File name:

Sigmanly_ab020413dce53c9d57cf22d75eaf1339d72252d5316617a935149e02fee42fd3

Full analysis: https://app.any.run/tasks/17c725a5-0d3e-48a1-934f-0ecc9de75735
Verdict: Malicious activity
Analysis date: May 15, 2025, 16:17:49
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
MD5:

57AECBCDCB3A5AD31AC07C5A62B56085

SHA1:

A443C574F039828D237030BC18895027CA780337

SHA256:

AB020413DCE53C9D57CF22D75EAF1339D72252D5316617A935149E02FEE42FD3

SSDEEP:

12288:mjGB20Q5YI8Yu8uXG2wafWVmf1r/lGWlGR:mjGB2H5YI8Yu8uXG2wafWVmf9lGWlGR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • reg.exe (PID: 7416)
      • reg.exe (PID: 7584)
      • reg.exe (PID: 8068)
      • reg.exe (PID: 8152)
      • reg.exe (PID: 496)
      • reg.exe (PID: 7952)
      • reg.exe (PID: 5204)
      • reg.exe (PID: 7428)
      • reg.exe (PID: 7788)
      • reg.exe (PID: 7572)
      • reg.exe (PID: 2040)
      • reg.exe (PID: 7716)
      • reg.exe (PID: 1180)
      • reg.exe (PID: 7812)
      • reg.exe (PID: 7996)
      • reg.exe (PID: 7744)
      • reg.exe (PID: 7000)
      • reg.exe (PID: 7084)
      • reg.exe (PID: 4272)
      • reg.exe (PID: 812)
      • reg.exe (PID: 5972)
      • reg.exe (PID: 5244)
      • reg.exe (PID: 7564)
      • reg.exe (PID: 5360)
      • reg.exe (PID: 7272)
      • reg.exe (PID: 3032)
      • reg.exe (PID: 7924)
      • reg.exe (PID: 2984)
      • reg.exe (PID: 2772)
      • reg.exe (PID: 8164)
      • reg.exe (PID: 7372)
      • reg.exe (PID: 7948)
      • reg.exe (PID: 7284)
      • reg.exe (PID: 3620)
      • reg.exe (PID: 6620)
      • reg.exe (PID: 5588)
      • reg.exe (PID: 7152)
      • reg.exe (PID: 5528)
      • reg.exe (PID: 2960)

    • Starts NET.EXE to view/change shared resources

      • net.exe (PID: 5936)
      • net.exe (PID: 1532)
      • net.exe (PID: 6048)
      • cmd.exe (PID: 4200)

  • SUSPICIOUS

    • Starts application from unusual location

      • Sigmanly_ab020413dce53c9d57cf22d75eaf1339d72252d5316617a935149e02fee42fd3.exe (PID: 7276)
      • cmd.exe (PID: 7316)
      • cmd.exe (PID: 7820)
      • smss.exe (PID: 7408)
      • smss.exe (PID: 7744)
      • ipconfig.exe (PID: 7960)
      • PING.EXE (PID: 7340)
      • cmd.exe (PID: 6132)
      • cmd.exe (PID: 8024)
      • PING.EXE (PID: 8092)
      • cmd.exe (PID: 728)
      • PING.EXE (PID: 6136)
      • PING.EXE (PID: 7800)
      • cmd.exe (PID: 7736)
      • PING.EXE (PID: 6048)
      • cmd.exe (PID: 7216)

    • Executable content was dropped or overwritten

      • Sigmanly_ab020413dce53c9d57cf22d75eaf1339d72252d5316617a935149e02fee42fd3.exe (PID: 7276)

    • Creates file in the systems drive root

      • Sigmanly_ab020413dce53c9d57cf22d75eaf1339d72252d5316617a935149e02fee42fd3.exe (PID: 7276)
      • smss.exe (PID: 7744)
      • smss.exe (PID: 7408)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 7296)
      • cmd.exe (PID: 7772)
      • cmd.exe (PID: 7520)
      • cmd.exe (PID: 7764)
      • cmd.exe (PID: 8012)
      • cmd.exe (PID: 8096)
      • cmd.exe (PID: 8180)
      • cmd.exe (PID: 6480)
      • cmd.exe (PID: 7596)
      • cmd.exe (PID: 4164)
      • cmd.exe (PID: 4892)
      • cmd.exe (PID: 2772)
      • cmd.exe (PID: 4112)
      • cmd.exe (PID: 7908)
      • cmd.exe (PID: 6512)
      • cmd.exe (PID: 4068)
      • cmd.exe (PID: 8136)
      • cmd.exe (PID: 4180)
      • cmd.exe (PID: 8180)
      • cmd.exe (PID: 7976)
      • cmd.exe (PID: 7824)
      • cmd.exe (PID: 5508)
      • cmd.exe (PID: 744)
      • cmd.exe (PID: 6156)
      • cmd.exe (PID: 3300)
      • cmd.exe (PID: 7424)
      • cmd.exe (PID: 6584)
      • cmd.exe (PID: 5892)
      • cmd.exe (PID: 3132)
      • cmd.exe (PID: 7304)
      • cmd.exe (PID: 7680)
      • cmd.exe (PID: 7792)
      • cmd.exe (PID: 6652)
      • cmd.exe (PID: 6752)
      • cmd.exe (PID: 7772)
      • cmd.exe (PID: 7824)
      • cmd.exe (PID: 8184)
      • cmd.exe (PID: 3156)
      • cmd.exe (PID: 7896)
      • cmd.exe (PID: 6988)
      • cmd.exe (PID: 536)
      • cmd.exe (PID: 7488)
      • cmd.exe (PID: 6572)
      • cmd.exe (PID: 1184)
      • cmd.exe (PID: 3300)
      • cmd.exe (PID: 5204)

    • Process uses IPCONFIG to get network configuration information

      • cmd.exe (PID: 7820)

    • Starts CMD.EXE for commands execution

      • Sigmanly_ab020413dce53c9d57cf22d75eaf1339d72252d5316617a935149e02fee42fd3.exe (PID: 7276)
      • smss.exe (PID: 7408)
      • smss.exe (PID: 7744)

    • Detected use of alternative data streams (AltDS)

      • smss.exe (PID: 7408)

  • INFO

    • Create files in a temporary directory

      • Sigmanly_ab020413dce53c9d57cf22d75eaf1339d72252d5316617a935149e02fee42fd3.exe (PID: 7276)
      • smss.exe (PID: 7408)
      • smss.exe (PID: 7744)

    • The sample compiled with english language support

      • Sigmanly_ab020413dce53c9d57cf22d75eaf1339d72252d5316617a935149e02fee42fd3.exe (PID: 7276)

    • Checks supported languages

      • Sigmanly_ab020413dce53c9d57cf22d75eaf1339d72252d5316617a935149e02fee42fd3.exe (PID: 7276)
      • smss.exe (PID: 7408)
      • smss.exe (PID: 7744)

    • Reads the computer name

      • Sigmanly_ab020413dce53c9d57cf22d75eaf1339d72252d5316617a935149e02fee42fd3.exe (PID: 7276)
      • smss.exe (PID: 7408)

    • Failed to create an executable file in Windows directory

      • Sigmanly_ab020413dce53c9d57cf22d75eaf1339d72252d5316617a935149e02fee42fd3.exe (PID: 7276)
      • smss.exe (PID: 7408)
      • smss.exe (PID: 7744)

    • Auto-launch of the file from Registry key

      • reg.exe (PID: 7416)
      • reg.exe (PID: 7584)
      • reg.exe (PID: 8068)
      • reg.exe (PID: 8152)
      • reg.exe (PID: 496)
      • reg.exe (PID: 7952)
      • reg.exe (PID: 5204)
      • reg.exe (PID: 7428)
      • reg.exe (PID: 2040)
      • reg.exe (PID: 7812)
      • reg.exe (PID: 7788)
      • reg.exe (PID: 7572)
      • reg.exe (PID: 7716)
      • reg.exe (PID: 7744)
      • reg.exe (PID: 7000)
      • reg.exe (PID: 1180)
      • reg.exe (PID: 7996)
      • reg.exe (PID: 7084)
      • reg.exe (PID: 4272)
      • reg.exe (PID: 812)
      • reg.exe (PID: 7564)
      • reg.exe (PID: 5244)
      • reg.exe (PID: 5972)
      • reg.exe (PID: 7272)
      • reg.exe (PID: 2772)
      • reg.exe (PID: 5360)
      • reg.exe (PID: 2984)
      • reg.exe (PID: 3032)
      • reg.exe (PID: 7924)
      • reg.exe (PID: 8164)
      • reg.exe (PID: 7284)
      • reg.exe (PID: 7372)
      • reg.exe (PID: 7948)
      • reg.exe (PID: 6620)
      • reg.exe (PID: 5588)
      • reg.exe (PID: 7152)
      • reg.exe (PID: 3620)
      • reg.exe (PID: 5528)
      • reg.exe (PID: 2960)

    • Manual execution by a user

      • smss.exe (PID: 7744)

    • Reads the software policy settings

      • slui.exe (PID: 8124)

    • Checks proxy server information

      • slui.exe (PID: 8124)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Microsoft Visual Basic 6 (84.4)
.dll | Win32 Dynamic Link Library (generic) (6.7)
.exe | Win32 Executable (generic) (4.6)
.exe | Generic Win/DOS Executable (2)
.exe | DOS Executable Generic (2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 0000:00:00 00:00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 229376
InitializedDataSize: 16384
UninitializedDataSize: -
EntryPoint: 0x27cc
OSVersion: 4
ImageVersion: 5.5
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 5.5.0.0
ProductVersionNumber: 5.5.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Free Microsoft Games
ProductName: 2009-09-22
FileVersion: 5.05
ProductVersion: 5.05
InternalName: open2
OriginalFileName: open2.exe
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
292
Monitored processes
170
Malicious processes
4
Suspicious processes
45

Behavior graph

Click at the process to see the details
start sigmanly_ab020413dce53c9d57cf22d75eaf1339d72252d5316617a935149e02fee42fd3.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs smss.exe no specs reg.exe cmd.exe no specs conhost.exe no specs reg.exe smss.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs reg.exe no specs reg.exe ipconfig.exe no specs cmd.exe no specs conhost.exe no specs reg.exe cmd.exe no specs conhost.exe no specs reg.exe cmd.exe no specs conhost.exe no specs reg.exe cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs reg.exe no specs net.exe no specs net.exe no specs net.exe no specs net1.exe no specs net1.exe no specs net1.exe no specs cmd.exe no specs conhost.exe no specs reg.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe ping.exe no specs cmd.exe no specs conhost.exe no specs reg.exe cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs reg.exe reg.exe reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe cmd.exe no specs conhost.exe no specs reg.exe cmd.exe no specs conhost.exe no specs reg.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe ping.exe no specs slui.exe cmd.exe no specs conhost.exe no specs reg.exe cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs reg.exe reg.exe no specs reg.exe cmd.exe no specs conhost.exe no specs reg.exe cmd.exe no specs conhost.exe no specs reg.exe cmd.exe no specs conhost.exe no specs reg.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe ping.exe no specs cmd.exe no specs conhost.exe no specs reg.exe cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs reg.exe reg.exe no specs reg.exe cmd.exe no specs conhost.exe no specs reg.exe cmd.exe no specs conhost.exe no specs reg.exe cmd.exe no specs conhost.exe no specs reg.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe ping.exe no specs cmd.exe no specs conhost.exe no specs reg.exe cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe reg.exe cmd.exe no specs conhost.exe no specs reg.exe cmd.exe no specs conhost.exe no specs reg.exe cmd.exe no specs conhost.exe no specs reg.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe ping.exe no specs cmd.exe no specs conhost.exe no specs reg.exe cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs reg.exe reg.exe

Process information

PID
CMD
Path
Indicators
Parent process
496REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /fC:\Windows\SysWOW64\reg.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
536C:\WINDOWS\system32\net1 share Love2="c:\Documents and Settings" /unlimited C:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
536cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /fC:\Windows\SysWOW64\cmd.exe—Sigmanly_ab020413dce53c9d57cf22d75eaf1339d72252d5316617a935149e02fee42fd3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
680\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
728cmd /c ping ernet adapter C2 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"C:\Windows\SysWOW64\cmd.exe—smss.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
744cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /fC:\Windows\SysWOW64\cmd.exe—smss.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
780\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
812C:\WINDOWS\system32\net1 share Love3=d:\ /unlimitedC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
812REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /fC:\Windows\SysWOW64\reg.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1132REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "smss\smss.exe " /fC:\Windows\SysWOW64\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
6 835
Read events
6 796
Write events
39
Delete events
0

Modification events

(PID) Process:(7416) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:smss
Value:
c:\RECYCLER\smss.exe
(PID) Process:(7584) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:smss
Value:
c:\RECYCLER\smss.exe
(PID) Process:(7952) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Csrss
Value:
c:\RECYCLER\smss.exe
(PID) Process:(8068) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:smss
Value:
c:\RECYCLER\smss.exe
(PID) Process:(8152) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Csrss
Value:
c:\RECYCLER\smss.exe
(PID) Process:(496) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Csrss
Value:
c:\RECYCLER\smss.exe
(PID) Process:(5204) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Csrss
Value:
c:\RECYCLER\smss.exe
(PID) Process:(7428) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Csrss
Value:
c:\RECYCLER\smss.exe
(PID) Process:(7572) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Csrss
Value:
c:\RECYCLER\smss.exe
(PID) Process:(2040) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Csrss
Value:
c:\RECYCLER\smss.exe
Executable files
3
Suspicious files
2
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
7276Sigmanly_ab020413dce53c9d57cf22d75eaf1339d72252d5316617a935149e02fee42fd3.exeC:\Users\admin\AppData\Local\Temp\smss.exeexecutable
MD5:57AECBCDCB3A5AD31AC07C5A62B56085
SHA256:AB020413DCE53C9D57CF22D75EAF1339D72252D5316617A935149E02FEE42FD3
7276Sigmanly_ab020413dce53c9d57cf22d75eaf1339d72252d5316617a935149e02fee42fd3.exeC:\RECYCLER\smss.exeexecutable
MD5:57AECBCDCB3A5AD31AC07C5A62B56085
SHA256:AB020413DCE53C9D57CF22D75EAF1339D72252D5316617A935149E02FEE42FD3
7276Sigmanly_ab020413dce53c9d57cf22d75eaf1339d72252d5316617a935149e02fee42fd3.exeC:\RECYCLER\Downloads.exeexecutable
MD5:57AECBCDCB3A5AD31AC07C5A62B56085
SHA256:AB020413DCE53C9D57CF22D75EAF1339D72252D5316617A935149E02FEE42FD3
7744smss.exeC:\Users\admin\AppData\Local\Temp\~DF0F9965A0F0281101.TMPbinary
MD5:E282EC2773982235D407598EA8D3253A
SHA256:601F6ABAD2FF2BBBB6EB24C0BB2278FB0824E5CC6E43CEA0AAF863CEC66AB197
7408smss.exeC:\RECYCLER\Checked_IPs.dlxtext
MD5:CC19931A85B9CC4771F1C9A522A6DCDA
SHA256:C343143C0B0E252BB4406FCD4F9333C393A486E82926BF1A6CFF385191BC7F20
7408smss.exeC:\RECYCLER\autorun.INFbinary
MD5:CBA289891EC7B2F21BDA3435F229537B
SHA256:34E37C589C9CDFEA750288F65D019AFEE10644722CC520F1E95FEBC5758FD4F0
728cmd.exeC:\RECYCLER\check_4_online.dlxtext
MD5:1AEE8EDDEF535A3C072B7F520EAF5560
SHA256:18E39B4A5A91F2CF56367C2D7B53830881D5D885BCCCC234219C39FD0AF44353
7736cmd.exeC:\RECYCLER\check_4_online.dlxtext
MD5:1AEE8EDDEF535A3C072B7F520EAF5560
SHA256:18E39B4A5A91F2CF56367C2D7B53830881D5D885BCCCC234219C39FD0AF44353
7216cmd.exeC:\RECYCLER\check_4_online.dlxtext
MD5:1AEE8EDDEF535A3C072B7F520EAF5560
SHA256:18E39B4A5A91F2CF56367C2D7B53830881D5D885BCCCC234219C39FD0AF44353
6132cmd.exeC:\RECYCLER\check_4_online.dlxtext
MD5:1AEE8EDDEF535A3C072B7F520EAF5560
SHA256:18E39B4A5A91F2CF56367C2D7B53830881D5D885BCCCC234219C39FD0AF44353
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
35
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
2104
svchost.exe
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2196
svchost.exe
224.0.0.251:5353
—
—
—
unknown
2196
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 172.217.18.110
whitelisted
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
whitelisted
www.microsoft.com
  • 23.219.150.101
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
  • 40.91.76.224
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Sigmanly_ab020413dce53c9d57cf22d75eaf1339d72252d5316617a935149e02fee42fd3