File name:

child2-za.exe

Full analysis: https://app.any.run/tasks/7d27f6dc-7c2f-40eb-9afa-86b1dee30340
Verdict: Malicious activity
Threats:

Trojans are a group of malicious programs distinguished by their ability to masquerade as benign software. Depending on their type, trojans possess a variety of capabilities, ranging from maintaining full remote control over the victim’s machine to stealing data and files, as well as dropping other malware. At the same time, the main functionality of each trojan family can differ significantly depending on its type. The most common trojan infection chain starts with a phishing email.

Malware Trends Tracker     >>>
Analysis date: November 22, 2020, 11:27:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
zeroaccess
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

8544FECA0FD08939A209DE7179829F77

SHA1:

6FD63926DE368F7BD849993809603103938338C7

SHA256:

044FAA54C7908D54B6ADDF01D0412619FE50F0DD01CA3DE40422B8FF272586AB

SSDEEP:

3072:qdBuXaFlGOQXbk+pj+TiddURolFbnHrZs91krsWTq:q72aFl6XbPj+unLMkrsWq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Runs injected code in another process

      • child2-za.exe (PID: 1668)
      • InstallFlashPlayer.exe (PID: 648)

    • Loads dropped or rewritten executable

      • InstallFlashPlayer.exe (PID: 648)
      • InstallFlashPlayer.exe (PID: 4084)

    • Application was dropped or rewritten from another process

      • InstallFlashPlayer.exe (PID: 648)
      • InstallFlashPlayer.exe (PID: 4084)
      • FlashPlayerUpdateService.exe (PID: 2244)
      • FlashPlayerUpdateService.exe (PID: 2656)

    • Changes the autorun value in the registry

      • child2-za.exe (PID: 1668)
      • services.exe (PID: 472)

    • Runs app for hidden code execution

      • child2-za.exe (PID: 1668)
      • InstallFlashPlayer.exe (PID: 648)

    • Application was injected by another process

      • explorer.exe (PID: 376)
      • services.exe (PID: 472)

    • Modifies Windows Defender service settings

      • services.exe (PID: 472)

    • Drops executable file immediately after starts

      • child2-za.exe (PID: 1668)
      • InstallFlashPlayer.exe (PID: 4084)

    • Modifies Windows security services settings

      • services.exe (PID: 472)

    • ZEROACCESS was detected

      • child2-za.exe (PID: 1668)
      • InstallFlashPlayer.exe (PID: 648)

    • Loads the Task Scheduler COM API

      • FlashPlayerUpdateService.exe (PID: 2656)

  • SUSPICIOUS

    • Drops a file that was compiled in debug mode

      • child2-za.exe (PID: 1668)
      • InstallFlashPlayer.exe (PID: 4084)
      • InstallFlashPlayer.exe (PID: 648)

    • Creates a directory in Program Files

      • InstallFlashPlayer.exe (PID: 648)

    • Starts CMD.EXE for commands execution

      • child2-za.exe (PID: 1668)
      • InstallFlashPlayer.exe (PID: 4084)
      • InstallFlashPlayer.exe (PID: 648)

    • Executable content was dropped or overwritten

      • child2-za.exe (PID: 1668)
      • InstallFlashPlayer.exe (PID: 648)
      • InstallFlashPlayer.exe (PID: 4084)

    • Creates or modifies windows services

      • InstallFlashPlayer.exe (PID: 648)
      • services.exe (PID: 472)

    • Creates files in the Windows directory

      • InstallFlashPlayer.exe (PID: 4084)
      • services.exe (PID: 472)
      • InstallFlashPlayer.exe (PID: 648)

    • Removes files from Windows directory

      • InstallFlashPlayer.exe (PID: 4084)

    • Drops a file with a compile date too recent

      • InstallFlashPlayer.exe (PID: 4084)
      • InstallFlashPlayer.exe (PID: 648)

    • Disables SEHOP

      • InstallFlashPlayer.exe (PID: 4084)

    • Modifies the open verb of a shell class

      • InstallFlashPlayer.exe (PID: 4084)

    • Creates a software uninstall entry

      • InstallFlashPlayer.exe (PID: 4084)

    • Writes to a desktop.ini file (may be used to cloak folders)

      • services.exe (PID: 472)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2013:11:25 16:34:01+01:00
PEType: PE32
LinkerVersion: 9
CodeSize: 18432
InitializedDataSize: 99840
UninitializedDataSize: -
EntryPoint: 0x1e65
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 25-Nov-2013 15:34:01
Detected languages:
  • English - United States

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 25-Nov-2013 15:34:01
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000047FB
0x00004800
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.5165
.rdata
0x00006000
0x00017636
0x00017800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.83102
.data
0x0001E000
0x00000228
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.28413
.rsrc
0x0001F000
0x000001E0
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.70139
.reloc
0x00020000
0x000006D8
0x00000800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
4.38941

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.92524
378
UNKNOWN
English - United States
RT_MANIFEST

Imports

ADVAPI32.dll
KERNEL32.dll
SHELL32.dll
WS2_32.dll
ntdll.dll

Exports

Title
Ordinal
Address
AlphaBlend
1
0x0001D5C0
GradientFill
2
0x0001D5E9
TransparentBlt
3
0x0001D616
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
10
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
inject drop and start start inject drop and start drop and start drop and start #ZEROACCESS child2-za.exe explorer.exe #ZEROACCESS installflashplayer.exe cmd.exe no specs services.exe installflashplayer.exe flashplayerupdateservice.exe no specs flashplayerupdateservice.exe no specs cmd.exe no specs cmd.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
376C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
472C:\Windows\system32\services.exeC:\Windows\System32\services.exe
wininit.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Services and Controller app
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\services.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\profapi.dll
c:\windows\system32\sechost.dll
c:\windows\system32\cryptbase.dll
648"C:\Users\admin\AppData\Local\Temp\InstallFlashPlayer.exe" C:\Users\admin\AppData\Local\Temp\InstallFlashPlayer.exe
child2-za.exe
User:
admin
Company:
Adobe Systems, Inc.
Integrity Level:
HIGH
Description:
Adobe® Flash® Player Installer/Uninstaller 11.0 r1
Exit code:
0
Version:
11,0,1,152
Modules
Images
c:\users\admin\appdata\local\temp\installflashplayer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
1152"C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe—InstallFlashPlayer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
4294967295
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
1552"C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe—child2-za.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
4294967295
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1668"C:\Users\admin\AppData\Local\Temp\child2-za.exe" C:\Users\admin\AppData\Local\Temp\child2-za.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\child2-za.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2244C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe -setSilentAutoUpdateC:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe—InstallFlashPlayer.exe
User:
admin
Company:
Adobe
Integrity Level:
HIGH
Description:
Adobe® Flash® Player Update Service 32.0 r0
Exit code:
0
Version:
32,0,0,453
Modules
Images
c:\windows\system32\macromed\flash\flashplayerupdateservice.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\webio.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
2656C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe -installC:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe—InstallFlashPlayer.exe
User:
admin
Company:
Adobe
Integrity Level:
HIGH
Description:
Adobe® Flash® Player Update Service 32.0 r0
Exit code:
0
Version:
32,0,0,453
Modules
Images
c:\windows\system32\macromed\flash\flashplayerupdateservice.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winhttp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\webio.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
3148"C:\Windows\system32\cmd.exe" /c del "C:\Users\admin\AppData\Local\Temp\F3D9.dir\InstallFlashPlayer.exe" >> NULC:\Windows\system32\cmd.exe—InstallFlashPlayer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
4084"C:\Users\admin\AppData\Local\Temp\F3D9.dir\InstallFlashPlayer.exe" -iv 6C:\Users\admin\AppData\Local\Temp\F3D9.dir\InstallFlashPlayer.exe
InstallFlashPlayer.exe
User:
admin
Company:
Adobe
Integrity Level:
HIGH
Description:
Adobe® Flash® Player Installer/Uninstaller 32.0 r0
Exit code:
0
Version:
32,0,0,453
Modules
Images
c:\users\admin\appdata\local\temp\f3d9.dir\installflashplayer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\advapi32.dll
Total events
2 416
Read events
1 725
Write events
421
Delete events
270

Modification events

(PID) Process:(1668) child2-za.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Google Update
Value:
"C:\Users\admin\AppData\Local\Google\Desktop\Install\{6c5bc945-ecdc-d004-f972-a3d5e5911bb1}\❤≸⋙\Ⱒ☠⍨\‮ﯹ๛\{6c5bc945-ecdc-d004-f972-a3d5e5911bb1}\GoogleUpdate.exe" >
(PID) Process:(1668) child2-za.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1668) child2-za.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1668) child2-za.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(648) InstallFlashPlayer.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinDefend\Parameters
Operation:delete keyName:(default)
Value:
(PID) Process:(648) InstallFlashPlayer.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinDefend\Security
Operation:delete keyName:(default)
Value:
(PID) Process:(648) InstallFlashPlayer.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinDefend\TriggerInfo\0
Operation:delete keyName:(default)
Value:
(PID) Process:(648) InstallFlashPlayer.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinDefend\TriggerInfo
Operation:delete keyName:(default)
Value:
(PID) Process:(648) InstallFlashPlayer.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\WinDefend
Operation:delete keyName:(default)
Value:
(PID) Process:(648) InstallFlashPlayer.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellServiceObjects\{F56F6FDD-AA9D-4618-A949-C1B91AF43B1A}
Operation:delete keyName:(default)
Value:
Executable files
10
Suspicious files
1
Text files
2
Unknown types
1

Dropped files

PID
Process
Filename
Type
472services.exeC:\Windows\assembly\GAC\Desktop.ini —
MD5:—
SHA256:—
4084InstallFlashPlayer.exeC:\Windows\system32\Macromed\Temp\{65CB8F07-6A28-4FFC-ACC5-B6239BC1F75B}\fpb.tmp —
MD5:—
SHA256:—
1668child2-za.exeC:\Users\admin\AppData\Local\Temp\msimg32.dllexecutable
MD5:—
SHA256:—
4084InstallFlashPlayer.exeC:\Windows\system32\Macromed\Flash\FlashInstall32.logbinary
MD5:—
SHA256:—
4084InstallFlashPlayer.exeC:\Windows\system32\Macromed\Flash\activex.vchcat
MD5:—
SHA256:—
648InstallFlashPlayer.exeC:\Windows\system32\Macromed\Flash\FlashInstall.logtext
MD5:—
SHA256:—
4084InstallFlashPlayer.exeC:\Windows\system32\Macromed\Flash\FlashUtil32_32_0_0_453_ActiveX.exeexecutable
MD5:F82FA9E584E7121D94462B3697FD050A
SHA256:B914BBA5E52749DA68D0E4DF4D0F628164454547C4B54D117C64326B99FE7A74
4084InstallFlashPlayer.exeC:\Windows\system32\Macromed\Temp\{0E90F6AE-2DFA-48F6-9065-7A16A06F1554}\fpb.tmpexecutable
MD5:1631E1D2C67425DFD202AC8FB960B052
SHA256:8C23C30FFB5AEB3BA03D8F2A081CAD5FBFE0D942F818CDEDEB7196C28BDE9E31
4084InstallFlashPlayer.exeC:\Windows\system32\Macromed\Flash\Flash32_32_0_0_453.ocxexecutable
MD5:9C1A3146511E2CD364C250152B7BE279
SHA256:9012C761A33022F994DC4641FFB2DB1269FCE164B4D20EDB57A62271F6CCD613
4084InstallFlashPlayer.exeC:\Windows\system32\Macromed\Flash\FlashUtil32_32_0_0_453_ActiveX.dllexecutable
MD5:1631E1D2C67425DFD202AC8FB960B052
SHA256:8C23C30FFB5AEB3BA03D8F2A081CAD5FBFE0D942F818CDEDEB7196C28BDE9E31
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
273
DNS requests
17
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4084
InstallFlashPlayer.exe
GET
404
92.122.188.7:80
http://fpdownload2.macromedia.com/get/flashplayer/update/current/install/version.xml32.0.0.453~installVector=6&previousVersion=26.0.0.131&pProc=installflashplayer.exe&lang=en&cpuWordLength=32&playerType=ax&os=win&osVer=13&isDebug=0
unknown
html
427 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1668
child2-za.exe
85.114.128.127:53
—
myLoc managed IT AG
DE
malicious
648
InstallFlashPlayer.exe
85.114.128.127:53
—
myLoc managed IT AG
DE
malicious
648
InstallFlashPlayer.exe
23.212.157.223:80
fpdownload.macromedia.com
GTT Communications Inc.
US
unknown
1668
child2-za.exe
8.8.8.8:53
—
Google Inc.
US
malicious
—
—
176.61.195.55:16471
—
Slovanet a.s.
SK
unknown
—
—
89.42.153.135:16471
—
—
GB
unknown
—
—
95.85.170.63:16471
—
Sat-Trakt D.O.O.
RS
unknown
—
—
218.186.205.90:16471
—
StarHub Cable Vision Ltd
SG
unknown
—
—
103.12.122.101:16471
—
Connect Communications
PK
unknown
—
—
84.210.70.201:16471
—
Get AS
NO
unknown

DNS requests

Domain
IP
Reputation
j.maxmind.com
  • —
shared
  • —
whitelisted
fpdownload.macromedia.com
  • 23.212.157.223
whitelisted
fpdownload2.macromedia.com
  • 92.122.188.7
  • 92.122.188.32
whitelisted

Threats

PID
Process
Class
Message
1668
child2-za.exe
A Network Trojan was detected
ET TROJAN ZeroAccess udp traffic detected
648
InstallFlashPlayer.exe
A Network Trojan was detected
ET TROJAN ZeroAccess udp traffic detected
648
InstallFlashPlayer.exe
A Network Trojan was detected
ET TROJAN ZeroAccess udp traffic detected
648
InstallFlashPlayer.exe
A Network Trojan was detected
ET TROJAN ZeroAccess udp traffic detected
648
InstallFlashPlayer.exe
A Network Trojan was detected
ET TROJAN ZeroAccess udp traffic detected
648
InstallFlashPlayer.exe
A Network Trojan was detected
ET TROJAN ZeroAccess udp traffic detected
648
InstallFlashPlayer.exe
A Network Trojan was detected
ET TROJAN ZeroAccess udp traffic detected
648
InstallFlashPlayer.exe
Generic Protocol Command Decode
SURICATA HTTP Request abnormal Content-Encoding header
—
—
A Network Trojan was detected
ET TROJAN ZeroAccess Outbound udp traffic detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
child2-za.exe