File name:

HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.7z

Full analysis: https://app.any.run/tasks/40cdf4b9-ce99-4f43-bb2c-d9587d20bbdb
Verdict: Malicious activity
Analysis date: March 14, 2025, 17:28:51
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
discord
autorun-reg
netreactor
autorun-sched
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

929617B933957ABF1571F8A6EF25D0C5

SHA1:

51EC47C60C848607464ED66EEA2B24CBB125A732

SHA256:

A4410880A2BA9CD6905579DB56666025859470E3DE6A896DA6BF191B734A84E7

SSDEEP:

49152:izrXYKdA7u2f2VVME1n5Tc0qEMoYbRTDK/A7Pdh7KiCM3kbvEeNl51wfaE5syQK6:iPldA7u1/ME1habR/bdEHHbvEGlXE5s5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6516)

    • Changes the autorun value in the registry

      • HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exe (PID: 7624)
      • HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exe (PID: 5512)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 1012)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exe (PID: 7624)
      • Treuochczasjrikixaclp.exe (PID: 4620)
      • HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exe (PID: 5512)

    • Reads the date of Windows installation

      • HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exe (PID: 7624)
      • HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exe (PID: 5512)

    • The process executes VB scripts

      • HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exe (PID: 7624)

    • Reads security settings of Internet Explorer

      • HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exe (PID: 7624)
      • HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exe (PID: 5512)

    • Starts itself from another location

      • HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exe (PID: 7624)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 5156)

    • Starts CMD.EXE for commands execution

      • Treuochczasjrikixaclp.exe (PID: 4620)

    • Connects to unusual port

      • HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exe (PID: 5512)

    • Starts POWERSHELL.EXE for commands execution

      • HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exe (PID: 5512)

  • INFO

    • Checks supported languages

      • HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exe (PID: 7624)
      • Treuochczasjrikixaclp.exe (PID: 4620)

    • Manual execution by a user

      • HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exe (PID: 7624)

    • Create files in a temporary directory

      • HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exe (PID: 7624)

    • Process checks computer location settings

      • HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exe (PID: 7624)

    • Reads the machine GUID from the registry

      • HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exe (PID: 7624)
      • HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exe (PID: 5512)

    • Reads the computer name

      • HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exe (PID: 7624)
      • Treuochczasjrikixaclp.exe (PID: 4620)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6516)

    • Creates files or folders in the user directory

      • HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exe (PID: 7624)
      • HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exe (PID: 5512)
      • Treuochczasjrikixaclp.exe (PID: 4620)

    • Autorun file from Registry key

      • HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exe (PID: 7624)
      • HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exe (PID: 5512)

    • Reads mouse settings

      • Treuochczasjrikixaclp.exe (PID: 4620)

    • .NET Reactor protector has been detected

      • HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exe (PID: 5512)

    • Reads the software policy settings

      • Treuochczasjrikixaclp.exe (PID: 4620)

    • Autorun file from Task Scheduler

      • cmd.exe (PID: 1012)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
ModifyDate: 2021:10:26 12:05:34+00:00
ArchivedFileName: HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
14
Malicious processes
1
Suspicious processes
4

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe heur-trojan.win32.generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exe wscript.exe no specs heur-trojan.win32.generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exe treuochczasjrikixaclp.exe powershell.exe no specs conhost.exe no specs slui.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1012C:\WINDOWS\system32\cmd.exe /C SCHTASKS /CREATE /SC minute /MO 5 /TN "adminWIN_10" /TR "C:\Users\admin\AppData\Roaming\adminWIN_10\adminWIN_10.exe" /F & SCHTASKS /CREATE /SC onstart /TN "adminWIN_10 SubSystem" /TR "C:\Users\admin\AppData\Roaming\adminWIN_10\adminWIN_10.exe" /FC:\Windows\SysWOW64\cmd.exe—Treuochczasjrikixaclp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2392"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3096"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection www.google.comC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
4620"C:\Users\admin\AppData\Local\Temp\Treuochczasjrikixaclp.exe" C:\Users\admin\AppData\Local\Temp\Treuochczasjrikixaclp.exe
wscript.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\appdata\local\temp\treuochczasjrikixaclp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
5116\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5156"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Vyamwdybxthxan.vbs" C:\Windows\System32\wscript.exe—HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
5436\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5512C:\Users\admin\AppData\Local\Temp\HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exeC:\Users\admin\AppData\Local\Temp\HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exe
HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
HIGH
Description:
Java Update Checker
Version:
2.8.51.16
Modules
Images
c:\users\admin\appdata\local\temp\heur-trojan.win32.generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6516"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.7zC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7152C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
10 303
Read events
10 280
Write events
23
Delete events
0

Modification events

(PID) Process:(6516) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6516) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6516) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6516) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.7z
(PID) Process:(6516) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6516) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6516) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6516) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6516) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(6516) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF3D0000002D000000FD03000016020000
Executable files
6
Suspicious files
1
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
3096powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_45jptufe.yzu.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7624HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exeC:\Users\admin\AppData\Local\Temp\HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exeexecutable
MD5:4A2FA223B1F54A8623E1A531CD32A632
SHA256:DA0B39D25BF7347C7477473F1CA89451F7AF37F0CE3FA9B15899D848F3BED182
7624HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google\Chrome.exeexecutable
MD5:4A2FA223B1F54A8623E1A531CD32A632
SHA256:DA0B39D25BF7347C7477473F1CA89451F7AF37F0CE3FA9B15899D848F3BED182
6516WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb6516.14988\HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exeexecutable
MD5:4A2FA223B1F54A8623E1A531CD32A632
SHA256:DA0B39D25BF7347C7477473F1CA89451F7AF37F0CE3FA9B15899D848F3BED182
7624HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exeC:\Users\admin\AppData\Local\Temp\Treuochczasjrikixaclp.exeexecutable
MD5:DB9A97AA29FF479309B9FBB5A9301DAA
SHA256:355303002CEC0DA439DAC8199D75B21E7D57EB0C32D374F9176779ADB1703845
3096powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_qjaoliny.j2p.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
5512HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google\HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.vbstext
MD5:86B8B3634FC20599E757FD34900A1BA0
SHA256:C3682FB0BE3C4DDD28EC1A266CEAB4151589C2C3B2233B8E760E379E57C342AD
7624HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.exeC:\Users\admin\AppData\Local\Temp\Vyamwdybxthxan.vbstext
MD5:F46FA61C1B8814A189E656AFA6D84CA6
SHA256:2F7C5150CC9C73BA2DD21C141FF6E76DB82765A1690F27EA7465D582B38FC8BB
3096powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:61C9627F70F64EEC6498FEAFAC3EF7DC
SHA256:F03A9E52235D5B3CCF280BA583B7CE4E47DE9859E60A2B2AE128A74FC02C89F8
4620Treuochczasjrikixaclp.exeC:\Users\admin\AppData\Roaming\adminWIN_10\adminWIN_10.exeexecutable
MD5:DB9A97AA29FF479309B9FBB5A9301DAA
SHA256:355303002CEC0DA439DAC8199D75B21E7D57EB0C32D374F9176779ADB1703845
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
27
DNS requests
19
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
62.115.253.10:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
62.115.253.10:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.16.38.4:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7808
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7808
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4988
backgroundTaskHost.exe
GET
200
2.16.38.4:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
62.115.253.10:80
crl.microsoft.com
Telia Company AB
ES
whitelisted
—
—
62.115.253.10:80
crl.microsoft.com
Telia Company AB
ES
whitelisted
6544
svchost.exe
40.126.32.138:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.16.38.4:80
ocsp.digicert.com
AKAMAI-AS
ES
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
google.com
  • 142.250.185.206
whitelisted
crl.microsoft.com
  • 62.115.253.10
  • 62.115.253.40
whitelisted
login.live.com
  • 40.126.32.138
  • 20.190.160.131
  • 40.126.32.68
  • 40.126.32.134
  • 20.190.160.20
  • 20.190.160.3
  • 20.190.160.5
  • 20.190.160.22
whitelisted
ocsp.digicert.com
  • 2.16.38.4
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
4620
Treuochczasjrikixaclp.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
2196
svchost.exe
Misc activity
ET INFO Discord Chat Service Domain in DNS Lookup (discord .com)
4620
Treuochczasjrikixaclp.exe
Misc activity
ET INFO Observed Discord Service Domain (discord .com) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HEUR-Trojan.Win32.Generic-da0b39d25bf7347c7477473f1ca89451f7af37f0ce3fa9b15899d848f3bed182.7z