File name:

0db3f06e287e53fc06f6392cd441b79c57a936860ed2cec462d9f12f186b59ce

Full analysis: https://app.any.run/tasks/925a37d0-9877-4502-972a-721f63960d04
Verdict: Malicious activity
Analysis date: September 19, 2024, 17:23:38
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

4BC03C18A07B850C92D833E765F119B6

SHA1:

68A71FBB13BFEA5F9C122B5BEAE439B5D2523910

SHA256:

0DB3F06E287E53FC06F6392CD441B79C57A936860ED2CEC462D9F12F186B59CE

SSDEEP:

49152:3aMZRxdhL5+RbNOLK3nkUrNktPwTqbJSplx5J25DcWrjshg666j77yHsbinHUP+k:d3LQRbkLMkUrNk3JSpJY1cWrYhgcj7uW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Known privilege escalation attack

      • dllhost.exe (PID: 3376)

    • Connects to the CnC server

      • svchost.exe (PID: 2936)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 0db3f06e287e53fc06f6392cd441b79c57a936860ed2cec462d9f12f186b59ce.exe (PID: 6376)
      • rundll32.exe (PID: 6628)

    • Reads security settings of Internet Explorer

      • 0db3f06e287e53fc06f6392cd441b79c57a936860ed2cec462d9f12f186b59ce.exe (PID: 6376)
      • wuauclt.exe (PID: 2224)
      • wuauclt.exe (PID: 6108)

    • Uses RUNDLL32.EXE to load library

      • rundll32.exe (PID: 6688)
      • dllhost.exe (PID: 3376)

    • Executing commands from a ".bat" file

      • 0db3f06e287e53fc06f6392cd441b79c57a936860ed2cec462d9f12f186b59ce.exe (PID: 6376)

    • Starts CMD.EXE for commands execution

      • 0db3f06e287e53fc06f6392cd441b79c57a936860ed2cec462d9f12f186b59ce.exe (PID: 6376)

    • Executes as Windows Service

      • wuauclt.exe (PID: 6108)
      • wuauclt.exe (PID: 4168)

    • Application launched itself

      • wuauclt.exe (PID: 6108)
      • wuauclt.exe (PID: 4168)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 492)
      • cmd.exe (PID: 1776)

    • Contacting a server suspected of hosting an CnC

      • svchost.exe (PID: 2936)

    • There is functionality for taking screenshot (YARA)

      • svchost.exe (PID: 2936)
      • svchost.exe (PID: 2340)

  • INFO

    • Checks supported languages

      • 0db3f06e287e53fc06f6392cd441b79c57a936860ed2cec462d9f12f186b59ce.exe (PID: 6376)
      • wuauclt.exe (PID: 2224)
      • wuauclt.exe (PID: 6108)

    • Reads the computer name

      • 0db3f06e287e53fc06f6392cd441b79c57a936860ed2cec462d9f12f186b59ce.exe (PID: 6376)
      • wuauclt.exe (PID: 6108)
      • wuauclt.exe (PID: 2224)

    • Creates files in the program directory

      • 0db3f06e287e53fc06f6392cd441b79c57a936860ed2cec462d9f12f186b59ce.exe (PID: 6376)

    • Checks transactions between databases Windows and Oracle

      • rundll32.exe (PID: 6628)

    • Sends debugging messages

      • rundll32.exe (PID: 6628)

    • Create files in a temporary directory

      • 0db3f06e287e53fc06f6392cd441b79c57a936860ed2cec462d9f12f186b59ce.exe (PID: 6376)
      • rundll32.exe (PID: 6628)

    • The process uses the downloaded file

      • dllhost.exe (PID: 3376)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 3376)

    • Checks proxy server information

      • 0db3f06e287e53fc06f6392cd441b79c57a936860ed2cec462d9f12f186b59ce.exe (PID: 6376)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:03:15 04:13:06+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 40960
InitializedDataSize: 94208
UninitializedDataSize: -
EntryPoint: 0x52bc
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.1
ProductVersionNumber: 1.0.0.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: kilav Module
FileVersion: 1, 0, 0, 1
InternalName: kilav
LegalCopyright: Copyright 2018
LegalTrademarks: -
OLESelfRegister: -
OriginalFileName: kilav.EXE
PrivateBuild: -
ProductName: kilav Module
ProductVersion: 1, 0, 0, 1
SpecialBuild: -
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
314
Monitored processes
194
Malicious processes
5
Suspicious processes
3

Behavior graph

Click at the process to see the details
start 0db3f06e287e53fc06f6392cd441b79c57a936860ed2cec462d9f12f186b59ce.exe rundll32.exe no specs rundll32.exe CMSTPLUA cmd.exe no specs conhost.exe no specs wuauclt.exe no specs rundll32.exe no specs wuauclt.exe ping.exe no specs wuauclt.exe THREAT svchost.exe wuauclt.exe wuauclt.exe cmd.exe no specs conhost.exe no specs THREAT svchost.exe ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs taskkill.exe no specs ping.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
376Taskkill /F /pid 6376C:\Windows\SysWOW64\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
448ping 127.0.0.1C:\Windows\SysWOW64\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
492C:\WINDOWS\system32\cmd.exe /c "C:\Users\admin\AppData\Local\Temp\del.bat"C:\Windows\SysWOW64\cmd.exe—0db3f06e287e53fc06f6392cd441b79c57a936860ed2cec462d9f12f186b59ce.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
736ping 127.0.0.1C:\Windows\SysWOW64\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
752Taskkill /F /pid 6376C:\Windows\SysWOW64\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
884ping 127.0.0.1C:\Windows\SysWOW64\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
892ping 127.0.0.1C:\Windows\SysWOW64\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
940ping 127.0.0.1C:\Windows\SysWOW64\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
940ping 127.0.0.1C:\Windows\SysWOW64\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
964Taskkill /F /pid 6376C:\Windows\SysWOW64\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
24 243
Read events
24 241
Write events
2
Delete events
0

Modification events

(PID) Process:(3376) dllhost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(2936) svchost.exeKey:HKEY_LOCAL_MACHINE
Operation:writeName:CGroup
Value:
默认分组
Executable files
5
Suspicious files
3
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
63760db3f06e287e53fc06f6392cd441b79c57a936860ed2cec462d9f12f186b59ce.exeC:\ProgramData\IMEJP10\t1.datbinary
MD5:5050449C18EAB0B98A70ACCEB8C3CD0C
SHA256:8BF1D06C55B15268C897916E709FE730BC1709292AE8F382A0EE35A85BB481B2
63760db3f06e287e53fc06f6392cd441b79c57a936860ed2cec462d9f12f186b59ce.exeC:\ProgramData\IMEJP10\wuauclt.exeexecutable
MD5:0070A38553997DE066B2ABA8C0574D6F
SHA256:ABA3A87F4782ECA104B64355EDC26B54FF833474AFF4AC688F828CE4A5A4E27B
6628rundll32.exeC:\Users\admin\AppData\Local\Temp\instsrv.datexecutable
MD5:C226F84084C3B941B0735F261610CB79
SHA256:AE07053F16AC2CA8FCAE8B4C778BB644742F9B626949FB0AE1FD4B517F14AD7F
63760db3f06e287e53fc06f6392cd441b79c57a936860ed2cec462d9f12f186b59ce.exeC:\ProgramData\IMEJP10\DDVCtrlLib.dllexecutable
MD5:E7268A90D413C587E4583D5D9D25DF22
SHA256:5847035FD152F6D1AFEDC068F8F0857FE0AFD2394E65A4948B0F6A95D759B040
63760db3f06e287e53fc06f6392cd441b79c57a936860ed2cec462d9f12f186b59ce.exeC:\ProgramData\IMEJP10\DDVEC.dllexecutable
MD5:CD79B5FFCA8128339877390AA8F0A66D
SHA256:B2BF19461035158E0435769615A639157E35ACE1C96BFDDD24FDCF2611FB23AB
63760db3f06e287e53fc06f6392cd441b79c57a936860ed2cec462d9f12f186b59ce.exeC:\ProgramData\IMEJP10\Mshype.dllexecutable
MD5:F24B2619367536804B70729CBE96BCFB
SHA256:D54541FB102E8E299FDCE951EA5E96750908D2F9346754E3B5139D3134FC293D
63760db3f06e287e53fc06f6392cd441b79c57a936860ed2cec462d9f12f186b59ce.exeC:\ProgramData\IMEJP10\Config.datbinary
MD5:95B7242BD11FCC818B3921E1B809B290
SHA256:252DCA045082748E11FE999114FEB0E820280AA4374727F282BDDB5D7EA7DE5B
63760db3f06e287e53fc06f6392cd441b79c57a936860ed2cec462d9f12f186b59ce.exeC:\Users\admin\AppData\Local\Temp\del.battext
MD5:EA23C42A937C25541B8A726909861AD2
SHA256:14475596C95D21C806B3A9E08567276771070AD7C48D5202AC71D73010569EEB
63760db3f06e287e53fc06f6392cd441b79c57a936860ed2cec462d9f12f186b59ce.exeC:\ProgramData\IMEJP10\Mshype.inibinary
MD5:F8376C7FF1528F13E7058CB868CB1821
SHA256:C108F9F99B75C3E9B33E362132FF3B4A0A26C909BD20A843AD14A8B4FBD346A1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
23
DNS requests
6
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2120
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6924
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2864
RUXIMICS.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6924
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2120
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2864
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2120
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6924
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2864
RUXIMICS.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2936
svchost.exe
202.61.87.187:443
—
ABCDE GROUP COMPANY LIMITED
HK
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
whitelisted
google.com
  • 172.217.23.110
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
www.notekavasd.com
  • —
unknown

Threats

Found threats are available for the paid subscriptions
2 ETPRO signatures available at the full report
Process
Message
rundll32.exe
C:\Users\admin\AppData\Local\Temp\instsrv.dat,da 123
wuauclt.exe
100
wuauclt.exe
CreateDownSrvProcess
wuauclt.exe
CreateSystemProcess200
wuauclt.exe
RaisePrivleges
wuauclt.exe
GetProcessId
wuauclt.exe
OpenProcess
wuauclt.exe
OpenProcessToken
wuauclt.exe
BuildExplicitAccessWithName
wuauclt.exe
GetKernelObjectSecurity
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
0db3f06e287e53fc06f6392cd441b79c57a936860ed2cec462d9f12f186b59ce