File name:

New Text Document mod.exe

Full analysis: https://app.any.run/tasks/1f15287c-d163-4e7a-9f67-c4c20fe7d692
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: April 12, 2025, 20:38:47
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
phishing
tycoon
storm1747
xred
backdoor
evasion
loader
delphi
dyndns
hausbomber
dcrat
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

C6040234EE8EAEDBE618632818C3B1B3

SHA1:

68115F8C3394C782AA6BA663AC78695D2B80BF75

SHA256:

BB459869E5EF6D6DD6F0329080D7CB12542C4B37163AE2CD782620ADCD7D55A0

SSDEEP:

12288:f3H6yScLnqOl0r5Zu0LMFbtizFJ6rAPvOxrcg0i7u48S+isSl:f3HzLnqOaNMCFJ6kPvOxrcg0i7uFSsE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • New Text Document mod.exe (PID: 2136)

    • XRED has been detected

      • New Text Document mod.exe (PID: 2136)

    • PHISHING has been detected (SURICATA)

      • svchost.exe (PID: 2196)

    • Executing a file with an untrusted certificate

      • Cbqjobosim-Signed.exe (PID: 7220)

    • Connects to the CnC server

      • SQL.exe (PID: 4920)

    • XRED has been detected (YARA)

      • New Text Document mod.exe (PID: 2136)

    • XRED mutex has been found

      • New Text Document mod.exe (PID: 2136)
      • Synaptics.exe (PID: 7988)

    • HAUSBOMBER has been detected (YARA)

      • ._cache_New Text Document mod.exe (PID: 5244)

    • DCRAT has been detected (YARA)

      • ._cache_New Text Document mod.exe (PID: 5244)

    • Create files in the Startup directory

      • Cbqjobosim-Signed.exe (PID: 7220)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • New Text Document mod.exe (PID: 2136)
      • ._cache_New Text Document mod.exe (PID: 5244)
      • Synaptics.exe (PID: 7988)

    • Executable content was dropped or overwritten

      • ._cache_New Text Document mod.exe (PID: 5244)
      • New Text Document mod.exe (PID: 2136)
      • electrum-xrp-1.5.2.exe (PID: 8076)

    • Reads the date of Windows installation

      • ._cache_New Text Document mod.exe (PID: 5244)

    • Potential Corporate Privacy Violation

      • ._cache_New Text Document mod.exe (PID: 5244)

    • Connects to unusual port

      • SQL.exe (PID: 4920)

    • Process requests binary or script from the Internet

      • ._cache_New Text Document mod.exe (PID: 5244)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • SQL.exe (PID: 4920)

    • There is functionality for communication dyndns network (YARA)

      • New Text Document mod.exe (PID: 2136)

    • There is functionality for communication over UDP network (YARA)

      • New Text Document mod.exe (PID: 2136)

    • There is functionality for taking screenshot (YARA)

      • New Text Document mod.exe (PID: 2136)

    • The process creates files with name similar to system file names

      • electrum-xrp-1.5.2.exe (PID: 8076)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • electrum-xrp-1.5.2.exe (PID: 8076)

  • INFO

    • Reads the computer name

      • New Text Document mod.exe (PID: 2136)
      • SQL.exe (PID: 2236)
      • ._cache_New Text Document mod.exe (PID: 5244)
      • SQL.exe (PID: 4920)
      • Cbqjobosim-Signed.exe (PID: 7220)
      • MSBuild.exe (PID: 7572)
      • Synaptics.exe (PID: 7988)
      • electrum-xrp-1.5.2.exe (PID: 8076)

    • Process checks computer location settings

      • New Text Document mod.exe (PID: 2136)
      • ._cache_New Text Document mod.exe (PID: 5244)
      • SQL.exe (PID: 2236)
      • MSBuild.exe (PID: 7572)
      • SQL.exe (PID: 4920)

    • Reads Environment values

      • ._cache_New Text Document mod.exe (PID: 5244)
      • SQL.exe (PID: 4920)
      • Cbqjobosim-Signed.exe (PID: 7220)

    • Checks supported languages

      • ._cache_New Text Document mod.exe (PID: 5244)
      • SQL.exe (PID: 2236)
      • SQL.exe (PID: 4920)
      • New Text Document mod.exe (PID: 2136)
      • Cbqjobosim-Signed.exe (PID: 7220)
      • MSBuild.exe (PID: 7572)
      • Synaptics.exe (PID: 7988)
      • electrum-xrp-1.5.2.exe (PID: 8076)

    • Checks proxy server information

      • ._cache_New Text Document mod.exe (PID: 5244)
      • Synaptics.exe (PID: 7988)

    • Reads the software policy settings

      • ._cache_New Text Document mod.exe (PID: 5244)
      • slui.exe (PID: 5416)

    • Creates files in the program directory

      • New Text Document mod.exe (PID: 2136)
      • Synaptics.exe (PID: 7988)

    • Reads the machine GUID from the registry

      • SQL.exe (PID: 2236)
      • Cbqjobosim-Signed.exe (PID: 7220)
      • ._cache_New Text Document mod.exe (PID: 5244)
      • MSBuild.exe (PID: 7572)
      • SQL.exe (PID: 4920)

    • Disables trace logs

      • ._cache_New Text Document mod.exe (PID: 5244)

    • The sample compiled with french language support

      • ._cache_New Text Document mod.exe (PID: 5244)

    • Checks transactions between databases Windows and Oracle

      • SQL.exe (PID: 2236)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 1660)

    • The sample compiled with turkish language support

      • New Text Document mod.exe (PID: 2136)

    • Creates files or folders in the user directory

      • Cbqjobosim-Signed.exe (PID: 7220)

    • Create files in a temporary directory

      • Cbqjobosim-Signed.exe (PID: 7220)
      • electrum-xrp-1.5.2.exe (PID: 8076)

    • Manual execution by a user

      • MSBuild.exe (PID: 7572)

    • Compiled with Borland Delphi (YARA)

      • ._cache_New Text Document mod.exe (PID: 5244)
      • conhost.exe (PID: 6044)
      • New Text Document mod.exe (PID: 2136)

    • The sample compiled with english language support

      • electrum-xrp-1.5.2.exe (PID: 8076)

    • Reads product name

      • SQL.exe (PID: 4920)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Borland Delphi 7 (96.4)
.exe | Win32 Executable Delphi generic (2)
.exe | Win32 Executable (generic) (0.6)
.exe | Win16/32 Executable Delphi generic (0.3)
.exe | Generic Win/DOS Executable (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 629760
InitializedDataSize: 148992
UninitializedDataSize: -
EntryPoint: 0x9ab80
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.4
ProductVersionNumber: 1.0.0.4
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Turkish
CharacterSet: Windows, Turkish
CompanyName: Synaptics
FileDescription: Synaptics Pointing Device Driver
FileVersion: 1.0.0.4
InternalName: -
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: -
ProductName: Synaptics Pointing Device Driver
ProductVersion: 1.0.0.0
Comments: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
147
Monitored processes
17
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #XRED new text document mod.exe #HAUSBOMBER ._cache_new text document mod.exe conhost.exe no specs #PHISHING svchost.exe sppextcomobj.exe no specs slui.exe sql.exe no specs CMSTPLUA no specs rundll32.exe no specs Color Management no specs sql.exe cbqjobosim-signed.exe msbuild.exe no specs #XRED synaptics.exe electrum-xrp-1.5.2.exe slui.exe no specs win-anchor-wallet-1.3.12.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
664C:\WINDOWS\system32\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
1660C:\WINDOWS\system32\DllHost.exe /Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
2136"C:\Users\admin\Desktop\New Text Document mod.exe" C:\Users\admin\Desktop\New Text Document mod.exe
explorer.exe
User:
admin
Company:
Synaptics
Integrity Level:
MEDIUM
Description:
Synaptics Pointing Device Driver
Exit code:
0
Version:
1.0.0.4
Modules
Images
c:\users\admin\desktop\new text document mod.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2236"C:\Users\admin\Desktop\a\SQL.exe" C:\Users\admin\Desktop\a\SQL.exe—._cache_New Text Document mod.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1630
Modules
Images
c:\users\admin\desktop\a\sql.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ole32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\combase.dll
c:\windows\system32\gdi32.dll
4448C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
4920"C:\Users\admin\Desktop\a\SQL.exe" C:\Users\admin\Desktop\a\SQL.exe
dllhost.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\a\sql.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ole32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\combase.dll
c:\windows\system32\gdi32.dll
5244"C:\Users\admin\Desktop\._cache_New Text Document mod.exe" C:\Users\admin\Desktop\._cache_New Text Document mod.exe
New Text Document mod.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Version:
0.0.0.0
Modules
Images
c:\users\admin\desktop\._cache_new text document mod.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
5404C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
5416"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
5 023
Read events
5 004
Write events
18
Delete events
1

Modification events

(PID) Process:(2136) New Text Document mod.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(2136) New Text Document mod.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Synaptics Pointing Device Driver
Value:
C:\ProgramData\Synaptics\Synaptics.exe
(PID) Process:(2136) New Text Document mod.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A7803901000060B81DB4E48ED2119906E49FADC173CACC000000
(PID) Process:(5244) ._cache_New Text Document mod.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(5244) ._cache_New Text Document mod.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(5244) ._cache_New Text Document mod.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(5244) ._cache_New Text Document mod.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(5244) ._cache_New Text Document mod.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(5244) ._cache_New Text Document mod.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(5244) ._cache_New Text Document mod.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
Executable files
10
Suspicious files
0
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
7220Cbqjobosim-Signed.exeC:\Users\admin\AppData\Local\Temp\overmelod.exe —
MD5:—
SHA256:—
5244._cache_New Text Document mod.exeC:\Users\admin\Desktop\a\win-anchor-wallet-1.3.12.exe —
MD5:—
SHA256:—
2136New Text Document mod.exeC:\Users\admin\Desktop\._cache_New Text Document mod.exeexecutable
MD5:69994FF2F00EECA9335CCD502198E05B
SHA256:2E2E035ECE4ACCDEE838ECAACDC263FA526939597954D18D1320D73C8BF810C2
8076electrum-xrp-1.5.2.exeC:\Users\admin\AppData\Local\Temp\nsr45B2.tmp\System.dllexecutable
MD5:0D7AD4F45DC6F5AA87F606D0331C6901
SHA256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
8076electrum-xrp-1.5.2.exeC:\Users\admin\AppData\Local\Temp\nsr45B2.tmp\UAC.dllexecutable
MD5:ADB29E6B186DAA765DC750128649B63D
SHA256:2F7F8FC05DC4FD0D5CDA501B47E4433357E887BBFED7292C028D99C73B52DC08
5244._cache_New Text Document mod.exeC:\Users\admin\Desktop\a\Cbqjobosim-Signed.exeexecutable
MD5:44269F3383C745B0656F94EBDF04BB4C
SHA256:0303F9D6082240E16F0D503CF900F5F378A5CF906088A7C6312F58AD50472D8A
8076electrum-xrp-1.5.2.exeC:\Users\admin\AppData\Local\Temp\nsr45B2.tmp\modern-wizard.bmpimage
MD5:52FF52EEE3B944B862C11C268A02C196
SHA256:2079F7A3EBA60E0D9EE827A7208AA052A71B384873B641DE5E299AEB8E733109
7220Cbqjobosim-Signed.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\overmelod.vbstext
MD5:3EDC34055A61C3418B59075433129A8E
SHA256:75B03C038679A517862D861DC0E520513C426219CC627EBA992A0FAADFF26C69
8076electrum-xrp-1.5.2.exeC:\Users\admin\AppData\Local\Temp\nsr45B2.tmp\nsDialogs.dllexecutable
MD5:466179E1C8EE8A1FF5E4427DBB6C4A01
SHA256:1E40211AF65923C2F4FD02CE021458A7745D28E2F383835E3015E96575632172
2136New Text Document mod.exeC:\ProgramData\Synaptics\Synaptics.exeexecutable
MD5:C6040234EE8EAEDBE618632818C3B1B3
SHA256:BB459869E5EF6D6DD6F0329080D7CB12542C4B37163AE2CD782620ADCD7D55A0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
30
DNS requests
23
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5244
._cache_New Text Document mod.exe
GET
200
104.21.42.251:80
http://www.rovilane.ru/Downloads/SQL.exe
unknown
—
—
unknown
5496
MoUsoCoreWorker.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
756
lsass.exe
GET
200
142.250.185.195:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
5244
._cache_New Text Document mod.exe
GET
200
104.21.48.206:80
http://mail.workspacedoc.com/Downloads/Cbqjobosim-Signed.exe
unknown
—
—
unknown
4920
SQL.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/212.30.37.95
unknown
—
—
whitelisted
7732
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7732
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7988
Synaptics.exe
GET
200
69.42.215.252:80
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5244
._cache_New Text Document mod.exe
151.101.2.49:443
urlhaus.abuse.ch
FASTLY
US
whitelisted
5244
._cache_New Text Document mod.exe
104.21.42.251:80
www.rovilane.ru
CLOUDFLARENET
—
unknown
5244
._cache_New Text Document mod.exe
104.21.48.206:80
mail.workspacedoc.com
CLOUDFLARENET
—
unknown
6544
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.46
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
urlhaus.abuse.ch
  • 151.101.2.49
  • 151.101.194.49
  • 151.101.130.49
  • 151.101.66.49
whitelisted
www.rovilane.ru
  • 104.21.42.251
  • 172.67.214.78
unknown
mail.workspacedoc.com
  • 104.21.48.206
  • 172.67.156.48
unknown
login.live.com
  • 20.190.159.0
  • 40.126.31.3
  • 20.190.159.68
  • 20.190.159.71
  • 20.190.159.4
  • 20.190.159.73
  • 40.126.31.71
  • 40.126.31.73
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
api.ipify.org
  • 104.26.13.205
  • 172.67.74.152
  • 104.26.12.205
shared
c.pki.goog
  • 142.250.185.195
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Possible Social Engineering Attempted
PHISHING [ANY.RUN] Suspected Tycoon2FA`s Phishing-Kit domain by CrossDomain ( .rovilane .ru)
5244
._cache_New Text Document mod.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
5244
._cache_New Text Document mod.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
5244
._cache_New Text Document mod.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
5244
._cache_New Text Document mod.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2196
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
4920
SQL.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
4920
SQL.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
4920
SQL.exe
A Network Trojan was detected
ET MALWARE Aurotun Stealer CnC Checkin
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
New Text Document mod.exe