File name:

ShtrayEasy.exe

Full analysis: https://app.any.run/tasks/10bcbd30-6bf8-479c-a414-02884122d1b7
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: May 10, 2025, 06:27:02
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
loader
auto-reg
telegram
auto-startup
vidar
stealer
antivm
rat
njrat
bladabindi
remote
backdoor
quasar
evasion
asyncrat
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

4E88B64FC66298E865BD76790950B8F9

SHA1:

8B662E2ADA8F882E68255E2A748E7A8FC8C36860

SHA256:

D5F6F15BCD3ED0966D65943273A34F17F4EC7B54BDA1E0B01843AA8F635BE446

SSDEEP:

49152:Oh65CM9hWCQMBV89GQXCFqKKpu9tTsQX9Rwqou:Oh65CM9hWCrBVcIqKKpuzwQX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • XNPHLE.exe (PID: 2616)
      • NXXELQ.exe (PID: 5576)
      • SSIGRT.exe (PID: 6872)
      • SJWZYN.exe (PID: 1128)
      • TETHIU.exe (PID: 6148)
      • ZGWPNK.exe (PID: 4464)
      • TVEWMT.exe (PID: 7448)
      • WWMIUE.exe (PID: 1276)
      • EUVQLT.exe (PID: 7300)
      • YFIUUR.exe (PID: 7736)
      • IVVXHE.exe (PID: 8368)

    • VIDAR mutex has been found

      • MSBuild.exe (PID: 3240)

    • Executing a file with an untrusted certificate

      • SGOXOT.exe (PID: 496)
      • iwbas0rqi5.exe (PID: 7984)
      • vaaaaimy5p.exe (PID: 8852)
      • iwbas0rqi5.exe (PID: 8564)
      • asr16fct00.exe (PID: 4884)

    • Changes the autorun value in the registry

      • XNPHLE.exe (PID: 2616)
      • NXXELQ.exe (PID: 5576)
      • SSIGRT.exe (PID: 6872)
      • TETHIU.exe (PID: 6148)
      • SJWZYN.exe (PID: 1128)
      • ZGWPNK.exe (PID: 4464)
      • WWMIUE.exe (PID: 1276)
      • TVEWMT.exe (PID: 7448)
      • YFIUUR.exe (PID: 7736)
      • EUVQLT.exe (PID: 7300)
      • IVVXHE.exe (PID: 8368)

    • Actions looks like stealing of personal data

      • MSBuild.exe (PID: 3240)

    • Steals credentials from Web Browsers

      • MSBuild.exe (PID: 3240)

    • VIDAR has been detected (YARA)

      • MSBuild.exe (PID: 3240)

    • Uses Task Scheduler to run other applications

      • Dllhost.exe (PID: 8076)

    • NJRAT has been detected (SURICATA)

      • Dllhost.exe (PID: 8076)

    • Connects to the CnC server

      • Dllhost.exe (PID: 8076)
      • Client.exe (PID: 1804)

    • QUASAR has been detected (SURICATA)

      • Client.exe (PID: 1804)

    • ASYNCRAT has been detected (SURICATA)

      • Riot Games.exe (PID: 7996)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • ShtrayEasy.exe (PID: 1180)
      • XNPHLE.exe (PID: 2616)
      • XNPHLE.exe (PID: 4180)
      • NXXELQ.exe (PID: 496)
      • SSIGRT.exe (PID: 2904)
      • TETHIU.exe (PID: 1052)
      • SJWZYN.exe (PID: 5436)
      • ZGWPNK.exe (PID: 5964)
      • WWMIUE.exe (PID: 7360)
      • TVEWMT.exe (PID: 7712)
      • YFIUUR.exe (PID: 7276)
      • EUVQLT.exe (PID: 8340)
      • IVVXHE.exe (PID: 8412)
      • MSBuild.exe (PID: 3240)
      • l6890zc2db.exe (PID: 1324)
      • XQSXGD.exe (PID: 8316)
      • c2dt0r1dbs.exe (PID: 7992)
      • iwbas0rqi5.exe (PID: 8564)
      • Dllhost.exe (PID: 8076)
      • MSBuild.exe (PID: 7616)
      • 26pzcbiwb1.exe (PID: 2392)
      • WNZVPL.exe (PID: 3796)
      • wtr1no89hv.exe (PID: 2104)
      • dtrqqqi5pp.exe (PID: 6264)

    • Starts itself from another location

      • ShtrayEasy.exe (PID: 1180)
      • XNPHLE.exe (PID: 4180)
      • NXXELQ.exe (PID: 496)
      • SSIGRT.exe (PID: 2904)
      • TETHIU.exe (PID: 1052)
      • SJWZYN.exe (PID: 5436)
      • ZGWPNK.exe (PID: 5964)
      • WWMIUE.exe (PID: 7360)
      • TVEWMT.exe (PID: 7712)
      • YFIUUR.exe (PID: 7276)
      • EUVQLT.exe (PID: 8340)
      • IVVXHE.exe (PID: 8412)
      • iwbas0rqi5.exe (PID: 8564)
      • XQSXGD.exe (PID: 8316)
      • c2dt0r1dbs.exe (PID: 7992)
      • l6890zc2db.exe (PID: 1324)
      • 26pzcbiwb1.exe (PID: 2392)
      • wtr1no89hv.exe (PID: 2104)
      • WNZVPL.exe (PID: 3796)

    • Reads security settings of Internet Explorer

      • MSBuild.exe (PID: 3240)

    • Process drops legitimate windows executable

      • XNPHLE.exe (PID: 2616)
      • MSBuild.exe (PID: 3240)
      • MSBuild.exe (PID: 7616)
      • dtrqqqi5pp.exe (PID: 6264)

    • Starts a Microsoft application from unusual location

      • SGOXOT.exe (PID: 496)

    • Potential Corporate Privacy Violation

      • XNPHLE.exe (PID: 2616)
      • MSBuild.exe (PID: 3240)
      • MSBuild.exe (PID: 7616)

    • Connects to unusual port

      • XNPHLE.exe (PID: 2616)
      • NXXELQ.exe (PID: 5576)
      • TETHIU.exe (PID: 6148)
      • SSIGRT.exe (PID: 6872)
      • SJWZYN.exe (PID: 1128)
      • ZGWPNK.exe (PID: 4464)
      • WWMIUE.exe (PID: 1276)
      • TVEWMT.exe (PID: 7448)
      • YFIUUR.exe (PID: 7736)
      • EUVQLT.exe (PID: 7300)
      • IVVXHE.exe (PID: 8368)
      • UELOZD.exe (PID: 8616)
      • SYREZP.exe (PID: 6940)
      • Dllhost.exe (PID: 8076)
      • Client.exe (PID: 1804)
      • OIQYKH.exe (PID: 6656)
      • Riot Games.exe (PID: 7996)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • MSBuild.exe (PID: 3240)
      • MSBuild.exe (PID: 7616)
      • MSBuild.exe (PID: 7708)

    • Searches for installed software

      • MSBuild.exe (PID: 3240)

    • There is functionality for VM detection Parallels (YARA)

      • ShtrayEasy.exe (PID: 1180)
      • XNPHLE.exe (PID: 2616)
      • NXXELQ.exe (PID: 496)
      • NXXELQ.exe (PID: 5576)
      • SSIGRT.exe (PID: 6872)
      • XNPHLE.exe (PID: 4180)
      • TETHIU.exe (PID: 6148)
      • SSIGRT.exe (PID: 2904)

    • There is functionality for VM detection antiVM strings (YARA)

      • ShtrayEasy.exe (PID: 1180)
      • XNPHLE.exe (PID: 2616)
      • NXXELQ.exe (PID: 496)
      • XNPHLE.exe (PID: 4180)
      • SSIGRT.exe (PID: 6872)
      • NXXELQ.exe (PID: 5576)
      • SSIGRT.exe (PID: 2904)
      • TETHIU.exe (PID: 6148)

    • There is functionality for VM detection Xen (YARA)

      • ShtrayEasy.exe (PID: 1180)
      • XNPHLE.exe (PID: 2616)
      • NXXELQ.exe (PID: 496)
      • XNPHLE.exe (PID: 4180)
      • NXXELQ.exe (PID: 5576)
      • SSIGRT.exe (PID: 6872)
      • TETHIU.exe (PID: 6148)
      • SSIGRT.exe (PID: 2904)

    • There is functionality for VM detection VirtualBox (YARA)

      • ShtrayEasy.exe (PID: 1180)
      • XNPHLE.exe (PID: 2616)
      • NXXELQ.exe (PID: 496)
      • NXXELQ.exe (PID: 5576)
      • SSIGRT.exe (PID: 6872)
      • XNPHLE.exe (PID: 4180)
      • TETHIU.exe (PID: 6148)
      • SSIGRT.exe (PID: 2904)

    • There is functionality for VM detection VMWare (YARA)

      • ShtrayEasy.exe (PID: 1180)
      • XNPHLE.exe (PID: 2616)
      • NXXELQ.exe (PID: 496)
      • NXXELQ.exe (PID: 5576)
      • XNPHLE.exe (PID: 4180)
      • SSIGRT.exe (PID: 6872)
      • TETHIU.exe (PID: 6148)
      • SSIGRT.exe (PID: 2904)

    • Multiple wallet extension IDs have been found

      • MSBuild.exe (PID: 3240)

    • There is functionality for taking screenshot (YARA)

      • MSBuild.exe (PID: 3240)

    • Process requests binary or script from the Internet

      • MSBuild.exe (PID: 3240)
      • MSBuild.exe (PID: 7616)

    • Starts CMD.EXE for commands execution

      • MSBuild.exe (PID: 3240)
      • MSBuild.exe (PID: 7616)
      • dtrqqqi5pp.exe (PID: 6264)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 7328)
      • cmd.exe (PID: 2664)
      • cmd.exe (PID: 8916)

    • Contacting a server suspected of hosting an CnC

      • Dllhost.exe (PID: 8076)
      • Client.exe (PID: 1804)
      • Riot Games.exe (PID: 7996)

    • Checks for external IP

      • svchost.exe (PID: 2196)

    • Start notepad (likely ransomware note)

      • MSBuild.exe (PID: 7616)

    • The process executes via Task Scheduler

      • Server.exe (PID: 6632)

    • The executable file from the user directory is run by the CMD process

      • Riot Games.exe (PID: 7996)

    • Executing commands from a ".bat" file

      • dtrqqqi5pp.exe (PID: 6264)

  • INFO

    • Checks supported languages

      • ShtrayEasy.exe (PID: 1180)
      • XNPHLE.exe (PID: 2616)
      • SGOXOT.exe (PID: 496)
      • MSBuild.exe (PID: 3240)
      • NXXELQ.exe (PID: 5576)
      • XNPHLE.exe (PID: 4180)
      • NXXELQ.exe (PID: 496)
      • SSIGRT.exe (PID: 6872)
      • SSIGRT.exe (PID: 2904)
      • TETHIU.exe (PID: 6148)
      • SJWZYN.exe (PID: 1128)
      • SJWZYN.exe (PID: 5436)
      • TETHIU.exe (PID: 1052)
      • ZGWPNK.exe (PID: 4464)
      • ZGWPNK.exe (PID: 5964)
      • WWMIUE.exe (PID: 1276)
      • WWMIUE.exe (PID: 7360)
      • TVEWMT.exe (PID: 7448)
      • TVEWMT.exe (PID: 7712)
      • YFIUUR.exe (PID: 7736)
      • YFIUUR.exe (PID: 7276)
      • EUVQLT.exe (PID: 7300)
      • EUVQLT.exe (PID: 8340)
      • IVVXHE.exe (PID: 8368)

    • Create files in a temporary directory

      • ShtrayEasy.exe (PID: 1180)
      • XNPHLE.exe (PID: 2616)
      • XNPHLE.exe (PID: 4180)
      • NXXELQ.exe (PID: 496)
      • SSIGRT.exe (PID: 2904)
      • TETHIU.exe (PID: 1052)
      • SJWZYN.exe (PID: 5436)
      • ZGWPNK.exe (PID: 5964)
      • WWMIUE.exe (PID: 7360)
      • TVEWMT.exe (PID: 7712)
      • YFIUUR.exe (PID: 7276)
      • EUVQLT.exe (PID: 8340)

    • Creates files or folders in the user directory

      • XNPHLE.exe (PID: 2616)
      • NXXELQ.exe (PID: 5576)
      • MSBuild.exe (PID: 3240)
      • SSIGRT.exe (PID: 6872)
      • TETHIU.exe (PID: 6148)
      • SJWZYN.exe (PID: 1128)
      • ZGWPNK.exe (PID: 4464)
      • WWMIUE.exe (PID: 1276)
      • TVEWMT.exe (PID: 7448)
      • YFIUUR.exe (PID: 7736)
      • EUVQLT.exe (PID: 7300)
      • IVVXHE.exe (PID: 8368)

    • Reads the computer name

      • XNPHLE.exe (PID: 2616)
      • MSBuild.exe (PID: 3240)
      • NXXELQ.exe (PID: 5576)
      • SSIGRT.exe (PID: 6872)
      • TETHIU.exe (PID: 6148)
      • SJWZYN.exe (PID: 1128)
      • ZGWPNK.exe (PID: 4464)
      • TVEWMT.exe (PID: 7448)
      • YFIUUR.exe (PID: 7736)
      • EUVQLT.exe (PID: 7300)
      • IVVXHE.exe (PID: 8368)
      • WWMIUE.exe (PID: 1276)

    • Auto-launch of the file from Startup directory

      • XNPHLE.exe (PID: 2616)
      • NXXELQ.exe (PID: 5576)
      • SSIGRT.exe (PID: 6872)
      • TETHIU.exe (PID: 6148)
      • SJWZYN.exe (PID: 1128)
      • ZGWPNK.exe (PID: 4464)
      • WWMIUE.exe (PID: 1276)
      • TVEWMT.exe (PID: 7448)
      • YFIUUR.exe (PID: 7736)
      • EUVQLT.exe (PID: 7300)
      • IVVXHE.exe (PID: 8368)

    • Creates files in the program directory

      • MSBuild.exe (PID: 3240)

    • Checks proxy server information

      • MSBuild.exe (PID: 3240)

    • Reads the machine GUID from the registry

      • MSBuild.exe (PID: 3240)

    • The sample compiled with english language support

      • XNPHLE.exe (PID: 2616)
      • MSBuild.exe (PID: 3240)
      • MSBuild.exe (PID: 7616)

    • Auto-launch of the file from Registry key

      • XNPHLE.exe (PID: 2616)
      • NXXELQ.exe (PID: 5576)
      • SSIGRT.exe (PID: 6872)
      • TETHIU.exe (PID: 6148)
      • SJWZYN.exe (PID: 1128)
      • ZGWPNK.exe (PID: 4464)
      • WWMIUE.exe (PID: 1276)
      • TVEWMT.exe (PID: 7448)
      • YFIUUR.exe (PID: 7736)
      • EUVQLT.exe (PID: 7300)
      • IVVXHE.exe (PID: 8368)

    • Reads the software policy settings

      • MSBuild.exe (PID: 3240)

    • Manual execution by a user

      • XNPHLE.exe (PID: 4180)
      • NXXELQ.exe (PID: 496)
      • SSIGRT.exe (PID: 2904)
      • TETHIU.exe (PID: 1052)
      • SJWZYN.exe (PID: 5436)
      • ZGWPNK.exe (PID: 5964)
      • WWMIUE.exe (PID: 7360)
      • TVEWMT.exe (PID: 7712)
      • YFIUUR.exe (PID: 7276)
      • IVVXHE.exe (PID: 8412)
      • EUVQLT.exe (PID: 8340)

    • Reads Environment values

      • MSBuild.exe (PID: 3240)

    • Reads CPU info

      • MSBuild.exe (PID: 3240)

    • Reads product name

      • MSBuild.exe (PID: 3240)

    • Application launched itself

      • chrome.exe (PID: 7236)
      • msedge.exe (PID: 7836)
      • chrome.exe (PID: 2344)
      • msedge.exe (PID: 7592)

    • Attempting to use instant messaging service

      • MSBuild.exe (PID: 7708)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Vidar

(PID) Process(3240) MSBuild.exe
C2https://t.me/m00f3r
URLhttps://steamcommunity.com/profiles/76561199851454339
RC43333333333333333UUUUUUUUUUUUUUUU
Strings (1)
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:08 11:21:04+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.42
CodeSize: 985088
InitializedDataSize: 250368
UninitializedDataSize: -
EntryPoint: 0xbc0cd
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
238
Monitored processes
107
Malicious processes
34
Suspicious processes
5

Behavior graph

Click at the process to see the details
start shtrayeasy.exe xnphle.exe sgoxot.exe no specs sppextcomobj.exe no specs #VIDAR msbuild.exe slui.exe xnphle.exe nxxelq.exe nxxelq.exe ssigrt.exe ssigrt.exe tethiu.exe tethiu.exe sjwzyn.exe sjwzyn.exe zgwpnk.exe zgwpnk.exe wwmiue.exe chrome.exe chrome.exe no specs wwmiue.exe tvewmt.exe chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs tvewmt.exe yfiuur.exe yfiuur.exe euvqlt.exe msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs euvqlt.exe ivvxhe.exe ivvxhe.exe uelozd.exe iwbas0rqi5.exe no specs c2dt0r1dbs.exe msbuild.exe l6890zc2db.exe l6890zc2db.exe no specs client.exe no specs iwbas0rqi5.exe xqsxgd.exe syrezp.exe vaaaaimy5p.exe no specs cmd.exe no specs #NJRAT dllhost.exe conhost.exe no specs timeout.exe no specs msbuild.exe svchost.exe slui.exe no specs schtasks.exe no specs conhost.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs asr16fct00.exe no specs 2vs0h4ohdt.exe no specs 26pzcbiwb1.exe msbuild.exe dtrqqqi5pp.exe #QUASAR client.exe wtr1no89hv.exe wnzvpl.exe oiqykh.exe cmd.exe no specs conhost.exe no specs timeout.exe no specs 26pzcbiwb1.exe no specs server.exe no specs cmd.exe no specs conhost.exe no specs timeout.exe no specs msbuild.exe #ASYNCRAT riot games.exe

Process information

PID
CMD
Path
Indicators
Parent process
208"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2732 --field-trial-handle=1564,i,5048963566119830089,11430928771472198711,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
496C:\Users\admin\AppData\Local\Temp\UFEUSLONOIH\SGOXOT.exeC:\Users\admin\AppData\Local\Temp\UFEUSLONOIH\SGOXOT.exe—XNPHLE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Netstat Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\ufeuslonoih\sgoxot.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
496C:\Users\admin\AppData\Local\Temp\NGXXWGGFFIS\NXXELQ.exeC:\Users\admin\AppData\Local\Temp\NGXXWGGFFIS\NXXELQ.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\ngxxwggffis\nxxelq.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
904C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1052C:\Users\admin\AppData\Local\Temp\LTKZWZRGWJN\TETHIU.exeC:\Users\admin\AppData\Local\Temp\LTKZWZRGWJN\TETHIU.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\ltkzwzrgwjn\tethiu.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
1128C:\Users\admin\AppData\Local\Temp\IEKFUIZPRPT\SJWZYN.exe 1052C:\Users\admin\AppData\Local\Temp\IEKFUIZPRPT\SJWZYN.exe
TETHIU.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\iekfuizprpt\sjwzyn.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1132"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --remote-debugging-port=9223 --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4692 --field-trial-handle=1564,i,5048963566119830089,11430928771472198711,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1180"C:\Users\admin\AppData\Local\Temp\ShtrayEasy.exe" C:\Users\admin\AppData\Local\Temp\ShtrayEasy.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\shtrayeasy.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1276C:\Users\admin\AppData\Local\Temp\NHJVROOGTHY\WWMIUE.exe 5964C:\Users\admin\AppData\Local\Temp\NHJVROOGTHY\WWMIUE.exe
ZGWPNK.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\nhjvroogthy\wwmiue.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1324"C:\ProgramData\l6890zc2db.exe" C:\ProgramData\l6890zc2db.exe
MSBuild.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Quasar Client
Exit code:
3
Version:
1.4.1
Modules
Images
c:\programdata\l6890zc2db.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
83 453
Read events
81 765
Write events
1 688
Delete events
0

Modification events

(PID) Process:(2616) XNPHLE.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:XNPHLE.exe
Value:
C:\Users\admin\AppData\Local\Temp\DYIMYRFTWNL\XNPHLE.exe
(PID) Process:(3240) MSBuild.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3240) MSBuild.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3240) MSBuild.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5576) NXXELQ.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:NXXELQ.exe
Value:
C:\Users\admin\AppData\Local\Temp\NGXXWGGFFIS\NXXELQ.exe
(PID) Process:(6872) SSIGRT.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:SSIGRT.exe
Value:
C:\Users\admin\AppData\Local\Temp\EMLISFMKEEF\SSIGRT.exe
(PID) Process:(6148) TETHIU.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:TETHIU.exe
Value:
C:\Users\admin\AppData\Local\Temp\LTKZWZRGWJN\TETHIU.exe
(PID) Process:(1128) SJWZYN.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:SJWZYN.exe
Value:
C:\Users\admin\AppData\Local\Temp\IEKFUIZPRPT\SJWZYN.exe
(PID) Process:(4464) ZGWPNK.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:ZGWPNK.exe
Value:
C:\Users\admin\AppData\Local\Temp\WKKZLUSTLFS\ZGWPNK.exe
(PID) Process:(1276) WWMIUE.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:WWMIUE.exe
Value:
C:\Users\admin\AppData\Local\Temp\NHJVROOGTHY\WWMIUE.exe
Executable files
76
Suspicious files
405
Text files
188
Unknown types
0

Dropped files

PID
Process
Filename
Type
1180ShtrayEasy.exeC:\Users\admin\AppData\Local\Temp\DYIMYRFTWNL\XNPHLE.exeexecutable
MD5:4E88B64FC66298E865BD76790950B8F9
SHA256:D5F6F15BCD3ED0966D65943273A34F17F4EC7B54BDA1E0B01843AA8F635BE446
2616XNPHLE.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XNPHLE.exe.lnkbinary
MD5:C6A539A33D32AB9F206BDECBE8B9249E
SHA256:2193509E412FC15A34D8CFD851087609C2EBD941FBE264869168A4E63F507244
3240MSBuild.exeC:\ProgramData\lx4oz\2ngdj5text
MD5:2C99A16AED3906D92FFE3EF1808E2753
SHA256:08412578CC3BB4922388F8FF8C23962F616B69A1588DA720ADE429129C73C452
6872SSIGRT.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SSIGRT.exe.lnkbinary
MD5:84009B8A028190BC459E6EED1D99D94B
SHA256:C159DD3E5EBFC2BEF56C9102C012CDD3A4ECC2F32EE0DDA8485ED95DFC20C691
2616XNPHLE.exeC:\Users\admin\AppData\Local\Temp\UFEUSLONOIH\SGOXOT.exeexecutable
MD5:3E7CDF51208C96EB024869280FDE9AF9
SHA256:3E1FB01359A0A5F75391368A4D3518F82CCB76F56F3F7C363A60C90678F3C1D7
3240MSBuild.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\35F878CD86A7A14C1EF53773C281B737binary
MD5:513653B72AC27DBD12F65E1C74C0969B
SHA256:D22DE060673942ABD4623C05880EAEF7D12C61950423023399418151BE6D8CFC
5576NXXELQ.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NXXELQ.exe.lnkbinary
MD5:5D9CEB5B5BAC9218BCFE25E44F4A0C2A
SHA256:3E38915D72A969D7ABAB632EF995653A837B8AB84E9FFE385A3080A2F0B19A8B
3240MSBuild.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:1255C99EFAC15807CD877F1E910F49CB
SHA256:7A6C992D6CBD0C5CA070FC7751FA24F7346E7240FAAC5904A8C4D9BFA320C483
3240MSBuild.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\35F878CD86A7A14C1EF53773C281B737binary
MD5:3D331F0817710E8552D5CB79BB81EF79
SHA256:93C7D16634B8E7A132E3C82B48D4513851AA91D31791E69591DD666A284D1973
496NXXELQ.exeC:\Users\admin\AppData\Local\Temp\EMLISFMKEEF\SSIGRT.exeexecutable
MD5:4E88B64FC66298E865BD76790950B8F9
SHA256:D5F6F15BCD3ED0966D65943273A34F17F4EC7B54BDA1E0B01843AA8F635BE446
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
470
DNS requests
133
Threats
20

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
8168
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3240
MSBuild.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
2616
XNPHLE.exe
GET
200
213.209.150.210:80
http://files.innovadentalkj.com/css/VasuisUly.exe
unknown
—
—
malicious
—
—
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3240
MSBuild.exe
GET
200
18.66.147.103:80
http://e6.c.lencr.org/96.crl
unknown
—
—
whitelisted
8168
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3240
MSBuild.exe
GET
200
213.209.150.210:80
http://files.innovadentalkj.com/js/qLos.exe
unknown
—
—
malicious
3240
MSBuild.exe
GET
200
213.209.150.210:80
http://files.innovadentalkj.com/js/nJack.exe
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2616
XNPHLE.exe
213.209.150.210:8437
files.innovadentalkj.com
Alsycon B.V.
GB
malicious
2616
XNPHLE.exe
213.209.150.210:80
files.innovadentalkj.com
Alsycon B.V.
GB
malicious
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
google.com
  • 142.250.184.206
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.166
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
files.innovadentalkj.com
  • 213.209.150.210
unknown
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.67
  • 40.126.32.138
  • 20.190.160.4
  • 20.190.160.132
  • 20.190.160.130
  • 20.190.160.5
  • 20.190.160.128
  • 40.126.32.76
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
t.me
  • 149.154.167.99
whitelisted
72.aa.4t.com
  • 78.46.233.21
unknown

Threats

PID
Process
Class
Message
2616
XNPHLE.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 57
2616
XNPHLE.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
3240
MSBuild.exe
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
3240
MSBuild.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
3240
MSBuild.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7616
MSBuild.exe
Misc activity
ET INFO Observed Telegram Domain (t .me in TLS SNI)
2196
svchost.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Suspected Domain Associated with Malware Distribution (itsrevolutionmagnus .xyz)
8076
Dllhost.exe
Misc activity
ET INFO Possible Host Profile Exfiltration In Pipe Delimited Format
8076
Dllhost.exe
Malware Command and Control Activity Detected
BACKDOOR [ANY.RUN] njRAT Bladabindi CnC Communication command ll
8076
Dllhost.exe
Malware Command and Control Activity Detected
ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ShtrayEasy.exe