File name:

winstart.exe

Full analysis: https://app.any.run/tasks/41a1e0f5-9b90-4d91-8893-e859085d26d8
Verdict: Malicious activity
Analysis date: May 15, 2025, 23:57:24
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

B2892820187735D017B753B3FCA40B8D

SHA1:

643C05E1F91564D1EF1A05524B3856FBACAA299C

SHA256:

B2638A99132BE81299A8AEC1D602A4DD83E6FB49E1DD6A5EAE874A5EB9546741

SSDEEP:

49152:fmgGOhX02hD2nPiLq3A6770DODdl/rADxXhCk/3DgrA7etEhI/fsbW5zqhLoGdhG:V2nP6q3A6770DODdl/rADxRLDgsWwxG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • winstart.exe (PID: 4300)
      • winstart.exe (PID: 4776)
      • winstart.exe (PID: 300)
      • winstart.exe (PID: 5864)
      • winstart.exe (PID: 1116)
      • winstart.exe (PID: 1568)
      • winstart.exe (PID: 6268)
      • winstart.exe (PID: 668)
      • winstart.exe (PID: 6572)
      • winstart.exe (PID: 3784)
      • winstart.exe (PID: 6940)
      • winstart.exe (PID: 3008)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • winstart.exe (PID: 4300)
      • winstart.exe (PID: 4776)
      • winstart.exe (PID: 300)
      • winstart.exe (PID: 5864)
      • winstart.exe (PID: 1116)
      • winstart.exe (PID: 1568)
      • winstart.exe (PID: 6268)
      • winstart.exe (PID: 668)
      • winstart.exe (PID: 6572)
      • winstart.exe (PID: 3784)
      • winstart.exe (PID: 6940)
      • winstart.exe (PID: 3008)

    • Reads the date of Windows installation

      • winstart.exe (PID: 4300)
      • winstart.exe (PID: 4776)
      • winstart.exe (PID: 300)
      • winstart.exe (PID: 5864)
      • winstart.exe (PID: 1116)
      • winstart.exe (PID: 1568)
      • winstart.exe (PID: 6268)
      • winstart.exe (PID: 668)
      • winstart.exe (PID: 6572)
      • winstart.exe (PID: 3784)
      • winstart.exe (PID: 6940)
      • winstart.exe (PID: 3008)

    • Starts CMD.EXE for commands execution

      • winstart.exe (PID: 4300)
      • winstart.exe (PID: 4776)
      • winstart.exe (PID: 300)
      • winstart.exe (PID: 5864)
      • winstart.exe (PID: 1116)
      • winstart.exe (PID: 1568)
      • winstart.exe (PID: 6268)
      • winstart.exe (PID: 668)
      • winstart.exe (PID: 6572)
      • winstart.exe (PID: 3784)
      • winstart.exe (PID: 6940)
      • winstart.exe (PID: 3008)

    • Executing commands from a ".bat" file

      • winstart.exe (PID: 4300)
      • winstart.exe (PID: 4776)
      • winstart.exe (PID: 300)
      • winstart.exe (PID: 5864)
      • winstart.exe (PID: 1116)
      • winstart.exe (PID: 1568)
      • winstart.exe (PID: 6268)
      • winstart.exe (PID: 668)
      • winstart.exe (PID: 6572)
      • winstart.exe (PID: 3784)
      • winstart.exe (PID: 6940)
      • winstart.exe (PID: 3008)

    • Starts application with an unusual extension

      • cmd.exe (PID: 4988)
      • cmd.exe (PID: 3900)
      • cmd.exe (PID: 1096)
      • cmd.exe (PID: 6392)
      • cmd.exe (PID: 4920)
      • cmd.exe (PID: 1852)
      • cmd.exe (PID: 4464)
      • cmd.exe (PID: 6652)
      • cmd.exe (PID: 7156)
      • cmd.exe (PID: 5400)
      • cmd.exe (PID: 2088)
      • cmd.exe (PID: 4884)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 4988)
      • cmd.exe (PID: 3900)
      • cmd.exe (PID: 1096)
      • cmd.exe (PID: 6392)
      • cmd.exe (PID: 4920)
      • cmd.exe (PID: 1852)
      • cmd.exe (PID: 4464)
      • cmd.exe (PID: 6652)
      • cmd.exe (PID: 7156)
      • cmd.exe (PID: 2088)
      • cmd.exe (PID: 5400)
      • cmd.exe (PID: 4884)

    • The executable file from the user directory is run by the CMD process

      • winstart.exe (PID: 4776)
      • winstart.exe (PID: 5864)
      • winstart.exe (PID: 300)
      • winstart.exe (PID: 1116)
      • winstart.exe (PID: 1568)
      • winstart.exe (PID: 6268)
      • winstart.exe (PID: 668)
      • winstart.exe (PID: 6572)
      • winstart.exe (PID: 3784)
      • winstart.exe (PID: 3008)
      • winstart.exe (PID: 6940)

  • INFO

    • Reads the machine GUID from the registry

      • winstart.exe (PID: 4300)
      • winstart.exe (PID: 4776)
      • winstart.exe (PID: 5864)
      • winstart.exe (PID: 300)
      • winstart.exe (PID: 1568)
      • winstart.exe (PID: 1116)
      • winstart.exe (PID: 6268)
      • winstart.exe (PID: 668)
      • winstart.exe (PID: 6572)
      • winstart.exe (PID: 3784)
      • winstart.exe (PID: 6940)
      • winstart.exe (PID: 3008)

    • Checks supported languages

      • winstart.exe (PID: 4300)
      • chcp.com (PID: 920)
      • winstart.exe (PID: 4776)
      • chcp.com (PID: 6028)
      • winstart.exe (PID: 300)
      • chcp.com (PID: 5964)
      • winstart.exe (PID: 5864)
      • chcp.com (PID: 4200)
      • winstart.exe (PID: 1116)
      • chcp.com (PID: 4188)
      • chcp.com (PID: 4728)
      • winstart.exe (PID: 1568)
      • winstart.exe (PID: 6268)
      • chcp.com (PID: 6228)
      • winstart.exe (PID: 668)
      • chcp.com (PID: 2084)
      • winstart.exe (PID: 6572)
      • chcp.com (PID: 3968)
      • winstart.exe (PID: 3784)
      • chcp.com (PID: 2644)
      • chcp.com (PID: 1852)
      • winstart.exe (PID: 3008)
      • winstart.exe (PID: 6940)
      • chcp.com (PID: 5528)

    • Reads the computer name

      • winstart.exe (PID: 4300)
      • winstart.exe (PID: 4776)
      • winstart.exe (PID: 300)
      • winstart.exe (PID: 5864)
      • winstart.exe (PID: 1116)
      • winstart.exe (PID: 1568)
      • winstart.exe (PID: 6268)
      • winstart.exe (PID: 668)
      • winstart.exe (PID: 6572)
      • winstart.exe (PID: 3784)
      • winstart.exe (PID: 6940)
      • winstart.exe (PID: 3008)

    • Reads Environment values

      • winstart.exe (PID: 4300)
      • winstart.exe (PID: 4776)
      • winstart.exe (PID: 5864)
      • winstart.exe (PID: 300)
      • winstart.exe (PID: 1116)
      • winstart.exe (PID: 1568)
      • winstart.exe (PID: 6268)
      • winstart.exe (PID: 668)
      • winstart.exe (PID: 6572)
      • winstart.exe (PID: 3784)
      • winstart.exe (PID: 6940)
      • winstart.exe (PID: 3008)

    • Auto-launch of the file from Registry key

      • winstart.exe (PID: 4300)
      • winstart.exe (PID: 4776)
      • winstart.exe (PID: 300)
      • winstart.exe (PID: 5864)
      • winstart.exe (PID: 1116)
      • winstart.exe (PID: 1568)
      • winstart.exe (PID: 6268)
      • winstart.exe (PID: 668)
      • winstart.exe (PID: 6572)
      • winstart.exe (PID: 3784)
      • winstart.exe (PID: 6940)
      • winstart.exe (PID: 3008)

    • Create files in a temporary directory

      • winstart.exe (PID: 4300)
      • winstart.exe (PID: 4776)
      • winstart.exe (PID: 300)
      • winstart.exe (PID: 5864)
      • winstart.exe (PID: 1116)
      • winstart.exe (PID: 1568)
      • winstart.exe (PID: 6268)
      • winstart.exe (PID: 668)
      • winstart.exe (PID: 6572)
      • winstart.exe (PID: 3784)
      • winstart.exe (PID: 6940)
      • winstart.exe (PID: 3008)

    • Process checks computer location settings

      • winstart.exe (PID: 4300)
      • winstart.exe (PID: 4776)
      • winstart.exe (PID: 300)
      • winstart.exe (PID: 5864)
      • winstart.exe (PID: 1116)
      • winstart.exe (PID: 1568)
      • winstart.exe (PID: 6268)
      • winstart.exe (PID: 668)
      • winstart.exe (PID: 6572)
      • winstart.exe (PID: 3784)
      • winstart.exe (PID: 6940)
      • winstart.exe (PID: 3008)

    • Changes the display of characters in the console

      • cmd.exe (PID: 4988)
      • cmd.exe (PID: 3900)
      • cmd.exe (PID: 1096)
      • cmd.exe (PID: 6392)
      • cmd.exe (PID: 4920)
      • cmd.exe (PID: 1852)
      • cmd.exe (PID: 4464)
      • cmd.exe (PID: 6652)
      • cmd.exe (PID: 7156)
      • cmd.exe (PID: 5400)
      • cmd.exe (PID: 2088)
      • cmd.exe (PID: 4884)

    • Reads the software policy settings

      • slui.exe (PID: 6032)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (56.7)
.exe | Win64 Executable (generic) (21.3)
.scr | Windows screen saver (10.1)
.dll | Win32 Dynamic Link Library (generic) (5)
.exe | Win32 Executable (generic) (3.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:03:12 16:16:39+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 3261440
InitializedDataSize: 3584
UninitializedDataSize: -
EntryPoint: 0x31e3de
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.4.1.0
ProductVersionNumber: 1.4.1.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: Quasar Client
FileVersion: 1.4.1
InternalName: Client.exe
LegalCopyright: Copyright © MaxXor 2023
LegalTrademarks: -
OriginalFileName: Client.exe
ProductName: Quasar
ProductVersion: 1.4.1
AssemblyVersion: 1.4.1.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
194
Monitored processes
64
Malicious processes
21
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winstart.exe sppextcomobj.exe no specs slui.exe cmd.exe no specs conhost.exe no specs svchost.exe chcp.com no specs ping.exe no specs winstart.exe cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs winstart.exe cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs winstart.exe cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs winstart.exe cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs winstart.exe cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs slui.exe no specs winstart.exe cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs winstart.exe cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs winstart.exe cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs winstart.exe cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs winstart.exe cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs winstart.exe cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
300"C:\Users\admin\AppData\Local\Temp\winstart.exe" C:\Users\admin\AppData\Local\Temp\winstart.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Quasar Client
Exit code:
0
Version:
1.4.1
Modules
Images
c:\users\admin\appdata\local\temp\winstart.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
668"C:\Users\admin\AppData\Local\Temp\winstart.exe" C:\Users\admin\AppData\Local\Temp\winstart.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Quasar Client
Exit code:
0
Version:
1.4.1
Modules
Images
c:\users\admin\appdata\local\temp\winstart.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
920chcp 65001C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
920\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1012\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1096C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\S4uYs35GrbDZ.bat" "C:\Windows\System32\cmd.exe—winstart.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
1116"C:\Users\admin\AppData\Local\Temp\winstart.exe" C:\Users\admin\AppData\Local\Temp\winstart.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Quasar Client
Exit code:
0
Version:
1.4.1
Modules
Images
c:\users\admin\appdata\local\temp\winstart.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1228\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1452\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1568"C:\Users\admin\AppData\Local\Temp\winstart.exe" C:\Users\admin\AppData\Local\Temp\winstart.exe
cmd.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Quasar Client
Exit code:
0
Version:
1.4.1
Modules
Images
c:\users\admin\appdata\local\temp\winstart.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
14 442
Read events
14 430
Write events
12
Delete events
0

Modification events

(PID) Process:(4300) winstart.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:winstart
Value:
"C:\Users\admin\AppData\Roaming\winstart\winstart.exe"
(PID) Process:(4776) winstart.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:winstart
Value:
"C:\Users\admin\AppData\Roaming\winstart\winstart.exe"
(PID) Process:(300) winstart.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:winstart
Value:
"C:\Users\admin\AppData\Roaming\winstart\winstart.exe"
(PID) Process:(5864) winstart.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:winstart
Value:
"C:\Users\admin\AppData\Roaming\winstart\winstart.exe"
(PID) Process:(1116) winstart.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:winstart
Value:
"C:\Users\admin\AppData\Roaming\winstart\winstart.exe"
(PID) Process:(1568) winstart.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:winstart
Value:
"C:\Users\admin\AppData\Roaming\winstart\winstart.exe"
(PID) Process:(6268) winstart.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:winstart
Value:
"C:\Users\admin\AppData\Roaming\winstart\winstart.exe"
(PID) Process:(668) winstart.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:winstart
Value:
"C:\Users\admin\AppData\Roaming\winstart\winstart.exe"
(PID) Process:(6572) winstart.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:winstart
Value:
"C:\Users\admin\AppData\Roaming\winstart\winstart.exe"
(PID) Process:(3784) winstart.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:winstart
Value:
"C:\Users\admin\AppData\Roaming\winstart\winstart.exe"
Executable files
0
Suspicious files
0
Text files
12
Unknown types
0

Dropped files

PID
Process
Filename
Type
4300winstart.exeC:\Users\admin\AppData\Local\Temp\3Q6FYUMnNRIi.battext
MD5:44E6EAEC3DCBBAE90163BDCAB3C6BF2B
SHA256:9B6F0BC39B08B9E51CA6F3D2A3AD147FD9F5D3C40FEF3E2659CA611B47024087
1116winstart.exeC:\Users\admin\AppData\Local\Temp\LuLpdjxbrr8s.battext
MD5:4D08C93965A4B264359A7B572C61CCD5
SHA256:06029D1C45BA10F90B0F0F7C2E9157711F48D7DF99FBDA1D7C2A8B359ED90326
300winstart.exeC:\Users\admin\AppData\Local\Temp\S4uYs35GrbDZ.battext
MD5:46E98EFBAB2C6EA0871821DC8F7CFCA8
SHA256:310377FEF3ACBD88D3A4309E7A3BB87AA832FB98D9B922CEEE31EB95C2AD5EFF
4776winstart.exeC:\Users\admin\AppData\Local\Temp\doC4POIlE4sL.battext
MD5:44C995B6DCF4B64DEB10D676866CCE43
SHA256:BB09E755DAD78A8FBCE9FF7D26B3CCD5C414915EA29565BBE5F5773B6D4AC2E2
5864winstart.exeC:\Users\admin\AppData\Local\Temp\SHgScqjNpJkl.battext
MD5:478B4201E4CFD770C1D55252AE4B4155
SHA256:C8480F42262E97C37D5C08E38A70006BB86075C0B6E72A0970C6DC638AE4707B
1568winstart.exeC:\Users\admin\AppData\Local\Temp\PukvHwfJDE75.battext
MD5:D92327D5682B409B732B217105439FAE
SHA256:F9A3F2DE1EAE67B063B0CCFC456B884FF21096682CC13509D39CCC12374065FC
668winstart.exeC:\Users\admin\AppData\Local\Temp\GCjzjjQO5E3a.battext
MD5:E087255250AB963728E2F68CB7C136D9
SHA256:0EAECF6E2387E5F26DC0700F0BFCC2132A8EF0435316BDC6719F8BA73B309020
6268winstart.exeC:\Users\admin\AppData\Local\Temp\cdGKfbkeIP7x.battext
MD5:A8D3BFB5FCEF952446584905365C2B83
SHA256:B34FE8CE1CF54353D17BDE65474B4047D8997BDDE0C71C5C23C0F554033E999A
3784winstart.exeC:\Users\admin\AppData\Local\Temp\4c4kOrhPJohR.battext
MD5:8606D6630F3ED32C883ED9D19B8D16B1
SHA256:5A640BD8B9CBB8AE2022D3B463C5CED6EB8AEB5B8D9E58ACA2586A8597B904B5
6940winstart.exeC:\Users\admin\AppData\Local\Temp\z8lnwnNYhjxr.battext
MD5:D04C355B8612009C2C5C93B80F5202FB
SHA256:ED27C2574B140EF17885AD770D74B208BC882AE457D1CC697CD98408AF42B562
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
21
DNS requests
16
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4892
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4892
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5216
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 216.58.206.78
whitelisted
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
paltalkroom.ddns.net
  • 0.0.0.0
malicious
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.31.2
  • 40.126.31.131
  • 40.126.31.128
  • 20.190.159.73
  • 20.190.159.0
  • 20.190.159.128
  • 40.126.31.73
  • 20.190.159.75
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DNS Query to DynDNS Domain *.ddns .net
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
winstart.exe