File name:

a0d991805036a997aa6a3946eb2ab946bac14f0973d106d37ce8c596cb5c4c9c

Full analysis: https://app.any.run/tasks/5f6854c9-9233-477f-911f-76c9be5dc2fa
Verdict: Malicious activity
Analysis date: April 29, 2025, 06:12:14
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
MD5:

60D58CA6CA618C816368E144C8456ECB

SHA1:

731265DDAC5987CE83F19B45A1B55D3B74D2E739

SHA256:

A0D991805036A997AA6A3946EB2AB946BAC14F0973D106D37CE8C596CB5C4C9C

SSDEEP:

98304:Vz9Uum888888888888888888888888888888888888888888888888888888888G:y

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • a0d991805036a997aa6a3946eb2ab946bac14f0973d106d37ce8c596cb5c4c9c.exe (PID: 7392)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • a0d991805036a997aa6a3946eb2ab946bac14f0973d106d37ce8c596cb5c4c9c.exe (PID: 7392)

    • Executable content was dropped or overwritten

      • a0d991805036a997aa6a3946eb2ab946bac14f0973d106d37ce8c596cb5c4c9c.exe (PID: 7392)

    • Executes application which crashes

      • a0d991805036a997aa6a3946eb2ab946bac14f0973d106d37ce8c596cb5c4c9c.exe (PID: 7392)
      • jyqxcafx.exe (PID: 7568)

    • Detected use of alternative data streams (AltDS)

      • svchost.exe (PID: 7680)

  • INFO

    • Create files in a temporary directory

      • a0d991805036a997aa6a3946eb2ab946bac14f0973d106d37ce8c596cb5c4c9c.exe (PID: 7392)

    • Reads the computer name

      • a0d991805036a997aa6a3946eb2ab946bac14f0973d106d37ce8c596cb5c4c9c.exe (PID: 7392)
      • jyqxcafx.exe (PID: 7568)

    • Process checks computer location settings

      • a0d991805036a997aa6a3946eb2ab946bac14f0973d106d37ce8c596cb5c4c9c.exe (PID: 7392)

    • Checks supported languages

      • a0d991805036a997aa6a3946eb2ab946bac14f0973d106d37ce8c596cb5c4c9c.exe (PID: 7392)
      • jyqxcafx.exe (PID: 7568)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:03:12 19:20:19+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 148480
InitializedDataSize: 32325632
UninitializedDataSize: -
EntryPoint: 0x5bd2
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 8.0.0.0
ProductVersionNumber: 28.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Unknown (0293)
CharacterSet: Unknown (85B1)
CompanyName: Siply
FileDescriptions: PlasticFantastic
FileVersion: 13.78.85.48
InternalName: GrowTrees.exe
LegalCopyrights: Challangers kenia
ProductName: Game
ProductVersion: 45.83.62.11
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
8
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start a0d991805036a997aa6a3946eb2ab946bac14f0973d106d37ce8c596cb5c4c9c.exe wusa.exe no specs wusa.exe jyqxcafx.exe werfault.exe no specs svchost.exe no specs werfault.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
7392"C:\Users\admin\AppData\Local\Temp\a0d991805036a997aa6a3946eb2ab946bac14f0973d106d37ce8c596cb5c4c9c.exe" C:\Users\admin\AppData\Local\Temp\a0d991805036a997aa6a3946eb2ab946bac14f0973d106d37ce8c596cb5c4c9c.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225622
Modules
Images
c:\users\admin\appdata\local\temp\a0d991805036a997aa6a3946eb2ab946bac14f0973d106d37ce8c596cb5c4c9c.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7440"C:\Windows\System32\wusa.exe" C:\Windows\SysWOW64\wusa.exe—a0d991805036a997aa6a3946eb2ab946bac14f0973d106d37ce8c596cb5c4c9c.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Update Standalone Installer
Exit code:
3221226540
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wusa.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7544"C:\WINDOWS\SysWOW64\wusa.exe" C:\Windows\SysWOW64\wusa.exe
a0d991805036a997aa6a3946eb2ab946bac14f0973d106d37ce8c596cb5c4c9c.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Update Standalone Installer
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wusa.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7568"C:\Users\admin\jyqxcafx.exe" /d"C:\Users\admin\AppData\Local\Temp\a0d991805036a997aa6a3946eb2ab946bac14f0973d106d37ce8c596cb5c4c9c.exe" /e5E0402100000007FC:\Users\admin\jyqxcafx.exe
a0d991805036a997aa6a3946eb2ab946bac14f0973d106d37ce8c596cb5c4c9c.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225622
Modules
Images
c:\users\admin\jyqxcafx.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7648C:\WINDOWS\SysWOW64\WerFault.exe -u -p 7392 -s 1032C:\Windows\SysWOW64\WerFault.exe—a0d991805036a997aa6a3946eb2ab946bac14f0973d106d37ce8c596cb5c4c9c.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
7680svchost.exeC:\Windows\SysWOW64\svchost.exe—jyqxcafx.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
3221225501
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
7728C:\WINDOWS\SysWOW64\WerFault.exe -u -p 7568 -s 556C:\Windows\SysWOW64\WerFault.exe—jyqxcafx.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
8052C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
1 453
Read events
1 450
Write events
2
Delete events
1

Modification events

(PID) Process:(7392) a0d991805036a997aa6a3946eb2ab946bac14f0973d106d37ce8c596cb5c4c9c.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:goteafsa
Value:
"C:\Users\admin\jyqxcafx.exe"
(PID) Process:(7680) svchost.exeKey:HKEY_CURRENT_USER\Control Panel\Buses
Operation:writeName:Config0
Value:
008D213F4A831E3D24EDB47D450DD49D084297DCE82E72BAA49565FFE422031D88FA691CD1CC945D24EDB47D470DD49D024195DAF71261ADC06D04FDA6E22673BBC9154961CDA56B15D4824A723AE1AD644490BDBD7F20E99C5905CFFD8D3C74BBC4103D36F4A26811DA814E750DB8F2054991CFDB2470DD906D5185A7E82469BBC41A5B6BCD9E2B419F8944702DB0FC1048C9F7E52334EC974D06CDF5B5742CD69744053EFEA65747D0D74D743DE4AD5549D4DCB97D26E8905A07CE81AD227CD9EB4405358BA26811D881487138E1A5260D81D8E27024EF915902C8F5BC5E4285D5490D34FDA46D14DD85741B6FACA0541DC48DB47D24EDAD325785F9BD6628D5E8320F37C4CB395CD0844F713C91DB566FFDE2F72429ED965805BBF4BA6414BBC91D0034FFA16C61AB863F4D52B6ED591DC688B50B24EAE7646B8EB4B0642FD19C317842FD9E2F4199894D7638E0A5551CC4B4F47C29ED965801CDF6BB6014949F490D34FDA46D14DD8474343EE9AD541DC48DB47D24D4D45909CDF6B8655BD4EC403776A8E06014DF81490539E1DB6D5DC580B47F21E99D2C02BFCDFD6620D49F41093D8CA21F2D9D8740743FE3A4271DC48D8D3D20E0945F04CFF4BF642FEEDF114939FAA26516ABF73E7D04A4AC591DC68ABD0E24ED946444CFF9BA6225D6EB377F34C4E46E19DD844D743DE4AD25248489B97A23E8925A77C88187247183DE4E3704
(PID) Process:(7680) svchost.exeKey:HKEY_CURRENT_USER\Control Panel\Buses
Operation:delete valueName:Config1
Value:
Executable files
2
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
7680svchost.exeC:\Users\admin:.reposbinary
MD5:8337C64A0EA7EB9AD8C5325024887E4B
SHA256:F9113D187D2F70FBA61EA8F945718AF2B6F8DE24C6D7CB8A185D4607C89C465C
7392a0d991805036a997aa6a3946eb2ab946bac14f0973d106d37ce8c596cb5c4c9c.exeC:\Users\admin\jyqxcafx.exeexecutable
MD5:4F9CB6F6722150E6DF3ED961C8C150B0
SHA256:385C6BB32168E99454F929236E93F2EAE2C6B91202509B0888246F3341437605
7392a0d991805036a997aa6a3946eb2ab946bac14f0973d106d37ce8c596cb5c4c9c.exeC:\Users\admin\AppData\Local\Temp\dpxuantr.exeexecutable
MD5:A5D82F79AD9DA3E0A9406F623CEA097F
SHA256:FFD883A217E2064FAF9E28498BAE10FDAE3F50BA258B4B0ECDD7FD80A86D1DA2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
17
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.32.238.112:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
72.246.169.155:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7876
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7876
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.32.238.112:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
72.246.169.155:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
7876
SIHClient.exe
20.12.23.50:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7876
SIHClient.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
7876
SIHClient.exe
13.95.31.18:443
fe3cr.delivery.mp.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.174
whitelisted
crl.microsoft.com
  • 23.32.238.112
  • 23.32.238.107
whitelisted
www.microsoft.com
  • 72.246.169.155
  • 95.101.149.131
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
a0d991805036a997aa6a3946eb2ab946bac14f0973d106d37ce8c596cb5c4c9c