File name:

82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe

Full analysis: https://app.any.run/tasks/fe0eb04b-f1a4-43a9-bc56-2cfba34e28a9
Verdict: Malicious activity
Threats:

MetaStealer is an info-stealing malware primarily targeting sensitive data like login credentials, payment details, and browser history. It typically infects systems via phishing emails or malicious downloads and can exfiltrate data to a command and control (C2) server. MetaStealer is known for its stealthy techniques, including evasion and persistence mechanisms, which make it difficult to detect. This malware has been actively used in various cyberattacks, particularly for financial theft and credential harvesting from individuals and organizations.

Malware Trends Tracker     >>>
Analysis date: May 11, 2024, 11:37:53
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
meta
metastealer
redline
miner
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

585D78B9FFC988D345E7A2A0EE119111

SHA1:

65B5C6A6C72A845D5610D82CA2AA9A301A907E43

SHA256:

82AE530EB29E0C64986DBD019F86CAC5EFF3DAF3C1FB861757A60252EB1E4661

SSDEEP:

196608:ubGf4Jsi1RkqfMgfezrtqKWZHYa5KnoUHihyM9mo03lq3xdxJv3X0NLMKO:949/fUrt8HYCKo9y1omM3zxp0NLMKO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe (PID: 6276)
      • MVPInstaller.exe (PID: 6440)
      • DCRatBuild.exe (PID: 6380)
      • MVPInstaller.exe (PID: 6564)
      • build.exe (PID: 6356)
      • WinUpdater.exe (PID: 5032)

    • Adds extension to the Windows Defender exclusion list

      • build.exe (PID: 6356)
      • WinUpdater.exe (PID: 5032)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 6540)

    • Steals credentials from Web Browsers

      • 323.exe (PID: 6388)

    • Application was injected by another process

      • dwm.exe (PID: 504)
      • svchost.exe (PID: 1420)
      • svchost.exe (PID: 488)
      • svchost.exe (PID: 1156)
      • svchost.exe (PID: 784)
      • svchost.exe (PID: 1032)
      • svchost.exe (PID: 1164)
      • svchost.exe (PID: 1064)
      • svchost.exe (PID: 1292)
      • svchost.exe (PID: 1520)
      • svchost.exe (PID: 1472)
      • svchost.exe (PID: 1348)
      • winlogon.exe (PID: 668)
      • lsass.exe (PID: 748)
      • svchost.exe (PID: 1664)
      • svchost.exe (PID: 1400)
      • svchost.exe (PID: 1800)
      • svchost.exe (PID: 1908)
      • svchost.exe (PID: 1656)
      • svchost.exe (PID: 1548)
      • svchost.exe (PID: 1696)
      • svchost.exe (PID: 1836)
      • svchost.exe (PID: 2016)
      • svchost.exe (PID: 1916)
      • svchost.exe (PID: 2076)
      • svchost.exe (PID: 2184)
      • svchost.exe (PID: 2368)
      • svchost.exe (PID: 2376)
      • svchost.exe (PID: 2268)
      • svchost.exe (PID: 2432)
      • svchost.exe (PID: 2356)
      • spoolsv.exe (PID: 2660)
      • svchost.exe (PID: 2828)
      • svchost.exe (PID: 2720)
      • OfficeClickToRun.exe (PID: 2908)
      • svchost.exe (PID: 2888)
      • svchost.exe (PID: 2924)
      • svchost.exe (PID: 2900)
      • svchost.exe (PID: 2944)
      • svchost.exe (PID: 3056)
      • svchost.exe (PID: 2972)
      • svchost.exe (PID: 2964)
      • svchost.exe (PID: 3160)
      • svchost.exe (PID: 2256)
      • svchost.exe (PID: 3352)
      • svchost.exe (PID: 3152)
      • svchost.exe (PID: 3632)
      • svchost.exe (PID: 3936)
      • dasHost.exe (PID: 4056)
      • svchost.exe (PID: 3968)
      • svchost.exe (PID: 4404)
      • svchost.exe (PID: 3716)
      • svchost.exe (PID: 2984)
      • sihost.exe (PID: 1560)
      • svchost.exe (PID: 4168)
      • ctfmon.exe (PID: 4252)
      • svchost.exe (PID: 4364)
      • svchost.exe (PID: 4176)
      • explorer.exe (PID: 4472)
      • RuntimeBroker.exe (PID: 5048)
      • svchost.exe (PID: 4732)
      • RuntimeBroker.exe (PID: 5212)
      • svchost.exe (PID: 3032)
      • svchost.exe (PID: 3876)
      • svchost.exe (PID: 5456)
      • ApplicationFrameHost.exe (PID: 5544)
      • MoUsoCoreWorker.exe (PID: 5140)
      • UserOOBEBroker.exe (PID: 5760)
      • uhssvc.exe (PID: 1716)
      • svchost.exe (PID: 544)
      • svchost.exe (PID: 2760)
      • svchost.exe (PID: 2732)
      • svchost.exe (PID: 1784)
      • svchost.exe (PID: 2408)
      • svchost.exe (PID: 2508)
      • svchost.exe (PID: 3368)
      • WmiPrvSE.exe (PID: 1744)
      • svchost.exe (PID: 6340)
      • WmiPrvSE.exe (PID: 708)
      • dllhost.exe (PID: 5408)
      • RuntimeBroker.exe (PID: 5888)
      • dllhost.exe (PID: 6000)
      • RuntimeBroker.exe (PID: 2876)
      • svchost.exe (PID: 4716)
      • taskhostw.exe (PID: 4936)

    • Modifies hosts file to block updates

      • build.exe (PID: 6356)

    • Runs injected code in another process

      • dialer.exe (PID: 6384)
      • dialer.exe (PID: 6396)

    • Actions looks like stealing of personal data

      • 323.exe (PID: 6388)

    • METASTEALER has been detected (SURICATA)

      • 323.exe (PID: 6388)

    • Creates a writable file in the system directory

      • powershell.exe (PID: 1604)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • 82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe (PID: 6276)
      • DCRatBuild.exe (PID: 6380)
      • MVPInstaller.exe (PID: 6564)

    • Reads security settings of Internet Explorer

      • 82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe (PID: 6276)
      • DCRatBuild.exe (PID: 6380)
      • TextInputHost.exe (PID: 6892)
      • MVPInstaller.exe (PID: 6564)
      • OfficeClickToRun.exe (PID: 2908)

    • Executable content was dropped or overwritten

      • 82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe (PID: 6276)
      • MVPInstaller.exe (PID: 6440)
      • DCRatBuild.exe (PID: 6380)
      • MVPInstaller.exe (PID: 6564)
      • build.exe (PID: 6356)
      • WinUpdater.exe (PID: 5032)

    • Reads the Windows owner or organization settings

      • MVPInstaller.exe (PID: 6440)

    • Executing commands from a ".bat" file

      • MVPInstaller.exe (PID: 6440)
      • wscript.exe (PID: 6540)

    • Starts CMD.EXE for commands execution

      • MVPInstaller.exe (PID: 6440)
      • wscript.exe (PID: 6540)
      • build.exe (PID: 6356)
      • WinUpdater.exe (PID: 5032)

    • Process drops legitimate windows executable

      • MVPInstaller.exe (PID: 6564)
      • svchost.exe (PID: 2732)

    • Script adds exclusion extension to Windows Defender

      • build.exe (PID: 6356)
      • WinUpdater.exe (PID: 5032)

    • Script adds exclusion path to Windows Defender

      • build.exe (PID: 6356)
      • WinUpdater.exe (PID: 5032)

    • Starts POWERSHELL.EXE for commands execution

      • build.exe (PID: 6356)
      • WinUpdater.exe (PID: 5032)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 6540)

    • The process drops C-runtime libraries

      • MVPInstaller.exe (PID: 6564)

    • Searches for installed software

      • 323.exe (PID: 6388)

    • Process uninstalls Windows update

      • wusa.exe (PID: 6660)
      • wusa.exe (PID: 2480)

    • Starts SC.EXE for service management

      • build.exe (PID: 6356)

    • Executes as Windows Service

      • WinUpdater.exe (PID: 5032)

    • Drops a system driver (possible attempt to evade defenses)

      • WinUpdater.exe (PID: 5032)

    • Connects to unusual port

      • dialer.exe (PID: 3728)
      • 323.exe (PID: 6388)

    • Checks Windows Trust Settings

      • OfficeClickToRun.exe (PID: 2908)

  • INFO

    • Checks supported languages

      • build.exe (PID: 6356)
      • 82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe (PID: 6276)
      • 323.exe (PID: 6388)
      • DCRatBuild.exe (PID: 6380)
      • MVPInstaller.exe (PID: 6440)
      • MVPInstaller.exe (PID: 6564)
      • MVPInstaller.exe (PID: 6716)
      • TextInputHost.exe (PID: 6892)
      • WindowsUpdate.exe (PID: 2312)
      • WinUpdater.exe (PID: 5032)

    • Reads the computer name

      • 82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe (PID: 6276)
      • DCRatBuild.exe (PID: 6380)
      • MVPInstaller.exe (PID: 6440)
      • MVPInstaller.exe (PID: 6564)
      • 323.exe (PID: 6388)
      • MVPInstaller.exe (PID: 6716)
      • TextInputHost.exe (PID: 6892)
      • WindowsUpdate.exe (PID: 2312)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 4472)
      • RuntimeBroker.exe (PID: 2876)

    • Process checks computer location settings

      • 82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe (PID: 6276)
      • DCRatBuild.exe (PID: 6380)
      • MVPInstaller.exe (PID: 6564)

    • Create files in a temporary directory

      • 82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe (PID: 6276)
      • MVPInstaller.exe (PID: 6440)
      • MVPInstaller.exe (PID: 6564)

    • Reads the software policy settings

      • lsass.exe (PID: 748)
      • OfficeClickToRun.exe (PID: 2908)

    • Creates files in the program directory

      • MVPInstaller.exe (PID: 6440)
      • MoUsoCoreWorker.exe (PID: 5140)
      • build.exe (PID: 6356)
      • svchost.exe (PID: 1032)

    • Creates files or folders in the user directory

      • MVPInstaller.exe (PID: 6440)
      • dllhost.exe (PID: 5408)
      • lsass.exe (PID: 748)

    • Reads the machine GUID from the registry

      • 323.exe (PID: 6388)
      • WindowsUpdate.exe (PID: 2312)
      • OfficeClickToRun.exe (PID: 2908)

    • Reads Microsoft Office registry keys

      • OfficeClickToRun.exe (PID: 2908)

    • Reads Environment values

      • WindowsUpdate.exe (PID: 2312)
      • 323.exe (PID: 6388)

    • Reads the time zone

      • WmiPrvSE.exe (PID: 708)

    • Reads Windows Product ID

      • WmiPrvSE.exe (PID: 708)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6992)
      • powershell.exe (PID: 1604)

    • Drops the executable file immediately after the start

      • svchost.exe (PID: 2732)

    • Creates a writable file in the system directory

      • svchost.exe (PID: 2924)
      • lsass.exe (PID: 748)
      • OfficeClickToRun.exe (PID: 2908)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 5120
InitializedDataSize: 25021952
UninitializedDataSize: -
EntryPoint: 0x20cc
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.0.0.0
ProductVersionNumber: 2.0.0.0
FileFlagsMask: 0x003f
FileFlags: Pre-release
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: -
CompanyName: MVPLoader LLC
FileDescription: MVPInstaller Setup
FileVersion: 2
InternalName: MVPInstaller
LegalCopyright: Copyright © 2024 MVPLoader LLC
LegalTrademarks: -
OriginalFileName: MVPInstaller.exe
PrivateBuild: -
ProductName: MVPInstaller
ProductVersion: 2
SpecialBuild: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
165
Monitored processes
127
Malicious processes
95
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe svchost.exe build.exe dcratbuild.exe #METASTEALER 323.exe mvpinstaller.exe wscript.exe no specs mvpinstaller.exe cmd.exe no specs conhost.exe no specs mvpinstaller.exe no specs textinputhost.exe no specs powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs windowsupdate.exe no specs wmiprvse.exe wmiprvse.exe cmd.exe no specs conhost.exe no specs dialer.exe no specs sc.exe no specs conhost.exe no specs wusa.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs winupdater.exe choice.exe no specs powershell.exe no specs conhost.exe no specs runtimebroker.exe svchost.exe taskhostw.exe cmd.exe no specs conhost.exe no specs dialer.exe no specs dialer.exe no specs dialer.exe wusa.exe no specs filecoauth.exe no specs svchost.exe dwm.exe svchost.exe winlogon.exe lsass.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe sihost.exe svchost.exe svchost.exe svchost.exe uhssvc.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe spoolsv.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe officeclicktorun.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe dashost.exe svchost.exe svchost.exe ctfmon.exe svchost.exe svchost.exe explorer.exe svchost.exe runtimebroker.exe mousocoreworker.exe runtimebroker.exe dllhost.exe svchost.exe applicationframehost.exe useroobebroker.exe runtimebroker.exe dllhost.exe 82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
488C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p -s LSMC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\lsm.dll
c:\windows\system32\msvcrt.dll
504"dwm.exe"C:\Windows\System32\dwm.exe
winlogon.exe
User:
DWM-1
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Desktop Window Manager
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dwm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
544C:\WINDOWS\System32\svchost.exe -k netsvcs -pC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
668winlogon.exeC:\Windows\System32\winlogon.exe
—
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Logon Application
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\winlogon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
708C:\WINDOWS\system32\wbem\wmiprvse.exe -secured -EmbeddingC:\Windows\System32\wbem\WmiPrvSE.exe
svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
WMI Provider Host
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmiprvse.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wbem\fastprox.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ncobjapi.dll
748C:\WINDOWS\system32\lsass.exeC:\Windows\System32\lsass.exe
wininit.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Local Security Authority Process
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\lsass.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\lsasrv.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\sechost.dll
780C:\WINDOWS\system32\dialer.exeC:\Windows\System32\dialer.exe—WinUpdater.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Phone Dialer
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dialer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
784C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s gpsvcC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
1032C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s DsmSvcC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
1064C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhostsC:\Windows\System32\svchost.exe
services.exe
User:
LOCAL SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
Total events
79 205
Read events
78 334
Write events
592
Delete events
279

Modification events

(PID) Process:(4472) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Security and Maintenance\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
23004100430042006C006F00620000000000000000000000010000000000000044000000
(PID) Process:(748) lsass.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\SecureTimeLimits
Operation:writeName:SecureTimeHigh
Value:
5E3432F6CE6FDA01
(PID) Process:(748) lsass.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\SecureTimeLimits
Operation:writeName:SecureTimeEstimated
Value:
5ECC6D94C66FDA01
(PID) Process:(748) lsass.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\SecureTimeLimits
Operation:writeName:SecureTimeLow
Value:
5E64A932BE6FDA01
(PID) Process:(748) lsass.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\SecureTimeLimits\RunTime
Operation:writeName:SecureTimeTickCount
Value:
465C110000000000
(PID) Process:(748) lsass.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\W32Time\SecureTimeLimits\RunTime
Operation:writeName:SecureTimeConfidence
Value:
0
(PID) Process:(6276) 82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(6276) 82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6276) 82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6276) 82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
Executable files
27
Suspicious files
100
Text files
23
Unknown types
2

Dropped files

PID
Process
Filename
Type
6380DCRatBuild.exeC:\WindowsUpdate\2UpMr4oh.battext
MD5:ECECCB4DAB2899A896F6727230DDB26A
SHA256:F7F7150AE59104004CC4BDD36110807333EF0A27C0CE0A08FD0AE2646159F73C
6564MVPInstaller.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\data\app.so —
MD5:—
SHA256:—
1664svchost.exeC:\Windows\Prefetch\82AE530EB29E0C64986DBD019F86C-785B32DF.pfbinary
MD5:22B07320906C064A3C75E8154520543F
SHA256:CF0D5FD2262135EECDD8DD4A4AEA8B3AFA02797A2EA71F658876A9466C4679CC
6440MVPInstaller.exeC:\Users\admin\AppData\Local\Temp\gentee65\setup_temp.geabs
MD5:7637EEC1732BE8F409C7D8C96D7BC21A
SHA256:91A7DB05E07460D7F3D2304B44DE6FD49F8FAA8345264D5D23D0525EBDB1D0B8
4472explorer.exeC:\Users\admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.datbinary
MD5:E49C56350AEDF784BFE00E444B879672
SHA256:A8BD235303668981563DFB5AAE338CB802817C4060E2C199B7C84901D57B7E1E
6440MVPInstaller.exeC:\Users\admin\AppData\Local\Temp\genteert.dllexecutable
MD5:6CE814FD1AD7AE07A9E462C26B3A0F69
SHA256:54C0DA1735BB1CB02B60C321DE938488345F8D1D26BF389C8CB2ACAD5D01B831
6440MVPInstaller.exeC:\Users\admin\AppData\Local\Temp\gentee65\guig.dllexecutable
MD5:D3F8C0334C19198A109E44D074DAC5FD
SHA256:005C251C21D6A5BA1C3281E7B9F3B4F684D007E0C3486B34A545BB370D8420AA
6380DCRatBuild.exeC:\WindowsUpdate\WindowsUpdate.exeexecutable
MD5:0B87D00F10456B51ADA70C1B7807338A
SHA256:4E4816037287D21798D7B3D11A3C32BC6B32DB6C07CA9AF6D3F603B6E77111FA
6380DCRatBuild.exeC:\WindowsUpdate\TEUXpnVW2Rogcdt2Uv.vbevbe
MD5:EA0CABD5FC14E86870EF589016AD6400
SHA256:3F5A8EF3D4412432127FEAB5637A18B59CB06EC47FAEFAE6F54DFCDE27A5CBF7
1664svchost.exeC:\Windows\Prefetch\SVCHOST.EXE-0C2D202C.pfbinary
MD5:462462C0EE5E4C7DC19F27C5F0855970
SHA256:96D4ACBFCA738F70EA3AA9874BFA6BE281F38C0AF29C98B065D4A759CC5A6C33
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
54
DNS requests
26
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4264
svchost.exe
GET
200
2.16.164.18:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
4264
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
4680
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
—
—
unknown
7116
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
2508
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
7116
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
6172
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
unknown
2908
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
239.255.255.250:1900
—
—
—
unknown
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4708
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5140
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4264
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4264
svchost.exe
2.16.164.18:80
crl.microsoft.com
Akamai International B.V.
NL
unknown
4264
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
unknown
6388
323.exe
176.123.161.158:1337
—
OOO MediaSeti
RU
malicious
4
System
192.168.100.255:138
—
—
—
whitelisted
5140
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.16.164.18
  • 2.16.164.51
  • 2.16.164.32
  • 2.16.164.34
  • 2.16.164.40
  • 2.16.164.106
  • 2.16.164.81
  • 2.16.164.72
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.133
  • 40.126.32.72
  • 20.190.160.22
  • 40.126.32.140
  • 20.190.160.14
  • 40.126.32.134
  • 40.126.32.136
  • 40.126.32.76
whitelisted
go.microsoft.com
  • 2.18.97.227
whitelisted
slscr.update.microsoft.com
  • 40.68.123.157
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.166.126.56
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
xmr.2miners.com
  • 162.19.139.184
unknown

Threats

PID
Process
Class
Message
6388
323.exe
Potentially Bad Traffic
ET INFO Microsoft net.tcp Connection Initialization Activity
6388
323.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] RedLine Stealer/MetaStealer Family Related (MC-NMF Authorization)
6388
323.exe
A Network Trojan was detected
ET MALWARE Redline Stealer/MetaStealer Family Activity (Response)
2184
svchost.exe
Crypto Currency Mining Activity Detected
ET COINMINER Observed DNS Query to Cryptocurrency Mining Pool Domain (xmr .2miners .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
82ae530eb29e0c64986dbd019f86cac5eff3daf3c1fb861757a60252eb1e4661.exe