File name:

open_cmd.exe

Full analysis: https://app.any.run/tasks/1defebce-b11b-493e-b55e-a751e2015151
Verdict: Malicious activity
Analysis date: November 25, 2025, 19:36:47
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 19 sections
MD5:

7AAE6218FFBBE9ADDF6863D73B483FE0

SHA1:

9DE262CEB79C5C6B0440B02039153EB2D878A805

SHA256:

BAC72F003695ADE0B6FCF1574A2A5271C4E688F84DBDD2721C207892A8E0C230

SSDEEP:

1536:KGq1eUpHQEBIle8ner0urgp/Q09sCZIoWpCPI2Jjn+grnHr47noir40WqaEsKXmV:KGq1eUpdI8omP7vif

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 6980)
      • cmd.exe (PID: 2060)
      • cmd.exe (PID: 2468)
      • cmd.exe (PID: 2120)
      • cmd.exe (PID: 3144)
      • open_cmd.exe (PID: 580)
      • cmd.exe (PID: 6016)
      • cmd.exe (PID: 3144)
      • cmd.exe (PID: 7180)
      • cmd.exe (PID: 7348)
      • cmd.exe (PID: 7504)
      • cmd.exe (PID: 7704)
      • cmd.exe (PID: 7800)
      • cmd.exe (PID: 7896)
      • cmd.exe (PID: 7988)
      • cmd.exe (PID: 8176)
      • cmd.exe (PID: 8088)
      • cmd.exe (PID: 5460)
      • cmd.exe (PID: 7608)
      • cmd.exe (PID: 8112)
      • cmd.exe (PID: 7592)
      • cmd.exe (PID: 6452)
      • cmd.exe (PID: 2308)
      • cmd.exe (PID: 7372)
      • cmd.exe (PID: 5492)
      • cmd.exe (PID: 8092)
      • cmd.exe (PID: 7540)
      • cmd.exe (PID: 7068)
      • cmd.exe (PID: 4884)
      • cmd.exe (PID: 2784)
      • cmd.exe (PID: 8016)
      • cmd.exe (PID: 132)
      • cmd.exe (PID: 2784)
      • cmd.exe (PID: 8288)
      • cmd.exe (PID: 8384)
      • cmd.exe (PID: 8584)
      • cmd.exe (PID: 8884)
      • cmd.exe (PID: 8780)
      • cmd.exe (PID: 8480)
      • cmd.exe (PID: 8684)
      • cmd.exe (PID: 8988)
      • cmd.exe (PID: 9084)
      • cmd.exe (PID: 9176)
      • cmd.exe (PID: 6432)
      • cmd.exe (PID: 8820)
      • cmd.exe (PID: 9012)
      • cmd.exe (PID: 9124)
      • cmd.exe (PID: 8320)
      • cmd.exe (PID: 8720)
      • cmd.exe (PID: 2060)
      • cmd.exe (PID: 7256)
      • cmd.exe (PID: 9268)
      • cmd.exe (PID: 7380)
      • cmd.exe (PID: 8720)
      • cmd.exe (PID: 4916)
      • cmd.exe (PID: 5684)
      • cmd.exe (PID: 9364)
      • cmd.exe (PID: 9464)
      • cmd.exe (PID: 9560)
      • cmd.exe (PID: 9768)
      • cmd.exe (PID: 9664)

    • Application launched itself

      • cmd.exe (PID: 6980)
      • cmd.exe (PID: 2060)
      • cmd.exe (PID: 2468)
      • cmd.exe (PID: 2120)
      • cmd.exe (PID: 3144)
      • cmd.exe (PID: 6016)
      • cmd.exe (PID: 3144)
      • cmd.exe (PID: 7180)
      • cmd.exe (PID: 7348)
      • cmd.exe (PID: 7504)
      • cmd.exe (PID: 7608)
      • cmd.exe (PID: 7704)
      • cmd.exe (PID: 7800)
      • cmd.exe (PID: 7896)
      • cmd.exe (PID: 8088)
      • cmd.exe (PID: 8176)
      • cmd.exe (PID: 7988)
      • cmd.exe (PID: 7068)
      • cmd.exe (PID: 7592)
      • cmd.exe (PID: 7372)
      • cmd.exe (PID: 5492)
      • cmd.exe (PID: 8092)
      • cmd.exe (PID: 5460)
      • cmd.exe (PID: 7540)
      • cmd.exe (PID: 8112)
      • cmd.exe (PID: 6452)
      • cmd.exe (PID: 2308)
      • cmd.exe (PID: 4884)
      • cmd.exe (PID: 2784)
      • cmd.exe (PID: 2784)
      • cmd.exe (PID: 8384)
      • cmd.exe (PID: 132)
      • cmd.exe (PID: 8016)
      • cmd.exe (PID: 8288)
      • cmd.exe (PID: 8884)
      • cmd.exe (PID: 8584)
      • cmd.exe (PID: 8780)
      • cmd.exe (PID: 8684)
      • cmd.exe (PID: 8988)
      • cmd.exe (PID: 9084)
      • cmd.exe (PID: 9176)
      • cmd.exe (PID: 6432)
      • cmd.exe (PID: 8480)
      • cmd.exe (PID: 8820)
      • cmd.exe (PID: 9012)
      • cmd.exe (PID: 9124)
      • cmd.exe (PID: 8320)
      • cmd.exe (PID: 2060)
      • cmd.exe (PID: 7256)
      • cmd.exe (PID: 4916)
      • cmd.exe (PID: 7380)
      • cmd.exe (PID: 5684)
      • cmd.exe (PID: 8720)
      • cmd.exe (PID: 8720)
      • cmd.exe (PID: 9268)
      • cmd.exe (PID: 9364)
      • cmd.exe (PID: 9464)
      • cmd.exe (PID: 9560)
      • cmd.exe (PID: 9664)
      • cmd.exe (PID: 9768)

  • INFO

    • Checks supported languages

      • open_cmd.exe (PID: 580)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:11:25 19:36:17+00:00
ImageFileCharacteristics: Executable, No line numbers, Large address aware
PEType: PE32+
LinkerVersion: 2.45
CodeSize: 6656
InitializedDataSize: 8704
UninitializedDataSize: 512
EntryPoint: 0x1400
OSVersion: 4
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
327
Monitored processes
183
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start open_cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs slui.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
132C:\WINDOWS\system32\cmd.exe /c start cmdC:\Windows\System32\cmd.exe—open_cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
272\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
580"C:\Users\admin\AppData\Local\Temp\open_cmd.exe" C:\Users\admin\AppData\Local\Temp\open_cmd.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
592\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
800cmd C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
916\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
1080\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
1164cmd C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
1172\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
1288\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

No data
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
23
DNS requests
15
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4048
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2972
svchost.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1036
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
1036
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
1036
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.3.crl
unknown
—
—
whitelisted
1036
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1036
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1036
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.3.crl
unknown
—
—
whitelisted
1036
SIHClient.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
1036
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
2972
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5596
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2800
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
4048
svchost.exe
20.190.160.17:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4048
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2972
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2972
svchost.exe
2.16.168.124:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
3440
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
  • 20.73.194.208
whitelisted
google.com
  • 142.250.186.174
whitelisted
login.live.com
  • 20.190.160.17
  • 20.190.160.131
  • 20.190.160.128
  • 20.190.160.5
  • 40.126.32.74
  • 20.190.160.22
  • 20.190.160.64
  • 40.126.32.68
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
  • 2.16.241.19
  • 2.16.241.12
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
slscr.update.microsoft.com
  • 74.178.240.61
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
activation-v2.sls.microsoft.com
  • 4.154.209.85
whitelisted

Threats

PID
Process
Class
Message
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
open_cmd.exe