File name:

ShtrayEasy.exe

Full analysis: https://app.any.run/tasks/10bcbd30-6bf8-479c-a414-02884122d1b7
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: May 10, 2025, 06:27:02
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
auto-reg
telegram
auto-startup
vidar
stealer
antivm
rat
njrat
bladabindi
remote
backdoor
quasar
evasion
asyncrat
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

4E88B64FC66298E865BD76790950B8F9

SHA1:

8B662E2ADA8F882E68255E2A748E7A8FC8C36860

SHA256:

D5F6F15BCD3ED0966D65943273A34F17F4EC7B54BDA1E0B01843AA8F635BE446

SSDEEP:

49152:Oh65CM9hWCQMBV89GQXCFqKKpu9tTsQX9Rwqou:Oh65CM9hWCrBVcIqKKpuzwQX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • XNPHLE.exe (PID: 2616)
      • NXXELQ.exe (PID: 5576)
      • SSIGRT.exe (PID: 6872)
      • TETHIU.exe (PID: 6148)
      • SJWZYN.exe (PID: 1128)
      • ZGWPNK.exe (PID: 4464)
      • WWMIUE.exe (PID: 1276)
      • TVEWMT.exe (PID: 7448)
      • YFIUUR.exe (PID: 7736)
      • EUVQLT.exe (PID: 7300)
      • IVVXHE.exe (PID: 8368)

    • Executing a file with an untrusted certificate

      • SGOXOT.exe (PID: 496)
      • iwbas0rqi5.exe (PID: 7984)
      • iwbas0rqi5.exe (PID: 8564)
      • vaaaaimy5p.exe (PID: 8852)
      • asr16fct00.exe (PID: 4884)

    • Changes the autorun value in the registry

      • XNPHLE.exe (PID: 2616)
      • NXXELQ.exe (PID: 5576)
      • SSIGRT.exe (PID: 6872)
      • TETHIU.exe (PID: 6148)
      • SJWZYN.exe (PID: 1128)
      • ZGWPNK.exe (PID: 4464)
      • WWMIUE.exe (PID: 1276)
      • TVEWMT.exe (PID: 7448)
      • YFIUUR.exe (PID: 7736)
      • EUVQLT.exe (PID: 7300)
      • IVVXHE.exe (PID: 8368)

    • Steals credentials from Web Browsers

      • MSBuild.exe (PID: 3240)

    • Actions looks like stealing of personal data

      • MSBuild.exe (PID: 3240)

    • VIDAR mutex has been found

      • MSBuild.exe (PID: 3240)

    • VIDAR has been detected (YARA)

      • MSBuild.exe (PID: 3240)

    • Uses Task Scheduler to run other applications

      • Dllhost.exe (PID: 8076)

    • NJRAT has been detected (SURICATA)

      • Dllhost.exe (PID: 8076)

    • Connects to the CnC server

      • Dllhost.exe (PID: 8076)
      • Client.exe (PID: 1804)

    • QUASAR has been detected (SURICATA)

      • Client.exe (PID: 1804)

    • ASYNCRAT has been detected (SURICATA)

      • Riot Games.exe (PID: 7996)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • ShtrayEasy.exe (PID: 1180)
      • XNPHLE.exe (PID: 2616)
      • XNPHLE.exe (PID: 4180)
      • NXXELQ.exe (PID: 496)
      • SSIGRT.exe (PID: 2904)
      • TETHIU.exe (PID: 1052)
      • SJWZYN.exe (PID: 5436)
      • ZGWPNK.exe (PID: 5964)
      • WWMIUE.exe (PID: 7360)
      • TVEWMT.exe (PID: 7712)
      • YFIUUR.exe (PID: 7276)
      • EUVQLT.exe (PID: 8340)
      • IVVXHE.exe (PID: 8412)
      • MSBuild.exe (PID: 3240)
      • l6890zc2db.exe (PID: 1324)
      • iwbas0rqi5.exe (PID: 8564)
      • XQSXGD.exe (PID: 8316)
      • Dllhost.exe (PID: 8076)
      • MSBuild.exe (PID: 7616)
      • c2dt0r1dbs.exe (PID: 7992)
      • 26pzcbiwb1.exe (PID: 2392)
      • wtr1no89hv.exe (PID: 2104)
      • WNZVPL.exe (PID: 3796)
      • dtrqqqi5pp.exe (PID: 6264)

    • Starts itself from another location

      • ShtrayEasy.exe (PID: 1180)
      • XNPHLE.exe (PID: 4180)
      • NXXELQ.exe (PID: 496)
      • SSIGRT.exe (PID: 2904)
      • TETHIU.exe (PID: 1052)
      • ZGWPNK.exe (PID: 5964)
      • SJWZYN.exe (PID: 5436)
      • WWMIUE.exe (PID: 7360)
      • TVEWMT.exe (PID: 7712)
      • YFIUUR.exe (PID: 7276)
      • EUVQLT.exe (PID: 8340)
      • IVVXHE.exe (PID: 8412)
      • l6890zc2db.exe (PID: 1324)
      • iwbas0rqi5.exe (PID: 8564)
      • XQSXGD.exe (PID: 8316)
      • c2dt0r1dbs.exe (PID: 7992)
      • 26pzcbiwb1.exe (PID: 2392)
      • WNZVPL.exe (PID: 3796)
      • wtr1no89hv.exe (PID: 2104)

    • Process drops legitimate windows executable

      • XNPHLE.exe (PID: 2616)
      • MSBuild.exe (PID: 3240)
      • MSBuild.exe (PID: 7616)
      • dtrqqqi5pp.exe (PID: 6264)

    • Starts a Microsoft application from unusual location

      • SGOXOT.exe (PID: 496)

    • Potential Corporate Privacy Violation

      • XNPHLE.exe (PID: 2616)
      • MSBuild.exe (PID: 3240)
      • MSBuild.exe (PID: 7616)

    • Reads security settings of Internet Explorer

      • MSBuild.exe (PID: 3240)

    • Connects to unusual port

      • XNPHLE.exe (PID: 2616)
      • NXXELQ.exe (PID: 5576)
      • SSIGRT.exe (PID: 6872)
      • SJWZYN.exe (PID: 1128)
      • ZGWPNK.exe (PID: 4464)
      • WWMIUE.exe (PID: 1276)
      • TETHIU.exe (PID: 6148)
      • TVEWMT.exe (PID: 7448)
      • YFIUUR.exe (PID: 7736)
      • EUVQLT.exe (PID: 7300)
      • IVVXHE.exe (PID: 8368)
      • UELOZD.exe (PID: 8616)
      • SYREZP.exe (PID: 6940)
      • Dllhost.exe (PID: 8076)
      • Client.exe (PID: 1804)
      • OIQYKH.exe (PID: 6656)
      • Riot Games.exe (PID: 7996)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • MSBuild.exe (PID: 3240)
      • MSBuild.exe (PID: 7616)
      • MSBuild.exe (PID: 7708)

    • Searches for installed software

      • MSBuild.exe (PID: 3240)

    • There is functionality for VM detection Xen (YARA)

      • ShtrayEasy.exe (PID: 1180)
      • XNPHLE.exe (PID: 2616)
      • NXXELQ.exe (PID: 496)
      • XNPHLE.exe (PID: 4180)
      • NXXELQ.exe (PID: 5576)
      • SSIGRT.exe (PID: 6872)
      • SSIGRT.exe (PID: 2904)
      • TETHIU.exe (PID: 6148)

    • There is functionality for VM detection Parallels (YARA)

      • ShtrayEasy.exe (PID: 1180)
      • XNPHLE.exe (PID: 2616)
      • XNPHLE.exe (PID: 4180)
      • NXXELQ.exe (PID: 5576)
      • SSIGRT.exe (PID: 6872)
      • SSIGRT.exe (PID: 2904)
      • TETHIU.exe (PID: 6148)
      • NXXELQ.exe (PID: 496)

    • There is functionality for VM detection antiVM strings (YARA)

      • ShtrayEasy.exe (PID: 1180)
      • XNPHLE.exe (PID: 2616)
      • XNPHLE.exe (PID: 4180)
      • NXXELQ.exe (PID: 5576)
      • SSIGRT.exe (PID: 6872)
      • SSIGRT.exe (PID: 2904)
      • TETHIU.exe (PID: 6148)
      • NXXELQ.exe (PID: 496)

    • There is functionality for VM detection VirtualBox (YARA)

      • ShtrayEasy.exe (PID: 1180)
      • XNPHLE.exe (PID: 2616)
      • NXXELQ.exe (PID: 496)
      • XNPHLE.exe (PID: 4180)
      • NXXELQ.exe (PID: 5576)
      • SSIGRT.exe (PID: 2904)
      • SSIGRT.exe (PID: 6872)
      • TETHIU.exe (PID: 6148)

    • There is functionality for VM detection VMWare (YARA)

      • ShtrayEasy.exe (PID: 1180)
      • XNPHLE.exe (PID: 2616)
      • NXXELQ.exe (PID: 496)
      • XNPHLE.exe (PID: 4180)
      • NXXELQ.exe (PID: 5576)
      • SSIGRT.exe (PID: 6872)
      • SSIGRT.exe (PID: 2904)
      • TETHIU.exe (PID: 6148)

    • There is functionality for taking screenshot (YARA)

      • MSBuild.exe (PID: 3240)

    • Multiple wallet extension IDs have been found

      • MSBuild.exe (PID: 3240)

    • Process requests binary or script from the Internet

      • MSBuild.exe (PID: 3240)
      • MSBuild.exe (PID: 7616)

    • Starts CMD.EXE for commands execution

      • MSBuild.exe (PID: 3240)
      • dtrqqqi5pp.exe (PID: 6264)
      • MSBuild.exe (PID: 7616)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 7328)
      • cmd.exe (PID: 8916)
      • cmd.exe (PID: 2664)

    • Contacting a server suspected of hosting an CnC

      • Dllhost.exe (PID: 8076)
      • Client.exe (PID: 1804)
      • Riot Games.exe (PID: 7996)

    • Start notepad (likely ransomware note)

      • MSBuild.exe (PID: 7616)

    • Checks for external IP

      • svchost.exe (PID: 2196)

    • Executing commands from a ".bat" file

      • dtrqqqi5pp.exe (PID: 6264)

    • The executable file from the user directory is run by the CMD process

      • Riot Games.exe (PID: 7996)

    • The process executes via Task Scheduler

      • Server.exe (PID: 6632)

  • INFO

    • Checks supported languages

      • ShtrayEasy.exe (PID: 1180)
      • XNPHLE.exe (PID: 2616)
      • SGOXOT.exe (PID: 496)
      • MSBuild.exe (PID: 3240)
      • XNPHLE.exe (PID: 4180)
      • NXXELQ.exe (PID: 5576)
      • NXXELQ.exe (PID: 496)
      • SSIGRT.exe (PID: 6872)
      • SSIGRT.exe (PID: 2904)
      • TETHIU.exe (PID: 6148)
      • TETHIU.exe (PID: 1052)
      • SJWZYN.exe (PID: 1128)
      • SJWZYN.exe (PID: 5436)
      • ZGWPNK.exe (PID: 5964)
      • ZGWPNK.exe (PID: 4464)
      • WWMIUE.exe (PID: 1276)
      • TVEWMT.exe (PID: 7448)
      • WWMIUE.exe (PID: 7360)
      • TVEWMT.exe (PID: 7712)
      • YFIUUR.exe (PID: 7736)
      • YFIUUR.exe (PID: 7276)
      • EUVQLT.exe (PID: 7300)
      • EUVQLT.exe (PID: 8340)
      • IVVXHE.exe (PID: 8368)

    • Create files in a temporary directory

      • ShtrayEasy.exe (PID: 1180)
      • XNPHLE.exe (PID: 2616)
      • XNPHLE.exe (PID: 4180)
      • NXXELQ.exe (PID: 496)
      • SSIGRT.exe (PID: 2904)
      • TETHIU.exe (PID: 1052)
      • SJWZYN.exe (PID: 5436)
      • ZGWPNK.exe (PID: 5964)
      • WWMIUE.exe (PID: 7360)
      • TVEWMT.exe (PID: 7712)
      • YFIUUR.exe (PID: 7276)
      • EUVQLT.exe (PID: 8340)

    • The sample compiled with english language support

      • XNPHLE.exe (PID: 2616)
      • MSBuild.exe (PID: 3240)
      • MSBuild.exe (PID: 7616)

    • Creates files or folders in the user directory

      • XNPHLE.exe (PID: 2616)
      • NXXELQ.exe (PID: 5576)
      • MSBuild.exe (PID: 3240)
      • SSIGRT.exe (PID: 6872)
      • TETHIU.exe (PID: 6148)
      • ZGWPNK.exe (PID: 4464)
      • WWMIUE.exe (PID: 1276)
      • SJWZYN.exe (PID: 1128)
      • YFIUUR.exe (PID: 7736)
      • EUVQLT.exe (PID: 7300)
      • IVVXHE.exe (PID: 8368)
      • TVEWMT.exe (PID: 7448)

    • Auto-launch of the file from Registry key

      • XNPHLE.exe (PID: 2616)
      • NXXELQ.exe (PID: 5576)
      • SSIGRT.exe (PID: 6872)
      • TETHIU.exe (PID: 6148)
      • WWMIUE.exe (PID: 1276)
      • ZGWPNK.exe (PID: 4464)
      • TVEWMT.exe (PID: 7448)
      • SJWZYN.exe (PID: 1128)
      • YFIUUR.exe (PID: 7736)
      • EUVQLT.exe (PID: 7300)
      • IVVXHE.exe (PID: 8368)

    • Reads the computer name

      • XNPHLE.exe (PID: 2616)
      • MSBuild.exe (PID: 3240)
      • NXXELQ.exe (PID: 5576)
      • SSIGRT.exe (PID: 6872)
      • TETHIU.exe (PID: 6148)
      • ZGWPNK.exe (PID: 4464)
      • WWMIUE.exe (PID: 1276)
      • TVEWMT.exe (PID: 7448)
      • SJWZYN.exe (PID: 1128)
      • YFIUUR.exe (PID: 7736)
      • EUVQLT.exe (PID: 7300)
      • IVVXHE.exe (PID: 8368)

    • Auto-launch of the file from Startup directory

      • XNPHLE.exe (PID: 2616)
      • NXXELQ.exe (PID: 5576)
      • SSIGRT.exe (PID: 6872)
      • TETHIU.exe (PID: 6148)
      • SJWZYN.exe (PID: 1128)
      • ZGWPNK.exe (PID: 4464)
      • WWMIUE.exe (PID: 1276)
      • TVEWMT.exe (PID: 7448)
      • YFIUUR.exe (PID: 7736)
      • EUVQLT.exe (PID: 7300)
      • IVVXHE.exe (PID: 8368)

    • Reads the machine GUID from the registry

      • MSBuild.exe (PID: 3240)

    • Reads the software policy settings

      • MSBuild.exe (PID: 3240)

    • Checks proxy server information

      • MSBuild.exe (PID: 3240)

    • Manual execution by a user

      • XNPHLE.exe (PID: 4180)
      • NXXELQ.exe (PID: 496)
      • SSIGRT.exe (PID: 2904)
      • TETHIU.exe (PID: 1052)
      • SJWZYN.exe (PID: 5436)
      • ZGWPNK.exe (PID: 5964)
      • WWMIUE.exe (PID: 7360)
      • TVEWMT.exe (PID: 7712)
      • YFIUUR.exe (PID: 7276)
      • EUVQLT.exe (PID: 8340)
      • IVVXHE.exe (PID: 8412)

    • Reads Environment values

      • MSBuild.exe (PID: 3240)

    • Reads CPU info

      • MSBuild.exe (PID: 3240)

    • Reads product name

      • MSBuild.exe (PID: 3240)

    • Creates files in the program directory

      • MSBuild.exe (PID: 3240)

    • Application launched itself

      • chrome.exe (PID: 7236)
      • msedge.exe (PID: 7836)
      • chrome.exe (PID: 2344)
      • msedge.exe (PID: 7592)

    • Attempting to use instant messaging service

      • MSBuild.exe (PID: 7708)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Vidar

(PID) Process(3240) MSBuild.exe
C2https://t.me/m00f3r
URLhttps://steamcommunity.com/profiles/76561199851454339
RC43333333333333333UUUUUUUUUUUUUUUU
Strings (1)
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:08 11:21:04+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.42
CodeSize: 985088
InitializedDataSize: 250368
UninitializedDataSize: -
EntryPoint: 0xbc0cd
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
238
Monitored processes
107
Malicious processes
34
Suspicious processes
5

Behavior graph

Click at the process to see the details
start shtrayeasy.exe xnphle.exe sgoxot.exe no specs sppextcomobj.exe no specs #VIDAR msbuild.exe slui.exe xnphle.exe nxxelq.exe nxxelq.exe ssigrt.exe ssigrt.exe tethiu.exe tethiu.exe sjwzyn.exe sjwzyn.exe zgwpnk.exe zgwpnk.exe wwmiue.exe chrome.exe chrome.exe no specs wwmiue.exe tvewmt.exe chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs tvewmt.exe yfiuur.exe yfiuur.exe euvqlt.exe msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs euvqlt.exe ivvxhe.exe ivvxhe.exe uelozd.exe iwbas0rqi5.exe no specs c2dt0r1dbs.exe msbuild.exe l6890zc2db.exe l6890zc2db.exe no specs client.exe no specs iwbas0rqi5.exe xqsxgd.exe syrezp.exe vaaaaimy5p.exe no specs cmd.exe no specs #NJRAT dllhost.exe conhost.exe no specs timeout.exe no specs msbuild.exe svchost.exe slui.exe no specs schtasks.exe no specs conhost.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs asr16fct00.exe no specs 2vs0h4ohdt.exe no specs 26pzcbiwb1.exe msbuild.exe dtrqqqi5pp.exe #QUASAR client.exe wtr1no89hv.exe wnzvpl.exe oiqykh.exe cmd.exe no specs conhost.exe no specs timeout.exe no specs 26pzcbiwb1.exe no specs server.exe no specs cmd.exe no specs conhost.exe no specs timeout.exe no specs msbuild.exe #ASYNCRAT riot games.exe

Process information

PID
CMD
Path
Indicators
Parent process
208"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2732 --field-trial-handle=1564,i,5048963566119830089,11430928771472198711,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
496C:\Users\admin\AppData\Local\Temp\UFEUSLONOIH\SGOXOT.exeC:\Users\admin\AppData\Local\Temp\UFEUSLONOIH\SGOXOT.exe—XNPHLE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Netstat Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\ufeuslonoih\sgoxot.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
496C:\Users\admin\AppData\Local\Temp\NGXXWGGFFIS\NXXELQ.exeC:\Users\admin\AppData\Local\Temp\NGXXWGGFFIS\NXXELQ.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\ngxxwggffis\nxxelq.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
904C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1052C:\Users\admin\AppData\Local\Temp\LTKZWZRGWJN\TETHIU.exeC:\Users\admin\AppData\Local\Temp\LTKZWZRGWJN\TETHIU.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\ltkzwzrgwjn\tethiu.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
1128C:\Users\admin\AppData\Local\Temp\IEKFUIZPRPT\SJWZYN.exe 1052C:\Users\admin\AppData\Local\Temp\IEKFUIZPRPT\SJWZYN.exe
TETHIU.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\iekfuizprpt\sjwzyn.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1132"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4692 --field-trial-handle=1564,i,5048963566119830089,11430928771472198711,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1180"C:\Users\admin\AppData\Local\Temp\ShtrayEasy.exe" C:\Users\admin\AppData\Local\Temp\ShtrayEasy.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\shtrayeasy.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1276C:\Users\admin\AppData\Local\Temp\NHJVROOGTHY\WWMIUE.exe 5964C:\Users\admin\AppData\Local\Temp\NHJVROOGTHY\WWMIUE.exe
ZGWPNK.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\nhjvroogthy\wwmiue.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1324"C:\ProgramData\l6890zc2db.exe" C:\ProgramData\l6890zc2db.exe
MSBuild.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Quasar Client
Exit code:
3
Version:
1.4.1
Modules
Images
c:\programdata\l6890zc2db.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
83 453
Read events
81 765
Write events
1 688
Delete events
0

Modification events

(PID) Process:(2616) XNPHLE.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:XNPHLE.exe
Value:
C:\Users\admin\AppData\Local\Temp\DYIMYRFTWNL\XNPHLE.exe
(PID) Process:(3240) MSBuild.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3240) MSBuild.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3240) MSBuild.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5576) NXXELQ.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:NXXELQ.exe
Value:
C:\Users\admin\AppData\Local\Temp\NGXXWGGFFIS\NXXELQ.exe
(PID) Process:(6872) SSIGRT.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:SSIGRT.exe
Value:
C:\Users\admin\AppData\Local\Temp\EMLISFMKEEF\SSIGRT.exe
(PID) Process:(6148) TETHIU.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:TETHIU.exe
Value:
C:\Users\admin\AppData\Local\Temp\LTKZWZRGWJN\TETHIU.exe
(PID) Process:(1128) SJWZYN.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:SJWZYN.exe
Value:
C:\Users\admin\AppData\Local\Temp\IEKFUIZPRPT\SJWZYN.exe
(PID) Process:(4464) ZGWPNK.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:ZGWPNK.exe
Value:
C:\Users\admin\AppData\Local\Temp\WKKZLUSTLFS\ZGWPNK.exe
(PID) Process:(1276) WWMIUE.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:WWMIUE.exe
Value:
C:\Users\admin\AppData\Local\Temp\NHJVROOGTHY\WWMIUE.exe
Executable files
76
Suspicious files
405
Text files
188
Unknown types
0

Dropped files

PID
Process
Filename
Type
5576NXXELQ.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NXXELQ.exe.lnkbinary
MD5:5D9CEB5B5BAC9218BCFE25E44F4A0C2A
SHA256:240370B8BF31BFA536F8F1CCAC333023E8457377FD8F99D8ED408EE04A3B0B2D
1180ShtrayEasy.exeC:\Users\admin\AppData\Local\Temp\DYIMYRFTWNL\XNPHLE.exeexecutable
MD5:4E88B64FC66298E865BD76790950B8F9
SHA256:D5F6F15BCD3ED0966D65943273A34F17F4EC7B54BDA1E0B01843AA8F635BE446
2616XNPHLE.exeC:\Users\admin\AppData\Local\Temp\UFEUSLONOIH\SGOXOT.exeexecutable
MD5:3E7CDF51208C96EB024869280FDE9AF9
SHA256:B2B24F74E4698A57BBCBB3B827746C9A23B65BF59ADB1F5D3EB775AABF530367
4180XNPHLE.exeC:\Users\admin\AppData\Local\Temp\NGXXWGGFFIS\NXXELQ.exeexecutable
MD5:4E88B64FC66298E865BD76790950B8F9
SHA256:D5F6F15BCD3ED0966D65943273A34F17F4EC7B54BDA1E0B01843AA8F635BE446
6872SSIGRT.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SSIGRT.exe.lnkbinary
MD5:84009B8A028190BC459E6EED1D99D94B
SHA256:9A6460C22A6C002C777556CCD6E3B9AD1F9E9A895B5BFF7E3AA3842F902AC8C3
2616XNPHLE.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XNPHLE.exe.lnkbinary
MD5:C6A539A33D32AB9F206BDECBE8B9249E
SHA256:B14E0A15127A6ECA0D052925054A9B5711558B14CAA270CD2CD6B1FA9E8404C2
3240MSBuild.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\35F878CD86A7A14C1EF53773C281B737binary
MD5:3D331F0817710E8552D5CB79BB81EF79
SHA256:4DD732EDD94C74BBF04024330F03B9C465FB00E491E84FB7EA9DC9EB39FAC5B9
3240MSBuild.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:1255C99EFAC15807CD877F1E910F49CB
SHA256:7083FD8D81FEA0442F16C7E4D3586BB2728F16DEFD2342A486E74800D9F6F332
3240MSBuild.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751binary
MD5:E192462F281446B5D1500D474FBACC4B
SHA256:F1BA9F1B63C447682EBF9DE956D0DA2A027B1B779ABEF9522D347D3479139A60
3240MSBuild.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\35F878CD86A7A14C1EF53773C281B737binary
MD5:513653B72AC27DBD12F65E1C74C0969B
SHA256:DE6F25B9A052172C8DF98F1DCB25E9AEA6E8E9DB665E6254B1A60DD2FF7FAEC7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
470
DNS requests
133
Threats
20

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2616
XNPHLE.exe
GET
200
213.209.150.210:80
http://files.innovadentalkj.com/css/VasuisUly.exe
unknown
—
—
malicious
3240
MSBuild.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
8168
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3240
MSBuild.exe
GET
200
18.66.147.103:80
http://e6.c.lencr.org/96.crl
unknown
—
—
whitelisted
8168
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3240
MSBuild.exe
GET
200
213.209.150.210:80
http://files.innovadentalkj.com/js/nJack.exe
unknown
—
—
malicious
3240
MSBuild.exe
GET
200
213.209.150.210:80
http://files.innovadentalkj.com/css/LisuasControl.exe
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2616
XNPHLE.exe
213.209.150.210:8437
files.innovadentalkj.com
Alsycon B.V.
GB
malicious
2616
XNPHLE.exe
213.209.150.210:80
files.innovadentalkj.com
Alsycon B.V.
GB
malicious
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
google.com
  • 142.250.184.206
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.166
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
files.innovadentalkj.com
  • 213.209.150.210
unknown
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.67
  • 40.126.32.138
  • 20.190.160.4
  • 20.190.160.132
  • 20.190.160.130
  • 20.190.160.5
  • 20.190.160.128
  • 40.126.32.76
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
t.me
  • 149.154.167.99
whitelisted
72.aa.4t.com
  • 78.46.233.21
unknown

Threats

PID
Process
Class
Message
—
—
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 57
—
—
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
—
—
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
—
—
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
—
—
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
—
—
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
—
—
A Network Trojan was detected
MALWARE [ANY.RUN] Suspected Domain Associated with Malware Distribution (itsrevolutionmagnus .xyz)
—
—
Misc activity
ET INFO Possible Host Profile Exfiltration In Pipe Delimited Format
—
—
Malware Command and Control Activity Detected
BACKDOOR [ANY.RUN] njRAT Bladabindi CnC Communication command ll
—
—
Malware Command and Control Activity Detected
ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
ShtrayEasy.exe