File name:

run.bat

Full analysis: https://app.any.run/tasks/1320c6ec-b6fc-4c50-869e-a3f6eb3e1861
Verdict: Malicious activity
Analysis date: July 06, 2025, 05:12:06
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
websocket
arch-doc
Indicators:
MIME: text/plain
File info: ASCII text, with CRLF line terminators
MD5:

19CADC6E0B2FDF2A952F5B4EFCA653AB

SHA1:

EFFE08BE1D17273BAA77E953A4FECA682E7D2863

SHA256:

D03B88FD411A25B37BCE6320B10186CD7620C5EBB632B2D41D4C6FAC6FFF1CD4

SSDEEP:

3:3J3ePq2ysI3TAKWyC3fsWMoR5LGSsWMn:3J3ePq2ysOTANfULozULn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executes as Windows Service

      • VSSVC.exe (PID: 1984)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 6668)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 6668)

    • Uses WMIC.EXE

      • CCDPlanet Launcher.exe (PID: 620)
      • CCDPlanet Launcher.exe (PID: 2288)

    • Application launched itself

      • CCDPlanet Launcher.exe (PID: 620)
      • CCDPlanet Launcher.exe (PID: 2288)

    • Uses WMIC.EXE to obtain network information

      • CCDPlanet Launcher.exe (PID: 620)
      • CCDPlanet Launcher.exe (PID: 2288)

  • INFO

    • Checks supported languages

      • curl.exe (PID: 5808)
      • msiexec.exe (PID: 6668)
      • CCDPlanet Launcher.exe (PID: 1564)
      • CCDPlanet Launcher.exe (PID: 1200)
      • CCDPlanet Launcher.exe (PID: 5104)
      • CCDPlanet Launcher.exe (PID: 620)
      • CCDPlanet Launcher.exe (PID: 4456)
      • CCDPlanet Launcher.exe (PID: 2288)
      • CCDPlanet Launcher.exe (PID: 2764)
      • CCDPlanet Launcher.exe (PID: 6980)

    • Execution of CURL command

      • cmd.exe (PID: 4788)

    • Manual execution by a user

      • Taskmgr.exe (PID: 7132)
      • Taskmgr.exe (PID: 2324)
      • msiexec.exe (PID: 5020)
      • powershell.exe (PID: 5980)
      • Taskmgr.exe (PID: 2292)
      • Taskmgr.exe (PID: 2732)

    • Reads the computer name

      • curl.exe (PID: 5808)
      • msiexec.exe (PID: 6668)
      • CCDPlanet Launcher.exe (PID: 620)
      • CCDPlanet Launcher.exe (PID: 1564)
      • CCDPlanet Launcher.exe (PID: 5104)
      • CCDPlanet Launcher.exe (PID: 6980)
      • CCDPlanet Launcher.exe (PID: 2288)
      • CCDPlanet Launcher.exe (PID: 2764)

    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 2324)
      • WMIC.exe (PID: 4944)
      • WMIC.exe (PID: 4932)
      • WMIC.exe (PID: 2732)
      • WMIC.exe (PID: 3800)
      • Taskmgr.exe (PID: 2292)

    • Manages system restore points

      • SrTasks.exe (PID: 6900)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6668)

    • The sample compiled with english language support

      • msiexec.exe (PID: 6668)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 6668)
      • CCDPlanet Launcher.exe (PID: 620)
      • CCDPlanet Launcher.exe (PID: 5104)
      • CCDPlanet Launcher.exe (PID: 2288)
      • CCDPlanet Launcher.exe (PID: 6980)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 6668)

    • Process checks computer location settings

      • CCDPlanet Launcher.exe (PID: 620)
      • CCDPlanet Launcher.exe (PID: 1200)
      • CCDPlanet Launcher.exe (PID: 2288)
      • CCDPlanet Launcher.exe (PID: 4456)

    • Reads Environment values

      • CCDPlanet Launcher.exe (PID: 620)
      • CCDPlanet Launcher.exe (PID: 2288)

    • Reads product name

      • CCDPlanet Launcher.exe (PID: 620)
      • CCDPlanet Launcher.exe (PID: 2288)

    • Drops encrypted JS script (Microsoft Script Encoder)

      • CCDPlanet Launcher.exe (PID: 620)
      • CCDPlanet Launcher.exe (PID: 2288)

    • Checks proxy server information

      • CCDPlanet Launcher.exe (PID: 620)
      • CCDPlanet Launcher.exe (PID: 2288)
      • slui.exe (PID: 2144)

    • Reads the machine GUID from the registry

      • CCDPlanet Launcher.exe (PID: 620)
      • CCDPlanet Launcher.exe (PID: 2288)

    • Create files in a temporary directory

      • CCDPlanet Launcher.exe (PID: 620)
      • CCDPlanet Launcher.exe (PID: 2288)

    • Checks current location (POWERSHELL)

      • powershell.exe (PID: 5980)

    • Reads the software policy settings

      • slui.exe (PID: 2144)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
173
Monitored processes
32
Malicious processes
0
Suspicious processes
3

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
620"C:\Users\admin\AppData\Local\Programs\ccdplanet\CCDPlanet Launcher.exe"C:\Users\admin\AppData\Local\Programs\ccdplanet\CCDPlanet Launcher.exe
msiexec.exe
User:
admin
Company:
GitHub, Inc.
Integrity Level:
MEDIUM
Description:
CCDPlanet Launcher
Exit code:
3221225477
Version:
1.0.0
Modules
Images
c:\users\admin\appdata\local\programs\ccdplanet\ccdplanet launcher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
1200"C:\Users\admin\AppData\Local\Programs\ccdplanet\CCDPlanet Launcher.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Roaming\ccdplanet" --app-path="C:\Users\admin\AppData\Local\Programs\ccdplanet\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1751777204505406 --launch-time-ticks=1579146477 --field-trial-handle=1932,i,2854095291907895644,10635157599531412211,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:1C:\Users\admin\AppData\Local\Programs\ccdplanet\CCDPlanet Launcher.exe—CCDPlanet Launcher.exe
User:
admin
Company:
GitHub, Inc.
Integrity Level:
LOW
Description:
CCDPlanet Launcher
Exit code:
0
Version:
1.0.0
Modules
Images
c:\users\admin\appdata\local\programs\ccdplanet\ccdplanet launcher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
1336\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WMIC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1564"C:\Users\admin\AppData\Local\Programs\ccdplanet\CCDPlanet Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\admin\AppData\Roaming\ccdplanet" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1932,i,2854095291907895644,10635157599531412211,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=ScreenAIOCREnabled,SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2C:\Users\admin\AppData\Local\Programs\ccdplanet\CCDPlanet Launcher.exe—CCDPlanet Launcher.exe
User:
admin
Company:
GitHub, Inc.
Integrity Level:
LOW
Description:
CCDPlanet Launcher
Exit code:
0
Version:
1.0.0
Modules
Images
c:\users\admin\appdata\local\programs\ccdplanet\ccdplanet launcher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
1984C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2128\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WMIC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2144C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2288"C:\Users\admin\AppData\Local\Programs\ccdplanet\CCDPlanet Launcher.exe"C:\Users\admin\AppData\Local\Programs\ccdplanet\CCDPlanet Launcher.exe
powershell.exe
User:
admin
Company:
GitHub, Inc.
Integrity Level:
MEDIUM
Description:
CCDPlanet Launcher
Version:
1.0.0
Modules
Images
c:\users\admin\appdata\local\programs\ccdplanet\ccdplanet launcher.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\dbghelp.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2292"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Manager
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
2324"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Manager
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
25 983
Read events
25 356
Write events
571
Delete events
56

Modification events

(PID) Process:(2324) Taskmgr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\TaskManager
Operation:delete valueName:Preferences
Value:
(PID) Process:(2324) Taskmgr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\TaskManager
Operation:writeName:Preferences
Value:
0D00000060000000600000006800000068000000E3010000DC010000000001000000008000000080D8010080DF010080000100016B00000034000000130300008C020000E80300000000000000000000000000000F000000010000000000000058AAEE82F77F00000000000000000000000000002E0100001E0000008990000000000000FF00000001015002000000000D0000000000000098AAEE82F77F00000000000000000000FFFFFFFF960000001E0000008B900000010000000000000000101001000000000300000000000000B0AAEE82F77F00000000000000000000FFFFFFFF780000001E0000008C900000020000000000000001021200000000000400000000000000C8AAEE82F77F00000000000000000000FFFFFFFF960000001E0000008D900000030000000000000000011001000000000200000000000000E8AAEE82F77F00000000000000000000FFFFFFFF320000001E0000008A90000004000000000000000008200100000000050000000000000000ABEE82F77F00000000000000000000FFFFFFFFC80000001E0000008E90000005000000000000000001100100000000060000000000000028ABEE82F77F00000000000000000000FFFFFFFF040100001E0000008F90000006000000000000000001100100000000070000000000000050ABEE82F77F00000000000000000000FFFFFFFF49000000490000009090000007000000000000000004250000000000080000000000000080AAEE82F77F00000000000000000000FFFFFFFF49000000490000009190000008000000000000000004250000000000090000000000000070ABEE82F77F00000000000000000000FFFFFFFF490000004900000092900000090000000000000000042508000000000A0000000000000088ABEE82F77F00000000000000000000FFFFFFFF4900000049000000939000000A0000000000000000042508000000000B00000000000000A8ABEE82F77F00000000000000000000FFFFFFFF490000004900000039A000000B0000000000000000042509000000001C00000000000000C8ABEE82F77F00000000000000000000FFFFFFFFC8000000490000003AA000000C0000000000000000011009000000001D00000000000000F0ABEE82F77F00000000000000000000FFFFFFFF64000000490000004CA000000D0000000000000000021508000000001E0000000000000010ACEE82F77F00000000000000000000FFFFFFFF64000000490000004DA000000E000000000000000002150800000000030000000A000000010000000000000058AAEE82F77F0000000000000000000000000000D70000001E0000008990000000000000FF00000001015002000000000400000000000000C8AAEE82F77F0000000000000000000001000000960000001E0000008D900000010000000000000001011000000000000300000000000000B0AAEE82F77F00000000000000000000FFFFFFFF640000001E0000008C900000020000000000000000021000000000000C0000000000000040ACEE82F77F0000000000000000000003000000640000001E00000094900000030000000000000001021000000000000D0000000000000068ACEE82F77F00000000000000000000FFFFFFFF640000001E00000095900000040000000000000000011001000000000E0000000000000090ACEE82F77F0000000000000000000005000000320000001E00000096900000050000000000000001042001000000000F00000000000000B8ACEE82F77F0000000000000000000006000000320000001E00000097900000060000000000000001042001000000001000000000000000D8ACEE82F77F0000000000000000000007000000460000001E00000098900000070000000000000001011001000000001100000000000000F8ACEE82F77F00000000000000000000FFFFFFFF640000001E0000009990000008000000000000000001100100000000060000000000000028ABEE82F77F0000000000000000000009000000040100001E0000008F9000000900000000000000010110010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000B000000010000000000000058AAEE82F77F0000000000000000000000000000D70000001E0000009E90000000000000FF0000000101500200000000120000000000000020ADEE82F77F00000000000000000000FFFFFFFF2D0000001E0000009B90000001000000000000000004200100000000140000000000000040ADEE82F77F00000000000000000000FFFFFFFF640000001E0000009D90000002000000000000000001100100000000130000000000000068ADEE82F77F00000000000000000000FFFFFFFF640000001E0000009C900000030000000000000000011001000000000300000000000000B0AAEE82F77F00000000000000000000FFFFFFFF640000001E0000008C90000004000000000000000102100000000000070000000000000050ABEE82F77F000000000000000000000500000049000000490000009090000005000000000000000104210000000000080000000000000080AAEE82F77F000000000000000000000600000049000000490000009190000006000000000000000104210000000000090000000000000070ABEE82F77F0000000000000000000007000000490000004900000092900000070000000000000001042108000000000A0000000000000088ABEE82F77F0000000000000000000008000000490000004900000093900000080000000000000001042108000000000B00000000000000A8ABEE82F77F0000000000000000000009000000490000004900000039A00000090000000000000001042109000000001C00000000000000C8ABEE82F77F000000000000000000000A00000064000000490000003AA000000A00000000000000000110090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000008000000010000000000000058AAEE82F77F0000000000000000000000000000C60000001E000000B090000000000000FF0000000101500200000000150000000000000088ADEE82F77F00000000000000000000FFFFFFFF6B0000001E000000B1900000010000000000000000042500000000001600000000000000B8ADEE82F77F00000000000000000000FFFFFFFF6B0000001E000000B2900000020000000000000000042500000000001800000000000000E0ADEE82F77F00000000000000000000FFFFFFFF6B0000001E000000B490000003000000000000000004250000000000170000000000000008AEEE82F77F00000000000000000000FFFFFFFF6B0000001E000000B390000004000000000000000004250000000000190000000000000040AEEE82F77F00000000000000000000FFFFFFFFA00000001E000000B5900000050000000000000000042001000000001A0000000000000070AEEE82F77F00000000000000000000FFFFFFFF7D0000001E000000B6900000060000000000000000042001000000001B00000000000000A0AEEE82F77F00000000000000000000FFFFFFFF7D0000001E000000B790000007000000000000000004200100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000DA00000000000000000000000000000000000000000000009D200000200000009100000064000000320000006400000050000000320000003200000028000000500000003C0000005000000050000000320000005000000050000000500000005000000050000000500000002800000050000000230000002300000023000000230000005000000050000000500000003200000032000000320000007800000078000000500000003C00000050000000500000009700000032000000780000003200000050000000500000005000000050000000000000000100000002000000030000000400000005000000060000000700000008000000090000000A0000000B0000000C0000000D0000000E0000000F000000100000001100000012000000130000001400000015000000160000001700000018000000190000001A0000001B0000001C0000001D0000001E0000001F000000200000002100000022000000230000002400000025000000260000002700000028000000290000002A0000002B0000002C00000000000000000000001F00000000000000B400000032000000D8000000640000006400000000000000000000000000000000000000000000000000000000000000000000000000000000000000DA000000000000000000000000000000000000009D200000200000009100000064000000320000009700000050000000320000003200000028000000500000003C000000500000005000000032000000500000005000000050000000500000005000000050000000500000002800000050000000230000002300000023000000230000005000000050000000500000003200000032000000320000007800000078000000500000003C0000005000000064000000780000003200000078000000780000003200000050000000500000005000000050000000C8000000000000000100000002000000030000000400000005000000060000000700000008000000090000000A0000000B0000000C0000000D0000000E0000000F000000100000001100000012000000130000001400000015000000160000001700000018000000190000001A0000001B0000001C0000001D0000001E0000001F000000200000002100000022000000230000002400000025000000260000002700000028000000290000002A0000002B0000002C0000002D0000002E0000002F00000000000000000000001F00000000000000B400000032000000D8000000640000006400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000002000000030000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000
(PID) Process:(6668) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
48000000000000008F7CF49834EEDB010C1A000010050000D50700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6668) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
48000000000000008F7CF49834EEDB010C1A000010050000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6668) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
480000000000000074DA159934EEDB010C1A000010050000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6668) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
480000000000000074DA159934EEDB010C1A000010050000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6668) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
4800000000000000423D189934EEDB010C1A000010050000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6668) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4800000000000000FC031D9934EEDB010C1A000010050000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(6668) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
4800000000000000303C759934EEDB010C1A000010100000E8030000010000000000000000000000B9AAE213AC0C7C418F018F4F88B0421A00000000000000000000000000000000
(PID) Process:(1984) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
48000000000000008F1B819934EEDB01C0070000F01A0000E80300000100000001000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
18
Suspicious files
208
Text files
117
Unknown types
0

Dropped files

PID
Process
Filename
Type
6668msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
6668msiexec.exeC:\Windows\Installer\17eec5.msi —
MD5:—
SHA256:—
6668msiexec.exeC:\Users\admin\AppData\Local\Programs\ccdplanet\CCDPlanet Launcher.exe —
MD5:—
SHA256:—
6668msiexec.exeC:\Users\admin\AppData\Local\Programs\ccdplanet\LICENSES.chromium.html —
MD5:—
SHA256:—
6668msiexec.exeC:\Users\admin\AppData\Local\Programs\ccdplanet\icudtl.dat —
MD5:—
SHA256:—
6668msiexec.exeC:\Users\admin\AppData\Local\Programs\ccdplanet\resources.pak —
MD5:—
SHA256:—
6668msiexec.exeC:\Users\admin\AppData\Local\Programs\ccdplanet\run.bat —
MD5:—
SHA256:—
6668msiexec.exeC:\Users\admin\AppData\Local\Programs\ccdplanet\resources\app.asar —
MD5:—
SHA256:—
6668msiexec.exeC:\Windows\Temp\~DFF1DED8BD76E31B37.TMPbinary
MD5:BF619EAC0CDF3F68D496EA9344137E8B
SHA256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
6668msiexec.exeC:\Users\admin\AppData\Local\Programs\ccdplanet\ffmpeg.dllexecutable
MD5:1B6E88CA461269EC6275E8E0F7A9D0A7
SHA256:457FBAB7ECF064E1ABC043C69BBEF7A5214FE9C2DEBE4B5A78D750931E7F5D0D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
67
DNS requests
29
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
764
lsass.exe
GET
200
104.18.21.213:80
http://e6.c.lencr.org/120.crl
unknown
binary
38.4 Kb
whitelisted
1268
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
814 b
whitelisted
1268
svchost.exe
GET
200
23.32.238.112:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
825 b
whitelisted
7060
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
DE
binary
471 b
whitelisted
1128
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
DE
binary
420 b
whitelisted
620
CCDPlanet Launcher.exe
GET
101
66.151.40.39:8080
http://strix-server.ru:8080/
US
—
—
unknown
1128
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
DE
binary
408 b
whitelisted
2288
CCDPlanet Launcher.exe
GET
101
66.151.40.39:8080
http://strix-server.ru:8080/
US
—
—
unknown
2940
svchost.exe
GET
200
2.18.161.41:80
http://x1.c.lencr.org/
DE
binary
734 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1352
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5808
curl.exe
66.151.40.39:443
uptime-de.strix-server.ru
INTERNAP-2BLK
US
unknown
764
lsass.exe
104.18.21.213:80
e6.c.lencr.org
CLOUDFLARENET
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
23.32.238.112:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 4.231.128.59
whitelisted
google.com
  • 142.250.186.46
whitelisted
uptime-de.strix-server.ru
  • 66.151.40.39
unknown
e6.c.lencr.org
  • 104.18.21.213
  • 104.18.20.213
whitelisted
launcher.msi
  • —
unknown
crl.microsoft.com
  • 23.32.238.112
  • 23.32.238.107
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
login.live.com
  • 20.190.160.20
  • 20.190.160.128
  • 40.126.32.74
  • 40.126.32.68
  • 20.190.160.67
  • 40.126.32.138
  • 20.190.160.3
  • 20.190.160.2
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
nexusrules.officeapps.live.com
  • 52.111.236.23
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Misc activity
ET INFO Level.io Agent P2P Connection Domain in DNS Lookup (global .stun .twilio .com)
620
CCDPlanet Launcher.exe
Not Suspicious Traffic
INFO [ANY.RUN] Websocket Upgrade Request
5104
CCDPlanet Launcher.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
5104
CCDPlanet Launcher.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
5104
CCDPlanet Launcher.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
5104
CCDPlanet Launcher.exe
Generic Protocol Command Decode
SURICATA QUIC failed decrypt
2288
CCDPlanet Launcher.exe
Not Suspicious Traffic
INFO [ANY.RUN] Websocket Upgrade Request
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
run.bat