File name:

UpdateV5.1.3.2.exe

Full analysis: https://app.any.run/tasks/1432d465-13aa-482f-a75e-40cba900ee48
Verdict: Malicious activity
Analysis date: August 29, 2024, 08:15:47
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
upx
autoit
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

6B11AD6583ABE8C06731FE3AF9ADFB01

SHA1:

20DEA14182379AC9423CB98FBD74AA5160BA6E04

SHA256:

14ABCD403432FE32755325D3F0DBB3D671479A043EFBB6792A63E30539774533

SSDEEP:

98304:BzutsBUnPAwOU+IlzV17EcPYaFPXICUuwVHoA/hhOeYVQ6+IlzV17EcPQgcwdeMX:PSA5C3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts NET.EXE for service management

      • cmd.exe (PID: 6368)
      • net.exe (PID: 936)
      • cmd.exe (PID: 7012)
      • net.exe (PID: 2264)
      • net.exe (PID: 5172)
      • cmd.exe (PID: 3980)
      • cmd.exe (PID: 4068)
      • net.exe (PID: 6296)
      • cmd.exe (PID: 5300)
      • net.exe (PID: 6584)
      • cmd.exe (PID: 2208)
      • net.exe (PID: 5104)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 5524)

    • Changes the login/logoff helper path in the registry

      • Service.exe (PID: 4064)

    • Starts CMD.EXE for self-deleting

      • UpdateV5.1.3.2.exe (PID: 1292)
      • UpdateV5.1.3.2.exe (PID: 3964)

    • Scans artifacts that could help determine the target

      • Service.exe (PID: 4064)

  • SUSPICIOUS

    • The process executes via Task Scheduler

      • UpdateV5.1.3.2.exe (PID: 1292)

    • Drops the executable file immediately after the start

      • UpdateV5.1.3.2.exe (PID: 3964)
      • UpdateV5.1.3.2.exe (PID: 1292)

    • Starts CMD.EXE for commands execution

      • UpdateV5.1.3.2.exe (PID: 3964)
      • UpdateV5.1.3.2.exe (PID: 1292)
      • Service.exe (PID: 4064)

    • Executable content was dropped or overwritten

      • UpdateV5.1.3.2.exe (PID: 1292)

    • Process drops legitimate windows executable

      • UpdateV5.1.3.2.exe (PID: 1292)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • cmd.exe (PID: 6836)
      • cmd.exe (PID: 6852)
      • cmd.exe (PID: 6428)
      • cmd.exe (PID: 2180)
      • cmd.exe (PID: 5504)
      • cmd.exe (PID: 4100)
      • cmd.exe (PID: 304)

    • Executes as Windows Service

      • Service.exe (PID: 4064)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 6984)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 740)
      • cmd.exe (PID: 4364)

    • Potential Corporate Privacy Violation

      • Service.exe (PID: 4064)

    • Reads security settings of Internet Explorer

      • Service.exe (PID: 4064)

  • INFO

    • Reads the computer name

      • UpdateV5.1.3.2.exe (PID: 3964)
      • UpdateV5.1.3.2.exe (PID: 1292)
      • Service.exe (PID: 6356)
      • Service.exe (PID: 4064)

    • Reads mouse settings

      • UpdateV5.1.3.2.exe (PID: 1292)
      • UpdateV5.1.3.2.exe (PID: 3964)
      • Service.exe (PID: 6356)
      • Service.exe (PID: 4064)

    • Checks supported languages

      • UpdateV5.1.3.2.exe (PID: 3964)
      • UpdateV5.1.3.2.exe (PID: 1292)
      • Service.exe (PID: 6356)
      • Service.exe (PID: 4064)

    • Create files in a temporary directory

      • UpdateV5.1.3.2.exe (PID: 1292)
      • UpdateV5.1.3.2.exe (PID: 3964)
      • Service.exe (PID: 6356)

    • UPX packer has been detected

      • UpdateV5.1.3.2.exe (PID: 3964)

    • Creates files in the program directory

      • Service.exe (PID: 4064)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (39.3)
.exe | Win32 EXE Yoda's Crypter (38.6)
.dll | Win32 Dynamic Link Library (generic) (9.5)
.exe | Win32 Executable (generic) (6.5)
.exe | Generic Win/DOS Executable (2.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2012:01:29 21:32:28+00:00
ImageFileCharacteristics: No relocs, Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 274432
InitializedDataSize: 28672
UninitializedDataSize: 479232
EntryPoint: 0xb7e70
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 5.1.3.2
ProductVersionNumber: 2.9.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
FileVersion: 5.1.3.2
Comments: Easyfast-Update
FileDescription: Easyfast-Update
ProductVersion: 2.9
LegalCopyright: Copyright (C) 2010-2016 tooyk.com All rights reserved.
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
188
Monitored processes
65
Malicious processes
3
Suspicious processes
6

Behavior graph

Click at the process to see the details
start THREAT updatev5.1.3.2.exe cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs schtasks.exe no specs schtasks.exe no specs updatev5.1.3.2.exe cmd.exe no specs conhost.exe no specs net.exe no specs net1.exe no specs cmd.exe no specs conhost.exe no specs net.exe no specs net1.exe no specs cmd.exe no specs conhost.exe no specs net.exe no specs net1.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs service.exe no specs service.exe cmd.exe no specs conhost.exe no specs net.exe no specs net1.exe no specs cmd.exe no specs conhost.exe no specs net.exe no specs net1.exe no specs cmd.exe no specs conhost.exe no specs net.exe no specs net1.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs schtasks.exe no specs ping.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs updatev5.1.3.2.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
304C:\WINDOWS\system32\cmd.exe /c netsh firewall add allowedprogram "C:\WINDOWS\SysWOW64\YKJLFWD\ttvncs.exe" "TTVNC" ENABLEC:\Windows\SysWOW64\cmd.exe—UpdateV5.1.3.2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
740C:\WINDOWS\system32\cmd.exe /c ping 127.0.0.1 -n 3&del /q "C:\Users\admin\Desktop\UpdateV5.1.3.2.exe"C:\Windows\SysWOW64\cmd.exe—UpdateV5.1.3.2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
936net stop xlkfsC:\Windows\SysWOW64\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1292"C:\Users\admin\Desktop\UpdateV5.1.3.2.exe" /TaskC:\Users\admin\Desktop\UpdateV5.1.3.2.exe
svchost.exe
User:
admin
Integrity Level:
HIGH
Description:
Easyfast-Update
Exit code:
0
Version:
5.1.3.2
Modules
Images
c:\users\admin\desktop\updatev5.1.3.2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
1356netsh firewall add allowedprogram "C:\WINDOWS\SysWOW64\YKJLFWD\TeamViewer\TeamViewer_Service.exe" "TeamViewer_Service" ENABLEC:\Windows\SysWOW64\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1372\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2092C:\WINDOWS\system32\net1 stop YServiceC:\Windows\SysWOW64\net1.exe—net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
2180C:\WINDOWS\system32\cmd.exe /c netsh firewall add allowedprogram "C:\WINDOWS\SysWOW64\rserver30\rserver3.exe" "rserver3" ENABLEC:\Windows\SysWOW64\cmd.exe—UpdateV5.1.3.2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
2208C:\WINDOWS\system32\cmd.exe /c net start xlkfsC:\Windows\SysWOW64\cmd.exe—UpdateV5.1.3.2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
2
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
2264net stop YServiceRunC:\Windows\SysWOW64\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
2
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
12 417
Read events
12 404
Write events
13
Delete events
0

Modification events

(PID) Process:(1292) UpdateV5.1.3.2.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\YKJLFWD
Operation:writeName:Version
Value:
35313332
(PID) Process:(4064) Service.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Operation:writeName:AutoRestartShell
Value:
1
(PID) Process:(4064) Service.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(4064) Service.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(4064) Service.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(4064) Service.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(4064) Service.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(4064) Service.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(4064) Service.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
8
Suspicious files
9
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
3964UpdateV5.1.3.2.exeC:\Users\admin\AppData\Local\Temp\uufomlptext
MD5:1AED5E75D0CEC8D0909270EB3E08279B
SHA256:5B8B84E2083CE22AAF0F4D21877F9C1752EAF3B49636417112EA22F9F5C620FD
1292UpdateV5.1.3.2.exeC:\Users\admin\AppData\Local\Temp\htagvdftext
MD5:1AED5E75D0CEC8D0909270EB3E08279B
SHA256:5B8B84E2083CE22AAF0F4D21877F9C1752EAF3B49636417112EA22F9F5C620FD
1292UpdateV5.1.3.2.exeC:\Users\admin\AppData\Local\Temp\autB752.tmpbinary
MD5:CE917DF84BD981222E4CC026D042D7ED
SHA256:AF0E0D25A2DFEE954FFF2EDCF788F1245D60DD6AFC03914E00FBD157D87E2074
3964UpdateV5.1.3.2.exeC:\Users\admin\AppData\Local\Temp\autA986.tmpbinary
MD5:CE917DF84BD981222E4CC026D042D7ED
SHA256:AF0E0D25A2DFEE954FFF2EDCF788F1245D60DD6AFC03914E00FBD157D87E2074
1292UpdateV5.1.3.2.exeC:\Windows\SysWOW64\YKJLFWD\vncserver.exeexecutable
MD5:47EC8910B6CF6EE7E3D824330A2DC66A
SHA256:B7836B67523990257E892D8B0750ED868D8CBBF1FEF049AD04E6149B00025E60
1292UpdateV5.1.3.2.exeC:\Users\admin\AppData\Local\Temp\autBB2D.tmpbinary
MD5:E773DD511BA1106417834FFB5DD8BDDE
SHA256:FBAB1D98D22C50582ABA31B088A15778C7D2465C969B4D78653BAAE8B44ADFFF
1292UpdateV5.1.3.2.exeC:\Users\admin\AppData\Local\Temp\autBACD.tmpexecutable
MD5:D41C77E67C3CF44CA166461E6C31082E
SHA256:9F0F8025AB80AF28EE877D030A51B7EC527F4865F7BE876941E23F5ECAD3A7E9
1292UpdateV5.1.3.2.exeC:\Users\admin\AppData\Local\Temp\autBB8D.tmpbinary
MD5:34611E4D203CE060920E27024C5FC473
SHA256:C9D5E67374BFA5E4F16F86C7AEB98E9F34DC30C00FBD8385ACD2E9525F748573
1292UpdateV5.1.3.2.exeC:\Windows\SysWOW64\YKJLFWD\Server.exeexecutable
MD5:20129A039B5E3614F51E0788BD40B9FF
SHA256:A19EBD2490B06906FCFAFE09AF8B65F33B060E642479782F00F03554F46A4656
1292UpdateV5.1.3.2.exeC:\Windows\SysWOW64\YKJLFWD\ttvncs.exeexecutable
MD5:23E50228EB9D79CE249A43717F96F75F
SHA256:AF0F233C62D8DBC22C4EE9FA7E2DC7A729FBA99223D459157DF5DC14D5907939
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
47
TCP/UDP connections
15
DNS requests
6
Threats
47

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4064
Service.exe
GET
404
47.113.180.71:80
http://www.tooyk.com/deskad/deskicon.txt
unknown
—
—
unknown
4064
Service.exe
GET
404
47.113.180.71:80
http://www.tooyk.com/deskad/deskicon.txt
unknown
—
—
unknown
4064
Service.exe
GET
404
47.113.180.71:80
http://www.tooyk.com/deskad/deskicon.txt
unknown
—
—
unknown
4064
Service.exe
GET
404
47.113.180.71:80
http://www.tooyk.com/deskad/deskicon.txt
unknown
—
—
unknown
4064
Service.exe
GET
404
47.113.180.71:80
http://www.tooyk.com/deskad/deskicon.txt
unknown
—
—
unknown
4064
Service.exe
GET
404
47.113.180.71:80
http://www.tooyk.com/deskad/deskicon.txt
unknown
—
—
unknown
4064
Service.exe
GET
404
47.113.180.71:80
http://www.tooyk.com/deskad/deskicon.txt
unknown
—
—
unknown
4064
Service.exe
GET
404
47.113.180.71:80
http://www.tooyk.com/deskad/deskicon.txt
unknown
—
—
unknown
4064
Service.exe
GET
404
47.113.180.71:80
http://www.tooyk.com/deskad/deskicon.txt
unknown
—
—
unknown
4064
Service.exe
GET
404
47.113.180.71:80
http://www.tooyk.com/deskad/deskicon.txt
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:138
—
—
—
whitelisted
568
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6652
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
568
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
2120
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4324
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4064
Service.exe
47.113.180.71:80
www.tooyk.com
Hangzhou Alibaba Advertising Co.,Ltd.
CN
suspicious

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
google.com
  • 142.250.185.174
whitelisted
www.tooyk.com
  • 47.113.180.71
unknown
ip.qq.com
  • 0.0.0.1
whitelisted

Threats

PID
Process
Class
Message
4064
Service.exe
Potential Corporate Privacy Violation
ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile
4064
Service.exe
Potential Corporate Privacy Violation
ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile
4064
Service.exe
Potential Corporate Privacy Violation
ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile
4064
Service.exe
Potential Corporate Privacy Violation
ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile
4064
Service.exe
Potential Corporate Privacy Violation
ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile
4064
Service.exe
Potential Corporate Privacy Violation
ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile
4064
Service.exe
Potential Corporate Privacy Violation
ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile
4064
Service.exe
Potential Corporate Privacy Violation
ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile
4064
Service.exe
Potential Corporate Privacy Violation
ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile
4064
Service.exe
Potential Corporate Privacy Violation
ET POLICY Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
UpdateV5.1.3.2.exe