File name:

Hacker-Bp.exe

Full analysis: https://app.any.run/tasks/c43008f7-584e-49a7-bed2-4217dd0390ec
Verdict: Malicious activity
Threats:

XWorm is a remote access trojan (RAT) sold as a malware-as-a-service. It possesses an extensive hacking toolset and is capable of gathering private information and files from the infected computer, hijacking MetaMask and Telegram accounts, and tracking user activity. XWorm is typically delivered to victims' computers through multi-stage attacks that start with phishing emails.

Malware Trends Tracker     >>>
Analysis date: April 09, 2025, 06:13:55
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
netreactor
xworm
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

55F18B04DEAFDEFC093DD8C083EBE6BB

SHA1:

25A9608CC4A8CB76CDE74F4B8797BE2CB78EC7F2

SHA256:

FCD1A4DC12DA8D27E3844862880F1F46EB5E3A253350F7C815391A26DBDD48F3

SSDEEP:

12288:HIcFg/sM1j+eYVp5av9R4VQnAizj+mY7GRcYNDH0a/AZJzGg/UoOm:HTFgJ1qNYFn1EiOY5g/UoOm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to autorun other applications

      • Hacker-Bp.exe (PID: 7388)

    • Application was injected by another process

      • lsass.exe (PID: 756)
      • svchost.exe (PID: 468)
      • svchost.exe (PID: 1044)
      • svchost.exe (PID: 1232)
      • svchost.exe (PID: 1252)
      • svchost.exe (PID: 1288)
      • svchost.exe (PID: 1444)
      • svchost.exe (PID: 1260)
      • svchost.exe (PID: 1416)
      • svchost.exe (PID: 1552)
      • svchost.exe (PID: 1792)
      • svchost.exe (PID: 1524)
      • svchost.exe (PID: 1652)
      • svchost.exe (PID: 2536)
      • svchost.exe (PID: 1784)
      • svchost.exe (PID: 1892)
      • svchost.exe (PID: 1980)
      • svchost.exe (PID: 1904)
      • svchost.exe (PID: 1988)
      • svchost.exe (PID: 2196)
      • svchost.exe (PID: 2172)
      • svchost.exe (PID: 2068)
      • svchost.exe (PID: 2396)
      • svchost.exe (PID: 2292)
      • svchost.exe (PID: 2448)
      • svchost.exe (PID: 2584)
      • svchost.exe (PID: 2544)
      • spoolsv.exe (PID: 2732)
      • svchost.exe (PID: 2624)
      • svchost.exe (PID: 2776)
      • OfficeClickToRun.exe (PID: 3112)
      • svchost.exe (PID: 3104)
      • dasHost.exe (PID: 3012)
      • svchost.exe (PID: 2932)
      • svchost.exe (PID: 3084)
      • svchost.exe (PID: 2920)
      • svchost.exe (PID: 3284)
      • svchost.exe (PID: 3216)
      • svchost.exe (PID: 3196)
      • svchost.exe (PID: 3184)
      • svchost.exe (PID: 3232)
      • svchost.exe (PID: 3564)
      • svchost.exe (PID: 3812)
      • svchost.exe (PID: 3860)
      • svchost.exe (PID: 4292)
      • svchost.exe (PID: 860)
      • svchost.exe (PID: 2880)
      • svchost.exe (PID: 4312)
      • svchost.exe (PID: 6024)
      • svchost.exe (PID: 4508)
      • dllhost.exe (PID: 5880)
      • svchost.exe (PID: 2112)
      • svchost.exe (PID: 1572)
      • svchost.exe (PID: 2996)
      • uhssvc.exe (PID: 648)
      • WmiPrvSE.exe (PID: 1132)
      • svchost.exe (PID: 1684)
      • winlogon.exe (PID: 6648)
      • dwm.exe (PID: 6568)
      • sihost.exe (PID: 4984)
      • svchost.exe (PID: 4544)
      • svchost.exe (PID: 4952)
      • explorer.exe (PID: 5492)
      • MoUsoCoreWorker.exe (PID: 5496)
      • RuntimeBroker.exe (PID: 5368)
      • ctfmon.exe (PID: 956)
      • RuntimeBroker.exe (PID: 3032)
      • svchost.exe (PID: 4348)
      • ApplicationFrameHost.exe (PID: 6952)
      • dllhost.exe (PID: 6176)
      • svchost.exe (PID: 4684)
      • svchost.exe (PID: 4916)
      • svchost.exe (PID: 6544)
      • audiodg.exe (PID: 6168)
      • RuntimeBroker.exe (PID: 4528)
      • svchost.exe (PID: 6180)
      • svchost.exe (PID: 6608)
      • dllhost.exe (PID: 6896)
      • RuntimeBroker.exe (PID: 6160)
      • RuntimeBroker.exe (PID: 1036)
      • UserOOBEBroker.exe (PID: 1248)
      • svchost.exe (PID: 7036)
      • slui.exe (PID: 5404)
      • svchost.exe (PID: 5132)
      • svchost.exe (PID: 6344)
      • taskhostw.exe (PID: 7148)
      • svchost.exe (PID: 4284)
      • SppExtComObj.Exe (PID: 4880)
      • svchost.exe (PID: 5892)
      • WaaSMedicAgent.exe (PID: 5728)
      • conhost.exe (PID: 896)
      • svchost.exe (PID: 7244)
      • svchost.exe (PID: 7900)

    • Runs injected code in another process

      • uxh0jla3.gwf.exe (PID: 7452)

    • XWORM has been detected (YARA)

      • Hacker-Bp.exe (PID: 7388)

  • SUSPICIOUS

    • Reads the date of Windows installation

      • Hacker-Bp.exe (PID: 7388)

    • Reads security settings of Internet Explorer

      • Hacker-Bp.exe (PID: 7388)

    • Executable content was dropped or overwritten

      • Hacker-Bp.exe (PID: 7388)

    • Executes application which crashes

      • ucemkjci.m3u.exe (PID: 1228)

    • There is functionality for taking screenshot (YARA)

      • Hacker-Bp.exe (PID: 7388)

  • INFO

    • Create files in a temporary directory

      • Hacker-Bp.exe (PID: 7388)

    • Reads the computer name

      • Hacker-Bp.exe (PID: 7388)
      • uxh0jla3.gwf.exe (PID: 7452)
      • ucemkjci.m3u.exe (PID: 1228)

    • Checks supported languages

      • Hacker-Bp.exe (PID: 7388)
      • uxh0jla3.gwf.exe (PID: 7452)
      • uhssvc.exe (PID: 648)
      • ucemkjci.m3u.exe (PID: 1228)

    • Process checks computer location settings

      • Hacker-Bp.exe (PID: 7388)

    • Reads the software policy settings

      • lsass.exe (PID: 756)
      • WaaSMedicAgent.exe (PID: 5728)
      • Hacker-Bp.exe (PID: 7388)
      • slui.exe (PID: 7596)
      • slui.exe (PID: 5404)

    • Reads the machine GUID from the registry

      • Hacker-Bp.exe (PID: 7388)
      • ucemkjci.m3u.exe (PID: 1228)

    • Reads Environment values

      • Hacker-Bp.exe (PID: 7388)

    • Disables trace logs

      • Hacker-Bp.exe (PID: 7388)

    • Checks proxy server information

      • Hacker-Bp.exe (PID: 7388)
      • slui.exe (PID: 7596)

    • Creates files in the program directory

      • svchost.exe (PID: 5892)
      • MoUsoCoreWorker.exe (PID: 5496)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 4776)

    • .NET Reactor protector has been detected

      • Hacker-Bp.exe (PID: 7388)

    • Reads Microsoft Office registry keys

      • OfficeClickToRun.exe (PID: 3112)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

XWorm

(PID) Process(7388) Hacker-Bp.exe
C2PKYR5vis3S8H12Bk/DjJyYP7SlZ+YI+TOIlM/NwlqhaRoS8y9RVkDjiuMoGF7k/F:%IP%
Keys
AES%Port%
Options
SplitterI6QTVADAO+4Z7J5sdSJrrQ==
USB drop nameyaq24HtvY/hBH7v28IrPxQ==
Mutex2
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2090:10:05 05:32:40+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 431104
InitializedDataSize: 5120
UninitializedDataSize: -
EntryPoint: 0x6b20e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: -
FileVersion: 1.0.0.0
InternalName: MasonRootkit.exe
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: MasonRootkit.exe
ProductName: -
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
103
Malicious processes
2
Suspicious processes
93

Behavior graph

Click at the process to see the details
start #XWORM hacker-bp.exe uxh0jla3.gwf.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs ucemkjci.m3u.exe svchost.exe waasmedicagent.exe conhost.exe werfault.exe no specs svchost.exe slui.exe svchost.exe svchost.exe uhssvc.exe lsass.exe svchost.exe ctfmon.exe runtimebroker.exe svchost.exe wmiprvse.exe svchost.exe useroobebroker.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe spoolsv.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe dashost.exe runtimebroker.exe svchost.exe svchost.exe officeclicktorun.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe runtimebroker.exe svchost.exe svchost.exe sppextcomobj.exe svchost.exe svchost.exe sihost.exe svchost.exe runtimebroker.exe slui.exe explorer.exe mousocoreworker.exe dllhost.exe svchost.exe runtimebroker.exe audiodg.exe dllhost.exe svchost.exe svchost.exe svchost.exe dwm.exe svchost.exe winlogon.exe dllhost.exe applicationframehost.exe svchost.exe taskhostw.exe hacker-bp.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
468C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p -s LSMC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\lsm.dll
c:\windows\system32\msvcrt.dll
648"C:\Program Files\Microsoft Update Health Tools\uhssvc.exe"C:\Program Files\Microsoft Update Health Tools\uhssvc.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Update Health Service
Version:
10.0.19041.3626 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\shlwapi.dll
c:\program files\microsoft update health tools\uhssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\advapi32.dll
756C:\WINDOWS\system32\lsass.exeC:\Windows\System32\lsass.exe
wininit.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Local Security Authority Process
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\lsass.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\lsasrv.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\sechost.dll
860C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvcC:\Windows\System32\svchost.exe
services.exe
User:
LOCAL SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\shlwapi.dll
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
896\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe
WaaSMedicAgent.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
956"ctfmon.exe"C:\Windows\System32\ctfmon.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
CTF Loader
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\shlwapi.dll
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
1036C:\Windows\System32\RuntimeBroker.exe -EmbeddingC:\Windows\System32\RuntimeBroker.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Runtime Broker
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\runtimebroker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\powrprof.dll
1044C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s gpsvcC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
1132C:\WINDOWS\system32\wbem\wmiprvse.exeC:\Windows\System32\wbem\WmiPrvSE.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
WMI Provider Host
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\shlwapi.dll
c:\windows\system32\wbem\wmiprvse.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wbem\fastprox.dll
c:\windows\system32\ncobjapi.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\combase.dll
1228"C:\Users\admin\AppData\Local\Temp\ucemkjci.m3u.exe" C:\Users\admin\AppData\Local\Temp\ucemkjci.m3u.exe
Hacker-Bp.exe
User:
admin
Integrity Level:
HIGH
Description:
Exit code:
3762504530
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\ucemkjci.m3u.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
19 490
Read events
19 261
Write events
131
Delete events
98

Modification events

(PID) Process:(7388) Hacker-Bp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Masonconfig\pid
Operation:writeName:oimyfd2j.wfo
Value:
7388
(PID) Process:(7388) Hacker-Bp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Masonconfig\paths
Operation:writeName:mrvblpcc.mwx
Value:
C:\Users\admin\Desktop\Hacker-Bp.exe
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CompatibilityAdapter\Signatures
Operation:delete valueName:MasonHacker-Bp.exe.job
Value:
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\CompatibilityAdapter\Signatures
Operation:delete valueName:MasonHacker-Bp.exe.job.fp
Value:
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\MasonHacker-Bp.exe
Operation:writeName:SD
Value:
01000480880000009800000000000000140000000200740004000000001018009F011F0001020000000000052000000020020000001014009F011F0001010000000000051200000000101800FF011F00010200000000000520000000200200000000240089001200010500000000000515000000AC8CF364854C30247ED94EABE90300001200000001020000000000052000000020020000010500000000000515000000AC8CF364854C30247ED94EAB01020000
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\MasonHacker-Bp.exe
Operation:writeName:Id
Value:
{0B929B93-80A1-444E-A91C-65C01124E1E6}
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\MasonHacker-Bp.exe
Operation:writeName:Index
Value:
2
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0B929B93-80A1-444E-A91C-65C01124E1E6}
Operation:writeName:Path
Value:
\MasonHacker-Bp.exe
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0B929B93-80A1-444E-A91C-65C01124E1E6}
Operation:writeName:Hash
Value:
CBED12272FE7098F9F1E761FB0BE2B34C4707F685B517F3B9970D7720460B74A
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0B929B93-80A1-444E-A91C-65C01124E1E6}
Operation:writeName:Schema
Value:
65538
Executable files
2
Suspicious files
11
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
4776WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_ucemkjci.m3u.exe_3953ff6a3c9f792e264ae6aac0ec5dda44cfe6e5_5417f3ff_f8b10492-21e7-49d3-9ee9-186d2e05dbd2\Report.wer —
MD5:—
SHA256:—
4776WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\ucemkjci.m3u.exe.1228.dmp —
MD5:—
SHA256:—
7388Hacker-Bp.exeC:\Users\admin\AppData\Local\Temp\uxh0jla3.gwf.exeexecutable
MD5:94F1AB3A068F83B32639579EC9C5D025
SHA256:879CC20B41635709BB304E315AAA5CA4708B480A1BFC2F4935FCF2215188EFB0
6896dllhost.exeC:\Users\admin\AppData\Local\Microsoft\Windows\WebCache\V01.chkbinary
MD5:E313E6FAE3209AADA08F9555EC656479
SHA256:A7C3F81F6A785EDAD90CA02F02D7FBCBBCCC711A00F924D1AA8ED18284CF7F87
7388Hacker-Bp.exeC:\Users\admin\AppData\Local\Temp\ucemkjci.m3u.exeexecutable
MD5:89C9C8D9E0BE2016D9AB16E2571AE05B
SHA256:678949B288738E54239E2B21078870CBD9C02E61EE2FA2810A7B45EEBDA29B5F
4776WerFault.exeC:\Windows\appcompat\Programs\Amcache.hvebinary
MD5:C2E200EB2BB7985DC26F9D6B1CA8EF8D
SHA256:F918E1385DE2423DE58DD388592C3424B1EDA71C2F1F1E2F4F8D66DB267CA961
4776WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD45A.tmp.WERInternalMetadata.xmlbinary
MD5:845886FBC8564E388C59E96839A49CAB
SHA256:AB05A082A31CDE294F477DDDF768B263477F8CEE231B8E85A70E4F418838FECA
4776WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD49A.tmp.xmlxml
MD5:733A6F2CD1B2C77689FF38D7A2EC258F
SHA256:9B63AFB30CE29168AC1A1BA52536434F3A823841AAD79A4EEA381FE25B377F2C
4776WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WERD36F.tmp.dmpbinary
MD5:7BF2ED0C06D2568A5E28EE42539F5BAA
SHA256:77597BB337E94B4AFC71D645584E2F90DB761521A2D8B3892205BAA22C3648D0
6176dllhost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.chkbinary
MD5:60F0D919AAFA07FDDB72CE01EDBC9832
SHA256:79E61D407A24A9648A8FA8247F16E30466949EF181873BCDD2EBD9CCD444DB24
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
50
TCP/UDP connections
67
DNS requests
10
Threats
47

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.216.77.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
—
104.21.96.1:443
https://i.ibb.co/Dwrj41N/Image.png
unknown
—
—
—
—
—
GET
—
104.21.64.1:443
https://i.ibb.co/Dwrj41N/Image.png
unknown
—
—
—
—
—
GET
—
104.21.112.1:443
https://i.ibb.co/Dwrj41N/Image.png
unknown
—
—
—
—
—
GET
—
104.21.48.1:443
https://i.ibb.co/Dwrj41N/Image.png
unknown
—
—
—
—
—
GET
—
104.21.16.1:443
https://i.ibb.co/Dwrj41N/Image.png
unknown
—
—
—
—
—
GET
—
104.21.32.1:443
https://i.ibb.co/Dwrj41N/Image.png
unknown
—
—
—
—
—
GET
—
104.21.80.1:443
https://i.ibb.co/Dwrj41N/Image.png
unknown
—
—
—
—
—
GET
—
104.21.96.1:443
https://i.ibb.co/Dwrj41N/Image.png
unknown
—
—
—
—
—
GET
—
104.21.112.1:443
https://i.ibb.co/Dwrj41N/Image.png
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
23.216.77.42:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7388
Hacker-Bp.exe
91.134.9.160:443
i.ibb.co
OVH SAS
FR
shared
7388
Hacker-Bp.exe
104.26.2.16:443
rentry.co
CLOUDFLARENET
US
suspicious
5404
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
  • 20.73.194.208
whitelisted
google.com
  • 142.250.185.78
whitelisted
crl.microsoft.com
  • 23.216.77.42
  • 23.216.77.6
whitelisted
i.ibb.co
  • 91.134.9.160
  • 91.134.10.182
  • 91.134.82.79
  • 91.134.9.159
  • 91.134.10.127
  • 91.134.10.168
shared
rentry.co
  • 104.26.2.16
  • 172.67.75.40
  • 104.26.3.16
unknown
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
7388
Hacker-Bp.exe
Not Suspicious Traffic
INFO [ANY.RUN] Image hosting service ImgBB
2196
svchost.exe
Misc activity
ET INFO Pastebin Service Domain in DNS Lookup (rentry .co)
7388
Hacker-Bp.exe
Misc activity
ET INFO Observed Pastebin Service Domain (rentry .co in TLS SNI)
7388
Hacker-Bp.exe
Not Suspicious Traffic
INFO [ANY.RUN] Image hosting service ImgBB
7388
Hacker-Bp.exe
Not Suspicious Traffic
INFO [ANY.RUN] Image hosting service ImgBB
7388
Hacker-Bp.exe
Not Suspicious Traffic
INFO [ANY.RUN] Image hosting service ImgBB
7388
Hacker-Bp.exe
Not Suspicious Traffic
INFO [ANY.RUN] Image hosting service ImgBB
7388
Hacker-Bp.exe
Not Suspicious Traffic
INFO [ANY.RUN] Image hosting service ImgBB
7388
Hacker-Bp.exe
Not Suspicious Traffic
INFO [ANY.RUN] Image hosting service ImgBB
7388
Hacker-Bp.exe
Not Suspicious Traffic
INFO [ANY.RUN] Image hosting service ImgBB
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Hacker-Bp.exe