File name:

NewTextDocument.bin.exe

Full analysis: https://app.any.run/tasks/c2dfbc7f-f129-49ed-97eb-6c99b8788310
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: May 19, 2025, 01:11:09
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
generic
loader
screenconnect
remote
rat
asyncrat
proxyware
ghostsocks
evasion
miner
hausbomber
github
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

0B0D247AA1F24C2F5867B3BF29F69450

SHA1:

48DE9F34226FD7F637E2379365BE035AF5C0DF1A

SHA256:

A6E7292E734C3A15CFA654BBA8DEA72A2F55F1C24CF6BBDC2FD7E63887E9315A

SSDEEP:

12288:dcgCzNHJj96xfKJStJkRm3bYXob0AnmFMcaGQxkZVVVVVVVVVAtVVVUvqGV:UQKgLIQmFuGQxklvqO

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GENERIC has been found (auto)

      • NewTextDocument.bin.exe (PID: 7496)

    • Known privilege escalation attack

      • dllhost.exe (PID: 5552)

    • Changes Windows Defender settings

      • WinTemp-v4.exe (PID: 7172)

    • Adds process to the Windows Defender exclusion list

      • WinTemp-v4.exe (PID: 7172)

    • Create files in the Startup directory

      • ckjg.exe (PID: 5064)
      • cbot.exe (PID: 1328)
      • cbot_debug.exe (PID: 6244)
      • raw_cbot.exe (PID: 2984)
      • raw_cbot_debug.exe (PID: 5400)

    • HAUSBOMBER has been detected (YARA)

      • New Text Document.exe (PID: 7488)

    • GHOSTSOCKS has been found (auto)

      • New Text Document.exe (PID: 7488)

    • Changes the autorun value in the registry

      • Quodlibet.exe (PID: 7956)
      • WinTemp-v4.exe (PID: 7172)

    • ASYNCRAT has been detected (SURICATA)

      • ckjg.exe (PID: 5064)

    • SCREENCONNECT has been detected (SURICATA)

      • ScreenConnect.WindowsClient.exe (PID: 7992)

    • Uses Task Scheduler to autorun other applications

      • WinTemp-v4.exe (PID: 7172)

    • Starts REAGENTC.EXE to disable the Windows Recovery Environment

      • ReAgentc.exe (PID: 4164)

    • Connects to the CnC server

      • cmd.exe (PID: 7432)
      • svchost.exe (PID: 2196)

    • MINER has been detected (SURICATA)

      • cmd.exe (PID: 7432)

    • Executing a file with an untrusted certificate

      • Supawn.exe (PID: 5360)
      • inferno.exe (PID: 3176)
      • Nationalbankdirektrernes.exe (PID: 7936)
      • CompoundsTrim.exe (PID: 4012)
      • 123123213.exe (PID: 8180)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2196)
      • MSBuild.exe (PID: 8028)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • NewTextDocument.bin.exe (PID: 7496)
      • NewTextDocument.bin.exe (PID: 7388)

    • There is functionality for taking screenshot (YARA)

      • NewTextDocument.bin.exe (PID: 7496)

    • Reads security settings of Internet Explorer

      • NewTextDocument.bin.exe (PID: 7496)
      • NewTextDocument.bin.exe (PID: 7388)
      • New Text Document.exe (PID: 7488)
      • dfsvc.exe (PID: 6872)

    • Reads Internet Explorer settings

      • NewTextDocument.bin.exe (PID: 7496)
      • NewTextDocument.bin.exe (PID: 7388)
      • dfsvc.exe (PID: 6872)

    • Reads the date of Windows installation

      • New Text Document.exe (PID: 7488)
      • dfsvc.exe (PID: 6872)

    • Connects to unusual port

      • New Text Document.exe (PID: 7488)
      • raw_cbot_debug.exe (PID: 5400)
      • cbot_debug.exe (PID: 6244)
      • raw_cbot.exe (PID: 2984)
      • cbot.exe (PID: 1328)
      • ckjg.exe (PID: 5064)
      • ScreenConnect.WindowsClient.exe (PID: 7992)
      • Quodlibet.exe (PID: 7956)
      • WinTemp-v4.exe (PID: 7172)
      • cmd.exe (PID: 7432)

    • Process requests binary or script from the Internet

      • New Text Document.exe (PID: 7488)
      • New Text Document.exe (PID: 7980)
      • New Text Document.exe (PID: 7144)
      • New Text Document.exe (PID: 7868)
      • New Text Document.exe (PID: 6192)
      • New Text Document.exe (PID: 3156)

    • Executable content was dropped or overwritten

      • New Text Document.exe (PID: 7488)
      • NewTextDocument.bin.exe (PID: 7388)
      • oxDU0MW.exe (PID: 1180)
      • dfsvc.exe (PID: 6872)
      • cbot.exe (PID: 1328)
      • cbot_debug.exe (PID: 6244)
      • raw_cbot.exe (PID: 2984)
      • raw_cbot_debug.exe (PID: 5400)
      • Quodlibet.exe (PID: 7956)
      • WinTemp-v4.exe (PID: 7172)
      • New Text Document.exe (PID: 7980)
      • Supawn.exe (PID: 5360)
      • New Text Document.exe (PID: 7144)
      • New Text Document.exe (PID: 7764)
      • New Text Document.exe (PID: 6192)
      • Slasher.exe (PID: 7996)
      • New Text Document.exe (PID: 6048)
      • Nationalbankdirektrernes.exe (PID: 7936)
      • New Text Document.exe (PID: 7868)

    • Adds/modifies Windows certificates

      • work_approval_pdf3.Client.exe (PID: 5116)
      • dfsvc.exe (PID: 6872)

    • Potential Corporate Privacy Violation

      • New Text Document.exe (PID: 7488)
      • ScreenConnect.WindowsClient.exe (PID: 7992)
      • cmd.exe (PID: 7432)
      • New Text Document.exe (PID: 7868)
      • New Text Document.exe (PID: 3156)
      • New Text Document.exe (PID: 6192)
      • New Text Document.exe (PID: 7144)
      • New Text Document.exe (PID: 7980)

    • Connects to the server without a host name

      • New Text Document.exe (PID: 7488)
      • New Text Document.exe (PID: 7868)
      • New Text Document.exe (PID: 7144)
      • New Text Document.exe (PID: 6192)
      • New Text Document.exe (PID: 7980)
      • New Text Document.exe (PID: 3156)

    • Script adds exclusion process to Windows Defender

      • WinTemp-v4.exe (PID: 7172)

    • Starts POWERSHELL.EXE for commands execution

      • WinTemp-v4.exe (PID: 7172)

    • Executes application which crashes

      • TiWorker.exe (PID: 1020)
      • alphamm.exe (PID: 5072)
      • kjoxca.exe (PID: 7516)

    • The process creates files with name similar to system file names

      • dfsvc.exe (PID: 6872)

    • Process drops legitimate windows executable

      • New Text Document.exe (PID: 7488)
      • cbot.exe (PID: 1328)
      • cbot_debug.exe (PID: 6244)
      • raw_cbot.exe (PID: 2984)
      • raw_cbot_debug.exe (PID: 5400)

    • Starts a Microsoft application from unusual location

      • cbot_debug.exe (PID: 6244)
      • cbot.exe (PID: 1328)
      • raw_cbot.exe (PID: 2984)
      • raw_cbot_debug.exe (PID: 5400)
      • inferno.exe (PID: 3176)
      • 123123213.exe (PID: 8180)

    • Script adds exclusion path to Windows Defender

      • WinTemp-v4.exe (PID: 7172)

    • Contacting a server suspected of hosting an CnC

      • ckjg.exe (PID: 5064)
      • svchost.exe (PID: 2196)
      • MSBuild.exe (PID: 8028)

    • Uses WMIC.EXE to obtain computer system information

      • ckjg.exe (PID: 5064)

    • Accesses domain name via WMI (SCRIPT)

      • WMIC.exe (PID: 6828)

    • Starts CMD.EXE for commands execution

      • WinTemp-v4.exe (PID: 7172)
      • CompoundsTrim.exe (PID: 4012)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • WinTemp-v4.exe (PID: 7172)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 7932)
      • cmd.exe (PID: 7464)

    • Uses powercfg.exe to modify the power settings

      • WinTemp-v4.exe (PID: 7172)

    • Takes ownership (TAKEOWN.EXE)

      • cmd.exe (PID: 4228)

    • Hides command output

      • cmd.exe (PID: 5324)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Supawn.exe (PID: 5360)
      • Nationalbankdirektrernes.exe (PID: 7936)

    • Executing commands from a ".bat" file

      • CompoundsTrim.exe (PID: 4012)

  • INFO

    • Checks supported languages

      • NewTextDocument.bin.exe (PID: 7496)
      • NewTextDocument.bin.exe (PID: 7388)
      • work_approval_pdf3.Client.exe (PID: 5116)
      • New Text Document.exe (PID: 7488)
      • ckjg.exe (PID: 5064)
      • TiWorker.exe (PID: 1020)
      • dfsvc.exe (PID: 6872)
      • oxDU0MW.exe (PID: 1180)
      • WinTemp-v4.exe (PID: 7172)
      • ScreenConnect.WindowsClient.exe (PID: 7992)
      • Quodlibet.exe (PID: 7956)
      • cbot_debug.exe (PID: 6244)
      • widsmob_denoise_win.exe (PID: 7780)
      • cbot.exe (PID: 1328)
      • raw_cbot.exe (PID: 2984)
      • raw_cbot_debug.exe (PID: 5400)

    • Checks proxy server information

      • NewTextDocument.bin.exe (PID: 7496)
      • NewTextDocument.bin.exe (PID: 7388)
      • New Text Document.exe (PID: 7488)
      • dfsvc.exe (PID: 6872)
      • ScreenConnect.WindowsClient.exe (PID: 7992)

    • Reads the computer name

      • NewTextDocument.bin.exe (PID: 7496)
      • NewTextDocument.bin.exe (PID: 7388)
      • work_approval_pdf3.Client.exe (PID: 5116)
      • New Text Document.exe (PID: 7488)
      • dfsvc.exe (PID: 6872)
      • ckjg.exe (PID: 5064)
      • oxDU0MW.exe (PID: 1180)
      • ScreenConnect.WindowsClient.exe (PID: 7992)

    • Manual execution by a user

      • NewTextDocument.bin.exe (PID: 7388)
      • New Text Document.exe (PID: 7488)
      • NewTextDocument.bin.exe (PID: 2320)
      • New Text Document.exe (PID: 6192)
      • NewTextDocument.bin.exe (PID: 7740)
      • New Text Document.exe (PID: 7980)
      • New Text Document.exe (PID: 7868)
      • New Text Document.exe (PID: 7764)
      • New Text Document.exe (PID: 5720)
      • New Text Document.exe (PID: 7144)
      • New Text Document.exe (PID: 3156)
      • New Text Document.exe (PID: 6048)
      • New Text Document.exe (PID: 7292)

    • Disables trace logs

      • New Text Document.exe (PID: 7488)
      • dfsvc.exe (PID: 6872)
      • ScreenConnect.WindowsClient.exe (PID: 7992)

    • Reads Environment values

      • New Text Document.exe (PID: 7488)
      • dfsvc.exe (PID: 6872)
      • ckjg.exe (PID: 5064)
      • ScreenConnect.WindowsClient.exe (PID: 7992)

    • Reads the software policy settings

      • New Text Document.exe (PID: 7488)
      • dfsvc.exe (PID: 6872)
      • slui.exe (PID: 7632)
      • ckjg.exe (PID: 5064)

    • Process checks computer location settings

      • New Text Document.exe (PID: 7488)
      • dfsvc.exe (PID: 6872)

    • Reads the machine GUID from the registry

      • work_approval_pdf3.Client.exe (PID: 5116)
      • New Text Document.exe (PID: 7488)
      • dfsvc.exe (PID: 6872)
      • ckjg.exe (PID: 5064)
      • oxDU0MW.exe (PID: 1180)
      • ScreenConnect.WindowsClient.exe (PID: 7992)
      • cbot_debug.exe (PID: 6244)
      • cbot.exe (PID: 1328)
      • raw_cbot.exe (PID: 2984)
      • raw_cbot_debug.exe (PID: 5400)

    • Creates files or folders in the user directory

      • dfsvc.exe (PID: 6872)
      • ckjg.exe (PID: 5064)
      • WerFault.exe (PID: 7936)
      • cbot.exe (PID: 1328)
      • ScreenConnect.WindowsClient.exe (PID: 7992)
      • cbot_debug.exe (PID: 6244)
      • raw_cbot.exe (PID: 2984)
      • raw_cbot_debug.exe (PID: 5400)
      • Quodlibet.exe (PID: 7956)
      • WinTemp-v4.exe (PID: 7172)

    • Create files in a temporary directory

      • dfsvc.exe (PID: 6872)
      • TiWorker.exe (PID: 1020)
      • oxDU0MW.exe (PID: 1180)
      • Quodlibet.exe (PID: 7956)

    • Process checks whether UAC notifications are on

      • dfsvc.exe (PID: 6872)

    • The sample compiled with english language support

      • New Text Document.exe (PID: 7488)
      • cbot.exe (PID: 1328)
      • cbot_debug.exe (PID: 6244)
      • raw_cbot.exe (PID: 2984)
      • Quodlibet.exe (PID: 7956)
      • raw_cbot_debug.exe (PID: 5400)
      • New Text Document.exe (PID: 3156)
      • New Text Document.exe (PID: 7868)
      • New Text Document.exe (PID: 7144)
      • New Text Document.exe (PID: 7980)

    • Reads mouse settings

      • TiWorker.exe (PID: 1020)

    • Checks transactions between databases Windows and Oracle

      • oxDU0MW.exe (PID: 1180)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 5552)
      • WMIC.exe (PID: 6828)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7212)
      • powershell.exe (PID: 7516)
      • powershell.exe (PID: 1132)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7212)
      • powershell.exe (PID: 1132)
      • powershell.exe (PID: 7516)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:10:03 07:51:19+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.33
CodeSize: 214528
InitializedDataSize: 119296
UninitializedDataSize: -
EntryPoint: 0x21d50
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
250
Monitored processes
112
Malicious processes
25
Suspicious processes
5

Behavior graph

Click at the process to see the details
start newtextdocument.bin.exe no specs sppextcomobj.exe no specs slui.exe newtextdocument.bin.exe #GHOSTSOCKS new text document.exe conhost.exe no specs work_approval_pdf3.client.exe no specs dfsvc.exe #ASYNCRAT ckjg.exe tiworker.exe oxdu0mw.exe CMSTPLUA svchost.exe no specs wintemp-v4.exe powershell.exe no specs conhost.exe no specs quodlibet.exe werfault.exe no specs #SCREENCONNECT screenconnect.windowsclient.exe widsmob_denoise_win.exe no specs cbot_debug.exe conhost.exe no specs cbot.exe raw_cbot_debug.exe conhost.exe no specs raw_cbot.exe powershell.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reagentc.exe no specs cmd.exe no specs conhost.exe no specs takeown.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs slui.exe no specs ping.exe no specs #MINER cmd.exe newtextdocument.bin.exe no specs newtextdocument.bin.exe no specs bitlockertogo.exe new text document.exe new text document.exe new text document.exe new text document.exe conhost.exe no specs conhost.exe no specs new text document.exe new text document.exe conhost.exe no specs new text document.exe conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs alphamm.exe emmmmmmslay.exe kjoxca.exe supawn.exe slasher.exe svchost.exe no specs svchost.exe no specs new text document.exe werfault.exe no specs werfault.exe no specs conhost.exe no specs new text document.exe conhost.exe no specs inferno.exe no specs redfireexternal.exe no specs wscript.exe no specs nationalbankdirektrernes.exe compoundstrim.exe no specs #LUMMA msbuild.exe sgsdg.exe redfireexternal.exe 123123213.exe no specs redfire.external.exe no specs support.clientsetup.exe no specs msbuild.exe no specs cmd.exe no specs conhost.exe no specs redfire.external.exe support.clientsetup.exe #LUMMA svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
728\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—New Text Document.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1020"C:\Users\admin\Desktop\a\TiWorker.exe" C:\Users\admin\Desktop\a\TiWorker.exe
New Text Document.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\desktop\a\tiworker.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
1096\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—New Text Document.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1132powershell -Command "Add-MpPreference -ExclusionProcess 'cmd.exe'; Add-MpPreference -ExclusionPath 'C:\'"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—WinTemp-v4.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\atl.dll
c:\windows\system32\ucrtbase.dll
1180"C:\Users\admin\Desktop\a\oxDU0MW.exe" C:\Users\admin\Desktop\a\oxDU0MW.exe
New Text Document.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\a\oxdu0mw.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1180C:\WINDOWS\SysWOW64\WerFault.exe -u -p 5072 -s 640C:\Windows\SysWOW64\WerFault.exe—alphamm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1196\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—New Text Document.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1328"C:\Users\admin\Desktop\a\cbot.exe" C:\Users\admin\Desktop\a\cbot.exe
New Text Document.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
1.2.0.0
Modules
Images
c:\users\admin\desktop\a\cbot.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1560"C:\Users\admin\Desktop\a\RedFireEXTERNAL.exe" C:\Users\admin\Desktop\a\RedFireEXTERNAL.exe—New Text Document.exe
User:
admin
Company:
Esx Cheats
Integrity Level:
MEDIUM
Description:
Esx Cheats
Exit code:
3221226540
Version:
31.31.31.31
Modules
Images
c:\users\admin\desktop\a\redfireexternal.exe
c:\windows\system32\ntdll.dll
1672"C:\Users\admin\Desktop\a\alphamm.exe" C:\Windows\SysWOW64\svchost.exe—alphamm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Total events
72 325
Read events
71 311
Write events
924
Delete events
90

Modification events

(PID) Process:(7496) NewTextDocument.bin.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7496) NewTextDocument.bin.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7496) NewTextDocument.bin.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7496) NewTextDocument.bin.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\LowRegistry
Operation:delete valueName:AddToFavoritesInitialSelection
Value:
(PID) Process:(7496) NewTextDocument.bin.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\LowRegistry
Operation:delete valueName:AddToFeedsInitialSelection
Value:
(PID) Process:(7388) NewTextDocument.bin.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7388) NewTextDocument.bin.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7388) NewTextDocument.bin.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7388) NewTextDocument.bin.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\LowRegistry
Operation:delete valueName:AddToFavoritesInitialSelection
Value:
(PID) Process:(7388) NewTextDocument.bin.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\LowRegistry
Operation:delete valueName:AddToFeedsInitialSelection
Value:
Executable files
64
Suspicious files
62
Text files
70
Unknown types
1

Dropped files

PID
Process
Filename
Type
6872dfsvc.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141binary
MD5:C7D00759503E0F506C5775FF24789A3B
SHA256:94FC525025F316570F4FF2F43C72D5180D17FD4EA8FC8DBB2B6F06A52378BF91
7488New Text Document.exeC:\Users\admin\Desktop\a\work_approval_pdf3.Client.exeexecutable
MD5:B6B1C343F11CD79788320A048D66D09F
SHA256:ABDB5AB588FB23C2F7B2F813F5CDB0BF29BF1411FEE95EB5E2C26E790BA42C87
6872dfsvc.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_BE4413523710330F97BEE5D4A544C42Bbinary
MD5:CF36558ACD3293F290195EEE9868F94A
SHA256:5A1A90B41FDF55D603B283EC7A1ABBB8E82D4D0D02ECE0E6F09F58F66FE19EC8
6872dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\AWZW4TAN.6A2\7ZN34LDL.AL7.applicationxml
MD5:DA69D38B0DCF29670D4601D8565E6833
SHA256:D1BE7F3014B3804D836E04308D831E7AB31EDEE627643A926D45224B66FC194B
7488New Text Document.exeC:\Users\admin\Desktop\a\02.08.2022.exebinary
MD5:11B995FDD90C8FEC88D27BC7283C82BA
SHA256:D0EDEFBF92FE890890E3D26ABED57FB3CB02277348C7922442C542F67D57E50B
6872dfsvc.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_BE4413523710330F97BEE5D4A544C42Bbinary
MD5:45AF105471E4B4CA222EF586E66BC6B3
SHA256:0F5F5B53F338DD0AB3020C3E6FC4155AF94E7037E5174595D04E61F8B4FD47D9
6872dfsvc.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1693682860-607145093-2874071422-1001\932a2db58c237abd381d22df4c63a04a_bb926e54-e3ca-40fd-ae90-2764341e7792binary
MD5:D2DED43CE07BFCE4D1C101DFCAA178C8
SHA256:8EEE9284E733B9D4F2E5C43F71B81E27966F5CD8900183EB3BB77A1F1160D050
7488New Text Document.exeC:\Users\admin\Desktop\a\ckjg.exeexecutable
MD5:962D2A0880C5325328930B66BB4E2CF1
SHA256:08037DE4A729634FA818DDF03DDD27C28C89F42158AF5EDE71CF0AE2D78FA198
6872dfsvc.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141binary
MD5:308308A22123BDFE4C862E0FBEAF0DAA
SHA256:3A7A08106979C3A4A0C0D4B886AE4B1120C1923F5685A034DDE95A9A08819DCF
1020TiWorker.exeC:\Users\admin\AppData\Local\Temp\aut6C15.tmpbinary
MD5:24466CEAA754885D3AE569EF821E7103
SHA256:B24A39DB91A037063D1EA2D79E3170C7A5290AB14C2221C1C7B34F6682854589
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
27
TCP/UDP connections
117
DNS requests
34
Threats
79

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6800
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6800
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7488
New Text Document.exe
GET
200
106.75.78.139:33333
http://106.75.78.139:33333/02.08.2022.exe
unknown
—
—
malicious
7488
New Text Document.exe
GET
200
193.46.217.4:80
http://gettsveriff.com/bgj3/ckjg.exe
unknown
—
—
malicious
6872
dfsvc.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.185.206
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.31.130
  • 40.126.31.67
  • 40.126.31.0
  • 40.126.31.1
  • 20.190.159.23
  • 40.126.31.128
  • 20.190.159.130
  • 40.126.31.3
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted
urlhaus.abuse.ch
  • 151.101.130.49
  • 151.101.66.49
  • 151.101.2.49
  • 151.101.194.49
whitelisted

Threats

PID
Process
Class
Message
7488
New Text Document.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7488
New Text Document.exe
Misc activity
ET INFO Observed ZeroSSL SSL/TLS Certificate
6872
dfsvc.exe
Misc activity
ET INFO Observed ZeroSSL SSL/TLS Certificate
7488
New Text Document.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7488
New Text Document.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
7488
New Text Document.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7488
New Text Document.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7488
New Text Document.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
7488
New Text Document.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
7488
New Text Document.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
NewTextDocument.bin.exe