File name:

c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455

Full analysis: https://app.any.run/tasks/27bbfe36-aab9-4d96-ac61-39ea31939a8f
Verdict: Malicious activity
Threats:

Crypto mining malware is a resource-intensive threat that infiltrates computers with the purpose of mining cryptocurrencies. This type of threat can be deployed either on an infected machine or a compromised website. In both cases the miner will utilize the computing power of the device and its network bandwidth.

Malware Trends Tracker     >>>
Analysis date: May 10, 2025, 06:06:32
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
autoit
winring0x64-sys
vuln-driver
themida
telegram
evasion
miner
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 12 sections
MD5:

608E6BC28C8DC492A1BBE983962B78FD

SHA1:

79DD9D133A4257E03127D31888E9E085ED8CBF59

SHA256:

C65EA1C461F9189510633DDD67C93CE23E84D4D81B56C8CA78553D0DEC861455

SSDEEP:

196608:51/kEaK0GvltOA7/g40GerP2o6w55IKsyLPuvfkSqlf1jm:5dkEaK0GjOAz9LWenw5hTykSef1jm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Vulnerable driver has been detected

      • Packs.exe (PID: 5964)

    • MINER has been detected (SURICATA)

      • MicrosoftHost.exe (PID: 4004)

    • Connects to the CnC server

      • MicrosoftHost.exe (PID: 4004)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe (PID: 2140)
      • Packs.exe (PID: 5964)

    • Reads the BIOS version

      • c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe (PID: 2140)
      • audiodg.exe (PID: 1228)

    • Starts a Microsoft application from unusual location

      • c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe (PID: 2140)

    • Detected use of alternative data streams (AltDS)

      • c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe (PID: 2140)

    • Process uses IPCONFIG to clear DNS cache

      • cmd.exe (PID: 4228)

    • Potential Corporate Privacy Violation

      • c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe (PID: 2140)
      • svchost.exe (PID: 2196)
      • MicrosoftHost.exe (PID: 4004)
      • audiodg.exe (PID: 1228)

    • Reads security settings of Internet Explorer

      • c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe (PID: 2140)
      • audiodg.exe (PID: 1228)

    • Starts CMD.EXE for commands execution

      • c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe (PID: 2140)
      • AppHost.exe (PID: 4152)

    • Executable content was dropped or overwritten

      • c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe (PID: 2140)
      • Packs.exe (PID: 5964)

    • The process creates files with name similar to system file names

      • Packs.exe (PID: 5964)

    • Drops a system driver (possible attempt to evade defenses)

      • Packs.exe (PID: 5964)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 6148)
      • cmd.exe (PID: 5376)
      • cmd.exe (PID: 6872)
      • cmd.exe (PID: 2392)
      • cmd.exe (PID: 968)
      • cmd.exe (PID: 2316)
      • cmd.exe (PID: 2088)
      • cmd.exe (PID: 968)
      • cmd.exe (PID: 2108)
      • cmd.exe (PID: 1224)
      • cmd.exe (PID: 3888)
      • cmd.exe (PID: 4688)
      • cmd.exe (PID: 6668)
      • cmd.exe (PID: 1108)
      • cmd.exe (PID: 1132)
      • cmd.exe (PID: 5124)
      • cmd.exe (PID: 4980)
      • cmd.exe (PID: 4188)
      • cmd.exe (PID: 864)
      • cmd.exe (PID: 5744)
      • cmd.exe (PID: 1280)
      • cmd.exe (PID: 4004)
      • cmd.exe (PID: 1108)
      • cmd.exe (PID: 6048)
      • cmd.exe (PID: 1240)
      • cmd.exe (PID: 4180)
      • cmd.exe (PID: 6344)
      • cmd.exe (PID: 1312)
      • cmd.exe (PID: 6136)
      • cmd.exe (PID: 5800)
      • cmd.exe (PID: 5960)
      • cmd.exe (PID: 7020)
      • cmd.exe (PID: 4408)
      • cmd.exe (PID: 2980)
      • cmd.exe (PID: 5112)
      • cmd.exe (PID: 2644)
      • cmd.exe (PID: 5936)
      • cmd.exe (PID: 1628)
      • cmd.exe (PID: 7012)
      • cmd.exe (PID: 1012)
      • cmd.exe (PID: 4996)
      • cmd.exe (PID: 6004)
      • cmd.exe (PID: 3768)
      • cmd.exe (PID: 3140)
      • cmd.exe (PID: 6388)
      • cmd.exe (PID: 5376)
      • cmd.exe (PID: 5744)
      • cmd.exe (PID: 6620)
      • cmd.exe (PID: 4620)
      • cmd.exe (PID: 2108)
      • cmd.exe (PID: 1244)
      • cmd.exe (PID: 6372)
      • cmd.exe (PID: 2236)
      • cmd.exe (PID: 1240)
      • cmd.exe (PID: 6344)
      • cmd.exe (PID: 4180)
      • cmd.exe (PID: 5200)
      • cmd.exe (PID: 5744)
      • cmd.exe (PID: 1348)
      • cmd.exe (PID: 2108)
      • cmd.exe (PID: 5608)
      • cmd.exe (PID: 7020)
      • cmd.exe (PID: 1628)
      • cmd.exe (PID: 2084)
      • cmd.exe (PID: 3140)
      • cmd.exe (PID: 5064)
      • cmd.exe (PID: 5744)
      • cmd.exe (PID: 2552)
      • cmd.exe (PID: 6768)
      • cmd.exe (PID: 1324)
      • cmd.exe (PID: 4688)
      • cmd.exe (PID: 6488)
      • cmd.exe (PID: 6344)
      • cmd.exe (PID: 1180)
      • cmd.exe (PID: 920)
      • cmd.exe (PID: 2432)
      • cmd.exe (PID: 208)
      • cmd.exe (PID: 2108)
      • cmd.exe (PID: 7020)
      • cmd.exe (PID: 5384)
      • cmd.exe (PID: 4212)

    • The process verifies whether the antivirus software is installed

      • c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe (PID: 2140)
      • icacls.exe (PID: 5668)
      • icacls.exe (PID: 1280)
      • icacls.exe (PID: 1328)
      • icacls.exe (PID: 5680)
      • icacls.exe (PID: 664)
      • icacls.exe (PID: 6388)
      • icacls.exe (PID: 1240)
      • icacls.exe (PID: 5936)
      • icacls.exe (PID: 6372)
      • icacls.exe (PID: 7156)
      • icacls.exe (PID: 736)
      • icacls.exe (PID: 5576)
      • icacls.exe (PID: 5728)
      • icacls.exe (PID: 2984)
      • icacls.exe (PID: 1300)
      • icacls.exe (PID: 5736)
      • icacls.exe (PID: 5112)
      • icacls.exe (PID: 1244)
      • icacls.exe (PID: 744)

    • Found strings related to reading or modifying Windows Defender settings

      • c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe (PID: 2140)

    • Checks for external IP

      • c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe (PID: 2140)
      • svchost.exe (PID: 2196)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe (PID: 2140)

    • Connects to unusual port

      • MicrosoftHost.exe (PID: 4004)

  • INFO

    • Reads mouse settings

      • c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe (PID: 2140)
      • audiodg.exe (PID: 1228)

    • The sample compiled with english language support

      • c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe (PID: 2140)
      • Packs.exe (PID: 5964)

    • Checks supported languages

      • c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe (PID: 2140)
      • Packs.exe (PID: 5964)
      • audiodg.exe (PID: 1228)
      • AppHost.exe (PID: 4152)
      • MicrosoftHost.exe (PID: 4004)

    • Reads the computer name

      • c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe (PID: 2140)
      • Packs.exe (PID: 5964)
      • MicrosoftHost.exe (PID: 4004)
      • audiodg.exe (PID: 1228)

    • Creates files in the program directory

      • c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe (PID: 2140)
      • Packs.exe (PID: 5964)

    • Checks proxy server information

      • c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe (PID: 2140)
      • audiodg.exe (PID: 1228)

    • Create files in a temporary directory

      • c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe (PID: 2140)

    • The process uses AutoIt

      • c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe (PID: 2140)

    • Creates files or folders in the user directory

      • c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe (PID: 2140)
      • audiodg.exe (PID: 1228)

    • Reads product name

      • c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe (PID: 2140)

    • Reads the machine GUID from the registry

      • c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe (PID: 2140)
      • audiodg.exe (PID: 1228)

    • Reads Environment values

      • c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe (PID: 2140)

    • Themida protector has been detected

      • c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe (PID: 2140)

    • The sample compiled with japanese language support

      • Packs.exe (PID: 5964)

    • Reads the software policy settings

      • c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe (PID: 2140)

    • Reads CPU info

      • c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe (PID: 2140)
      • audiodg.exe (PID: 1228)

    • Attempting to use instant messaging service

      • svchost.exe (PID: 2196)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:04:28 07:28:21+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.16
CodeSize: 734208
InitializedDataSize: 16238080
UninitializedDataSize: -
EntryPoint: 0x17e5478
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 25.0.0.2025
ProductVersionNumber: 25.0.0.2025
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: COM Surrogate
FileVersion: 25.0.0.2025
InternalName: dllhost.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: dllhost.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 25.0.0.2025
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
400
Monitored processes
268
Malicious processes
5
Suspicious processes
2

Behavior graph

Click at the process to see the details
start c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe cmd.exe no specs conhost.exe no specs ipconfig.exe no specs cmd.exe no specs conhost.exe no specs gpupdate.exe no specs THREAT packs.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs icacls.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs audiodg.exe apphost.exe no specs conhost.exe no specs cmd.exe no specs #MINER microsofthost.exe slui.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
208C:\WINDOWS\system32\cmd.exe /c icacls "C:\Program Files\EnigmaSoft" /deny "%username%":(OI)(CI)(F)C:\Windows\System32\cmd.exe—c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
300icacls "c:\Program Files\Transmission" /deny "admin":(OI)(CI)(F)C:\Windows\System32\icacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
664icacls "C:\Program Files (x86)\AVG" /deny "admin":(OI)(CI)(F)C:\Windows\System32\icacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
668C:\WINDOWS\system32\cmd.exe " /c " & "icacls "C:\KVRT2020_Data" /deny "%username%":(OI)(CI)(F)C:\Windows\System32\cmd.exe—c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
680\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
680\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
680icacls "C:\Program Files\Process Hacker 2" /deny "admin":(OI)(CI)(F)C:\Windows\System32\icacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
736icacls "C:\Program Files\Bitdefender Agent" /deny "admin":(OI)(CI)(F)C:\Windows\System32\icacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
744\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
744icacls "C:\Program Files (x86)\Panda Security" /deny "admin":(OI)(CI)(F)C:\Windows\System32\icacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
6 224
Read events
6 218
Write events
6
Delete events
0

Modification events

(PID) Process:(2140) c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2140) c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2140) c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1228) audiodg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1228) audiodg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1228) audiodg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
6
Suspicious files
6
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
2140c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exeC:\Users\admin\AppData\Local\Temp\autFFED.tmpexecutable
MD5:EB03DB9CC7EC1E30171823523C5859B3
SHA256:3061ED1FF6063B4E82D2D835C6DEC87C755225995726DB0B812F9C613DB25020
5964Packs.exeC:\ProgramData\WindowsTask\MicrosoftHost.exeexecutable
MD5:7C4884F067E34D59C685665A7A8EB8DD
SHA256:12A209356DB82DC1FC47DA0A9A146096F6A9E7CD99E2EC71D513F394B57FC5F8
2140c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\CX1[1].htmtext
MD5:DB2511F83DABEDE89FF70C6DB3D27CD1
SHA256:C417934FB242D7BFA427E2E900B003CD17B3485FCA8ED0520CAE4CC9B53CF1D2
1228audiodg.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\durum[1].htmtext
MD5:98B3551BF4C678ADAC8CC65F4B892D1A
SHA256:19E284911F4377A5A64B40A4F5CD3D7D6F06358562C1322269C9424AFE8ACF9D
2140c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\list[1].txttext
MD5:F69C54FC9E97F4CC76749B0C0E077A16
SHA256:103D023B4235018CC1FD9D67FBE7BD77FF9F5B8D89A2958DF9B5D1E82C31463B
5964Packs.exeC:\ProgramData\WindowsTask\audiodg.exeexecutable
MD5:0415EA19154DAF968C4080B9954C29E3
SHA256:5A497DB8CBF707BA0C5EAE9D92327AF234421FFF7A8075115F140D4DA1D6B8A7
2140c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:4A90329071AE30B759D279CCA342B0A6
SHA256:FB6A7C3EDCD7B97FABC18855102A39FC4D6D3F82C0FDD39B1667807B71B9C49B
5964Packs.exeC:\ProgramData\WindowsTask\WinRing0x64.sysexecutable
MD5:0C0195C48B6B8582FA6F6373032118DA
SHA256:11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
2140c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:1FBB37F79B317A9A248E7C4CE4F5BAC5
SHA256:6FB1B8E593CB0388F67EAD35313A230F524657317EA86271B3A97362E5EC6AD9
2140c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exeC:\Users\admin\AppData\Local\Temp\autB9C8.tmpbinary
MD5:52B38C5025C2ECFA9A101E97CC48BFDF
SHA256:D35F48DF7A4B20E7213B9530A9401F52D8EEEF833EFD0836583A841835BAFDC1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
31
DNS requests
27
Threats
21

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2140
c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe
GET
302
162.255.119.99:80
http://ftpsystem.xyz/magicx.html
unknown
—
—
malicious
2140
c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe
GET
436
91.195.240.19:80
http://www.ftpsystem.xyz/magicx.html
unknown
—
—
malicious
2140
c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe
GET
200
172.67.137.115:80
http://magicam.xyz/magicx/durum.html
unknown
—
—
—
2140
c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe
GET
200
172.67.137.115:80
http://magicam.xyz/list.txt
unknown
—
—
—
2140
c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe
GET
200
172.67.137.115:80
http://magicam.xyz/magicx/CX1.html
unknown
—
—
—
856
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2140
c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455.exe
GET
200
142.250.184.195:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1196
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 216.58.212.174
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.130
  • 40.126.32.68
  • 20.190.160.131
  • 20.190.160.22
  • 20.190.160.66
  • 40.126.32.74
  • 20.190.160.67
  • 40.126.32.138
  • 40.126.31.1
  • 20.190.159.131
  • 40.126.31.130
  • 40.126.31.129
  • 20.190.159.0
  • 40.126.31.3
  • 40.126.31.67
  • 20.190.159.73
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
ftpsystem.xyz
  • 162.255.119.99
malicious
www.ftpsystem.xyz
  • 91.195.240.19
malicious
magicam.xyz
  • 172.67.137.115
  • 104.21.78.204
unknown

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET INFO Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile
—
—
Potential Corporate Privacy Violation
ET INFO Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile
—
—
Potential Corporate Privacy Violation
ET INFO Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile
—
—
Potential Corporate Privacy Violation
ET INFO Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile
—
—
Potential Corporate Privacy Violation
ET INFO Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile
—
—
Misc activity
ET INFO Namecheap URL Forward
—
—
Potential Corporate Privacy Violation
POLICY [ANY.RUN] IP Checker (iplogger .co)
—
—
A Network Trojan was detected
ET MALWARE System Information Being Sent in User-Agent
—
—
Misc activity
SUSPICIOUS [ANY.RUN] Possible sending an external IP address to Telegram
—
—
Misc activity
ET HUNTING Telegram API Domain in DNS Lookup
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
c65ea1c461f9189510633ddd67c93ce23e84d4d81b56c8ca78553d0dec861455