File name:

_8efdd3ae9cc090b78afa32eae41f092190edca16a112a33b16375ae51d9b828e.exe

Full analysis: https://app.any.run/tasks/913ccc38-8885-496b-90d2-504cab26e2a2
Verdict: Malicious activity
Analysis date: February 20, 2026, 13:34:25
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-startup
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections
MD5:

B0D64F35D10F7FCA715D77342EEAF469

SHA1:

CA1C5AB6F77D96B671B3F8B2E526D4A47756A8A0

SHA256:

8EFDD3AE9CC090B78AFA32EAE41F092190EDCA16A112A33B16375AE51D9B828E

SSDEEP:

24576:zV/omROEhlp827z6itSu/vtda7fyEhmnN81YzyR9PXRkRXet6gyzud6V1bfYOSyh:zV/omROEhlpX7z6itSu/v/a7JhmnN81y

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • ambiparous.exe (PID: 4856)

  • SUSPICIOUS

    • Starts itself from another location

      • _8efdd3ae9cc090b78afa32eae41f092190edca16a112a33b16375ae51d9b828e.exe (PID: 2572)

    • Executable content was dropped or overwritten

      • _8efdd3ae9cc090b78afa32eae41f092190edca16a112a33b16375ae51d9b828e.exe (PID: 2572)

    • Application launched itself

      • ambiparous.exe (PID: 4856)
      • ambiparous.exe (PID: 6424)
      • ambiparous.exe (PID: 7644)
      • ambiparous.exe (PID: 5356)
      • ambiparous.exe (PID: 2260)
      • ambiparous.exe (PID: 2788)
      • ambiparous.exe (PID: 2428)
      • ambiparous.exe (PID: 8228)
      • ambiparous.exe (PID: 3036)
      • ambiparous.exe (PID: 2016)
      • ambiparous.exe (PID: 8532)
      • ambiparous.exe (PID: 7844)
      • ambiparous.exe (PID: 8052)
      • ambiparous.exe (PID: 8284)
      • ambiparous.exe (PID: 4060)
      • ambiparous.exe (PID: 5604)
      • ambiparous.exe (PID: 2824)
      • ambiparous.exe (PID: 7728)
      • ambiparous.exe (PID: 2284)
      • ambiparous.exe (PID: 7048)
      • ambiparous.exe (PID: 3020)
      • ambiparous.exe (PID: 7936)
      • ambiparous.exe (PID: 3304)
      • ambiparous.exe (PID: 3560)
      • ambiparous.exe (PID: 6072)
      • ambiparous.exe (PID: 8232)
      • ambiparous.exe (PID: 3376)
      • ambiparous.exe (PID: 8260)
      • ambiparous.exe (PID: 2796)
      • ambiparous.exe (PID: 8088)
      • ambiparous.exe (PID: 6236)
      • ambiparous.exe (PID: 7608)
      • ambiparous.exe (PID: 7208)
      • ambiparous.exe (PID: 8552)
      • ambiparous.exe (PID: 7736)
      • ambiparous.exe (PID: 6600)
      • ambiparous.exe (PID: 664)
      • ambiparous.exe (PID: 7540)
      • ambiparous.exe (PID: 3240)
      • ambiparous.exe (PID: 5828)
      • ambiparous.exe (PID: 6692)
      • ambiparous.exe (PID: 2232)
      • ambiparous.exe (PID: 2944)
      • ambiparous.exe (PID: 5736)
      • ambiparous.exe (PID: 4616)
      • ambiparous.exe (PID: 5808)
      • ambiparous.exe (PID: 2748)
      • ambiparous.exe (PID: 4680)
      • ambiparous.exe (PID: 8320)
      • ambiparous.exe (PID: 8224)
      • ambiparous.exe (PID: 2868)
      • ambiparous.exe (PID: 5508)
      • ambiparous.exe (PID: 8676)
      • ambiparous.exe (PID: 7992)
      • ambiparous.exe (PID: 8660)
      • ambiparous.exe (PID: 684)
      • ambiparous.exe (PID: 8432)
      • ambiparous.exe (PID: 3152)
      • ambiparous.exe (PID: 6900)
      • ambiparous.exe (PID: 7036)
      • ambiparous.exe (PID: 1368)
      • ambiparous.exe (PID: 4352)
      • ambiparous.exe (PID: 9152)
      • ambiparous.exe (PID: 3652)
      • ambiparous.exe (PID: 6080)
      • ambiparous.exe (PID: 7376)
      • ambiparous.exe (PID: 8444)
      • ambiparous.exe (PID: 8084)
      • ambiparous.exe (PID: 8512)
      • ambiparous.exe (PID: 8628)
      • ambiparous.exe (PID: 7944)
      • ambiparous.exe (PID: 3656)
      • ambiparous.exe (PID: 6908)
      • ambiparous.exe (PID: 8816)
      • ambiparous.exe (PID: 6084)
      • ambiparous.exe (PID: 8852)
      • ambiparous.exe (PID: 6848)
      • ambiparous.exe (PID: 224)
      • ambiparous.exe (PID: 8944)
      • ambiparous.exe (PID: 7244)
      • ambiparous.exe (PID: 8736)
      • ambiparous.exe (PID: 4292)
      • ambiparous.exe (PID: 5440)
      • ambiparous.exe (PID: 1612)
      • ambiparous.exe (PID: 6996)
      • ambiparous.exe (PID: 7488)
      • ambiparous.exe (PID: 8640)
      • ambiparous.exe (PID: 3004)
      • ambiparous.exe (PID: 5040)
      • ambiparous.exe (PID: 7640)
      • ambiparous.exe (PID: 7460)
      • ambiparous.exe (PID: 3388)
      • ambiparous.exe (PID: 8360)
      • ambiparous.exe (PID: 3276)
      • ambiparous.exe (PID: 6784)
      • ambiparous.exe (PID: 1820)
      • ambiparous.exe (PID: 1136)
      • ambiparous.exe (PID: 1188)
      • ambiparous.exe (PID: 2756)
      • ambiparous.exe (PID: 7956)
      • ambiparous.exe (PID: 5888)
      • ambiparous.exe (PID: 8568)
      • ambiparous.exe (PID: 3192)
      • ambiparous.exe (PID: 1128)
      • ambiparous.exe (PID: 8496)
      • ambiparous.exe (PID: 3920)
      • ambiparous.exe (PID: 1316)
      • ambiparous.exe (PID: 1692)
      • ambiparous.exe (PID: 5708)
      • ambiparous.exe (PID: 1116)
      • ambiparous.exe (PID: 8032)
      • ambiparous.exe (PID: 7580)
      • ambiparous.exe (PID: 8332)
      • ambiparous.exe (PID: 7832)
      • ambiparous.exe (PID: 7308)
      • ambiparous.exe (PID: 8764)
      • ambiparous.exe (PID: 2600)
      • ambiparous.exe (PID: 7564)
      • ambiparous.exe (PID: 676)
      • ambiparous.exe (PID: 5464)
      • ambiparous.exe (PID: 8728)
      • ambiparous.exe (PID: 1984)
      • ambiparous.exe (PID: 1068)
      • ambiparous.exe (PID: 4188)
      • ambiparous.exe (PID: 7760)
      • ambiparous.exe (PID: 8564)
      • ambiparous.exe (PID: 7904)
      • ambiparous.exe (PID: 1488)
      • ambiparous.exe (PID: 8176)
      • ambiparous.exe (PID: 7480)
      • ambiparous.exe (PID: 8516)
      • ambiparous.exe (PID: 8468)
      • ambiparous.exe (PID: 1432)
      • ambiparous.exe (PID: 6880)
      • ambiparous.exe (PID: 4788)
      • ambiparous.exe (PID: 8700)
      • ambiparous.exe (PID: 7508)
      • ambiparous.exe (PID: 8028)
      • ambiparous.exe (PID: 3628)
      • ambiparous.exe (PID: 7324)
      • ambiparous.exe (PID: 8004)
      • ambiparous.exe (PID: 2460)
      • ambiparous.exe (PID: 7232)
      • ambiparous.exe (PID: 4136)
      • ambiparous.exe (PID: 824)
      • ambiparous.exe (PID: 1084)
      • ambiparous.exe (PID: 7740)
      • ambiparous.exe (PID: 9208)
      • ambiparous.exe (PID: 6504)
      • ambiparous.exe (PID: 6820)
      • ambiparous.exe (PID: 6808)
      • ambiparous.exe (PID: 6728)
      • ambiparous.exe (PID: 7204)
      • ambiparous.exe (PID: 1848)
      • ambiparous.exe (PID: 6584)
      • ambiparous.exe (PID: 4424)
      • ambiparous.exe (PID: 2352)
      • ambiparous.exe (PID: 1172)
      • ambiparous.exe (PID: 7472)
      • ambiparous.exe (PID: 2864)
      • ambiparous.exe (PID: 2124)
      • ambiparous.exe (PID: 8720)
      • ambiparous.exe (PID: 7372)
      • ambiparous.exe (PID: 3400)
      • ambiparous.exe (PID: 7080)
      • ambiparous.exe (PID: 2996)
      • ambiparous.exe (PID: 492)
      • ambiparous.exe (PID: 7680)
      • ambiparous.exe (PID: 6284)
      • ambiparous.exe (PID: 7668)
      • ambiparous.exe (PID: 8100)
      • ambiparous.exe (PID: 5628)
      • ambiparous.exe (PID: 9188)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 9160)

  • INFO

    • Reads mouse settings

      • _8efdd3ae9cc090b78afa32eae41f092190edca16a112a33b16375ae51d9b828e.exe (PID: 2572)
      • ambiparous.exe (PID: 4856)
      • ambiparous.exe (PID: 6424)
      • ambiparous.exe (PID: 7644)
      • ambiparous.exe (PID: 2260)
      • ambiparous.exe (PID: 5356)
      • ambiparous.exe (PID: 2428)
      • ambiparous.exe (PID: 2788)
      • ambiparous.exe (PID: 8228)
      • ambiparous.exe (PID: 3036)
      • ambiparous.exe (PID: 8532)
      • ambiparous.exe (PID: 2016)
      • ambiparous.exe (PID: 7844)
      • ambiparous.exe (PID: 8052)
      • ambiparous.exe (PID: 8284)
      • ambiparous.exe (PID: 4060)
      • ambiparous.exe (PID: 7048)
      • ambiparous.exe (PID: 5604)
      • ambiparous.exe (PID: 2284)
      • ambiparous.exe (PID: 2824)
      • ambiparous.exe (PID: 3304)
      • ambiparous.exe (PID: 7728)
      • ambiparous.exe (PID: 3020)
      • ambiparous.exe (PID: 7936)
      • ambiparous.exe (PID: 3560)
      • ambiparous.exe (PID: 3376)
      • ambiparous.exe (PID: 6072)
      • ambiparous.exe (PID: 6236)
      • ambiparous.exe (PID: 8088)
      • ambiparous.exe (PID: 8232)
      • ambiparous.exe (PID: 2796)
      • ambiparous.exe (PID: 7608)
      • ambiparous.exe (PID: 7208)
      • ambiparous.exe (PID: 8260)
      • ambiparous.exe (PID: 8552)
      • ambiparous.exe (PID: 7736)
      • ambiparous.exe (PID: 6600)
      • ambiparous.exe (PID: 664)
      • ambiparous.exe (PID: 3240)
      • ambiparous.exe (PID: 7540)
      • ambiparous.exe (PID: 2232)
      • ambiparous.exe (PID: 5828)
      • ambiparous.exe (PID: 2944)
      • ambiparous.exe (PID: 6692)
      • ambiparous.exe (PID: 5808)
      • ambiparous.exe (PID: 2748)
      • ambiparous.exe (PID: 4616)
      • ambiparous.exe (PID: 5736)
      • ambiparous.exe (PID: 4680)
      • ambiparous.exe (PID: 8224)
      • ambiparous.exe (PID: 2868)
      • ambiparous.exe (PID: 8320)
      • ambiparous.exe (PID: 5508)
      • ambiparous.exe (PID: 684)
      • ambiparous.exe (PID: 8660)
      • ambiparous.exe (PID: 8676)
      • ambiparous.exe (PID: 7992)
      • ambiparous.exe (PID: 8432)
      • ambiparous.exe (PID: 6900)
      • ambiparous.exe (PID: 3152)
      • ambiparous.exe (PID: 1368)
      • ambiparous.exe (PID: 7036)
      • ambiparous.exe (PID: 9152)
      • ambiparous.exe (PID: 4352)
      • ambiparous.exe (PID: 3652)
      • ambiparous.exe (PID: 7376)
      • ambiparous.exe (PID: 7944)
      • ambiparous.exe (PID: 8444)
      • ambiparous.exe (PID: 6080)
      • ambiparous.exe (PID: 8084)
      • ambiparous.exe (PID: 8628)
      • ambiparous.exe (PID: 6908)
      • ambiparous.exe (PID: 3656)
      • ambiparous.exe (PID: 8512)
      • ambiparous.exe (PID: 6084)
      • ambiparous.exe (PID: 8816)
      • ambiparous.exe (PID: 8852)
      • ambiparous.exe (PID: 6848)
      • ambiparous.exe (PID: 224)
      • ambiparous.exe (PID: 8944)
      • ambiparous.exe (PID: 7244)
      • ambiparous.exe (PID: 8736)
      • ambiparous.exe (PID: 5440)
      • ambiparous.exe (PID: 4292)
      • ambiparous.exe (PID: 7488)
      • ambiparous.exe (PID: 1612)
      • ambiparous.exe (PID: 6996)
      • ambiparous.exe (PID: 3004)
      • ambiparous.exe (PID: 5040)
      • ambiparous.exe (PID: 8360)
      • ambiparous.exe (PID: 3388)
      • ambiparous.exe (PID: 8640)
      • ambiparous.exe (PID: 3276)
      • ambiparous.exe (PID: 7640)
      • ambiparous.exe (PID: 7460)
      • ambiparous.exe (PID: 2756)
      • ambiparous.exe (PID: 1820)
      • ambiparous.exe (PID: 6784)
      • ambiparous.exe (PID: 3192)
      • ambiparous.exe (PID: 7956)
      • ambiparous.exe (PID: 1188)
      • ambiparous.exe (PID: 1136)
      • ambiparous.exe (PID: 5888)
      • ambiparous.exe (PID: 8496)
      • ambiparous.exe (PID: 8568)
      • ambiparous.exe (PID: 1316)
      • ambiparous.exe (PID: 1692)
      • ambiparous.exe (PID: 1128)
      • ambiparous.exe (PID: 3920)
      • ambiparous.exe (PID: 1116)
      • ambiparous.exe (PID: 8332)
      • ambiparous.exe (PID: 5708)
      • ambiparous.exe (PID: 7580)
      • ambiparous.exe (PID: 8032)
      • ambiparous.exe (PID: 7308)
      • ambiparous.exe (PID: 676)
      • ambiparous.exe (PID: 8764)
      • ambiparous.exe (PID: 7832)
      • ambiparous.exe (PID: 7564)
      • ambiparous.exe (PID: 5464)
      • ambiparous.exe (PID: 1984)
      • ambiparous.exe (PID: 2600)
      • ambiparous.exe (PID: 4188)
      • ambiparous.exe (PID: 8728)
      • ambiparous.exe (PID: 8176)
      • ambiparous.exe (PID: 8564)
      • ambiparous.exe (PID: 1068)
      • ambiparous.exe (PID: 7760)
      • ambiparous.exe (PID: 1488)
      • ambiparous.exe (PID: 7904)
      • ambiparous.exe (PID: 7480)
      • ambiparous.exe (PID: 8516)
      • ambiparous.exe (PID: 4788)
      • ambiparous.exe (PID: 8468)
      • ambiparous.exe (PID: 1432)
      • ambiparous.exe (PID: 6880)
      • ambiparous.exe (PID: 3628)
      • ambiparous.exe (PID: 8028)
      • ambiparous.exe (PID: 8700)
      • ambiparous.exe (PID: 8004)
      • ambiparous.exe (PID: 7324)
      • ambiparous.exe (PID: 7508)
      • ambiparous.exe (PID: 4136)
      • ambiparous.exe (PID: 2460)
      • ambiparous.exe (PID: 6504)
      • ambiparous.exe (PID: 824)
      • ambiparous.exe (PID: 9208)
      • ambiparous.exe (PID: 7232)
      • ambiparous.exe (PID: 1084)
      • ambiparous.exe (PID: 6808)
      • ambiparous.exe (PID: 7740)
      • ambiparous.exe (PID: 6820)
      • ambiparous.exe (PID: 6728)
      • ambiparous.exe (PID: 7204)
      • ambiparous.exe (PID: 7472)
      • ambiparous.exe (PID: 4424)
      • ambiparous.exe (PID: 6584)
      • ambiparous.exe (PID: 1848)
      • ambiparous.exe (PID: 1172)
      • ambiparous.exe (PID: 2352)
      • ambiparous.exe (PID: 2864)
      • ambiparous.exe (PID: 8720)
      • ambiparous.exe (PID: 7080)
      • ambiparous.exe (PID: 2996)
      • ambiparous.exe (PID: 2124)
      • ambiparous.exe (PID: 6284)
      • ambiparous.exe (PID: 7372)
      • ambiparous.exe (PID: 3400)
      • ambiparous.exe (PID: 492)
      • ambiparous.exe (PID: 7680)
      • ambiparous.exe (PID: 9188)
      • ambiparous.exe (PID: 7668)
      • ambiparous.exe (PID: 6060)
      • ambiparous.exe (PID: 5628)
      • ambiparous.exe (PID: 8100)
      • ambiparous.exe (PID: 5920)

    • Creates files or folders in the user directory

      • _8efdd3ae9cc090b78afa32eae41f092190edca16a112a33b16375ae51d9b828e.exe (PID: 2572)
      • ambiparous.exe (PID: 4856)

    • The sample compiled with english language support

      • _8efdd3ae9cc090b78afa32eae41f092190edca16a112a33b16375ae51d9b828e.exe (PID: 2572)

    • Checks supported languages

      • _8efdd3ae9cc090b78afa32eae41f092190edca16a112a33b16375ae51d9b828e.exe (PID: 2572)
      • ambiparous.exe (PID: 4856)
      • ambiparous.exe (PID: 6424)
      • ambiparous.exe (PID: 7644)
      • ambiparous.exe (PID: 2260)
      • ambiparous.exe (PID: 5356)
      • ambiparous.exe (PID: 2428)
      • ambiparous.exe (PID: 2788)
      • ambiparous.exe (PID: 8228)
      • ambiparous.exe (PID: 3036)
      • ambiparous.exe (PID: 8532)
      • ambiparous.exe (PID: 2016)
      • ambiparous.exe (PID: 8052)
      • ambiparous.exe (PID: 7844)
      • ambiparous.exe (PID: 8284)
      • ambiparous.exe (PID: 4060)
      • ambiparous.exe (PID: 5604)
      • ambiparous.exe (PID: 7048)
      • ambiparous.exe (PID: 2284)
      • ambiparous.exe (PID: 3304)
      • ambiparous.exe (PID: 7728)
      • ambiparous.exe (PID: 3020)
      • ambiparous.exe (PID: 2824)
      • ambiparous.exe (PID: 7936)
      • ambiparous.exe (PID: 3560)
      • ambiparous.exe (PID: 3376)
      • ambiparous.exe (PID: 6072)
      • ambiparous.exe (PID: 8232)
      • ambiparous.exe (PID: 6236)
      • ambiparous.exe (PID: 8088)
      • ambiparous.exe (PID: 2796)
      • ambiparous.exe (PID: 7608)
      • ambiparous.exe (PID: 8260)
      • ambiparous.exe (PID: 8552)
      • ambiparous.exe (PID: 7736)
      • ambiparous.exe (PID: 6600)
      • ambiparous.exe (PID: 7208)
      • ambiparous.exe (PID: 3240)
      • ambiparous.exe (PID: 7540)
      • ambiparous.exe (PID: 5828)
      • ambiparous.exe (PID: 664)
      • ambiparous.exe (PID: 2944)
      • ambiparous.exe (PID: 6692)
      • ambiparous.exe (PID: 4616)
      • ambiparous.exe (PID: 2232)
      • ambiparous.exe (PID: 5736)
      • ambiparous.exe (PID: 5808)
      • ambiparous.exe (PID: 2748)
      • ambiparous.exe (PID: 8224)
      • ambiparous.exe (PID: 4680)
      • ambiparous.exe (PID: 2868)
      • ambiparous.exe (PID: 8676)
      • ambiparous.exe (PID: 8320)
      • ambiparous.exe (PID: 5508)
      • ambiparous.exe (PID: 684)
      • ambiparous.exe (PID: 8660)
      • ambiparous.exe (PID: 7992)
      • ambiparous.exe (PID: 8432)
      • ambiparous.exe (PID: 6900)
      • ambiparous.exe (PID: 3152)
      • ambiparous.exe (PID: 1368)
      • ambiparous.exe (PID: 9152)
      • ambiparous.exe (PID: 4352)
      • ambiparous.exe (PID: 7036)
      • ambiparous.exe (PID: 7376)
      • ambiparous.exe (PID: 3652)
      • ambiparous.exe (PID: 7944)
      • ambiparous.exe (PID: 8084)
      • ambiparous.exe (PID: 6080)
      • ambiparous.exe (PID: 8444)
      • ambiparous.exe (PID: 8628)
      • ambiparous.exe (PID: 6908)
      • ambiparous.exe (PID: 3656)
      • ambiparous.exe (PID: 8512)
      • ambiparous.exe (PID: 6084)
      • ambiparous.exe (PID: 8816)
      • ambiparous.exe (PID: 6848)
      • ambiparous.exe (PID: 8852)
      • ambiparous.exe (PID: 224)
      • ambiparous.exe (PID: 8944)
      • ambiparous.exe (PID: 7244)
      • ambiparous.exe (PID: 8736)
      • ambiparous.exe (PID: 4292)
      • ambiparous.exe (PID: 5440)
      • ambiparous.exe (PID: 7488)
      • ambiparous.exe (PID: 5040)
      • ambiparous.exe (PID: 3004)
      • ambiparous.exe (PID: 1612)
      • ambiparous.exe (PID: 6996)
      • ambiparous.exe (PID: 8360)
      • ambiparous.exe (PID: 3388)
      • ambiparous.exe (PID: 8640)
      • ambiparous.exe (PID: 7460)
      • ambiparous.exe (PID: 1820)
      • ambiparous.exe (PID: 7640)
      • ambiparous.exe (PID: 3276)
      • ambiparous.exe (PID: 6784)
      • ambiparous.exe (PID: 2756)
      • ambiparous.exe (PID: 3192)
      • ambiparous.exe (PID: 7956)
      • ambiparous.exe (PID: 1188)
      • ambiparous.exe (PID: 1136)
      • ambiparous.exe (PID: 5888)
      • ambiparous.exe (PID: 8568)
      • ambiparous.exe (PID: 1316)
      • ambiparous.exe (PID: 1692)
      • ambiparous.exe (PID: 8496)
      • ambiparous.exe (PID: 1128)
      • ambiparous.exe (PID: 5708)
      • ambiparous.exe (PID: 3920)
      • ambiparous.exe (PID: 1116)
      • ambiparous.exe (PID: 8032)
      • ambiparous.exe (PID: 7580)
      • ambiparous.exe (PID: 8332)
      • ambiparous.exe (PID: 8764)
      • ambiparous.exe (PID: 676)
      • ambiparous.exe (PID: 7308)
      • ambiparous.exe (PID: 7832)
      • ambiparous.exe (PID: 5464)
      • ambiparous.exe (PID: 1984)
      • ambiparous.exe (PID: 2600)
      • ambiparous.exe (PID: 7564)
      • ambiparous.exe (PID: 4188)
      • ambiparous.exe (PID: 8728)
      • ambiparous.exe (PID: 8176)
      • ambiparous.exe (PID: 8564)
      • ambiparous.exe (PID: 1068)
      • ambiparous.exe (PID: 7760)
      • ambiparous.exe (PID: 7480)
      • ambiparous.exe (PID: 7904)
      • ambiparous.exe (PID: 1488)
      • ambiparous.exe (PID: 4788)
      • ambiparous.exe (PID: 8468)
      • ambiparous.exe (PID: 8516)
      • ambiparous.exe (PID: 3628)
      • ambiparous.exe (PID: 8028)
      • ambiparous.exe (PID: 1432)
      • ambiparous.exe (PID: 6880)
      • ambiparous.exe (PID: 8700)
      • ambiparous.exe (PID: 7324)
      • ambiparous.exe (PID: 7508)
      • ambiparous.exe (PID: 2460)
      • ambiparous.exe (PID: 8004)
      • ambiparous.exe (PID: 4136)
      • ambiparous.exe (PID: 7232)
      • ambiparous.exe (PID: 9208)
      • ambiparous.exe (PID: 6504)
      • ambiparous.exe (PID: 824)
      • ambiparous.exe (PID: 7740)
      • ambiparous.exe (PID: 1084)
      • ambiparous.exe (PID: 6820)
      • ambiparous.exe (PID: 7204)
      • ambiparous.exe (PID: 6728)
      • ambiparous.exe (PID: 1848)
      • ambiparous.exe (PID: 6808)
      • ambiparous.exe (PID: 7472)
      • ambiparous.exe (PID: 4424)
      • ambiparous.exe (PID: 6584)
      • ambiparous.exe (PID: 8720)
      • ambiparous.exe (PID: 2864)
      • ambiparous.exe (PID: 2352)
      • ambiparous.exe (PID: 1172)
      • ambiparous.exe (PID: 2124)
      • ambiparous.exe (PID: 2996)
      • ambiparous.exe (PID: 7080)
      • ambiparous.exe (PID: 3400)
      • ambiparous.exe (PID: 6284)
      • ambiparous.exe (PID: 7372)
      • ambiparous.exe (PID: 7668)
      • ambiparous.exe (PID: 9188)
      • ambiparous.exe (PID: 492)
      • ambiparous.exe (PID: 7680)
      • ambiparous.exe (PID: 8100)
      • ambiparous.exe (PID: 5628)
      • ambiparous.exe (PID: 6060)
      • ambiparous.exe (PID: 5920)

    • Create files in a temporary directory

      • _8efdd3ae9cc090b78afa32eae41f092190edca16a112a33b16375ae51d9b828e.exe (PID: 2572)
      • ambiparous.exe (PID: 4856)
      • ambiparous.exe (PID: 6424)
      • ambiparous.exe (PID: 7644)
      • ambiparous.exe (PID: 2260)
      • ambiparous.exe (PID: 5356)
      • ambiparous.exe (PID: 2788)
      • ambiparous.exe (PID: 2428)
      • ambiparous.exe (PID: 8228)
      • ambiparous.exe (PID: 3036)
      • ambiparous.exe (PID: 8532)
      • ambiparous.exe (PID: 2016)
      • ambiparous.exe (PID: 7844)
      • ambiparous.exe (PID: 8052)
      • ambiparous.exe (PID: 8284)
      • ambiparous.exe (PID: 4060)
      • ambiparous.exe (PID: 7048)
      • ambiparous.exe (PID: 5604)
      • ambiparous.exe (PID: 2284)
      • ambiparous.exe (PID: 2824)
      • ambiparous.exe (PID: 3304)
      • ambiparous.exe (PID: 7728)
      • ambiparous.exe (PID: 3020)
      • ambiparous.exe (PID: 7936)
      • ambiparous.exe (PID: 3376)
      • ambiparous.exe (PID: 3560)
      • ambiparous.exe (PID: 6072)
      • ambiparous.exe (PID: 8232)
      • ambiparous.exe (PID: 6236)
      • ambiparous.exe (PID: 8088)
      • ambiparous.exe (PID: 2796)
      • ambiparous.exe (PID: 7608)
      • ambiparous.exe (PID: 8260)
      • ambiparous.exe (PID: 8552)
      • ambiparous.exe (PID: 7736)
      • ambiparous.exe (PID: 6600)
      • ambiparous.exe (PID: 7208)
      • ambiparous.exe (PID: 664)
      • ambiparous.exe (PID: 3240)
      • ambiparous.exe (PID: 7540)
      • ambiparous.exe (PID: 2232)
      • ambiparous.exe (PID: 2944)
      • ambiparous.exe (PID: 6692)
      • ambiparous.exe (PID: 5828)
      • ambiparous.exe (PID: 4616)
      • ambiparous.exe (PID: 5808)
      • ambiparous.exe (PID: 2748)
      • ambiparous.exe (PID: 5736)
      • ambiparous.exe (PID: 8224)
      • ambiparous.exe (PID: 4680)
      • ambiparous.exe (PID: 8320)
      • ambiparous.exe (PID: 2868)
      • ambiparous.exe (PID: 5508)
      • ambiparous.exe (PID: 684)
      • ambiparous.exe (PID: 8660)
      • ambiparous.exe (PID: 8676)
      • ambiparous.exe (PID: 7992)
      • ambiparous.exe (PID: 8432)
      • ambiparous.exe (PID: 3152)
      • ambiparous.exe (PID: 6900)
      • ambiparous.exe (PID: 7036)
      • ambiparous.exe (PID: 1368)
      • ambiparous.exe (PID: 9152)
      • ambiparous.exe (PID: 3652)
      • ambiparous.exe (PID: 4352)
      • ambiparous.exe (PID: 7376)
      • ambiparous.exe (PID: 6080)
      • ambiparous.exe (PID: 8084)
      • ambiparous.exe (PID: 7944)
      • ambiparous.exe (PID: 8444)
      • ambiparous.exe (PID: 8512)
      • ambiparous.exe (PID: 8628)
      • ambiparous.exe (PID: 6908)
      • ambiparous.exe (PID: 6084)
      • ambiparous.exe (PID: 8816)
      • ambiparous.exe (PID: 3656)
      • ambiparous.exe (PID: 7244)
      • ambiparous.exe (PID: 224)
      • ambiparous.exe (PID: 8944)
      • ambiparous.exe (PID: 8852)
      • ambiparous.exe (PID: 6848)
      • ambiparous.exe (PID: 8736)
      • ambiparous.exe (PID: 4292)
      • ambiparous.exe (PID: 5440)
      • ambiparous.exe (PID: 7488)
      • ambiparous.exe (PID: 3004)
      • ambiparous.exe (PID: 6996)
      • ambiparous.exe (PID: 5040)
      • ambiparous.exe (PID: 1612)
      • ambiparous.exe (PID: 8640)
      • ambiparous.exe (PID: 3388)
      • ambiparous.exe (PID: 8360)
      • ambiparous.exe (PID: 7460)
      • ambiparous.exe (PID: 7640)
      • ambiparous.exe (PID: 6784)
      • ambiparous.exe (PID: 2756)
      • ambiparous.exe (PID: 3276)
      • ambiparous.exe (PID: 1820)
      • ambiparous.exe (PID: 1188)
      • ambiparous.exe (PID: 1136)
      • ambiparous.exe (PID: 3192)
      • ambiparous.exe (PID: 8568)
      • ambiparous.exe (PID: 5888)
      • ambiparous.exe (PID: 7956)
      • ambiparous.exe (PID: 8496)
      • ambiparous.exe (PID: 1316)
      • ambiparous.exe (PID: 1692)
      • ambiparous.exe (PID: 1128)
      • ambiparous.exe (PID: 5708)
      • ambiparous.exe (PID: 3920)
      • ambiparous.exe (PID: 7580)
      • ambiparous.exe (PID: 1116)
      • ambiparous.exe (PID: 8332)
      • ambiparous.exe (PID: 8032)
      • ambiparous.exe (PID: 7308)
      • ambiparous.exe (PID: 8764)
      • ambiparous.exe (PID: 676)
      • ambiparous.exe (PID: 7832)
      • ambiparous.exe (PID: 7564)
      • ambiparous.exe (PID: 2600)
      • ambiparous.exe (PID: 4188)
      • ambiparous.exe (PID: 5464)
      • ambiparous.exe (PID: 1984)
      • ambiparous.exe (PID: 8728)
      • ambiparous.exe (PID: 1068)
      • ambiparous.exe (PID: 7760)
      • ambiparous.exe (PID: 8564)
      • ambiparous.exe (PID: 8176)
      • ambiparous.exe (PID: 7904)
      • ambiparous.exe (PID: 1488)
      • ambiparous.exe (PID: 4788)
      • ambiparous.exe (PID: 8468)
      • ambiparous.exe (PID: 7480)
      • ambiparous.exe (PID: 8516)
      • ambiparous.exe (PID: 6880)
      • ambiparous.exe (PID: 3628)
      • ambiparous.exe (PID: 1432)
      • ambiparous.exe (PID: 8700)
      • ambiparous.exe (PID: 7508)
      • ambiparous.exe (PID: 8028)
      • ambiparous.exe (PID: 8004)
      • ambiparous.exe (PID: 4136)
      • ambiparous.exe (PID: 2460)
      • ambiparous.exe (PID: 7324)
      • ambiparous.exe (PID: 9208)
      • ambiparous.exe (PID: 6504)
      • ambiparous.exe (PID: 824)
      • ambiparous.exe (PID: 7232)
      • ambiparous.exe (PID: 1084)
      • ambiparous.exe (PID: 7740)
      • ambiparous.exe (PID: 7204)
      • ambiparous.exe (PID: 6728)
      • ambiparous.exe (PID: 6808)
      • ambiparous.exe (PID: 6820)
      • ambiparous.exe (PID: 1848)
      • ambiparous.exe (PID: 6584)
      • ambiparous.exe (PID: 7472)
      • ambiparous.exe (PID: 4424)
      • ambiparous.exe (PID: 1172)
      • ambiparous.exe (PID: 2352)
      • ambiparous.exe (PID: 7080)
      • ambiparous.exe (PID: 2124)
      • ambiparous.exe (PID: 8720)
      • ambiparous.exe (PID: 2864)
      • ambiparous.exe (PID: 2996)
      • ambiparous.exe (PID: 7372)
      • ambiparous.exe (PID: 3400)
      • ambiparous.exe (PID: 6284)
      • ambiparous.exe (PID: 492)
      • ambiparous.exe (PID: 7668)
      • ambiparous.exe (PID: 9188)
      • ambiparous.exe (PID: 7680)
      • ambiparous.exe (PID: 8100)
      • ambiparous.exe (PID: 5628)
      • ambiparous.exe (PID: 6060)
      • ambiparous.exe (PID: 5920)

    • Reads the machine GUID from the registry

      • _8efdd3ae9cc090b78afa32eae41f092190edca16a112a33b16375ae51d9b828e.exe (PID: 2572)

    • Drops script file

      • ambiparous.exe (PID: 4856)
      • ambiparous.exe (PID: 6424)
      • wscript.exe (PID: 9160)
      • ambiparous.exe (PID: 7644)
      • ambiparous.exe (PID: 5356)
      • ambiparous.exe (PID: 2260)
      • ambiparous.exe (PID: 2788)
      • ambiparous.exe (PID: 2428)
      • ambiparous.exe (PID: 8228)
      • ambiparous.exe (PID: 3036)
      • ambiparous.exe (PID: 8532)
      • ambiparous.exe (PID: 2016)
      • ambiparous.exe (PID: 7844)
      • ambiparous.exe (PID: 8052)
      • ambiparous.exe (PID: 8284)
      • ambiparous.exe (PID: 4060)
      • ambiparous.exe (PID: 5604)
      • ambiparous.exe (PID: 7048)
      • ambiparous.exe (PID: 2284)
      • ambiparous.exe (PID: 7728)
      • ambiparous.exe (PID: 3304)
      • ambiparous.exe (PID: 2824)
      • ambiparous.exe (PID: 3020)
      • ambiparous.exe (PID: 7936)
      • ambiparous.exe (PID: 3560)
      • ambiparous.exe (PID: 6072)
      • ambiparous.exe (PID: 8232)
      • ambiparous.exe (PID: 8088)
      • ambiparous.exe (PID: 3376)
      • ambiparous.exe (PID: 6236)
      • ambiparous.exe (PID: 8260)
      • ambiparous.exe (PID: 2796)
      • ambiparous.exe (PID: 7208)
      • ambiparous.exe (PID: 8552)
      • ambiparous.exe (PID: 7736)
      • ambiparous.exe (PID: 7608)
      • ambiparous.exe (PID: 664)
      • ambiparous.exe (PID: 7540)
      • ambiparous.exe (PID: 3240)
      • ambiparous.exe (PID: 6600)
      • ambiparous.exe (PID: 2232)
      • ambiparous.exe (PID: 6692)
      • ambiparous.exe (PID: 2944)
      • ambiparous.exe (PID: 5828)
      • ambiparous.exe (PID: 5736)
      • ambiparous.exe (PID: 4616)
      • ambiparous.exe (PID: 5808)
      • ambiparous.exe (PID: 2748)
      • ambiparous.exe (PID: 4680)
      • ambiparous.exe (PID: 8224)
      • ambiparous.exe (PID: 8320)
      • ambiparous.exe (PID: 5508)
      • ambiparous.exe (PID: 8676)
      • ambiparous.exe (PID: 8660)
      • ambiparous.exe (PID: 2868)
      • ambiparous.exe (PID: 8432)
      • ambiparous.exe (PID: 7992)
      • ambiparous.exe (PID: 684)
      • ambiparous.exe (PID: 7036)
      • ambiparous.exe (PID: 1368)
      • ambiparous.exe (PID: 3152)
      • ambiparous.exe (PID: 6900)
      • ambiparous.exe (PID: 4352)
      • ambiparous.exe (PID: 3652)
      • ambiparous.exe (PID: 7376)
      • ambiparous.exe (PID: 9152)
      • ambiparous.exe (PID: 8444)
      • ambiparous.exe (PID: 7944)
      • ambiparous.exe (PID: 6080)
      • ambiparous.exe (PID: 8084)
      • ambiparous.exe (PID: 8512)
      • ambiparous.exe (PID: 8628)
      • ambiparous.exe (PID: 6908)
      • ambiparous.exe (PID: 8816)
      • ambiparous.exe (PID: 6084)
      • ambiparous.exe (PID: 3656)
      • ambiparous.exe (PID: 8852)
      • ambiparous.exe (PID: 6848)
      • ambiparous.exe (PID: 224)
      • ambiparous.exe (PID: 8944)
      • ambiparous.exe (PID: 5440)
      • ambiparous.exe (PID: 8736)
      • ambiparous.exe (PID: 4292)
      • ambiparous.exe (PID: 7244)
      • ambiparous.exe (PID: 1612)
      • ambiparous.exe (PID: 6996)
      • ambiparous.exe (PID: 3004)
      • ambiparous.exe (PID: 7488)
      • ambiparous.exe (PID: 5040)
      • ambiparous.exe (PID: 8640)
      • ambiparous.exe (PID: 8360)
      • ambiparous.exe (PID: 7640)
      • ambiparous.exe (PID: 7460)
      • ambiparous.exe (PID: 3388)
      • ambiparous.exe (PID: 2756)
      • ambiparous.exe (PID: 6784)
      • ambiparous.exe (PID: 1820)
      • ambiparous.exe (PID: 3276)
      • ambiparous.exe (PID: 1136)
      • ambiparous.exe (PID: 1188)
      • ambiparous.exe (PID: 7956)
      • ambiparous.exe (PID: 5888)
      • ambiparous.exe (PID: 8568)
      • ambiparous.exe (PID: 3192)
      • ambiparous.exe (PID: 8496)
      • ambiparous.exe (PID: 1316)
      • ambiparous.exe (PID: 1128)
      • ambiparous.exe (PID: 5708)
      • ambiparous.exe (PID: 1692)
      • ambiparous.exe (PID: 3920)
      • ambiparous.exe (PID: 7580)
      • ambiparous.exe (PID: 8032)
      • ambiparous.exe (PID: 1116)
      • ambiparous.exe (PID: 8332)
      • ambiparous.exe (PID: 7308)
      • ambiparous.exe (PID: 7832)
      • ambiparous.exe (PID: 8764)
      • ambiparous.exe (PID: 2600)
      • ambiparous.exe (PID: 676)
      • ambiparous.exe (PID: 7564)
      • ambiparous.exe (PID: 5464)
      • ambiparous.exe (PID: 8728)
      • ambiparous.exe (PID: 4188)
      • ambiparous.exe (PID: 1984)
      • ambiparous.exe (PID: 7760)
      • ambiparous.exe (PID: 1068)
      • ambiparous.exe (PID: 7904)
      • ambiparous.exe (PID: 8176)
      • ambiparous.exe (PID: 8564)
      • ambiparous.exe (PID: 1488)
      • ambiparous.exe (PID: 8516)
      • ambiparous.exe (PID: 8468)
      • ambiparous.exe (PID: 7480)
      • ambiparous.exe (PID: 1432)
      • ambiparous.exe (PID: 4788)
      • ambiparous.exe (PID: 6880)
      • ambiparous.exe (PID: 8700)
      • ambiparous.exe (PID: 7508)
      • ambiparous.exe (PID: 8028)
      • ambiparous.exe (PID: 3628)
      • ambiparous.exe (PID: 8004)
      • ambiparous.exe (PID: 2460)
      • ambiparous.exe (PID: 7324)
      • ambiparous.exe (PID: 7232)
      • ambiparous.exe (PID: 824)
      • ambiparous.exe (PID: 4136)
      • ambiparous.exe (PID: 6504)
      • ambiparous.exe (PID: 1084)
      • ambiparous.exe (PID: 7740)
      • ambiparous.exe (PID: 9208)
      • ambiparous.exe (PID: 6808)
      • ambiparous.exe (PID: 7204)
      • ambiparous.exe (PID: 6820)
      • ambiparous.exe (PID: 6728)
      • ambiparous.exe (PID: 1848)
      • ambiparous.exe (PID: 6584)
      • ambiparous.exe (PID: 4424)
      • ambiparous.exe (PID: 1172)
      • ambiparous.exe (PID: 7472)
      • ambiparous.exe (PID: 2352)
      • ambiparous.exe (PID: 2124)
      • ambiparous.exe (PID: 2864)
      • ambiparous.exe (PID: 7080)
      • ambiparous.exe (PID: 8720)
      • ambiparous.exe (PID: 2996)
      • ambiparous.exe (PID: 7372)
      • ambiparous.exe (PID: 3400)
      • ambiparous.exe (PID: 492)
      • ambiparous.exe (PID: 7680)
      • ambiparous.exe (PID: 6284)
      • ambiparous.exe (PID: 8100)
      • ambiparous.exe (PID: 5628)
      • ambiparous.exe (PID: 9188)
      • ambiparous.exe (PID: 7668)

    • Launching a file from the Startup directory

      • ambiparous.exe (PID: 4856)

    • Manual execution by a user

      • wscript.exe (PID: 9160)

    • Checks proxy server information

      • slui.exe (PID: 6632)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (43.5)
.exe | Win32 EXE Yoda's Crypter (42.7)
.exe | Win32 Executable (generic) (7.2)
.exe | Generic Win/DOS Executable (3.2)
.exe | DOS Executable Generic (3.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2026:02:19 06:15:32+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 380928
InitializedDataSize: 376832
UninitializedDataSize: 929792
EntryPoint: 0x140690
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (British)
CharacterSet: Unicode
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
320
Monitored processes
178
Malicious processes
0
Suspicious processes
3

Behavior graph

Click at the process to see the details
start _8efdd3ae9cc090b78afa32eae41f092190edca16a112a33b16375ae51d9b828e.exe ambiparous.exe ambiparous.exe no specs ambiparous.exe no specs wscript.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs slui.exe ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs ambiparous.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
224"C:\Users\admin\AppData\Local\flexuosely\ambiparous.exe"C:\Users\admin\AppData\Local\flexuosely\ambiparous.exe—ambiparous.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\flexuosely\ambiparous.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
492"C:\Users\admin\AppData\Local\flexuosely\ambiparous.exe"C:\Users\admin\AppData\Local\flexuosely\ambiparous.exe—ambiparous.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\flexuosely\ambiparous.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
664"C:\Users\admin\AppData\Local\flexuosely\ambiparous.exe"C:\Users\admin\AppData\Local\flexuosely\ambiparous.exe—ambiparous.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\flexuosely\ambiparous.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
676"C:\Users\admin\AppData\Local\flexuosely\ambiparous.exe"C:\Users\admin\AppData\Local\flexuosely\ambiparous.exe—ambiparous.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\flexuosely\ambiparous.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
684"C:\Users\admin\AppData\Local\flexuosely\ambiparous.exe"C:\Users\admin\AppData\Local\flexuosely\ambiparous.exe—ambiparous.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\flexuosely\ambiparous.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
824"C:\Users\admin\AppData\Local\flexuosely\ambiparous.exe"C:\Users\admin\AppData\Local\flexuosely\ambiparous.exe—ambiparous.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\flexuosely\ambiparous.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
1068"C:\Users\admin\AppData\Local\flexuosely\ambiparous.exe"C:\Users\admin\AppData\Local\flexuosely\ambiparous.exe—ambiparous.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\flexuosely\ambiparous.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
1084"C:\Users\admin\AppData\Local\flexuosely\ambiparous.exe"C:\Users\admin\AppData\Local\flexuosely\ambiparous.exe—ambiparous.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\flexuosely\ambiparous.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
1116"C:\Users\admin\AppData\Local\flexuosely\ambiparous.exe"C:\Users\admin\AppData\Local\flexuosely\ambiparous.exe—ambiparous.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\flexuosely\ambiparous.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
1128"C:\Users\admin\AppData\Local\flexuosely\ambiparous.exe"C:\Users\admin\AppData\Local\flexuosely\ambiparous.exe—ambiparous.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\flexuosely\ambiparous.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
8 377
Read events
8 377
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
178
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
2572_8efdd3ae9cc090b78afa32eae41f092190edca16a112a33b16375ae51d9b828e.exeC:\Users\admin\AppData\Local\Temp\aut5EB8.tmpbinary
MD5:B6B45763E5ABF2A109DDDE9E2BD46039
SHA256:78F1381014A817A6E34AA12F9ED92788B346AB6BEEB1BB5B92FCE8C48AB41B8F
4856ambiparous.exeC:\Users\admin\AppData\Local\Temp\aut656E.tmpbinary
MD5:B6B45763E5ABF2A109DDDE9E2BD46039
SHA256:78F1381014A817A6E34AA12F9ED92788B346AB6BEEB1BB5B92FCE8C48AB41B8F
4856ambiparous.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ambiparous.vbsbinary
MD5:40F0EA1AA1122E703541AA6BDD92DADB
SHA256:E9B469B9DFD81FA0D090BED2F516F707FFE55ACA602E642177A199E4CDE52CB1
6424ambiparous.exeC:\Users\admin\AppData\Local\Temp\aut6BF6.tmpbinary
MD5:B6B45763E5ABF2A109DDDE9E2BD46039
SHA256:78F1381014A817A6E34AA12F9ED92788B346AB6BEEB1BB5B92FCE8C48AB41B8F
2572_8efdd3ae9cc090b78afa32eae41f092190edca16a112a33b16375ae51d9b828e.exeC:\Users\admin\AppData\Local\Temp\nonsubmergedbinary
MD5:B6B45763E5ABF2A109DDDE9E2BD46039
SHA256:78F1381014A817A6E34AA12F9ED92788B346AB6BEEB1BB5B92FCE8C48AB41B8F
2572_8efdd3ae9cc090b78afa32eae41f092190edca16a112a33b16375ae51d9b828e.exeC:\Users\admin\AppData\Local\flexuosely\ambiparous.exeexecutable
MD5:B0D64F35D10F7FCA715D77342EEAF469
SHA256:8EFDD3AE9CC090B78AFA32EAE41F092190EDCA16A112A33B16375AE51D9B828E
2260ambiparous.exeC:\Users\admin\AppData\Local\Temp\aut7EF2.tmpbinary
MD5:B6B45763E5ABF2A109DDDE9E2BD46039
SHA256:78F1381014A817A6E34AA12F9ED92788B346AB6BEEB1BB5B92FCE8C48AB41B8F
7644ambiparous.exeC:\Users\admin\AppData\Local\Temp\aut7916.tmpbinary
MD5:B6B45763E5ABF2A109DDDE9E2BD46039
SHA256:78F1381014A817A6E34AA12F9ED92788B346AB6BEEB1BB5B92FCE8C48AB41B8F
2428ambiparous.exeC:\Users\admin\AppData\Local\Temp\aut859A.tmpbinary
MD5:B6B45763E5ABF2A109DDDE9E2BD46039
SHA256:78F1381014A817A6E34AA12F9ED92788B346AB6BEEB1BB5B92FCE8C48AB41B8F
5356ambiparous.exeC:\Users\admin\AppData\Local\Temp\aut7F21.tmpbinary
MD5:B6B45763E5ABF2A109DDDE9E2BD46039
SHA256:78F1381014A817A6E34AA12F9ED92788B346AB6BEEB1BB5B92FCE8C48AB41B8F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
54
TCP/UDP connections
49
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3348
RUXIMICS.exe
GET
304
51.124.78.146:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/RUXIM?os=Windows&osVer=10.0.19045.4046.amd64fre.vb_release.191206-1406&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&sampleId=s:95271487&appVer=10.0.19041.3623&OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&FlightRing=Retail&AttrDataVer=186&App=RUXIM&AppVer=&DeviceFamily=Windows.Desktop
US
—
—
whitelisted
6768
MoUsoCoreWorker.exe
GET
304
51.124.78.146:443
https://settings-win.data.microsoft.com/settings/v3.0/wsd/muse?ProcessorClockSpeed=3094&FlightIds=&UpdateOfferedDays=4294967295&BranchReadinessLevel=CB&OEMManufacturerName=DELL&IsCloudDomainJoined=0&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&sku=48&ActivationChannel=Retail&AttrDataVer=186&IsMDMEnrolled=0&ProcessorCores=6&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&TotalPhysicalRAM=6144&PrimaryDiskType=4294967295&FlightingBranchName=&ChassisTypeId=1&OEMModelNumber=DELL&SystemVolumeTotalCapacity=260281&sampleId=95271487&deviceClass=Windows.Desktop&App=muse&DisableDualScan=0&AppVer=10.0&OEMSubModel=J5CR&locale=en-US&IsAlwaysOnAlwaysConnectedCapable=0&ms=0&DefaultUserRegion=244&UpdateServiceUrl=http%3A%2F%2Fneverupdatewindows10.com&osVer=10.0.19045.4046.amd64fre.vb_release.191206-1406&os=windows&deviceId=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&DeferQualityUpdatePeriodInDays=0&ring=Retail&DeferFeatureUpdatePeriodInDays=30
US
—
—
whitelisted
2496
SIHClient.exe
GET
304
20.165.94.63:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
6768
MoUsoCoreWorker.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
3348
RUXIMICS.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
3348
RUXIMICS.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
7288
svchost.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
6768
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
2496
SIHClient.exe
GET
200
13.95.31.18:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
US
—
—
whitelisted
7288
svchost.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
7288
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3348
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6768
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
3348
RUXIMICS.exe
2.16.241.12:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
6768
MoUsoCoreWorker.exe
2.16.241.12:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
7288
svchost.exe
2.16.241.12:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
3348
RUXIMICS.exe
2.23.246.101:80
www.microsoft.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
self.events.data.microsoft.com
  • 52.168.112.66
  • 40.79.150.123
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 20.59.87.227
whitelisted
google.com
  • 142.251.141.142
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
  • 2.16.164.120
  • 2.16.164.49
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 23.52.181.212
  • 88.221.169.152
whitelisted
login.live.com
  • 40.126.31.1
  • 20.190.159.131
  • 40.126.31.128
  • 40.126.31.129
  • 20.190.159.71
  • 20.190.159.0
  • 20.190.159.64
  • 40.126.31.131
  • 20.190.160.132
  • 40.126.32.72
  • 40.126.32.138
  • 20.190.160.65
  • 40.126.32.68
  • 40.126.32.140
  • 40.126.32.76
  • 20.190.160.64
whitelisted
slscr.update.microsoft.com
  • 20.165.94.63
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
activation-v2.sls.microsoft.com
  • 48.192.1.65
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
_8efdd3ae9cc090b78afa32eae41f092190edca16a112a33b16375ae51d9b828e.exe