File name:

Unconfirmed 575566.crdownload

Full analysis: https://app.any.run/tasks/e716677b-692f-4271-83c2-b577b15ce9e8
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: January 15, 2026, 12:20:11
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
hiddentear
ransomware
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

C850F942CCF6E45230169CC4BD9EB5C8

SHA1:

51C647E2B150E781BD1910CAC4061A2CEE1DAF89

SHA256:

86E0EAC8C5CE70C4B839EF18AF5231B5F92E292B81E440193CDBDC7ED108049F

SSDEEP:

6144:Av+lDAAB6fm00rx/Qdd1QkfRLT+vLtls6LEmynPsVpw/pcPk19V:RdAAB6Mk1HfRLqzPlLEmynPsVpwBTV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Disables task manager

      • Unconfirmed 575566.crdownload.exe (PID: 7680)

    • Renames files like ransomware

      • Unconfirmed 575566.crdownload.exe (PID: 7680)

    • HIDDENTEAR has been detected (YARA)

      • Unconfirmed 575566.crdownload.exe (PID: 7680)

  • SUSPICIOUS

    • Changes the desktop background image

      • Unconfirmed 575566.crdownload.exe (PID: 7680)

  • INFO

    • Reads the machine GUID from the registry

      • Unconfirmed 575566.crdownload.exe (PID: 7680)

    • Reads the computer name

      • Unconfirmed 575566.crdownload.exe (PID: 7680)

    • Checks supported languages

      • Unconfirmed 575566.crdownload.exe (PID: 7680)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:06:02 15:44:57+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 394752
InitializedDataSize: 29184
UninitializedDataSize: -
EntryPoint: 0x62586
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: Loader
FileVersion: 1.0.0.0
InternalName: VapeHacksLoader.exe
LegalCopyright: Copyright © 2017
LegalTrademarks: -
OriginalFileName: VapeHacksLoader.exe
ProductName: Loader-Private
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #HIDDENTEAR unconfirmed 575566.crdownload.exe slui.exe no specs unconfirmed 575566.crdownload.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2564C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7524"C:\Users\admin\AppData\Local\Temp\Unconfirmed 575566.crdownload.exe" C:\Users\admin\AppData\Local\Temp\Unconfirmed 575566.crdownload.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Loader
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\unconfirmed 575566.crdownload.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7680"C:\Users\admin\AppData\Local\Temp\Unconfirmed 575566.crdownload.exe" C:\Users\admin\AppData\Local\Temp\Unconfirmed 575566.crdownload.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Loader
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\unconfirmed 575566.crdownload.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
281
Read events
279
Write events
2
Delete events
0

Modification events

(PID) Process:(7680) Unconfirmed 575566.crdownload.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:DisableTaskMgr
Value:
1
(PID) Process:(7680) Unconfirmed 575566.crdownload.exeKey:HKEY_CURRENT_USER\Control Panel\Desktop
Operation:writeName:Wallpaper
Value:
0
Executable files
0
Suspicious files
10
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
7680Unconfirmed 575566.crdownload.exeC:\Users\admin\Desktop\coverdifference.jpg.WINDOWSbinary
MD5:3BC7CB10D21D7123203866BA08FA6223
SHA256:A917523BB14775BE8B63762C53EFAAA8ED93898867DED11A2C5635899673413E
7680Unconfirmed 575566.crdownload.exeC:\Users\admin\Desktop\coverdifference.jpgbinary
MD5:3BC7CB10D21D7123203866BA08FA6223
SHA256:A917523BB14775BE8B63762C53EFAAA8ED93898867DED11A2C5635899673413E
7680Unconfirmed 575566.crdownload.exeC:\Users\admin\Desktop\futurekit.jpgbinary
MD5:4E759B1253193E978A24EF93CCE689AB
SHA256:D45A0B247FE7E47562DC7DD6B0A24470176B6CDC3E1435FD1C6A08E4A0480F3D
7680Unconfirmed 575566.crdownload.exeC:\Users\admin\Desktop\mostboard.jpgbinary
MD5:8AE536AEB8BD2B87A52BD8C0DA8E2BC6
SHA256:11AC56D42998507205093E1554643166473537FCEE755E452BB419FFD504C4E7
7680Unconfirmed 575566.crdownload.exeC:\Users\admin\Desktop\releasesincreased.pngbinary
MD5:CD1FAB10E54A8BC3A57863FFFBFFE584
SHA256:4568FC59BEEFD662EEA26A551E85507BDBF427D467883D90CBCCA17CB8371AC4
7680Unconfirmed 575566.crdownload.exeC:\Users\admin\Desktop\versionrepair.png.WINDOWSbinary
MD5:BB44A572406F8E4CB6F0EF94A961FD0B
SHA256:1ADB0A26B90852A746264A09786E2FA9C46A3F43AF4A0FAECEC9CEB6688F9A07
7680Unconfirmed 575566.crdownload.exeC:\Users\admin\Desktop\versionrepair.pngbinary
MD5:BB44A572406F8E4CB6F0EF94A961FD0B
SHA256:1ADB0A26B90852A746264A09786E2FA9C46A3F43AF4A0FAECEC9CEB6688F9A07
7680Unconfirmed 575566.crdownload.exeC:\Users\admin\Desktop\releasesincreased.png.WINDOWSbinary
MD5:CD1FAB10E54A8BC3A57863FFFBFFE584
SHA256:4568FC59BEEFD662EEA26A551E85507BDBF427D467883D90CBCCA17CB8371AC4
7680Unconfirmed 575566.crdownload.exeC:\Users\admin\Desktop\mostboard.jpg.WINDOWSbinary
MD5:8AE536AEB8BD2B87A52BD8C0DA8E2BC6
SHA256:11AC56D42998507205093E1554643166473537FCEE755E452BB419FFD504C4E7
7680Unconfirmed 575566.crdownload.exeC:\Users\admin\Desktop\READ_IT.txttext
MD5:D845190DB42D07B1F4A34292D8F335C7
SHA256:6BD70F8E5AFCAF2BAC76A5E40649BE7AD4D59FB10D37E4F18ED3B1027B714B9A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
24
TCP/UDP connections
25
DNS requests
17
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6768
MoUsoCoreWorker.exe
GET
304
4.231.128.59:443
https://settings-win.data.microsoft.com/settings/v3.0/OneSettings/Client?OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&LocalDeviceID=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&AttrDataVer=186&OSUILocale=en-US&OSSkuId=48&App=WOSC&AppVer=&IsFlightingEnabled=0&TelemetryLevel=1&DeviceFamily=Windows.Desktop
unknown
—
—
whitelisted
6768
MoUsoCoreWorker.exe
GET
304
4.231.128.59:443
https://settings-win.data.microsoft.com/settings/v3.0/wsd/muse?ProcessorClockSpeed=3094&FlightIds=&UpdateOfferedDays=4294967295&BranchReadinessLevel=CB&OEMManufacturerName=DELL&IsCloudDomainJoined=0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&sku=48&ActivationChannel=Retail&AttrDataVer=186&IsMDMEnrolled=0&ProcessorCores=6&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&TotalPhysicalRAM=6144&PrimaryDiskType=4294967295&FlightingBranchName=&ChassisTypeId=1&OEMModelNumber=DELL&SystemVolumeTotalCapacity=260281&sampleId=95271487&deviceClass=Windows.Desktop&App=muse&DisableDualScan=0&AppVer=10.0&OEMSubModel=J5CR&locale=en-US&IsAlwaysOnAlwaysConnectedCapable=0&ms=0&DefaultUserRegion=244&UpdateServiceUrl=http%3A%2F%2Fneverupdatewindows10.com&osVer=10.0.19045.4046.amd64fre.vb_release.191206-1406&os=windows&deviceId=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&DeferQualityUpdatePeriodInDays=0&ring=Retail&DeferFeatureUpdatePeriodInDays=30
unknown
—
—
whitelisted
8156
SIHClient.exe
GET
200
52.165.164.15:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
whitelisted
8156
SIHClient.exe
GET
200
74.178.240.61:443
https://slscr.update.microsoft.com/sls/ping
unknown
—
—
whitelisted
8156
SIHClient.exe
GET
304
74.178.240.61:443
https://slscr.update.microsoft.com/SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
23.55.110.193:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
4.231.128.59:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/WaaSAssessment?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&ring=Retail&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=10.0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=562&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=WaaSAssessment&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&ServicingBranch=CB&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&HonorWUfBDeferrals=1&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2
unknown
text
5.58 Kb
whitelisted
1176
svchost.exe
GET
200
4.231.128.59:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/UpdateHealthTools?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&sampleId=s:95271487&appVer=10.0.19041.3626&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=562&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=SedimentPack&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2
unknown
text
1.43 Kb
whitelisted
1176
svchost.exe
GET
200
72.246.29.11:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4336
svchost.exe
POST
200
20.190.159.128:443
https://login.live.com/RST2.srf
unknown
xml
11.1 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
1176
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6768
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5204
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
1176
svchost.exe
23.55.110.193:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
1176
svchost.exe
72.246.29.11:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
4336
svchost.exe
20.190.159.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4336
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
3412
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 216.58.206.46
whitelisted
crl.microsoft.com
  • 23.55.110.193
  • 23.55.110.211
  • 2.16.164.72
  • 2.16.164.49
whitelisted
www.microsoft.com
  • 72.246.29.11
  • 88.221.169.152
whitelisted
login.live.com
  • 20.190.159.128
  • 40.126.31.129
  • 20.190.159.2
  • 20.190.159.23
  • 20.190.159.68
  • 20.190.159.73
  • 40.126.31.128
  • 40.126.31.1
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
slscr.update.microsoft.com
  • 74.178.240.61
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted
self.events.data.microsoft.com
  • 20.189.173.27
whitelisted

Threats

PID
Process
Class
Message
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Unconfirmed 575566.crdownload