File name:

c704d1128500fb0c5ab5c9bb66c8cded0a5169562799b7608c9d4a871ceb3262

Full analysis: https://app.any.run/tasks/93fb22d7-a487-48a8-a43c-5edb0874c2b2
Verdict: Malicious activity
Analysis date: April 29, 2025, 23:06:22
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
tofsee
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

D30FD3422653D59CDF5C2AB3B041C91C

SHA1:

FE1ABCE3E2622844BA89C254D362642366AE277E

SHA256:

C704D1128500FB0C5AB5C9BB66C8CDED0A5169562799B7608C9D4A871CEB3262

SSDEEP:

3072:Cb2ThLYV80/gEcm5DyQKzFGSy2oVH2EdRwAcdi8xLK2BMVVVViVCVfM:tThLigEcWvyS2Av8FK2BMVVVViVCV0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • TOFSEE has been detected (YARA)

      • svchost.exe (PID: 7796)

    • Changes the autorun value in the registry

      • c704d1128500fb0c5ab5c9bb66c8cded0a5169562799b7608c9d4a871ceb3262.exe (PID: 7472)

  • SUSPICIOUS

    • Detected use of alternative data streams (AltDS)

      • svchost.exe (PID: 7796)

    • Executable content was dropped or overwritten

      • c704d1128500fb0c5ab5c9bb66c8cded0a5169562799b7608c9d4a871ceb3262.exe (PID: 7472)

    • Reads security settings of Internet Explorer

      • c704d1128500fb0c5ab5c9bb66c8cded0a5169562799b7608c9d4a871ceb3262.exe (PID: 7472)

    • Connects to SMTP port

      • svchost.exe (PID: 7796)

  • INFO

    • Create files in a temporary directory

      • c704d1128500fb0c5ab5c9bb66c8cded0a5169562799b7608c9d4a871ceb3262.exe (PID: 7472)

    • Checks supported languages

      • c704d1128500fb0c5ab5c9bb66c8cded0a5169562799b7608c9d4a871ceb3262.exe (PID: 7472)
      • uzjeykhj.exe (PID: 7768)

    • Reads the computer name

      • c704d1128500fb0c5ab5c9bb66c8cded0a5169562799b7608c9d4a871ceb3262.exe (PID: 7472)
      • uzjeykhj.exe (PID: 7768)

    • Process checks computer location settings

      • c704d1128500fb0c5ab5c9bb66c8cded0a5169562799b7608c9d4a871ceb3262.exe (PID: 7472)

    • Reads the software policy settings

      • slui.exe (PID: 7536)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:04:13 04:33:08+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 30720
InitializedDataSize: 97280
UninitializedDataSize: -
EntryPoint: 0x7be0
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 28.0.0.0
ProductVersionNumber: 28.0.0.0
FileFlagsMask: 0x003f
FileFlags: Debug
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
7
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start c704d1128500fb0c5ab5c9bb66c8cded0a5169562799b7608c9d4a871ceb3262.exe sppextcomobj.exe no specs slui.exe wusa.exe no specs wusa.exe uzjeykhj.exe no specs #TOFSEE svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
7472"C:\Users\admin\AppData\Local\Temp\c704d1128500fb0c5ab5c9bb66c8cded0a5169562799b7608c9d4a871ceb3262.exe" C:\Users\admin\AppData\Local\Temp\c704d1128500fb0c5ab5c9bb66c8cded0a5169562799b7608c9d4a871ceb3262.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\c704d1128500fb0c5ab5c9bb66c8cded0a5169562799b7608c9d4a871ceb3262.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7504C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7536"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7680"C:\Windows\System32\wusa.exe" C:\Windows\SysWOW64\wusa.exe—c704d1128500fb0c5ab5c9bb66c8cded0a5169562799b7608c9d4a871ceb3262.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Update Standalone Installer
Exit code:
3221226540
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wusa.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7744"C:\WINDOWS\SysWOW64\wusa.exe" C:\Windows\SysWOW64\wusa.exe
c704d1128500fb0c5ab5c9bb66c8cded0a5169562799b7608c9d4a871ceb3262.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Update Standalone Installer
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wusa.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
7768"C:\Users\admin\uzjeykhj.exe" /d"C:\Users\admin\AppData\Local\Temp\c704d1128500fb0c5ab5c9bb66c8cded0a5169562799b7608c9d4a871ceb3262.exe" /e550302100000007FC:\Users\admin\uzjeykhj.exe—c704d1128500fb0c5ab5c9bb66c8cded0a5169562799b7608c9d4a871ceb3262.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\uzjeykhj.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7796svchost.exeC:\Windows\SysWOW64\svchost.exe
uzjeykhj.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
Total events
1 180
Read events
1 179
Write events
1
Delete events
0

Modification events

(PID) Process:(7472) c704d1128500fb0c5ab5c9bb66c8cded0a5169562799b7608c9d4a871ceb3262.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:klutjvne
Value:
"C:\Users\admin\uzjeykhj.exe"
Executable files
2
Suspicious files
0
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
7472c704d1128500fb0c5ab5c9bb66c8cded0a5169562799b7608c9d4a871ceb3262.exeC:\Users\admin\AppData\Local\Temp\wblgamjl.exeexecutable
MD5:4D6A8E24145827078141EBCEB13B5DD2
SHA256:C6337CF39D9B95C73983B2627682CE5A97B3A843CAF76E842609E0187B56CCF3
7472c704d1128500fb0c5ab5c9bb66c8cded0a5169562799b7608c9d4a871ceb3262.exeC:\Users\admin\uzjeykhj.exeexecutable
MD5:8CF7307617F8D11BBEC8BEC184726926
SHA256:5D00AF533892DD200DEE4FBE52C451B1ED6D1EB89C4F4F9C44741CBAE3FC10A2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
21
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7996
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
104.119.109.218:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7996
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6268
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
104.119.109.218:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7796
svchost.exe
13.107.246.59:80
microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7796
svchost.exe
52.101.8.32:25
microsoft-com.mail.protection.outlook.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 172.217.18.14
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
whitelisted
www.microsoft.com
  • 104.119.109.218
  • 23.52.120.96
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
microsoft.com
  • 13.107.246.59
whitelisted
microsoft-com.mail.protection.outlook.com
  • 52.101.8.32
  • 52.101.9.14
  • 52.101.9.5
  • 52.101.41.6
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted
yahoo.com
  • —
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
c704d1128500fb0c5ab5c9bb66c8cded0a5169562799b7608c9d4a871ceb3262