File name:

93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.exe

Full analysis: https://app.any.run/tasks/64734f48-889c-42d4-a519-0cb8c5d61149
Verdict: Malicious activity
Threats:

Crypto mining malware is a resource-intensive threat that infiltrates computers with the purpose of mining cryptocurrencies. This type of threat can be deployed either on an infected machine or a compromised website. In both cases the miner will utilize the computing power of the device and its network bandwidth.

Malware Trends Tracker     >>>
Analysis date: May 14, 2024, 21:32:25
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
miner
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

0FA34A970C3DEFA54DBC6B725E03B83D

SHA1:

44FA4A2D4D3FC9259FB03324EB390DEF62FF786A

SHA256:

93BC218FA7956DC4EB8D19F7FE8C8EBB2E0B60F06FF221BBAB6E62B56FC94F6A

SSDEEP:

196608:70SXmAwzSubQs2hjFJ75+dNhW/NkZBQKOSl54M7ct2XR:70smrrbqjFJEWGZBhOS5t7SQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.exe (PID: 6396)
      • 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.exe (PID: 6496)
      • 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmp (PID: 6536)
      • CheatEngine75.exe (PID: 7160)
      • prod0.exe (PID: 7064)
      • qtldobjk.exe (PID: 5720)
      • CheatEngine75.tmp (PID: 2128)
      • RAVEndPointProtection-installer.exe (PID: 6924)
      • o2uj34f1.exe (PID: 4888)
      • RAVVPN-installer.exe (PID: 4428)

    • Starts NET.EXE for service management

      • CheatEngine75.tmp (PID: 2128)
      • net.exe (PID: 4988)
      • net.exe (PID: 4340)

    • Actions looks like stealing of personal data

      • RAVEndPointProtection-installer.exe (PID: 6924)
      • rsEngineSvc.exe (PID: 2148)
      • RAVVPN-installer.exe (PID: 4428)

    • Changes the autorun value in the registry

      • rundll32.exe (PID: 6524)

    • Creates a writable file in the system directory

      • RAVEndPointProtection-installer.exe (PID: 6924)
      • rsEngineSvc.exe (PID: 2148)
      • rsEDRSvc.exe (PID: 2736)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmp (PID: 6424)
      • 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmp (PID: 6536)
      • prod0.exe (PID: 7064)
      • Cheat Engine.exe (PID: 5592)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 2492)
      • RAVEndPointProtection-installer.exe (PID: 6924)
      • rsWSC.exe (PID: 5404)
      • rsEngineSvc.exe (PID: 6456)
      • rsEDRSvc.exe (PID: 1680)
      • rsEngineSvc.exe (PID: 2148)

    • Executable content was dropped or overwritten

      • 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.exe (PID: 6396)
      • 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.exe (PID: 6496)
      • 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmp (PID: 6536)
      • CheatEngine75.exe (PID: 7160)
      • CheatEngine75.tmp (PID: 2128)
      • prod0.exe (PID: 7064)
      • RAVEndPointProtection-installer.exe (PID: 6924)
      • qtldobjk.exe (PID: 5720)
      • o2uj34f1.exe (PID: 4888)
      • RAVVPN-installer.exe (PID: 4428)

    • Reads the date of Windows installation

      • 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmp (PID: 6424)
      • 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmp (PID: 6536)
      • prod0.exe (PID: 7064)
      • Cheat Engine.exe (PID: 5592)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 2492)
      • rsEDRSvc.exe (PID: 2736)
      • rsEngineSvc.exe (PID: 2148)

    • Reads the Windows owner or organization settings

      • 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmp (PID: 6536)
      • CheatEngine75.tmp (PID: 2128)

    • The process creates files with name similar to system file names

      • qtldobjk.exe (PID: 5720)
      • RAVEndPointProtection-installer.exe (PID: 6924)
      • o2uj34f1.exe (PID: 4888)

    • Starts SC.EXE for service management

      • CheatEngine75.tmp (PID: 2128)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • qtldobjk.exe (PID: 5720)
      • o2uj34f1.exe (PID: 4888)

    • Process drops legitimate windows executable

      • qtldobjk.exe (PID: 5720)
      • CheatEngine75.tmp (PID: 2128)
      • RAVEndPointProtection-installer.exe (PID: 6924)
      • o2uj34f1.exe (PID: 4888)

    • Uses ICACLS.EXE to modify access control lists

      • CheatEngine75.tmp (PID: 2128)

    • Searches for installed software

      • RAVEndPointProtection-installer.exe (PID: 6924)
      • RAVVPN-installer.exe (PID: 4428)
      • rsEngineSvc.exe (PID: 2148)

    • Creates a software uninstall entry

      • RAVEndPointProtection-installer.exe (PID: 6924)
      • RAVVPN-installer.exe (PID: 4428)

    • Executes as Windows Service

      • rsSyncSvc.exe (PID: 1720)
      • rsWSC.exe (PID: 1444)
      • rsClientSvc.exe (PID: 2480)
      • rsEngineSvc.exe (PID: 2148)
      • rsEDRSvc.exe (PID: 2736)
      • WmiApSrv.exe (PID: 6392)

    • Process drops SQLite DLL files

      • CheatEngine75.tmp (PID: 2128)

    • Detected use of alternative data streams (AltDS)

      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 2492)

    • Executes application which crashes

      • 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmp (PID: 6536)

    • Checks Windows Trust Settings

      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 2492)
      • rsWSC.exe (PID: 5404)
      • rsEngineSvc.exe (PID: 6456)
      • rsWSC.exe (PID: 1444)
      • rsEDRSvc.exe (PID: 1680)
      • rsEngineSvc.exe (PID: 2148)
      • rsEDRSvc.exe (PID: 2736)

    • The process drops C-runtime libraries

      • RAVEndPointProtection-installer.exe (PID: 6924)

    • Drops 7-zip archiver for unpacking

      • RAVEndPointProtection-installer.exe (PID: 6924)

    • Drops a system driver (possible attempt to evade defenses)

      • RAVEndPointProtection-installer.exe (PID: 6924)

    • Creates or modifies Windows services

      • RAVEndPointProtection-installer.exe (PID: 6924)
      • rundll32.exe (PID: 6524)

    • Creates files in the driver directory

      • RAVEndPointProtection-installer.exe (PID: 6924)

    • Uses RUNDLL32.EXE to load library

      • RAVEndPointProtection-installer.exe (PID: 6924)

    • Adds/modifies Windows certificates

      • rsWSC.exe (PID: 5404)
      • rsEngineSvc.exe (PID: 6456)
      • rsEngineSvc.exe (PID: 2148)
      • rsEDRSvc.exe (PID: 2736)

    • Uses WEVTUTIL.EXE to install publishers and event logs from the manifest

      • RAVEndPointProtection-installer.exe (PID: 6924)

    • Reads the BIOS version

      • rsEDRSvc.exe (PID: 2736)
      • rsEngineSvc.exe (PID: 2148)

    • Process checks is Powershell's Script Block Logging on

      • rsEDRSvc.exe (PID: 2736)

    • Application launched itself

      • rsAppUI.exe (PID: 6680)

    • Dropped object may contain URLs of mainers pools

      • rsEngineSvc.exe (PID: 2148)

    • The process checks if it is being run in the virtual environment

      • rsEngineSvc.exe (PID: 2148)

  • INFO

    • Reads the computer name

      • 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmp (PID: 6424)
      • 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmp (PID: 6536)
      • prod0.exe (PID: 7064)
      • CheatEngine75.tmp (PID: 2128)
      • RAVEndPointProtection-installer.exe (PID: 6924)
      • rsSyncSvc.exe (PID: 5920)
      • Cheat Engine.exe (PID: 5592)
      • rsSyncSvc.exe (PID: 1720)
      • Kernelmoduleunloader.exe (PID: 4492)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 2492)
      • Tutorial-x86_64.exe (PID: 4628)
      • rsWSC.exe (PID: 5404)
      • rsWSC.exe (PID: 1444)
      • rsEngineSvc.exe (PID: 6456)
      • rsClientSvc.exe (PID: 6788)
      • rsClientSvc.exe (PID: 2480)
      • rsEngineSvc.exe (PID: 2148)
      • rsEDRSvc.exe (PID: 1680)
      • rsHelper.exe (PID: 532)
      • rsEDRSvc.exe (PID: 2736)
      • rsAppUI.exe (PID: 4160)
      • rsAppUI.exe (PID: 6680)
      • rsAppUI.exe (PID: 1864)
      • RAVVPN-installer.exe (PID: 4428)

    • Create files in a temporary directory

      • 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.exe (PID: 6396)
      • 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.exe (PID: 6496)
      • 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmp (PID: 6536)
      • prod0.exe (PID: 7064)
      • CheatEngine75.exe (PID: 7160)
      • CheatEngine75.tmp (PID: 2128)
      • qtldobjk.exe (PID: 5720)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 2492)
      • RAVEndPointProtection-installer.exe (PID: 6924)
      • rsAppUI.exe (PID: 6680)
      • o2uj34f1.exe (PID: 4888)

    • Checks supported languages

      • 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.exe (PID: 6396)
      • 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmp (PID: 6424)
      • 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.exe (PID: 6496)
      • 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmp (PID: 6536)
      • CheatEngine75.exe (PID: 7160)
      • CheatEngine75.tmp (PID: 2128)
      • prod0.exe (PID: 7064)
      • _setup64.tmp (PID: 6272)
      • qtldobjk.exe (PID: 5720)
      • RAVEndPointProtection-installer.exe (PID: 6924)
      • rsSyncSvc.exe (PID: 5920)
      • rsSyncSvc.exe (PID: 1720)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 2492)
      • windowsrepair.exe (PID: 3732)
      • Kernelmoduleunloader.exe (PID: 4492)
      • Cheat Engine.exe (PID: 5592)
      • Tutorial-x86_64.exe (PID: 4628)
      • rsWSC.exe (PID: 5404)
      • rsWSC.exe (PID: 1444)
      • rsClientSvc.exe (PID: 6788)
      • rsClientSvc.exe (PID: 2480)
      • rsEngineSvc.exe (PID: 6456)
      • rsEngineSvc.exe (PID: 2148)
      • rsEDRSvc.exe (PID: 1680)
      • rsEDRSvc.exe (PID: 2736)
      • rsHelper.exe (PID: 532)
      • EPP.exe (PID: 2456)
      • rsAppUI.exe (PID: 6680)
      • o2uj34f1.exe (PID: 4888)
      • rsAppUI.exe (PID: 4160)
      • rsAppUI.exe (PID: 1864)
      • RAVVPN-installer.exe (PID: 4428)
      • rsAppUI.exe (PID: 6724)
      • rsLitmus.A.exe (PID: 3572)
      • rsAppUI.exe (PID: 1532)

    • Process checks computer location settings

      • 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmp (PID: 6424)
      • 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmp (PID: 6536)
      • prod0.exe (PID: 7064)
      • Cheat Engine.exe (PID: 5592)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 2492)
      • rsAppUI.exe (PID: 1532)
      • rsAppUI.exe (PID: 6724)
      • rsAppUI.exe (PID: 6680)

    • Reads the software policy settings

      • 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmp (PID: 6536)
      • prod0.exe (PID: 7064)
      • RAVEndPointProtection-installer.exe (PID: 6924)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 2492)
      • WerFault.exe (PID: 2512)
      • WerFault.exe (PID: 3644)
      • slui.exe (PID: 5108)
      • rsWSC.exe (PID: 5404)
      • rsEngineSvc.exe (PID: 6456)
      • rsWSC.exe (PID: 1444)
      • rsEDRSvc.exe (PID: 1680)
      • rsEngineSvc.exe (PID: 2148)
      • rsEDRSvc.exe (PID: 2736)
      • RAVVPN-installer.exe (PID: 4428)

    • Reads the machine GUID from the registry

      • 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmp (PID: 6536)
      • prod0.exe (PID: 7064)
      • RAVEndPointProtection-installer.exe (PID: 6924)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 2492)
      • rsWSC.exe (PID: 5404)
      • rsWSC.exe (PID: 1444)
      • rsEngineSvc.exe (PID: 6456)
      • rsEngineSvc.exe (PID: 2148)
      • rsEDRSvc.exe (PID: 1680)
      • rsEDRSvc.exe (PID: 2736)
      • rsHelper.exe (PID: 532)
      • rsAppUI.exe (PID: 6680)
      • RAVVPN-installer.exe (PID: 4428)

    • Reads Environment values

      • prod0.exe (PID: 7064)
      • RAVEndPointProtection-installer.exe (PID: 6924)
      • rsEngineSvc.exe (PID: 2148)
      • rsEDRSvc.exe (PID: 2736)
      • rsAppUI.exe (PID: 6680)
      • RAVVPN-installer.exe (PID: 4428)

    • Checks proxy server information

      • prod0.exe (PID: 7064)
      • 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmp (PID: 6536)
      • RAVEndPointProtection-installer.exe (PID: 6924)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 2492)
      • WerFault.exe (PID: 2512)
      • WerFault.exe (PID: 3644)
      • rsWSC.exe (PID: 5404)
      • rsEngineSvc.exe (PID: 6456)
      • rsAppUI.exe (PID: 6680)
      • RAVVPN-installer.exe (PID: 4428)

    • Creates files in the program directory

      • CheatEngine75.tmp (PID: 2128)
      • RAVEndPointProtection-installer.exe (PID: 6924)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 2492)
      • rsWSC.exe (PID: 5404)
      • rsEngineSvc.exe (PID: 6456)
      • rsEngineSvc.exe (PID: 2148)
      • rsEDRSvc.exe (PID: 1680)
      • rsEDRSvc.exe (PID: 2736)
      • RAVVPN-installer.exe (PID: 4428)

    • Creates a software uninstall entry

      • CheatEngine75.tmp (PID: 2128)

    • Creates files or folders in the user directory

      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 2492)
      • WerFault.exe (PID: 2512)
      • WerFault.exe (PID: 3644)
      • rsWSC.exe (PID: 5404)
      • rsEngineSvc.exe (PID: 6456)
      • rsEngineSvc.exe (PID: 2148)
      • rsAppUI.exe (PID: 6680)
      • rsAppUI.exe (PID: 1864)

    • Reads the time zone

      • runonce.exe (PID: 6536)
      • rsEDRSvc.exe (PID: 2736)
      • rsEngineSvc.exe (PID: 2148)

    • Reads security settings of Internet Explorer

      • runonce.exe (PID: 6536)

    • Reads product name

      • rsEDRSvc.exe (PID: 2736)
      • rsAppUI.exe (PID: 6680)
      • rsEngineSvc.exe (PID: 2148)

    • Reads CPU info

      • rsEDRSvc.exe (PID: 2736)
      • rsEngineSvc.exe (PID: 2148)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (53.5)
.exe | InstallShield setup (21)
.exe | Win32 EXE PECompact compressed (generic) (20.2)
.exe | Win32 Executable (generic) (2.1)
.exe | Win16/32 Executable Delphi generic (1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:11:15 09:48:30+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741376
InitializedDataSize: 38400
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6.1
ImageVersion: 6
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 7.5.0.0
ProductVersionNumber: 7.5.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: ΕngineGame Installer
FileVersion: 7.5.0
LegalCopyright: © ΕngineGame
OriginalFileName:
ProductName: ΕngineGame
ProductVersion: 7.5.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
202
Monitored processes
69
Malicious processes
19
Suspicious processes
2

Behavior graph

Click at the process to see the details
start 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.exe 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmp no specs 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.exe 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmp prod0.exe cheatengine75.exe cheatengine75.tmp net.exe no specs conhost.exe no specs net1.exe no specs qtldobjk.exe net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs _setup64.tmp no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs ravendpointprotection-installer.exe sppextcomobj.exe no specs slui.exe rssyncsvc.exe no specs conhost.exe no specs rssyncsvc.exe no specs kernelmoduleunloader.exe windowsrepair.exe no specs icacls.exe no specs conhost.exe no specs cheat engine.exe no specs cheatengine-x86_64-sse4-avx2.exe werfault.exe werfault.exe tutorial-x86_64.exe no specs slui.exe no specs filecoauth.exe no specs rundll32.exe runonce.exe no specs grpconv.exe no specs wevtutil.exe no specs conhost.exe no specs fltmc.exe no specs conhost.exe no specs wevtutil.exe no specs conhost.exe no specs rswsc.exe rswsc.exe no specs rsclientsvc.exe no specs conhost.exe no specs rsclientsvc.exe no specs rsenginesvc.exe rsenginesvc.exe rsedrsvc.exe no specs rsedrsvc.exe rshelper.exe no specs epp.exe no specs rsappui.exe no specs o2uj34f1.exe rsappui.exe no specs rsappui.exe no specs rsappui.exe no specs ravvpn-installer.exe rsappui.exe no specs wmiapsrv.exe no specs rslitmus.a.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
532"c:\program files\reasonlabs\epp\rsHelper.exe"C:\Program Files\ReasonLabs\EPP\rsHelper.exe—rsEngineSvc.exe
User:
admin
Company:
Reason Software Company Inc.
Integrity Level:
MEDIUM
Description:
rsHelper
Version:
3.2.0.0
Modules
Images
c:\program files\reasonlabs\epp\rshelper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1008C:\WINDOWS\system32\net1 stop BadlionAnticheatC:\Windows\System32\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\samcli.dll
c:\windows\system32\ucrtbase.dll
1444\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1444\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—icacls.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1444"C:\Program Files\ReasonLabs\EPP\rsWSC.exe"C:\Program Files\ReasonLabs\EPP\rsWSC.exe—services.exe
User:
SYSTEM
Company:
Reason Software Company Inc.
Integrity Level:
SYSTEM
Description:
rsWSC
Version:
6.0.3.0
Modules
Images
c:\program files\reasonlabs\epp\rswsc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1532"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --app-user-model-id=com.reasonlabs.epp --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.4.2\resources\app.asar" --enable-sandbox --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2904 --field-trial-handle=2272,i,16519837109884553266,7733323459630834698,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:1C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe—rsAppUI.exe
User:
admin
Company:
Reason Cybersecurity Ltd.
Integrity Level:
LOW
Description:
ReasonLabs Application
Version:
1.4.2
Modules
Images
c:\program files\reasonlabs\common\client\v1.4.2\rsappui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
1628\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—rsLitmus.A.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1680"C:\Program Files\ReasonLabs\EDR\rsEDRSvc.exe" -i -iC:\Program Files\ReasonLabs\EDR\rsEDRSvc.exe—RAVEndPointProtection-installer.exe
User:
admin
Company:
Reason Cybersecurity Ltd.
Integrity Level:
HIGH
Description:
Reason EDR Service
Exit code:
0
Version:
2.1.0
Modules
Images
c:\program files\reasonlabs\edr\rsedrsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1720"C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe" -pn:EPP -lpn:rav_antivirus -url:https://update.reasonsecurity.com/v2/live -bn:ReasonLabs -dt:10C:\Program Files\ReasonLabs\Common\rsSyncSvc.exe—services.exe
User:
SYSTEM
Company:
Reason Software Company Inc.
Integrity Level:
SYSTEM
Description:
Reason Security Synchronize Service
Version:
1.7.2.0
Modules
Images
c:\program files\reasonlabs\common\rssyncsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1864"C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --bypasscsp-schemes --cors-schemes --fetch-schemes --service-worker-schemes --streaming-schemes --mojo-platform-channel-handle=2664 --field-trial-handle=2272,i,16519837109884553266,7733323459630834698,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8C:\Program Files\ReasonLabs\Common\Client\v1.4.2\rsAppUI.exe—rsAppUI.exe
User:
admin
Company:
Reason Cybersecurity Ltd.
Integrity Level:
MEDIUM
Description:
ReasonLabs Application
Version:
1.4.2
Modules
Images
c:\program files\reasonlabs\common\client\v1.4.2\rsappui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
Total events
84 338
Read events
83 914
Write events
322
Delete events
102

Modification events

(PID) Process:(6536) 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
881900004395133F46A6DA01
(PID) Process:(6536) 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
31AE0F8A916659E1422732C4B0802548534B4DB8854C61FAA3CF812A82E66D9F
(PID) Process:(6536) 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(6536) 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6536) 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6536) 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6536) 93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(7064) prod0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\prod0_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7064) prod0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\prod0_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7064) prod0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\prod0_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
632
Suspicious files
227
Text files
470
Unknown types
25

Dropped files

PID
Process
Filename
Type
653693bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmpC:\Users\admin\AppData\Local\Temp\is-IKP41.tmp\prod0 —
MD5:—
SHA256:—
653693bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmpC:\Users\admin\AppData\Local\Temp\is-IKP41.tmp\prod0.exe —
MD5:—
SHA256:—
639693bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.exeC:\Users\admin\AppData\Local\Temp\is-VBSG4.tmp\93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmpexecutable
MD5:14E34C5E0E3C320B904B9500E8FA96CF
SHA256:7398BD01E78DF0D69169402F7FECF781C23F61127BA68290D146582EBADBF2EF
653693bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmpC:\Users\admin\AppData\Local\Temp\is-IKP41.tmp\zbShieldUtils.dllexecutable
MD5:B83F5833E96C2EB13F14DCCA805D51A1
SHA256:00E667B838A4125C8CF847936168BB77BB54580BC05669330CB32C0377C4A401
653693bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmpC:\Users\admin\AppData\Local\Temp\is-IKP41.tmp\is-5DCEP.tmpimage
MD5:CD09F361286D1AD2622BA8A57B7613BD
SHA256:B92A31D4853D1B2C4E5B9D9624F40B439856D0C6A517E100978CBDE8D3C47DC8
653693bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmpC:\Users\admin\AppData\Local\Temp\is-IKP41.tmp\RAV_Cross.pngimage
MD5:CD09F361286D1AD2622BA8A57B7613BD
SHA256:B92A31D4853D1B2C4E5B9D9624F40B439856D0C6A517E100978CBDE8D3C47DC8
653693bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmpC:\Users\admin\AppData\Local\Temp\is-IKP41.tmp\finish.pngimage
MD5:136C08E03D9103B8F44B1E5984F0056C
SHA256:D57AE80F6B340DABC4C9F3E1DEDD0BC52EA34A47113F811F7D39C4ECB73F21BC
653693bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmpC:\Users\admin\AppData\Local\Temp\is-IKP41.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
5720qtldobjk.exeC:\Users\admin\AppData\Local\Temp\nsf7493.tmp\ArchiveUtilityx64.dllexecutable
MD5:3351152F6EE87E97682A0A7C459EF614
SHA256:6E2673687BA029074657F0D1C4410691EE013EFF2223D0C7695DFE4F70C62F1C
7064prod0.exeC:\Users\admin\AppData\Local\Temp\qtldobjk.exeexecutable
MD5:6BF0258BE74D7E8CCF12AF14663DC7F5
SHA256:1BCCE8863ED7F19689003BF341E3068EB7BC30056A6E194F16BA617BCA2CB67A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
44
TCP/UDP connections
111
DNS requests
45
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
920
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
5256
svchost.exe
GET
200
2.16.172.75:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
5256
svchost.exe
GET
200
173.223.57.250:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
6620
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
unknown
2492
cheatengine-x86_64-SSE4-AVX2.exe
GET
200
173.223.56.243:80
http://x2.c.lencr.org/
unknown
—
—
unknown
4628
SIHClient.exe
GET
200
173.223.57.250:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
unknown
2512
WerFault.exe
GET
200
2.16.172.80:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
4628
SIHClient.exe
GET
200
173.223.57.250:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
unknown
2512
WerFault.exe
GET
200
173.223.57.250:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
5404
rsWSC.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEQCeArDpSs6yEJyh6YNr4MLb
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5140
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4364
svchost.exe
239.255.255.250:1900
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4264
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4680
SearchApp.exe
23.64.12.40:443
www.bing.com
Akamai International B.V.
PL
unknown
4680
SearchApp.exe
23.64.12.16:443
www.bing.com
Akamai International B.V.
PL
unknown
920
svchost.exe
40.126.31.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
920
svchost.exe
192.229.221.95:80
—
EDGECAST
US
whitelisted
6536
93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.tmp
18.66.188.31:443
d1zlukw2pqueen.cloudfront.net
AMAZON-02
US
unknown

DNS requests

Domain
IP
Reputation
www.bing.com
  • 23.64.12.16
  • 23.64.12.26
  • 23.64.12.25
  • 23.64.12.19
  • 23.64.12.18
  • 23.64.12.17
  • 23.64.12.32
  • 23.64.12.33
  • 23.64.12.40
whitelisted
login.live.com
  • 40.126.31.73
  • 20.190.159.4
  • 20.190.159.0
  • 20.190.159.68
  • 20.190.159.73
  • 20.190.159.75
  • 40.126.31.69
  • 40.126.31.71
whitelisted
d1zlukw2pqueen.cloudfront.net
  • 18.66.188.31
  • 18.66.188.217
  • 18.66.188.192
  • 18.66.188.179
unknown
go.microsoft.com
  • 173.223.58.152
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
crl.microsoft.com
  • 2.16.172.75
  • 2.16.172.80
whitelisted
www.microsoft.com
  • 173.223.57.250
whitelisted
shield.reasonsecurity.com
  • 104.22.0.235
  • 104.22.1.235
  • 172.67.9.68
unknown
arc.msn.com
  • 20.223.35.26
whitelisted

Threats

No threats detected
Process
Message
Kernelmoduleunloader.exe
SCManager opened
Kernelmoduleunloader.exe
count=0
Kernelmoduleunloader.exe
setup=true
Kernelmoduleunloader.exe
Running in wow64
Kernelmoduleunloader.exe
Kernelmodule unloader
Kernelmoduleunloader.exe
attempting to unload
Kernelmoduleunloader.exe
Setup. So do not show messages
cheatengine-x86_64-SSE4-AVX2.exe
Lua thread terminated
rsEDRSvc.exe
Error: Array is variable sized and does not follow prefix convention.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
93bc218fa7956dc4eb8d19f7fe8c8ebb2e0b60f06ff221bbab6e62b56fc94f6a.exe