File name:

8a22ecaf0188e3c29e57e359d0cddfca00123895a3817cd64f0e37dac7c62d59

Full analysis: https://app.any.run/tasks/519d2155-4766-429c-b375-2b6eb58f7541
Verdict: Malicious activity
Threats:

Gh0st RAT is a malware with advanced trojan functionality that enables attackers to establish full control over the victim’s system. The spying capabilities of Gh0st RAT made it a go-to tool for numerous criminal groups in high-profile attacks against government and corporate organizations. The most common vector of attack involving this malware begins with spam and phishing emails.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 20:31:17
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
gh0st
rat
vmprotect
rdp
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

E61EE45EF81EED3BBD2343DD5E6F318F

SHA1:

ED8BFFD5E50E39E5E83942D90AF3905B8805FB16

SHA256:

8A22ECAF0188E3C29E57E359D0CDDFCA00123895A3817CD64F0E37DAC7C62D59

SSDEEP:

49152:ZaKoXA2V5VqZMBys8KZB6j/uDGspoHc+bi3vt2NCjE2NWgwvnfKKoTCZ+gKyEYVI:ZaKr2VHqZMR8KZB6j/vHc+bilgWEqWgJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • 8a22ecaf0188e3c29e57e359d0cddfca00123895a3817cd64f0e37dac7c62d59.exe (PID: 7352)
      • svchcst.exe (PID: 5868)
      • svchcst.exe (PID: 664)

    • Starts CMD.EXE for self-deleting

      • AK74.exe (PID: 7780)
      • AK74.exe (PID: 7656)

    • GH0ST mutex has been found

      • Ghiya.exe (PID: 7800)
      • 8a22ecaf0188e3c29e57e359d0cddfca00123895a3817cd64f0e37dac7c62d59.exe (PID: 7452)
      • Ghiya.exe (PID: 7832)
      • Ghiya.exe (PID: 7704)
      • svchcst.exe (PID: 664)
      • Ghiya.exe (PID: 7716)

    • GH0ST has been detected

      • AK74.exe (PID: 7780)
      • AK74.exe (PID: 7656)

    • Changes the autorun value in the registry

      • 8a22ecaf0188e3c29e57e359d0cddfca00123895a3817cd64f0e37dac7c62d59.exe (PID: 7452)

    • Create files in the Startup directory

      • 8a22ecaf0188e3c29e57e359d0cddfca00123895a3817cd64f0e37dac7c62d59.exe (PID: 7452)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 7996)

    • Creates or modifies Windows services

      • AK47.exe (PID: 7560)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 8a22ecaf0188e3c29e57e359d0cddfca00123895a3817cd64f0e37dac7c62d59.exe (PID: 7452)
      • AK47.exe (PID: 7504)
      • Ghiya.exe (PID: 7832)
      • AK47.exe (PID: 7560)
      • svchcst.exe (PID: 664)
      • AK74.exe (PID: 7780)

    • Reads security settings of Internet Explorer

      • 8a22ecaf0188e3c29e57e359d0cddfca00123895a3817cd64f0e37dac7c62d59.exe (PID: 7452)
      • svchcst.exe (PID: 664)

    • Mutex name with non-standard characters

      • AK47.exe (PID: 7512)
      • AK47.exe (PID: 7504)
      • AK47.exe (PID: 7560)
      • AK47.exe (PID: 7616)

    • Executes application which crashes

      • AK47.exe (PID: 7512)
      • AK47.exe (PID: 7504)

    • Executes as Windows Service

      • Ghiya.exe (PID: 7800)
      • Ghiya.exe (PID: 7716)

    • Hides command output

      • cmd.exe (PID: 7820)
      • cmd.exe (PID: 7720)

    • Starts CMD.EXE for commands execution

      • AK74.exe (PID: 7780)
      • AK74.exe (PID: 7656)

    • Application launched itself

      • Ghiya.exe (PID: 7800)
      • Ghiya.exe (PID: 7716)

    • Creates or modifies Windows services

      • Ghiya.exe (PID: 7832)

    • Drops a system driver (possible attempt to evade defenses)

      • Ghiya.exe (PID: 7832)

    • The process executes VB scripts

      • 8a22ecaf0188e3c29e57e359d0cddfca00123895a3817cd64f0e37dac7c62d59.exe (PID: 7452)

    • Creates files in the driver directory

      • Ghiya.exe (PID: 7832)

    • Accesses WMI object, sets custom ImpersonationLevel (SCRIPT)

      • wscript.exe (PID: 7996)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 7820)
      • cmd.exe (PID: 7720)

    • Executes WMI query (SCRIPT)

      • wscript.exe (PID: 7996)

    • There is functionality for taking screenshot (YARA)

      • 8a22ecaf0188e3c29e57e359d0cddfca00123895a3817cd64f0e37dac7c62d59.exe (PID: 7452)
      • Ghiya.exe (PID: 7832)

    • Connects to unusual port

      • 8a22ecaf0188e3c29e57e359d0cddfca00123895a3817cd64f0e37dac7c62d59.exe (PID: 7452)

    • There is functionality for enable RDP (YARA)

      • 8a22ecaf0188e3c29e57e359d0cddfca00123895a3817cd64f0e37dac7c62d59.exe (PID: 7452)

  • INFO

    • The sample compiled with chinese language support

      • 8a22ecaf0188e3c29e57e359d0cddfca00123895a3817cd64f0e37dac7c62d59.exe (PID: 7452)

    • Reads the computer name

      • 8a22ecaf0188e3c29e57e359d0cddfca00123895a3817cd64f0e37dac7c62d59.exe (PID: 7452)
      • AK74.exe (PID: 7780)
      • Ghiya.exe (PID: 7800)
      • Ghiya.exe (PID: 7832)
      • svchcst.exe (PID: 664)
      • AK47.exe (PID: 7560)
      • AK74.exe (PID: 7656)
      • Ghiya.exe (PID: 7716)

    • Process checks computer location settings

      • 8a22ecaf0188e3c29e57e359d0cddfca00123895a3817cd64f0e37dac7c62d59.exe (PID: 7452)
      • svchcst.exe (PID: 664)

    • Checks supported languages

      • AK47.exe (PID: 7512)
      • AK47.exe (PID: 7504)
      • Ghiya.exe (PID: 7800)
      • Ghiya.exe (PID: 7832)
      • 8a22ecaf0188e3c29e57e359d0cddfca00123895a3817cd64f0e37dac7c62d59.exe (PID: 7452)
      • svchcst.exe (PID: 664)
      • AK47.exe (PID: 7560)
      • AK74.exe (PID: 7656)
      • AK47.exe (PID: 7616)
      • Ghiya.exe (PID: 7716)
      • Ghiya.exe (PID: 7704)
      • AK74.exe (PID: 7780)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 7632)
      • 8a22ecaf0188e3c29e57e359d0cddfca00123895a3817cd64f0e37dac7c62d59.exe (PID: 7452)
      • WerFault.exe (PID: 7748)
      • WerFault.exe (PID: 7660)

    • Autorun file from Startup directory

      • 8a22ecaf0188e3c29e57e359d0cddfca00123895a3817cd64f0e37dac7c62d59.exe (PID: 7452)

    • VMProtect protector has been detected

      • 8a22ecaf0188e3c29e57e359d0cddfca00123895a3817cd64f0e37dac7c62d59.exe (PID: 7452)

    • Create files in a temporary directory

      • svchcst.exe (PID: 664)
      • 8a22ecaf0188e3c29e57e359d0cddfca00123895a3817cd64f0e37dac7c62d59.exe (PID: 7452)

    • Manual execution by a user

      • svchcst.exe (PID: 5868)
      • svchcst.exe (PID: 664)

    • Checks proxy server information

      • slui.exe (PID: 7752)

    • Reads the software policy settings

      • slui.exe (PID: 7752)

    • UPX packer has been detected

      • Ghiya.exe (PID: 7832)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:03:29 14:48:39+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 3530752
InitializedDataSize: 835584
UninitializedDataSize: -
EntryPoint: 0x2dfb0a
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
FileVersion: 1.0.0.0
FileDescription: Windows 配置程序
ProductName: Windows 核心进程
ProductVersion: 1.0.0.0
LegalCopyright: 作者版权所有 请尊重并使用正版
Comments: 本程序使用易语言编写(http://www.eyuyan.com)
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
155
Monitored processes
25
Malicious processes
9
Suspicious processes
3

Behavior graph

Click at the process to see the details
start #GH0ST 8a22ecaf0188e3c29e57e359d0cddfca00123895a3817cd64f0e37dac7c62d59.exe ak47.exe ak47.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs ak74.exe #GH0ST ghiya.exe no specs cmd.exe no specs #GH0ST ghiya.exe conhost.exe no specs ping.exe no specs wscript.exe no specs svchcst.exe no specs #GH0ST svchcst.exe ak47.exe ak47.exe no specs ak74.exe no specs #GH0ST ghiya.exe no specs cmd.exe no specs #GH0ST ghiya.exe no specs conhost.exe no specs ping.exe no specs slui.exe 8a22ecaf0188e3c29e57e359d0cddfca00123895a3817cd64f0e37dac7c62d59.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
664"C:\Users\admin\AppData\Roaming\Microsoft\svchcst.exe" C:\Users\admin\AppData\Roaming\Microsoft\svchcst.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Windows 配置程序
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\microsoft\svchcst.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
5868"C:\Users\admin\AppData\Roaming\Microsoft\svchcst.exe" C:\Users\admin\AppData\Roaming\Microsoft\svchcst.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Windows 配置程序
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\roaming\microsoft\svchcst.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7352"C:\Users\admin\Desktop\8a22ecaf0188e3c29e57e359d0cddfca00123895a3817cd64f0e37dac7c62d59.exe" C:\Users\admin\Desktop\8a22ecaf0188e3c29e57e359d0cddfca00123895a3817cd64f0e37dac7c62d59.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\8a22ecaf0188e3c29e57e359d0cddfca00123895a3817cd64f0e37dac7c62d59.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7452"C:\Users\admin\Desktop\8a22ecaf0188e3c29e57e359d0cddfca00123895a3817cd64f0e37dac7c62d59.exe" C:\Users\admin\Desktop\8a22ecaf0188e3c29e57e359d0cddfca00123895a3817cd64f0e37dac7c62d59.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\8a22ecaf0188e3c29e57e359d0cddfca00123895a3817cd64f0e37dac7c62d59.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
7504"C:\Users\admin\AppData\Local\Temp\AK47.exe" C:\Users\admin\AppData\Local\Temp\AK47.exe
8a22ecaf0188e3c29e57e359d0cddfca00123895a3817cd64f0e37dac7c62d59.exe
User:
admin
Company:
FEIM Studios
Integrity Level:
HIGH
Description:
A Free Enterprise Instant Messenger
Exit code:
3221225477
Version:
3, 5, 0, 1
Modules
Images
c:\users\admin\appdata\local\temp\ak47.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7512C:\Users\admin\AppData\Local\Temp\\AK47.exeC:\Users\admin\AppData\Local\Temp\AK47.exe
8a22ecaf0188e3c29e57e359d0cddfca00123895a3817cd64f0e37dac7c62d59.exe
User:
admin
Company:
FEIM Studios
Integrity Level:
HIGH
Description:
A Free Enterprise Instant Messenger
Exit code:
0
Version:
3, 5, 0, 1
Modules
Images
c:\users\admin\appdata\local\temp\ak47.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7560"C:\Users\admin\AppData\Local\Temp\AK47.exe" C:\Users\admin\AppData\Local\Temp\AK47.exe
svchcst.exe
User:
admin
Company:
FEIM Studios
Integrity Level:
HIGH
Description:
A Free Enterprise Instant Messenger
Exit code:
0
Version:
3, 5, 0, 1
Modules
Images
c:\users\admin\appdata\local\temp\ak47.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7616C:\Users\admin\AppData\Local\Temp\\AK47.exeC:\Users\admin\AppData\Local\Temp\AK47.exe—svchcst.exe
User:
admin
Company:
FEIM Studios
Integrity Level:
HIGH
Description:
A Free Enterprise Instant Messenger
Exit code:
0
Version:
3, 5, 0, 1
Modules
Images
c:\users\admin\appdata\local\temp\ak47.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7632C:\WINDOWS\SysWOW64\WerFault.exe -u -p 7512 -s 472C:\Windows\SysWOW64\WerFault.exe—AK47.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
7656C:\Users\admin\AppData\Local\Temp\\AK74.exeC:\Users\admin\AppData\Local\Temp\AK74.exe—svchcst.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\ak74.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
12 439
Read events
12 383
Write events
47
Delete events
9

Modification events

(PID) Process:(7660) WerFault.exeKey:\REGISTRY\A\{d74e2351-c42b-b74c-e0e2-a54852396949}\Root\InventoryApplicationFile
Operation:writeName:WritePermissionsCheck
Value:
1
(PID) Process:(7660) WerFault.exeKey:\REGISTRY\A\{d74e2351-c42b-b74c-e0e2-a54852396949}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Operation:delete keyName:(default)
Value:
(PID) Process:(7660) WerFault.exeKey:\REGISTRY\A\{d74e2351-c42b-b74c-e0e2-a54852396949}\Root\InventoryApplicationFile\ak47.exe|e9c334bf7b7ab4d1
Operation:writeName:ProgramId
Value:
0006f6f5183897db460d1605d721a83a06bb00000408
(PID) Process:(7660) WerFault.exeKey:\REGISTRY\A\{d74e2351-c42b-b74c-e0e2-a54852396949}\Root\InventoryApplicationFile\ak47.exe|e9c334bf7b7ab4d1
Operation:writeName:FileId
Value:
0000eca6a16ccd13adcfc27bc1041ddef97ec8081255
(PID) Process:(7660) WerFault.exeKey:\REGISTRY\A\{d74e2351-c42b-b74c-e0e2-a54852396949}\Root\InventoryApplicationFile\ak47.exe|e9c334bf7b7ab4d1
Operation:writeName:LowerCaseLongPath
Value:
c:\users\admin\appdata\local\temp\ak47.exe
(PID) Process:(7660) WerFault.exeKey:\REGISTRY\A\{d74e2351-c42b-b74c-e0e2-a54852396949}\Root\InventoryApplicationFile\ak47.exe|e9c334bf7b7ab4d1
Operation:writeName:LongPathHash
Value:
ak47.exe|e9c334bf7b7ab4d1
(PID) Process:(7660) WerFault.exeKey:\REGISTRY\A\{d74e2351-c42b-b74c-e0e2-a54852396949}\Root\InventoryApplicationFile\ak47.exe|e9c334bf7b7ab4d1
Operation:writeName:Name
Value:
AK47.exe
(PID) Process:(7660) WerFault.exeKey:\REGISTRY\A\{d74e2351-c42b-b74c-e0e2-a54852396949}\Root\InventoryApplicationFile\ak47.exe|e9c334bf7b7ab4d1
Operation:writeName:OriginalFileName
Value:
freeeim.exe
(PID) Process:(7660) WerFault.exeKey:\REGISTRY\A\{d74e2351-c42b-b74c-e0e2-a54852396949}\Root\InventoryApplicationFile\ak47.exe|e9c334bf7b7ab4d1
Operation:writeName:Publisher
Value:
feim studios
(PID) Process:(7660) WerFault.exeKey:\REGISTRY\A\{d74e2351-c42b-b74c-e0e2-a54852396949}\Root\InventoryApplicationFile\ak47.exe|e9c334bf7b7ab4d1
Operation:writeName:Version
Value:
3, 5, 0, 1
Executable files
9
Suspicious files
11
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
7660WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_AK47.exe_353d49645539527636f2b24bdf2b85f6a05152_2858139d_d8d33e22-4521-4e1c-87ee-cb247fd1a294\Report.wer —
MD5:—
SHA256:—
7632WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_AK47.exe_353d49645539527636f2b24bdf2b85f6a05152_2858139d_571e4ce6-7f3d-45f1-b537-ac53f8ddc4b6\Report.wer —
MD5:—
SHA256:—
7780AK74.exeC:\Windows\SysWOW64\Ghiya.exeexecutable
MD5:B0998AA7D5071D33DAA5B60B9C3C9735
SHA256:3080B6BB456564899B0D99D4131BD6A0B284D31F7D80EF773E4872D94048D49A
74528a22ecaf0188e3c29e57e359d0cddfca00123895a3817cd64f0e37dac7c62d59.exeC:\Users\admin\AppData\Local\Temp\AK47.exeexecutable
MD5:423EB994ED553294F8A6813619B8DA87
SHA256:050B4F2D5AE8EAECD414318DC8E222A56F169626DA6CA8FEB7EDD78E8B1F0218
7748WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_AK47.exe_64aa4f36e6aef78669aecf8d49802b2d81db24_2858139d_39d83ee7-60df-45c3-994d-41b79e2903d3\Report.wer —
MD5:—
SHA256:—
7632WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERCAF4.tmp.WERInternalMetadata.xmlbinary
MD5:9C8AB1AF84DD59507FB14C45D97CCEBB
SHA256:A1993CB4B78D1B408ED6FCE7069BF0DA03BD5656FCBC14A391E3682256943433
74528a22ecaf0188e3c29e57e359d0cddfca00123895a3817cd64f0e37dac7c62d59.exeC:\Users\admin\AppData\Roaming\Microsoft\VBS3.vbstext
MD5:712E56D9A5D762D86CE195597D105733
SHA256:6BFE31068BF83C16EBB885322041140F042E9ED62352B8F2BD7169F4AEB3BFD3
7832Ghiya.exeC:\Windows\System32\drivers\QAssist.sysexecutable
MD5:4E34C068E764AD0FF0CB58BC4F143197
SHA256:6CCE28B275D5EC20992BB13790976CAF434AB46DDBFD5CFD431D33424943122B
7748WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERCCE7.tmp.dmpbinary
MD5:379BB72A62B0F8347EEC2EDD4C68D1E5
SHA256:8B4E9312E4B31B12CFDBB2AA38D5E04394F8103A57B9917D02B9B8BEA9B57989
7632WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERCB92.tmp.xmlxml
MD5:544DEC8782F6E1CE9B2B2FF026D676A3
SHA256:28BAAEB328418CD7683795D7460DE13EA6189F3EF13ED796A9B7150FD429C1C5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
167
DNS requests
27
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7452
8a22ecaf0188e3c29e57e359d0cddfca00123895a3817cd64f0e37dac7c62d59.exe
43.249.193.73:54997
—
CHINA UNICOM China169 Backbone
CN
unknown
7204
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7752
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.78
whitelisted
cf1549064127.f3322.net
  • —
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
8a22ecaf0188e3c29e57e359d0cddfca00123895a3817cd64f0e37dac7c62d59