File name:

1 (253)

Full analysis: https://app.any.run/tasks/c5cd0077-a597-44f5-b547-a5a4e38cb48f
Verdict: Malicious activity
Analysis date: March 24, 2025, 18:49:37
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
MD5:

5D432B2A5BD50EEA9FEE2CC80396F890

SHA1:

E9601813D6F0B61AE15094A2109838EA980A2D28

SHA256:

A099BF01D10FECEC2EC68D77792C70E090DE9F6EBA1B1AB5E761D6FB79FD67C9

SSDEEP:

24576:4oE4BacwNqAJC4pbiGmwXX+67IQRQkZWv9F:4oEmacwNqAJfZiGmMX+rmQkZE9F

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • reg.exe (PID: 2148)
      • reg.exe (PID: 1188)
      • reg.exe (PID: 4628)
      • reg.exe (PID: 1196)
      • reg.exe (PID: 4628)
      • reg.exe (PID: 6080)
      • reg.exe (PID: 1312)
      • reg.exe (PID: 4108)
      • reg.exe (PID: 2240)
      • reg.exe (PID: 3900)
      • reg.exe (PID: 5756)
      • reg.exe (PID: 1184)
      • reg.exe (PID: 976)
      • reg.exe (PID: 5112)
      • reg.exe (PID: 3900)
      • reg.exe (PID: 5680)
      • reg.exe (PID: 5552)
      • reg.exe (PID: 4200)
      • reg.exe (PID: 4164)
      • reg.exe (PID: 5600)
      • reg.exe (PID: 4024)
      • reg.exe (PID: 4452)
      • reg.exe (PID: 3272)
      • reg.exe (PID: 1272)
      • reg.exe (PID: 4300)
      • reg.exe (PID: 2776)
      • reg.exe (PID: 3008)
      • reg.exe (PID: 3620)
      • reg.exe (PID: 6044)
      • reg.exe (PID: 6960)
      • reg.exe (PID: 3016)

  • SUSPICIOUS

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 6768)
      • cmd.exe (PID: 3132)
      • cmd.exe (PID: 2096)
      • cmd.exe (PID: 2568)
      • cmd.exe (PID: 4228)
      • cmd.exe (PID: 5756)
      • cmd.exe (PID: 4224)
      • cmd.exe (PID: 1388)
      • cmd.exe (PID: 2552)
      • cmd.exe (PID: 2960)
      • cmd.exe (PID: 4628)
      • cmd.exe (PID: 4108)
      • cmd.exe (PID: 4756)
      • cmd.exe (PID: 6476)
      • cmd.exe (PID: 5260)
      • cmd.exe (PID: 4200)
      • cmd.exe (PID: 1132)
      • cmd.exe (PID: 5984)
      • cmd.exe (PID: 4756)
      • cmd.exe (PID: 6816)
      • cmd.exe (PID: 2392)
      • cmd.exe (PID: 5624)
      • cmd.exe (PID: 1912)
      • cmd.exe (PID: 924)
      • cmd.exe (PID: 1088)
      • cmd.exe (PID: 3272)
      • cmd.exe (PID: 1272)
      • cmd.exe (PID: 6068)
      • cmd.exe (PID: 4056)
      • cmd.exe (PID: 1056)
      • cmd.exe (PID: 2340)
      • cmd.exe (PID: 6712)
      • cmd.exe (PID: 6392)
      • cmd.exe (PID: 2332)
      • cmd.exe (PID: 3016)
      • cmd.exe (PID: 1532)
      • cmd.exe (PID: 2088)
      • cmd.exe (PID: 4628)
      • cmd.exe (PID: 6712)
      • cmd.exe (PID: 4996)
      • cmd.exe (PID: 3096)
      • cmd.exe (PID: 1748)
      • cmd.exe (PID: 3800)
      • cmd.exe (PID: 4400)

    • Executing commands from a ".bat" file

      • 1 (253).exe (PID: 6620)
      • service.exe (PID: 2152)
      • service.exe (PID: 5024)
      • service.exe (PID: 2384)
      • service.exe (PID: 6708)
      • service.exe (PID: 6676)
      • service.exe (PID: 5868)
      • service.exe (PID: 1852)
      • service.exe (PID: 5512)
      • service.exe (PID: 2908)
      • service.exe (PID: 3132)
      • service.exe (PID: 5308)
      • service.exe (PID: 5216)
      • service.exe (PID: 4228)
      • service.exe (PID: 4024)
      • service.exe (PID: 4692)
      • service.exe (PID: 6808)
      • service.exe (PID: 744)
      • service.exe (PID: 6576)
      • service.exe (PID: 5964)
      • service.exe (PID: 2284)
      • service.exe (PID: 6960)
      • service.exe (PID: 2236)
      • service.exe (PID: 5112)
      • service.exe (PID: 5400)
      • service.exe (PID: 1244)
      • service.exe (PID: 2416)
      • service.exe (PID: 1188)
      • service.exe (PID: 4628)
      • service.exe (PID: 2644)
      • service.exe (PID: 2040)
      • service.exe (PID: 6228)
      • service.exe (PID: 6808)
      • service.exe (PID: 3900)
      • service.exe (PID: 4428)
      • service.exe (PID: 872)
      • service.exe (PID: 5436)
      • service.exe (PID: 1004)
      • service.exe (PID: 6248)
      • service.exe (PID: 5404)
      • service.exe (PID: 6708)
      • service.exe (PID: 5384)
      • service.exe (PID: 4112)
      • service.exe (PID: 2392)

    • Starts CMD.EXE for commands execution

      • 1 (253).exe (PID: 6620)
      • service.exe (PID: 2152)
      • service.exe (PID: 5024)
      • service.exe (PID: 2384)
      • service.exe (PID: 6708)
      • service.exe (PID: 6676)
      • service.exe (PID: 1852)
      • service.exe (PID: 5868)
      • service.exe (PID: 5512)
      • service.exe (PID: 2908)
      • service.exe (PID: 5308)
      • service.exe (PID: 3132)
      • service.exe (PID: 5216)
      • service.exe (PID: 4024)
      • service.exe (PID: 4228)
      • service.exe (PID: 4692)
      • service.exe (PID: 6808)
      • service.exe (PID: 744)
      • service.exe (PID: 6576)
      • service.exe (PID: 5964)
      • service.exe (PID: 2284)
      • service.exe (PID: 6960)
      • service.exe (PID: 2236)
      • service.exe (PID: 5112)
      • service.exe (PID: 1244)
      • service.exe (PID: 5400)
      • service.exe (PID: 2416)
      • service.exe (PID: 1188)
      • service.exe (PID: 4628)
      • service.exe (PID: 2644)
      • service.exe (PID: 2040)
      • service.exe (PID: 6808)
      • service.exe (PID: 6228)
      • service.exe (PID: 3900)
      • service.exe (PID: 4428)
      • service.exe (PID: 5436)
      • service.exe (PID: 1004)
      • service.exe (PID: 872)
      • service.exe (PID: 6248)
      • service.exe (PID: 5404)
      • service.exe (PID: 6708)
      • service.exe (PID: 5384)
      • service.exe (PID: 4112)
      • service.exe (PID: 2392)

    • Reads security settings of Internet Explorer

      • 1 (253).exe (PID: 6620)
      • service.exe (PID: 2152)
      • service.exe (PID: 5024)
      • service.exe (PID: 2384)
      • service.exe (PID: 6708)
      • service.exe (PID: 5868)
      • service.exe (PID: 5512)
      • service.exe (PID: 1852)
      • service.exe (PID: 5308)
      • service.exe (PID: 2908)
      • service.exe (PID: 3132)
      • service.exe (PID: 5216)
      • service.exe (PID: 4228)
      • service.exe (PID: 4692)
      • service.exe (PID: 744)
      • service.exe (PID: 6576)
      • service.exe (PID: 5964)
      • service.exe (PID: 6960)
      • service.exe (PID: 2284)
      • service.exe (PID: 2236)
      • service.exe (PID: 5400)
      • service.exe (PID: 1188)
      • service.exe (PID: 2416)
      • service.exe (PID: 4628)
      • service.exe (PID: 2040)
      • service.exe (PID: 2644)
      • service.exe (PID: 6228)
      • service.exe (PID: 6808)
      • service.exe (PID: 4428)
      • service.exe (PID: 5436)
      • service.exe (PID: 872)
      • service.exe (PID: 1004)
      • service.exe (PID: 5404)
      • service.exe (PID: 6248)
      • service.exe (PID: 5384)
      • service.exe (PID: 6708)
      • service.exe (PID: 2392)

    • Executable content was dropped or overwritten

      • 1 (253).exe (PID: 6620)
      • service.exe (PID: 2152)
      • service.exe (PID: 5024)
      • service.exe (PID: 2384)
      • service.exe (PID: 6676)
      • service.exe (PID: 6708)
      • service.exe (PID: 5868)
      • service.exe (PID: 1852)
      • service.exe (PID: 5512)
      • service.exe (PID: 2908)
      • service.exe (PID: 3132)
      • service.exe (PID: 5216)
      • service.exe (PID: 5308)
      • service.exe (PID: 4024)
      • service.exe (PID: 4228)
      • service.exe (PID: 4692)
      • service.exe (PID: 6808)
      • service.exe (PID: 744)
      • service.exe (PID: 6576)
      • service.exe (PID: 5964)
      • service.exe (PID: 2284)
      • service.exe (PID: 6960)
      • service.exe (PID: 2236)
      • service.exe (PID: 5112)
      • service.exe (PID: 5400)
      • service.exe (PID: 1244)
      • service.exe (PID: 2416)
      • service.exe (PID: 1188)
      • service.exe (PID: 4628)
      • service.exe (PID: 2040)
      • service.exe (PID: 2644)
      • service.exe (PID: 6228)
      • service.exe (PID: 6808)
      • service.exe (PID: 3900)
      • service.exe (PID: 5436)
      • service.exe (PID: 4428)
      • service.exe (PID: 872)
      • service.exe (PID: 1004)
      • service.exe (PID: 5404)
      • service.exe (PID: 6248)
      • service.exe (PID: 5384)
      • service.exe (PID: 6708)
      • service.exe (PID: 2392)
      • service.exe (PID: 4112)

    • Starts itself from another location

      • 1 (253).exe (PID: 6620)
      • service.exe (PID: 2152)
      • service.exe (PID: 2384)
      • service.exe (PID: 5024)
      • service.exe (PID: 6708)
      • service.exe (PID: 6676)
      • service.exe (PID: 5868)
      • service.exe (PID: 1852)
      • service.exe (PID: 5512)
      • service.exe (PID: 3132)
      • service.exe (PID: 2908)
      • service.exe (PID: 5308)
      • service.exe (PID: 5216)
      • service.exe (PID: 4024)
      • service.exe (PID: 4228)
      • service.exe (PID: 6808)
      • service.exe (PID: 4692)
      • service.exe (PID: 744)
      • service.exe (PID: 6576)
      • service.exe (PID: 5964)
      • service.exe (PID: 2284)
      • service.exe (PID: 6960)
      • service.exe (PID: 2236)
      • service.exe (PID: 5112)
      • service.exe (PID: 5400)
      • service.exe (PID: 1244)
      • service.exe (PID: 2416)
      • service.exe (PID: 1188)
      • service.exe (PID: 4628)
      • service.exe (PID: 2040)
      • service.exe (PID: 2644)
      • service.exe (PID: 6228)
      • service.exe (PID: 6808)
      • service.exe (PID: 3900)
      • service.exe (PID: 5436)
      • service.exe (PID: 4428)
      • service.exe (PID: 872)
      • service.exe (PID: 1004)
      • service.exe (PID: 5404)
      • service.exe (PID: 6248)
      • service.exe (PID: 5384)
      • service.exe (PID: 6708)
      • service.exe (PID: 2392)
      • service.exe (PID: 4112)

  • INFO

    • The sample compiled with english language support

      • 1 (253).exe (PID: 6620)

    • Creates files or folders in the user directory

      • 1 (253).exe (PID: 6620)
      • service.exe (PID: 2152)
      • service.exe (PID: 6708)
      • service.exe (PID: 2384)
      • service.exe (PID: 6676)
      • service.exe (PID: 5868)
      • service.exe (PID: 1852)
      • service.exe (PID: 5512)
      • service.exe (PID: 2908)
      • service.exe (PID: 5308)
      • service.exe (PID: 5216)
      • service.exe (PID: 4228)
      • service.exe (PID: 4692)
      • service.exe (PID: 744)
      • service.exe (PID: 6576)
      • service.exe (PID: 5964)
      • service.exe (PID: 2284)
      • service.exe (PID: 2236)
      • service.exe (PID: 5112)
      • service.exe (PID: 5400)
      • service.exe (PID: 1188)
      • service.exe (PID: 2416)
      • service.exe (PID: 4628)
      • service.exe (PID: 2644)
      • service.exe (PID: 6808)
      • service.exe (PID: 6228)
      • service.exe (PID: 4428)
      • service.exe (PID: 5436)
      • service.exe (PID: 6248)
      • service.exe (PID: 5384)
      • service.exe (PID: 6708)
      • service.exe (PID: 4112)

    • Reads the computer name

      • 1 (253).exe (PID: 6620)
      • service.exe (PID: 2152)
      • service.exe (PID: 5024)
      • service.exe (PID: 6708)
      • service.exe (PID: 2384)
      • service.exe (PID: 5868)
      • service.exe (PID: 1852)
      • service.exe (PID: 5308)
      • service.exe (PID: 4024)
      • service.exe (PID: 6808)
      • service.exe (PID: 5964)
      • service.exe (PID: 2284)
      • service.exe (PID: 2236)
      • service.exe (PID: 6960)
      • service.exe (PID: 5112)
      • service.exe (PID: 5400)
      • service.exe (PID: 1244)
      • service.exe (PID: 2416)
      • service.exe (PID: 1188)
      • service.exe (PID: 4628)
      • service.exe (PID: 2040)
      • service.exe (PID: 2644)
      • service.exe (PID: 6228)
      • service.exe (PID: 3900)
      • service.exe (PID: 4428)
      • service.exe (PID: 5436)
      • service.exe (PID: 1004)
      • service.exe (PID: 6248)
      • service.exe (PID: 5384)
      • service.exe (PID: 2392)
      • service.exe (PID: 4112)

    • Checks supported languages

      • 1 (253).exe (PID: 6620)
      • service.exe (PID: 2152)
      • service.exe (PID: 5024)
      • service.exe (PID: 2384)
      • service.exe (PID: 6708)
      • service.exe (PID: 6676)
      • service.exe (PID: 5868)
      • service.exe (PID: 1852)
      • service.exe (PID: 2908)
      • service.exe (PID: 5512)
      • service.exe (PID: 3132)
      • service.exe (PID: 5308)
      • service.exe (PID: 5216)
      • service.exe (PID: 4024)
      • service.exe (PID: 4228)
      • service.exe (PID: 4692)
      • service.exe (PID: 6808)
      • service.exe (PID: 744)
      • service.exe (PID: 6576)
      • service.exe (PID: 5964)
      • service.exe (PID: 2284)
      • service.exe (PID: 6960)
      • service.exe (PID: 2236)
      • service.exe (PID: 5112)
      • service.exe (PID: 1244)
      • service.exe (PID: 2416)
      • service.exe (PID: 5400)
      • service.exe (PID: 1188)
      • service.exe (PID: 4628)
      • service.exe (PID: 2040)
      • service.exe (PID: 2644)
      • service.exe (PID: 6228)
      • service.exe (PID: 6808)
      • service.exe (PID: 4428)
      • service.exe (PID: 5436)
      • service.exe (PID: 872)
      • service.exe (PID: 1004)
      • service.exe (PID: 5404)
      • service.exe (PID: 2392)
      • service.exe (PID: 6708)
      • service.exe (PID: 4112)

    • Process checks computer location settings

      • 1 (253).exe (PID: 6620)
      • service.exe (PID: 2152)
      • service.exe (PID: 5024)
      • service.exe (PID: 2384)
      • service.exe (PID: 6676)
      • service.exe (PID: 6708)
      • service.exe (PID: 5868)
      • service.exe (PID: 1852)
      • service.exe (PID: 5512)
      • service.exe (PID: 2908)
      • service.exe (PID: 3132)
      • service.exe (PID: 5308)
      • service.exe (PID: 5216)
      • service.exe (PID: 4692)
      • service.exe (PID: 6808)
      • service.exe (PID: 744)
      • service.exe (PID: 6576)
      • service.exe (PID: 5964)
      • service.exe (PID: 2284)
      • service.exe (PID: 6960)
      • service.exe (PID: 2236)
      • service.exe (PID: 5112)
      • service.exe (PID: 5400)
      • service.exe (PID: 1244)
      • service.exe (PID: 2416)
      • service.exe (PID: 4628)
      • service.exe (PID: 1188)
      • service.exe (PID: 2644)
      • service.exe (PID: 2040)
      • service.exe (PID: 6228)
      • service.exe (PID: 6808)
      • service.exe (PID: 5436)
      • service.exe (PID: 1004)
      • service.exe (PID: 5404)
      • service.exe (PID: 2392)
      • service.exe (PID: 4112)

    • Create files in a temporary directory

      • 1 (253).exe (PID: 6620)
      • service.exe (PID: 2152)
      • service.exe (PID: 5024)
      • service.exe (PID: 2384)
      • service.exe (PID: 6676)
      • service.exe (PID: 6708)
      • service.exe (PID: 5868)
      • service.exe (PID: 5512)
      • service.exe (PID: 1852)
      • service.exe (PID: 2908)
      • service.exe (PID: 5308)
      • service.exe (PID: 5216)
      • service.exe (PID: 4024)
      • service.exe (PID: 4228)
      • service.exe (PID: 6808)
      • service.exe (PID: 4692)
      • service.exe (PID: 744)
      • service.exe (PID: 6576)
      • service.exe (PID: 6960)
      • service.exe (PID: 2236)
      • service.exe (PID: 2284)
      • service.exe (PID: 5112)
      • service.exe (PID: 5400)
      • service.exe (PID: 1244)
      • service.exe (PID: 1188)
      • service.exe (PID: 4628)
      • service.exe (PID: 2040)
      • service.exe (PID: 2644)
      • service.exe (PID: 6808)
      • service.exe (PID: 4428)
      • service.exe (PID: 5436)
      • service.exe (PID: 872)
      • service.exe (PID: 5404)
      • service.exe (PID: 5384)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Microsoft Visual Basic 6 (84.4)
.dll | Win32 Dynamic Link Library (generic) (6.7)
.exe | Win32 Executable (generic) (4.6)
.exe | Generic Win/DOS Executable (2)
.exe | DOS Executable Generic (2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2011:07:14 23:24:23+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 53248
InitializedDataSize: 471040
UninitializedDataSize: -
EntryPoint: 0x17fc
OSVersion: 4
ImageVersion: 4.5
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 7.5.0.5255
ProductVersionNumber: 7.5.0.5255
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: ICQ, LLC.
FileDescription: ICQ
FileVersion: 7.5.0.5255
InternalName: ICQ
LegalCopyright: Copyright (c) 1998-2010 ICQ, LLC.
LegalTrademarks: -
OriginalFileName: ICQ.exe
ProductName: ICQ
ProductVersion: 7.5.0.5255
DistId: 30012
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
318
Monitored processes
180
Malicious processes
35
Suspicious processes
50

Behavior graph

Click at the process to see the details
start 1 (253).exe sppextcomobj.exe no specs slui.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe no specs service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe no specs service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe no specs service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe no specs service.exe cmd.exe no specs conhost.exe no specs reg.exe no specs service.exe cmd.exe no specs conhost.exe no specs reg.exe no specs service.exe slui.exe no specs cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe no specs service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe no specs service.exe cmd.exe no specs conhost.exe no specs reg.exe no specs service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe no specs service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe no specs service.exe cmd.exe no specs conhost.exe no specs reg.exe no specs service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe service.exe cmd.exe no specs conhost.exe no specs reg.exe no specs service.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "AWVMCQMKYPBPRMF" /t REG_SZ /d "C:\Users\admin\AppData\Local\Temp\TWLFELUKPHYPDOE\service.exe" /fC:\Windows\SysWOW64\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
664\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
732\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
736\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
744"C:\Users\admin\AppData\Local\Temp\DRNQTSUGKPCAOWO\service.exe" C:\Users\admin\AppData\Local\Temp\DRNQTSUGKPCAOWO\service.exe
service.exe
User:
admin
Company:
ICQ, LLC.
Integrity Level:
MEDIUM
Description:
ICQ
Exit code:
0
Version:
7.5.0.5255
Modules
Images
c:\users\admin\appdata\local\temp\drnqtsugkpcaowo\service.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
872"C:\Users\admin\AppData\Local\Temp\CKBTLHCVMNKSELP\service.exe" C:\Users\admin\AppData\Local\Temp\CKBTLHCVMNKSELP\service.exe
service.exe
User:
admin
Company:
ICQ, LLC.
Integrity Level:
MEDIUM
Description:
ICQ
Exit code:
0
Version:
7.5.0.5255
Modules
Images
c:\users\admin\appdata\local\temp\ckbtlhcvmnkselp\service.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
904\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
920\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
924C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\TempYDVUR.bat" "C:\Windows\SysWOW64\cmd.exe—service.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
968\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
16 096
Read events
16 052
Write events
44
Delete events
0

Modification events

(PID) Process:(2148) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:LPUBCHAFTTGIDBE
Value:
C:\Users\admin\AppData\Local\Temp\UATDPOQLJQMBPWF\service.exe
(PID) Process:(4628) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:HUBKYUSCXJCWDUN
Value:
C:\Users\admin\AppData\Local\Temp\TNGMTEFSXPXLWMI\service.exe
(PID) Process:(1188) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:XYBLRYYJBDRNMGB
Value:
C:\Users\admin\AppData\Local\Temp\BOKYWNXQPRDHMAL\service.exe
(PID) Process:(1196) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:HDBRXPGFIDAJXFT
Value:
C:\Users\admin\AppData\Local\Temp\HVQTXVYJOTAGDSR\service.exe
(PID) Process:(4628) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:LPKSGHYAHHQLULA
Value:
C:\Users\admin\AppData\Local\Temp\IETYRHRLJMYBHUT\service.exe
(PID) Process:(6080) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:HYQMHXRCSBRSPYK
Value:
C:\Users\admin\AppData\Local\Temp\KGUSJTMLNDIWVHP\service.exe
(PID) Process:(1312) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:OKLWTRVQYMNAGNN
Value:
C:\Users\admin\AppData\Local\Temp\UMLTIHIDCIEUHPJ\service.exe
(PID) Process:(4108) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:PRDJQQBVUJSFESV
Value:
C:\Users\admin\AppData\Local\Temp\ESORUSVGLQDAPXP\service.exe
(PID) Process:(2240) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:IWDMVTEAYLEYFVO
Value:
C:\Users\admin\AppData\Local\Temp\IBQAIRNIDCSTQYK\service.exe
(PID) Process:(3900) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:LMJSEKPBCFRSNLO
Value:
C:\Users\admin\AppData\Local\Temp\QTICBIRHNEVMALB\service.exe
Executable files
88
Suspicious files
0
Text files
88
Unknown types
0

Dropped files

PID
Process
Filename
Type
66201 (253).exeC:\Users\admin\AppData\Local\TempTHOJN.battext
MD5:0CBD33C26DC1DC43A291E5777D952115
SHA256:531BA8FB70581E50CCE45162A66C0D9A628E6B0DD3E187EBF0572E1E441C6CD8
2152service.exeC:\Users\admin\AppData\Local\TempQRWDE.battext
MD5:3F9C5ECB549D39225C01E9D7CAFB5AAA
SHA256:186579C0DEA0A0E8E1A0635F1905980C7A3BCDBA70E23680E12951A0DBB58C88
66201 (253).exeC:\Users\admin\AppData\Local\TempTHOJN.txttext
MD5:0CBD33C26DC1DC43A291E5777D952115
SHA256:531BA8FB70581E50CCE45162A66C0D9A628E6B0DD3E187EBF0572E1E441C6CD8
6708service.exeC:\Users\admin\AppData\Local\TempJUSRV.battext
MD5:F46AA5DD7387C48F93A5FE1B33EED382
SHA256:E8F1BCCD53B7995A39BD4A13D8CE2682D9D5E9876F10E9A8BA2FD481FFEBA8DE
2152service.exeC:\Users\admin\AppData\Local\Temp\TNGMTEFSXPXLWMI\service.exeexecutable
MD5:E645B13A5A8E568BA69570A0D1E17B3B
SHA256:9E1FBBB6F265C80A4DB82F584D1A6746C960F1FEA5C7C885004A60A2F9FB374E
5024service.exeC:\Users\admin\AppData\Local\TempXPVHD.txttext
MD5:BFF02AA7DF60ADE5A8B68472AB40067E
SHA256:1EEFA310280F89302F635EE9755BCE33863BF6982F18DD0B7370AC26EDFA6AE3
66201 (253).exeC:\Users\admin\AppData\Local\Temp\UATDPOQLJQMBPWF\service.exeexecutable
MD5:24A01AD928DE3E17BAC71C9A702C85FA
SHA256:13726CEF0B2EB9CE356B20D4D6E99C1B1D1463170BCD09F723C7A9A60BBF7BCB
2152service.exeC:\Users\admin\AppData\Local\TempQRWDE.txttext
MD5:3F9C5ECB549D39225C01E9D7CAFB5AAA
SHA256:186579C0DEA0A0E8E1A0635F1905980C7A3BCDBA70E23680E12951A0DBB58C88
2152service.exeC:\Users\admin\AppData\Local\Temp\TNGMTEFSXPXLWMI\service.txtexecutable
MD5:24A01AD928DE3E17BAC71C9A702C85FA
SHA256:13726CEF0B2EB9CE356B20D4D6E99C1B1D1463170BCD09F723C7A9A60BBF7BCB
66201 (253).exeC:\Users\admin\AppData\Local\Temp\UATDPOQLJQMBPWF\service.txtexecutable
MD5:5D432B2A5BD50EEA9FEE2CC80396F890
SHA256:A099BF01D10FECEC2EC68D77792C70E090DE9F6EBA1B1AB5E761D6FB79FD67C9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
23
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
780
backgroundTaskHost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6512
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6512
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
23.54.109.203:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
780
backgroundTaskHost.exe
20.105.99.58:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
780
backgroundTaskHost.exe
23.54.109.203:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.238
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.176
  • 23.48.23.141
  • 23.48.23.177
  • 23.48.23.145
  • 23.48.23.180
  • 23.48.23.194
  • 23.48.23.183
  • 23.48.23.164
  • 23.48.23.162
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.160.20
  • 40.126.32.136
  • 20.190.160.3
  • 20.190.160.4
  • 40.126.32.68
  • 20.190.160.64
  • 20.190.160.5
  • 20.190.160.2
whitelisted
ocsp.digicert.com
  • 23.54.109.203
whitelisted
arc.msn.com
  • 20.105.99.58
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
1 (253)