File name:

e49ac3d276a063483f0ff0fb188f714a43be26a0e319569efcd5ae0487fe360b

Full analysis: https://app.any.run/tasks/bffd58f5-3a68-476a-95d5-453757ac20c5
Verdict: Malicious activity
Analysis date: January 11, 2025, 00:42:38
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

184C4378B6A2ED789C3AA3A5FE315A57

SHA1:

875AA1ADDBCE0DB830EC5F837DF6A210A30EE484

SHA256:

E49AC3D276A063483F0FF0FB188F714A43BE26A0E319569EFCD5AE0487FE360B

SSDEEP:

24576:Rf1up0WoQ1ix/uNAJ1sKPxwLtNzUQU8LPbF56gHK7wa449ZnJPxeSfUhea9iNs9J:Rf1up0WoQ1ix/uqJ1sKPxwLtNzUQNLPr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • e49ac3d276a063483f0ff0fb188f714a43be26a0e319569efcd5ae0487fe360b.exe (PID: 6404)

    • Executing a file with an untrusted certificate

      • e49ac3d276a063483f0ff0fb188f714a43be26a0e319569efcd5ae0487fe360b.exe (PID: 2744)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • e49ac3d276a063483f0ff0fb188f714a43be26a0e319569efcd5ae0487fe360b.exe (PID: 6404)

    • Application launched itself

      • e49ac3d276a063483f0ff0fb188f714a43be26a0e319569efcd5ae0487fe360b.exe (PID: 6404)

    • Executable content was dropped or overwritten

      • e49ac3d276a063483f0ff0fb188f714a43be26a0e319569efcd5ae0487fe360b.exe (PID: 6404)

    • Executes application which crashes

      • e49ac3d276a063483f0ff0fb188f714a43be26a0e319569efcd5ae0487fe360b.exe (PID: 2744)

  • INFO

    • Creates files or folders in the user directory

      • e49ac3d276a063483f0ff0fb188f714a43be26a0e319569efcd5ae0487fe360b.exe (PID: 6404)
      • WerFault.exe (PID: 1744)

    • Reads the software policy settings

      • WerFault.exe (PID: 1744)

    • Create files in a temporary directory

      • e49ac3d276a063483f0ff0fb188f714a43be26a0e319569efcd5ae0487fe360b.exe (PID: 6404)

    • Reads the computer name

      • e49ac3d276a063483f0ff0fb188f714a43be26a0e319569efcd5ae0487fe360b.exe (PID: 6404)

    • Reads the machine GUID from the registry

      • e49ac3d276a063483f0ff0fb188f714a43be26a0e319569efcd5ae0487fe360b.exe (PID: 6404)

    • Checks proxy server information

      • WerFault.exe (PID: 1744)

    • Checks supported languages

      • e49ac3d276a063483f0ff0fb188f714a43be26a0e319569efcd5ae0487fe360b.exe (PID: 6404)

    • The process uses the downloaded file

      • e49ac3d276a063483f0ff0fb188f714a43be26a0e319569efcd5ae0487fe360b.exe (PID: 6404)

    • Process checks computer location settings

      • e49ac3d276a063483f0ff0fb188f714a43be26a0e319569efcd5ae0487fe360b.exe (PID: 6404)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.scr | Windows screen saver (46.4)
.dll | Win32 Dynamic Link Library (generic) (23.3)
.exe | Win32 Executable (generic) (15.9)
.exe | Generic Win/DOS Executable (7.1)
.exe | DOS Executable Generic (7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:12:23 00:28:38+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 854528
InitializedDataSize: 2560
UninitializedDataSize: -
EntryPoint: 0xd2836
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 2.0.0.781
ProductVersionNumber: 2.0.0.781
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: PDF document
CompanyName: Adobe Reader
FileDescription: Microsoft PDF Document
FileVersion: 2.0.0.781
InternalName: VhBK.exe
LegalCopyright: Adobe Inc. All rights reserved
LegalTrademarks: PDF document
OriginalFileName: VhBK.exe
ProductName: Adobe Reader
ProductVersion: 2.0.0.781
AssemblyVersion: 2.0.0.781
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
130
Monitored processes
5
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start e49ac3d276a063483f0ff0fb188f714a43be26a0e319569efcd5ae0487fe360b.exe schtasks.exe no specs conhost.exe no specs e49ac3d276a063483f0ff0fb188f714a43be26a0e319569efcd5ae0487fe360b.exe werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
6404"C:\Users\admin\AppData\Local\Temp\e49ac3d276a063483f0ff0fb188f714a43be26a0e319569efcd5ae0487fe360b.exe" C:\Users\admin\AppData\Local\Temp\e49ac3d276a063483f0ff0fb188f714a43be26a0e319569efcd5ae0487fe360b.exe
explorer.exe
User:
admin
Company:
Adobe Reader
Integrity Level:
MEDIUM
Description:
Microsoft PDF Document
Exit code:
0
Version:
2.0.0.781
Modules
Images
c:\users\admin\appdata\local\temp\e49ac3d276a063483f0ff0fb188f714a43be26a0e319569efcd5ae0487fe360b.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7128"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AzieQpv" /XML "C:\Users\admin\AppData\Local\Temp\tmp953E.tmp"C:\Windows\SysWOW64\schtasks.exe—e49ac3d276a063483f0ff0fb188f714a43be26a0e319569efcd5ae0487fe360b.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7136\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2744"C:\Users\admin\AppData\Local\Temp\e49ac3d276a063483f0ff0fb188f714a43be26a0e319569efcd5ae0487fe360b.exe"C:\Users\admin\AppData\Local\Temp\e49ac3d276a063483f0ff0fb188f714a43be26a0e319569efcd5ae0487fe360b.exe
e49ac3d276a063483f0ff0fb188f714a43be26a0e319569efcd5ae0487fe360b.exe
User:
admin
Company:
Adobe Reader
Integrity Level:
MEDIUM
Description:
Microsoft PDF Document
Exit code:
3221225477
Version:
2.0.0.781
Modules
Images
c:\users\admin\appdata\local\temp\e49ac3d276a063483f0ff0fb188f714a43be26a0e319569efcd5ae0487fe360b.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1744C:\WINDOWS\SysWOW64\WerFault.exe -u -p 2744 -s 228C:\Windows\SysWOW64\WerFault.exe
e49ac3d276a063483f0ff0fb188f714a43be26a0e319569efcd5ae0487fe360b.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
3 561
Read events
3 561
Write events
0
Delete events
0

Modification events

No data
Executable files
1
Suspicious files
6
Text files
3
Unknown types
0

Dropped files

PID
Process
Filename
Type
1744WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_e49ac3d276a06348_444c76d6f7865f942ae9e626ff9e2668b445e81_000a83e2_4b8f9a5b-f2ed-4a14-bdd2-ce37c336933a\Report.wer —
MD5:—
SHA256:—
1744WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\21253908F3CB05D51B1C2DA8B681A785binary
MD5:F6F53CD09A41E968C363419B279D3112
SHA256:6D2BB01CC7A9BADE2113B219CAC1BDA86B2733196B7E1BD0C807CE1E396B1892
6404e49ac3d276a063483f0ff0fb188f714a43be26a0e319569efcd5ae0487fe360b.exeC:\Users\admin\AppData\Roaming\AzieQpv.exeexecutable
MD5:184C4378B6A2ED789C3AA3A5FE315A57
SHA256:E49AC3D276A063483F0FF0FB188F714A43BE26A0E319569EFCD5AE0487FE360B
1744WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERE545.tmp.xmlxml
MD5:DADDA94CF012F516FFCF07547F5FE185
SHA256:7C1A473615BDDA9944E8EF3BCD92A4F743D738DBA2AA5137D2CD6B5D59F662A5
1744WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37C951188967C8EB88D99893D9D191FEbinary
MD5:9BDA13B5F93D977EDE47500EAC04CFCD
SHA256:CAC9CE0516988FC14AFD518521234DEE07B5FF16486BE6C9F00F704B635B77C4
1744WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\21253908F3CB05D51B1C2DA8B681A785binary
MD5:180D17C4A69B90072DD278BC71010B6B
SHA256:DB8C1970176C9743A579B24D40B560A8AF955E59D6EE6FBF5B9FB101BEFE9E4B
1744WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERE505.tmp.WERInternalMetadata.xmlxml
MD5:2AE484273BA9C904D752A7810788B8FC
SHA256:1ED513B1E69E8751D8E1945B5B144CCC500672B022D0D2B1971205DC67AB8FAF
1744WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\e49ac3d276a063483f0ff0fb188f714a43be26a0e319569efcd5ae0487fe360b.exe.2744.dmpbinary
MD5:11A4BF631B7F5D9E98D810F06EB2E7D7
SHA256:DA011726BF26292AD6667F3CAF7823749743E3CDC87FDCDD8E4419D69E69A546
1744WerFault.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FEder
MD5:FA84E4BCC92AA5DB735AB50711040CDE
SHA256:6D7205E794FDE4219A62D9692ECDDF612663A5CF20399E79BE87B851FCA4CA33
1744WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERE4C6.tmp.dmpbinary
MD5:0A1F6E695543D9778CA3C7443164A4F2
SHA256:B067C290EA254517D2BA456A660091B07290A6A2ECE6C61158F80BDE503F7AF6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
35
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4536
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6244
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4536
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1744
WerFault.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6244
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1744
WerFault.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6484
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
4536
svchost.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4536
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
104.126.37.131:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
40.126.32.136:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 2.23.246.101
whitelisted
google.com
  • 172.217.16.142
whitelisted
www.bing.com
  • 104.126.37.131
  • 104.126.37.145
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.136
  • 40.126.32.68
  • 20.190.160.14
  • 40.126.32.133
  • 40.126.32.76
  • 40.126.32.74
  • 20.190.160.20
  • 20.190.160.17
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
arc.msn.com
  • 20.103.156.88
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
e49ac3d276a063483f0ff0fb188f714a43be26a0e319569efcd5ae0487fe360b