File name:

9587bda655a2dc730e4bdbd7de5ab39bc37de697fe22f449a6b2f851adaedfb8

Full analysis: https://app.any.run/tasks/a19fdba6-8dc6-4140-8308-0c11203fac94
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: June 02, 2025, 23:42:18
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
uac
antivm
golang
loader
smokeloader
delphi
discord
miner
pastebin
winring0x64-sys
vuln-driver
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

ACA54A0DDB87930DC31FE9123C46D76D

SHA1:

EA2B2453CDFF42D802117AB302028C9614A83A43

SHA256:

9587BDA655A2DC730E4BDBD7DE5AB39BC37DE697FE22F449A6B2F851ADAEDFB8

SSDEEP:

98304:n4WObp7a0kAf7hOUP5ll2Ei78jUpYCceVP0qndG47e/UHtwxXGSML/ULZoCOoMUR:NDulvmvgvnHj9YpuYf8GLgB4cmNYU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 7556)

    • Runs injected code in another process

      • toolspub1.exe (PID: 5728)

    • Application was injected by another process

      • explorer.exe (PID: 5492)

    • Bypass User Account Control (Modify registry)

      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 5228)

    • Bypass User Account Control (fodhelper)

      • fodhelper.exe (PID: 1180)

    • Executing a file with an untrusted certificate

      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 7940)
      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 132)
      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 5228)
      • csrss.exe (PID: 5364)

    • SMOKE has been detected (SURICATA)

      • explorer.exe (PID: 5492)

    • Changes Windows Defender settings

      • FirstZ.exe (PID: 7816)
      • reakuqnanrkn.exe (PID: 8048)

    • Adds extension to the Windows Defender exclusion list

      • FirstZ.exe (PID: 7816)
      • reakuqnanrkn.exe (PID: 8048)

    • Uninstalls Malicious Software Removal Tool (MRT)

      • cmd.exe (PID: 7244)
      • cmd.exe (PID: 6264)

    • Vulnerable driver has been detected

      • reakuqnanrkn.exe (PID: 8048)

    • MINER has been detected (SURICATA)

      • svchost.exe (PID: 2196)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 9587bda655a2dc730e4bdbd7de5ab39bc37de697fe22f449a6b2f851adaedfb8.exe (PID: 6072)
      • InstallSetup7.exe (PID: 5304)
      • explorer.exe (PID: 5492)
      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 132)
      • csrss.exe (PID: 5364)
      • FirstZ.exe (PID: 7816)
      • reakuqnanrkn.exe (PID: 8048)

    • Reads security settings of Internet Explorer

      • 9587bda655a2dc730e4bdbd7de5ab39bc37de697fe22f449a6b2f851adaedfb8.exe (PID: 6072)
      • rty25.exe (PID: 1284)
      • InstallSetup7.exe (PID: 5304)

    • Starts POWERSHELL.EXE for commands execution

      • FirstZ.exe (PID: 5760)
      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 7940)
      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 132)
      • csrss.exe (PID: 5364)
      • FirstZ.exe (PID: 7816)
      • reakuqnanrkn.exe (PID: 8048)

    • Executes application which crashes

      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 5228)
      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 7940)
      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 132)
      • csrss.exe (PID: 5364)

    • Executing commands from a ".bat" file

      • BroomSetup.exe (PID: 4784)

    • Starts application with an unusual extension

      • cmd.exe (PID: 7556)

    • Starts CMD.EXE for commands execution

      • BroomSetup.exe (PID: 4784)
      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 5228)
      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 132)
      • csrss.exe (PID: 5364)
      • FirstZ.exe (PID: 7816)
      • reakuqnanrkn.exe (PID: 8048)

    • Changes default file association

      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 5228)

    • The process hides Powershell's copyright startup banner

      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 7940)
      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 132)
      • csrss.exe (PID: 5364)

    • The process bypasses the loading of PowerShell profile settings

      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 7940)
      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 132)
      • csrss.exe (PID: 5364)

    • Application launched itself

      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 7940)

    • There is functionality for taking screenshot (YARA)

      • InstallSetup7.exe (PID: 5304)
      • BroomSetup.exe (PID: 4784)

    • There is functionality for VM detection VirtualPC (YARA)

      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 5228)
      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 7940)

    • There is functionality for VM detection Parallels (YARA)

      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 5228)
      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 7940)

    • There is functionality for VM detection VirtualBox (YARA)

      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 5228)
      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 7940)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • cmd.exe (PID: 8160)

    • Starts process via Powershell

      • powershell.exe (PID: 4120)

    • Starts itself from another location

      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 132)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 6516)

    • There is functionality for VM detection VMWare (YARA)

      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 7940)
      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 5228)

    • Drops a system driver (possible attempt to evade defenses)

      • csrss.exe (PID: 5364)
      • reakuqnanrkn.exe (PID: 8048)

    • Windows service management via SC.EXE

      • sc.exe (PID: 7820)
      • sc.exe (PID: 7264)
      • sc.exe (PID: 7916)
      • sc.exe (PID: 404)
      • sc.exe (PID: 4728)

    • Script adds exclusion extension to Windows Defender

      • FirstZ.exe (PID: 7816)
      • reakuqnanrkn.exe (PID: 8048)

    • Manipulates environment variables

      • powershell.exe (PID: 3132)
      • powershell.exe (PID: 2560)

    • Script adds exclusion path to Windows Defender

      • FirstZ.exe (PID: 7816)
      • reakuqnanrkn.exe (PID: 8048)

    • Starts SC.EXE for service management

      • FirstZ.exe (PID: 7816)
      • reakuqnanrkn.exe (PID: 8048)

    • Stops a currently running service

      • sc.exe (PID: 2236)
      • sc.exe (PID: 8084)
      • sc.exe (PID: 6028)
      • sc.exe (PID: 2644)
      • sc.exe (PID: 1132)
      • sc.exe (PID: 7188)
      • sc.exe (PID: 8152)
      • sc.exe (PID: 7700)
      • sc.exe (PID: 7260)
      • sc.exe (PID: 7436)
      • sc.exe (PID: 5416)

    • Process uninstalls Windows update

      • wusa.exe (PID: 6828)
      • wusa.exe (PID: 6048)

    • Uses powercfg.exe to modify the power settings

      • FirstZ.exe (PID: 7816)
      • reakuqnanrkn.exe (PID: 8048)

    • Creates a new Windows service

      • sc.exe (PID: 6248)

    • Connects to unusual port

      • explorer.exe (PID: 7840)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 2196)

    • Executes as Windows Service

      • reakuqnanrkn.exe (PID: 8048)

  • INFO

    • Reads the computer name

      • 9587bda655a2dc730e4bdbd7de5ab39bc37de697fe22f449a6b2f851adaedfb8.exe (PID: 6072)
      • InstallSetup7.exe (PID: 5304)
      • rty25.exe (PID: 1284)
      • BroomSetup.exe (PID: 4784)
      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 5228)
      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 7940)

    • The sample compiled with english language support

      • 9587bda655a2dc730e4bdbd7de5ab39bc37de697fe22f449a6b2f851adaedfb8.exe (PID: 6072)
      • InstallSetup7.exe (PID: 5304)
      • csrss.exe (PID: 5364)
      • FirstZ.exe (PID: 7816)

    • Create files in a temporary directory

      • 9587bda655a2dc730e4bdbd7de5ab39bc37de697fe22f449a6b2f851adaedfb8.exe (PID: 6072)
      • InstallSetup7.exe (PID: 5304)

    • Checks supported languages

      • InstallSetup7.exe (PID: 5304)
      • rty25.exe (PID: 1284)
      • FirstZ.exe (PID: 5760)
      • BroomSetup.exe (PID: 4784)
      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 5228)
      • chcp.com (PID: 7612)
      • FirstZ.exe (PID: 7816)
      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 7940)
      • 9587bda655a2dc730e4bdbd7de5ab39bc37de697fe22f449a6b2f851adaedfb8.exe (PID: 6072)
      • toolspub1.exe (PID: 5728)

    • Process checks computer location settings

      • 9587bda655a2dc730e4bdbd7de5ab39bc37de697fe22f449a6b2f851adaedfb8.exe (PID: 6072)

    • Checks proxy server information

      • rty25.exe (PID: 1284)
      • InstallSetup7.exe (PID: 5304)

    • Creates files or folders in the user directory

      • BroomSetup.exe (PID: 4784)

    • Launch of the file from Task Scheduler

      • cmd.exe (PID: 7556)

    • Changes the display of characters in the console

      • cmd.exe (PID: 7556)

    • The executable file from the user directory is run by the Powershell process

      • FirstZ.exe (PID: 7816)

    • Reads security settings of Internet Explorer

      • cmd.exe (PID: 7584)
      • fodhelper.exe (PID: 1180)

    • Drops encrypted JS script (Microsoft Script Encoder)

      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 7940)

    • Application based on Golang

      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 5228)
      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 7940)

    • Detects GO elliptic curve encryption (YARA)

      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 5228)
      • 31839b57a4f11171d6abc8bbc4451ee4.exe (PID: 7940)

    • Compiled with Borland Delphi (YARA)

      • BroomSetup.exe (PID: 4784)

    • Uses Task Scheduler to autorun other applications (AUTOMATE)

      • csrss.exe (PID: 5364)

    • The sample compiled with japanese language support

      • reakuqnanrkn.exe (PID: 8048)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:01:23 20:26:34+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 9699840
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x94210e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 1.0.0.0
InternalName: latestrocki.exe
LegalCopyright:
OriginalFileName: latestrocki.exe
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
361
Monitored processes
177
Malicious processes
13
Suspicious processes
5

Behavior graph

Click at the process to see the details
start 9587bda655a2dc730e4bdbd7de5ab39bc37de697fe22f449a6b2f851adaedfb8.exe installsetup7.exe toolspub1.exe no specs 31839b57a4f11171d6abc8bbc4451ee4.exe rty25.exe no specs broomsetup.exe no specs firstz.exe no specs powershell.exe no specs conhost.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs schtasks.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs firstz.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs cmd.exe no specs conhost.exe no specs fodhelper.exe no specs fodhelper.exe no specs fodhelper.exe 31839b57a4f11171d6abc8bbc4451ee4.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs powershell.exe no specs conhost.exe no specs 31839b57a4f11171d6abc8bbc4451ee4.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs werfault.exe no specs #SMOKE explorer.exe csrss.exe werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs powershell.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs werfault.exe no specs powershell.exe no specs conhost.exe no specs werfault.exe no specs werfault.exe no specs mountvol.exe no specs conhost.exe no specs mountvol.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs wusa.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs conhost.exe no specs conhost.exe no specs powercfg.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs THREAT reakuqnanrkn.exe powershell.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs cmd.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs wusa.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs powercfg.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs powercfg.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs explorer.exe #MINER svchost.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
32\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powercfg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
132"C:\Users\admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"C:\Users\admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
31839b57a4f11171d6abc8bbc4451ee4.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\31839b57a4f11171d6abc8bbc4451ee4.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msimg32.dll
c:\windows\syswow64\gdi32.dll
240\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
404C:\WINDOWS\system32\sc.exe delete "WSNKISKT"C:\Windows\System32\sc.exe—FirstZ.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
472\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
656\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
668C:\WINDOWS\SysWOW64\WerFault.exe -u -p 5364 -s 468C:\Windows\SysWOW64\WerFault.exe—csrss.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
780C:\WINDOWS\SysWOW64\WerFault.exe -u -p 7940 -s 392C:\Windows\SysWOW64\WerFault.exe—31839b57a4f11171d6abc8bbc4451ee4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
928\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1132C:\WINDOWS\system32\sc.exe stop wuauservC:\Windows\System32\sc.exe—FirstZ.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1062
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
Total events
75 283
Read events
75 236
Write events
45
Delete events
2

Modification events

(PID) Process:(4784) BroomSetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Broom
Operation:writeName:Key
Value:
XZWEN-27MCX-Z9JD1-USCSW
(PID) Process:(4784) BroomSetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Broom
Operation:writeName:Date
Value:
047F6F9C5F5EE640
(PID) Process:(5228) 31839b57a4f11171d6abc8bbc4451ee4.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\fde20f96
Operation:writeName:Servers
Value:
https://thestatsfiles.ru
(PID) Process:(5228) 31839b57a4f11171d6abc8bbc4451ee4.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\fde20f96
Operation:writeName:UUID
Value:
(PID) Process:(5228) 31839b57a4f11171d6abc8bbc4451ee4.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\fde20f96
Operation:writeName:FirstInstallDate
Value:
E8363E6800000000
(PID) Process:(5228) 31839b57a4f11171d6abc8bbc4451ee4.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\fde20f96
Operation:writeName:ServiceVersion
Value:
(PID) Process:(5228) 31839b57a4f11171d6abc8bbc4451ee4.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\fde20f96
Operation:writeName:PGDSE
Value:
0000000000000000
(PID) Process:(5228) 31839b57a4f11171d6abc8bbc4451ee4.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\fde20f96
Operation:writeName:ServersVersion
Value:
C300000000000000
(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5\ApplicationViewManagement\W32:0000000000060342
Operation:writeName:VirtualDesktop
Value:
1000000030304456BFA0DB55E4278845B426357D5B5F97B3
(PID) Process:(5228) 31839b57a4f11171d6abc8bbc4451ee4.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\fde20f96
Operation:writeName:AV
Value:
Executable files
14
Suspicious files
5
Text files
37
Unknown types
0

Dropped files

PID
Process
Filename
Type
60729587bda655a2dc730e4bdbd7de5ab39bc37de697fe22f449a6b2f851adaedfb8.exeC:\Users\admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exeexecutable
MD5:8DCC157B2C7D02AFDCD96896E3EA4902
SHA256:079F86DC403A10360B70A9CD26620A7E924494988EB20CF301ED5BA9ECC9B459
4120powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ueydoesc.j52.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5304InstallSetup7.exeC:\Users\admin\AppData\Local\Temp\BroomSetup.exeexecutable
MD5:5E94F0F6265F9E8B2F706F1D46BBD39E
SHA256:50A46B3120DA828502EF0CABA15DEFBAD004A3ADB88E6EACF1F9604572E2D503
60729587bda655a2dc730e4bdbd7de5ab39bc37de697fe22f449a6b2f851adaedfb8.exeC:\Users\admin\AppData\Local\Temp\InstallSetup7.exeexecutable
MD5:6E23201D2E4560010928ADA16D5E4AE9
SHA256:2E3D25B6B55A04346FCC1FA8F587DD08F27F2CF8878AD354A695E50C74956EFC
4120powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_laxaxr3f.b1p.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2136powershell.exeC:\Windows\Temp\__PSScriptPolicyTest_52x4rr2n.dvi.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4120powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:EE3D27F81459B098C3E82B0EECA6B895
SHA256:B8DF12A45988FCF401FEEF450A4A054DA6B12FA6C23B1078FDE1C029D2FD10FC
5744powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactivebinary
MD5:4AA94459561C7A66D1D9EECC8DB78E88
SHA256:C5374794677312C539F55028CD1B37D5B6DEAEF6FB9301A1029EA2003583D8B9
5744powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_z433oome.3ci.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2136powershell.exeC:\Windows\Temp\__PSScriptPolicyTest_f4yoa3pm.z3t.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
30
DNS requests
35
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5492
explorer.exe
POST
404
188.40.141.211:80
http://trad-einmyus.com/index.php
unknown
—
—
malicious
5492
explorer.exe
POST
404
188.40.141.211:80
http://trad-einmyus.com/index.php
unknown
—
—
malicious
3768
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3768
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
8064
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.42:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5304
InstallSetup7.exe
185.172.128.90:80
—
OOO Nadym Svyaz Service
RU
malicious
6544
svchost.exe
40.126.31.129:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.216.77.42
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 2.23.181.156
whitelisted
google.com
  • 142.250.186.174
whitelisted
i.alie3ksgaa.com
  • —
unknown
login.live.com
  • 40.126.31.129
  • 40.126.31.1
  • 20.190.159.68
  • 20.190.159.2
  • 20.190.159.0
  • 40.126.31.3
  • 40.126.31.2
  • 20.190.159.71
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
trad-einmyus.com
  • 188.40.141.211
malicious
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted

Threats

PID
Process
Class
Message
5492
explorer.exe
A Network Trojan was detected
LOADER [ANY.RUN] Smokeloader HTTP Header
5492
explorer.exe
A Network Trojan was detected
LOADER [ANY.RUN] Smokeloader HTTP Header
2196
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discordapp .com)
5364
csrss.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
2196
svchost.exe
Potential Corporate Privacy Violation
ET INFO Observed DNS Query to Coin Mining Domain (nanopool .org)
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Online Pastebin Text Storage
2196
svchost.exe
Potential Corporate Privacy Violation
ET INFO Observed DNS Query to Coin Mining Domain (nanopool .org)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
9587bda655a2dc730e4bdbd7de5ab39bc37de697fe22f449a6b2f851adaedfb8