File name:

Oxygen Virus.exe

Full analysis: https://app.any.run/tasks/88299692-5505-4073-8542-f157f7edd9a8
Verdict: Malicious activity
Analysis date: May 17, 2025, 18:02:22
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 6 sections
MD5:

4B5CDBF3F04D76C07A1B4436430A51C3

SHA1:

8AC95AF8A700F7436A87B7A97DF24FC17F406B31

SHA256:

D53581041CF4C5C6BB99D5F0BFA352ABC42F47CB54689D982B79CF25129C4982

SSDEEP:

6144:TE+9PPJwWcDaKGsbSo0Af6ltI2VwxiTiIPI30fWpb6GTu:TEMPJPcDaKd10Af6ltIKwxiTi/30fM6G

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to autorun other applications

      • cmd.exe (PID: 7428)

    • Disables command prompt

      • Oxygen Virus.exe (PID: 7360)

    • Disables task manager

      • Oxygen Virus.exe (PID: 7360)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • StartMenuExperienceHost.exe (PID: 6112)
      • Oxygen Virus.exe (PID: 5364)

    • Reads the date of Windows installation

      • Oxygen Virus.exe (PID: 5364)
      • StartMenuExperienceHost.exe (PID: 6112)

    • Starts itself from another location

      • Oxygen Virus.exe (PID: 5364)

    • Executable content was dropped or overwritten

      • Oxygen Virus.exe (PID: 5364)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 4136)
      • Oxygen Virus.exe (PID: 4156)

    • Starts CMD.EXE for commands execution

      • Oxygen Virus.exe (PID: 7360)

  • INFO

    • Checks supported languages

      • Oxygen Virus.exe (PID: 5364)
      • SearchApp.exe (PID: 7452)
      • StartMenuExperienceHost.exe (PID: 6112)
      • TextInputHost.exe (PID: 4620)
      • Oxygen Virus.exe (PID: 7360)

    • Reads the machine GUID from the registry

      • SearchApp.exe (PID: 7452)

    • Process checks computer location settings

      • StartMenuExperienceHost.exe (PID: 6112)
      • Oxygen Virus.exe (PID: 5364)
      • SearchApp.exe (PID: 7452)

    • Reads the computer name

      • Oxygen Virus.exe (PID: 5364)
      • TextInputHost.exe (PID: 4620)
      • Oxygen Virus.exe (PID: 7360)
      • StartMenuExperienceHost.exe (PID: 6112)
      • SearchApp.exe (PID: 7452)

    • Reads the software policy settings

      • SearchApp.exe (PID: 7452)

    • Reads Environment values

      • SearchApp.exe (PID: 7452)

    • Checks proxy server information

      • SearchApp.exe (PID: 7452)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:05:17 17:53:31+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.43
CodeSize: 158720
InitializedDataSize: 104960
UninitializedDataSize: -
EntryPoint: 0x9820
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
277
Monitored processes
16
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start oxygen virus.exe conhost.exe no specs sppextcomobj.exe no specs slui.exe no specs oxygen virus.exe no specs conhost.exe no specs cmd.exe schtasks.exe no specs textinputhost.exe no specs startmenuexperiencehost.exe no specs searchapp.exe mobsync.exe no specs plugscheduler.exe no specs oxygen virus.exe no specs conhost.exe no specs oxygen virus.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
4136"C:\Program Files\RUXIM\PLUGscheduler.exe"C:\Program Files\RUXIM\PLUGScheduler.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Update LifeCycle Component Scheduler
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\plugscheduler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
4156"C:\WINDOWS\system32\Oxygen Virus.exe" --autorunC:\Windows\System32\Oxygen Virus.exe—svchost.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\windows\system32\oxygen virus.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4200"C:\Users\admin\AppData\Local\Temp\Oxygen Virus.exe" C:\Users\admin\AppData\Local\Temp\Oxygen Virus.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\oxygen virus.exe
c:\windows\system32\ntdll.dll
4200\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Oxygen Virus.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4256\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Oxygen Virus.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4620"C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Exit code:
0
Version:
123.26505.0.0
Modules
Images
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\vcruntime140_app.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
5364"C:\Users\admin\AppData\Local\Temp\Oxygen Virus.exe" C:\Users\admin\AppData\Local\Temp\Oxygen Virus.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\oxygen virus.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
6112"C:\WINDOWS\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mcaC:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\systemapps\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\startmenuexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wincorlib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
7212C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7244"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
10 030
Read events
9 914
Write events
113
Delete events
3

Modification events

(PID) Process:(6112) StartMenuExperienceHost.exeKey:\REGISTRY\A\{4a47ff36-20db-cea5-2acb-796e3105d5a7}\LocalState\DataCorruptionRecovery
Operation:writeName:InitializationAttemptCount
Value:
01000000D61FC4EC55C7DB01
(PID) Process:(7452) SearchApp.exeKey:\REGISTRY\A\{b712b650-73ed-df1d-b77f-ff0e1cf7e7bc}\LocalState
Operation:writeName:BINGIDENTITY_PROP_USEREMAIL
Value:
0000E2AD0BED55C7DB01
(PID) Process:(7452) SearchApp.exeKey:\REGISTRY\A\{b712b650-73ed-df1d-b77f-ff0e1cf7e7bc}\LocalState
Operation:writeName:BINGIDENTITY_PROP_ACCOUNTTYPETEXT
Value:
000077FE0DED55C7DB01
(PID) Process:(7452) SearchApp.exeKey:\REGISTRY\A\{b712b650-73ed-df1d-b77f-ff0e1cf7e7bc}\LocalState
Operation:writeName:BINGIDENTITY_PROP_ACCOUNTTYPE
Value:
000077FE0DED55C7DB01
(PID) Process:(7452) SearchApp.exeKey:\REGISTRY\A\{b712b650-73ed-df1d-b77f-ff0e1cf7e7bc}\LocalState
Operation:writeName:BINGIDENTITY_PROP_ACCOUNTTYPE
Value:
4E006F006E006500000077FE0DED55C7DB01
(PID) Process:(7452) SearchApp.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\A1hdl50UVDh2ZbG324Nx-6fZgntcGnHOs5kHLdmaJYE\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Speech_OneCore\Recognizers
Operation:writeName:DefaultTokenId
Value:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\Recognizers\Tokens\MS-1033-110-WINMO-DNN
(PID) Process:(7452) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SearchSettings
Operation:writeName:IsMSACloudSearchEnabled
Value:
0
(PID) Process:(7452) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SearchSettings
Operation:writeName:IsAADCloudSearchEnabled
Value:
0
(PID) Process:(7452) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search
Operation:writeName:CortanaStateLastRun
Value:
54CF286800000000
(PID) Process:(7452) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\Flighting
Operation:writeName:CachedFeatureString
Value:
Executable files
1
Suspicious files
88
Text files
1 077
Unknown types
0

Dropped files

PID
Process
Filename
Type
7360Oxygen Virus.exeC:\Users\admin\Desktop\ihcJYIpdYtb6text
MD5:1DC0CDA9AFD5F3E09C2835CF245EB83F
SHA256:C75D0F58F707789FAF1217151478EE946BF09714FBC8D8DB3CBEEFE71CA5D541
7360Oxygen Virus.exeC:\Users\admin\Desktop\GxSijIYQADdEtext
MD5:1DC0CDA9AFD5F3E09C2835CF245EB83F
SHA256:C75D0F58F707789FAF1217151478EE946BF09714FBC8D8DB3CBEEFE71CA5D541
7360Oxygen Virus.exeC:\Users\admin\Desktop\rvTwoeI4lfN3text
MD5:1DC0CDA9AFD5F3E09C2835CF245EB83F
SHA256:C75D0F58F707789FAF1217151478EE946BF09714FBC8D8DB3CBEEFE71CA5D541
7360Oxygen Virus.exeC:\Users\admin\Desktop\dB7ep6tZNshetext
MD5:1DC0CDA9AFD5F3E09C2835CF245EB83F
SHA256:C75D0F58F707789FAF1217151478EE946BF09714FBC8D8DB3CBEEFE71CA5D541
7360Oxygen Virus.exeC:\Users\admin\Desktop\UWFfZQvPhbY2text
MD5:1DC0CDA9AFD5F3E09C2835CF245EB83F
SHA256:C75D0F58F707789FAF1217151478EE946BF09714FBC8D8DB3CBEEFE71CA5D541
7360Oxygen Virus.exeC:\Users\admin\Desktop\hRF29bfGB7Xktext
MD5:1DC0CDA9AFD5F3E09C2835CF245EB83F
SHA256:C75D0F58F707789FAF1217151478EE946BF09714FBC8D8DB3CBEEFE71CA5D541
7360Oxygen Virus.exeC:\Users\admin\Desktop\b4N2S2FJdwYttext
MD5:1DC0CDA9AFD5F3E09C2835CF245EB83F
SHA256:C75D0F58F707789FAF1217151478EE946BF09714FBC8D8DB3CBEEFE71CA5D541
7360Oxygen Virus.exeC:\Users\admin\Desktop\rneOG9eEgi4atext
MD5:1DC0CDA9AFD5F3E09C2835CF245EB83F
SHA256:C75D0F58F707789FAF1217151478EE946BF09714FBC8D8DB3CBEEFE71CA5D541
7360Oxygen Virus.exeC:\Users\admin\Desktop\skqmwMocqMBVtext
MD5:1DC0CDA9AFD5F3E09C2835CF245EB83F
SHA256:C75D0F58F707789FAF1217151478EE946BF09714FBC8D8DB3CBEEFE71CA5D541
7360Oxygen Virus.exeC:\Users\admin\Desktop\uNAPLWfogbFitext
MD5:1DC0CDA9AFD5F3E09C2835CF245EB83F
SHA256:C75D0F58F707789FAF1217151478EE946BF09714FBC8D8DB3CBEEFE71CA5D541
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
46
DNS requests
29
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.21:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7948
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7948
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7452
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.216.77.21:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.216.77.21
  • 23.216.77.43
  • 23.216.77.35
  • 23.216.77.25
  • 23.216.77.33
  • 23.216.77.31
  • 23.216.77.26
  • 23.216.77.39
  • 23.216.77.42
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 216.58.206.78
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.2
  • 20.190.159.4
  • 20.190.159.129
  • 20.190.159.71
  • 20.190.159.130
  • 20.190.159.131
  • 40.126.31.69
  • 20.190.159.68
  • 40.126.31.73
  • 40.126.31.71
  • 20.190.159.23
  • 40.126.31.129
  • 40.126.31.3
  • 20.190.159.0
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
www.bing.com
  • 2.23.227.215
  • 2.23.227.208
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Oxygen Virus.exe