download:

/installer/480271/3653570249

Full analysis: https://app.any.run/tasks/a8e5aed4-6c56-463b-b919-971616aa7c41
Verdict: Malicious activity
Threats:

Crypto mining malware is a resource-intensive threat that infiltrates computers with the purpose of mining cryptocurrencies. This type of threat can be deployed either on an infected machine or a compromised website. In both cases the miner will utilize the computing power of the device and its network bandwidth.

Malware Trends Tracker     >>>
Analysis date: September 05, 2024, 13:42:41
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
netreactor
miner
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

609FEA742D34DC1D53F0EEB4873B1A0A

SHA1:

3232C52DA3CB8F47A870162A35CDD75FCAE60AEA

SHA256:

E2E15826B69778E381F25AC8F2B109A377B23F7CF79B5F482E81F4D28C30F95E

SSDEEP:

98304:wSiW4opH4opH4op4U9tNz9RGa/xlbLP/h4:ZDBDBD1t3Hbb+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE for service management

      • net.exe (PID: 4076)
      • CheatEngine75.tmp (PID: 6464)
      • net.exe (PID: 6196)

    • Actions looks like stealing of personal data

      • UnifiedStub-installer.exe (PID: 1640)
      • rsEngineSvc.exe (PID: 6712)
      • rsVPNSvc.exe (PID: 6684)
      • rsDNSSvc.exe (PID: 4128)

    • Changes the autorun value in the registry

      • rundll32.exe (PID: 3812)
      • rundll32.exe (PID: 7732)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 3653570249.tmp (PID: 7004)
      • 3653570249.tmp (PID: 5732)
      • prod0.exe (PID: 236)
      • Cheat Engine.exe (PID: 5988)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7016)
      • UnifiedStub-installer.exe (PID: 1640)
      • rsWSC.exe (PID: 7116)
      • rsEngineSvc.exe (PID: 5540)
      • rsEDRSvc.exe (PID: 6188)
      • rsEngineSvc.exe (PID: 6712)
      • rsVPNSvc.exe (PID: 904)
      • rsDNSSvc.exe (PID: 1748)

    • Executable content was dropped or overwritten

      • 3653570249.exe (PID: 7052)
      • 3653570249.exe (PID: 4444)
      • 3653570249.tmp (PID: 5732)
      • CheatEngine75.tmp (PID: 6464)
      • prod0.exe (PID: 236)
      • CheatEngine75.exe (PID: 6396)
      • 4qumar01.exe (PID: 4132)
      • UnifiedStub-installer.exe (PID: 1640)

    • Reads the Windows owner or organization settings

      • 3653570249.tmp (PID: 5732)
      • CheatEngine75.tmp (PID: 6464)

    • Starts SC.EXE for service management

      • CheatEngine75.tmp (PID: 6464)

    • Uses ICACLS.EXE to modify access control lists

      • CheatEngine75.tmp (PID: 6464)

    • Process drops legitimate windows executable

      • 4qumar01.exe (PID: 4132)
      • CheatEngine75.tmp (PID: 6464)
      • UnifiedStub-installer.exe (PID: 1640)

    • Process drops SQLite DLL files

      • CheatEngine75.tmp (PID: 6464)

    • Searches for installed software

      • UnifiedStub-installer.exe (PID: 1640)
      • rsVPNSvc.exe (PID: 6684)

    • Reads the date of Windows installation

      • prod0.exe (PID: 236)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7016)
      • rsEDRSvc.exe (PID: 4020)
      • rsEngineSvc.exe (PID: 6712)

    • Executes as Windows Service

      • rsSyncSvc.exe (PID: 1812)
      • rsWSC.exe (PID: 32)
      • rsClientSvc.exe (PID: 3208)
      • rsEngineSvc.exe (PID: 6712)
      • rsEDRSvc.exe (PID: 4020)
      • WmiApSrv.exe (PID: 1828)
      • rsVPNClientSvc.exe (PID: 2660)
      • rsVPNSvc.exe (PID: 6684)
      • WmiApSrv.exe (PID: 7040)
      • rsDNSClientSvc.exe (PID: 7924)
      • rsDNSResolver.exe (PID: 8116)
      • rsDNSSvc.exe (PID: 4128)
      • WmiApSrv.exe (PID: 7732)

    • Creates a software uninstall entry

      • UnifiedStub-installer.exe (PID: 1640)

    • Detected use of alternative data streams (AltDS)

      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7016)

    • Checks Windows Trust Settings

      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7016)
      • UnifiedStub-installer.exe (PID: 1640)
      • rsWSC.exe (PID: 7116)
      • rsEngineSvc.exe (PID: 5540)
      • rsEDRSvc.exe (PID: 6188)
      • rsWSC.exe (PID: 32)
      • rsEDRSvc.exe (PID: 4020)
      • rsEngineSvc.exe (PID: 6712)
      • rsVPNSvc.exe (PID: 904)
      • rsDNSSvc.exe (PID: 1748)

    • Uses RUNDLL32.EXE to load library

      • UnifiedStub-installer.exe (PID: 1640)

    • The process drops C-runtime libraries

      • UnifiedStub-installer.exe (PID: 1640)

    • Creates or modifies Windows services

      • rundll32.exe (PID: 3812)
      • UnifiedStub-installer.exe (PID: 1640)

    • Creates files in the driver directory

      • UnifiedStub-installer.exe (PID: 1640)

    • Drops 7-zip archiver for unpacking

      • UnifiedStub-installer.exe (PID: 1640)

    • Adds/modifies Windows certificates

      • UnifiedStub-installer.exe (PID: 1640)
      • rsWSC.exe (PID: 7116)
      • rsEngineSvc.exe (PID: 6712)

    • Drops a system driver (possible attempt to evade defenses)

      • UnifiedStub-installer.exe (PID: 1640)

    • The process creates files with name similar to system file names

      • UnifiedStub-installer.exe (PID: 1640)

    • Uses WEVTUTIL.EXE to install publishers and event logs from the manifest

      • UnifiedStub-installer.exe (PID: 1640)

    • Reads the BIOS version

      • rsEDRSvc.exe (PID: 4020)
      • rsEngineSvc.exe (PID: 6712)

    • Dropped object may contain URLs of mainers pools

      • rsEngineSvc.exe (PID: 6712)

    • Application launched itself

      • rsAppUI.exe (PID: 5692)
      • rsAppUI.exe (PID: 6268)
      • rsAppUI.exe (PID: 7752)

    • Process checks is Powershell's Script Block Logging on

      • rsEDRSvc.exe (PID: 4020)

    • The process checks if it is being run in the virtual environment

      • rsEngineSvc.exe (PID: 6712)
      • rsVPNSvc.exe (PID: 6684)
      • rsDNSSvc.exe (PID: 4128)

    • There is functionality for taking screenshot (YARA)

      • rsHelper.exe (PID: 6800)
      • rsVPNSvc.exe (PID: 6684)

    • Process uses IPCONFIG to clear DNS cache

      • cmd.exe (PID: 7636)
      • cmd.exe (PID: 5284)

    • Starts CMD.EXE for commands execution

      • rsDNSSvc.exe (PID: 4128)

  • INFO

    • Checks supported languages

      • 3653570249.exe (PID: 7052)
      • 3653570249.tmp (PID: 7004)
      • 3653570249.exe (PID: 4444)
      • 3653570249.tmp (PID: 5732)
      • CheatEngine75.exe (PID: 6396)
      • prod0.exe (PID: 236)
      • _setup64.tmp (PID: 6488)
      • CheatEngine75.tmp (PID: 6464)
      • UnifiedStub-installer.exe (PID: 1640)
      • 4qumar01.exe (PID: 4132)
      • rsSyncSvc.exe (PID: 1332)
      • Kernelmoduleunloader.exe (PID: 6252)
      • windowsrepair.exe (PID: 3728)
      • Cheat Engine.exe (PID: 5988)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7016)
      • rsSyncSvc.exe (PID: 1812)
      • Tutorial-x86_64.exe (PID: 568)
      • rsWSC.exe (PID: 32)
      • rsClientSvc.exe (PID: 5888)
      • rsWSC.exe (PID: 7116)
      • rsClientSvc.exe (PID: 3208)
      • rsEngineSvc.exe (PID: 5540)
      • rsEngineSvc.exe (PID: 6712)
      • rsEDRSvc.exe (PID: 6188)
      • rsEDRSvc.exe (PID: 4020)
      • rsHelper.exe (PID: 6800)
      • EPP.exe (PID: 1932)
      • rsAppUI.exe (PID: 5692)
      • rsAppUI.exe (PID: 876)
      • rsAppUI.exe (PID: 232)
      • rsAppUI.exe (PID: 5040)
      • rsAppUI.exe (PID: 4760)
      • rsLitmus.A.exe (PID: 6340)
      • rsVPNClientSvc.exe (PID: 872)
      • rsVPNClientSvc.exe (PID: 2660)
      • rsVPNSvc.exe (PID: 904)
      • rsVPNSvc.exe (PID: 6684)
      • VPN.exe (PID: 2032)
      • rsAppUI.exe (PID: 6268)
      • rsAppUI.exe (PID: 4252)
      • rsAppUI.exe (PID: 6668)
      • rsDNSResolver.exe (PID: 7960)
      • rsDNSClientSvc.exe (PID: 7924)
      • rsDNSClientSvc.exe (PID: 7860)
      • rsAppUI.exe (PID: 4284)
      • rsDNSResolver.exe (PID: 8116)
      • rsDNSSvc.exe (PID: 1748)
      • rsDNSResolver.exe (PID: 8036)
      • rsDNSSvc.exe (PID: 4128)
      • rsAppUI.exe (PID: 7480)
      • DNS.exe (PID: 5160)
      • rsAppUI.exe (PID: 7752)
      • rsAppUI.exe (PID: 8076)
      • rsAppUI.exe (PID: 1344)
      • rsAppUI.exe (PID: 4576)
      • rsAppUI.exe (PID: 8184)

    • Reads the computer name

      • 3653570249.tmp (PID: 7004)
      • 3653570249.tmp (PID: 5732)
      • prod0.exe (PID: 236)
      • CheatEngine75.tmp (PID: 6464)
      • UnifiedStub-installer.exe (PID: 1640)
      • rsSyncSvc.exe (PID: 1812)
      • Kernelmoduleunloader.exe (PID: 6252)
      • Cheat Engine.exe (PID: 5988)
      • rsSyncSvc.exe (PID: 1332)
      • Tutorial-x86_64.exe (PID: 568)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7016)
      • rsWSC.exe (PID: 32)
      • rsClientSvc.exe (PID: 5888)
      • rsWSC.exe (PID: 7116)
      • rsEngineSvc.exe (PID: 5540)
      • rsEngineSvc.exe (PID: 6712)
      • rsClientSvc.exe (PID: 3208)
      • rsHelper.exe (PID: 6800)
      • rsEDRSvc.exe (PID: 6188)
      • rsEDRSvc.exe (PID: 4020)
      • rsAppUI.exe (PID: 5692)
      • rsAppUI.exe (PID: 5040)
      • rsAppUI.exe (PID: 876)
      • rsVPNClientSvc.exe (PID: 872)
      • rsVPNClientSvc.exe (PID: 2660)
      • rsVPNSvc.exe (PID: 6684)
      • rsVPNSvc.exe (PID: 904)
      • rsAppUI.exe (PID: 6268)
      • rsAppUI.exe (PID: 4252)
      • rsDNSClientSvc.exe (PID: 7860)
      • rsDNSClientSvc.exe (PID: 7924)
      • rsAppUI.exe (PID: 6668)
      • rsAppUI.exe (PID: 7752)
      • rsDNSResolver.exe (PID: 8116)
      • rsDNSSvc.exe (PID: 1748)
      • rsDNSResolver.exe (PID: 8036)
      • rsDNSSvc.exe (PID: 4128)
      • rsAppUI.exe (PID: 1344)
      • rsAppUI.exe (PID: 8076)
      • rsAppUI.exe (PID: 4576)

    • Create files in a temporary directory

      • 3653570249.exe (PID: 7052)
      • 3653570249.exe (PID: 4444)
      • prod0.exe (PID: 236)
      • 3653570249.tmp (PID: 5732)
      • CheatEngine75.tmp (PID: 6464)
      • CheatEngine75.exe (PID: 6396)
      • 4qumar01.exe (PID: 4132)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7016)
      • UnifiedStub-installer.exe (PID: 1640)
      • rsAppUI.exe (PID: 5692)
      • rsAppUI.exe (PID: 6268)
      • rsAppUI.exe (PID: 7752)

    • Process checks computer location settings

      • 3653570249.tmp (PID: 7004)
      • 3653570249.tmp (PID: 5732)
      • prod0.exe (PID: 236)
      • Cheat Engine.exe (PID: 5988)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7016)
      • rsAppUI.exe (PID: 5692)
      • rsAppUI.exe (PID: 232)
      • rsAppUI.exe (PID: 4760)
      • rsVPNSvc.exe (PID: 6684)
      • rsAppUI.exe (PID: 6268)
      • rsAppUI.exe (PID: 4284)
      • rsAppUI.exe (PID: 7480)
      • rsAppUI.exe (PID: 8184)
      • rsAppUI.exe (PID: 7752)

    • Reads the machine GUID from the registry

      • prod0.exe (PID: 236)
      • 3653570249.tmp (PID: 5732)
      • UnifiedStub-installer.exe (PID: 1640)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7016)
      • rsWSC.exe (PID: 7116)
      • rsWSC.exe (PID: 32)
      • rsEngineSvc.exe (PID: 6712)
      • rsEngineSvc.exe (PID: 5540)
      • rsHelper.exe (PID: 6800)
      • rsEDRSvc.exe (PID: 6188)
      • rsEDRSvc.exe (PID: 4020)
      • rsAppUI.exe (PID: 5692)
      • rsVPNSvc.exe (PID: 904)
      • rsVPNSvc.exe (PID: 6684)
      • rsAppUI.exe (PID: 6268)
      • rsDNSSvc.exe (PID: 1748)
      • rsDNSSvc.exe (PID: 4128)
      • rsAppUI.exe (PID: 7752)
      • rsAppUI.exe (PID: 4576)

    • Checks proxy server information

      • prod0.exe (PID: 236)
      • 3653570249.tmp (PID: 5732)
      • UnifiedStub-installer.exe (PID: 1640)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7016)
      • rsWSC.exe (PID: 7116)
      • rsAppUI.exe (PID: 5692)
      • slui.exe (PID: 5244)
      • rsAppUI.exe (PID: 6268)
      • rsAppUI.exe (PID: 7752)

    • Reads the software policy settings

      • 3653570249.tmp (PID: 5732)
      • prod0.exe (PID: 236)
      • UnifiedStub-installer.exe (PID: 1640)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7016)
      • slui.exe (PID: 5504)
      • rsWSC.exe (PID: 7116)
      • rsEngineSvc.exe (PID: 5540)
      • rsEngineSvc.exe (PID: 6712)
      • rsEDRSvc.exe (PID: 6188)
      • rsWSC.exe (PID: 32)
      • rsEDRSvc.exe (PID: 4020)
      • slui.exe (PID: 5244)
      • rsVPNSvc.exe (PID: 904)
      • rsVPNSvc.exe (PID: 6684)
      • rsDNSSvc.exe (PID: 1748)
      • rsDNSSvc.exe (PID: 4128)

    • The process uses the downloaded file

      • 3653570249.tmp (PID: 5732)
      • UnifiedStub-installer.exe (PID: 1640)
      • prod0.exe (PID: 236)
      • Cheat Engine.exe (PID: 5988)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7016)
      • rsWSC.exe (PID: 7116)
      • runonce.exe (PID: 1932)
      • rsEngineSvc.exe (PID: 5540)
      • rsEDRSvc.exe (PID: 6188)
      • rsEngineSvc.exe (PID: 6712)
      • rsVPNSvc.exe (PID: 904)
      • runonce.exe (PID: 7776)
      • rsDNSSvc.exe (PID: 1748)

    • Disables trace logs

      • prod0.exe (PID: 236)
      • UnifiedStub-installer.exe (PID: 1640)
      • rsEngineSvc.exe (PID: 6712)
      • rsEDRSvc.exe (PID: 4020)
      • rsVPNSvc.exe (PID: 6684)
      • rsDNSSvc.exe (PID: 4128)

    • Reads Environment values

      • prod0.exe (PID: 236)
      • UnifiedStub-installer.exe (PID: 1640)
      • rsEngineSvc.exe (PID: 6712)
      • rsEDRSvc.exe (PID: 4020)
      • rsAppUI.exe (PID: 5692)
      • rsVPNSvc.exe (PID: 6684)
      • rsAppUI.exe (PID: 6268)
      • rsDNSSvc.exe (PID: 4128)
      • rsAppUI.exe (PID: 7752)

    • Creates files in the program directory

      • CheatEngine75.tmp (PID: 6464)
      • UnifiedStub-installer.exe (PID: 1640)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7016)
      • rsWSC.exe (PID: 7116)
      • rsEngineSvc.exe (PID: 5540)
      • rsEngineSvc.exe (PID: 6712)
      • rsEDRSvc.exe (PID: 6188)
      • rsEDRSvc.exe (PID: 4020)
      • rsVPNSvc.exe (PID: 904)
      • rsVPNSvc.exe (PID: 6684)
      • rsDNSResolver.exe (PID: 8116)
      • rsDNSResolver.exe (PID: 8036)
      • rsDNSSvc.exe (PID: 1748)
      • rsDNSSvc.exe (PID: 4128)

    • Sends debugging messages

      • Kernelmoduleunloader.exe (PID: 6252)
      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7016)
      • rsEngineSvc.exe (PID: 6712)
      • rsEDRSvc.exe (PID: 4020)

    • Creates a software uninstall entry

      • CheatEngine75.tmp (PID: 6464)

    • .NET Reactor protector has been detected

      • UnifiedStub-installer.exe (PID: 1640)
      • rsWSC.exe (PID: 32)
      • rsHelper.exe (PID: 6800)
      • rsEDRSvc.exe (PID: 4020)
      • rsEngineSvc.exe (PID: 6712)
      • rsVPNSvc.exe (PID: 6684)

    • Creates files or folders in the user directory

      • cheatengine-x86_64-SSE4-AVX2.exe (PID: 7016)
      • UnifiedStub-installer.exe (PID: 1640)
      • rsWSC.exe (PID: 7116)
      • rsEngineSvc.exe (PID: 6712)
      • rsAppUI.exe (PID: 5692)
      • rsAppUI.exe (PID: 5040)
      • rsAppUI.exe (PID: 6268)
      • rsVPNSvc.exe (PID: 6684)
      • rsAppUI.exe (PID: 6668)
      • rsDNSSvc.exe (PID: 4128)
      • rsAppUI.exe (PID: 7752)
      • rsAppUI.exe (PID: 1344)
      • rsAppUI.exe (PID: 4576)

    • Reads the time zone

      • runonce.exe (PID: 1932)
      • rsEngineSvc.exe (PID: 6712)
      • rsEDRSvc.exe (PID: 4020)
      • rsVPNSvc.exe (PID: 6684)
      • runonce.exe (PID: 7776)
      • rsDNSSvc.exe (PID: 4128)

    • Reads security settings of Internet Explorer

      • runonce.exe (PID: 1932)
      • runonce.exe (PID: 7776)

    • Reads product name

      • rsEDRSvc.exe (PID: 4020)
      • rsAppUI.exe (PID: 5692)
      • rsEngineSvc.exe (PID: 6712)
      • rsAppUI.exe (PID: 6268)
      • rsAppUI.exe (PID: 7752)

    • Reads CPU info

      • rsEngineSvc.exe (PID: 6712)
      • rsEDRSvc.exe (PID: 4020)
      • rsVPNSvc.exe (PID: 6684)
      • rsDNSSvc.exe (PID: 4128)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (51.8)
.exe | InstallShield setup (20.3)
.exe | Win32 EXE PECompact compressed (generic) (19.6)
.dll | Win32 Dynamic Link Library (generic) (3.1)
.exe | Win32 Executable (generic) (2.1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:11:15 09:48:30+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741376
InitializedDataSize: 38400
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6.1
ImageVersion: 6
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 7.5.0.0
ProductVersionNumber: 7.5.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: EngineGame Installer
FileVersion: 7.5.0
LegalCopyright: © EngineGame
OriginalFileName:
ProductName: EngineGame
ProductVersion: 7.5.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
239
Monitored processes
102
Malicious processes
13
Suspicious processes
7

Behavior graph

Click at the process to see the details
start 3653570249.exe 3653570249.tmp no specs 3653570249.exe 3653570249.tmp sppextcomobj.exe no specs slui.exe prod0.exe cheatengine75.exe cheatengine75.tmp net.exe no specs conhost.exe no specs net1.exe no specs net.exe no specs conhost.exe no specs net1.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs _setup64.tmp no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs 4qumar01.exe THREAT unifiedstub-installer.exe rssyncsvc.exe no specs conhost.exe no specs rssyncsvc.exe no specs kernelmoduleunloader.exe windowsrepair.exe no specs icacls.exe no specs conhost.exe no specs cheat engine.exe no specs cheatengine-x86_64-sse4-avx2.exe tutorial-x86_64.exe no specs slui.exe rundll32.exe runonce.exe no specs grpconv.exe no specs wevtutil.exe no specs conhost.exe no specs fltmc.exe no specs conhost.exe no specs wevtutil.exe no specs conhost.exe no specs rswsc.exe THREAT rswsc.exe no specs rsclientsvc.exe no specs conhost.exe no specs rsclientsvc.exe no specs rsenginesvc.exe no specs THREAT rsenginesvc.exe THREAT rshelper.exe no specs rsedrsvc.exe no specs THREAT rsedrsvc.exe epp.exe no specs rsappui.exe no specs wmiapsrv.exe no specs rsappui.exe no specs rsappui.exe no specs rsappui.exe no specs rsappui.exe no specs rslitmus.a.exe no specs conhost.exe no specs rsvpnclientsvc.exe no specs conhost.exe no specs rsvpnclientsvc.exe no specs rsvpnsvc.exe no specs THREAT rsvpnsvc.exe vpn.exe no specs rsappui.exe no specs wmiapsrv.exe no specs rsappui.exe no specs rsappui.exe rsappui.exe no specs rsappui.exe no specs rundll32.exe runonce.exe no specs grpconv.exe no specs rsdnsclientsvc.exe no specs conhost.exe no specs rsdnsclientsvc.exe no specs rsdnsresolver.exe no specs conhost.exe no specs rsdnsresolver.exe no specs conhost.exe no specs rsdnsresolver.exe no specs rsdnssvc.exe no specs rsdnssvc.exe cmd.exe no specs conhost.exe no specs ipconfig.exe no specs dns.exe no specs rsappui.exe no specs wmiapsrv.exe no specs rsappui.exe no specs rsappui.exe rsappui.exe no specs cmd.exe no specs conhost.exe no specs ipconfig.exe no specs rsappui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
32"C:\Program Files\ReasonLabs\EPP\rsWSC.exe"C:\Program Files\ReasonLabs\EPP\rsWSC.exe
services.exe
User:
SYSTEM
Company:
Reason Software Company Inc.
Integrity Level:
SYSTEM
Description:
rsWSC
Version:
6.0.3.0
Modules
Images
c:\program files\reasonlabs\epp\rswsc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
232"C:\Program Files\ReasonLabs\Common\Client\v1.6.0\rsAppUI.exe" --type=renderer --user-data-dir="C:\Users\admin\AppData\Roaming\ReasonLabs\EPP" --standard-schemes=mc --secure-schemes=mc --app-user-model-id=com.reasonlabs.epp --app-path="C:\Program Files\ReasonLabs\Common\Client\v1.6.0\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2460,i,10940331970776295661,2164900910089398279,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:1C:\Program Files\ReasonLabs\Common\Client\v1.6.0\rsAppUI.exe—rsAppUI.exe
User:
admin
Company:
Reason Cybersecurity Ltd.
Integrity Level:
LOW
Description:
ReasonLabs Application
Version:
1.6.0
Modules
Images
c:\program files\reasonlabs\common\client\v1.6.0\rsappui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
236"C:\Users\admin\AppData\Local\Temp\is-3REAT.tmp\prod0.exe" -ip:"dui=bb926e54-e3ca-40fd-ae90-2764341e7792&dit=20240905134254&is_silent=true&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100&b=&se=true" -vp:"dui=bb926e54-e3ca-40fd-ae90-2764341e7792&dit=20240905134254&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100&oip=26&ptl=7&dta=true" -dp:"dui=bb926e54-e3ca-40fd-ae90-2764341e7792&dit=20240905134254&oc=ZB_RAV_Cross_Tri_NCB&p=cdc2&a=100" -i -v -d -se=trueC:\Users\admin\AppData\Local\Temp\is-3REAT.tmp\prod0.exe
3653570249.tmp
User:
admin
Company:
Reason Software Company Inc.
Integrity Level:
HIGH
Description:
rsStubActivator
Exit code:
0
Version:
1.6.1.0
Modules
Images
c:\users\admin\appdata\local\temp\is-3reat.tmp\prod0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
568"C:\Program Files\Cheat Engine 7.5\Tutorial-x86_64.exe" C:\Program Files\Cheat Engine 7.5\Tutorial-x86_64.exe—cheatengine-x86_64-SSE4-AVX2.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\cheat engine 7.5\tutorial-x86_64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
752"icacls" "C:\Program Files\Cheat Engine 7.5" /grant *S-1-15-2-1:(OI)(CI)(RX)C:\Windows\System32\icacls.exe—CheatEngine75.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
812\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—wevtutil.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
872"C:\Program Files\ReasonLabs\VPN\rsVPNClientSvc.exe" -i -iC:\Program Files\ReasonLabs\VPN\rsVPNClientSvc.exe—UnifiedStub-installer.exe
User:
admin
Company:
Reason Software Company Inc.
Integrity Level:
HIGH
Description:
Reason Client Service
Exit code:
0
Version:
4.5.1.0
Modules
Images
c:\program files\reasonlabs\vpn\rsvpnclientsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
876"C:\Program Files\ReasonLabs\Common\Client\v1.6.0\rsAppUI.exe" --type=gpu-process --user-data-dir="C:\Users\admin\AppData\Roaming\ReasonLabs\EPP" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1720,i,10940331970776295661,2164900910089398279,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1712 /prefetch:2C:\Program Files\ReasonLabs\Common\Client\v1.6.0\rsAppUI.exe—rsAppUI.exe
User:
admin
Company:
Reason Cybersecurity Ltd.
Integrity Level:
LOW
Description:
ReasonLabs Application
Version:
1.6.0
Modules
Images
c:\program files\reasonlabs\common\client\v1.6.0\rsappui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
904"C:\Program Files\ReasonLabs\VPN\rsVPNSvc.exe" -i -iC:\Program Files\ReasonLabs\VPN\rsVPNSvc.exe—UnifiedStub-installer.exe
User:
admin
Company:
Reason Software Company Inc.
Integrity Level:
HIGH
Description:
rsVPNSvc
Exit code:
0
Version:
2.18.0.0
Modules
Images
c:\program files\reasonlabs\vpn\rsvpnsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
940\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—rsClientSvc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
76 935
Read events
76 396
Write events
325
Delete events
214

Modification events

(PID) Process:(236) prod0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\prod0_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(236) prod0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\prod0_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(236) prod0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\prod0_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(236) prod0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\prod0_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(236) prod0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\prod0_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(236) prod0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\prod0_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(236) prod0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\prod0_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(236) prod0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\prod0_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(236) prod0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\prod0_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(236) prod0.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\prod0_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
1 003
Suspicious files
336
Text files
498
Unknown types
164

Dropped files

PID
Process
Filename
Type
70523653570249.exeC:\Users\admin\AppData\Local\Temp\is-LKONQ.tmp\3653570249.tmpexecutable
MD5:1CDBF6DA4DEFE32C9CB5908968A02FAB
SHA256:87C1BB2236A874C97369B2CCA0D55559FA917707CEBDDF7A5EABC691F8302487
57323653570249.tmpC:\Users\admin\AppData\Local\Temp\is-3REAT.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
44443653570249.exeC:\Users\admin\AppData\Local\Temp\is-2J96T.tmp\3653570249.tmpexecutable
MD5:1CDBF6DA4DEFE32C9CB5908968A02FAB
SHA256:87C1BB2236A874C97369B2CCA0D55559FA917707CEBDDF7A5EABC691F8302487
57323653570249.tmpC:\Users\admin\AppData\Local\Temp\is-3REAT.tmp\zbShieldUtils.dllexecutable
MD5:FAD0877741DA31AB87913EF1F1F2EB1A
SHA256:73FF938887449779E7A9D51100D7BE2195198A5E2C4C7DE5F93CEAC7E98E3E02
6396CheatEngine75.exeC:\Users\admin\AppData\Local\Temp\is-RQS9H.tmp\CheatEngine75.tmpexecutable
MD5:9AA2ACD4C96F8BA03BB6C3EA806D806F
SHA256:1B81562FDAEAA1BC22CBAA15C92BAB90A12080519916CFA30C843796021153BB
6464CheatEngine75.tmpC:\Program Files\Cheat Engine 7.5\unins000.exeexecutable
MD5:9AA2ACD4C96F8BA03BB6C3EA806D806F
SHA256:1B81562FDAEAA1BC22CBAA15C92BAB90A12080519916CFA30C843796021153BB
57323653570249.tmpC:\Users\admin\AppData\Local\Temp\is-3REAT.tmp\is-40AS0.tmpexecutable
MD5:E0F666FE4FF537FB8587CCD215E41E5F
SHA256:F88B0E5A32A395AB9996452D461820679E55C19952EFFE991DEE8FEDEA1968AF
57323653570249.tmpC:\Users\admin\AppData\Local\Temp\is-3REAT.tmp\is-3MC66.tmpexecutable
MD5:5D90C6B745C6264513710604E98A6B3B
SHA256:8A812327228754DB9013CE01F456BD63CB901227CDD0285A1964305E258D73FC
57323653570249.tmpC:\Users\admin\AppData\Local\Temp\is-3REAT.tmp\CheatEngine75.exeexecutable
MD5:E0F666FE4FF537FB8587CCD215E41E5F
SHA256:F88B0E5A32A395AB9996452D461820679E55C19952EFFE991DEE8FEDEA1968AF
6464CheatEngine75.tmpC:\Program Files\Cheat Engine 7.5\is-0B9F3.tmpexecutable
MD5:9AA2ACD4C96F8BA03BB6C3EA806D806F
SHA256:1B81562FDAEAA1BC22CBAA15C92BAB90A12080519916CFA30C843796021153BB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
50
TCP/UDP connections
124
DNS requests
51
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6192
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6816
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
876
SIHClient.exe
GET
200
23.32.185.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
876
SIHClient.exe
GET
200
23.32.185.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1640
UnifiedStub-installer.exe
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRBq81UG1MnDOVNKqff0SSEz6JuZwQU6IPEM9fcnwycdpoKptTfh6ZeWO4CEzMAAWTujc16eayoCZIAAAABZO4%3D
unknown
—
—
whitelisted
1640
UnifiedStub-installer.exe
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBTDHsfuqfubd3pihvq4mgQVWgHWNwQUyH7SaoUqG8oZmAQHJ89QEE9oqKICEzMAAAAHh6M0o3uljhwAAAAAAAc%3D
unknown
—
—
whitelisted
1640
UnifiedStub-installer.exe
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBTOQYLFSE5GO%2FpaRVfYu7d9gZEbQAQU2UEpsA8PY2zvadf1zSmepEhqMOYCEzMAAAAHN4xbodlbjNQAAAAAAAc%3D
unknown
—
—
whitelisted
1640
UnifiedStub-installer.exe
GET
200
204.79.197.203:80
http://oneocsp.microsoft.com/ocsp/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRBq81UG1MnDOVNKqff0SSEz6JuZwQU6IPEM9fcnwycdpoKptTfh6ZeWO4CEzMAAWTujc16eayoCZIAAAABZO4%3D
unknown
—
—
whitelisted
7016
cheatengine-x86_64-SSE4-AVX2.exe
GET
200
216.58.206.67:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
7016
cheatengine-x86_64-SSE4-AVX2.exe
GET
200
216.58.206.67:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6288
RUXIMICS.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2120
MoUsoCoreWorker.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6192
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5732
3653570249.tmp
18.66.137.114:443
d2oq4dwfbh6gxl.cloudfront.net
AMAZON-02
US
whitelisted
6192
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6192
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3260
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6816
svchost.exe
40.126.31.69:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted
d2oq4dwfbh6gxl.cloudfront.net
  • 18.66.137.114
  • 18.66.137.70
  • 18.66.137.198
  • 18.66.137.45
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
  • 51.104.136.2
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 23.32.185.131
whitelisted
client.wns.windows.com
  • 40.113.103.199
  • 40.113.110.67
whitelisted
login.live.com
  • 40.126.31.69
  • 20.190.159.0
  • 20.190.159.68
  • 20.190.159.23
  • 20.190.159.64
  • 40.126.31.67
  • 20.190.159.4
  • 40.126.31.73
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
shield.reasonsecurity.com
  • 18.239.36.92
  • 18.239.36.26
  • 18.239.36.106
  • 18.239.36.94
unknown
slscr.update.microsoft.com
  • 40.127.169.103
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.166.126.56
whitelisted

Threats

No threats detected
Process
Message
Kernelmoduleunloader.exe
Kernelmodule unloader
Kernelmoduleunloader.exe
Running in wow64
Kernelmoduleunloader.exe
Setup. So do not show messages
Kernelmoduleunloader.exe
attempting to unload
Kernelmoduleunloader.exe
SCManager opened
Kernelmoduleunloader.exe
count=0
Kernelmoduleunloader.exe
setup=true
cheatengine-x86_64-SSE4-AVX2.exe
Lua thread terminated
rsEngineSvc.exe
Native library pre-loader is trying to load native SQLite library "C:\Program Files\ReasonLabs\EPP\x64\SQLite.Interop.dll"...
rsEDRSvc.exe
Native library pre-loader is trying to load native SQLite library "C:\Program Files\ReasonLabs\EDR\x64\SQLite.Interop.dll"...
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/installer/480271/3653570249