File name:

jXqUdWioqMkmaGwe.exe

Full analysis: https://app.any.run/tasks/6cc7d7ea-d9df-4068-97cf-370552a66a60
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: May 25, 2025, 09:45:12
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
api-base64
zerotrace
arch-doc
arch-html
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

B641B6A7CBA004444907A22E66EE60E9

SHA1:

EC789FB318D4A29C98AB6D4B1A987A3510CDD2D3

SHA256:

8D76C6EEDCA924A34D01CA64108418E93D28C90FEDD650FED18FA4368D79271E

SSDEEP:

49152:7DOlJjyULcWg4q2vX9OLQTM+acHEGSEGGVju0yxFXj0ia+CtbQRfrYIvV8ARgzDO:

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • grpconv.exe (PID: 4300)
      • grpconv.exe (PID: 5956)
      • grpconv.exe (PID: 5452)
      • grpconv.exe (PID: 5280)
      • grpconv.exe (PID: 2904)
      • grpconv.exe (PID: 4628)
      • grpconv.exe (PID: 7856)
      • grpconv.exe (PID: 4452)
      • grpconv.exe (PID: 7664)
      • grpconv.exe (PID: 6184)
      • grpconv.exe (PID: 8136)
      • grpconv.exe (PID: 8164)
      • grpconv.exe (PID: 7556)
      • jXqUdWioqMkmaGwe.exe (PID: 5552)
      • grpconv.exe (PID: 8752)
      • jXqUdWioqMkmaGwe.exe (PID: 4220)
      • grpconv.exe (PID: 8472)
      • grpconv.exe (PID: 7972)

    • Steals credentials from Web Browsers

      • grpconv.exe (PID: 4300)
      • grpconv.exe (PID: 5956)
      • grpconv.exe (PID: 5280)
      • grpconv.exe (PID: 2904)
      • grpconv.exe (PID: 5452)
      • grpconv.exe (PID: 4452)
      • grpconv.exe (PID: 7856)
      • grpconv.exe (PID: 7664)
      • grpconv.exe (PID: 6184)
      • grpconv.exe (PID: 8164)
      • grpconv.exe (PID: 7556)
      • grpconv.exe (PID: 8752)
      • grpconv.exe (PID: 8472)

    • ZEROTRACE has been detected

      • jXqUdWioqMkmaGwe.exe (PID: 5552)
      • jXqUdWioqMkmaGwe.exe (PID: 4220)

    • Changes powershell execution policy (Bypass)

      • jXqUdWioqMkmaGwe.exe (PID: 5552)
      • jXqUdWioqMkmaGwe.exe (PID: 4220)
      • jXqUdWioqMkmaGwe.exe (PID: 4748)
      • jXqUdWioqMkmaGwe.exe (PID: 7280)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 7528)
      • powershell.exe (PID: 7780)
      • powershell.exe (PID: 9272)
      • powershell.exe (PID: 7364)

    • Suspicious browser debugging (Possible cookie theft)

      • chrome.exe (PID: 10108)
      • chrome.exe (PID: 9432)
      • chrome.exe (PID: 8020)
      • chrome.exe (PID: 5728)
      • msedge.exe (PID: 9440)
      • chrome.exe (PID: 5576)
      • msedge.exe (PID: 10204)
      • msedge.exe (PID: 8652)
      • msedge.exe (PID: 10208)
      • chrome.exe (PID: 8888)
      • msedge.exe (PID: 8044)
      • msedge.exe (PID: 2568)
      • msedge.exe (PID: 7880)
      • chrome.exe (PID: 10208)
      • msedge.exe (PID: 6744)
      • chrome.exe (PID: 864)
      • msedge.exe (PID: 5580)

  • SUSPICIOUS

    • Multiple wallet extension IDs have been found

      • jXqUdWioqMkmaGwe.exe (PID: 5552)
      • jXqUdWioqMkmaGwe.exe (PID: 4220)
      • jXqUdWioqMkmaGwe.exe (PID: 4748)
      • jXqUdWioqMkmaGwe.exe (PID: 7280)

    • Starts POWERSHELL.EXE for commands execution

      • jXqUdWioqMkmaGwe.exe (PID: 5552)
      • jXqUdWioqMkmaGwe.exe (PID: 4220)
      • jXqUdWioqMkmaGwe.exe (PID: 4748)
      • jXqUdWioqMkmaGwe.exe (PID: 7280)

    • The process executes Powershell scripts

      • jXqUdWioqMkmaGwe.exe (PID: 5552)
      • jXqUdWioqMkmaGwe.exe (PID: 4220)
      • jXqUdWioqMkmaGwe.exe (PID: 4748)
      • jXqUdWioqMkmaGwe.exe (PID: 7280)

    • MS Edge headless start

      • msedge.exe (PID: 9440)
      • msedge.exe (PID: 9816)
      • msedge.exe (PID: 8652)
      • msedge.exe (PID: 5604)
      • msedge.exe (PID: 10204)
      • msedge.exe (PID: 10208)
      • msedge.exe (PID: 9636)
      • msedge.exe (PID: 9132)
      • msedge.exe (PID: 8044)
      • msedge.exe (PID: 2568)
      • msedge.exe (PID: 8456)
      • msedge.exe (PID: 7880)
      • msedge.exe (PID: 5232)
      • msedge.exe (PID: 6744)
      • msedge.exe (PID: 5580)
      • msedge.exe (PID: 7104)
      • msedge.exe (PID: 8876)

  • INFO

    • Reads the computer name

      • jXqUdWioqMkmaGwe.exe (PID: 5552)
      • jXqUdWioqMkmaGwe.exe (PID: 4220)
      • jXqUdWioqMkmaGwe.exe (PID: 4748)

    • Creates files or folders in the user directory

      • grpconv.exe (PID: 6044)
      • grpconv.exe (PID: 6820)
      • grpconv.exe (PID: 4300)
      • grpconv.exe (PID: 5404)
      • grpconv.exe (PID: 5008)
      • grpconv.exe (PID: 6656)
      • grpconv.exe (PID: 5332)
      • grpconv.exe (PID: 1348)
      • grpconv.exe (PID: 5280)
      • grpconv.exe (PID: 2148)
      • grpconv.exe (PID: 5116)
      • grpconv.exe (PID: 5956)
      • grpconv.exe (PID: 2240)
      • grpconv.exe (PID: 4192)
      • grpconv.exe (PID: 4408)
      • grpconv.exe (PID: 2904)
      • grpconv.exe (PID: 5380)
      • grpconv.exe (PID: 1600)
      • grpconv.exe (PID: 660)
      • grpconv.exe (PID: 2320)
      • grpconv.exe (PID: 4628)
      • grpconv.exe (PID: 5452)
      • grpconv.exe (PID: 4452)
      • grpconv.exe (PID: 7532)
      • grpconv.exe (PID: 7664)
      • grpconv.exe (PID: 6184)
      • grpconv.exe (PID: 5064)
      • grpconv.exe (PID: 8136)
      • grpconv.exe (PID: 8164)
      • grpconv.exe (PID: 7556)
      • grpconv.exe (PID: 7856)
      • grpconv.exe (PID: 7568)
      • grpconv.exe (PID: 8752)
      • grpconv.exe (PID: 8804)
      • grpconv.exe (PID: 8472)
      • grpconv.exe (PID: 7972)
      • grpconv.exe (PID: 4380)

    • Create files in a temporary directory

      • grpconv.exe (PID: 6044)
      • grpconv.exe (PID: 6820)
      • grpconv.exe (PID: 6656)
      • grpconv.exe (PID: 1348)
      • grpconv.exe (PID: 5452)
      • grpconv.exe (PID: 4192)
      • grpconv.exe (PID: 5280)
      • grpconv.exe (PID: 5380)
      • grpconv.exe (PID: 7856)
      • jXqUdWioqMkmaGwe.exe (PID: 5552)
      • grpconv.exe (PID: 8164)
      • grpconv.exe (PID: 7556)
      • grpconv.exe (PID: 8752)
      • jXqUdWioqMkmaGwe.exe (PID: 4220)

    • Checks supported languages

      • jXqUdWioqMkmaGwe.exe (PID: 5552)
      • jXqUdWioqMkmaGwe.exe (PID: 4220)
      • jXqUdWioqMkmaGwe.exe (PID: 4748)

    • Manual execution by a user

      • jXqUdWioqMkmaGwe.exe (PID: 4220)
      • jXqUdWioqMkmaGwe.exe (PID: 4748)
      • msedge.exe (PID: 6480)
      • firefox.exe (PID: 7264)
      • mspaint.exe (PID: 8700)
      • msedge.exe (PID: 2568)
      • jXqUdWioqMkmaGwe.exe (PID: 7280)
      • firefox.exe (PID: 8124)
      • galaxy_shooter.exe (PID: 8016)
      • galaxy_shooter.exe (PID: 8692)
      • galaxy_shooter.exe (PID: 10016)
      • galaxy_shooter.exe (PID: 5956)

    • Reads the machine GUID from the registry

      • jXqUdWioqMkmaGwe.exe (PID: 5552)
      • jXqUdWioqMkmaGwe.exe (PID: 4220)
      • jXqUdWioqMkmaGwe.exe (PID: 4748)

    • Potential access to remote process (Base64 Encoded 'OpenProcess')

      • jXqUdWioqMkmaGwe.exe (PID: 5552)
      • jXqUdWioqMkmaGwe.exe (PID: 4220)
      • jXqUdWioqMkmaGwe.exe (PID: 4748)
      • jXqUdWioqMkmaGwe.exe (PID: 7280)

    • Potential remote process memory reading (Base64 Encoded 'ReadProcessMemory')

      • jXqUdWioqMkmaGwe.exe (PID: 5552)
      • jXqUdWioqMkmaGwe.exe (PID: 4220)
      • jXqUdWioqMkmaGwe.exe (PID: 4748)
      • jXqUdWioqMkmaGwe.exe (PID: 7280)

    • Potential library load (Base64 Encoded 'LoadLibrary')

      • jXqUdWioqMkmaGwe.exe (PID: 5552)
      • jXqUdWioqMkmaGwe.exe (PID: 4220)
      • jXqUdWioqMkmaGwe.exe (PID: 4748)
      • jXqUdWioqMkmaGwe.exe (PID: 7280)

    • Potential dynamic function import (Base64 Encoded 'GetProcAddress')

      • jXqUdWioqMkmaGwe.exe (PID: 5552)
      • jXqUdWioqMkmaGwe.exe (PID: 4220)
      • jXqUdWioqMkmaGwe.exe (PID: 4748)
      • jXqUdWioqMkmaGwe.exe (PID: 7280)

    • Reads Microsoft Office registry keys

      • grpconv.exe (PID: 1600)
      • grpconv.exe (PID: 7532)
      • grpconv.exe (PID: 4380)

    • Reads Windows Product ID

      • grpconv.exe (PID: 1600)
      • grpconv.exe (PID: 7532)
      • grpconv.exe (PID: 4380)

    • Application launched itself

      • msedge.exe (PID: 6480)
      • firefox.exe (PID: 7264)
      • firefox.exe (PID: 7748)
      • chrome.exe (PID: 8020)
      • chrome.exe (PID: 5728)
      • chrome.exe (PID: 9432)
      • msedge.exe (PID: 9440)
      • chrome.exe (PID: 5576)
      • msedge.exe (PID: 8652)
      • chrome.exe (PID: 10108)
      • chrome.exe (PID: 8888)
      • msedge.exe (PID: 7880)
      • msedge.exe (PID: 8044)
      • msedge.exe (PID: 2568)
      • msedge.exe (PID: 10204)
      • chrome.exe (PID: 10208)
      • chrome.exe (PID: 864)
      • msedge.exe (PID: 6744)
      • msedge.exe (PID: 5580)
      • firefox.exe (PID: 8124)

    • Reads CPU info

      • jXqUdWioqMkmaGwe.exe (PID: 5552)
      • jXqUdWioqMkmaGwe.exe (PID: 4220)

    • Potential remote process memory writing (Base64 Encoded 'WriteProcessMemory')

      • jXqUdWioqMkmaGwe.exe (PID: 4748)

    • Potential remote process memory interaction (Base64 Encoded 'VirtualAllocEx')

      • jXqUdWioqMkmaGwe.exe (PID: 4748)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2102:03:16 01:25:54+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 11233280
InitializedDataSize: 2560
UninitializedDataSize: -
EntryPoint: 0xab863e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: ZeroTraceOfficialStub
FileVersion: 1.0.0.0
InternalName: ZeroTraceOfficialStub.exe
LegalCopyright: Copyright © 2025
LegalTrademarks: -
OriginalFileName: ZeroTraceOfficialStub.exe
ProductName: ZeroTraceOfficialStub
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
401
Monitored processes
263
Malicious processes
42
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #ZEROTRACE jxqudwioqmkmagwe.exe grpconv.exe no specs grpconv.exe no specs grpconv.exe no specs #ZEROTRACE jxqudwioqmkmagwe.exe grpconv.exe no specs grpconv.exe no specs grpconv.exe no specs grpconv.exe no specs grpconv.exe no specs grpconv.exe grpconv.exe no specs grpconv.exe grpconv.exe no specs grpconv.exe no specs grpconv.exe no specs grpconv.exe grpconv.exe no specs jxqudwioqmkmagwe.exe grpconv.exe no specs grpconv.exe no specs grpconv.exe grpconv.exe no specs grpconv.exe no specs grpconv.exe grpconv.exe no specs grpconv.exe no specs grpconv.exe no specs grpconv.exe no specs grpconv.exe no specs grpconv.exe grpconv.exe grpconv.exe no specs grpconv.exe no specs grpconv.exe msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs grpconv.exe no specs grpconv.exe no specs grpconv.exe no specs grpconv.exe grpconv.exe grpconv.exe no specs grpconv.exe no specs grpconv.exe no specs grpconv.exe no specs grpconv.exe grpconv.exe firefox.exe no specs grpconv.exe grpconv.exe no specs firefox.exe powershell.exe no specs conhost.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs grpconv.exe no specs grpconv.exe firefox.exe no specs grpconv.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs grpconv.exe powershell.exe no specs conhost.exe no specs grpconv.exe no specs grpconv.exe no specs rundll32.exe no specs grpconv.exe no specs grpconv.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs mspaint.exe no specs grpconv.exe no specs grpconv.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs grpconv.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs slui.exe msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs jxqudwioqmkmagwe.exe no specs grpconv.exe no specs grpconv.exe no specs grpconv.exe no specs grpconv.exe no specs grpconv.exe no specs grpconv.exe no specs grpconv.exe no specs grpconv.exe no specs grpconv.exe no specs grpconv.exe no specs grpconv.exe no specs grpconv.exe no specs grpconv.exe no specs grpconv.exe no specs grpconv.exe no specs powershell.exe no specs conhost.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs galaxy_shooter.exe no specs conhost.exe no specs galaxy_shooter.exe no specs conhost.exe no specs galaxy_shooter.exe no specs conhost.exe no specs galaxy_shooter.exe no specs conhost.exe no specs firefox.exe no specs firefox.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
660"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\admin\AppData\Roaming\InstalledApps-output_20250525094536.txt"C:\Windows\SysWOW64\grpconv.exe—jXqUdWioqMkmaGwe.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Progman Group Converter
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
864"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\admin\AppData\Local\Google\Chrome\User Data" C:\Program Files\Google\Chrome\Application\chrome.exe
powershell.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
4294967295
Version:
122.0.6261.70
1164\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
1348"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\admin\AppData\Roaming\FirefoxCookies-output_20250525094526.txt"C:\Windows\SysWOW64\grpconv.exe—jXqUdWioqMkmaGwe.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Progman Group Converter
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
1388"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\Google\Chrome\User Data" --extension-process --no-appcompat-clear --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3168 --field-trial-handle=2000,i,1075760629933849190,4741670095176492260,262144 --disable-features=PaintHolding --variations-seed-version /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
4294967295
Version:
122.0.6261.70
1600"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\admin\AppData\Roaming\ProductKeys-output_20250525094520.txt"C:\Windows\SysWOW64\grpconv.exe—jXqUdWioqMkmaGwe.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Progman Group Converter
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
2136"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\admin\AppData\Local\Google\Chrome\User Data" --no-appcompat-clear --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2908 --field-trial-handle=1996,i,12384331600449703036,4238405020745367606,262144 --disable-features=PaintHolding --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
4294967295
Version:
122.0.6261.70
2148"C:\Windows\SysWOW64\grpconv.exe" /shtml "C:\Users\admin\AppData\Roaming\watch-output_20250525094526.html"C:\Windows\SysWOW64\grpconv.exe—jXqUdWioqMkmaGwe.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Progman Group Converter
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
2148\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—galaxy_shooter.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
2240"C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\admin\AppData\Roaming\WorkingTasks-output_20250525094520.txt"C:\Windows\SysWOW64\grpconv.exe—jXqUdWioqMkmaGwe.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Progman Group Converter
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
67
Suspicious files
706
Text files
660
Unknown types
0

Dropped files

PID
Process
Filename
Type
6044grpconv.exeC:\Users\admin\AppData\Local\Temp\ecvB940.tmp —
MD5:—
SHA256:—
6656grpconv.exeC:\Users\admin\AppData\Local\Temp\ecvCE9C.tmp —
MD5:—
SHA256:—
5280grpconv.exeC:\Users\admin\AppData\Local\Temp\bhvE198.tmp —
MD5:—
SHA256:—
5280grpconv.exeC:\Users\admin\AppData\Local\Temp\sqpE2A2.tmp —
MD5:—
SHA256:—
5452grpconv.exeC:\Users\admin\AppData\Local\Temp\bhvF697.tmp —
MD5:—
SHA256:—
4192grpconv.exeC:\Users\admin\AppData\Local\Temp\ecvF7A0.tmp —
MD5:—
SHA256:—
5452grpconv.exeC:\Users\admin\AppData\Local\Temp\sqpF80F.tmp —
MD5:—
SHA256:—
5280grpconv.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\places.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
5280grpconv.exeC:\Users\admin\AppData\Local\Temp\sqpE2A2.tmp-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
5452grpconv.exeC:\Users\admin\AppData\Roaming\BrowserHistory-output_20250525094526.txttext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
24
TCP/UDP connections
317
DNS requests
449
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6676
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6676
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7748
firefox.exe
POST
200
142.250.186.67:80
http://o.pki.goog/s/wr3/FIY
unknown
—
—
whitelisted
7748
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
7748
firefox.exe
POST
200
2.16.168.113:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
7748
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
7748
firefox.exe
POST
200
2.16.168.113:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5796
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5024
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
40.126.31.129:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 2.23.246.101
whitelisted
google.com
  • 142.250.185.78
whitelisted
login.live.com
  • 40.126.31.129
  • 20.190.159.130
  • 40.126.31.131
  • 40.126.31.1
  • 20.190.159.75
  • 40.126.31.0
  • 40.126.31.2
  • 40.126.31.130
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.249
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
ntp.msn.com
  • 204.79.197.203
  • 131.253.33.203
whitelisted
edge.microsoft.com
  • 150.171.28.11
  • 150.171.27.11
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
jXqUdWioqMkmaGwe.exe