File name:

try.exe

Full analysis: https://app.any.run/tasks/2444b489-86ef-4791-bef3-a753be1e960c
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: August 03, 2024, 18:32:32
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
telegram
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

72FB4D268A7DC2EB8152554D8BBC8FC8

SHA1:

EB37533B8BA3222FAB367E12655A100B1176861F

SHA256:

A3EF1710401A745F77C2DD06B1E737F49FE513FA565AA3787F49451A915551A2

SSDEEP:

98304:oq9ESUfXdNdRM2lhNfEiQ8qkaFywIm905LAqm5Zl12nKmkfCPCdErVcTS3yVgg/T:T

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • try.exe (PID: 6296)

    • Actions looks like stealing of personal data

      • try.exe (PID: 6296)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • try.exe (PID: 6296)

    • Searches for installed software

      • try.exe (PID: 6296)

    • Executes application which crashes

      • try.exe (PID: 6296)

    • Checks for external IP

      • svchost.exe (PID: 2256)
      • try.exe (PID: 6296)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • try.exe (PID: 6296)

    • Connects to unusual port

      • try.exe (PID: 6296)

  • INFO

    • Reads the computer name

      • try.exe (PID: 6296)
      • Activator.exe (PID: 6548)
      • TextInputHost.exe (PID: 7152)

    • Checks supported languages

      • try.exe (PID: 6296)
      • Activator.exe (PID: 6548)
      • TextInputHost.exe (PID: 7152)

    • Create files in a temporary directory

      • try.exe (PID: 6296)

    • Reads the machine GUID from the registry

      • Activator.exe (PID: 6548)

    • Creates files or folders in the user directory

      • try.exe (PID: 6296)
      • WerFault.exe (PID: 6220)

    • Checks proxy server information

      • WerFault.exe (PID: 6220)

    • Reads the software policy settings

      • WerFault.exe (PID: 6220)

    • Attempting to use instant messaging service

      • try.exe (PID: 6296)
      • svchost.exe (PID: 2256)

    • Manual execution by a user

      • chrome.exe (PID: 6540)

    • Application launched itself

      • chrome.exe (PID: 6540)

    • Reads Microsoft Office registry keys

      • chrome.exe (PID: 6540)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:25 22:52:16+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.39
CodeSize: 2521088
InitializedDataSize: 835072
UninitializedDataSize: -
EntryPoint: 0x21ab71
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
155
Monitored processes
15
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start try.exe activator.exe no specs svchost.exe werfault.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs textinputhost.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1172"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1836 --field-trial-handle=1868,i,1246810610487112770,7013209888144359761,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1680"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=2064 --field-trial-handle=1868,i,1246810610487112770,7013209888144359761,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:3C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2256C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2616"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=4944 --field-trial-handle=1868,i,1246810610487112770,7013209888144359761,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3696"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4444 --field-trial-handle=1868,i,1246810610487112770,7013209888144359761,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
3900"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=4216 --field-trial-handle=1868,i,1246810610487112770,7013209888144359761,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4056"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3196 --field-trial-handle=1868,i,1246810610487112770,7013209888144359761,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4560"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=2288 --field-trial-handle=1868,i,1246810610487112770,7013209888144359761,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6208"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3172 --field-trial-handle=1868,i,1246810610487112770,7013209888144359761,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6220C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6296 -s 1248C:\Windows\SysWOW64\WerFault.exe
try.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
13 627
Read events
13 599
Write events
26
Delete events
2

Modification events

(PID) Process:(6220) WerFault.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property
Operation:writeName:00180010F429971D
Value:
0100000001000000D08C9DDF0115D1118C7A00C04FC297EB0100000042CB6C300049C042863C8A748EF9A2B200000000020000000000106600000001000020000000A28C4B6E8214BECE3B3CD4BA0EE95A0CA4373C79D00276D49B8BC7B7082CBEAE000000000E8000000002000020000000AA35351922D2AB57BF626C980D5B051222DD833487D6AA6DEB58A3CAEE6AD6B18000000024034CEFB69D3B76D7168F89331D552A0880E3E3A00561795767DADFA167B28500301E944D99B215D51135AF27FB53AC3C0E17DE9C0988AD3A89241D7B42309CC3C6D6F6717C7A3E583FFE6C061519DDCFAE263925DF051BCD5B1B5D5C9CBD3E46A050B8257F386C7174C82F02DE0722FE5C0718704DAA0F4CAB4AF50B8EBC5B4000000074E325D2CFE85B5E73E195B76B16A2A82A024E3C6FDB9D46FC3E240DF1CF972EB0DA3AEB4C24C228084905B67A4F4F69F54275903D70F33B2DD148BDAB3677CE
(PID) Process:(6220) WerFault.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
Operation:writeName:DeviceTicket
Value:
0100000001000000D08C9DDF0115D1118C7A00C04FC297EB0100000042CB6C300049C042863C8A748EF9A2B2000000000200000000001066000000010000200000000CADF5A60A214D8803D88DBF32F43D682364DEBF78B71A54B43E0DBB1041705A000000000E80000000020000200000001C06720F6DDDED2B0E9E5319D0796E0ECA7E804AF898D0450FC94B73818463B720080000BE3836D58E11EB9C6DB92D0EBB06AB0A788AD51A437B933AC009CA969A3D73B0C8EA7EB2B1645C81D5042D4E1745CF1B18BAC13EFB89D5650A8B4401EB8484736BAB4EA8EAFACCFA7C2E430FDE9945508A536189C9E1678A342BAB230D0EFC5F59CA2CB020D45DD5BCE6D1C301935EDE091604A87CDA0842D75B8D03E3EA8FC590906F444AE2963BA8FB92833478AC9A06570C5DF471F2952A9286134F2151768DC007E76B2029A4B7CDCB9EBE080A2F5207C301C3006AF42CA4EA094F8D9F2EEE3FD5399608B573CD756D98B55F6B3EF31DA834C608A37E42C5CD4FCEC419DB68CD80907E1469B21B14CEA2D630E84F7BD1BC1C3F2195993F38833A699BEA02E333C673F65CAEE37D4A169682A35B4AFEF81C9B557473F3BE3356B5BCB0008EAED80D6DFCF1C9898318601CEBBECD493BCA47CF2D34009FB060539F4FF33734C037D6DF19A70873537BCA3D68D6A6F9139681A8D0D09178545041DA6F5D952745C4F4962A19144ECE55D9A8788B9D05A03D32B40CE773C42C337B97C00BD77B00AE8E085749C53C62456A58597FBAEC26A764077960575922500EEA46F8DDA39B336667E8ADB181D115FAB218EC2EEF4157ECFA1022748087725E537C2866DE25D0492A1392282E4D77B59028B978B621A6ABE571408DE7E046494C3B47781C491B7E2D72C9165655969A900E1236797AD163A877A538F929DE30E056CFA4EEC78A0B1818F12FB2B97BA5E15FBBE08C7087226F07D0A6C2F930CB02B8F81CAEAB2F2FC45F919BA568D445FB6845207A58E110725C4ABA59FA05505318662DA2EAEEFFB9E75118EC372C302647FCCDEA9AEF520853EB7B26C0858C941257FEAC7C503B715CA5E758BF6019427F0445EA0E828CDE457D78DC7D77E03695E261D3D1E006AF2528BA3B1C9D32EC81C579D8945B99870F33DB59B04AADF2ABB081639D8BE02973A34E9C5FF95F830A11A8599F17C50ADEF3F4C36167BA4E99B1637248B4DC39F9EE521DE9DDE053ADE7A144BFBCEBF71E4FF5E4B9A376240751FB8586F3CE974C361713EF5597A803ED71AB4B1B0123BE8678A50D6501AE407C71850F6349ADA8A804DBEBAAC47215A2791C9E0A435AF5CBC6610B69A8FEF5BEEE1F0EFFD8F644D72B535E33FDAB2053EF6B46C951047C4FF77894E8D25A15DE36488E08D9F10A051002E288F3AFAAEA9F7E689701E740A7EE97A1E35F4B6A925BB12D8A856F798E4F081106CF8E5552CA76A5037FDCDBEF1D06F9380C6DEA9F023A1EA090F13840566402FE90F0241D510FA5D68985D5018A463C75473B75FCDA961F30725A784D44C9D6814C7B1BA6886748B27936B1C0121B7EAEB0569462CD5C16F9491A87A632CCA5B3B982806120D8BCC78978B0536E99B63A3D3EFF7AA8257DF7B7B951C5EE3759E0C7A8E0655C59BD527EB66DC236187EF23FC87EC24E2B985420E24C8E2F18218552AD95FCD3FF1FF1619AD687E902D0FF9B7C89E47608179FCB7B6AEE3D0394C2DF562FC0E0AFD7C345B32225826390C65A40CC94884010D41626CB8988637FC0D00EDD04F825FB54DBA190AEA399894EB8B1F98F2C99F17226DAA1622B6700BEE399AC96AB5633FC5EBB0A2ECFCCD8781BC38F19BEE6635E1476A0248A1632F036A71F31772604904381E6B32CCE84291842B483C73F05DE2E1FDE94A9DB95A92245E4ED8875A67075FF7837C92185262C42C56F0F929931A44762E72A1A9FF70148F0C3F9F356D8683412F717BD6BF02CE206D9143450717FC51B7B3A6F53E5E88C009027C3BF8D12759212282BF3D4A8100AE68199439CB6E8856C4A28F15D120A946E7E24EAB4A43D3B368D86277F8921BD2CB14A340564673452E0BD87B23323F3E24CBD6D64791503C758E2FA43BDF751BEBA427E9B99D929360B68827CBC50FCADAE6A96CAD050ABEEE7C40B22224DEE4C4E96E3CFB815237223DFCE108703F279322503AFD75AEB473B6252DE121A34FE2E5DB9E30955C0F4E3D53C3C6292C2C7C2680A4591082B13E228F16444C1CB46DAA5A2B998C9C784DC0EDC63C20A56BAD9353C42E0CF05C6169CA8E982AB905839EE224A1CBB551B0BD1E0E8F3E3DC5C9CB0FC9705B1D5CD6B0E08F127D94F244638EBA17ECFC54F6DD02CAFE883A5E2A4C2402770063C1B8C64DD7A0B6D456124042A250149D45443ADC8D7DC78989AFD57F96DCD8AE695B9CFA4919BD0EDEF1E485F25A34EC7D82FFD4C9D3DBD9B91C00A82D42F94E204AD6123C20461D1381D96BCA07C8EC6A00AFC69A20385DBEE92CBCA758A61DE114B963D9F74B9F6B86C8FC083F195F5FFA82CDB69529C3B06FDAC1A1747EF2B3E25E5F58F2F3474A639635C87F2BCB220D8E5111ED4CB463ACE7CB6D7A73A1C971A82877D96738B637223CD53EB535712D4BE6AA1210C9FBDF4D94D02ADE08FA6D68C83B44BF068DF501FEBA282B9E75B4C90778B4C234101A2203EFED929A635FCE40A96B8FACFC6B7A15D265457A2EC3F01AE420CC7CAB92EF1A4229082E845614A7765EE3684B388F443E4627EA82B49A31113122C076D8F8A9531B91089F152B1A0CF796B9C3854DC458E27A8EF734CD675F2DD1578F856859C7EA6143C28D656B44E8CFAAEFB4FF635021614255CD68382C6C11F7A2D4F46A74DF42207C3AC3260E50F60955B166A634EBFF805BF8D16B03B9C24068ED3BEDDB538B307F255607BDCE9CF0A2A9246BFDEC66043917778784FF96A6423E133F8B3B8E5DE0657D3E50B3103F1DA4B87190E448F0201ECA6037FCC3998A41980CB435FFCF4AC388E1202CA4397D923A3DE3941760F5C4F689E90722938D1218EFFDA4382820D3EF7B2A873B72ABB31748F20085E7160E8CD06E2216A9148BE486235C1EA11341EAAD43B83E848F981768E2351E896C28F6B7241CA0C1B04178CA5592CE8A5CEF37124AAB52684AEFD6140000000BDC6F9C08A1FF3F5AEFBAD33AB4242119B149326CF2B05566C79C16388DDA2DCC3A4AC12C3B0D8EA851C9B57BF161377162759EDFCAF87D0AE4CEC751D97AC3E
(PID) Process:(6220) WerFault.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
Operation:writeName:DeviceId
Value:
00180010F429971D
(PID) Process:(6220) WerFault.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{67082621-8D18-4333-9C64-10DE93676363}
Operation:writeName:ApplicationFlags
Value:
1
(PID) Process:(6540) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(6540) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(6540) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(6540) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(6540) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(6540) chrome.exeKey:HKEY_CURRENT_USER\SOFTWARE\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
Executable files
1
Suspicious files
43
Text files
23
Unknown types
0

Dropped files

PID
Process
Filename
Type
6296try.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\Fredy_Places.sqlite —
MD5:—
SHA256:—
6296try.exeC:\Users\admin\AppData\Local\Temp\Activator.exeexecutable
MD5:2B2204C85F334DE4695369F631926664
SHA256:69DB6B1262AF756060EFD63CA54A933CBEC740AC193221A88BBC46DF9AC53DE9
6296try.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Fredy_Historybinary
MD5:FDDE63730E15DD2E18C540BA52B6A945
SHA256:40740EAABD14FC0E08D3B5EE340C1E1B372E158F61EF58AEED1EE4B3A3F4492E
6296try.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Fredy_Datasqlite
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
6296try.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Fredy_Web_Datasqlite
MD5:F6C33AC5E1032A0873BE7BFC65169287
SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83
6220WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_try.exe_9247f59c07215e6f08814a75acd5c6ea65e4fa_fb6659c0_3f38aeb1-5434-4114-af8b-d24c7c7199e5\Report.wer —
MD5:—
SHA256:—
6296try.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Fredy_Historysqlite
MD5:0B2213BCE3950F1E95FEEB8E8B3B9543
SHA256:71DB3D87713A320BA9FD3043392509B430630CFCF574EE84118406D6471CFC5A
6296try.exeC:\Users\admin\AppData\Local\Temp\AUTOSAVE\History\Microsoft Edge Browser_Default.txttext
MD5:7323C46C40744B5B3E68DA49B8A676FE
SHA256:FB1DDA6116E17EAC4B0CAB865B7931A6A088D3F0AE5EE970C36BF242B55D71C2
6296try.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Fredy_Datasqlite
MD5:29A644B1F0D96166A05602FE27B3F4AD
SHA256:BF96902FEB97E990A471492F78EE8386BCF430D66BDAEFDEAFBF912C8CF7CE46
6296try.exeC:\Users\admin\AppData\Local\Temp\AUTOSAVE\Screenshot.jpgimage
MD5:4A89C745D130F5C5516FC5150BB68350
SHA256:4D1B502794E2B07544A5296904A13E086A17D324B444BEFEC49BA73180CD699F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
70
DNS requests
41
Threats
18

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
2968
svchost.exe
GET
304
23.192.153.142:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
6296
try.exe
GET
200
44.198.106.96:80
http://httpbin.org/ip
unknown
—
—
shared
6296
try.exe
GET
200
44.198.106.96:80
http://httpbin.org/ip
unknown
—
—
shared
768
lsass.exe
GET
200
95.101.54.137:80
http://r10.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgRFR8WyY%2FlMkr0lsTk9YS076A%3D%3D
unknown
—
—
whitelisted
6296
try.exe
HEAD
403
185.53.177.31:80
http://suckmydick.com/
unknown
—
—
malicious
6296
try.exe
GET
200
44.198.106.96:80
http://httpbin.org/ip
unknown
—
—
shared
6296
try.exe
GET
200
44.198.106.96:80
http://httpbin.org/ip
unknown
—
—
shared
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3140
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4232
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3140
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6296
try.exe
44.198.106.96:80
httpbin.org
AMAZON-AES
US
unknown
6296
try.exe
34.117.59.81:443
ipinfo.io
GOOGLE-CLOUD-PLATFORM
US
whitelisted
768
lsass.exe
95.101.54.137:80
r10.o.lencr.org
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.174
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
httpbin.org
  • 44.198.106.96
  • 34.194.112.169
shared
ipinfo.io
  • 34.117.59.81
shared
r10.o.lencr.org
  • 95.101.54.137
  • 2.16.202.112
  • 95.101.54.216
  • 95.101.54.107
  • 95.101.54.121
  • 95.101.54.139
  • 95.101.54.202
  • 95.101.54.112
  • 95.101.54.105
whitelisted
suckmydick.com
  • 185.53.177.31
malicious
www.bing.com
  • 2.23.209.149
  • 2.23.209.187
  • 2.23.209.140
  • 2.23.209.182
  • 2.23.209.185
  • 2.23.209.189
  • 2.23.209.130
  • 2.23.209.179
  • 2.23.209.133
  • 104.126.37.131
  • 104.126.37.161
  • 104.126.37.130
  • 104.126.37.128
  • 104.126.37.145
  • 104.126.37.185
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
client.wns.windows.com
  • 40.115.3.253
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.160.22
  • 20.190.160.20
  • 40.126.32.76
  • 20.190.160.17
  • 40.126.32.72
  • 40.126.32.136
  • 40.126.32.138
  • 40.126.32.134
whitelisted

Threats

PID
Process
Class
Message
2256
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ipinfo .io)
6296
try.exe
Device Retrieving External IP Address Detected
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
6296
try.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup SSL Cert Observed (ipinfo .io)
6296
try.exe
Device Retrieving External IP Address Detected
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
6296
try.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup SSL Cert Observed (ipinfo .io)
6296
try.exe
A Network Trojan was detected
ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt) M2
6296
try.exe
A Network Trojan was detected
ET MALWARE Suspicious Zipped Filename in Outbound POST Request (passwords.txt) M2
6296
try.exe
A Network Trojan was detected
ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
2256
svchost.exe
Misc activity
SUSPICIOUS [ANY.RUN] Possible sending an external IP address to Telegram
2256
svchost.exe
Misc activity
ET HUNTING Telegram API Domain in DNS Lookup
6 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
try.exe