File name:

C:\Users\admin\AppData\Local\Temp\265A.tmp.exe

Full analysis: https://app.any.run/tasks/2c8a91ce-7489-4188-a596-0b6897f0c7c4
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: January 18, 2020, 13:05:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
miner
qwertminer
adware
oxypumper
loader
pup
linkury
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

7C2AB15D2A95F4A15C2C5082CE77D1FB

SHA1:

B3E288EC58F27942256EF3233948C6A5E425C8DA

SHA256:

0C63F8ECF4F8853B8D3A94222C21D3B4A9B888CA9B66FD708948C5E7D000D362

SSDEEP:

3072:rnKg8d1LK2PBq6SDI2U2xGqqoFQ2WXMDRQuAg0FujsY9eSDM5V:rnKgSLjzeIfX+vBhAOotSDM5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • fish.exe (PID: 1712)
      • Good-Hold.exe (PID: 3860)
      • CloudPrinter.exe (PID: 292)
      • EcoZozhome.bin (PID: 320)
      • LogicHandler.exe (PID: 4000)
      • LogicHandler.exe (PID: 2176)
      • ZathIt.exe (PID: 4020)
      • Pangoc.exe (PID: 2580)
      • set.exe (PID: 328)
      • Pangoc.exe (PID: 2668)
      • Pangoc.exe (PID: 2028)
      • Pangoc.exe (PID: 2876)
      • Pangoc.exe (PID: 1856)

    • Connects to CnC server

      • fish.exe (PID: 1712)
      • ZathIt.exe (PID: 4020)
      • Good-Hold.exe (PID: 3860)
      • set.exe (PID: 328)
      • Pangoc.exe (PID: 2580)

    • Downloads executable files from the Internet

      • 265A.tmp.exe (PID: 2280)
      • fish.exe (PID: 1712)

    • QWERTMINER was detected

      • 265A.tmp.exe (PID: 2280)

    • LINKURY was detected

      • fish.exe (PID: 1712)
      • CloudPrinter.exe (PID: 292)
      • ZathIt.exe (PID: 4020)
      • Good-Hold.exe (PID: 3860)
      • Pangoc.exe (PID: 2580)
      • LogicHandler.exe (PID: 4000)
      • set.exe (PID: 328)

    • Changes settings of System certificates

      • fish.exe (PID: 1712)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 3912)
      • cmd.exe (PID: 3964)
      • cmd.exe (PID: 2468)
      • cmd.exe (PID: 4080)
      • cmd.exe (PID: 600)
      • cmd.exe (PID: 1412)
      • cmd.exe (PID: 3124)
      • cmd.exe (PID: 1600)
      • cmd.exe (PID: 3744)
      • cmd.exe (PID: 3796)
      • cmd.exe (PID: 2004)
      • cmd.exe (PID: 1524)
      • cmd.exe (PID: 1416)
      • cmd.exe (PID: 1852)
      • cmd.exe (PID: 3924)
      • cmd.exe (PID: 2532)
      • cmd.exe (PID: 1016)
      • cmd.exe (PID: 1584)
      • cmd.exe (PID: 3488)
      • cmd.exe (PID: 616)
      • cmd.exe (PID: 2976)
      • cmd.exe (PID: 3716)
      • cmd.exe (PID: 3404)
      • cmd.exe (PID: 2056)
      • cmd.exe (PID: 3388)
      • cmd.exe (PID: 904)
      • cmd.exe (PID: 3744)
      • cmd.exe (PID: 2112)
      • cmd.exe (PID: 1928)
      • cmd.exe (PID: 932)
      • cmd.exe (PID: 3984)
      • cmd.exe (PID: 1328)
      • cmd.exe (PID: 408)
      • cmd.exe (PID: 2748)
      • cmd.exe (PID: 492)
      • cmd.exe (PID: 3944)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2096)
      • schtasks.exe (PID: 3936)
      • schtasks.exe (PID: 1316)
      • schtasks.exe (PID: 4036)
      • schtasks.exe (PID: 3892)
      • schtasks.exe (PID: 952)
      • schtasks.exe (PID: 2416)
      • schtasks.exe (PID: 1296)
      • schtasks.exe (PID: 1888)
      • schtasks.exe (PID: 2832)
      • schtasks.exe (PID: 2172)
      • schtasks.exe (PID: 3344)
      • schtasks.exe (PID: 2700)
      • schtasks.exe (PID: 1292)
      • schtasks.exe (PID: 3804)
      • schtasks.exe (PID: 2500)
      • schtasks.exe (PID: 3872)
      • schtasks.exe (PID: 3412)
      • schtasks.exe (PID: 3952)
      • schtasks.exe (PID: 3452)
      • schtasks.exe (PID: 1904)
      • schtasks.exe (PID: 2528)
      • schtasks.exe (PID: 2200)
      • schtasks.exe (PID: 1704)
      • schtasks.exe (PID: 3308)
      • schtasks.exe (PID: 1292)
      • schtasks.exe (PID: 3696)
      • schtasks.exe (PID: 2120)
      • schtasks.exe (PID: 3948)
      • schtasks.exe (PID: 920)
      • schtasks.exe (PID: 1780)
      • schtasks.exe (PID: 2928)
      • schtasks.exe (PID: 3116)
      • schtasks.exe (PID: 1024)
      • schtasks.exe (PID: 392)
      • schtasks.exe (PID: 2172)

    • Loads dropped or rewritten executable

      • Pangoc.exe (PID: 2580)
      • conhost.exe (PID: 2076)
      • schtasks.exe (PID: 3892)
      • cmd.exe (PID: 1412)
      • schtasks.exe (PID: 952)
      • conhost.exe (PID: 1800)
      • conhost.exe (PID: 2812)
      • cmd.exe (PID: 1600)
      • regedit.exe (PID: 3948)
      • schtasks.exe (PID: 2416)
      • cmd.exe (PID: 3124)
      • schtasks.exe (PID: 1296)
      • conhost.exe (PID: 3964)
      • cmd.exe (PID: 3744)
      • schtasks.exe (PID: 1888)
      • set.exe (PID: 328)
      • cmd.exe (PID: 3796)
      • conhost.exe (PID: 3944)
      • schtasks.exe (PID: 2172)
      • schtasks.exe (PID: 2832)
      • Pangoc.exe (PID: 2668)
      • taskeng.exe (PID: 2996)
      • conhost.exe (PID: 408)
      • conhost.exe (PID: 2136)
      • cmd.exe (PID: 2004)
      • cmd.exe (PID: 1524)
      • conhost.exe (PID: 2660)
      • schtasks.exe (PID: 3344)
      • cmd.exe (PID: 1416)
      • schtasks.exe (PID: 2700)
      • Pangoc.exe (PID: 2028)
      • conhost.exe (PID: 1704)
      • schtasks.exe (PID: 1292)
      • cmd.exe (PID: 1852)
      • schtasks.exe (PID: 3804)
      • cmd.exe (PID: 3924)
      • cmd.exe (PID: 2532)
      • conhost.exe (PID: 1792)
      • schtasks.exe (PID: 2500)
      • conhost.exe (PID: 2952)
      • cmd.exe (PID: 1584)
      • conhost.exe (PID: 3756)
      • conhost.exe (PID: 2204)
      • cmd.exe (PID: 1016)
      • regedit.exe (PID: 1328)
      • schtasks.exe (PID: 3872)
      • conhost.exe (PID: 896)
      • cmd.exe (PID: 3488)
      • schtasks.exe (PID: 3412)
      • schtasks.exe (PID: 3952)
      • cmd.exe (PID: 2976)
      • DllHost.exe (PID: 3176)
      • schtasks.exe (PID: 3452)
      • conhost.exe (PID: 3680)
      • conhost.exe (PID: 1416)
      • cmd.exe (PID: 616)
      • schtasks.exe (PID: 2528)
      • schtasks.exe (PID: 1904)
      • conhost.exe (PID: 1524)
      • cmd.exe (PID: 3716)
      • werfault.exe (PID: 2776)
      • werfault.exe (PID: 3356)
      • conhost.exe (PID: 2512)
      • conhost.exe (PID: 1888)
      • cmd.exe (PID: 2056)
      • schtasks.exe (PID: 392)
      • cmd.exe (PID: 3404)
      • conhost.exe (PID: 2552)
      • cmd.exe (PID: 3388)
      • regedit.exe (PID: 3452)
      • schtasks.exe (PID: 1704)
      • schtasks.exe (PID: 2200)
      • conhost.exe (PID: 3196)
      • cmd.exe (PID: 904)
      • schtasks.exe (PID: 2172)
      • conhost.exe (PID: 2708)
      • cmd.exe (PID: 3744)
      • cmd.exe (PID: 2112)
      • conhost.exe (PID: 1788)
      • regedit.exe (PID: 3264)
      • schtasks.exe (PID: 3308)
      • schtasks.exe (PID: 1292)
      • conhost.exe (PID: 3368)
      • cmd.exe (PID: 1928)
      • schtasks.exe (PID: 3696)
      • conhost.exe (PID: 3796)
      • cmd.exe (PID: 932)
      • schtasks.exe (PID: 2120)
      • Pangoc.exe (PID: 2876)
      • schtasks.exe (PID: 3948)
      • cmd.exe (PID: 3984)
      • conhost.exe (PID: 2420)
      • cmd.exe (PID: 1328)
      • conhost.exe (PID: 944)
      • schtasks.exe (PID: 920)
      • conhost.exe (PID: 2184)
      • schtasks.exe (PID: 1780)
      • cmd.exe (PID: 408)
      • Pangoc.exe (PID: 1856)
      • conhost.exe (PID: 2660)
      • cmd.exe (PID: 2748)
      • schtasks.exe (PID: 2928)
      • conhost.exe (PID: 520)
      • schtasks.exe (PID: 3116)
      • werfault.exe (PID: 2604)
      • conhost.exe (PID: 3900)
      • cmd.exe (PID: 492)
      • schtasks.exe (PID: 1024)
      • werfault.exe (PID: 3356)
      • cmd.exe (PID: 3944)

    • Changes the autorun value in the registry

      • regedit.exe (PID: 1160)
      • regedit.exe (PID: 3948)
      • regedit.exe (PID: 1328)
      • regedit.exe (PID: 3452)
      • regedit.exe (PID: 3264)

    • Changes AppInit_DLLs value (autorun option)

      • regedit.exe (PID: 1160)
      • regedit.exe (PID: 3948)
      • regedit.exe (PID: 1328)
      • regedit.exe (PID: 3452)
      • regedit.exe (PID: 3264)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 265A.tmp.exe (PID: 2280)
      • ZathIt.exe (PID: 4020)
      • Good-Hold.exe (PID: 3860)
      • fish.exe (PID: 1712)
      • EcoZozhome.bin (PID: 320)
      • LogicHandler.exe (PID: 2176)
      • Pangoc.exe (PID: 2580)

    • Creates files in the program directory

      • ZathIt.exe (PID: 4020)
      • Good-Hold.exe (PID: 3860)
      • LogicHandler.exe (PID: 4000)
      • LogicHandler.exe (PID: 2176)
      • fish.exe (PID: 1712)
      • Pangoc.exe (PID: 2580)

    • Starts itself from another location

      • fish.exe (PID: 1712)

    • Starts SC.EXE for service management

      • ZathIt.exe (PID: 4020)
      • Good-Hold.exe (PID: 3860)
      • cmd.exe (PID: 2432)
      • LogicHandler.exe (PID: 2176)

    • Creates files in the Windows directory

      • CloudPrinter.exe (PID: 292)
      • Pangoc.exe (PID: 2580)
      • set.exe (PID: 328)

    • Starts application with an unusual extension

      • fish.exe (PID: 1712)

    • Executed as Windows Service

      • Pangoc.exe (PID: 2580)
      • CloudPrinter.exe (PID: 292)
      • set.exe (PID: 328)

    • Application launched itself

      • LogicHandler.exe (PID: 4000)

    • Starts CMD.EXE for commands execution

      • LogicHandler.exe (PID: 2176)
      • Pangoc.exe (PID: 2580)
      • Pangoc.exe (PID: 2668)
      • Pangoc.exe (PID: 2028)
      • Pangoc.exe (PID: 2876)
      • Pangoc.exe (PID: 1856)

    • Adds / modifies Windows certificates

      • fish.exe (PID: 1712)

    • Creates a software uninstall entry

      • fish.exe (PID: 1712)

    • Removes files from Windows directory

      • set.exe (PID: 328)
      • Pangoc.exe (PID: 2580)

    • Executed via Task Scheduler

      • cmd.exe (PID: 600)
      • cmd.exe (PID: 1600)
      • Pangoc.exe (PID: 2668)
      • cmd.exe (PID: 1584)
      • cmd.exe (PID: 2056)
      • cmd.exe (PID: 2112)

    • Changes the started page of IE

      • Pangoc.exe (PID: 2580)

    • Creates files in the user directory

      • Pangoc.exe (PID: 2580)

    • Searches for installed software

      • Pangoc.exe (PID: 2580)

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:11:21 10:09:53+01:00
PEType: PE32
LinkerVersion: 14.16
CodeSize: 81408
InitializedDataSize: 74240
UninitializedDataSize: -
EntryPoint: 0x7ca2
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 21-Nov-2019 09:09:53
Detected languages:
  • English - United States
Debug artifacts:
  • C:\Work\ajhjfdgkjhdf\Release\safefinder.pdb

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000110

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 21-Nov-2019 09:09:53
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00013DC9
0x00013E00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.64202
.rdata
0x00015000
0x0000DEDE
0x0000E000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.3533
.data
0x00023000
0x00001AC8
0x00000C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
2.94776
.rsrc
0x00025000
0x00000938
0x00000A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
3.69123
.reloc
0x00026000
0x00001A5C
0x00001C00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.40428

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.89623
392
UNKNOWN
English - United States
RT_MANIFEST
101
3.43406
1682
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
GDI32.dll
KERNEL32.dll
RPCRT4.dll
SHELL32.dll
USER32.dll
WININET.dll
urlmon.dll
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
182
Monitored processes
134
Malicious processes
95
Suspicious processes
20

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start drop and start #QWERTMINER 265a.tmp.exe #LINKURY fish.exe #LINKURY zathit.exe sc.exe no specs #LINKURY cloudprinter.exe #LINKURY good-hold.exe sc.exe no specs #LINKURY pangoc.exe ecozozhome.bin #LINKURY logichandler.exe logichandler.exe cmd.exe no specs sc.exe no specs sc.exe no specs #LINKURY set.exe cmd.exe no specs schtasks.exe no specs cmd.exe no specs schtasks.exe no specs cmd.exe no specs schtasks.exe no specs cmd.exe no specs regedit.exe cmd.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs regedit.exe schtasks.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs taskeng.exe no specs conhost.exe no specs schtasks.exe no specs pangoc.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs pangoc.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs regedit.exe schtasks.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs Thumbnail Cache Out of Proc Server no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs werfault.exe no specs werfault.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs regedit.exe schtasks.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs regedit.exe schtasks.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs pangoc.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs pangoc.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs werfault.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs werfault.exe no specs 265a.tmp.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
292C:\ProgramData\\CloudPrinter\\CloudPrinter.exe shuz -f "C:\ProgramData\\CloudPrinter\\CloudPrinter.dat" -l -aC:\ProgramData\CloudPrinter\CloudPrinter.exe
services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\programdata\cloudprinter\cloudprinter.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
320"C:\Users\admin\AppData\Local\EcoZozhome.bin" DeviceId=a6985883-ace4-b706-fafa-0ee4efb037e4 Distributer=APSFPango ChannelId=3 BarcodeId=54565003 Ids=inafjghmmkmiobijhbgkfekenbfbklhb ExtensionEntityName=bazzsearch ForceInstall=true OpenTP=falseC:\Users\admin\AppData\Local\EcoZozhome.bin
fish.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1000
Modules
Images
c:\users\admin\appdata\local\ecozozhome.bin
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\sfc_os.dll
328"C:\ProgramData\Logic Cramble\set.exe"C:\ProgramData\Logic Cramble\set.exe
services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Description:
ExtManager
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\programdata\logic cramble\set.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
392"C:\Users\admin\AppData\Local\Temp\265A.tmp.exe" C:\Users\admin\AppData\Local\Temp\265A.tmp.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\systemroot\system32\ntdll.dll
392SCHTASKS /Query /TN "psv_Stocktam"C:\Windows\system32\schtasks.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\users\admin\appdata\local\temp\265a.tmp.exe
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
408\??\C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe—csrss.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\conhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
408"C:\Windows\System32\cmd.exe" /c SCHTASKS /Create /TN "snf" /XML "C:\Windows\TEMP\tmp6A02.tmp"C:\Windows\System32\cmd.exe—Pangoc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\programdata\pangoc\ranking.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msctf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\conhost.exe
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
492"C:\Windows\System32\cmd.exe" /c SCHTASKS /Delete /TN "snf" /FC:\Windows\System32\cmd.exe—Pangoc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
520\??\C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe—csrss.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\conhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
592"C:\Windows\system32\sc.exe" create CloudPrinter binpath= "C:\ProgramData\\CloudPrinter\\CloudPrinter.exe shuz -f \"C:\ProgramData\\CloudPrinter\\CloudPrinter.dat\" -l -a" DisplayName= CloudPrinter start= autoC:\Windows\system32\sc.exe—ZathIt.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
1 609
Read events
1 351
Write events
257
Delete events
1

Modification events

(PID) Process:(2280) 265A.tmp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\265A_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2280) 265A.tmp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\265A_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2280) 265A.tmp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\265A_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(2280) 265A.tmp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\265A_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(2280) 265A.tmp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\265A_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2280) 265A.tmp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\265A_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2280) 265A.tmp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\265A_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2280) 265A.tmp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\265A_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2280) 265A.tmp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\265A_RASMANCS
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(2280) 265A.tmp.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\265A_RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
4294901760
Executable files
20
Suspicious files
21
Text files
57
Unknown types
28

Dropped files

PID
Process
Filename
Type
1712fish.exeC:\Users\admin\AppData\Local\agent.dat —
MD5:—
SHA256:—
4020ZathIt.exeC:\ProgramData\CloudPrinter\CloudPrinter.exeexecutable
MD5:—
SHA256:—
1712fish.exeC:\Users\admin\AppData\Local\InstallationConfiguration.xmltext
MD5:—
SHA256:—
3860Good-Hold.exeC:\ProgramData\Pangoc\Pangoc.d.dat —
MD5:—
SHA256:—
2280265A.tmp.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LH043OAM\dynlink_1579267140397[1].exeexecutable
MD5:—
SHA256:—
1712fish.exeC:\Users\admin\AppData\Local\Good-Hold.tstpgc
MD5:—
SHA256:—
1712fish.exeC:\Users\admin\AppData\Local\md.xmltext
MD5:—
SHA256:—
1712fish.exeC:\Users\admin\AppData\Local\noah.datbinary
MD5:—
SHA256:—
1712fish.exeC:\Users\admin\AppData\Local\ZathIt.tstbinary
MD5:—
SHA256:—
1712fish.exeC:\Users\admin\AppData\Local\installer.datbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
127
TCP/UDP connections
51
DNS requests
36
Threats
289

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1712
fish.exe
POST
200
52.166.114.5:80
http://stats.utyuytjn.com/StatisticsService.svc/V1/JSON/Lee
NL
text
10 b
whitelisted
1712
fish.exe
GET
200
205.185.208.154:80
http://m4y2d5k4.ssl.hwcdn.net/installer/installers-config/safefinder-ap/apsfpango/ic090120.xml
US
text
15.8 Kb
malicious
1712
fish.exe
POST
200
52.166.114.5:80
http://stats.utyuytjn.com/StatisticsService.svc/V1/JSON/Lee
NL
text
10 b
whitelisted
1712
fish.exe
POST
200
52.166.114.5:80
http://stats.utyuytjn.com/StatisticsService.svc/V1/JSON/Lee
NL
text
10 b
whitelisted
1712
fish.exe
POST
200
52.166.114.5:80
http://stats.utyuytjn.com/StatisticsService.svc/V1/JSON/Lee
NL
text
10 b
whitelisted
1712
fish.exe
POST
200
52.166.114.5:80
http://stats.utyuytjn.com/StatisticsService.svc/V1/JSON/Lee
NL
text
10 b
whitelisted
1712
fish.exe
GET
200
52.174.148.190:80
http://updates.utyuytjn.com/Update/CheckInstallConfig?deviceid=a6985883-ace4-b706-fafa-0ee4efb037e4&distributer=APSFPango&channelid=3&barcodeid=54565003&country=GB&encrypt=True
NL
text
263 b
whitelisted
1712
fish.exe
GET
200
52.166.114.5:80
http://svc-stats.linkury.com/StateStatisticsService.svc/V1/JSON/GetDistributorIdFromNameHttpGet?distributorName=APSFPango
NL
text
13 b
shared
1712
fish.exe
POST
200
52.166.114.5:80
http://stats.utyuytjn.com/StatisticsService.svc/V1/JSON/Lee
NL
text
10 b
whitelisted
1712
fish.exe
POST
200
52.166.114.5:80
http://stats.utyuytjn.com/StatisticsService.svc/V1/JSON/Lee
NL
text
10 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2280
265A.tmp.exe
205.185.208.154:80
h8y9u9b2.ssl.hwcdn.net
Highwinds Network Group, Inc.
US
malicious
1712
fish.exe
65.52.153.196:80
madmax.utyuytjn.com
Microsoft Corporation
NL
whitelisted
2280
265A.tmp.exe
216.58.207.36:80
google-analytics.com
Google Inc.
US
whitelisted
1712
fish.exe
52.174.148.190:80
install.portmdfmoon.com
Microsoft Corporation
NL
whitelisted
1712
fish.exe
52.166.114.5:80
svc-stats.linkury.com
Microsoft Corporation
NL
whitelisted
1712
fish.exe
205.185.208.154:80
h8y9u9b2.ssl.hwcdn.net
Highwinds Network Group, Inc.
US
malicious
292
CloudPrinter.exe
52.166.114.5:80
svc-stats.linkury.com
Microsoft Corporation
NL
whitelisted
1712
fish.exe
104.41.146.197:80
api.eazymount.com
Microsoft Corporation
US
whitelisted
4020
ZathIt.exe
65.52.153.196:80
madmax.utyuytjn.com
Microsoft Corporation
NL
whitelisted
292
CloudPrinter.exe
65.52.153.196:80
madmax.utyuytjn.com
Microsoft Corporation
NL
whitelisted

DNS requests

Domain
IP
Reputation
google-analytics.com
  • 216.58.207.36
whitelisted
install.portmdfmoon.com
  • 52.174.148.190
unknown
h8y9u9b2.ssl.hwcdn.net
  • 205.185.208.154
malicious
svc-stats.linkury.com
  • 52.166.114.5
shared
madmax.utyuytjn.com
  • 65.52.153.196
unknown
updates.utyuytjn.com
  • 52.174.148.190
unknown
stats.utyuytjn.com
  • 52.166.114.5
unknown
m4y2d5k4.ssl.hwcdn.net
  • 205.185.208.154
malicious
api.eazymount.com
  • 104.41.146.197
unknown
cloud-search.linkury.com
  • 65.52.153.196
whitelisted

Threats

PID
Process
Class
Message
2280
265A.tmp.exe
A Network Trojan was detected
MALWARE [PTsecurity] Win32/QwertMiner CoinMiner UA
2280
265A.tmp.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2280
265A.tmp.exe
Misc activity
ET INFO EXE - Served Attached HTTP
2280
265A.tmp.exe
Misc activity
SUSPICIOUS [PTsecurity] Cmd.Powershell.Download HTTP UserAgent (Win7)
1712
fish.exe
Misc activity
ADWARE [PTsecurity] PUP.Optional.LogicHandler
1712
fish.exe
Misc activity
ADWARE [PTsecurity] Linkury
1712
fish.exe
Misc activity
ADWARE [PTsecurity] Linkury
1712
fish.exe
Misc activity
ADWARE [PTsecurity] Linkury
1712
fish.exe
Misc activity
ADWARE [PTsecurity] Linkury
1712
fish.exe
Misc activity
ADWARE [PTsecurity] Linkury
193 ETPRO signatures available at the full report
Process
Message
265A.tmp.exe
[18/01/2020 13:05:51:0409] Downloaded
265A.tmp.exe
[18/01/2020 13:05:51:0409] {"packer":{"DistributerName":"APSFPango","ChannelId":"3"},"Agent":{"SetAll":"true"}}
ZathIt.exe
DeviceId=a6985883-ace4-b706-fafa-0ee4efb037e4 Distributer=APSFPango ChannelId=3 BarcodeId=54565003 ApName=Pangoc
Good-Hold.exe
DeviceId=a6985883-ace4-b706-fafa-0ee4efb037e4 Distributer=APSFPango ChannelId=3 BarcodeId=54565003 DefaultSearchDomain=https://feed.sonic-search.com HomePageDomain=https://feed.helperbar.com NewTabDomain=https://feed.helperbar.com EncryptUrl=true AddRemove=false AgentName=Pangoc YBSearch=false ApName=Pangoc SetAll=true
Pangoc.exe
Agent Main
Pangoc.exe
Agent Started
Pangoc.exe
Current directory: C:\ProgramData\Pangoc
Pangoc.exe
Agent service started with arg: DeviceId=a6985883-ace4-b706-fafa-0ee4efb037e4 Distributer=APSFPango ChannelId=3 BarcodeId=54565003 DefaultSearchDomain=https://feed.sonic-search.com HomePageDomain=https://feed.helperbar.com NewTabDomain=https://feed.helperbar.com EncryptUrl=true AddRemove=false AgentName=Pangoc YBSearch=false ApName=Pangoc SetAll=true
Pangoc.exe
Create file context remotely : Path = C:\ProgramData\Pangoc\Pangoc.d.dat, Version = 3.0.0.27
Pangoc.exe
*****************************************************************
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
C:\Users\admin\AppData\Local\Temp\265A.tmp.exe