File name:

9D62DA0AB950520600505B7FED03198F.exe

Full analysis: https://app.any.run/tasks/bae4eefb-0a2d-400c-ae64-bc13f16c121b
Verdict: Malicious activity
Threats:

DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common.

Malware Trends Tracker     >>>
Analysis date: May 17, 2025, 20:19:38
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
dcrat
rat
auto-reg
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 5 sections
MD5:

9D62DA0AB950520600505B7FED03198F

SHA1:

0295273C68055145122CBFABA1709BE8F0907925

SHA256:

BD0D735A8BD758E6A751DFB19F7A66CE95E403A9DF9688E2EEFDDAB4301FA3B2

SSDEEP:

49152:38OWbOR9KxqWHfRbWYR18XB3K9ZgGvWrOe1zvARHybEzLmlw/8dB1gDXO9+yswwY:38bbBT4gjvWF1Edywz6lnFFQys8HL5Iu

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • DCRAT mutex has been found

      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5548)
      • System.exe (PID: 4920)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 1324)
      • dllhost.exe (PID: 6244)
      • RuntimeBroker.exe (PID: 1280)
      • dwm.exe (PID: 728)
      • System.exe (PID: 4180)
      • System.exe (PID: 6576)
      • System.exe (PID: 5756)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6148)
      • System.exe (PID: 7020)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2616)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5204)
      • System.exe (PID: 4180)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2980)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5260)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2096)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5956)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6416)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 4620)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5256)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6184)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6744)

    • Changes the autorun value in the registry

      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5548)

  • SUSPICIOUS

    • The process creates files with name similar to system file names

      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5548)

    • Executable content was dropped or overwritten

      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5548)
      • csc.exe (PID: 3900)
      • System.exe (PID: 4920)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 1324)
      • System.exe (PID: 6576)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2616)
      • System.exe (PID: 5756)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6148)
      • System.exe (PID: 7020)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5204)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2980)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5260)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2096)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5956)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 4620)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5256)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6184)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6744)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 4696)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6416)

    • Process drops legitimate windows executable

      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5548)

    • Reads security settings of Internet Explorer

      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5548)
      • System.exe (PID: 4920)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 1324)
      • System.exe (PID: 6576)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2616)
      • System.exe (PID: 5756)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6148)
      • System.exe (PID: 7020)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5204)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2980)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5260)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2096)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5956)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6416)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 4620)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5256)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6184)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6744)

    • Reads the date of Windows installation

      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5548)
      • System.exe (PID: 4920)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 1324)
      • System.exe (PID: 6576)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2616)
      • System.exe (PID: 5756)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6148)
      • System.exe (PID: 7020)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5204)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2980)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5260)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2096)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6416)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 4620)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5256)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6184)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6744)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5956)

    • Starts CMD.EXE for commands execution

      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5548)
      • System.exe (PID: 4920)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 1324)
      • System.exe (PID: 6576)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2616)
      • System.exe (PID: 5756)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6148)
      • System.exe (PID: 7020)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2980)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5260)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2096)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5956)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6416)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5204)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 4620)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5256)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6184)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6744)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 4696)

    • Executing commands from a ".bat" file

      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5548)
      • System.exe (PID: 4920)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 1324)
      • System.exe (PID: 6576)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2616)
      • System.exe (PID: 5756)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6148)
      • System.exe (PID: 7020)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2980)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5260)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2096)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5956)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6416)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5204)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5256)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6184)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 4696)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6744)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 4620)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6156)
      • cmd.exe (PID: 5528)
      • cmd.exe (PID: 6744)
      • cmd.exe (PID: 5588)
      • cmd.exe (PID: 1452)
      • cmd.exe (PID: 5776)
      • cmd.exe (PID: 664)
      • cmd.exe (PID: 1532)
      • cmd.exe (PID: 1132)
      • cmd.exe (PID: 812)
      • cmd.exe (PID: 1096)
      • cmd.exe (PID: 6148)
      • cmd.exe (PID: 6960)
      • cmd.exe (PID: 4400)
      • cmd.exe (PID: 5376)
      • cmd.exe (PID: 4528)
      • cmd.exe (PID: 1748)
      • cmd.exe (PID: 7100)
      • cmd.exe (PID: 6640)

    • Probably delay the execution using 'w32tm.exe'

      • cmd.exe (PID: 6156)
      • cmd.exe (PID: 5588)
      • cmd.exe (PID: 664)
      • cmd.exe (PID: 812)
      • cmd.exe (PID: 6148)
      • cmd.exe (PID: 6960)
      • cmd.exe (PID: 4400)
      • cmd.exe (PID: 5376)
      • cmd.exe (PID: 1748)
      • cmd.exe (PID: 7100)

    • The executable file from the user directory is run by the CMD process

      • System.exe (PID: 4920)
      • System.exe (PID: 6576)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2616)
      • System.exe (PID: 5756)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6148)
      • System.exe (PID: 7020)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5204)
      • System.exe (PID: 4180)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2980)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5260)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2096)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5956)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6416)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 4620)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5256)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6184)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6744)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 4696)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 5528)
      • cmd.exe (PID: 6744)
      • cmd.exe (PID: 1132)
      • cmd.exe (PID: 1452)
      • cmd.exe (PID: 5776)
      • cmd.exe (PID: 1532)
      • cmd.exe (PID: 1096)
      • cmd.exe (PID: 4528)
      • cmd.exe (PID: 6640)

  • INFO

    • Checks supported languages

      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5548)
      • csc.exe (PID: 3900)
      • cvtres.exe (PID: 2108)
      • chcp.com (PID: 6004)
      • System.exe (PID: 4920)
      • chcp.com (PID: 2108)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 1324)
      • RuntimeBroker.exe (PID: 1280)
      • dllhost.exe (PID: 6244)
      • System.exe (PID: 4180)
      • dwm.exe (PID: 728)
      • chcp.com (PID: 5936)
      • System.exe (PID: 6576)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2616)
      • chcp.com (PID: 6028)
      • chcp.com (PID: 6112)
      • System.exe (PID: 5756)
      • chcp.com (PID: 1188)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6148)
      • System.exe (PID: 7020)
      • chcp.com (PID: 6240)
      • chcp.com (PID: 1096)
      • System.exe (PID: 4180)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5204)
      • chcp.com (PID: 1072)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2980)
      • chcp.com (PID: 1452)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5260)
      • chcp.com (PID: 4528)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2096)
      • chcp.com (PID: 5508)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5956)
      • chcp.com (PID: 2236)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6416)
      • chcp.com (PID: 6372)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 4620)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5256)
      • chcp.com (PID: 6620)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6184)
      • chcp.com (PID: 1676)
      • chcp.com (PID: 4448)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6744)

    • Reads the computer name

      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5548)
      • System.exe (PID: 4920)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 1324)
      • RuntimeBroker.exe (PID: 1280)
      • dllhost.exe (PID: 6244)
      • System.exe (PID: 4180)
      • dwm.exe (PID: 728)
      • System.exe (PID: 6576)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2616)
      • System.exe (PID: 5756)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6148)
      • System.exe (PID: 7020)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5204)
      • System.exe (PID: 4180)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2980)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5260)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2096)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5956)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6416)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 4620)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5256)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6184)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6744)

    • Reads the machine GUID from the registry

      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5548)
      • csc.exe (PID: 3900)
      • System.exe (PID: 4920)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 1324)
      • RuntimeBroker.exe (PID: 1280)
      • dllhost.exe (PID: 6244)
      • System.exe (PID: 4180)
      • dwm.exe (PID: 728)
      • System.exe (PID: 6576)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2616)
      • System.exe (PID: 5756)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6148)
      • System.exe (PID: 7020)
      • System.exe (PID: 4180)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5204)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2980)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5260)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2096)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5956)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6416)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 4620)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5256)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6184)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6744)

    • Reads Environment values

      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5548)
      • System.exe (PID: 4920)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 1324)
      • RuntimeBroker.exe (PID: 1280)
      • System.exe (PID: 4180)
      • dwm.exe (PID: 728)
      • System.exe (PID: 6576)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2616)
      • dllhost.exe (PID: 6244)
      • System.exe (PID: 5756)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6148)
      • System.exe (PID: 7020)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5204)
      • System.exe (PID: 4180)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2980)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5260)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2096)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5956)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6416)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 4620)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5256)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6184)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6744)

    • Failed to create an executable file in Windows directory

      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5548)

    • Creates files in the program directory

      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5548)

    • Auto-launch of the file from Registry key

      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5548)

    • Create files in a temporary directory

      • cvtres.exe (PID: 2108)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5548)
      • System.exe (PID: 4920)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 1324)
      • System.exe (PID: 6576)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6148)
      • System.exe (PID: 7020)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5204)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2616)
      • System.exe (PID: 5756)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2980)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5260)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2096)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5956)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6416)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 4620)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5256)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6184)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6744)

    • The sample compiled with english language support

      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5548)

    • Creates files or folders in the user directory

      • csc.exe (PID: 3900)

    • Process checks computer location settings

      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5548)
      • System.exe (PID: 4920)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 1324)
      • System.exe (PID: 6576)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2616)
      • System.exe (PID: 5756)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6148)
      • System.exe (PID: 7020)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2980)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5260)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2096)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6416)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5204)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 4620)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5256)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6184)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6744)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5956)

    • Changes the display of characters in the console

      • cmd.exe (PID: 6156)
      • cmd.exe (PID: 5528)
      • cmd.exe (PID: 6744)
      • cmd.exe (PID: 5588)
      • cmd.exe (PID: 1132)
      • cmd.exe (PID: 1452)
      • cmd.exe (PID: 5776)
      • cmd.exe (PID: 664)
      • cmd.exe (PID: 1532)
      • cmd.exe (PID: 812)
      • cmd.exe (PID: 1096)
      • cmd.exe (PID: 6148)
      • cmd.exe (PID: 6960)
      • cmd.exe (PID: 4400)
      • cmd.exe (PID: 5376)
      • cmd.exe (PID: 4528)
      • cmd.exe (PID: 1748)
      • cmd.exe (PID: 7100)
      • cmd.exe (PID: 6640)

    • Disables trace logs

      • System.exe (PID: 4920)
      • System.exe (PID: 6576)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 1324)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2616)
      • System.exe (PID: 5756)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6148)
      • System.exe (PID: 7020)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5204)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2980)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5260)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2096)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5956)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6416)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 4620)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5256)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6184)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6744)

    • Checks proxy server information

      • System.exe (PID: 4920)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 1324)
      • System.exe (PID: 6576)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2616)
      • System.exe (PID: 5756)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6148)
      • System.exe (PID: 7020)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5204)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2980)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5260)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 2096)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5956)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6416)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 4620)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 5256)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6184)
      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 6744)

    • Manual execution by a user

      • 9D62DA0AB950520600505B7FED03198F.exe (PID: 1324)
      • RuntimeBroker.exe (PID: 1280)
      • dllhost.exe (PID: 6244)
      • dwm.exe (PID: 728)
      • System.exe (PID: 4180)

    • Reads the software policy settings

      • slui.exe (PID: 896)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (41)
.exe | Win64 Executable (generic) (36.3)
.dll | Win32 Dynamic Link Library (generic) (8.6)
.exe | Win32 Executable (generic) (5.9)
.exe | Win16/32 Executable Delphi generic (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:01:29 15:01:49+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 1556480
InitializedDataSize: 307200
UninitializedDataSize: -
EntryPoint: 0x4e00a
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.2.7.1277
ProductVersionNumber: 1.2.7.1277
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: -
FileDescription: -
FileVersion: 1.2.7.1277
InternalName: SpotifyStartupTask
LegalCopyright: Copyright (c) 2023, Spotify Ltd
OriginalFileName: SpotifyStartupTask.exe
ProductName: -
ProductVersion: 1.2.7.1277
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
236
Monitored processes
107
Malicious processes
35
Suspicious processes
3

Behavior graph

Click at the process to see the details
start #DCRAT 9d62da0ab950520600505b7fed03198f.exe sppextcomobj.exe no specs slui.exe csc.exe conhost.exe no specs cvtres.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs w32tm.exe no specs #DCRAT system.exe cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs #DCRAT 9d62da0ab950520600505b7fed03198f.exe #DCRAT runtimebroker.exe no specs #DCRAT dllhost.exe no specs #DCRAT system.exe no specs #DCRAT dwm.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs #DCRAT system.exe cmd.exe no specs conhost.exe no specs chcp.com no specs w32tm.exe no specs #DCRAT 9d62da0ab950520600505b7fed03198f.exe cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs #DCRAT system.exe cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs #DCRAT 9d62da0ab950520600505b7fed03198f.exe cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs #DCRAT system.exe cmd.exe no specs conhost.exe no specs chcp.com no specs w32tm.exe no specs #DCRAT 9d62da0ab950520600505b7fed03198f.exe #DCRAT system.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs #DCRAT 9d62da0ab950520600505b7fed03198f.exe cmd.exe no specs conhost.exe no specs chcp.com no specs w32tm.exe no specs #DCRAT 9d62da0ab950520600505b7fed03198f.exe cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs slui.exe no specs #DCRAT 9d62da0ab950520600505b7fed03198f.exe cmd.exe no specs conhost.exe no specs chcp.com no specs w32tm.exe no specs #DCRAT 9d62da0ab950520600505b7fed03198f.exe cmd.exe no specs conhost.exe no specs chcp.com no specs w32tm.exe no specs #DCRAT 9d62da0ab950520600505b7fed03198f.exe cmd.exe no specs conhost.exe no specs chcp.com no specs w32tm.exe no specs #DCRAT 9d62da0ab950520600505b7fed03198f.exe cmd.exe no specs conhost.exe no specs chcp.com no specs w32tm.exe no specs #DCRAT 9d62da0ab950520600505b7fed03198f.exe cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs #DCRAT 9d62da0ab950520600505b7fed03198f.exe cmd.exe no specs conhost.exe no specs chcp.com no specs w32tm.exe no specs #DCRAT 9d62da0ab950520600505b7fed03198f.exe cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs 9d62da0ab950520600505b7fed03198f.exe cmd.exe no specs conhost.exe no specs chcp.com no specs w32tm.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
300chcp 65001C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
664\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
664C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Hfmet1a8LI.bat" "C:\Windows\System32\cmd.exe—System.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
728"C:\Users\admin\dwm.exe"C:\Users\admin\dwm.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.2.7.1277
Modules
Images
c:\users\admin\dwm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
812C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Y3JLLbydWs.bat" "C:\Windows\System32\cmd.exe—9D62DA0AB950520600505B7FED03198F.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
896"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
960w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 C:\Windows\System32\w32tm.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Time Service Diagnostic Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\w32tm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\advapi32.dll
968ping -n 10 localhost C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\dnsapi.dll
1052ping -n 10 localhost C:\Windows\System32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\dnsapi.dll
1072chcp 65001C:\Windows\System32\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
Total events
35 382
Read events
35 348
Write events
34
Delete events
0

Modification events

(PID) Process:(5548) 9D62DA0AB950520600505B7FED03198F.exeKey:HKEY_CURRENT_USER\SOFTWARE\5f33641eddfc67e1bf1965f03f3f84c529c96281
Operation:writeName:9c0d2826f90278b2db33c6cb42a93649423b0e38
Value:
H4sIAAAAAAAEAIWOPQvCMBiE/4p0FomVVuOWGDs5VZ18HUL6gsV8kaSo/94gDh38mO7gHu7uVGzWAMeIIQIwrSdvK5waDNqUbaf1xcU0wzsW0zEuO9PbnN/M16xFlUsA9o+Y8AM2WmwHm3qDPLgrhp/kv0PMeyGTBNg5JTXAAY0HoKIuBSOM04pUJakJycqXzVaQxZyumlfd+QkPfKPUEAEAAA==
(PID) Process:(5548) 9D62DA0AB950520600505B7FED03198F.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:dwm
Value:
"C:\Users\admin\dwm.exe"
(PID) Process:(5548) 9D62DA0AB950520600505B7FED03198F.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:System
Value:
"C:\Users\admin\Recent\System.exe"
(PID) Process:(5548) 9D62DA0AB950520600505B7FED03198F.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:RuntimeBroker
Value:
"C:\Users\All Users\RuntimeBroker.exe"
(PID) Process:(5548) 9D62DA0AB950520600505B7FED03198F.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:dllhost
Value:
"C:\Users\All Users\dllhost.exe"
(PID) Process:(5548) 9D62DA0AB950520600505B7FED03198F.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:9D62DA0AB950520600505B7FED03198F
Value:
"C:\Users\admin\AppData\Local\Temp\9D62DA0AB950520600505B7FED03198F.exe"
(PID) Process:(4920) System.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\System_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4920) System.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\System_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4920) System.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\System_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4920) System.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\System_RASAPI32
Operation:writeName:FileTracingMask
Value:
Executable files
83
Suspicious files
2
Text files
47
Unknown types
0

Dropped files

PID
Process
Filename
Type
55489D62DA0AB950520600505B7FED03198F.exeC:\Users\admin\Desktop\qVDXdJbX.logexecutable
MD5:D8BF2A0481C0A17A634D066A711C12E9
SHA256:2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
55489D62DA0AB950520600505B7FED03198F.exeC:\Users\admin\Desktop\pxVXhVgN.logexecutable
MD5:E9CE850DB4350471A62CC24ACB83E859
SHA256:7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
55489D62DA0AB950520600505B7FED03198F.exeC:\Users\admin\Desktop\QMvCeolR.logexecutable
MD5:0B2AFABFAF0DD55AD21AC76FBF03B8A0
SHA256:DD4560987BD87EF3E6E8FAE220BA22AA08812E9743352523C846553BD99E4254
55489D62DA0AB950520600505B7FED03198F.exeC:\ProgramData\RuntimeBroker.exeexecutable
MD5:9D62DA0AB950520600505B7FED03198F
SHA256:BD0D735A8BD758E6A751DFB19F7A66CE95E403A9DF9688E2EEFDDAB4301FA3B2
55489D62DA0AB950520600505B7FED03198F.exeC:\Users\admin\Desktop\YqEsOiBy.logexecutable
MD5:F4B38D0F95B7E844DD288B441EBC9AAF
SHA256:AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
55489D62DA0AB950520600505B7FED03198F.exeC:\ProgramData\5940a34987c991text
MD5:1626A4942E593D834E0BB40CF51D2732
SHA256:D113DD00502260074EE51C0015A331BCC4A21AA74668F6AFA78B192F8091FFAA
55489D62DA0AB950520600505B7FED03198F.exeC:\Users\admin\AppData\Local\Temp\17e119e6c4af51text
MD5:504A25444CD80549781C94C2E991048C
SHA256:D8AA09C863E1F29261705358B8DF8930041A30D81BAAC7D673602B6487B0F064
55489D62DA0AB950520600505B7FED03198F.exeC:\Users\Public\Documents\dllhost.exeexecutable
MD5:9D62DA0AB950520600505B7FED03198F
SHA256:BD0D735A8BD758E6A751DFB19F7A66CE95E403A9DF9688E2EEFDDAB4301FA3B2
55489D62DA0AB950520600505B7FED03198F.exeC:\Users\admin\dwm.exeexecutable
MD5:9D62DA0AB950520600505B7FED03198F
SHA256:BD0D735A8BD758E6A751DFB19F7A66CE95E403A9DF9688E2EEFDDAB4301FA3B2
55489D62DA0AB950520600505B7FED03198F.exeC:\Users\admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe.exeexecutable
MD5:CF1A1B2A6F227D5B06AB0B3C8B88618B
SHA256:1FD250A499B2912B1ACEC31A03CAA32F1B328F2861E1383E94F23386F724FB36
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
40
DNS requests
16
Threats
18

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6656
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
—
—
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6656
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
—
—
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
5496
MoUsoCoreWorker.exe
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 2.19.11.120
  • 2.19.11.105
whitelisted
www.microsoft.com
  • 23.219.150.101
  • 184.30.21.171
whitelisted
google.com
  • 216.58.206.46
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.31.0
  • 20.190.159.64
  • 20.190.159.23
  • 40.126.31.2
  • 40.126.31.69
  • 40.126.31.1
  • 40.126.31.128
  • 40.126.31.129
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
rthgdfcx23weads.atwebpages.com
  • 185.176.43.98
malicious
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

PID
Process
Class
Message
4920
System.exe
Misc activity
ET HUNTING Suspicious HTTP POST to Free Web Host Atwebpages
1324
9D62DA0AB950520600505B7FED03198F.exe
Misc activity
ET HUNTING Suspicious HTTP POST to Free Web Host Atwebpages
6576
System.exe
Misc activity
ET HUNTING Suspicious HTTP POST to Free Web Host Atwebpages
2616
9D62DA0AB950520600505B7FED03198F.exe
Misc activity
ET HUNTING Suspicious HTTP POST to Free Web Host Atwebpages
5756
System.exe
Misc activity
ET HUNTING Suspicious HTTP POST to Free Web Host Atwebpages
6148
9D62DA0AB950520600505B7FED03198F.exe
Misc activity
ET HUNTING Suspicious HTTP POST to Free Web Host Atwebpages
7020
System.exe
Misc activity
ET HUNTING Suspicious HTTP POST to Free Web Host Atwebpages
5204
9D62DA0AB950520600505B7FED03198F.exe
Misc activity
ET HUNTING Suspicious HTTP POST to Free Web Host Atwebpages
2980
9D62DA0AB950520600505B7FED03198F.exe
Misc activity
ET HUNTING Suspicious HTTP POST to Free Web Host Atwebpages
5260
9D62DA0AB950520600505B7FED03198F.exe
Misc activity
ET HUNTING Suspicious HTTP POST to Free Web Host Atwebpages
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
9D62DA0AB950520600505B7FED03198F.exe