File name:

f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe

Full analysis: https://app.any.run/tasks/49b22ff8-e47a-424d-8819-4db885a85231
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 08:49:19
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
sinkhole
simda
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 7 sections
MD5:

2A111D8ECFE17CEFC0275B4F90C541DF

SHA1:

960ACBFC68F2493846A05EEE8A8A3AE6F12EC8C1

SHA256:

F6A434A6D006ACEC7219DD43A25F0706DCDB1081E1145475AFFD2436C2DA76B5

SSDEEP:

3072:hkpB/MT5miFV/hwXZ4bfhb1gdDkRuSvLcNIF0Iv3RytR/lHGvs9jC1cw4Yy9OtYo:n/hE4bfhb1gdodXF0Ivhyr/ldN8YGgDg

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • SIMDA mutex has been found

      • f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe (PID: 6652)

    • Changes the autorun value in the registry

      • f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe (PID: 6652)

  • SUSPICIOUS

    • The process checks if it is being run in the virtual environment

      • f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe (PID: 6652)

    • Reads the date of Windows installation

      • f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe (PID: 6652)

    • The process verifies whether the antivirus software is installed

      • f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe (PID: 6652)

    • Reads security settings of Internet Explorer

      • f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe (PID: 6652)

    • There is functionality for taking screenshot (YARA)

      • f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe (PID: 6652)

    • Potential Corporate Privacy Violation

      • f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe (PID: 6652)

  • INFO

    • Checks supported languages

      • f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe (PID: 6652)

    • The sample compiled with english language support

      • f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe (PID: 6652)

    • Reads the computer name

      • f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe (PID: 6652)

    • Reads the machine GUID from the registry

      • f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe (PID: 6652)

    • Checks proxy server information

      • f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe (PID: 6652)
      • BackgroundTransferHost.exe (PID: 8016)

    • Reads the software policy settings

      • f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe (PID: 6652)
      • slui.exe (PID: 7200)

    • Creates files or folders in the user directory

      • f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe (PID: 6652)
      • BackgroundTransferHost.exe (PID: 8016)

    • Create files in a temporary directory

      • f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe (PID: 6652)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 7780)
      • BackgroundTransferHost.exe (PID: 8016)
      • BackgroundTransferHost.exe (PID: 7856)
      • BackgroundTransferHost.exe (PID: 6564)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.8)
.exe | Generic Win/DOS Executable (23.4)
.exe | DOS Executable Generic (23.4)
.dbf | Sybase iAnywhere database files (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2003:10:16 23:30:18+00:00
ImageFileCharacteristics: Executable, No line numbers, 32-bit
PEType: PE32
LinkerVersion: 4.3
CodeSize: 17920
InitializedDataSize: 187904
UninitializedDataSize: -
EntryPoint: 0x21e6
OSVersion: 3
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.5.6.3
ProductVersionNumber: 1.9.6.1
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: ASCII
FileDescription: Google Update
LegalCopyright: Copyright (C) 1995-2009 Trend Micro Incorporated. All rights reserved.
InternalName: TISPatch
ProductName: Trend Micro Internet Security
CompanyName: Kingston
Tag1: Copyright (C) Trend Micro Inc.
FileVersion: 1.5.6.3
ProductVersion: 1.9.6.1
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
142
Monitored processes
10
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #SIMDA f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe sppextcomobj.exe no specs slui.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs slui.exe svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
1312"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
5304"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
6388C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6564"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
6652"C:\Users\admin\AppData\Local\Temp\f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe" C:\Users\admin\AppData\Local\Temp\f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
explorer.exe
User:
admin
Company:
Kingston
Integrity Level:
MEDIUM
Description:
Google Update
Version:
1.5.6.3
Modules
Images
c:\users\admin\appdata\local\temp\f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7200C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7780"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
7856"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
8016"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
Total events
3 182
Read events
3 161
Write events
20
Delete events
1

Modification events

(PID) Process:(6652) f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:userinit
Value:
C:\Users\admin\AppData\Local\Temp\f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
(PID) Process:(6652) f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:userinit
Value:
C:\Users\admin\AppData\Local\Temp\F6A434~1.EXE
(PID) Process:(6652) f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft
Operation:delete valueName:D9486297a
Value:
(PID) Process:(6652) f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6652) f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6652) f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7780) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7780) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7780) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(8016) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
0
Suspicious files
8
Text files
20
Unknown types
0

Dropped files

PID
Process
Filename
Type
8016BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D —
MD5:—
SHA256:—
8016BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\3314f1f8-c316-41f2-b4c8-8f105442cfbe.down_data —
MD5:—
SHA256:—
6652f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exeC:\Users\admin\AppData\Local\Temp\B9F4.tmphtml
MD5:854AB16ECE4CD9E947B7A24BD6DF3432
SHA256:1715DB83D33082DCF2898E1E6205FF392AA56549F54EFB7B6DFD706E28223599
6652f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\4SQSJS69.htmhtml
MD5:46923764451223B8CA87A0FE564AA4EE
SHA256:560ACF59147E63C7D6A0D4F32BD8649CDBADF2BE19E380031A20EE52149E8FFA
6652f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\login[1].htmhtml
MD5:4F8E702CC244EC5D4DE32740C0ECBD97
SHA256:9E17CB15DD75BBBD5DBB984EDA674863C3B10AB72613CF8A39A00C3E11A8492A
6652f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:F9A9B758C198F86F6854AE340A8DE1C8
SHA256:05B19771D73847FEA33C502D84775F9D6E19D89EFB908FAAA4E6009DE4E132D2
6652f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exeC:\Users\admin\AppData\Local\Temp\B9F5.tmphtml
MD5:46923764451223B8CA87A0FE564AA4EE
SHA256:560ACF59147E63C7D6A0D4F32BD8649CDBADF2BE19E380031A20EE52149E8FFA
6652f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\1OXE00ZI.htmhtml
MD5:854AB16ECE4CD9E947B7A24BD6DF3432
SHA256:1715DB83D33082DCF2898E1E6205FF392AA56549F54EFB7B6DFD706E28223599
6652f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\login[1].phptext
MD5:32682312D17C7CBF18E73594F5570319
SHA256:E55FB1A1D731153E943B68844AF12DCCE8BFAC917C98FFDEA64C80DA0607DD47
6652f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:C9BE626E9715952E9B70F92F912B9787
SHA256:C13E8D22800C200915F87F71C31185053E4E60CA25DE2E41E160E09CD2D815D4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
48
TCP/UDP connections
81
DNS requests
1 117
Threats
18

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.148:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
GET
200
3.229.117.57:80
http://qetyfuv.com/login.php
unknown
—
—
malicious
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
GET
200
54.85.87.184:80
http://lymyxid.com/login.php
unknown
—
—
malicious
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
GET
301
104.21.80.1:80
http://qegyhig.com/login.php
unknown
—
—
malicious
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
GET
200
34.229.166.50:80
http://vonypom.com/login.php
unknown
—
—
malicious
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
GET
404
23.253.46.64:80
http://gahyqah.com/login.php
unknown
—
—
malicious
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
GET
500
76.223.54.146:80
http://puzylyp.com/login.php
unknown
—
—
malicious
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
GET
200
3.229.117.57:80
http://vocyzit.com/login.php
unknown
—
—
malicious
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
GET
302
199.191.50.83:80
http://galyqaz.com/login.php
unknown
—
—
malicious
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
GET
302
69.162.80.54:80
http://lysyfyj.com/login.php
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.148:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
104.126.37.155:80
www.bing.com
Akamai International B.V.
DE
whitelisted
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
85.17.31.82:80
gatyfus.com
LeaseWeb Netherlands B.V.
NL
malicious
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
104.21.80.1:80
qegyhig.com
CLOUDFLARENET
—
malicious
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
23.253.46.64:80
gahyqah.com
RACKSPACE
US
malicious
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
76.223.54.146:80
puzylyp.com
AMAZON-02
US
malicious

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.238
whitelisted
crl.microsoft.com
  • 23.48.23.148
  • 23.48.23.157
  • 23.48.23.169
  • 23.48.23.191
  • 23.48.23.188
  • 23.48.23.161
  • 23.48.23.181
  • 23.48.23.155
  • 23.48.23.164
whitelisted
www.bing.com
  • 104.126.37.155
  • 104.126.37.146
  • 104.126.37.131
  • 104.126.37.130
  • 104.126.37.152
  • 104.126.37.128
  • 104.126.37.145
  • 104.126.37.139
  • 104.126.37.137
  • 23.53.43.89
  • 23.53.43.88
whitelisted
qegyqaq.com
  • —
unknown
lygymoj.com
  • —
malicious
puzylyp.com
  • 76.223.54.146
  • 13.248.169.48
malicious
gacyzuz.com
  • —
malicious
lymysan.com
  • —
malicious
vowydef.com
  • —
unknown
qexylup.com
  • —
unknown

Threats

PID
Process
Class
Message
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
Potential Corporate Privacy Violation
ET INFO Unsupported/Fake Internet Explorer Version MSIE 2.
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
Potential Corporate Privacy Violation
ET INFO Unsupported/Fake Internet Explorer Version MSIE 2.
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
Potential Corporate Privacy Violation
ET INFO Unsupported/Fake Windows NT Version 5.0
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
Potential Corporate Privacy Violation
ET INFO Unsupported/Fake Windows NT Version 5.0
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
6652
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
f6a434a6d006acec7219dd43a25f0706dcdb1081e1145475affd2436c2da76b5.exe