File name:

eax.exe

Full analysis: https://app.any.run/tasks/667f7399-efc4-4cb8-8f94-e803dc67c401
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: April 16, 2025, 21:57:34
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections
MD5:

989AE3D195203B323AA2B3ADF04E9833

SHA1:

31A45521BC672ABCF64E50284CA5D4E6B3687DC8

SHA256:

D30D7676A3B4C91B77D403F81748EBF6B8824749DB5F860E114A8A204BCA5B8F

SSDEEP:

12288:85J5X487qJUtcWfkVJ6g5s/cD01oKHQyis2AePsr8nP712TBJ:s487pcZEgwcDpg1L2tbPR2tJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • UAC/LUA settings modification

      • eax.exe (PID: 4208)

    • Disables the Shutdown in the Start menu

      • eax.exe (PID: 4208)

    • Changes the login/logoff helper path in the registry

      • eax.exe (PID: 4208)

    • Steals credentials from Web Browsers

      • chrmstp.exe (PID: 5276)
      • setup.exe (PID: 5484)
      • chrome.exe (PID: 6932)

    • Actions looks like stealing of personal data

      • chrome.exe (PID: 6932)

    • Modifies files in the Chrome extension folder

      • chrome.exe (PID: 6932)

    • Executing a file with an untrusted certificate

      • FileSyncConfig.exe (PID: 8184)
      • OneDrive.exe (PID: 5684)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • eax.exe (PID: 1672)
      • ShellExperienceHost.exe (PID: 5064)
      • chrome.exe (PID: 6932)

    • Application launched itself

      • eax.exe (PID: 1672)
      • setup.exe (PID: 5552)
      • setup.exe (PID: 5484)
      • OneDriveSetup.exe (PID: 5780)

    • There is functionality for taking screenshot (YARA)

      • eax.exe (PID: 4208)

    • Executable content was dropped or overwritten

      • eax.exe (PID: 4208)
      • OneDriveSetup.exe (PID: 7148)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 4500)

    • Reads Microsoft Outlook installation path

      • FirstLogonAnim.exe (PID: 5116)

    • Reads Internet Explorer settings

      • FirstLogonAnim.exe (PID: 5116)

    • The process creates files with name similar to system file names

      • OneDriveSetup.exe (PID: 7148)

    • The process drops C-runtime libraries

      • OneDriveSetup.exe (PID: 7148)

    • Creates a software uninstall entry

      • OneDriveSetup.exe (PID: 7148)

    • Creates/Modifies COM task schedule object

      • OneDriveSetup.exe (PID: 7148)

    • Write to the desktop.ini file (may be used to cloak folders)

      • FileSyncConfig.exe (PID: 8184)

  • INFO

    • The sample compiled with english language support

      • eax.exe (PID: 1672)
      • eax.exe (PID: 4208)
      • OneDriveSetup.exe (PID: 7148)

    • Process checks computer location settings

      • eax.exe (PID: 1672)
      • setup.exe (PID: 5552)
      • chrome.exe (PID: 6932)

    • Checks supported languages

      • eax.exe (PID: 1672)
      • eax.exe (PID: 4208)
      • ShellExperienceHost.exe (PID: 5064)
      • PLUGScheduler.exe (PID: 4500)
      • winnt32.exe (PID: 3696)
      • winnt32.exe (PID: 4928)
      • winnt32.exe (PID: 2140)
      • winnt32.exe (PID: 3888)
      • winnt32.exe (PID: 5148)
      • setup.exe (PID: 5484)
      • winnt32.exe (PID: 5464)
      • setup.exe (PID: 5508)
      • setup.exe (PID: 5552)
      • winnt32.exe (PID: 5156)
      • winnt32.exe (PID: 5256)
      • chrmstp.exe (PID: 5276)
      • setup.exe (PID: 5572)
      • winnt32.exe (PID: 5668)
      • winnt32.exe (PID: 7956)
      • wab.exe (PID: 2248)
      • winnt32.exe (PID: 6048)
      • winnt32.exe (PID: 6896)
      • chrome.exe (PID: 6932)
      • winnt32.exe (PID: 5344)
      • FileSyncConfig.exe (PID: 8184)
      • OneDrive.exe (PID: 5684)

    • Reads the computer name

      • eax.exe (PID: 1672)
      • eax.exe (PID: 4208)
      • ShellExperienceHost.exe (PID: 5064)
      • setup.exe (PID: 5484)
      • setup.exe (PID: 5552)
      • chrmstp.exe (PID: 5276)
      • PLUGScheduler.exe (PID: 4500)
      • chrome.exe (PID: 6932)
      • OneDrive.exe (PID: 5684)

    • Creates files in the program directory

      • eax.exe (PID: 4208)
      • chrmstp.exe (PID: 5368)
      • chrmstp.exe (PID: 5276)
      • setup.exe (PID: 5484)
      • setup.exe (PID: 5552)
      • PLUGScheduler.exe (PID: 4500)
      • chrmstp.exe (PID: 6244)
      • chrmstp.exe (PID: 1552)

    • Creates files or folders in the user directory

      • eax.exe (PID: 4208)

    • Manual execution by a user

      • FirstLogonAnim.exe (PID: 5116)
      • winnt32.exe (PID: 3696)
      • winnt32.exe (PID: 2140)
      • winnt32.exe (PID: 3888)
      • winnt32.exe (PID: 5464)
      • winnt32.exe (PID: 5256)
      • winnt32.exe (PID: 6048)
      • winnt32.exe (PID: 7956)
      • winnt32.exe (PID: 5668)
      • winnt32.exe (PID: 6896)

    • Reads security settings of Internet Explorer

      • FirstLogonAnim.exe (PID: 5116)
      • unregmp2.exe (PID: 2248)
      • unregmp2.exe (PID: 848)
      • OneDriveSetup.exe (PID: 5780)
      • OneDriveSetup.exe (PID: 7148)

    • Application launched itself

      • chrmstp.exe (PID: 5276)
      • chrmstp.exe (PID: 5368)
      • chrome.exe (PID: 6932)
      • chrmstp.exe (PID: 6244)
      • chrmstp.exe (PID: 1552)

    • Reads Microsoft Office registry keys

      • setup.exe (PID: 5484)

    • Reads the software policy settings

      • OneDriveSetup.exe (PID: 5780)
      • OneDriveSetup.exe (PID: 7148)

    • Checks proxy server information

      • chrome.exe (PID: 6932)

    • Reads the machine GUID from the registry

      • chrome.exe (PID: 6932)
      • OneDrive.exe (PID: 5684)

    • The sample compiled with chinese language support

      • OneDriveSetup.exe (PID: 7148)

    • The sample compiled with portuguese language support

      • OneDriveSetup.exe (PID: 7148)

    • Reads CPU info

      • OneDrive.exe (PID: 5684)

    • Reads the time zone

      • OneDrive.exe (PID: 5684)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:11:29 09:09:24+00:00
ImageFileCharacteristics: Executable, 32-bit, No debug
PEType: PE32
LinkerVersion: 14.28
CodeSize: 15360
InitializedDataSize: 1832960
UninitializedDataSize: -
EntryPoint: 0x1c640e
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 6.6.6.6
ProductVersionNumber: 6.6.6.6
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Endermanch
FileDescription: Windows Customization Tool
FileVersion: 6.6.6.6
InternalName: WinCustomize.exe
LegalCopyright: Copyright (C) 2020
OriginalFileName: WinCustomize.exe
ProductName: Customization Tool
ProductVersion: 6.6.6.6
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
405
Monitored processes
85
Malicious processes
6
Suspicious processes
5

Behavior graph

Click at the process to see the details
start eax.exe no specs eax.exe sppextcomobj.exe no specs slui.exe no specs shellexperiencehost.exe no specs plugscheduler.exe no specs winnt32.exe no specs firstlogonanim.exe no specs winnt32.exe no specs unregmp2.exe no specs winnt32.exe no specs winnt32.exe no specs unregmp2.exe no specs winnt32.exe no specs winnt32.exe no specs unregmp2.exe no specs unregmp2.exe no specs winnt32.exe no specs chrmstp.exe chrmstp.exe no specs chrmstp.exe no specs chrmstp.exe no specs winnt32.exe no specs setup.exe setup.exe no specs setup.exe no specs setup.exe no specs winnt32.exe no specs fsquirt.exe no specs winnt32.exe no specs onedrivesetup.exe no specs winnt32.exe no specs wab.exe no specs onedrivesetup.exe winnt32.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrmstp.exe no specs chrmstp.exe no specs chrome.exe no specs chrmstp.exe no specs chrmstp.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winnt32.exe no specs filesyncconfig.exe no specs onedrive.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
428"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5532 --field-trial-handle=1920,i,14814460959523686273,2123729070429128568,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
Administrator
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
428"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=5340 --field-trial-handle=1920,i,14814460959523686273,2123729070429128568,262144 --variations-seed-version /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
Administrator
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
848e" /FirstLogonC:\Windows\SysWOW64\unregmp2.exe—winnt32.exe
User:
Administrator
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Windows Media Player Setup Utility
Exit code:
0
Version:
12.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\unregmp2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
1020"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5520 --field-trial-handle=1920,i,14814460959523686273,2123729070429128568,262144 --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
Administrator
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1196C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1208"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6600 --field-trial-handle=1920,i,14814460959523686273,2123729070429128568,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
Administrator
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1320"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5496 --field-trial-handle=1920,i,14814460959523686273,2123729070429128568,262144 --variations-seed-version /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
Administrator
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1552"C:\Program Files\Google\Chrome\Application\122.0.6261.70\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settingsC:\Program Files\Google\Chrome\Application\122.0.6261.70\Installer\chrmstp.exe—chrome.exe
User:
Administrator
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome Installer
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\122.0.6261.70\installer\chrmstp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1672"C:\Users\admin\AppData\Local\Temp\eax.exe" C:\Users\admin\AppData\Local\Temp\eax.exe—explorer.exe
User:
admin
Company:
Endermanch
Integrity Level:
MEDIUM
Description:
Windows Customization Tool
Exit code:
0
Version:
6.6.6.6
Modules
Images
c:\users\admin\appdata\local\temp\eax.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1812"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
23 833
Read events
23 580
Write events
232
Delete events
21

Modification events

(PID) Process:(4208) eax.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Operation:writeName:AutoAdminLogon
Value:
0
(PID) Process:(4208) eax.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Operation:writeName:DisableCAD
Value:
1
(PID) Process:(4208) eax.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:shutdownwithoutlogon
Value:
0
(PID) Process:(4208) eax.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
Operation:writeName:UseDefaultTile
Value:
1
(PID) Process:(4208) eax.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
Operation:writeName:DisableLogonBackgroundImage
Value:
1
(PID) Process:(4208) eax.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Keyboard Layout
Operation:writeName:Scancode Map
Value:
0000000000000000710000000000010000003B0000003C0000003D0000003E0000003F0000004000000041000000420000004300000044000000570000005800000037E000004600000052E0000047E0000049E0000051E000004FE0000053E0000048E000004BE0000050E000004DE00000520000005300000051000000500000004F0000004B0000004C0000004D0000004E0000004900000048000000470000004500000035E00000370000004A0000002900000002000000030000000400000005000000060000000700000008000000090000000A0000000B0000000C0000000D0000000F0000001000000011000000130000001600000017000000190000001A0000001B0000002B000000280000002700000026000000250000002400000022000000210000003A0000002A0000001D0000005BE00000380000002C0000002D0000002E0000002F0000003000000032000000330000003400000035000000360000001DE000005DE000005CE0000038E000005900000065E0000021E000006BE000005EE000005FE000006AE0000069E0000068E0000067E0000032E000006CE000006DE0000066E0000020E000002EE000002CE0000030E0000019E0000010E0000024E0000022E000000000
(PID) Process:(4208) eax.exeKey:HKEY_CURRENT_USER\Control Panel\Mouse
Operation:writeName:SwapMouseButtons
Value:
1
(PID) Process:(4208) eax.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:EnableLUA
Value:
0
(PID) Process:(4208) eax.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:DisableRegistryTools
Value:
1
(PID) Process:(4208) eax.exeKey:HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\System
Operation:writeName:DisableCMD
Value:
2
Executable files
222
Suspicious files
656
Text files
322
Unknown types
0

Dropped files

PID
Process
Filename
Type
4208eax.exeC:\Users\admin\AppData\Local\noescape.pngimage
MD5:9E655CFD3D501F1ED01D6A2E0DB0E744
SHA256:CF7B5334E06A13501821834CD1AEDB7C3306A543F7D8EC03D1F20BFAF9BED613
4208eax.exeC:\ProgramData\Microsoft\User Account Pictures\user.pngimage
MD5:96F17C361A25164E71716D5BB56CB3D8
SHA256:1025314EF977B5D07041B8B73E4ADBEA779E5E06096C3C66BD1F06FBBBA7FD1C
4208eax.exeC:\ProgramData\Microsoft\User Account Pictures\user-48.pngimage
MD5:C7572C5706CA8D652D6B87787AE7F5B2
SHA256:37C63EE5D26FB77F8E697FAEC3891673E40C449BF8411CFF806D852AE7506ADA
4208eax.exeC:\ProgramData\Microsoft\User Account Pictures\user-32.pngimage
MD5:5D572D54E293ACD90D5B8AD6036333DA
SHA256:4810DC6C101937DDE12D4581DE81E608EA144761D1307779DC6A256872330EDE
4208eax.exeC:\Users\Public\Desktop\Ⅸߔⵤ⫔⮤⢽٭஦Ⴞ⏎઒◾ত᜔ᇄ᡻␊⽁Ꮷ᭼ᖶ່⺛④⎮ᬬᰩኾ⇄binary
MD5:E49F0A8EFFA6380B4518A8064F6D240B
SHA256:8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
4208eax.exeC:\ProgramData\Microsoft\User Account Pictures\user.bmpimage
MD5:2AB3698B005B421349512142ED6B965E
SHA256:150E95DA6C1E09511241130DA0E376878F5E24E21C2A9DFE7FBCC1022660E29F
4208eax.exeC:\Users\Public\Desktop\ᨵᚨベ⚭⢙⿧⭸῍ᥧ⑒ℇዟ۷⁛┺ᢪ⵲⩨Ṍ♕⦬⋅ᇻ⁠ᩓ།὿ᚪṅ♓ࣛbinary
MD5:E49F0A8EFFA6380B4518A8064F6D240B
SHA256:8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
4208eax.exeC:\Users\Public\Desktop\ਠ߯ᖄᣱਅᡳ⚓⮕⒱バ⚚ነୈ⛲∛ᙡাᕹbinary
MD5:E49F0A8EFFA6380B4518A8064F6D240B
SHA256:8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
4208eax.exeC:\Users\Public\Desktop\ᖛ⎦ేཎዕతᎬᨉ⍃⾣᜙კຼ Ộᜫbinary
MD5:E49F0A8EFFA6380B4518A8064F6D240B
SHA256:8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
4208eax.exeC:\Users\Public\Desktop\┭ௐ⣥᐀ڼ⅐⠾ขՎᖵڇ⚇ᝍฯᮥンℷ៳ኢ❠᱘᛼⚖කᱨ⦮┢ޱⱼῊbinary
MD5:E49F0A8EFFA6380B4518A8064F6D240B
SHA256:8DBD06E9585C5A16181256C9951DBC65621DF66CEB22C8E3D2304477178BEE13
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
28
TCP/UDP connections
83
DNS requests
57
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.30:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5256
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5256
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5864
dllhost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5864
dllhost.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
784
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7628
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
4792
SearchApp.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1916
SystemSettings.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.216.77.30:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.132:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.216.77.30
  • 23.216.77.22
  • 23.216.77.8
  • 23.216.77.36
  • 23.216.77.6
  • 23.216.77.19
  • 2.16.241.12
  • 2.16.241.19
whitelisted
google.com
  • 142.250.186.174
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.132
  • 20.190.160.22
  • 20.190.160.66
  • 20.190.160.17
  • 40.126.32.136
  • 20.190.160.131
  • 20.190.160.65
  • 20.190.160.20
  • 20.190.160.64
  • 40.126.32.140
  • 20.190.160.5
  • 20.190.160.130
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
self.events.data.microsoft.com
  • 104.46.162.227
  • 13.69.239.78
whitelisted
officeclient.microsoft.com
  • 52.109.89.18
whitelisted
ecs.office.com
  • 52.123.129.14
  • 52.123.128.14
whitelisted
go.microsoft.com
  • 95.100.186.9
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
eax.exe