File name:

a8571d791170f7c0aa913fbc99b1ce38057cc9ee439a6f621f5baf0f85e170e0

Full analysis: https://app.any.run/tasks/7df1ab95-08b0-4d35-b85b-954bca809f21
Verdict: Malicious activity
Analysis date: April 29, 2025, 09:52:31
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

11D18AB36B9DD7092A491EE1DFEE88D4

SHA1:

762B90FE8AB2D30DC9BDEC82B94C5AAD21548642

SHA256:

A8571D791170F7C0AA913FBC99B1CE38057CC9EE439A6F621F5BAF0F85E170E0

SSDEEP:

24576:pjPIZEHewQYaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaag:pjPIZwewQY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • a8571d791170f7c0aa913fbc99b1ce38057cc9ee439a6f621f5baf0f85e170e0.exe (PID: 6044)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • a8571d791170f7c0aa913fbc99b1ce38057cc9ee439a6f621f5baf0f85e170e0.exe (PID: 6044)

    • Executable content was dropped or overwritten

      • a8571d791170f7c0aa913fbc99b1ce38057cc9ee439a6f621f5baf0f85e170e0.exe (PID: 6044)

    • Executes application which crashes

      • a8571d791170f7c0aa913fbc99b1ce38057cc9ee439a6f621f5baf0f85e170e0.exe (PID: 6044)
      • reqngtyi.exe (PID: 7500)

    • Detected use of alternative data streams (AltDS)

      • svchost.exe (PID: 7788)

    • Connects to SMTP port

      • svchost.exe (PID: 7788)

  • INFO

    • Checks supported languages

      • a8571d791170f7c0aa913fbc99b1ce38057cc9ee439a6f621f5baf0f85e170e0.exe (PID: 6044)
      • reqngtyi.exe (PID: 7500)

    • The sample compiled with chinese language support

      • a8571d791170f7c0aa913fbc99b1ce38057cc9ee439a6f621f5baf0f85e170e0.exe (PID: 6044)

    • Reads the computer name

      • a8571d791170f7c0aa913fbc99b1ce38057cc9ee439a6f621f5baf0f85e170e0.exe (PID: 6044)
      • reqngtyi.exe (PID: 7500)

    • Create files in a temporary directory

      • a8571d791170f7c0aa913fbc99b1ce38057cc9ee439a6f621f5baf0f85e170e0.exe (PID: 6044)

    • Process checks computer location settings

      • a8571d791170f7c0aa913fbc99b1ce38057cc9ee439a6f621f5baf0f85e170e0.exe (PID: 6044)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:09:28 00:22:05+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 57344
InitializedDataSize: 23682048
UninitializedDataSize: -
EntryPoint: 0x1d3d
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.2.5.1
ProductVersionNumber: 1.9.0.1
FileFlagsMask: 0x006f
FileFlags: Private build
FileOS: Unknown (0x40314)
ObjectFileType: Static library
FileSubtype: 49
LanguageCode: Chinese (Simplified)
CharacterSet: Unknown (05B0)
FileVersion: 1.0.0.1
InternalName: amizepik.im
Copyright: Copyright (C) 2020, kozosh
ProductVersion: 1.7.21
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
9
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start a8571d791170f7c0aa913fbc99b1ce38057cc9ee439a6f621f5baf0f85e170e0.exe sppextcomobj.exe no specs slui.exe no specs wusa.exe no specs wusa.exe reqngtyi.exe werfault.exe no specs svchost.exe werfault.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
728C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
4000"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6044"C:\Users\admin\AppData\Local\Temp\a8571d791170f7c0aa913fbc99b1ce38057cc9ee439a6f621f5baf0f85e170e0.exe" C:\Users\admin\AppData\Local\Temp\a8571d791170f7c0aa913fbc99b1ce38057cc9ee439a6f621f5baf0f85e170e0.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\temp\a8571d791170f7c0aa913fbc99b1ce38057cc9ee439a6f621f5baf0f85e170e0.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
7364"C:\Windows\System32\wusa.exe" C:\Windows\SysWOW64\wusa.exe—a8571d791170f7c0aa913fbc99b1ce38057cc9ee439a6f621f5baf0f85e170e0.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Update Standalone Installer
Exit code:
3221226540
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wusa.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7460"C:\WINDOWS\SysWOW64\wusa.exe" C:\Windows\SysWOW64\wusa.exe
a8571d791170f7c0aa913fbc99b1ce38057cc9ee439a6f621f5baf0f85e170e0.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Update Standalone Installer
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wusa.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7500"C:\Users\admin\reqngtyi.exe" /d"C:\Users\admin\AppData\Local\Temp\a8571d791170f7c0aa913fbc99b1ce38057cc9ee439a6f621f5baf0f85e170e0.exe" /e550302100000007FC:\Users\admin\reqngtyi.exe
a8571d791170f7c0aa913fbc99b1ce38057cc9ee439a6f621f5baf0f85e170e0.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\reqngtyi.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
7572C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6044 -s 752C:\Windows\SysWOW64\WerFault.exe—a8571d791170f7c0aa913fbc99b1ce38057cc9ee439a6f621f5baf0f85e170e0.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
7788svchost.exeC:\Windows\SysWOW64\svchost.exe
reqngtyi.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
7836C:\WINDOWS\SysWOW64\WerFault.exe -u -p 7500 -s 584C:\Windows\SysWOW64\WerFault.exe—reqngtyi.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
1 408
Read events
1 407
Write events
1
Delete events
0

Modification events

(PID) Process:(6044) a8571d791170f7c0aa913fbc99b1ce38057cc9ee439a6f621f5baf0f85e170e0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:opyxnzri
Value:
"C:\Users\admin\reqngtyi.exe"
Executable files
2
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6044a8571d791170f7c0aa913fbc99b1ce38057cc9ee439a6f621f5baf0f85e170e0.exeC:\Users\admin\AppData\Local\Temp\auulwfwy.exeexecutable
MD5:D225C98A55A799726C2E8A58AA90B7EF
SHA256:40B1FBB8A4BE8597382C761137D8B65CEC779D697B1C2E1B78904AEBF078D557
6044a8571d791170f7c0aa913fbc99b1ce38057cc9ee439a6f621f5baf0f85e170e0.exeC:\Users\admin\reqngtyi.exeexecutable
MD5:336B558B53AFCB66CBC1D6BB74D0023E
SHA256:A836143B60A5FE74F357B021E71EF1022E3A67FC570A78CF3CE8FB9F29B79BEA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
24
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.164.106:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7976
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7976
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
2.16.164.106:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7788
svchost.exe
13.107.246.59:80
microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7788
svchost.exe
52.101.41.4:25
microsoft-com.mail.protection.outlook.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.142
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 2.16.164.106
  • 2.16.164.49
  • 2.16.164.43
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.31.0
  • 40.126.31.71
  • 20.190.159.130
  • 20.190.159.73
  • 40.126.31.131
  • 40.126.31.130
  • 20.190.159.75
  • 20.190.159.4
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
microsoft.com
  • 13.107.246.59
whitelisted
microsoft-com.mail.protection.outlook.com
  • 52.101.41.4
  • 52.101.41.180
  • 52.101.8.51
  • 52.101.40.2
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
a8571d791170f7c0aa913fbc99b1ce38057cc9ee439a6f621f5baf0f85e170e0