File name:

Oxygen Virus.exe

Full analysis: https://app.any.run/tasks/997d8fce-5966-46ff-a376-95b4b0a6a2c4
Verdict: Malicious activity
Analysis date: May 17, 2025, 08:04:50
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (console) x86-64, for MS Windows, 6 sections
MD5:

2F879BBC5B7D5265EB378431BC116C03

SHA1:

DED230B4927E562A9DA7F6070D1AAF9B78C3F515

SHA256:

EFAEF808012437A7B58DA354868B9A233CF9E295CB9CD64045EB1F068E236B04

SSDEEP:

6144:1ErozMdcYpo8zGVorBkhcrZNjshMX+VQkxf/4JNzIKDE:1Eroz8cYpolGrBkhcrZdshMX+vxnYzIp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to autorun other applications

      • cmd.exe (PID: 8056)

    • Disables task manager

      • Oxygen Virus.exe (PID: 7972)

    • Disables the Command Prompt (cmd)

      • Oxygen Virus.exe (PID: 7972)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Oxygen Virus.exe (PID: 7424)

    • Reads the date of Windows installation

      • Oxygen Virus.exe (PID: 7424)
      • StartMenuExperienceHost.exe (PID: 1184)

    • Starts itself from another location

      • Oxygen Virus.exe (PID: 7424)

    • Starts CMD.EXE for commands execution

      • Oxygen Virus.exe (PID: 7972)

    • Reads security settings of Internet Explorer

      • Oxygen Virus.exe (PID: 7424)
      • StartMenuExperienceHost.exe (PID: 1184)

  • INFO

    • Checks supported languages

      • Oxygen Virus.exe (PID: 7424)
      • Oxygen Virus.exe (PID: 7972)
      • TextInputHost.exe (PID: 6872)
      • StartMenuExperienceHost.exe (PID: 1184)
      • SearchApp.exe (PID: 728)

    • Reads the computer name

      • Oxygen Virus.exe (PID: 7424)
      • StartMenuExperienceHost.exe (PID: 1184)
      • TextInputHost.exe (PID: 6872)
      • SearchApp.exe (PID: 728)
      • Oxygen Virus.exe (PID: 7972)

    • Process checks computer location settings

      • Oxygen Virus.exe (PID: 7424)
      • StartMenuExperienceHost.exe (PID: 1184)
      • SearchApp.exe (PID: 728)

    • Checks proxy server information

      • SearchApp.exe (PID: 728)

    • Reads the software policy settings

      • SearchApp.exe (PID: 728)

    • Reads Environment values

      • SearchApp.exe (PID: 728)

    • Reads the machine GUID from the registry

      • SearchApp.exe (PID: 728)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:05:17 08:04:19+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.43
CodeSize: 157696
InitializedDataSize: 104960
UninitializedDataSize: -
EntryPoint: 0x9470
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
13
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start oxygen virus.exe conhost.exe no specs sppextcomobj.exe no specs slui.exe no specs oxygen virus.exe no specs conhost.exe no specs cmd.exe schtasks.exe no specs startmenuexperiencehost.exe no specs textinputhost.exe no specs searchapp.exe mobsync.exe no specs oxygen virus.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
728"C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mcaC:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Search application
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ntmarta.dll
736C:\WINDOWS\System32\mobsync.exe -EmbeddingC:\Windows\System32\mobsync.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Sync Center
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mobsync.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1184"C:\WINDOWS\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mcaC:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe—svchost.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\windows\systemapps\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\startmenuexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wincorlib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
6872"C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Version:
123.26505.0.0
Modules
Images
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\vcruntime140_app.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
7308"C:\Users\admin\AppData\Local\Temp\Oxygen Virus.exe" C:\Users\admin\AppData\Local\Temp\Oxygen Virus.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\oxygen virus.exe
c:\windows\system32\ntdll.dll
7424"C:\Users\admin\AppData\Local\Temp\Oxygen Virus.exe" C:\Users\admin\AppData\Local\Temp\Oxygen Virus.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\oxygen virus.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
7440\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Oxygen Virus.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7496C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7528"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7972"C:\WINDOWS\system32\Oxygen Virus.exe" --movedC:\Windows\System32\Oxygen Virus.exe—Oxygen Virus.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\windows\system32\oxygen virus.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
9 055
Read events
8 957
Write events
97
Delete events
1

Modification events

(PID) Process:(1184) StartMenuExperienceHost.exeKey:\REGISTRY\A\{aa3449e9-3a7d-3621-a5d7-da5c9b44c698}\LocalState\DataCorruptionRecovery
Operation:writeName:InitializationAttemptCount
Value:
010000008AF1716F02C7DB01
(PID) Process:(728) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SearchSettings
Operation:writeName:SafeSearchMode
Value:
1
(PID) Process:(1184) StartMenuExperienceHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TileDataModel\Migration\StartNonLayoutProperties
Operation:writeName:Completed
Value:
1
(PID) Process:(1184) StartMenuExperienceHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TileDataModel\Migration\StartNonLayoutProperties_AppUsageData
Operation:writeName:Completed
Value:
1
(PID) Process:(1184) StartMenuExperienceHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\TileDataModel\Migration\StartNonLayoutProperties_TargetedContentTiles
Operation:writeName:Completed
Value:
1
(PID) Process:(1184) StartMenuExperienceHost.exeKey:\REGISTRY\A\{aa3449e9-3a7d-3621-a5d7-da5c9b44c698}\LocalState\DataCorruptionRecovery
Operation:writeName:InitializationAttemptCount
Value:
000000002611A46F02C7DB01
(PID) Process:(1184) StartMenuExperienceHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CloudStore\Store\Cache\DefaultAccount\$de${c6a388c9-afd3-47e2-a46b-29cb43ad4323}$start.tilegrid$windows.data.curatedtilecollection.tilecollection\Current
Operation:writeName:Data
Value:
02000000ECC8AA6F02C7DB0100000000434201000A0A00D0140CCA3200CB8C0A0212267B00410039003400310034003200440039002D0032003100350030002D0034003600380037002D0038003600390033002D003100450036003200320036003500390039003900430031007D000012267B00390033004600380044003900390046002D0036003500300041002D0034003100330035002D0038004200340043002D003200460046004100410041003300450046004600340039007D0000E22C01010000
(PID) Process:(728) SearchApp.exeKey:\REGISTRY\A\{f935c7a7-5e62-603c-70f1-ac53ae4b8ee6}\LocalState
Operation:writeName:BINGIDENTITY_PROP_USEREMAIL
Value:
0000F4A9C06F02C7DB01
(PID) Process:(728) SearchApp.exeKey:\REGISTRY\A\{f935c7a7-5e62-603c-70f1-ac53ae4b8ee6}\LocalState
Operation:writeName:BINGIDENTITY_PROP_ACCOUNTTYPETEXT
Value:
0000F4A9C06F02C7DB01
(PID) Process:(728) SearchApp.exeKey:\REGISTRY\A\{f935c7a7-5e62-603c-70f1-ac53ae4b8ee6}\LocalState
Operation:writeName:BINGIDENTITY_PROP_ACCOUNTTYPE
Value:
0000F4A9C06F02C7DB01
Executable files
1
Suspicious files
45
Text files
1 080
Unknown types
0

Dropped files

PID
Process
Filename
Type
7972Oxygen Virus.exeC:\Users\admin\Desktop\Y12eDN7uoA5Wtext
MD5:1DC0CDA9AFD5F3E09C2835CF245EB83F
SHA256:C75D0F58F707789FAF1217151478EE946BF09714FBC8D8DB3CBEEFE71CA5D541
7972Oxygen Virus.exeC:\Users\admin\Desktop\8jDzPscB1Xfztext
MD5:1DC0CDA9AFD5F3E09C2835CF245EB83F
SHA256:C75D0F58F707789FAF1217151478EE946BF09714FBC8D8DB3CBEEFE71CA5D541
7972Oxygen Virus.exeC:\Users\admin\Desktop\rWzQs27eJ6rgtext
MD5:1DC0CDA9AFD5F3E09C2835CF245EB83F
SHA256:C75D0F58F707789FAF1217151478EE946BF09714FBC8D8DB3CBEEFE71CA5D541
7972Oxygen Virus.exeC:\Users\admin\Desktop\fcZfXHfA7WQWtext
MD5:1DC0CDA9AFD5F3E09C2835CF245EB83F
SHA256:C75D0F58F707789FAF1217151478EE946BF09714FBC8D8DB3CBEEFE71CA5D541
7972Oxygen Virus.exeC:\Users\admin\Desktop\LLObn6U1wGxFtext
MD5:1DC0CDA9AFD5F3E09C2835CF245EB83F
SHA256:C75D0F58F707789FAF1217151478EE946BF09714FBC8D8DB3CBEEFE71CA5D541
7972Oxygen Virus.exeC:\Users\admin\Desktop\U1DvrtjbV5pUtext
MD5:1DC0CDA9AFD5F3E09C2835CF245EB83F
SHA256:C75D0F58F707789FAF1217151478EE946BF09714FBC8D8DB3CBEEFE71CA5D541
7972Oxygen Virus.exeC:\Users\admin\Desktop\WH3yjXHgwFlstext
MD5:1DC0CDA9AFD5F3E09C2835CF245EB83F
SHA256:C75D0F58F707789FAF1217151478EE946BF09714FBC8D8DB3CBEEFE71CA5D541
7972Oxygen Virus.exeC:\Users\admin\Desktop\M0Vd82zgqD4ztext
MD5:1DC0CDA9AFD5F3E09C2835CF245EB83F
SHA256:C75D0F58F707789FAF1217151478EE946BF09714FBC8D8DB3CBEEFE71CA5D541
7972Oxygen Virus.exeC:\Users\admin\Desktop\w7tED3SztwP1text
MD5:1DC0CDA9AFD5F3E09C2835CF245EB83F
SHA256:C75D0F58F707789FAF1217151478EE946BF09714FBC8D8DB3CBEEFE71CA5D541
7972Oxygen Virus.exeC:\Users\admin\Desktop\bYpk738z0Zjltext
MD5:1DC0CDA9AFD5F3E09C2835CF245EB83F
SHA256:C75D0F58F707789FAF1217151478EE946BF09714FBC8D8DB3CBEEFE71CA5D541
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
28
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7968
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7968
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
728
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 2.23.246.101
whitelisted
google.com
  • 172.217.16.206
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.4
  • 40.126.32.138
  • 20.190.160.128
  • 40.126.32.140
  • 20.190.160.14
  • 20.190.160.67
  • 20.190.160.3
  • 40.126.32.133
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
www.bing.com
  • 2.16.241.205
  • 2.16.241.201
  • 2.16.241.218
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Oxygen Virus.exe