Malware analysis convertmate.exe Malicious activity | ANY.RUN

Add for printing

File name:	convertmate.exe
Full analysis:	https://app.any.run/tasks/8003119c-84a4-41f2-894c-6657ed3e5cc1
Verdict:	Malicious activity
Analysis date:	October 22, 2025, 12:07:16
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	arch-exec
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows, 2 sections
MD5:	2DF67805A1EF4C69B1DE46E484FDE896
SHA1:	0F0E7F2098FFBE68C40969FBD6DB30A164A3008F
SHA256:	08B9F93000512B45F8C2E8D3D6624536B366E67C40FD4B958DB58E3A1D129C3D
SSDEEP:	98304:j20km/AdVa2OH7/qC3DkDr9ac1rI/OS2PLF0ZhQ/DKCf5Ow1IoL6MG1QCgjEesvC:DOAFDi5ZrpavDa

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 120 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: 60 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (133.0.6943.127)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (133.0.3065.92)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (136.0)
Mozilla Maintenance Service (136.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Changes powershell execution policy (RemoteSigned)
  - convertmate.exe (PID: 7500)
SUSPICIOUS
- The process executes Powershell scripts
  - convertmate.exe (PID: 7500)
- Starts POWERSHELL.EXE for commands execution
  - convertmate.exe (PID: 7500)
- Process drops legitimate windows executable
  - convertmate.exe (PID: 7500)
- Executable content was dropped or overwritten
  - convertmate.exe (PID: 7500)
- Gets path to any of the special folders (POWERSHELL)
  - powershell.exe (PID: 7760)
- Searches for installed software
  - convertmate.exe (PID: 7500)
- Reads security settings of Internet Explorer
  - convertmate.exe (PID: 7500)
  - Convert Mate.exe (PID: 4528)
- SQL CE related mutex has been found
  - convertmate.exe (PID: 7500)
- Reads the date of Windows installation
  - convertmate.exe (PID: 7500)
INFO
- Reads the computer name
  - convertmate.exe (PID: 7500)
  - Convert Mate.exe (PID: 4528)
- Checks supported languages
  - convertmate.exe (PID: 7500)
  - Convert Mate.exe (PID: 4528)
- Disables trace logs
  - convertmate.exe (PID: 7500)
- Reads the software policy settings
  - convertmate.exe (PID: 7500)
- Checks proxy server information
  - convertmate.exe (PID: 7500)
- Reads the machine GUID from the registry
  - convertmate.exe (PID: 7500)
  - Convert Mate.exe (PID: 4528)
- Reads Environment values
  - convertmate.exe (PID: 7500)
- Creates files or folders in the user directory
  - convertmate.exe (PID: 7500)
- Creates a software uninstall entry
  - convertmate.exe (PID: 7500)
- Create files in a temporary directory
  - convertmate.exe (PID: 7500)
- Process checks computer location settings
  - convertmate.exe (PID: 7500)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Win64 Executable (generic) (87.3)
.exe	\|	Generic Win/DOS Executable (6.3)
.exe	\|	DOS Executable Generic (6.3)

EXIF

EXE

MachineType:	AMD AMD64
TimeStamp:	2103:07:28 15:51:51+00:00
ImageFileCharacteristics:	Executable, Large address aware
PEType:	PE32+
LinkerVersion:	8
CodeSize:	7783424
InitializedDataSize:	17408
UninitializedDataSize:	-
EntryPoint:	0x0000
OSVersion:	4
ImageVersion:	-
SubsystemVersion:	4
Subsystem:	Windows GUI
FileVersionNumber:	12.1.3.1020
ProductVersionNumber:	12.1.3.1020
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Win32
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	Neutral
CharacterSet:	Unicode
Comments:	-
CompanyName:	-
FileDescription:	ConvertMate
FileVersion:	12.1.3.1020
InternalName:	ConvertMate.exe
LegalCopyright:	Copyright © 2024
LegalTrademarks:	-
OriginalFileName:	ConvertMate.exe
ProductName:	ConvertMate
ProductVersion:	12.1.3.1020
AssemblyVersion:	12.1.3.1020

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

147

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

4528

"C:\Users\admin\AppData\Local\ConvertMate\Convert Mate.exe"

C:\Users\admin\AppData\Local\ConvertMate\Convert Mate.exe

—

convertmate.exe

User:

admin

Integrity Level:

MEDIUM

Description:

NativeV10

Exit code:

Version:

5.0.0.1000

Modules

Images
c:\users\admin\appdata\local\convertmate\convert mate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll

7188

C:\WINDOWS\System32\slui.exe -Embedding

C:\Windows\System32\slui.exe

—

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Activation Client

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

7500

"C:\Users\admin\Desktop\convertmate.exe"

C:\Users\admin\Desktop\convertmate.exe

explorer.exe

User:

admin

Integrity Level:

MEDIUM

Description:

ConvertMate

Exit code:

Version:

12.1.3.1020

Modules

Images
c:\users\admin\desktop\convertmate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll

7760

"powershell.exe" -ep RemoteSigned -File "C:\Users\admin\AppData\Local\ConvertMate\conmate_update.ps1"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

—

convertmate.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows PowerShell

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll

7768

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

powershell.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

Add for printing

Total events

8 689

Read events

8 599

Write events

Delete events

Modification events


(PID) Process:	(7500) convertmate.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\convertmate_RASAPI32
Operation:	write	Name:	EnableFileTracing
Value: 0
(PID) Process:	(7500) convertmate.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\convertmate_RASAPI32
Operation:	write	Name:	EnableAutoFileTracing
Value: 0
(PID) Process:	(7500) convertmate.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\convertmate_RASAPI32
Operation:	write	Name:	EnableConsoleTracing
Value: 0
(PID) Process:	(7500) convertmate.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\convertmate_RASAPI32
Operation:	write	Name:	FileTracingMask
Value:
(PID) Process:	(7500) convertmate.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\convertmate_RASAPI32
Operation:	write	Name:	ConsoleTracingMask
Value:
(PID) Process:	(7500) convertmate.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\convertmate_RASAPI32
Operation:	write	Name:	MaxFileSize
Value: 1048576
(PID) Process:	(7500) convertmate.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\convertmate_RASAPI32
Operation:	write	Name:	FileDirectory
Value: %windir%\tracing
(PID) Process:	(7500) convertmate.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\convertmate_RASMANCS
Operation:	write	Name:	EnableFileTracing
Value: 0
(PID) Process:	(7500) convertmate.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\convertmate_RASMANCS
Operation:	write	Name:	EnableAutoFileTracing
Value: 0
(PID) Process:	(7500) convertmate.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\convertmate_RASMANCS
Operation:	write	Name:	EnableConsoleTracing
Value: 0

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
7500	convertmate.exe	C:\Users\admin\AppData\Local\ConvertMate\Updating_files.zip		compressed
		MD5:2E16D9AB04684B787D6650621225E127	SHA256:2958A25CCFFA1D8647867DFDAB9C9075E72801C277630CD29A26C0A9D5FC0986
7500	convertmate.exe	C:\Users\admin\AppData\Local\ConvertMate\Native.zip		compressed
		MD5:88D70953482E2BFC5910FEFC50905C47	SHA256:DEB419D16561154DB9D499CA09C6299E365A5DBB41BC283A415B8F21AD208AAC
7500	convertmate.exe	C:\Users\admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML		text
		MD5:5433EAB10C6B5C6D55B7CBD302426A39	SHA256:23DBF7014E99E93AF5F2760F18EE1370274F06A453145C8D539B66D798DAD131
7760	powershell.exe	C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_4t3zogil.dwz.psm1		text
		MD5:D17FE0A3F47BE24A6453E9EF58C94641	SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7500	convertmate.exe	C:\Users\admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak		text
		MD5:7050D5AE8ACFBE560FA11073FEF8185D	SHA256:CB87767C4A384C24E4A0F88455F59101B1AE7B4FB8DE8A5ADB4136C5F7EE545B
7500	convertmate.exe	C:\Users\admin\AppData\Local\ConvertMate\Convert Mate.exe		executable
		MD5:192B80BAB47BCE9B96F683409DB2FE61	SHA256:DA97BD74CDBCDDAA818E1CEFFFCFE2C8113FB59480B42A701E892A3D14BE7B12
7500	convertmate.exe	C:\Users\admin\Desktop\Convert Mate.lnk		binary
		MD5:7D5F2906CD0ADB289E55FE93854EEC8D	SHA256:C569DCDDBBA6507599F4FD2E261F54E2461DBF14C8FF8073F6D2A0F777CF220D
7500	convertmate.exe	C:\Users\admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD		xml
		MD5:90BE2701C8112BEBC6BD58A7DE19846E	SHA256:644FBCDC20086E16D57F31C5BAD98BE68D02B1C061938D2F5F91CBE88C871FBF
7500	convertmate.exe	C:\Users\admin\AppData\Local\Temp\video.mp4		binary
		MD5:F23E33FA595FFE6651EEDC80F89B2415	SHA256:0B2F6EACA78D898D26E183EFE4E514CD81526A13DF1AF38F712DBE0CB22B742B
7500	convertmate.exe	C:\Users\admin\AppData\Local\ConvertMate\Newtonsoft.Json.dll		executable
		MD5:195FFB7167DB3219B217C4FD439EEDD6	SHA256:E1E27AF7B07EEEDF5CE71A9255F0422816A6FC5849A483C6714E1B472044FA9D

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
7088	SearchApp.exe	GET	200	2.17.190.73:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted
1784	backgroundTaskHost.exe	GET	200	2.17.190.73:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
7852	SIHClient.exe	GET	200	2.16.253.202:80	http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.3.crl	unknown	—	—	whitelisted
7852	SIHClient.exe	GET	200	2.16.253.202:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.3.crl	unknown	—	—	whitelisted
3984	svchost.exe	GET	200	2.17.190.73:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
3984	svchost.exe	GET	200	2.17.190.73:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
7340	backgroundTaskHost.exe	GET	200	2.17.190.73:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
5488	svchost.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
5596	MoUsoCoreWorker.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
1160	RUXIMICS.exe	40.127.240.158:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
7500	convertmate.exe	104.18.5.168:443	banifuri.com	CLOUDFLARENET	—	malicious
7088	SearchApp.exe	2.16.204.139:443	www.bing.com	Akamai International B.V.	DE	whitelisted
7088	SearchApp.exe	2.17.190.73:80	ocsp.digicert.com	AKAMAI-AS	DE	whitelisted
3984	svchost.exe	20.190.159.131:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
3984	svchost.exe	2.17.190.73:80	ocsp.digicert.com	AKAMAI-AS	DE	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	40.127.240.158 51.104.136.2	whitelisted
google.com	142.250.185.78	whitelisted
banifuri.com	104.18.5.168 104.18.4.168	malicious
www.bing.com	2.16.204.139 2.16.204.134 2.16.204.138 2.16.204.146 2.16.204.136 2.16.204.135 2.16.204.137 2.16.204.143 2.16.204.145 2.16.204.147 2.16.204.142 2.16.204.148 2.16.204.141	whitelisted
ocsp.digicert.com	2.17.190.73	whitelisted
login.live.com	20.190.159.131 40.126.31.67 40.126.31.2 20.190.159.130 40.126.31.130 20.190.159.129 20.190.159.0 40.126.31.0	whitelisted
th.bing.com	2.16.204.139 2.16.204.147 2.16.204.145 2.16.204.146 2.16.204.142 2.16.204.143 2.16.204.138 2.16.204.148 2.16.204.141	whitelisted
client.wns.windows.com	172.211.123.250	whitelisted
arc.msn.com	20.223.35.26	whitelisted
slscr.update.microsoft.com	74.178.240.61	whitelisted

Threats

PID	Process	Class	Message
—	—	A Network Trojan was detected	ET MALWARE Trojan-Dropper.MSIL CnC Traffic - POST

Add for printing

No debug info

General Info

convertmate.exe

2DF67805A1EF4C69B1DE46E484FDE896

0F0E7F2098FFBE68C40969FBD6DB30A164A3008F

08B9F93000512B45F8C2E8D3D6624536B366E67C40FD4B958DB58E3A1D129C3D

98304:j20km/AdVa2OH7/qC3DkDr9ac1rI/OS2PLF0ZhQ/DKCf5Ow1IoL6MG1QCgjEesvC:DOAFDi5ZrpavDa

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Changes powershell execution policy (RemoteSigned)

SUSPICIOUS

The process executes Powershell scripts

Starts POWERSHELL.EXE for commands execution

Process drops legitimate windows executable

Executable content was dropped or overwritten

Gets path to any of the special folders (POWERSHELL)

Searches for installed software

Reads security settings of Internet Explorer

SQL CE related mutex has been found

Reads the date of Windows installation

INFO

Reads the computer name

Checks supported languages

Disables trace logs

Reads the software policy settings

Checks proxy server information

Reads the machine GUID from the registry

Reads Environment values

Creates files or folders in the user directory

Creates a software uninstall entry

Create files in a temporary directory

Process checks computer location settings

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings