File name:

Checker ATT HQ V1.0.1 fixed login cracked.exe

Full analysis: https://app.any.run/tasks/37c6b34b-dd21-41ee-9843-5162114e2540
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 01:51:01
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

3A4F9AEE19211F290C0BD02B445CA11C

SHA1:

ECA6D9D927EC1D8E15B66B5C4B3A45482F7015B3

SHA256:

B3C188051CCB327C2406C0B2581AF1247DAFF6491C895B8FB5D6D0D2FB19D90C

SSDEEP:

98304:rF0/F4U5dUZ6SrNtBe7GqaOhUoRkM8SycSB9ZK404Nbsbv3/xxhj/Dt8ewAeD0Z8:L4szCU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • SYSTEM.EXE (PID: 1388)
      • SYSTEM.EXE (PID: 7808)
      • SYSTEM.EXE (PID: 7692)
      • SYSTEM.EXE (PID: 7516)
      • SYSTEM.EXE (PID: 7444)
      • SYSTEM.EXE (PID: 7768)
      • SYSTEM.EXE (PID: 7432)
      • SYSTEM.EXE (PID: 7464)
      • SYSTEM.EXE (PID: 7604)
      • SYSTEM.EXE (PID: 7368)
      • SYSTEM.EXE (PID: 8160)
      • SYSTEM.EXE (PID: 1812)
      • SYSTEM.EXE (PID: 4424)
      • SYSTEM.EXE (PID: 8316)
      • SYSTEM.EXE (PID: 8440)
      • SYSTEM.EXE (PID: 8832)
      • SYSTEM.EXE (PID: 8724)
      • SYSTEM.EXE (PID: 8932)
      • SYSTEM.EXE (PID: 1040)

    • Steals credentials from Web Browsers

      • SYSTEM.EXE (PID: 8160)
      • SYSTEM.EXE (PID: 7516)
      • SYSTEM.EXE (PID: 7444)
      • SYSTEM.EXE (PID: 7368)
      • SYSTEM.EXE (PID: 7808)
      • SYSTEM.EXE (PID: 1812)
      • SYSTEM.EXE (PID: 4424)
      • SYSTEM.EXE (PID: 8316)
      • SYSTEM.EXE (PID: 8832)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Checker ATT HQ V1.0.1 fixed login cracked.exe (PID: 1276)
      • LOADER.EXE (PID: 7344)

    • Reads security settings of Internet Explorer

      • Checker ATT HQ V1.0.1 fixed login cracked.exe (PID: 1276)
      • LOADER.EXE (PID: 7344)
      • LOADER.EXE (PID: 7560)
      • LOADER.EXE (PID: 7444)
      • LOADER.EXE (PID: 7748)
      • LOADER.EXE (PID: 7672)
      • LOADER.EXE (PID: 7828)
      • LOADER.EXE (PID: 7964)
      • LOADER.EXE (PID: 8148)
      • LOADER.EXE (PID: 920)
      • LOADER.EXE (PID: 2384)
      • LOADER.EXE (PID: 7424)
      • LOADER.EXE (PID: 7456)
      • LOADER.EXE (PID: 7808)
      • LOADER.EXE (PID: 7984)
      • LOADER.EXE (PID: 1040)
      • LOADER.EXE (PID: 7552)
      • LOADER.EXE (PID: 1128)
      • LOADER.EXE (PID: 7448)
      • LOADER.EXE (PID: 5260)
      • LOADER.EXE (PID: 7752)
      • LOADER.EXE (PID: 8256)
      • LOADER.EXE (PID: 8432)
      • LOADER.EXE (PID: 2268)
      • LOADER.EXE (PID: 8672)
      • LOADER.EXE (PID: 8816)
      • LOADER.EXE (PID: 8536)
      • LOADER.EXE (PID: 9088)
      • LOADER.EXE (PID: 7612)
      • LOADER.EXE (PID: 8916)
      • LOADER.EXE (PID: 8000)
      • LOADER.EXE (PID: 4436)
      • LOADER.EXE (PID: 8400)
      • LOADER.EXE (PID: 8920)
      • LOADER.EXE (PID: 7492)
      • LOADER.EXE (PID: 9872)
      • LOADER.EXE (PID: 9520)
      • LOADER.EXE (PID: 10108)
      • LOADER.EXE (PID: 8344)
      • LOADER.EXE (PID: 1852)
      • LOADER.EXE (PID: 6940)
      • LOADER.EXE (PID: 4040)
      • LOADER.EXE (PID: 9396)
      • LOADER.EXE (PID: 9284)
      • LOADER.EXE (PID: 9092)
      • LOADER.EXE (PID: 9912)
      • LOADER.EXE (PID: 8700)
      • LOADER.EXE (PID: 8324)
      • LOADER.EXE (PID: 8900)
      • LOADER.EXE (PID: 9828)
      • LOADER.EXE (PID: 8012)
      • LOADER.EXE (PID: 7752)
      • LOADER.EXE (PID: 2096)
      • LOADER.EXE (PID: 8520)

    • The process creates files with name similar to system file names

      • LOADER.EXE (PID: 7344)

    • Application launched itself

      • LOADER.EXE (PID: 7344)
      • LOADER.EXE (PID: 7444)
      • LOADER.EXE (PID: 7672)
      • LOADER.EXE (PID: 7748)
      • LOADER.EXE (PID: 7560)
      • LOADER.EXE (PID: 7828)
      • LOADER.EXE (PID: 7964)
      • LOADER.EXE (PID: 8148)
      • LOADER.EXE (PID: 2384)
      • LOADER.EXE (PID: 7424)
      • LOADER.EXE (PID: 7456)
      • LOADER.EXE (PID: 920)
      • LOADER.EXE (PID: 7808)
      • LOADER.EXE (PID: 7984)
      • LOADER.EXE (PID: 1128)
      • LOADER.EXE (PID: 7552)
      • LOADER.EXE (PID: 7448)
      • LOADER.EXE (PID: 1040)
      • LOADER.EXE (PID: 5260)
      • LOADER.EXE (PID: 7752)
      • LOADER.EXE (PID: 2268)
      • LOADER.EXE (PID: 8256)
      • LOADER.EXE (PID: 8536)
      • LOADER.EXE (PID: 8432)
      • LOADER.EXE (PID: 8672)
      • LOADER.EXE (PID: 8816)
      • LOADER.EXE (PID: 8916)
      • LOADER.EXE (PID: 9088)
      • LOADER.EXE (PID: 7612)
      • LOADER.EXE (PID: 8000)
      • LOADER.EXE (PID: 4436)
      • LOADER.EXE (PID: 8400)
      • LOADER.EXE (PID: 8920)
      • LOADER.EXE (PID: 7492)
      • LOADER.EXE (PID: 9520)
      • LOADER.EXE (PID: 9872)
      • LOADER.EXE (PID: 8344)
      • LOADER.EXE (PID: 10108)
      • LOADER.EXE (PID: 1852)
      • LOADER.EXE (PID: 4040)
      • LOADER.EXE (PID: 9560)
      • LOADER.EXE (PID: 9396)
      • LOADER.EXE (PID: 6940)
      • LOADER.EXE (PID: 9092)
      • LOADER.EXE (PID: 9284)
      • LOADER.EXE (PID: 9476)
      • LOADER.EXE (PID: 9912)
      • LOADER.EXE (PID: 8324)
      • LOADER.EXE (PID: 8700)
      • LOADER.EXE (PID: 8900)
      • LOADER.EXE (PID: 9828)
      • LOADER.EXE (PID: 2096)
      • LOADER.EXE (PID: 7752)
      • LOADER.EXE (PID: 8520)
      • LOADER.EXE (PID: 8012)

    • Uses REG/REGEDIT.EXE to modify registry

      • CHECKER ATT HQ V1.0.1 FIXED LOGIN.EXE (PID: 7284)

    • Starts CMD.EXE for commands execution

      • CHECKER ATT HQ V1.0.1 FIXED LOGIN.EXE (PID: 7284)

    • Write to the desktop.ini file (may be used to cloak folders)

      • SYSTEM.EXE (PID: 2908)
      • SYSTEM.EXE (PID: 1388)
      • SYSTEM.EXE (PID: 7516)
      • SYSTEM.EXE (PID: 7432)
      • SYSTEM.EXE (PID: 1812)
      • SYSTEM.EXE (PID: 4424)
      • SYSTEM.EXE (PID: 8552)
      • SYSTEM.EXE (PID: 8724)
      • SYSTEM.EXE (PID: 8832)
      • SYSTEM.EXE (PID: 8932)
      • SYSTEM.EXE (PID: 7460)

    • Executes application which crashes

      • SYSTEM.EXE (PID: 5984)
      • SYSTEM.EXE (PID: 7992)
      • SYSTEM.EXE (PID: 8168)
      • SYSTEM.EXE (PID: 5640)

  • INFO

    • Create files in a temporary directory

      • Checker ATT HQ V1.0.1 fixed login cracked.exe (PID: 1276)
      • LOADER.EXE (PID: 7344)
      • SYSTEM.EXE (PID: 7516)
      • SYSTEM.EXE (PID: 7692)
      • SYSTEM.EXE (PID: 7444)
      • SYSTEM.EXE (PID: 7808)
      • SYSTEM.EXE (PID: 7368)
      • SYSTEM.EXE (PID: 8160)
      • SYSTEM.EXE (PID: 7464)
      • SYSTEM.EXE (PID: 7768)
      • SYSTEM.EXE (PID: 1388)
      • SYSTEM.EXE (PID: 7432)
      • SYSTEM.EXE (PID: 7604)
      • SYSTEM.EXE (PID: 1812)
      • SYSTEM.EXE (PID: 4424)
      • SYSTEM.EXE (PID: 8316)
      • SYSTEM.EXE (PID: 8724)
      • SYSTEM.EXE (PID: 8440)
      • SYSTEM.EXE (PID: 8832)
      • SYSTEM.EXE (PID: 8932)
      • SYSTEM.EXE (PID: 1040)

    • Reads the computer name

      • Checker ATT HQ V1.0.1 fixed login cracked.exe (PID: 1276)
      • LOADER.EXE (PID: 7344)
      • SYSTEM.EXE (PID: 7464)
      • SYSTEM.EXE (PID: 7604)
      • LOADER.EXE (PID: 7560)
      • LOADER.EXE (PID: 7444)
      • SYSTEM.EXE (PID: 7768)
      • LOADER.EXE (PID: 7748)
      • SYSTEM.EXE (PID: 7848)
      • SYSTEM.EXE (PID: 7692)
      • LOADER.EXE (PID: 7672)
      • SYSTEM.EXE (PID: 7992)
      • LOADER.EXE (PID: 7828)
      • LOADER.EXE (PID: 7964)
      • SYSTEM.EXE (PID: 8168)
      • SYSTEM.EXE (PID: 2908)
      • LOADER.EXE (PID: 2384)
      • SYSTEM.EXE (PID: 5640)
      • LOADER.EXE (PID: 920)
      • LOADER.EXE (PID: 8148)
      • LOADER.EXE (PID: 7424)
      • SYSTEM.EXE (PID: 7444)
      • LOADER.EXE (PID: 7456)
      • LOADER.EXE (PID: 7808)
      • SYSTEM.EXE (PID: 7432)
      • SYSTEM.EXE (PID: 7820)
      • SYSTEM.EXE (PID: 8160)
      • LOADER.EXE (PID: 7984)
      • LOADER.EXE (PID: 7552)
      • SYSTEM.EXE (PID: 7808)
      • LOADER.EXE (PID: 1040)
      • SYSTEM.EXE (PID: 7368)
      • LOADER.EXE (PID: 1128)
      • SYSTEM.EXE (PID: 5984)
      • LOADER.EXE (PID: 7448)
      • LOADER.EXE (PID: 5260)
      • SYSTEM.EXE (PID: 1388)
      • SYSTEM.EXE (PID: 7516)
      • LOADER.EXE (PID: 7752)
      • SYSTEM.EXE (PID: 1812)
      • SYSTEM.EXE (PID: 4424)
      • LOADER.EXE (PID: 2268)
      • LOADER.EXE (PID: 8256)
      • SYSTEM.EXE (PID: 8440)
      • LOADER.EXE (PID: 8432)
      • SYSTEM.EXE (PID: 8552)
      • LOADER.EXE (PID: 8536)
      • SYSTEM.EXE (PID: 8316)
      • SYSTEM.EXE (PID: 8724)
      • LOADER.EXE (PID: 8672)
      • SYSTEM.EXE (PID: 8832)
      • LOADER.EXE (PID: 8816)
      • LOADER.EXE (PID: 9088)
      • SYSTEM.EXE (PID: 9132)
      • SYSTEM.EXE (PID: 1040)
      • LOADER.EXE (PID: 7612)
      • LOADER.EXE (PID: 8916)
      • SYSTEM.EXE (PID: 8932)
      • SYSTEM.EXE (PID: 7460)
      • LOADER.EXE (PID: 8000)
      • SYSTEM.EXE (PID: 8496)
      • LOADER.EXE (PID: 8400)
      • LOADER.EXE (PID: 4436)
      • SYSTEM.EXE (PID: 8752)
      • SYSTEM.EXE (PID: 9000)
      • LOADER.EXE (PID: 8920)
      • SYSTEM.EXE (PID: 5544)
      • LOADER.EXE (PID: 7492)
      • LOADER.EXE (PID: 9520)
      • SYSTEM.EXE (PID: 9548)
      • SYSTEM.EXE (PID: 9920)
      • SYSTEM.EXE (PID: 10140)
      • LOADER.EXE (PID: 10108)
      • LOADER.EXE (PID: 8344)
      • SYSTEM.EXE (PID: 8976)
      • SYSTEM.EXE (PID: 5228)
      • LOADER.EXE (PID: 4040)
      • LOADER.EXE (PID: 1852)
      • SYSTEM.EXE (PID: 9708)
      • SYSTEM.EXE (PID: 2344)
      • LOADER.EXE (PID: 6940)
      • LOADER.EXE (PID: 9560)
      • SYSTEM.EXE (PID: 8636)
      • LOADER.EXE (PID: 9396)
      • SYSTEM.EXE (PID: 8368)
      • SYSTEM.EXE (PID: 10084)
      • LOADER.EXE (PID: 9284)
      • SYSTEM.EXE (PID: 8412)
      • LOADER.EXE (PID: 9476)
      • SYSTEM.EXE (PID: 10008)
      • SYSTEM.EXE (PID: 9496)
      • SYSTEM.EXE (PID: 9052)
      • LOADER.EXE (PID: 8700)
      • SYSTEM.EXE (PID: 9456)
      • SYSTEM.EXE (PID: 8088)
      • SYSTEM.EXE (PID: 7996)
      • LOADER.EXE (PID: 7752)
      • LOADER.EXE (PID: 2096)
      • SYSTEM.EXE (PID: 4880)
      • SYSTEM.EXE (PID: 9292)
      • LOADER.EXE (PID: 2192)

    • Checks supported languages

      • Checker ATT HQ V1.0.1 fixed login cracked.exe (PID: 1276)
      • CHECKER ATT HQ V1.0.1 FIXED LOGIN.EXE (PID: 7284)
      • LOADER.EXE (PID: 7344)
      • LOADER.EXE (PID: 7444)
      • SYSTEM.EXE (PID: 7604)
      • SYSTEM.EXE (PID: 7464)
      • LOADER.EXE (PID: 7560)
      • LOADER.EXE (PID: 7672)
      • SYSTEM.EXE (PID: 7768)
      • SYSTEM.EXE (PID: 7992)
      • LOADER.EXE (PID: 8148)
      • LOADER.EXE (PID: 7964)
      • SYSTEM.EXE (PID: 8168)
      • LOADER.EXE (PID: 7748)
      • LOADER.EXE (PID: 7828)
      • SYSTEM.EXE (PID: 7848)
      • SYSTEM.EXE (PID: 7692)
      • SYSTEM.EXE (PID: 2908)
      • LOADER.EXE (PID: 2384)
      • SYSTEM.EXE (PID: 5640)
      • LOADER.EXE (PID: 7424)
      • LOADER.EXE (PID: 920)
      • SYSTEM.EXE (PID: 7444)
      • LOADER.EXE (PID: 7456)
      • SYSTEM.EXE (PID: 7820)
      • LOADER.EXE (PID: 7808)
      • SYSTEM.EXE (PID: 7432)
      • SYSTEM.EXE (PID: 8160)
      • LOADER.EXE (PID: 7984)
      • LOADER.EXE (PID: 7552)
      • SYSTEM.EXE (PID: 7368)
      • LOADER.EXE (PID: 1128)
      • SYSTEM.EXE (PID: 7808)
      • SYSTEM.EXE (PID: 5984)
      • LOADER.EXE (PID: 5260)
      • LOADER.EXE (PID: 7448)
      • SYSTEM.EXE (PID: 1388)
      • LOADER.EXE (PID: 1040)
      • SYSTEM.EXE (PID: 7516)
      • SYSTEM.EXE (PID: 1812)
      • LOADER.EXE (PID: 7752)
      • LOADER.EXE (PID: 2268)
      • SYSTEM.EXE (PID: 4424)
      • LOADER.EXE (PID: 8432)
      • LOADER.EXE (PID: 8256)
      • SYSTEM.EXE (PID: 8552)
      • SYSTEM.EXE (PID: 8440)
      • SYSTEM.EXE (PID: 8316)
      • LOADER.EXE (PID: 8672)
      • SYSTEM.EXE (PID: 8724)
      • LOADER.EXE (PID: 8536)
      • SYSTEM.EXE (PID: 8832)
      • LOADER.EXE (PID: 8816)
      • SYSTEM.EXE (PID: 8932)
      • SYSTEM.EXE (PID: 9132)
      • LOADER.EXE (PID: 8916)
      • SYSTEM.EXE (PID: 1040)
      • LOADER.EXE (PID: 9088)
      • SYSTEM.EXE (PID: 7460)
      • LOADER.EXE (PID: 8400)
      • SYSTEM.EXE (PID: 8496)
      • LOADER.EXE (PID: 7612)
      • LOADER.EXE (PID: 8000)
      • SYSTEM.EXE (PID: 8752)
      • SYSTEM.EXE (PID: 9000)
      • LOADER.EXE (PID: 4436)
      • LOADER.EXE (PID: 7492)
      • LOADER.EXE (PID: 8920)
      • SYSTEM.EXE (PID: 5544)
      • SYSTEM.EXE (PID: 9548)
      • LOADER.EXE (PID: 9520)
      • LOADER.EXE (PID: 9872)
      • SYSTEM.EXE (PID: 9920)
      • SYSTEM.EXE (PID: 10140)
      • SYSTEM.EXE (PID: 8976)
      • LOADER.EXE (PID: 10108)
      • LOADER.EXE (PID: 8344)
      • LOADER.EXE (PID: 4040)
      • LOADER.EXE (PID: 1852)
      • SYSTEM.EXE (PID: 5228)
      • SYSTEM.EXE (PID: 9708)
      • SYSTEM.EXE (PID: 9520)
      • LOADER.EXE (PID: 9560)
      • LOADER.EXE (PID: 6940)
      • SYSTEM.EXE (PID: 2344)
      • LOADER.EXE (PID: 9396)
      • SYSTEM.EXE (PID: 8636)
      • SYSTEM.EXE (PID: 8368)
      • LOADER.EXE (PID: 9092)
      • SYSTEM.EXE (PID: 8412)
      • SYSTEM.EXE (PID: 10084)
      • LOADER.EXE (PID: 9284)
      • LOADER.EXE (PID: 9476)
      • SYSTEM.EXE (PID: 10008)
      • LOADER.EXE (PID: 9912)
      • LOADER.EXE (PID: 8700)
      • SYSTEM.EXE (PID: 9052)
      • LOADER.EXE (PID: 8324)
      • SYSTEM.EXE (PID: 9496)
      • SYSTEM.EXE (PID: 9456)
      • LOADER.EXE (PID: 9828)
      • LOADER.EXE (PID: 2096)
      • SYSTEM.EXE (PID: 8680)
      • LOADER.EXE (PID: 8900)
      • SYSTEM.EXE (PID: 8088)
      • LOADER.EXE (PID: 8012)
      • SYSTEM.EXE (PID: 7996)
      • SYSTEM.EXE (PID: 8064)
      • SYSTEM.EXE (PID: 9292)
      • LOADER.EXE (PID: 8520)
      • SYSTEM.EXE (PID: 4880)
      • LOADER.EXE (PID: 7752)
      • LOADER.EXE (PID: 2192)

    • Process checks computer location settings

      • Checker ATT HQ V1.0.1 fixed login cracked.exe (PID: 1276)
      • LOADER.EXE (PID: 7344)
      • LOADER.EXE (PID: 7444)
      • LOADER.EXE (PID: 7560)
      • LOADER.EXE (PID: 7672)
      • LOADER.EXE (PID: 7748)
      • LOADER.EXE (PID: 7828)
      • LOADER.EXE (PID: 7964)
      • LOADER.EXE (PID: 2384)
      • LOADER.EXE (PID: 920)
      • LOADER.EXE (PID: 8148)
      • LOADER.EXE (PID: 7424)
      • LOADER.EXE (PID: 7456)
      • LOADER.EXE (PID: 7808)
      • LOADER.EXE (PID: 7984)
      • LOADER.EXE (PID: 7552)
      • LOADER.EXE (PID: 1128)
      • LOADER.EXE (PID: 7448)
      • LOADER.EXE (PID: 1040)
      • LOADER.EXE (PID: 5260)
      • LOADER.EXE (PID: 7752)
      • LOADER.EXE (PID: 2268)
      • LOADER.EXE (PID: 8256)
      • LOADER.EXE (PID: 8432)
      • LOADER.EXE (PID: 8536)
      • LOADER.EXE (PID: 8672)
      • LOADER.EXE (PID: 8816)
      • LOADER.EXE (PID: 8916)
      • LOADER.EXE (PID: 9088)
      • LOADER.EXE (PID: 8000)
      • LOADER.EXE (PID: 8400)
      • LOADER.EXE (PID: 7612)
      • LOADER.EXE (PID: 4436)
      • LOADER.EXE (PID: 8920)
      • LOADER.EXE (PID: 7492)
      • LOADER.EXE (PID: 9520)
      • LOADER.EXE (PID: 9872)
      • LOADER.EXE (PID: 10108)
      • LOADER.EXE (PID: 8344)
      • LOADER.EXE (PID: 1852)
      • LOADER.EXE (PID: 9560)
      • LOADER.EXE (PID: 4040)
      • LOADER.EXE (PID: 9396)
      • LOADER.EXE (PID: 6940)
      • LOADER.EXE (PID: 9284)
      • LOADER.EXE (PID: 9092)
      • LOADER.EXE (PID: 9476)
      • LOADER.EXE (PID: 9912)
      • LOADER.EXE (PID: 8700)
      • LOADER.EXE (PID: 8324)
      • LOADER.EXE (PID: 9828)
      • LOADER.EXE (PID: 8900)
      • LOADER.EXE (PID: 2096)
      • LOADER.EXE (PID: 8520)
      • LOADER.EXE (PID: 8012)
      • LOADER.EXE (PID: 7752)
      • LOADER.EXE (PID: 2192)

    • Drops encrypted JS script (Microsoft Script Encoder)

      • CHECKER ATT HQ V1.0.1 FIXED LOGIN.EXE (PID: 7284)

    • Reads the machine GUID from the registry

      • SYSTEM.EXE (PID: 7444)
      • SYSTEM.EXE (PID: 2908)
      • SYSTEM.EXE (PID: 7820)
      • SYSTEM.EXE (PID: 7692)
      • SYSTEM.EXE (PID: 7768)
      • SYSTEM.EXE (PID: 7848)
      • SYSTEM.EXE (PID: 5640)
      • SYSTEM.EXE (PID: 7432)
      • SYSTEM.EXE (PID: 5984)
      • SYSTEM.EXE (PID: 8440)
      • SYSTEM.EXE (PID: 8316)
      • SYSTEM.EXE (PID: 8552)
      • SYSTEM.EXE (PID: 8724)
      • SYSTEM.EXE (PID: 7808)
      • SYSTEM.EXE (PID: 8168)
      • SYSTEM.EXE (PID: 7992)
      • SYSTEM.EXE (PID: 8832)
      • SYSTEM.EXE (PID: 7368)
      • SYSTEM.EXE (PID: 8932)
      • SYSTEM.EXE (PID: 8160)
      • SYSTEM.EXE (PID: 7604)
      • SYSTEM.EXE (PID: 7516)
      • SYSTEM.EXE (PID: 1388)
      • SYSTEM.EXE (PID: 7464)
      • SYSTEM.EXE (PID: 1812)
      • SYSTEM.EXE (PID: 1040)
      • SYSTEM.EXE (PID: 9132)
      • SYSTEM.EXE (PID: 7460)
      • SYSTEM.EXE (PID: 4424)
      • SYSTEM.EXE (PID: 8496)
      • SYSTEM.EXE (PID: 8752)
      • SYSTEM.EXE (PID: 9000)
      • SYSTEM.EXE (PID: 5544)
      • SYSTEM.EXE (PID: 9920)
      • SYSTEM.EXE (PID: 10140)
      • SYSTEM.EXE (PID: 8976)
      • SYSTEM.EXE (PID: 2344)
      • SYSTEM.EXE (PID: 9708)

    • Creates files or folders in the user directory

      • SYSTEM.EXE (PID: 7516)
      • SYSTEM.EXE (PID: 1388)
      • SYSTEM.EXE (PID: 2908)
      • SYSTEM.EXE (PID: 7992)
      • SYSTEM.EXE (PID: 7768)
      • SYSTEM.EXE (PID: 7368)
      • SYSTEM.EXE (PID: 7432)
      • SYSTEM.EXE (PID: 7464)
      • SYSTEM.EXE (PID: 1812)
      • SYSTEM.EXE (PID: 8160)
      • SYSTEM.EXE (PID: 4424)
      • WerFault.exe (PID: 9896)
      • WerFault.exe (PID: 9988)
      • SYSTEM.EXE (PID: 8552)
      • SYSTEM.EXE (PID: 8316)
      • WerFault.exe (PID: 9936)
      • SYSTEM.EXE (PID: 8724)
      • SYSTEM.EXE (PID: 8440)
      • SYSTEM.EXE (PID: 8832)
      • SYSTEM.EXE (PID: 8932)
      • SYSTEM.EXE (PID: 1040)
      • SYSTEM.EXE (PID: 7460)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 EXE PECompact compressed (generic) (20.3)
.exe | Win32 Executable MS Visual C++ (generic) (15.2)
.dll | Win32 Dynamic Link Library (generic) (3.2)
.exe | Win32 Executable (generic) (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2011:07:03 09:05:04+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 31232
InitializedDataSize: 13524992
UninitializedDataSize: -
EntryPoint: 0x3248
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
260
Monitored processes
124
Malicious processes
45
Suspicious processes
27

Behavior graph

Click at the process to see the details
start checker att hq v1.0.1 fixed login cracked.exe checker att hq v1.0.1 fixed login.exe no specs checker att hq v1.0.1 fixed login.exe conhost.exe no specs loader.exe loader.exe no specs system.exe cmd.exe no specs reg.exe no specs loader.exe no specs reg.exe no specs system.exe loader.exe no specs system.exe loader.exe no specs system.exe loader.exe no specs system.exe no specs sppextcomobj.exe no specs slui.exe no specs loader.exe no specs system.exe loader.exe no specs system.exe loader.exe no specs system.exe no specs loader.exe no specs system.exe loader.exe no specs system.exe loader.exe no specs system.exe loader.exe no specs system.exe no specs loader.exe no specs system.exe loader.exe no specs system.exe loader.exe no specs system.exe loader.exe no specs system.exe loader.exe no specs system.exe loader.exe no specs system.exe loader.exe no specs system.exe loader.exe no specs system.exe loader.exe no specs system.exe loader.exe no specs system.exe loader.exe no specs system.exe no specs loader.exe no specs system.exe loader.exe no specs system.exe loader.exe no specs system.exe loader.exe no specs system.exe no specs loader.exe no specs system.exe loader.exe no specs system.exe no specs loader.exe no specs system.exe no specs loader.exe no specs system.exe no specs loader.exe no specs system.exe no specs loader.exe no specs system.exe no specs loader.exe no specs system.exe no specs loader.exe no specs werfault.exe no specs system.exe no specs werfault.exe no specs werfault.exe no specs werfault.exe no specs loader.exe no specs system.exe no specs loader.exe no specs system.exe no specs loader.exe no specs system.exe no specs loader.exe no specs system.exe no specs loader.exe no specs system.exe no specs loader.exe no specs system.exe no specs loader.exe no specs system.exe no specs loader.exe no specs system.exe no specs loader.exe no specs system.exe no specs loader.exe no specs system.exe no specs loader.exe no specs system.exe no specs loader.exe no specs system.exe no specs loader.exe no specs system.exe no specs loader.exe no specs system.exe no specs loader.exe no specs system.exe no specs loader.exe no specs system.exe no specs loader.exe no specs system.exe no specs loader.exe no specs system.exe no specs loader.exe no specs system.exe no specs loader.exe no specs system.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
920"C:\Users\admin\AppData\Local\Temp\LOADER.EXE" C:\Users\admin\AppData\Local\Temp\LOADER.EXE—LOADER.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
1040"C:\Users\admin\AppData\Local\Temp\LOADER.EXE" C:\Users\admin\AppData\Local\Temp\LOADER.EXE—LOADER.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
1040"C:\Users\admin\AppData\Local\Temp\SYSTEM.EXE" C:\Users\admin\AppData\Local\Temp\SYSTEM.EXE
LOADER.EXE
User:
admin
Integrity Level:
MEDIUM
Description:
Client
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\system.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1128"C:\Users\admin\AppData\Local\Temp\LOADER.EXE" C:\Users\admin\AppData\Local\Temp\LOADER.EXE—LOADER.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
1276"C:\Users\admin\AppData\Local\Temp\Checker ATT HQ V1.0.1 fixed login cracked.exe" C:\Users\admin\AppData\Local\Temp\Checker ATT HQ V1.0.1 fixed login cracked.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\checker att hq v1.0.1 fixed login cracked.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
1388"C:\Users\admin\AppData\Local\Temp\SYSTEM.EXE" C:\Users\admin\AppData\Local\Temp\SYSTEM.EXE
LOADER.EXE
User:
admin
Integrity Level:
MEDIUM
Description:
Client
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\system.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1812"C:\Users\admin\AppData\Local\Temp\SYSTEM.EXE" C:\Users\admin\AppData\Local\Temp\SYSTEM.EXE
LOADER.EXE
User:
admin
Integrity Level:
MEDIUM
Description:
Client
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\system.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1852"C:\Users\admin\AppData\Local\Temp\LOADER.EXE" C:\Users\admin\AppData\Local\Temp\LOADER.EXE—LOADER.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
2096"C:\Users\admin\AppData\Local\Temp\LOADER.EXE" C:\Users\admin\AppData\Local\Temp\LOADER.EXE—LOADER.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
2192"C:\Users\admin\AppData\Local\Temp\LOADER.EXE" C:\Users\admin\AppData\Local\Temp\LOADER.EXE—LOADER.EXE
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\loader.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
Total events
36 372
Read events
36 370
Write events
2
Delete events
0

Modification events

(PID) Process:(7532) reg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
Operation:writeName:MaxUserPort
Value:
65534
(PID) Process:(7568) reg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters
Operation:writeName:TcpTimedWaitDelay
Value:
30
Executable files
3
Suspicious files
228
Text files
353
Unknown types
0

Dropped files

PID
Process
Filename
Type
1276Checker ATT HQ V1.0.1 fixed login cracked.exeC:\Users\admin\AppData\Local\Temp\LOADER.EXEexecutable
MD5:732A98F70F3B364160EFC0DED95B7D9E
SHA256:FC7EF1178F19781E99908EC59F8170687A195DA74455D1615DB9CF72BBD00FE6
7368SYSTEM.EXEC:\Users\admin\AppData\Local\9fa77758cbf13bee452c66ca3ecc1900\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Pictures\desktop.initext
MD5:29EAE335B77F438E05594D86A6CA22FF
SHA256:88856962CEF670C087EDA4E07D8F78465BEEABB6143B96BD90F884A80AF925B4
7820SYSTEM.EXEC:\Users\admin\AppData\Local\eb6ac490e04191317f0bea9d91713320\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Desktop\connectiontitle.rtftext
MD5:40A313BBA7088DD4DD73B0B42AF0D7D7
SHA256:34DAC3EF310C55EEF05C154F85245B71CA8CC6C83C43D1ACC28B9C525296FF55
7368SYSTEM.EXEC:\Users\admin\AppData\Local\9fa77758cbf13bee452c66ca3ecc1900\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Pictures\Camera Roll\desktop.initext
MD5:D48FCE44E0F298E5DB52FD5894502727
SHA256:231A08CABA1F9BA9F14BD3E46834288F3C351079FCEDDA15E391B724AC0C7EA8
7820SYSTEM.EXEC:\Users\admin\AppData\Local\eb6ac490e04191317f0bea9d91713320\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Desktop\desktop.initext
MD5:9E36CC3537EE9EE1E3B10FA4E761045B
SHA256:4B9D687AC625690FD026ED4B236DAD1CAC90EF69E7AD256CC42766A065B50026
7516SYSTEM.EXEC:\Users\admin\AppData\Local\585a29ccb90b035de5dc9a9484f7c433\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Desktop\desktop.initext
MD5:9E36CC3537EE9EE1E3B10FA4E761045B
SHA256:4B9D687AC625690FD026ED4B236DAD1CAC90EF69E7AD256CC42766A065B50026
7444SYSTEM.EXEC:\Users\admin\AppData\Local\9fa77758cbf13bee452c66ca3ecc1900\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Desktop\desktop.initext
MD5:9E36CC3537EE9EE1E3B10FA4E761045B
SHA256:4B9D687AC625690FD026ED4B236DAD1CAC90EF69E7AD256CC42766A065B50026
7808SYSTEM.EXEC:\Users\admin\AppData\Local\9fa77758cbf13bee452c66ca3ecc1900\admin@DESKTOP-JGLLJLD_en-US\Grabber\DRIVE-C\Users\admin\Desktop\robertshot.rtftext
MD5:A2B19A8AD770AFC5A9A49C3CD3BA93B3
SHA256:C2D7B18FD8D8AF85F085DF8193CAC1A4B2DA76876D9C98CB34894A55B9541E23
7344LOADER.EXEC:\Users\admin\AppData\Local\Temp\SYSTEM.EXEexecutable
MD5:2EC124F1A1D284C71332A1541C308AE0
SHA256:E245FA83DFD5D14C64F8B8F9BD3D5542F09B223E150034D1B8C6E71B02EAE08B
1276Checker ATT HQ V1.0.1 fixed login cracked.exeC:\Users\admin\AppData\Local\Temp\CHECKER ATT HQ V1.0.1 FIXED LOGIN.EXEexecutable
MD5:7D7257E54B3FA79CF18FAD9295AB5C37
SHA256:053394EAE434D988B6DCAA6D911E9A8FF72ED6DFC0B1391B602F86073DA11AB7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
17
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
10172
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
10172
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.132:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
10172
SIHClient.exe
172.202.163.200:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
google.com
  • 216.58.206.46
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.160.132
  • 20.190.160.5
  • 40.126.32.74
  • 40.126.32.140
  • 40.126.32.68
  • 20.190.160.2
  • 20.190.160.128
  • 20.190.160.66
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Checker ATT HQ V1.0.1 fixed login cracked.exe