File name:

SeryCodes_f15e320a0031a694527b5c2dde4de2908610afddb8e8e715226af403778f22d1

Full analysis: https://app.any.run/tasks/10a43680-07a3-4b33-9f67-4ba5981ce4a8
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 14:15:17
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
adware
socelars
stealer
loader
pastebin
telegram
delphi
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

1248C8F96E57E5994599C55AF7DEA278

SHA1:

55DDE25E4BCBD002DA0EE08FAD1F9EEC2F9D5750

SHA256:

F15E320A0031A694527B5C2DDE4DE2908610AFDDB8E8E715226AF403778F22D1

SSDEEP:

98304:b9szDplS+gilLRk7oZopnioYogDV7hlx0Nc0lUatiGBklSH48QT98EDcqzmOdYhj:N+SY4cp6jn1XzYeueQozZFDA8y8WiUkR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds path to the Windows Defender exclusion list

      • setup_install.exe (PID: 8036)
      • cmd.exe (PID: 8136)
      • Thu16663aea8ab.exe (PID: 7608)

    • Changes settings for real-time protection

      • powershell.exe (PID: 8148)

    • Changes settings for sending potential threat samples to Microsoft servers

      • powershell.exe (PID: 8148)

    • Changes settings for reporting to Microsoft Active Protection Service (MAPS)

      • powershell.exe (PID: 8148)

    • Changes Windows Defender settings

      • cmd.exe (PID: 8128)
      • cmd.exe (PID: 8136)
      • Thu16663aea8ab.exe (PID: 7608)

    • Executing a file with an untrusted certificate

      • Thu16952d3d9ab444ec1.exe (PID: 7464)
      • Thu161f52aab88c12a59.exe (PID: 7496)
      • Thu16663aea8ab.exe (PID: 7608)
      • Thu16610b38e841.exe (PID: 5968)
      • Thu164775e846ab156d.exe (PID: 1348)
      • Thu16610b38e841.exe (PID: 2772)
      • Thu164775e846ab156d.exe (PID: 6512)
      • Thu16610b38e841.exe (PID: 7796)
      • Thu16952d3d9ab444ec1.exe (PID: 4428)
      • tkools.exe (PID: 2240)
      • tkools.exe (PID: 5384)
      • tkools.exe (PID: 8820)
      • csrss.exe (PID: 1116)
      • tkools.exe (PID: 2108)
      • tkools.exe (PID: 8516)
      • Thu16663aea8ab.exe (PID: 8536)

    • SOCELARS mutex has been found

      • Thu16a67c65b16d9.exe (PID: 7152)

    • Actions looks like stealing of personal data

      • Thu16fe4c07503.exe (PID: 7284)

    • ADWARE has been detected (SURICATA)

      • Thu16606c554f998.tmp (PID: 7052)

    • Uses Task Scheduler to autorun other applications

      • csrss.exe (PID: 1116)

    • Uses Task Scheduler to run other applications

      • tkools.exe (PID: 8820)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • SeryCodes_f15e320a0031a694527b5c2dde4de2908610afddb8e8e715226af403778f22d1.exe (PID: 7764)
      • setup_installer.exe (PID: 7920)
      • Thu166d0cb4caf7.exe (PID: 6584)
      • Thu16606c554f998.exe (PID: 7296)
      • Thu166d0cb4caf7.tmp (PID: 6324)
      • Thu16606c554f998.tmp (PID: 7052)
      • Thu166d0cb4caf7.exe (PID: 7740)
      • cmd.exe (PID: 8032)
      • Thu166d0cb4caf7.tmp (PID: 7848)
      • cmd.exe (PID: 7412)
      • Thu164775e846ab156d.exe (PID: 6512)
      • Thu16610b38e841.exe (PID: 7796)
      • Thu16952d3d9ab444ec1.exe (PID: 4428)
      • csrss.exe (PID: 1116)

    • Drops 7-zip archiver for unpacking

      • SeryCodes_f15e320a0031a694527b5c2dde4de2908610afddb8e8e715226af403778f22d1.exe (PID: 7764)

    • Reads security settings of Internet Explorer

      • SeryCodes_f15e320a0031a694527b5c2dde4de2908610afddb8e8e715226af403778f22d1.exe (PID: 7764)
      • setup_installer.exe (PID: 7920)
      • Thu16a67c65b16d9.exe (PID: 7152)
      • Thu16ab54c6bbaf.exe (PID: 4380)
      • Thu166d0cb4caf7.tmp (PID: 6324)
      • Thu16560dc2c97e1a429.exe (PID: 4880)
      • Thu169d522272ce.exe (PID: 7468)
      • Thu16606c554f998.tmp (PID: 7052)
      • RnOdl98KoaYN.exe (PID: 4068)
      • Thu164775e846ab156d.exe (PID: 6512)
      • Thu16610b38e841.exe (PID: 7796)

    • The process hide an interactive prompt from the user

      • cmd.exe (PID: 8136)
      • cmd.exe (PID: 8128)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 8136)
      • cmd.exe (PID: 8128)
      • Thu16663aea8ab.exe (PID: 7608)

    • Script adds exclusion path to Windows Defender

      • cmd.exe (PID: 8136)
      • Thu16663aea8ab.exe (PID: 7608)

    • The executable file from the user directory is run by the CMD process

      • Thu16ab54c6bbaf.exe (PID: 4380)
      • Thu16560dc2c97e1a429.exe (PID: 4880)
      • Thu166d0cb4caf7.exe (PID: 6584)
      • Thu16952d3d9ab444ec1.exe (PID: 7464)
      • Thu16d8c20ed15fec.exe (PID: 7504)
      • Thu161f52aab88c12a59.exe (PID: 7496)
      • Thu16f93726ed76.exe (PID: 456)
      • Thu165e0fea73b141.exe (PID: 7476)
      • Thu169d522272ce.exe (PID: 7468)
      • Thu16663aea8ab.exe (PID: 7608)
      • Thu164775e846ab156d.exe (PID: 1348)
      • Thu16606c554f998.exe (PID: 7296)
      • Thu16fe4c07503.exe (PID: 7284)
      • Thu16610b38e841.exe (PID: 5968)
      • Thu16a67c65b16d9.exe (PID: 7152)
      • Thu16f03a4ac480.exe (PID: 6808)
      • Thu16f58ffbbd584b6.exe (PID: 1228)
      • Thu16749d47096c.exe (PID: 3180)
      • RnOdl98KoaYN.exe (PID: 4068)

    • Starts CMD.EXE for commands execution

      • setup_install.exe (PID: 8036)
      • mshta.exe (PID: 7808)
      • mshta.exe (PID: 7272)
      • mshta.exe (PID: 7664)
      • cmd.exe (PID: 7412)
      • Thu164775e846ab156d.exe (PID: 6512)
      • cmd.exe (PID: 1272)
      • cmd.exe (PID: 6872)
      • Thu16610b38e841.exe (PID: 7796)
      • cmd.exe (PID: 6620)
      • Thu16952d3d9ab444ec1.exe (PID: 4428)
      • cmd.exe (PID: 660)
      • csrss.exe (PID: 1116)
      • tkools.exe (PID: 8820)

    • Script disables Windows Defender's real-time protection

      • cmd.exe (PID: 8128)

    • Process drops legitimate windows executable

      • Thu166d0cb4caf7.tmp (PID: 6324)
      • Thu16606c554f998.tmp (PID: 7052)
      • Thu166d0cb4caf7.tmp (PID: 7848)

    • Application launched itself

      • Thu16ab54c6bbaf.exe (PID: 4380)
      • Thu16610b38e841.exe (PID: 5968)
      • Thu165e0fea73b141.exe (PID: 7476)
      • Thu16749d47096c.exe (PID: 3180)
      • Thu164775e846ab156d.exe (PID: 1348)
      • cmd.exe (PID: 7412)
      • cmd.exe (PID: 1272)
      • Thu16952d3d9ab444ec1.exe (PID: 7464)
      • cmd.exe (PID: 6872)
      • cmd.exe (PID: 6620)
      • cmd.exe (PID: 660)
      • tkools.exe (PID: 2240)
      • tkools.exe (PID: 2108)
      • Thu16663aea8ab.exe (PID: 7608)

    • Reads the Windows owner or organization settings

      • Thu166d0cb4caf7.tmp (PID: 6324)
      • Thu16606c554f998.tmp (PID: 7052)
      • Thu166d0cb4caf7.tmp (PID: 7848)

    • Executes application which crashes

      • Thu161f52aab88c12a59.exe (PID: 7496)
      • Thu165e0fea73b141.exe (PID: 8020)
      • Thu16a67c65b16d9.exe (PID: 7152)

    • Checks for external IP

      • Thu16fe4c07503.exe (PID: 7284)
      • svchost.exe (PID: 2196)
      • Thu16a67c65b16d9.exe (PID: 7152)
      • Thu16f03a4ac480.exe (PID: 6808)

    • Access to an unwanted program domain was detected

      • Thu16606c554f998.tmp (PID: 7052)

    • Process requests binary or script from the Internet

      • Thu16606c554f998.tmp (PID: 7052)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 8032)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 2196)
      • Thu16f03a4ac480.exe (PID: 6808)
      • Thu16a67c65b16d9.exe (PID: 7152)

    • Runs shell command (SCRIPT)

      • mshta.exe (PID: 7808)
      • mshta.exe (PID: 7272)
      • mshta.exe (PID: 7664)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 1272)
      • cmd.exe (PID: 7280)
      • cmd.exe (PID: 6872)
      • cmd.exe (PID: 6620)
      • cmd.exe (PID: 8144)
      • cmd.exe (PID: 660)
      • cmd.exe (PID: 3304)
      • cmd.exe (PID: 1388)

    • Connects to unusual port

      • Thu16749d47096c.exe (PID: 7816)

    • Connects to the server without a host name

      • Thu16f58ffbbd584b6.exe (PID: 1228)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • cmd.exe (PID: 7448)

    • Starts itself from another location

      • Thu16952d3d9ab444ec1.exe (PID: 4428)
      • Thu16610b38e841.exe (PID: 7796)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 8440)

    • Windows service management via SC.EXE

      • sc.exe (PID: 8912)
      • sc.exe (PID: 9016)

    • Drops a system driver (possible attempt to evade defenses)

      • csrss.exe (PID: 1116)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 8328)

    • The process executes via Task Scheduler

      • tkools.exe (PID: 2108)

    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • Thu16f58ffbbd584b6.exe (PID: 1228)

  • INFO

    • Checks supported languages

      • SeryCodes_f15e320a0031a694527b5c2dde4de2908610afddb8e8e715226af403778f22d1.exe (PID: 7764)
      • setup_installer.exe (PID: 7920)
      • setup_install.exe (PID: 8036)
      • Thu16ab54c6bbaf.exe (PID: 4380)
      • Thu166d0cb4caf7.exe (PID: 6584)
      • Thu165e0fea73b141.exe (PID: 7476)
      • Thu164775e846ab156d.exe (PID: 1348)
      • Thu16663aea8ab.exe (PID: 7608)
      • Thu16952d3d9ab444ec1.exe (PID: 7464)
      • Thu161f52aab88c12a59.exe (PID: 7496)
      • Thu16f93726ed76.exe (PID: 456)
      • Thu16610b38e841.exe (PID: 5968)
      • Thu16fe4c07503.exe (PID: 7284)
      • Thu16606c554f998.exe (PID: 7296)
      • Thu16a67c65b16d9.exe (PID: 7152)
      • Thu16f58ffbbd584b6.exe (PID: 1228)
      • Thu16560dc2c97e1a429.exe (PID: 4880)
      • Thu16f03a4ac480.exe (PID: 6808)
      • Thu16749d47096c.exe (PID: 3180)
      • Thu16d8c20ed15fec.exe (PID: 7504)
      • Thu16606c554f998.tmp (PID: 7052)
      • Thu166d0cb4caf7.tmp (PID: 6324)
      • Thu166d0cb4caf7.exe (PID: 7740)
      • Thu169d522272ce.exe (PID: 7468)
      • Thu16ab54c6bbaf.exe (PID: 7184)
      • Thu166d0cb4caf7.tmp (PID: 7848)
      • RnOdl98KoaYN.exe (PID: 4068)
      • Thu164775e846ab156d.exe (PID: 6512)
      • Thu16610b38e841.exe (PID: 7796)
      • Thu16952d3d9ab444ec1.exe (PID: 4428)

    • Process checks computer location settings

      • SeryCodes_f15e320a0031a694527b5c2dde4de2908610afddb8e8e715226af403778f22d1.exe (PID: 7764)
      • setup_installer.exe (PID: 7920)
      • Thu16ab54c6bbaf.exe (PID: 4380)
      • Thu166d0cb4caf7.tmp (PID: 6324)
      • Thu16560dc2c97e1a429.exe (PID: 4880)
      • RnOdl98KoaYN.exe (PID: 4068)
      • Thu164775e846ab156d.exe (PID: 6512)

    • The sample compiled with english language support

      • SeryCodes_f15e320a0031a694527b5c2dde4de2908610afddb8e8e715226af403778f22d1.exe (PID: 7764)
      • setup_installer.exe (PID: 7920)
      • Thu166d0cb4caf7.tmp (PID: 6324)
      • Thu16606c554f998.tmp (PID: 7052)
      • Thu166d0cb4caf7.tmp (PID: 7848)
      • cmd.exe (PID: 7412)
      • csrss.exe (PID: 1116)

    • Reads the computer name

      • SeryCodes_f15e320a0031a694527b5c2dde4de2908610afddb8e8e715226af403778f22d1.exe (PID: 7764)
      • setup_installer.exe (PID: 7920)
      • Thu164775e846ab156d.exe (PID: 1348)
      • Thu16fe4c07503.exe (PID: 7284)
      • Thu16f93726ed76.exe (PID: 456)
      • Thu16ab54c6bbaf.exe (PID: 4380)
      • Thu165e0fea73b141.exe (PID: 7476)
      • Thu16610b38e841.exe (PID: 5968)
      • Thu16a67c65b16d9.exe (PID: 7152)
      • Thu16663aea8ab.exe (PID: 7608)
      • Thu16f03a4ac480.exe (PID: 6808)
      • Thu16d8c20ed15fec.exe (PID: 7504)
      • Thu16606c554f998.tmp (PID: 7052)
      • Thu16560dc2c97e1a429.exe (PID: 4880)
      • Thu16ab54c6bbaf.exe (PID: 7184)
      • Thu16f58ffbbd584b6.exe (PID: 1228)
      • Thu169d522272ce.exe (PID: 7468)
      • Thu16952d3d9ab444ec1.exe (PID: 7464)
      • Thu166d0cb4caf7.tmp (PID: 7848)
      • Thu164775e846ab156d.exe (PID: 6512)

    • Create files in a temporary directory

      • setup_installer.exe (PID: 7920)
      • Thu166d0cb4caf7.exe (PID: 6584)
      • Thu16606c554f998.exe (PID: 7296)
      • Thu166d0cb4caf7.tmp (PID: 6324)
      • Thu16606c554f998.tmp (PID: 7052)
      • Thu166d0cb4caf7.tmp (PID: 7848)
      • RnOdl98KoaYN.exe (PID: 4068)

    • The sample compiled with turkish language support

      • setup_installer.exe (PID: 7920)

    • Checks proxy server information

      • Thu16fe4c07503.exe (PID: 7284)
      • Thu16f03a4ac480.exe (PID: 6808)
      • Thu16606c554f998.tmp (PID: 7052)
      • Thu169d522272ce.exe (PID: 7468)
      • Thu16a67c65b16d9.exe (PID: 7152)

    • Reads Environment values

      • Thu16f03a4ac480.exe (PID: 6808)

    • Reads the machine GUID from the registry

      • Thu16f03a4ac480.exe (PID: 6808)
      • Thu16749d47096c.exe (PID: 3180)
      • Thu164775e846ab156d.exe (PID: 1348)
      • Thu165e0fea73b141.exe (PID: 7476)
      • Thu16610b38e841.exe (PID: 5968)

    • Disables trace logs

      • Thu16f03a4ac480.exe (PID: 6808)

    • Reads the software policy settings

      • Thu16f03a4ac480.exe (PID: 6808)
      • Thu16d8c20ed15fec.exe (PID: 7504)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 7808)
      • mshta.exe (PID: 7272)

    • Creates files or folders in the user directory

      • Thu169d522272ce.exe (PID: 7468)
      • WerFault.exe (PID: 2852)

    • Compiled with Borland Delphi (YARA)

      • conhost.exe (PID: 8044)

    • Application launched itself

      • msedge.exe (PID: 536)
      • msedge.exe (PID: 7496)
      • msedge.exe (PID: 8556)

    • Manual execution by a user

      • msedge.exe (PID: 7496)

    • Attempting to use instant messaging service

      • Thu16f58ffbbd584b6.exe (PID: 1228)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:08:01 02:44:18+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26112
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x35d8
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
316
Monitored processes
176
Malicious processes
37
Suspicious processes
15

Behavior graph

Click at the process to see the details
start serycodes_f15e320a0031a694527b5c2dde4de2908610afddb8e8e715226af403778f22d1.exe setup_installer.exe setup_install.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs powershell.exe no specs powershell.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs thu166d0cb4caf7.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs thu16560dc2c97e1a429.exe no specs thu16ab54c6bbaf.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs thu16952d3d9ab444ec1.exe no specs cmd.exe no specs thu16d8c20ed15fec.exe thu161f52aab88c12a59.exe thu16f93726ed76.exe no specs thu165e0fea73b141.exe no specs thu16663aea8ab.exe no specs thu169d522272ce.exe thu164775e846ab156d.exe no specs thu16f03a4ac480.exe thu16fe4c07503.exe thu16606c554f998.exe thu16610b38e841.exe no specs #SOCELARS thu16a67c65b16d9.exe thu16f58ffbbd584b6.exe thu166d0cb4caf7.tmp thu16749d47096c.exe no specs #ADWARE thu16606c554f998.tmp thu16ab54c6bbaf.exe conhost.exe no specs svchost.exe thu166d0cb4caf7.exe werfault.exe no specs thu166d0cb4caf7.tmp mshta.exe no specs thu16749d47096c.exe thu165e0fea73b141.exe cmd.exe conhost.exe no specs thu164775e846ab156d.exe thu16610b38e841.exe no specs rnodl98koayn.exe no specs taskkill.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe conhost.exe no specs werfault.exe no specs cmd.exe no specs cmd.exe no specs odbcconf.exe no specs thu16610b38e841.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs cacls.exe no specs cmd.exe no specs conhost.exe no specs cacls.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs cacls.exe no specs thu16952d3d9ab444ec1.exe cmd.exe no specs cacls.exe no specs werfault.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cacls.exe no specs cacls.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cacls.exe no specs csrss.exe cmd.exe no specs conhost.exe no specs tkools.exe no specs cacls.exe no specs tkools.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs mountvol.exe no specs conhost.exe no specs msedge.exe no specs mountvol.exe no specs conhost.exe no specs tkools.exe cmd.exe no specs conhost.exe no specs msedge.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs reg.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs tkools.exe no specs tkools.exe no specs powershell.exe no specs thu16663aea8ab.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs slui.exe no specs serycodes_f15e320a0031a694527b5c2dde4de2908610afddb8e8e715226af403778f22d1.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
456Thu16f93726ed76.exe C:\Users\admin\AppData\Local\Temp\7zS0FE4E6B0\Thu16f93726ed76.exe—cmd.exe
User:
admin
Company:
SecureMix LLC
Integrity Level:
HIGH
Description:
GlassWire Setup
Exit code:
2148734720
Version:
2,1,167,0
Modules
Images
c:\users\admin\appdata\local\temp\7zs0fe4e6b0\thu16f93726ed76.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
496\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
536"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=Thu16f93726ed76.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—Thu16f93726ed76.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
1
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
660CACLS "C:\Users\admin\AppData\Local\Temp\6829558ede" /P "admin:N"C:\Windows\SysWOW64\cacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Control ACLs Program
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cacls.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
660"C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\admin\AppData\Local\Temp\6829558ede" /P "admin:N"C:\Windows\SysWOW64\cmd.exe—Thu16610b38e841.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
680"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4308 --field-trial-handle=2060,i,17428034649472225238,4136513878666803208,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
864"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2968 --field-trial-handle=2604,i,8475285422226655899,9084373500924355278,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
1116C:\WINDOWS\rss\csrss.exe /306-306C:\Windows\rss\csrss.exe
Thu16952d3d9ab444ec1.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Modules
Images
c:\windows\rss\csrss.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1132\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1168"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4908 --field-trial-handle=2060,i,17428034649472225238,4136513878666803208,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
3221226029
Version:
122.0.2365.59
Total events
50 150
Read events
49 964
Write events
172
Delete events
14

Modification events

(PID) Process:(6808) Thu16f03a4ac480.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Thu16f03a4ac480_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6808) Thu16f03a4ac480.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Thu16f03a4ac480_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6808) Thu16f03a4ac480.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Thu16f03a4ac480_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6808) Thu16f03a4ac480.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Thu16f03a4ac480_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6808) Thu16f03a4ac480.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Thu16f03a4ac480_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6808) Thu16f03a4ac480.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Thu16f03a4ac480_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6808) Thu16f03a4ac480.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Thu16f03a4ac480_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6808) Thu16f03a4ac480.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Thu16f03a4ac480_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6808) Thu16f03a4ac480.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Thu16f03a4ac480_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6808) Thu16f03a4ac480.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\Thu16f03a4ac480_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
61
Suspicious files
270
Text files
71
Unknown types
0

Dropped files

PID
Process
Filename
Type
7764SeryCodes_f15e320a0031a694527b5c2dde4de2908610afddb8e8e715226af403778f22d1.exeC:\Users\admin\AppData\Local\Temp\nsyBFA9.tmp —
MD5:—
SHA256:—
7920setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS0FE4E6B0\libstdc++-6.dllexecutable
MD5:5E279950775BAAE5FEA04D2CC4526BCC
SHA256:97DE47068327BB822B33C7106F9CBB489480901A6749513EF5C31D229DCACA87
7920setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS0FE4E6B0\libgcc_s_dw2-1.dllexecutable
MD5:9AEC524B616618B0D3D00B27B6F51DA1
SHA256:59A466F77584438FC3ABC0F43EDC0FC99D41851726827A008841F05CFE12DA7E
7920setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS0FE4E6B0\libcurlpp.dllexecutable
MD5:E6E578373C2E416289A8DA55F1DC5E8E
SHA256:43E86D650A68F1F91FA2F4375AFF2720E934AA78FA3D33E06363122BF5A9535F
7920setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS0FE4E6B0\libwinpthread-1.dllexecutable
MD5:1E0D62C34FF2E649EBC5C372065732EE
SHA256:509CB1D1443B623A02562AC760BCED540E327C65157FFA938A22F75E38155723
7764SeryCodes_f15e320a0031a694527b5c2dde4de2908610afddb8e8e715226af403778f22d1.exeC:\Users\admin\AppData\Local\Temp\setup_installer.exeexecutable
MD5:958A640F823B6E92CF78024013B87213
SHA256:2F0F1000CCF29685AC7526D68F9EFD90D6A20DB27C64634E3EAC10074FBCE0BF
7920setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS0FE4E6B0\libcurl.dllexecutable
MD5:D09BE1F47FD6B827C81A4812B4F7296F
SHA256:0DE53E7BE51789ADAEC5294346220B20F793E7F8D153A3C110A92D658760697E
7920setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS0FE4E6B0\Thu16952d3d9ab444ec1.exeexecutable
MD5:9D7F6B3DF5921F65DB51CE39596F0FDA
SHA256:15A8702C9C739150614449018EBDDA11D97381CD17087DBC14FF10C4126C707D
7920setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS0FE4E6B0\setup_install.exeexecutable
MD5:2D763F0E82904E151786C159AE3127F8
SHA256:5818D7BE06AC51420C3376A744093E30197CB2EC7CB02F0F4FCAA22261E8D246
7920setup_installer.exeC:\Users\admin\AppData\Local\Temp\7zS0FE4E6B0\Thu166d0cb4caf7.exeexecutable
MD5:9668B7BE120A22CC3B478D0748DD6369
SHA256:438AD3221518973C484D5FC7C84E651D0B4C547846F34CFB91E6FE229E844C45
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
155
DNS requests
76
Threats
20

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.32.238.112:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7284
Thu16fe4c07503.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
—
—
whitelisted
7052
Thu16606c554f998.tmp
HEAD
403
51.158.211.1:80
http://hammajawa7dou.s3.nl-ams.scw.cloud/advertiser_Installer/powerOff.exe?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=SCWYZ0JHKZJYF9HYGTG9%2F20211128%2Fnl-ams%2Fs3%2Faws4_request&X-Amz-Date=20211128T232023Z&X-Amz-Expires=599989&X-Amz-Signature=c0c911b2c94a40a9bf3465b562da06341b63957b4fbc860ff8c20d8833ea73ef&X-Amz-SignedHeaders=host
unknown
—
—
unknown
7052
Thu16606c554f998.tmp
GET
403
51.158.211.1:80
http://hammajawa7dou.s3.nl-ams.scw.cloud/advertiser_Installer/powerOff.exe?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=SCWYZ0JHKZJYF9HYGTG9%2F20211128%2Fnl-ams%2Fs3%2Faws4_request&X-Amz-Date=20211128T232023Z&X-Amz-Expires=599989&X-Amz-Signature=c0c911b2c94a40a9bf3465b562da06341b63957b4fbc860ff8c20d8833ea73ef&X-Amz-SignedHeaders=host
unknown
—
—
unknown
7468
Thu169d522272ce.exe
GET
200
2.16.168.117:80
http://r11.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQaUrm0WeTDM5ghfoZtS72KO9ZnzgQUCLkRO6XQhRi06g%2BgrZ%2BGHo78OCcCEgaNm9kZr4EaFpDJ76YMB2KU6A%3D%3D
unknown
—
—
whitelisted
7468
Thu169d522272ce.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7468
Thu169d522272ce.exe
GET
200
95.101.54.107:80
http://r10.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRpD%2BQVZ%2B1vf7U0RGQGBm8JZwdxcgQUdKR2KRcYVIUxN75n5gZYwLzFBXICEgW%2FNrkAE%2Blf6V4N6QyoQjJPXg%3D%3D
unknown
—
—
whitelisted
1228
Thu16f58ffbbd584b6.exe
GET
406
185.225.19.18:80
http://185.225.19.18/borderxra
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.32.238.112:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7284
Thu16fe4c07503.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
whitelisted
6808
Thu16f03a4ac480.exe
172.67.74.161:443
iplogger.org
CLOUDFLARENET
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.46
whitelisted
crl.microsoft.com
  • 23.32.238.112
  • 23.32.238.107
  • 2.20.245.137
  • 2.20.245.139
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 2.23.246.101
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted
iplogger.org
  • 172.67.74.161
  • 104.26.2.46
  • 104.26.3.46
whitelisted
www.listincode.com
  • 38.6.176.121
whitelisted
gp.gamebuy768.com
  • 34.132.102.6
  • 34.136.111.81
unknown
hammajawa7dou.s3.nl-ams.scw.cloud
  • 51.158.211.1
  • 51.158.211.0
  • 51.158.211.2
unknown
qoto.org
  • 100.24.65.138
unknown

Threats

PID
Process
Class
Message
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
7284
Thu16fe4c07503.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
2196
svchost.exe
Potential Corporate Privacy Violation
ET INFO IP Check Domain (iplogger .org in DNS Lookup)
6808
Thu16f03a4ac480.exe
Potential Corporate Privacy Violation
ET INFO IP Check Domain (iplogger .org in TLS SNI)
7052
Thu16606c554f998.tmp
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Inno Download Plugin UA
7052
Thu16606c554f998.tmp
Possibly Unwanted Program Detected
ADWARE [ANY.RUN] Inno Download Plugin UA
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Online Pastebin Text Storage
6808
Thu16f03a4ac480.exe
Potential Corporate Privacy Violation
ET INFO IP Check Domain (iplogger .org in TLS SNI)
7152
Thu16a67c65b16d9.exe
Potential Corporate Privacy Violation
ET INFO IP Check Domain (iplogger .org in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SeryCodes_f15e320a0031a694527b5c2dde4de2908610afddb8e8e715226af403778f22d1