URL:

buzzheavier.com

Full analysis: https://app.any.run/tasks/397167ad-4f1e-4f44-b365-b783aab7df3b
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 31, 2026, 22:14:27
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
python
ahk
loader
Indicators:
MD5:

247C8BC74123F05A6055DF58866F05AC

SHA1:

6C5C795C22D0B2E645EA7B0E65C2E27E9F61572D

SHA256:

B1767D4D71CFFEDE702DA4D5C6CC21DE124E6768B6BBCD54C3C05B14FEDC8B12

SSDEEP:

3:k3T0:qT0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AHK has been detected

      • python.exe (PID: 2760)

  • SUSPICIOUS

    • Loads Python modules

      • python.exe (PID: 2216)
      • python.exe (PID: 6104)
      • python.exe (PID: 2760)

  • INFO

    • Application launched itself

      • chrome.exe (PID: 7348)

    • Drops script file

      • chrome.exe (PID: 7348)
      • cmd.exe (PID: 4816)
      • notepad++.exe (PID: 7300)
      • python.exe (PID: 2216)
      • python.exe (PID: 6104)
      • python.exe (PID: 2760)

    • Checks supported languages

      • python.exe (PID: 2216)
      • python.exe (PID: 6104)
      • python.exe (PID: 2760)

    • Python executable

      • python.exe (PID: 2216)
      • python.exe (PID: 6104)
      • python.exe (PID: 2760)

    • Manual execution by a user

      • cmd.exe (PID: 4816)
      • notepad++.exe (PID: 7300)

    • Reads the computer name

      • python.exe (PID: 6104)
      • python.exe (PID: 2760)

    • Drops encrypted JS script (Microsoft Script Encoder)

      • python.exe (PID: 6104)

    • Checks proxy server information

      • python.exe (PID: 6104)
      • slui.exe (PID: 3700)
      • python.exe (PID: 2760)

    • Create files in a temporary directory

      • python.exe (PID: 6104)

    • Reads the machine GUID from the registry

      • python.exe (PID: 6104)

    • Creates files or folders in the user directory

      • python.exe (PID: 6104)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
183
Monitored processes
36
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs cmd.exe no specs conhost.exe no specs python.exe no specs notepad++.exe slui.exe python.exe #AHK python.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2012"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --field-trial-handle=3116,i,852646766818674185,1389603399892530251,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=3672 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
2216python test.pyC:\Users\admin\AppData\Local\Programs\Python\Python314\python.exe—cmd.exe
User:
admin
Company:
Python Software Foundation
Integrity Level:
MEDIUM
Description:
Python
Exit code:
0
Version:
3.14.0b1
Modules
Images
c:\users\admin\appdata\local\programs\python\python314\python.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\users\admin\appdata\local\programs\python\python314\vcruntime140.dll
c:\users\admin\appdata\local\programs\python\python314\python314.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\version.dll
c:\windows\system32\rpcrt4.dll
2324C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2340"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --field-trial-handle=5520,i,852646766818674185,1389603399892530251,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=6072 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2760python test.pyC:\Users\admin\AppData\Local\Programs\Python\Python314\python.exe
cmd.exe
User:
admin
Company:
Python Software Foundation
Integrity Level:
MEDIUM
Description:
Python
Version:
3.14.0b1
Modules
Images
c:\users\admin\appdata\local\programs\python\python314\python.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\users\admin\appdata\local\programs\python\python314\vcruntime140.dll
c:\users\admin\appdata\local\programs\python\python314\python314.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3136"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --field-trial-handle=6108,i,852646766818674185,1389603399892530251,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=5864 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
3464"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --field-trial-handle=5320,i,852646766818674185,1389603399892530251,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=5240 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\133.0.6943.127\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
3700C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4268"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --field-trial-handle=6028,i,852646766818674185,1389603399892530251,262144 --disable-features=HttpsFirstBalancedMode,HttpsFirstModeV2,HttpsOnlyMode,HttpsUpgrades --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=6068 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
133.0.6943.127
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
4816"C:\WINDOWS\system32\cmd.exe" C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\wldp.dll
Total events
17 015
Read events
17 015
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
88
Text files
73
Unknown types
0

Dropped files

PID
Process
Filename
Type
7348chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db\LOG.old~RF18b3bb.TMP —
MD5:—
SHA256:—
7348chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old~RF18b3ca.TMP —
MD5:—
SHA256:—
7348chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
7348chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old~RF18b3ca.TMP —
MD5:—
SHA256:—
7348chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\parcel_tracking_db\LOG.old~RF18b3ca.TMP —
MD5:—
SHA256:—
7348chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials\LOG.old~RF18b3ca.TMP —
MD5:—
SHA256:—
7348chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB\LOG.old~RF18b3ca.TMP —
MD5:—
SHA256:—
7348chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\LOG.old~RF18b3da.TMP —
MD5:—
SHA256:—
7348chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\chrome_cart_db\LOG.old —
MD5:—
SHA256:—
7348chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1 836
TCP/UDP connections
1 749
DNS requests
53
Threats
5 731

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7484
chrome.exe
GET
302
104.18.94.41:443
https://challenges.cloudflare.com/turnstile/v0/api.js
US
—
—
unknown
7484
chrome.exe
GET
302
104.18.94.41:443
https://challenges.cloudflare.com/turnstile/v0/api.js
US
—
—
unknown
7484
chrome.exe
GET
200
142.251.208.174:80
http://clients2.google.com/time/1/current?cup2key=8:rtVEOoxKspC7WMngNNorN4Rviz5gJsnEs3bVvbcA_10&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
US
text
106 b
whitelisted
4668
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
4668
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
7484
chrome.exe
GET
200
216.58.206.35:443
https://clientservices.googleapis.com/chrome-variations/seed?osname=win&channel=stable&milestone=133
US
compressed
82.9 Kb
whitelisted
7484
chrome.exe
GET
200
142.251.141.138:443
https://safebrowsingohttpgateway.googleapis.com/v1/ohttp/hpkekeyconfig?key=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE
US
binary
41 b
whitelisted
7484
chrome.exe
GET
200
104.18.2.146:443
https://buzzheavier.com/
US
html
9.43 Kb
unknown
7484
chrome.exe
POST
200
142.251.127.84:443
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
US
text
17 b
whitelisted
7484
chrome.exe
GET
200
104.18.2.146:443
https://buzzheavier.com/whysostylish.css?v=b254bf02b9f0eec2b402ac5b7b619700b9b2309d-dirty
US
text
9.17 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6244
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6596
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
7484
chrome.exe
142.251.208.174:80
clients2.google.com
GOOGLE
US
whitelisted
7484
chrome.exe
142.251.141.138:443
safebrowsingohttpgateway.googleapis.com
GOOGLE
US
whitelisted
7484
chrome.exe
216.58.206.35:443
clientservices.googleapis.com
GOOGLE
US
whitelisted
4668
svchost.exe
23.216.77.28:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
7484
chrome.exe
142.250.185.138:443
safebrowsingohttpgateway.googleapis.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.251.141.142
whitelisted
clients2.google.com
  • 142.251.208.174
whitelisted
safebrowsingohttpgateway.googleapis.com
  • 142.251.141.138
  • 142.250.184.234
  • 216.58.206.74
  • 172.217.23.106
  • 172.217.16.202
  • 172.217.20.138
  • 172.217.16.170
  • 142.250.185.170
  • 142.250.201.74
  • 142.250.185.138
  • 142.251.141.74
  • 142.250.187.234
  • 216.58.206.42
  • 142.251.140.170
  • 142.251.208.10
  • 142.251.141.106
whitelisted
clientservices.googleapis.com
  • 216.58.206.35
whitelisted
buzzheavier.com
  • 104.18.2.146
  • 104.18.3.146
unknown
accounts.google.com
  • 142.251.127.84
whitelisted
challenges.cloudflare.com
  • 104.18.94.41
  • 104.18.95.41
whitelisted
static.cloudflareinsights.com
  • 104.16.80.73
  • 104.16.79.73
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.15
  • 23.216.77.41
  • 23.216.77.20
  • 23.216.77.13
  • 23.216.77.42
  • 23.216.77.22
  • 23.216.77.8
  • 23.216.77.18
  • 23.216.77.30
  • 23.216.77.29
  • 23.216.77.37
  • 23.216.77.38
  • 23.216.77.36
whitelisted

Threats

PID
Process
Class
Message
7484
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge
7484
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge
7484
chrome.exe
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge
4668
svchost.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
2760
python.exe
A Network Trojan was detected
ET HUNTING Suspicious Possible Process Dump in POST body
2760
python.exe
Misc activity
POLICY [ANY.RUN] Python requests User-agent in HTTP request
2760
python.exe
A Network Trojan was detected
ET HUNTING Suspicious Possible Process Dump in POST body
2760
python.exe
Misc activity
POLICY [ANY.RUN] Python requests User-agent in HTTP request
2760
python.exe
Misc activity
POLICY [ANY.RUN] Python requests User-agent in HTTP request
2760
python.exe
A Network Trojan was detected
ET HUNTING Suspicious Possible Process Dump in POST body
Process
Message
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
VerifyLibrary: error while getting certificate informations
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
buzzheavier.com