File name:

f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe

Full analysis: https://app.any.run/tasks/49b22ff8-e47a-424d-8819-4db885a85231
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 08:49:19
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
sinkhole
simda
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

2A111D8ECFE17CEFC0275B4F90C541DF

SHA1:

960ACBFC68F2493846A05EEE8A8A3AE6F12EC8C1

SHA256:

F6A434A6D006ACEC7219DD43A25F0706DCDB1081E1145475AFFD2436C2DA76B5

SSDEEP:

3072:hkpB/MT5miFV/hwXZ4bfhb1gdDkRuSvLcNIF0Iv3RytR/lHGvs9jC1cw4Yy9OtYo:n/hE4bfhb1gdodXF0Ivhyr/ldN8YGgDg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe (PID: 6652)

    • SIMDA mutex has been found

      • f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe (PID: 6652)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe (PID: 6652)

    • Reads security settings of Internet Explorer

      • f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe (PID: 6652)

    • The process verifies whether the antivirus software is installed

      • f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe (PID: 6652)

    • Potential Corporate Privacy Violation

      • f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe (PID: 6652)

    • There is functionality for taking screenshot (YARA)

      • f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe (PID: 6652)

    • The process checks if it is being run in the virtual environment

      • f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe (PID: 6652)

  • INFO

    • The sample compiled with english language support

      • f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe (PID: 6652)

    • Checks supported languages

      • f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe (PID: 6652)

    • Reads the machine GUID from the registry

      • f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe (PID: 6652)

    • Reads the software policy settings

      • f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe (PID: 6652)
      • slui.exe (PID: 7200)

    • Reads the computer name

      • f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe (PID: 6652)

    • Checks proxy server information

      • f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe (PID: 6652)
      • BackgroundTransferHost.exe (PID: 8016)

    • Creates files or folders in the user directory

      • f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe (PID: 6652)
      • BackgroundTransferHost.exe (PID: 8016)

    • Create files in a temporary directory

      • f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe (PID: 6652)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 7780)
      • BackgroundTransferHost.exe (PID: 8016)
      • BackgroundTransferHost.exe (PID: 7856)
      • BackgroundTransferHost.exe (PID: 6564)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.8)
.exe | Generic Win/DOS Executable (23.4)
.exe | DOS Executable Generic (23.4)
.dbf | Sybase iAnywhere database files (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2003:10:16 23:30:18+00:00
ImageFileCharacteristics: Executable, No line numbers, 32-bit
PEType: PE32
LinkerVersion: 4.3
CodeSize: 17920
InitializedDataSize: 187904
UninitializedDataSize: -
EntryPoint: 0x21e6
OSVersion: 3
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.5.6.3
ProductVersionNumber: 1.9.6.1
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: ASCII
FileDescription: Google Update
LegalCopyright: Copyright (C) 1995-2009 Trend Micro Incorporated. All rights reserved.
InternalName: TISPatch
ProductName: Trend Micro Internet Security
CompanyName: Kingston
Tag1: Copyright (C) Trend Micro Inc.
FileVersion: 1.5.6.3
ProductVersion: 1.9.6.1
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
10
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #SIMDA f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe sppextcomobj.exe no specs slui.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs slui.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
1312"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
5304"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
6388C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6564"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
6652"C:\Users\admin\AppData\Local\Temp\f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe" C:\Users\admin\AppData\Local\Temp\f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
explorer.exe
User:
admin
Company:
Kingston
Integrity Level:
MEDIUM
Description:
Google Update
Version:
1.5.6.3
Modules
Images
c:\users\admin\appdata\local\temp\f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7200C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7780"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
7856"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
8016"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
Total events
3 182
Read events
3 161
Write events
20
Delete events
1

Modification events

(PID) Process:(6652) f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:userinit
Value:
C:\Users\admin\AppData\Local\Temp\f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
(PID) Process:(6652) f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:userinit
Value:
C:\Users\admin\AppData\Local\Temp\F6A434~1.EXE
(PID) Process:(6652) f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft
Operation:delete valueName:D9486297a
Value:
(PID) Process:(6652) f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6652) f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6652) f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7780) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7780) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7780) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(8016) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
0
Suspicious files
8
Text files
20
Unknown types
0

Dropped files

PID
Process
Filename
Type
8016BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D —
MD5:—
SHA256:—
8016BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\3314f1f8-c316-41f2-b4c8-8f105442cfbe.down_data —
MD5:—
SHA256:—
6652f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:C9BE626E9715952E9B70F92F912B9787
SHA256:C13E8D22800C200915F87F71C31185053E4E60CA25DE2E41E160E09CD2D815D4
6652f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exeC:\Users\admin\AppData\Local\Temp\CB69.tmphtml
MD5:9094A6340B701DCE746AB1C16229ECCD
SHA256:E5BED8E9AE20FD99DA516271FC6149954C6601B0B56FDAEF7C5BECF79EAB920A
8016BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\6bb942f4-1f44-485d-9e94-a211076e1676.03b2111a-4850-4174-8a9f-836bbfde671e.down_metabinary
MD5:3762C1CF530FC0DAA8EF934518522423
SHA256:0D30668D3FC3B85C06105F9550587665C34A57A8CA82145947734301194A4B5F
6652f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\login[1].phptext
MD5:32682312D17C7CBF18E73594F5570319
SHA256:E55FB1A1D731153E943B68844AF12DCCE8BFAC917C98FFDEA64C80DA0607DD47
6652f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:971C514F84BBA0785F80AA1C23EDFD79
SHA256:F157ED17FCAF8837FA82F8B69973848C9B10A02636848F995698212A08F31895
6652f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\1OXE00ZI.htmhtml
MD5:854AB16ECE4CD9E947B7A24BD6DF3432
SHA256:1715DB83D33082DCF2898E1E6205FF392AA56549F54EFB7B6DFD706E28223599
6652f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\4SQSJS69.htmhtml
MD5:46923764451223B8CA87A0FE564AA4EE
SHA256:560ACF59147E63C7D6A0D4F32BD8649CDBADF2BE19E380031A20EE52149E8FFA
6652f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exeC:\Users\admin\AppData\Local\Temp\B9F5.tmphtml
MD5:46923764451223B8CA87A0FE564AA4EE
SHA256:560ACF59147E63C7D6A0D4F32BD8649CDBADF2BE19E380031A20EE52149E8FFA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
48
TCP/UDP connections
81
DNS requests
1 117
Threats
18

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.148:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
GET
301
104.21.80.1:80
http://qegyhig.com/login.php
unknown
—
—
malicious
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
GET
200
3.229.117.57:80
http://qetyfuv.com/login.php
unknown
—
—
malicious
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
GET
200
34.229.166.50:80
http://vonypom.com/login.php
unknown
—
—
malicious
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
GET
200
54.85.87.184:80
http://lymyxid.com/login.php
unknown
—
—
malicious
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
GET
200
3.229.117.57:80
http://vocyzit.com/login.php
unknown
—
—
malicious
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
GET
404
23.253.46.64:80
http://gahyqah.com/login.php
unknown
—
—
malicious
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
GET
302
199.191.50.83:80
http://galyqaz.com/login.php
unknown
—
—
malicious
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
GET
500
76.223.54.146:80
http://puzylyp.com/login.php
unknown
—
—
malicious
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
GET
502
154.212.231.82:80
http://gadyniw.com/login.php
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.148:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
104.126.37.155:80
www.bing.com
Akamai International B.V.
DE
whitelisted
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
85.17.31.82:80
gatyfus.com
LeaseWeb Netherlands B.V.
NL
malicious
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
104.21.80.1:80
qegyhig.com
CLOUDFLARENET
—
malicious
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
23.253.46.64:80
gahyqah.com
RACKSPACE
US
malicious
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
76.223.54.146:80
puzylyp.com
AMAZON-02
US
malicious

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.238
whitelisted
crl.microsoft.com
  • 23.48.23.148
  • 23.48.23.157
  • 23.48.23.169
  • 23.48.23.191
  • 23.48.23.188
  • 23.48.23.161
  • 23.48.23.181
  • 23.48.23.155
  • 23.48.23.164
whitelisted
www.bing.com
  • 104.126.37.155
  • 104.126.37.146
  • 104.126.37.131
  • 104.126.37.130
  • 104.126.37.152
  • 104.126.37.128
  • 104.126.37.145
  • 104.126.37.139
  • 104.126.37.137
  • 23.53.43.89
  • 23.53.43.88
whitelisted
qegyqaq.com
  • —
unknown
lygymoj.com
  • —
malicious
puzylyp.com
  • 76.223.54.146
  • 13.248.169.48
malicious
gacyzuz.com
  • —
malicious
lymysan.com
  • —
malicious
vowydef.com
  • —
unknown
qexylup.com
  • —
unknown

Threats

PID
Process
Class
Message
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
Potential Corporate Privacy Violation
ET INFO Unsupported/Fake Internet Explorer Version MSIE 2.
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
Potential Corporate Privacy Violation
ET INFO Unsupported/Fake Internet Explorer Version MSIE 2.
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
Potential Corporate Privacy Violation
ET INFO Unsupported/Fake Windows NT Version 5.0
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
Potential Corporate Privacy Violation
ET INFO Unsupported/Fake Windows NT Version 5.0
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe