File name:

E7E15660E65E12EED98C8969ECB9BA0B

Full analysis: https://app.any.run/tasks/923b1c6b-94f2-4292-b290-c31d962108e5
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: February 16, 2026, 11:27:33
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
python
anti-evasion
stealer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows, 2 sections
MD5:

E7E15660E65E12EED98C8969ECB9BA0B

SHA1:

58DFA922A7DAE1D79B640A62C532B9EE862B96E8

SHA256:

FFCFA3D0053C08CFFD2B9998FE7586993C3F2D4A8248481A5520869E757F7984

SSDEEP:

6144:x73VulMzZEBcGPHmkgsp7ec2zlssAl2fVnRM2ZQhpScb:x73Hl+cGvtL1ejzlssAluVRH8p

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • uSZnBgiiuBrbBgEp (PID: 1136)

  • SUSPICIOUS

    • Searches for installed software

      • E7E15660E65E12EED98C8969ECB9BA0B.exe (PID: 9064)
      • powershell.exe (PID: 5504)

    • Executable content was dropped or overwritten

      • E7E15660E65E12EED98C8969ECB9BA0B.exe (PID: 9064)
      • pdep.exe (PID: 4700)
      • NKT0VXcyZasWeY6C (PID: 3952)
      • pdep.exe (PID: 2780)
      • uSZnBgiiuBrbBgEp (PID: 2624)

    • Starts application with an unusual extension

      • pdep.exe (PID: 4700)
      • NKT0VXcyZasWeY6C (PID: 3952)
      • pdep.exe (PID: 2780)
      • uSZnBgiiuBrbBgEp (PID: 2624)

    • The process drops C-runtime libraries

      • NKT0VXcyZasWeY6C (PID: 3952)
      • uSZnBgiiuBrbBgEp (PID: 2624)

    • Process drops python dynamic module

      • NKT0VXcyZasWeY6C (PID: 3952)
      • uSZnBgiiuBrbBgEp (PID: 2624)

    • Application launched itself

      • NKT0VXcyZasWeY6C (PID: 3952)
      • uSZnBgiiuBrbBgEp (PID: 2624)

    • Process drops legitimate windows executable

      • NKT0VXcyZasWeY6C (PID: 3952)
      • uSZnBgiiuBrbBgEp (PID: 2624)

    • Starts CMD.EXE for commands execution

      • NKT0VXcyZasWeY6C (PID: 7664)
      • uSZnBgiiuBrbBgEp (PID: 1136)

    • Loads Python modules

      • NKT0VXcyZasWeY6C (PID: 7664)
      • uSZnBgiiuBrbBgEp (PID: 1136)

    • Starts POWERSHELL.EXE for commands execution

      • uSZnBgiiuBrbBgEp (PID: 1136)

    • Gets system UUID (POWERSHELL)

      • powershell.exe (PID: 1876)
      • powershell.exe (PID: 552)

    • Returns all items found within a container (POWERSHELL)

      • powershell.exe (PID: 5504)

    • Uses WMIC.EXE to obtain computer system information

      • cmd.exe (PID: 7932)
      • cmd.exe (PID: 3652)
      • cmd.exe (PID: 1036)

    • Lists computer manufacturer and model

      • uSZnBgiiuBrbBgEp (PID: 1136)

    • Possible stealing from browsers

      • uSZnBgiiuBrbBgEp (PID: 1136)

    • Uses WMIC.EXE

      • cmd.exe (PID: 8444)
      • cmd.exe (PID: 4936)
      • cmd.exe (PID: 6584)
      • cmd.exe (PID: 9176)

  • INFO

    • Checks supported languages

      • E7E15660E65E12EED98C8969ECB9BA0B.exe (PID: 9064)
      • pdep.exe (PID: 8316)
      • pdep.exe (PID: 4700)
      • NKT0VXcyZasWeY6C (PID: 3952)
      • NKT0VXcyZasWeY6C (PID: 7664)
      • pdep.exe (PID: 2780)
      • uSZnBgiiuBrbBgEp (PID: 2624)
      • uSZnBgiiuBrbBgEp (PID: 1136)

    • Reads Environment values

      • E7E15660E65E12EED98C8969ECB9BA0B.exe (PID: 9064)

    • Create files in a temporary directory

      • E7E15660E65E12EED98C8969ECB9BA0B.exe (PID: 9064)
      • NKT0VXcyZasWeY6C (PID: 7664)
      • NKT0VXcyZasWeY6C (PID: 3952)
      • uSZnBgiiuBrbBgEp (PID: 2624)
      • powershell.exe (PID: 5504)
      • uSZnBgiiuBrbBgEp (PID: 1136)

    • Disables trace logs

      • E7E15660E65E12EED98C8969ECB9BA0B.exe (PID: 9064)

    • Reads the machine GUID from the registry

      • E7E15660E65E12EED98C8969ECB9BA0B.exe (PID: 9064)

    • Checks proxy server information

      • E7E15660E65E12EED98C8969ECB9BA0B.exe (PID: 9064)
      • uSZnBgiiuBrbBgEp (PID: 1136)

    • Creates files or folders in the user directory

      • pdep.exe (PID: 4700)
      • pdep.exe (PID: 2780)
      • uSZnBgiiuBrbBgEp (PID: 1136)

    • Reads the computer name

      • NKT0VXcyZasWeY6C (PID: 3952)
      • NKT0VXcyZasWeY6C (PID: 7664)
      • uSZnBgiiuBrbBgEp (PID: 2624)
      • uSZnBgiiuBrbBgEp (PID: 1136)
      • E7E15660E65E12EED98C8969ECB9BA0B.exe (PID: 9064)

    • The sample compiled with english language support

      • NKT0VXcyZasWeY6C (PID: 3952)
      • uSZnBgiiuBrbBgEp (PID: 2624)

    • Checks operating system version

      • NKT0VXcyZasWeY6C (PID: 7664)
      • uSZnBgiiuBrbBgEp (PID: 1136)

    • Drops script file

      • NKT0VXcyZasWeY6C (PID: 7664)
      • powershell.exe (PID: 1876)
      • powershell.exe (PID: 1932)
      • powershell.exe (PID: 552)
      • powershell.exe (PID: 4616)
      • powershell.exe (PID: 7076)
      • powershell.exe (PID: 5164)
      • powershell.exe (PID: 2052)
      • powershell.exe (PID: 7992)
      • powershell.exe (PID: 5504)
      • powershell.exe (PID: 9088)
      • uSZnBgiiuBrbBgEp (PID: 1136)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 1932)

    • Reads security settings of Internet Explorer

      • powershell.exe (PID: 5504)
      • WMIC.exe (PID: 1512)
      • WMIC.exe (PID: 7376)
      • WMIC.exe (PID: 8720)
      • WMIC.exe (PID: 4924)
      • WMIC.exe (PID: 1848)
      • WMIC.exe (PID: 1000)
      • WMIC.exe (PID: 1352)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2063:02:18 02:01:33+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 48
CodeSize: 313344
InitializedDataSize: 1536
UninitializedDataSize: -
EntryPoint: 0x0000
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: PDFRefreshUpdater
FileDescription: PDFRefreshUpdater
FileVersion: 1.0.0.0
InternalName: PDFRefreshUpdater.exe
LegalCopyright:
OriginalFileName: PDFRefreshUpdater.exe
ProductName: PDFRefreshUpdater
ProductVersion: 1.0.0+c2e5961d8ef9ebfde0b1931e7f8329afbe6ba3ff
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
183
Monitored processes
38
Malicious processes
3
Suspicious processes
3

Behavior graph

Click at the process to see the details
start e7e15660e65e12eed98c8969ecb9ba0b.exe pdep.exe no specs conhost.exe no specs pdep.exe conhost.exe no specs nkt0vxcyzaswey6c nkt0vxcyzaswey6c no specs cmd.exe no specs pdep.exe conhost.exe no specs usznbgiiubrbbgep usznbgiiubrbbgep cmd.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs cmd.exe no specs wmic.exe no specs powershell.exe no specs slui.exe no specs powershell.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
552powershell.exe "(Get-CimInstance -Namespace root\cimv2 -ClassName Win32_ComputerSystemProduct).UUID"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—uSZnBgiiuBrbBgEp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
848C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1000wmic datafile where name="C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe" get Version /valueC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
1036C:\WINDOWS\system32\cmd.exe /c "WMIC COMPUTERSYSTEM GET MODEL"C:\Windows\System32\cmd.exe—uSZnBgiiuBrbBgEp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1136--safetorun --ch=d5e972ea188d85447cb8aa4d10bf1f72c44b4ba9 -xC:\Users\admin\AppData\Roaming\q1nMKs5vGfPtwoeL\uSZnBgiiuBrbBgEp
uSZnBgiiuBrbBgEp
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\roaming\q1nmks5vgfptwoel\usznbgiiubrbbgep
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1352wmic datafile where name="C:\\Program Files\\Mozilla Firefox\\firefox.exe" get Version /valueC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
1512WMIC COMPUTERSYSTEM GET HypervisorPresentC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
1848wmic datafile where name="C:\\Program Files\\Mozilla Firefox\\firefox.exe" get Version /valueC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
1876powershell.exe "(Get-CimInstance -Namespace root\cimv2 -ClassName Win32_ComputerSystemProduct).UUID"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—uSZnBgiiuBrbBgEp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1932powershell.exe "Get-ItemProperty -Path HKLM:\SOFTWARE\Policies\Google\Chrome\ -Name CloudManagementEnrollmentToken"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—uSZnBgiiuBrbBgEp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
Total events
94 209
Read events
94 195
Write events
14
Delete events
0

Modification events

(PID) Process:(9064) E7E15660E65E12EED98C8969ECB9BA0B.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\E7E15660E65E12EED98C8969ECB9BA0B_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(9064) E7E15660E65E12EED98C8969ECB9BA0B.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\E7E15660E65E12EED98C8969ECB9BA0B_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(9064) E7E15660E65E12EED98C8969ECB9BA0B.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\E7E15660E65E12EED98C8969ECB9BA0B_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(9064) E7E15660E65E12EED98C8969ECB9BA0B.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\E7E15660E65E12EED98C8969ECB9BA0B_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(9064) E7E15660E65E12EED98C8969ECB9BA0B.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\E7E15660E65E12EED98C8969ECB9BA0B_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(9064) E7E15660E65E12EED98C8969ECB9BA0B.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\E7E15660E65E12EED98C8969ECB9BA0B_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(9064) E7E15660E65E12EED98C8969ECB9BA0B.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\E7E15660E65E12EED98C8969ECB9BA0B_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(9064) E7E15660E65E12EED98C8969ECB9BA0B.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\E7E15660E65E12EED98C8969ECB9BA0B_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(9064) E7E15660E65E12EED98C8969ECB9BA0B.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\E7E15660E65E12EED98C8969ECB9BA0B_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(9064) E7E15660E65E12EED98C8969ECB9BA0B.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\E7E15660E65E12EED98C8969ECB9BA0B_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
161
Suspicious files
15
Text files
70
Unknown types
0

Dropped files

PID
Process
Filename
Type
9064E7E15660E65E12EED98C8969ECB9BA0B.exeC:\Users\admin\AppData\Local\Temp\pdep.exeexecutable
MD5:C677B081C516B9B82C48E7959D43BA95
SHA256:9E1DECBD9D8F78F6E8F1CF037A0590B5BBF2201B2A13B20926D51760C3066ABF
3952NKT0VXcyZasWeY6CC:\Users\admin\AppData\Local\Temp\_MEI39522\_hashlib.pydexecutable
MD5:BA682DFCDD600A4BB43A51A0D696A64C
SHA256:2AD55E11BDDB5B65CDF6E9E126D82A3B64551F7AD9D4CBF74A1058FD7E5993BD
3952NKT0VXcyZasWeY6CC:\Users\admin\AppData\Local\Temp\_MEI39522\_cffi_backend.cp311-win_amd64.pydexecutable
MD5:739D352BD982ED3957D376A9237C9248
SHA256:9AEE90CF7980C8FF694BB3FFE06C71F87EB6A613033F73E3174A732648D39980
3952NKT0VXcyZasWeY6CC:\Users\admin\AppData\Local\Temp\_MEI39522\_ctypes.pydexecutable
MD5:A25CDCF630C024047A47A53728DC87CD
SHA256:3D43869A4507ED8ECE285AE85782D83BB16328CF636170ACB895C227EBB142AC
3952NKT0VXcyZasWeY6CC:\Users\admin\AppData\Local\Temp\_MEI39522\_asyncio.pydexecutable
MD5:41806866D74E5EDCE05EDC0AD47752B9
SHA256:76DB93BD64CB4A36EDB37694456F89BB588DB98CF2733EB436F000B309EEC3B2
9064E7E15660E65E12EED98C8969ECB9BA0B.exeC:\Users\admin\AppData\Local\Temp\EE833DBB8788DC035DCEA75D.txttext
MD5:4422433DEFA98CD0FCCADC7DB0D7AC39
SHA256:60130AB990220A3F741DD4D199909FB98B16FFA235649220CD3DC10E593B79C8
3952NKT0VXcyZasWeY6CC:\Users\admin\AppData\Local\Temp\_MEI39522\Pythonwin\win32ui.pydexecutable
MD5:F0116137D0674482247D056642DC06BF
SHA256:8ECA3ED313003D3F3DEE1B7A5CE90B50E8477EC6E986E590E5ED91C919FC7564
4700pdep.exeC:\Users\admin\AppData\Roaming\KohT5CZLGkQe9CaY\NKT0VXcyZasWeY6Cexecutable
MD5:A4A7A8BEE2EF24229210885199732A4B
SHA256:3CB04A915783AC2F9DDFC163AA79F350A05A34C10B750CA9FC6EA86C50FB3BC0
3952NKT0VXcyZasWeY6CC:\Users\admin\AppData\Local\Temp\_MEI39522\_queue.pydexecutable
MD5:284FBC1B32F0282FC968045B922A4EE2
SHA256:AC3B144D7D7C8EE39F29D8749C5A35C4314B5365198821605C883FD11807E766
3952NKT0VXcyZasWeY6CC:\Users\admin\AppData\Local\Temp\_MEI39522\_multiprocessing.pydexecutable
MD5:758128E09779A4BAA28E68A8B9EE2476
SHA256:3C5B0823E30810AEE47FDFAD567491BC33DD640C37E35C8600E75C5A8D05CE2A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
26
TCP/UDP connections
33
DNS requests
19
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
9064
E7E15660E65E12EED98C8969ECB9BA0B.exe
GET
200
185.111.111.158:443
https://c.pdf-pdq.com/start_upgrade
unknown
—
—
unknown
9064
E7E15660E65E12EED98C8969ECB9BA0B.exe
GET
200
185.111.111.158:443
https://c.pdf-pdq.com/additional_command_started
unknown
—
—
unknown
9064
E7E15660E65E12EED98C8969ECB9BA0B.exe
GET
200
185.111.111.158:443
https://c.pdf-pdq.com/hash_verification_succeeded
unknown
—
—
unknown
9064
E7E15660E65E12EED98C8969ECB9BA0B.exe
GET
200
185.111.111.158:443
https://c.pdf-pdq.com/download_command_succeeded
unknown
—
—
unknown
9064
E7E15660E65E12EED98C8969ECB9BA0B.exe
GET
200
185.111.111.158:443
https://c.pdf-pdq.com/write_data_file_succeeded
unknown
—
—
unknown
9064
E7E15660E65E12EED98C8969ECB9BA0B.exe
GET
200
185.111.111.158:443
https://c.pdf-pdq.com/run-0
unknown
—
—
unknown
9064
E7E15660E65E12EED98C8969ECB9BA0B.exe
GET
200
185.111.111.158:443
https://c.pdf-pdq.com/failed-0-102
unknown
—
—
unknown
1488
svchost.exe
GET
304
20.73.194.208:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/UpdateHealthTools?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&sampleId=s:95271487&appVer=10.0.19041.3626&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=4294967295&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=SedimentPack&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2
unknown
—
—
whitelisted
9064
E7E15660E65E12EED98C8969ECB9BA0B.exe
GET
200
185.111.111.158:443
https://c.pdf-pdq.com/run-1
unknown
—
—
unknown
6768
MoUsoCoreWorker.exe
GET
304
51.104.136.2:443
https://settings-win.data.microsoft.com/settings/v3.0/OneSettings/Client?OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&LocalDeviceID=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&FlightRing=Retail&AttrDataVer=186&OSUILocale=en-US&OSSkuId=48&App=WOSC&AppVer=&IsFlightingEnabled=0&TelemetryLevel=1&DeviceFamily=Windows.Desktop
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
1488
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7244
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6768
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
9064
E7E15660E65E12EED98C8969ECB9BA0B.exe
185.111.111.158:443
c.pdf-pdq.com
CDNEXT
GB
whitelisted
9064
E7E15660E65E12EED98C8969ECB9BA0B.exe
172.67.215.247:443
dotspoint.com
CLOUDFLARENET
US
whitelisted
1488
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1488
svchost.exe
2.16.164.9:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
3412
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
google.com
  • 142.251.37.14
whitelisted
self.events.data.microsoft.com
  • 20.189.173.15
whitelisted
c.pdf-pdq.com
  • 185.111.111.158
whitelisted
dotspoint.com
  • 172.67.215.247
  • 104.21.91.109
unknown
crl.microsoft.com
  • 2.16.164.9
  • 2.16.164.49
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.31.2
  • 20.190.159.4
  • 20.190.159.128
  • 20.190.159.0
  • 20.190.159.75
  • 20.190.159.2
  • 20.190.159.23
  • 20.190.159.64
whitelisted
ocsp.digicert.com
  • 23.63.118.230
whitelisted
slscr.update.microsoft.com
  • 74.178.240.61
whitelisted

Threats

PID
Process
Class
Message
9064
E7E15660E65E12EED98C8969ECB9BA0B.exe
Misc activity
ET HUNTING EXE Base64 Encoded potential malware
9064
E7E15660E65E12EED98C8969ECB9BA0B.exe
A Network Trojan was detected
SUSPICIOUS [ANY.RUN] Base64-encoded PE file download via HTTP
1488
svchost.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
E7E15660E65E12EED98C8969ECB9BA0B