe (PID: 4188)
      • PowerRun.exe (PID: 4400)
      • PowerRun.exe (PID: 864)
      • PowerRun.exe (PID: 6676)
      • PowerRun.exe (PID: 2600)
      • PowerRun.exe (PID: 6372)
      • PowerRun.exe (PID: 6108)
      • PowerRun.exe (PID: 4696)
      • PowerRun.exe (PID: 1240)
      • PowerRun.exe (PID: 3332)
      • PowerRun.exe (PID: 5984)
      • PowerRun.exe (PID: 6004)
      • PowerRun.exe (PID: 904)
      • PowerRun.exe (PID: 644)
      • PowerRun.exe (PID: 5780)
      • PowerRun.exe (PID: 6808)
      • PowerRun.exe (PID: 7156)
      • PowerRun.exe (PID: 1228)
      • PowerRun.exe (PID: 5344)
      • PowerRun.exe (PID: 1764)
      • PowerRun.exe (PID: 6068)
      • PowerRun.exe (PID: 6828)
      • PowerRun.exe (PID: 5304)
      • PowerRun.exe (PID: 6184)
      • PowerRun.exe (PID: 856)
      • PowerRun.exe (PID: 5936)
      • PowerRun.exe (PID: 904)
      • PowerRun.exe (PID: 736)
      • PowerRun.exe (PID: 4040)
      • PowerRun.exe (PID: 6468)
      • PowerRun.exe (PID: 5936)
      • PowerRun.exe (PID: 3300)
      • PowerRun.exe (PID: 856)
      • PowerRun.exe (PID: 6184)
      • PowerRun.exe (PID: 4620)
      • PowerRun.exe (PID: 1764)
      • PowerRun.exe (PID: 5544)
      • PowerRun.exe (PID: 904)
      • PowerRun.exe (PID: 5892)
      • PowerRun.exe (PID: 3008)
      • PowerRun.exe (PID: 2984)
      • PowerRun.exe (PID: 4164)
      • PowerRun.exe (PID: 1096)
      • PowerRun.exe (PID: 4728)

    • The sample compiled with english language support

      • DefenderRemover.exe (PID: 4776)
      • powershell.exe (PID: 4620)

    • Checks supported languages

      • DefenderRemover.exe (PID: 4776)
      • PowerRun.exe (PID: 3896)
      • PowerRun.exe (PID: 5304)
      • PowerRun.exe (PID: 3300)
      • PowerRun.exe (PID: 4696)
      • PowerRun.exe (PID: 2800)
      • PowerRun.exe (PID: 5384)
      • DismHost.exe (PID: 6080)
      • PowerRun.exe (PID: 960)
      • PowerRun.exe (PID: 1128)
      • PowerRun.exe (PID: 5352)
      • PowerRun.exe (PID: 5360)
      • PowerRun.exe (PID: 1616)
      • PowerRun.exe (PID: 3008)
      • PowerRun.exe (PID: 780)
      • PowerRun.exe (PID: 6744)
      • PowerRun.exe (PID: 5084)
      • PowerRun.exe (PID: 644)
      • PowerRun.exe (PID: 5132)
      • PowerRun.exe (PID: 5324)
      • PowerRun.exe (PID: 4040)
      • PowerRun.exe (PID: 4188)
      • PowerRun.exe (PID: 5304)
      • PowerRun.exe (PID: 4696)
      • PowerRun.exe (PID: 5008)
      • PowerRun.exe (PID: 968)
      • PowerRun.exe (PID: 4400)
      • PowerRun.exe (PID: 4652)
      • PowerRun.exe (PID: 780)
      • PowerRun.exe (PID: 1452)
      • PowerRun.exe (PID: 1180)
      • PowerRun.exe (PID: 6080)
      • PowerRun.exe (PID: 4652)
      • PowerRun.exe (PID: 4188)
      • PowerRun.exe (PID: 2552)
      • PowerRun.exe (PID: 864)
      • PowerRun.exe (PID: 4400)
      • PowerRun.exe (PID: 6676)
      • PowerRun.exe (PID: 2600)
      • PowerRun.exe (PID: 6372)
      • PowerRun.exe (PID: 6108)
      • PowerRun.exe (PID: 4696)
      • PowerRun.exe (PID: 5008)
      • PowerRun.exe (PID: 1240)
      • PowerRun.exe (PID: 5984)
      • PowerRun.exe (PID: 3332)
      • PowerRun.exe (PID: 6004)
      • PowerRun.exe (PID: 1096)
      • PowerRun.exe (PID: 904)
      • PowerRun.exe (PID: 644)
      • PowerRun.exe (PID: 5780)
      • PowerRun.exe (PID: 7156)
      • PowerRun.exe (PID: 6808)
      • PowerRun.exe (PID: 5344)
      • PowerRun.exe (PID: 5008)
      • PowerRun.exe (PID: 5260)
      • PowerRun.exe (PID: 1228)
      • PowerRun.exe (PID: 1096)
      • PowerRun.exe (PID: 6068)
      • PowerRun.exe (PID: 6828)
      • PowerRun.exe (PID: 5720)
      • PowerRun.exe (PID: 1764)
      • PowerRun.exe (PID: 5304)
      • PowerRun.exe (PID: 6184)
      • PowerRun.exe (PID: 856)
      • PowerRun.exe (PID: 904)
      • PowerRun.exe (PID: 5936)
      • PowerRun.exe (PID: 1096)
      • PowerRun.exe (PID: 4880)
      • PowerRun.exe (PID: 736)
      • PowerRun.exe (PID: 2800)
      • PowerRun.exe (PID: 4040)
      • PowerRun.exe (PID: 6468)
      • PowerRun.exe (PID: 5936)
      • PowerRun.exe (PID: 3300)
      • PowerRun.exe (PID: 856)
      • PowerRun.exe (PID: 6184)
      • PowerRun.exe (PID: 1764)
      • PowerRun.exe (PID: 4620)
      • PowerRun.exe (PID: 6108)
      • PowerRun.exe (PID: 6252)
      • PowerRun.exe (PID: 2420)
      • PowerRun.exe (PID: 5544)
      • PowerRun.exe (PID: 5892)
      • PowerRun.exe (PID: 3008)
      • PowerRun.exe (PID: 904)
      • PowerRun.exe (PID: 4164)
      • PowerRun.exe (PID: 1096)
      • PowerRun.exe (PID: 5084)
      • PowerRun.exe (PID: 2984)
      • PowerRun.exe (PID: 6184)
      • PowerRun.exe (PID: 4728)
      • PowerRun.exe (PID: 5380)
      • PowerRun.exe (PID: 5136)
      • PowerRun.exe (PID: 6828)

    • Create files in a temporary directory

      • DefenderRemover.exe (PID: 4776)
      • PowerRun.exe (PID: 3896)
      • PowerRun.exe (PID: 3300)
      • PowerRun.exe (PID: 2800)
      • PowerRun.exe (PID: 5352)
      • PowerRun.exe (PID: 3008)
      • PowerRun.exe (PID: 6744)
      • PowerRun.exe (PID: 4652)
      • PowerRun.exe (PID: 4040)
      • PowerRun.exe (PID: 4696)
      • PowerRun.exe (PID: 780)
      • PowerRun.exe (PID: 1180)
      • PowerRun.exe (PID: 2552)
      • PowerRun.exe (PID: 6676)
      • PowerRun.exe (PID: 6108)
      • PowerRun.exe (PID: 1240)
      • PowerRun.exe (PID: 6004)
      • PowerRun.exe (PID: 644)
      • PowerRun.exe (PID: 6808)
      • PowerRun.exe (PID: 5260)
      • PowerRun.exe (PID: 1096)
      • PowerRun.exe (PID: 6828)
      • PowerRun.exe (PID: 6184)
      • PowerRun.exe (PID: 5936)
      • PowerRun.exe (PID: 736)
      • PowerRun.exe (PID: 6468)
      • PowerRun.exe (PID: 856)
      • PowerRun.exe (PID: 4620)
      • PowerRun.exe (PID: 6252)
      • PowerRun.exe (PID: 5892)
      • PowerRun.exe (PID: 2984)
      • PowerRun.exe (PID: 5084)

    • Reads Environment values

      • DismHost.exe (PID: 6080)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 4620)

    • Reads mouse settings

      • PowerRun.exe (PID: 3896)
      • PowerRun.exe (PID: 3300)
      • PowerRun.exe (PID: 5304)
      • PowerRun.exe (PID: 5384)
      • PowerRun.exe (PID: 4696)
      • PowerRun.exe (PID: 2800)
      • PowerRun.exe (PID: 5084)
      • PowerRun.exe (PID: 1128)
      • PowerRun.exe (PID: 960)
      • PowerRun.exe (PID: 5352)
      • PowerRun.exe (PID: 5360)
      • PowerRun.exe (PID: 1616)
      • PowerRun.exe (PID: 780)
      • PowerRun.exe (PID: 6744)
      • PowerRun.exe (PID: 3008)
      • PowerRun.exe (PID: 4400)
      • PowerRun.exe (PID: 644)
      • PowerRun.exe (PID: 5132)
      • PowerRun.exe (PID: 5324)
      • PowerRun.exe (PID: 4040)
      • PowerRun.exe (PID: 4188)
      • PowerRun.exe (PID: 5304)
      • PowerRun.exe (PID: 4696)
      • PowerRun.exe (PID: 5008)
      • PowerRun.exe (PID: 4652)
      • PowerRun.exe (PID: 968)
      • PowerRun.exe (PID: 780)
      • PowerRun.exe (PID: 6080)
      • PowerRun.exe (PID: 1180)
      • PowerRun.exe (PID: 1452)
      • PowerRun.exe (PID: 4652)
      • PowerRun.exe (PID: 4188)
      • PowerRun.exe (PID: 2552)
      • PowerRun.exe (PID: 864)
      • PowerRun.exe (PID: 4400)
      • PowerRun.exe (PID: 6676)
      • PowerRun.exe (PID: 6372)
      • PowerRun.exe (PID: 2600)
      • PowerRun.exe (PID: 6108)
      • PowerRun.exe (PID: 4696)
      • PowerRun.exe (PID: 5008)
      • PowerRun.exe (PID: 1240)
      • PowerRun.exe (PID: 3332)
      • PowerRun.exe (PID: 5984)
      • PowerRun.exe (PID: 1096)
      • PowerRun.exe (PID: 904)
      • PowerRun.exe (PID: 644)
      • PowerRun.exe (PID: 5780)
      • PowerRun.exe (PID: 7156)
      • PowerRun.exe (PID: 6808)
      • PowerRun.exe (PID: 5344)
      • PowerRun.exe (PID: 5008)
      • PowerRun.exe (PID: 5260)
      • PowerRun.exe (PID: 1228)
      • PowerRun.exe (PID: 1096)
      • PowerRun.exe (PID: 1764)
      • PowerRun.exe (PID: 6068)
      • PowerRun.exe (PID: 6828)
      • PowerRun.exe (PID: 6184)
      • PowerRun.exe (PID: 856)
      • PowerRun.exe (PID: 904)
      • PowerRun.exe (PID: 5720)
      • PowerRun.exe (PID: 5304)
      • PowerRun.exe (PID: 1096)
      • PowerRun.exe (PID: 4880)
      • PowerRun.exe (PID: 4040)
      • PowerRun.exe (PID: 6468)
      • PowerRun.exe (PID: 736)
      • PowerRun.exe (PID: 2800)
      • PowerRun.exe (PID: 5936)
      • PowerRun.exe (PID: 3300)
      • PowerRun.exe (PID: 856)
      • PowerRun.exe (PID: 6184)
      • PowerRun.exe (PID: 1764)
      • PowerRun.exe (PID: 6108)
      • PowerRun.exe (PID: 6252)
      • PowerRun.exe (PID: 5892)
      • PowerRun.exe (PID: 3008)
      • PowerRun.exe (PID: 6184)
      • PowerRun.exe (PID: 904)
      • PowerRun.exe (PID: 4164)
      • PowerRun.exe (PID: 5084)
      • PowerRun.exe (PID: 2984)
      • PowerRun.exe (PID: 5380)
      • PowerRun.exe (PID: 5136)
      • PowerRun.exe (PID: 4728)
      • PowerRun.exe (PID: 6828)

    • The executable file from the user directory is run by the Powershell process

      • DismHost.exe (PID: 6080)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:11:18 16:27:35+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 104960
InitializedDataSize: 314368
UninitializedDataSize: -
EntryPoint: 0x14b04
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 12.8.2.0
ProductVersionNumber: 12.8.2.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Gallery Inc
FileDescription: Defender Remover
FileVersion: 12.8.2
LegalCopyright: Gallery Inc.
ProductName: Defender Remover
ProductVersion: 12.8.2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
460
Monitored processes
328
Malicious processes
8
Suspicious processes
25

Behavior graph

Click at the process to see the details
start defenderremover.exe cmd.exe no specs conhost.exe no specs choice.exe no specs sppextcomobj.exe no specs slui.exe no specs powershell.exe dismhost.exe no specs dism.exe no specs dism.exe no specs dism.exe no specs powerrun.exe no specs powerrun.exe powerrun.exe no specs powerrun.exe powerrun.exe no specs powerrun.exe no specs powerrun.exe no specs powerrun.exe regedit.exe no specs regedit.exe no specs regedit.exe no specs powerrun.exe no specs regedit.exe no specs regedit.exe no specs powerrun.exe no specs regedit.exe no specs powerrun.exe powerrun.exe no specs powerrun.exe no specs powerrun.exe powerrun.exe no specs regedit.exe no specs powerrun.exe no specs powerrun.exe powerrun.exe no specs powerrun.exe no specs powerrun.exe cmd.exe no specs conhost.exe no specs powerrun.exe no specs cmd.exe no specs powerrun.exe no specs conhost.exe no specs powerrun.exe powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe no specs powerrun.exe powerrun.exe no specs powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe no specs powerrun.exe powerrun.exe no specs cmd.exe no specs powerrun.exe no specs conhost.exe no specs powerrun.exe powerrun.exe no specs powerrun.exe no specs powerrun.exe powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe no specs powerrun.exe powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe powerrun.exe no specs powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe powerrun.exe no specs cmd.exe no specs powerrun.exe no specs powerrun.exe conhost.exe no specs powerrun.exe no specs powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe powerrun.exe no specs powerrun.exe powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe no specs powerrun.exe no specs powerrun.exe powerrun.exe no specs powerrun.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe powerrun.exe no specs powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe powerrun.exe no specs cmd.exe no specs powerrun.exe no specs conhost.exe no specs powerrun.exe powerrun.exe no specs cmd.exe no specs powerrun.exe no specs conhost.exe no specs powerrun.exe powerrun.exe no specs powerrun.exe no specs powerrun.exe cmd.exe no specs conhost.exe no specs powerrun.exe no specs powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe no specs powerrun.exe powerrun.exe no specs powerrun.exe no specs powerrun.exe cmd.exe no specs powerrun.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe no specs powerrun.exe powerrun.exe no specs powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe no specs powerrun.exe powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe no specs powerrun.exe powerrun.exe no specs powerrun.exe no specs powerrun.exe powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe no specs powerrun.exe powerrun.exe no specs powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe powerrun.exe no specs powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe powerrun.exe no specs powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe powerrun.exe no specs powerrun.exe no specs cmd.exe no specs powerrun.exe conhost.exe no specs powerrun.exe no specs powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe powerrun.exe no specs powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe powerrun.exe no specs powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe no specs powerrun.exe powerrun.exe no specs powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe no specs powerrun.exe powerrun.exe no specs powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe powerrun.exe no specs powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe no specs powerrun.exe powerrun.exe no specs powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe powerrun.exe no specs powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe powerrun.exe no specs powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe no specs powerrun.exe powerrun.exe no specs powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe powerrun.exe no specs cmd.exe no specs powerrun.exe no specs conhost.exe no specs powerrun.exe powerrun.exe no specs powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe powerrun.exe no specs cmd.exe no specs powerrun.exe no specs conhost.exe no specs powerrun.exe powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe no specs powerrun.exe powerrun.exe no specs powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe powerrun.exe no specs powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe powerrun.exe no specs powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe no specs powerrun.exe powerrun.exe no specs powerrun.exe no specs powerrun.exe cmd.exe no specs powerrun.exe no specs conhost.exe no specs powerrun.exe no specs cmd.exe no specs conhost.exe no specs powerrun.exe timeout.exe no specs powerrun.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs shutdown.exe no specs defenderremover.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
616"C:\WINDOWS\regedit.exe" /s "C:\Users\admin\AppData\Local\Temp\7zSCC89.tmp\Remove_defender\NomoreDelayandTimeouts.reg"C:\Windows\regedit.exe—PowerRun.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Editor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\regedit.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\gdi32.dll
632PowerRun cmd.exe /c del /f ""C:\Windows\SysWOW64\DeviceCensus.exe""C:\Users\admin\AppData\Local\Temp\7zSCC89.tmp\PowerRun.exe—cmd.exe
User:
admin
Integrity Level:
HIGH
Description:
PowerRun
Exit code:
0
Version:
1.6.0.0
Modules
Images
c:\users\admin\appdata\local\temp\7zscc89.tmp\powerrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\psapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
644"C:\Users\admin\AppData\Local\Temp\7zSCC89.tmp\PowerRun.exe" /TI/ cmd.exe /c del /f ""C:\Windows\System32\SecurityAndMaintenance_Error.png""C:\Users\admin\AppData\Local\Temp\7zSCC89.tmp\PowerRun.exe—PowerRun.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Description:
PowerRun
Exit code:
0
Version:
1.6.0.0
Modules
Images
c:\users\admin\appdata\local\temp\7zscc89.tmp\powerrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\psapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\win32u.dll
644PowerRun cmd.exe /c del /f ""C:\Windows\System32\wscproxystub.dll""C:\Users\admin\AppData\Local\Temp\7zSCC89.tmp\PowerRun.exe—cmd.exe
User:
admin
Integrity Level:
HIGH
Description:
PowerRun
Exit code:
0
Version:
1.6.0.0
Modules
Images
c:\users\admin\appdata\local\temp\7zscc89.tmp\powerrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\psapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
660\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
660"C:\WINDOWS\system32\cmd.exe" /c del /f ""C:\Windows\System32\SecurityHealthProxyStub.dll""C:\Windows\System32\cmd.exe—PowerRun.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
660"C:\Users\admin\AppData\Local\Temp\7zSCC89.tmp\PowerRun.exe" cmd.exe /c rmdir "C:\Program Files (x86)\Windows Defender Advanced Threat Protection" /s /qC:\Users\admin\AppData\Local\Temp\7zSCC89.tmp\PowerRun.exe
PowerRun.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Description:
PowerRun
Exit code:
0
Version:
1.6.0.0
Modules
Images
c:\users\admin\appdata\local\temp\7zscc89.tmp\powerrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\psapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
664"C:\WINDOWS\system32\cmd.exe" /c del /f ""C:\Windows\SysWOW64\smartscreenps.dll""C:\Windows\System32\cmd.exe—PowerRun.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
664"C:\Users\admin\AppData\Local\Temp\7zSCC89.tmp\PowerRun.exe" /TI/ cmd.exe /c rmdir "C:\Windows\System32\WindowsPowerShell\v1.0\Modules\DefenderPerformance" /s /qC:\Users\admin\AppData\Local\Temp\7zSCC89.tmp\PowerRun.exe—PowerRun.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Description:
PowerRun
Exit code:
0
Version:
1.6.0.0
Modules
Images
c:\users\admin\appdata\local\temp\7zscc89.tmp\powerrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\psapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
664\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
29 933
Read events
29 279
Write events
414
Delete events
240

Modification events

(PID) Process:(856) regedit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:VerboseStatus
Value:
0
(PID) Process:(856) regedit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Reliability
Operation:writeName:ShutdownReasonOn
Value:
0
(PID) Process:(856) regedit.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Reliability
Operation:writeName:ShutdownReasonOn
Value:
0
(PID) Process:(856) regedit.exeKey:HKEY_CURRENT_USER\Control Panel\Desktop
Operation:writeName:AutoEndTasks
Value:
1
(PID) Process:(856) regedit.exeKey:HKEY_CURRENT_USER\Control Panel\Desktop
Operation:writeName:MenuShowDelay
Value:
1
(PID) Process:(856) regedit.exeKey:HKEY_CURRENT_USER\Control Panel\Desktop
Operation:writeName:ForegroundLockTimeout
Value:
0
(PID) Process:(856) regedit.exeKey:HKEY_CURRENT_USER\Control Panel\Desktop
Operation:writeName:WaitToKillAppTimeout
Value:
1
(PID) Process:(856) regedit.exeKey:HKEY_CURRENT_USER\Control Panel\Desktop
Operation:writeName:WaitToKillServiceTimeout
Value:
1
(PID) Process:(856) regedit.exeKey:HKEY_CURRENT_USER\Control Panel\Desktop
Operation:writeName:HungAppTimeout
Value:
1000
(PID) Process:(856) regedit.exeKey:HKEY_CURRENT_USER\Control Panel\Desktop
Operation:writeName:LowLevelHooksTimeout
Value:
1
Executable files
51
Suspicious files
568
Text files
200
Unknown types
0

Dropped files

PID
Process
Filename
Type
4776DefenderRemover.exeC:\Users\admin\AppData\Local\Temp\7zSCC89.tmp\Remove_Defender\NomoreDelayandTimeouts.regtext
MD5:59D99738DE1C67233FA6C5595AE6BB66
SHA256:FFB369C1B359A99845D2B1C4FC8CAAFBA2E157FB7D152C2AEBC4E38ACCFB9BA7
4620powershell.exeC:\Users\admin\AppData\Local\Temp\BB860238-90D7-4990-9647-7B57FC22C373\DismHost.exeexecutable
MD5:97CB1E2FCAB378421C4B91DF0C9F8310
SHA256:E36BCF02BC11F560761E943D0FAD37417078F6CBB473F85C72FCBC89E2600C58
4776DefenderRemover.exeC:\Users\admin\AppData\Local\Temp\7zSCC89.tmp\Script_Run.battext
MD5:44104C19893590DE7BBC2A2CBBA9B6E7
SHA256:32AD97E2B83D1EB8B49C2E54ED30C22E36DC21933CA6BAC3F66635868AAAA7CB
4776DefenderRemover.exeC:\Users\admin\AppData\Local\Temp\7zSCC89.tmp\RemoveSecHealthApp.ps1text
MD5:E578450EC12CA326EE55A47F121DEFA3
SHA256:B29D37C2D89B1D20AE79863E55A8BD41EE430A6115D695435CF3F5976DC35D32
4620powershell.exeC:\Users\admin\AppData\Local\Temp\BB860238-90D7-4990-9647-7B57FC22C373\DismCore.dllexecutable
MD5:681186B5696BA7D46B6681C027A659AD
SHA256:FBB5135DE4F6A5C9422A0B218D676930DB9BC9A2AEA0F7219077862912455914
4776DefenderRemover.exeC:\Users\admin\AppData\Local\Temp\7zSCC89.tmp\PowerRun.exeexecutable
MD5:FC1FB033D57F72089FB4762245A8B18D
SHA256:A6FA768C4964C328C748558627C20C2BA455E589A1B87CFA3911D197DA1688D2
4620powershell.exeC:\Users\admin\AppData\Local\Temp\BB860238-90D7-4990-9647-7B57FC22C373\DismCorePS.dllexecutable
MD5:35A07968EC37231249F3F072AE555E3A
SHA256:E5F25E5A170CB3D165C3D143EAE967B96AB80F88FB09176DA8591B0B68C77E00
4620powershell.exeC:\Users\admin\AppData\Local\Temp\BB860238-90D7-4990-9647-7B57FC22C373\AppxProvider.dllexecutable
MD5:396C483D62FEA5FA0FD442C8DC99D4EF
SHA256:36F2AF43F10FD76FEEF65BF574D79D3E27FD40DAF61249880511543C1F17AD91
4776DefenderRemover.exeC:\Users\admin\AppData\Local\Temp\7zSCC89.tmp\Remove_Defender\Output.regtext
MD5:8FEF3E73F3DA0CF6B5CB34DA20309236
SHA256:9DDB1443316F09391064D02668608E881C15E25DB9C6667418D086A8F234BD16
4620powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_y4ykotht.s0a.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
18
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.16.148:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3180
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3180
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.16.16.148:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3180
SIHClient.exe
52.149.20.212:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
google.com
  • 142.250.185.142
whitelisted
crl.microsoft.com
  • 2.16.16.148
  • 2.16.16.155
whitelisted
www.microsoft.com
  • 23.219.150.101
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.2
  • 20.190.160.128
  • 20.190.160.65
  • 40.126.32.133
  • 40.126.32.74
  • 20.190.160.20
  • 40.126.32.136
  • 20.190.160.66
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
self.events.data.microsoft.com
  • 20.189.173.1
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DefenderRemover.exe