File name:

c425bfe0b07ed39ea376957c54f020733d441370e6cd6301b210fecc90cdd0ff

Full analysis: https://app.any.run/tasks/a989716e-5542-4332-a17d-25617b454857
Verdict: Malicious activity
Analysis date: April 29, 2025, 21:56:40
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections
MD5:

3067B5CBC1112DC918AE66E4CBCC52C3

SHA1:

14E92601D2E561E9F4A14039939691D2B6A983D5

SHA256:

C425BFE0B07ED39EA376957C54F020733D441370E6CD6301B210FECC90CDD0FF

SSDEEP:

12288:UQdWsfvA4YQcxwoFZXZOw9/UvRsXs+BbRwLZ000000000000000000000000000U:UpHFZXZOm/UJsXs8bRwL

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • c425bfe0b07ed39ea376957c54f020733d441370e6cd6301b210fecc90cdd0ff.exe (PID: 1512)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • c425bfe0b07ed39ea376957c54f020733d441370e6cd6301b210fecc90cdd0ff.exe (PID: 1512)

    • Executable content was dropped or overwritten

      • c425bfe0b07ed39ea376957c54f020733d441370e6cd6301b210fecc90cdd0ff.exe (PID: 1512)

    • Executes application which crashes

      • c425bfe0b07ed39ea376957c54f020733d441370e6cd6301b210fecc90cdd0ff.exe (PID: 1512)
      • mbkxjqcf.exe (PID: 5864)

    • Detected use of alternative data streams (AltDS)

      • svchost.exe (PID: 6644)

  • INFO

    • Reads the computer name

      • c425bfe0b07ed39ea376957c54f020733d441370e6cd6301b210fecc90cdd0ff.exe (PID: 1512)
      • mbkxjqcf.exe (PID: 5864)

    • Create files in a temporary directory

      • c425bfe0b07ed39ea376957c54f020733d441370e6cd6301b210fecc90cdd0ff.exe (PID: 1512)

    • Checks supported languages

      • c425bfe0b07ed39ea376957c54f020733d441370e6cd6301b210fecc90cdd0ff.exe (PID: 1512)
      • mbkxjqcf.exe (PID: 5864)

    • Process checks computer location settings

      • c425bfe0b07ed39ea376957c54f020733d441370e6cd6301b210fecc90cdd0ff.exe (PID: 1512)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:02:22 08:12:57+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 286720
InitializedDataSize: 69120
UninitializedDataSize: -
EntryPoint: 0x8597
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 61.0.0.0
ProductVersionNumber: 71.0.0.0
FileFlagsMask: 0x765a
FileFlags: (none)
FileOS: Unknown (0x326)
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: Unknown (0324)
CharacterSet: Unknown (14E2)
FileVersions: 21.41.85.6
InternalName: ChickenPranes
FileDescription: Micrar
OriginalFilenames: Odilemia
ProductVersions: 17.21.14.17
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
9
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start c425bfe0b07ed39ea376957c54f020733d441370e6cd6301b210fecc90cdd0ff.exe wusa.exe no specs wusa.exe mbkxjqcf.exe werfault.exe no specs svchost.exe no specs werfault.exe no specs sppextcomobj.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1228C:\WINDOWS\SysWOW64\WerFault.exe -u -p 1512 -s 696C:\Windows\SysWOW64\WerFault.exe—c425bfe0b07ed39ea376957c54f020733d441370e6cd6301b210fecc90cdd0ff.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1512"C:\Users\admin\AppData\Local\Temp\c425bfe0b07ed39ea376957c54f020733d441370e6cd6301b210fecc90cdd0ff.exe" C:\Users\admin\AppData\Local\Temp\c425bfe0b07ed39ea376957c54f020733d441370e6cd6301b210fecc90cdd0ff.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\appdata\local\temp\c425bfe0b07ed39ea376957c54f020733d441370e6cd6301b210fecc90cdd0ff.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msimg32.dll
4740"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5864"C:\Users\admin\mbkxjqcf.exe" /d"C:\Users\admin\AppData\Local\Temp\c425bfe0b07ed39ea376957c54f020733d441370e6cd6301b210fecc90cdd0ff.exe" /e600502100000007FC:\Users\admin\mbkxjqcf.exe
c425bfe0b07ed39ea376957c54f020733d441370e6cd6301b210fecc90cdd0ff.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225477
Modules
Images
c:\users\admin\mbkxjqcf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msimg32.dll
5892C:\WINDOWS\SysWOW64\WerFault.exe -u -p 5864 -s 584C:\Windows\SysWOW64\WerFault.exe—mbkxjqcf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
6132"C:\Windows\System32\wusa.exe" C:\Windows\SysWOW64\wusa.exe—c425bfe0b07ed39ea376957c54f020733d441370e6cd6301b210fecc90cdd0ff.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Update Standalone Installer
Exit code:
3221226540
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wusa.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6620C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6644svchost.exeC:\Windows\SysWOW64\svchost.exe—mbkxjqcf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Exit code:
3221225501
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
7084"C:\WINDOWS\SysWOW64\wusa.exe" C:\Windows\SysWOW64\wusa.exe
c425bfe0b07ed39ea376957c54f020733d441370e6cd6301b210fecc90cdd0ff.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Update Standalone Installer
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wusa.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
1 401
Read events
1 398
Write events
2
Delete events
1

Modification events

(PID) Process:(1512) c425bfe0b07ed39ea376957c54f020733d441370e6cd6301b210fecc90cdd0ff.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:yrvsuolv
Value:
"C:\Users\admin\mbkxjqcf.exe"
(PID) Process:(6644) svchost.exeKey:HKEY_CURRENT_USER\Control Panel\Buses
Operation:writeName:Config0
Value:
008DF43DA2E61F3D24EDB47D450DD49D084297DCE82E72BAA4C2638A2100251DA71F2512D3CC945D24EDB47D470DD49D024195DAF71261ADC06D04FDA6E22673BBC9154961CDA56B15D4834E7739E5A9644490BDB57822E8955F05C5F1B454758DF21D5904FFA46514DF824C773DE19D084295D9E13F4BB4C06D01FDA1F5377894D92B546AABFB5D2E9BD10F7934E2BD004C80D8B90775B3845C07DDF6BD6525C49C460734F5AE6E16E7D740273DE4AD541DC5D9A42C29ED945A72CAF7BE113D92CC497B34F5A51B12D881487138E1A85115B69DF12872E0945D03BBF2B8652CEEF2154539FDA46D14DD844D75048BFF1C10C48DB47D24ED945D3DA2A7F5692DD49A367842FAA3547B89CC40743DE3DF216BC3FB8D1267B4995D04C5F4BF665BDCA42B596DF0A46D13AFF13B734BDDC2065DC98DB47A569B942904F49BFE2420D49D437F4188D6692E9FD109793DE4AA2215C58CB44464EC995D04C5F4BD662BD0A4040F39FDA46D14DD844D7404A4AE591DC48DB47D24ED946444C9F9BD642AA6EB447B3CC7E63850D0844D734B95A9516BFDCDB57024ED932B0DBCF2CF5D6DD690440D338BAD1C12AFBD0D7730E4AF261BCD8DB47D1DAD905004CFF4BF642FD49F7E4F61B9A96A12D5863B074EED94141CC98DB60F22E4945D04F4B4BF692AD295467B478FA45454DE894D743DE4AD541DB5B4F47929EA935802CA87B8111794C1134E3EC794
(PID) Process:(6644) svchost.exeKey:HKEY_CURRENT_USER\Control Panel\Buses
Operation:delete valueName:Config1
Value:
Executable files
2
Suspicious files
1
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6644svchost.exeC:\Users\admin:.reposbinary
MD5:4DE7FDD9523C3DA921721419002C02A6
SHA256:1E27FC534E7866DA132EACDE01CB4D93836AFFE755A4C5FB3E3CE730AF128C2D
1512c425bfe0b07ed39ea376957c54f020733d441370e6cd6301b210fecc90cdd0ff.exeC:\Users\admin\mbkxjqcf.exeexecutable
MD5:2EFA2BB0C993A5A5270D8DC9EE342322
SHA256:4F8E061E96FA14BF41512399E1A88B3A1D487AAE6ED0DD26C74F605649D71ACA
1512c425bfe0b07ed39ea376957c54f020733d441370e6cd6301b210fecc90cdd0ff.exeC:\Users\admin\AppData\Local\Temp\wpiepjtq.exeexecutable
MD5:7CCED894D1B015FD385C5D0E82685C05
SHA256:CBF9C8A0C0CB3D3890FF24725584081BCA69496675BAC0A129895747C8E2455C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
20
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7048
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7048
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.16.168.124:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.3:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 2.16.168.124
  • 2.16.168.114
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 2.23.246.101
whitelisted
google.com
  • 142.250.184.238
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.31.3
  • 40.126.31.71
  • 40.126.31.2
  • 40.126.31.1
  • 40.126.31.69
  • 40.126.31.131
  • 20.190.159.131
  • 20.190.159.71
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
c425bfe0b07ed39ea376957c54f020733d441370e6cd6301b210fecc90cdd0ff