File name:

f44c1daf26e41d9c1f263b1b561c60478f5684fb48f27f8dda8858c25fdd4a41

Full analysis: https://app.any.run/tasks/219e775a-f9b4-4629-a2a5-c376ce4bed6f
Verdict: Malicious activity
Analysis date: May 29, 2025, 02:28:46
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

8988249B47FBBDAE6A0AFDA88AD2CA7B

SHA1:

DE645799A6D1354344112FB8EDFC479C78E7A9F4

SHA256:

F44C1DAF26E41D9C1F263B1B561C60478F5684FB48F27F8DDA8858C25FDD4A41

SSDEEP:

3072:xIbg9Gx9LBLT+jffPD3xHNzZPDrLotARILxrwpQ:xIc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • f44c1daf26e41d9c1f263b1b561c60478f5684fb48f27f8dda8858c25fdd4a41.exe (PID: 7472)

  • SUSPICIOUS

    • Executes application which crashes

      • f44c1daf26e41d9c1f263b1b561c60478f5684fb48f27f8dda8858c25fdd4a41.exe (PID: 7472)

  • INFO

    • Reads the machine GUID from the registry

      • f44c1daf26e41d9c1f263b1b561c60478f5684fb48f27f8dda8858c25fdd4a41.exe (PID: 7472)

    • Checks supported languages

      • f44c1daf26e41d9c1f263b1b561c60478f5684fb48f27f8dda8858c25fdd4a41.exe (PID: 7472)

    • Reads the computer name

      • f44c1daf26e41d9c1f263b1b561c60478f5684fb48f27f8dda8858c25fdd4a41.exe (PID: 7472)

    • Disables trace logs

      • f44c1daf26e41d9c1f263b1b561c60478f5684fb48f27f8dda8858c25fdd4a41.exe (PID: 7472)

    • Reads the software policy settings

      • f44c1daf26e41d9c1f263b1b561c60478f5684fb48f27f8dda8858c25fdd4a41.exe (PID: 7472)

    • Checks proxy server information

      • f44c1daf26e41d9c1f263b1b561c60478f5684fb48f27f8dda8858c25fdd4a41.exe (PID: 7472)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 7712)
      • WerFault.exe (PID: 7900)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:09:27 22:24:41+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 14336
InitializedDataSize: 148992
UninitializedDataSize: -
EntryPoint: 0x57ce
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 6.15.0.10623
ProductVersionNumber: 6.15.0.10623
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: CCleaner Performance Optimizer Service
CompanyName: Piriform Software Ltd
FileDescription: CCleaner Performance Optimizer Service
FileVersion: 6.15.0.10623
InternalName: IMG_79112006pdf.exe
LegalCopyright: Copyright © 2005-2023 Piriform Software Ltd
LegalTrademarks: -
OriginalFileName: IMG_79112006pdf.exe
ProductName: CCleanerPerformanceOptimizerService.exe
ProductVersion: 6.15.0.10623
AssemblyVersion: 6.15.0.10623
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
5
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start f44c1daf26e41d9c1f263b1b561c60478f5684fb48f27f8dda8858c25fdd4a41.exe werfault.exe no specs sppextcomobj.exe no specs slui.exe werfault.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
7472"C:\Users\admin\AppData\Local\Temp\f44c1daf26e41d9c1f263b1b561c60478f5684fb48f27f8dda8858c25fdd4a41.exe" C:\Users\admin\AppData\Local\Temp\f44c1daf26e41d9c1f263b1b561c60478f5684fb48f27f8dda8858c25fdd4a41.exe
explorer.exe
User:
admin
Company:
Piriform Software Ltd
Integrity Level:
MEDIUM
Description:
CCleaner Performance Optimizer Service
Exit code:
3762504530
Version:
6.15.0.10623
Modules
Images
c:\users\admin\appdata\local\temp\f44c1daf26e41d9c1f263b1b561c60478f5684fb48f27f8dda8858c25fdd4a41.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7712C:\WINDOWS\SysWOW64\WerFault.exe -u -p 7472 -s 1600C:\Windows\SysWOW64\WerFault.exe—f44c1daf26e41d9c1f263b1b561c60478f5684fb48f27f8dda8858c25fdd4a41.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
7780C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7812"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7900C:\WINDOWS\SysWOW64\WerFault.exe -u -p 7472 -s 2012C:\Windows\SysWOW64\WerFault.exe—f44c1daf26e41d9c1f263b1b561c60478f5684fb48f27f8dda8858c25fdd4a41.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
4 458
Read events
4 444
Write events
14
Delete events
0

Modification events

(PID) Process:(7472) f44c1daf26e41d9c1f263b1b561c60478f5684fb48f27f8dda8858c25fdd4a41.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7472) f44c1daf26e41d9c1f263b1b561c60478f5684fb48f27f8dda8858c25fdd4a41.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7472) f44c1daf26e41d9c1f263b1b561c60478f5684fb48f27f8dda8858c25fdd4a41.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(7472) f44c1daf26e41d9c1f263b1b561c60478f5684fb48f27f8dda8858c25fdd4a41.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(7472) f44c1daf26e41d9c1f263b1b561c60478f5684fb48f27f8dda8858c25fdd4a41.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(7472) f44c1daf26e41d9c1f263b1b561c60478f5684fb48f27f8dda8858c25fdd4a41.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(7472) f44c1daf26e41d9c1f263b1b561c60478f5684fb48f27f8dda8858c25fdd4a41.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(7472) f44c1daf26e41d9c1f263b1b561c60478f5684fb48f27f8dda8858c25fdd4a41.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7472) f44c1daf26e41d9c1f263b1b561c60478f5684fb48f27f8dda8858c25fdd4a41.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7472) f44c1daf26e41d9c1f263b1b561c60478f5684fb48f27f8dda8858c25fdd4a41.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
0
Suspicious files
2
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
7712WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_XN05X3BGXUKYY4XC_a07c41710ab9a4168d1318065f51c20697ae597_e01ab641_72224b38-41fd-4862-b1b3-cabdf2f760ea\Report.wer —
MD5:—
SHA256:—
7712WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\f44c1daf26e41d9c1f263b1b561c60478f5684fb48f27f8dda8858c25fdd4a41.exe.7472.dmp —
MD5:—
SHA256:—
7900WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_XN05X3BGXUKYY4XC_a07c41710ab9a4168d1318065f51c20697ae597_e01ab641_df4412d6-c803-4fe1-ae2f-b03ba1ad6538\Report.wer —
MD5:—
SHA256:—
7900WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\f44c1daf26e41d9c1f263b1b561c60478f5684fb48f27f8dda8858c25fdd4a41.exe(1).7472.dmp —
MD5:—
SHA256:—
7712WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERAA2E.tmp.xmlxml
MD5:20FBD4E7D754122577FFE83869A051D3
SHA256:BD3DECED3243DFC5E010B0022C2F73A329D9BF972A6E0471196111EA030CC56F
7712WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERA8F4.tmp.dmpbinary
MD5:A71A10BF9078D9F9D3A3E71F26B41345
SHA256:776693D9E6AEE07FEC5C49B73B437DBC10C3B5AA0611299A50E73793EF5E0E9D
7712WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERAA1E.tmp.WERInternalMetadata.xmlxml
MD5:3060DE11FFC207D3702ADD24E6199E24
SHA256:A27635C68876A2ADA38F81C39A2A2C5FE02A061CC8D67E59E8033BB6AC8000B1
7900WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERADD8.tmp.xmlxml
MD5:3A05DB2F6EF3CC2F3E159040711C55CA
SHA256:1FBDB3BDDBEBF81B68B1A64FD61849F8E737D96E3CF9DBA42288D3372706BAF6
7900WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERACDC.tmp.dmpbinary
MD5:A3BD5CE2928120914DA327C68E532E6D
SHA256:78A6814B268EF8BEE0624166761458325E21F626F6011BAC393A6D4D60A2F7AA
7900WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERADB7.tmp.WERInternalMetadata.xmlxml
MD5:285903D67BF6555C50923AB15816E36E
SHA256:8B33C7A597ED27309067215CF3554E547AC44990005DDBF4CB171B36E53140BB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
19
DNS requests
13
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
8128
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8128
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5756
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
7472
f44c1daf26e41d9c1f263b1b561c60478f5684fb48f27f8dda8858c25fdd4a41.exe
141.227.172.157:443
qu.ax
—
FR
malicious
5796
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
20.190.160.3:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
google.com
  • 142.250.185.206
whitelisted
qu.ax
  • 141.227.172.157
  • 141.227.166.187
  • 141.227.136.130
  • 141.227.168.227
  • 141.227.138.153
malicious
login.live.com
  • 20.190.160.3
  • 20.190.160.4
  • 20.190.160.17
  • 40.126.32.74
  • 20.190.160.22
  • 40.126.32.76
  • 20.190.160.132
  • 20.190.160.66
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET FILE_SHARING Anonymous File Sharing Domain in DNS Lookup (qu .ax)
7472
f44c1daf26e41d9c1f263b1b561c60478f5684fb48f27f8dda8858c25fdd4a41.exe
Misc activity
ET FILE_SHARING Observed Anonymous File Sharing Service Domain (qu .ax) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
f44c1daf26e41d9c1f263b1b561c60478f5684fb48f27f8dda8858c25fdd4a41