File name:

SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178

Full analysis: https://app.any.run/tasks/3aefc539-71b9-4baa-82cc-702c18794833
Verdict: Malicious activity
Analysis date: July 31, 2024, 09:37:57
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
installer
icmp
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

C88056E5927B88CC685080634523FF54

SHA1:

C0AC73B1EA92A2634F618720507A721DA326AD21

SHA256:

1FED7562FA2BE11233FCA458C3FD90012803F9016C947E2F7152EB75175CEF2C

SSDEEP:

393216:IevIqJB2E1egqqJckiCSB3BTHmeHqASHgnLIyi7:ZyENiCSf1iKq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.exe (PID: 7020)
      • SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.exe (PID: 6168)
      • SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmp (PID: 3812)
      • ps2pdf995.exe (PID: 6780)
      • PS2Pdf995setup.exe (PID: 6832)
      • pdf995s.exe (PID: 360)
      • thinsetup.exe (PID: 3144)
      • copy64.exe (PID: 3992)
      • copy64.exe (PID: 2384)
      • setup.exe (PID: 2456)
      • copy64.exe (PID: 6500)

    • Registers / Runs the DLL via REGSVR32.EXE

      • SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmp (PID: 3812)

    • Scans artifacts that could help determine the target

      • Rpv.exe (PID: 5984)
      • glver.exe (PID: 1964)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.exe (PID: 7020)
      • SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.exe (PID: 6168)
      • SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmp (PID: 3812)
      • ps2pdf995.exe (PID: 6780)
      • PS2Pdf995setup.exe (PID: 6832)
      • pdf995s.exe (PID: 360)
      • thinsetup.exe (PID: 3144)
      • setup.exe (PID: 2456)
      • copy64.exe (PID: 3992)
      • copy64.exe (PID: 2384)
      • copy64.exe (PID: 6500)

    • Reads the date of Windows installation

      • SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmp (PID: 7040)

    • Reads security settings of Internet Explorer

      • SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmp (PID: 7040)
      • setup.exe (PID: 2456)
      • Rpv.exe (PID: 5984)
      • glver.exe (PID: 1964)
      • e-mailer.exe (PID: 3188)

    • Process drops legitimate windows executable

      • SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmp (PID: 3812)
      • pdf995s.exe (PID: 360)
      • thinsetup.exe (PID: 3144)
      • setup.exe (PID: 2456)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 6908)
      • regsvr32.exe (PID: 6912)
      • regsvr32.exe (PID: 6932)
      • regsvr32.exe (PID: 6712)
      • regsvr32.exe (PID: 6704)
      • regsvr32.exe (PID: 4924)
      • regsvr32.exe (PID: 2728)
      • regsvr32.exe (PID: 6572)
      • regsvr32.exe (PID: 1076)
      • regsvr32.exe (PID: 3136)
      • regsvr32.exe (PID: 1964)
      • regsvr32.exe (PID: 236)
      • regsvr32.exe (PID: 3116)
      • regsvr32.exe (PID: 6304)
      • regsvr32.exe (PID: 6876)
      • regsvr32.exe (PID: 7012)
      • regsvr32.exe (PID: 1164)
      • regsvr32.exe (PID: 5924)
      • regsvr32.exe (PID: 6536)
      • regsvr32.exe (PID: 4236)
      • regsvr32.exe (PID: 5180)
      • regsvr32.exe (PID: 6564)
      • regsvr32.exe (PID: 6504)
      • regsvr32.exe (PID: 6764)
      • regsvr32.exe (PID: 6616)

    • Reads the Windows owner or organization settings

      • SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmp (PID: 3812)

    • Starts CMD.EXE for commands execution

      • instpdf.exe (PID: 5044)

    • Executing commands from a ".bat" file

      • instpdf.exe (PID: 5044)

    • Creates a software uninstall entry

      • PS2Pdf995setup.exe (PID: 6832)
      • setup.exe (PID: 2456)

    • Creates file in the systems drive root

      • thinsetup.exe (PID: 3144)

    • Checks Windows Trust Settings

      • Rpv.exe (PID: 5984)
      • glver.exe (PID: 1964)

    • Reads Microsoft Outlook installation path

      • Rpv.exe (PID: 5984)
      • glver.exe (PID: 1964)
      • e-mailer.exe (PID: 3188)

    • Reads Internet Explorer settings

      • Rpv.exe (PID: 5984)
      • glver.exe (PID: 1964)
      • e-mailer.exe (PID: 3188)

    • Process requests binary or script from the Internet

      • glver.exe (PID: 1964)

    • There is functionality for communication over UDP network (YARA)

      • e-mailer.exe (PID: 3188)

    • There is functionality for sendig ICMP (YARA)

      • e-mailer.exe (PID: 3188)

  • INFO

    • Checks supported languages

      • SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.exe (PID: 7020)
      • SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmp (PID: 7040)
      • SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.exe (PID: 6168)
      • SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmp (PID: 3812)
      • instpdf.exe (PID: 5044)
      • autosetup.exe (PID: 6884)
      • ps2pdf995.exe (PID: 6780)
      • PS2Pdf995setup.exe (PID: 6832)
      • pdf995s.exe (PID: 360)
      • thinsetup.exe (PID: 3144)
      • splash.exe (PID: 1344)
      • setup.exe (PID: 2456)
      • copy64.exe (PID: 3992)
      • copy64.exe (PID: 2384)
      • copy64.exe (PID: 6500)
      • xprights.exe (PID: 6892)
      • Rpv.exe (PID: 5984)
      • glver.exe (PID: 1964)
      • e-mailer.exe (PID: 3188)

    • Create files in a temporary directory

      • SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.exe (PID: 7020)
      • SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.exe (PID: 6168)
      • SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmp (PID: 3812)
      • instpdf.exe (PID: 5044)
      • pdf995s.exe (PID: 360)
      • ps2pdf995.exe (PID: 6780)
      • Rpv.exe (PID: 5984)
      • glver.exe (PID: 1964)
      • e-mailer.exe (PID: 3188)

    • Reads the computer name

      • SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmp (PID: 7040)
      • SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmp (PID: 3812)
      • instpdf.exe (PID: 5044)
      • ps2pdf995.exe (PID: 6780)
      • pdf995s.exe (PID: 360)
      • splash.exe (PID: 1344)
      • setup.exe (PID: 2456)
      • xprights.exe (PID: 6892)
      • Rpv.exe (PID: 5984)
      • glver.exe (PID: 1964)
      • e-mailer.exe (PID: 3188)

    • Process checks computer location settings

      • SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmp (PID: 7040)

    • Creates files in the program directory

      • SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmp (PID: 3812)
      • autosetup.exe (PID: 6884)
      • PS2Pdf995setup.exe (PID: 6832)
      • thinsetup.exe (PID: 3144)
      • setup.exe (PID: 2456)
      • xprights.exe (PID: 6892)
      • instpdf.exe (PID: 5044)

    • Reads mouse settings

      • regsvr32.exe (PID: 1076)
      • regsvr32.exe (PID: 1964)
      • Rpv.exe (PID: 5984)
      • e-mailer.exe (PID: 3188)

    • Creates a software uninstall entry

      • SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmp (PID: 3812)

    • Creates files or folders in the user directory

      • xcopy.exe (PID: 2340)
      • xcopy.exe (PID: 2456)
      • xcopy.exe (PID: 6288)
      • xcopy.exe (PID: 6888)
      • xcopy.exe (PID: 5084)
      • xcopy.exe (PID: 3476)
      • xcopy.exe (PID: 7032)
      • instpdf.exe (PID: 5044)
      • Rpv.exe (PID: 5984)
      • glver.exe (PID: 1964)
      • e-mailer.exe (PID: 3188)

    • Reads Microsoft Office registry keys

      • setup.exe (PID: 2456)

    • Checks proxy server information

      • Rpv.exe (PID: 5984)
      • glver.exe (PID: 1964)
      • e-mailer.exe (PID: 3188)

    • Reads the software policy settings

      • Rpv.exe (PID: 5984)
      • glver.exe (PID: 1964)

    • Reads the machine GUID from the registry

      • Rpv.exe (PID: 5984)
      • glver.exe (PID: 1964)

    • Process checks Internet Explorer phishing filters

      • Rpv.exe (PID: 5984)
      • glver.exe (PID: 1964)
      • e-mailer.exe (PID: 3188)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (77.7)
.exe | Win32 Executable Delphi generic (10)
.dll | Win32 Dynamic Link Library (generic) (4.6)
.exe | Win32 Executable (generic) (3.1)
.exe | Win16/32 Executable Delphi generic (1.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 41984
InitializedDataSize: 17920
UninitializedDataSize: -
EntryPoint: 0xaad0
OSVersion: 1
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: Rpv Software
FileDescription: Rpv Reports Setup
FileVersion:
LegalCopyright:
ProductName: Rpv Reports
ProductVersion:
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
185
Monitored processes
56
Malicious processes
19
Suspicious processes
2

Behavior graph

Click at the process to see the details
start securiteinfo.com.trojan.win32.agent.xbltbw.25187.23178.exe securiteinfo.com.trojan.win32.agent.xbltbw.25187.23178.tmp no specs securiteinfo.com.trojan.win32.agent.xbltbw.25187.23178.exe securiteinfo.com.trojan.win32.agent.xbltbw.25187.23178.tmp regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs instpdf.exe no specs cmd.exe no specs conhost.exe no specs xcopy.exe no specs xcopy.exe no specs xcopy.exe no specs xcopy.exe no specs xcopy.exe no specs xcopy.exe no specs xcopy.exe no specs xcopy.exe no specs autosetup.exe no specs ps2pdf995.exe ps2pdf995setup.exe pdf995s.exe splash.exe no specs thinsetup.exe setup.exe copy64.exe copy64.exe copy64.exe xprights.exe no specs rpv.exe splwow64.exe no specs glver.exe THREAT e-mailer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208C:\WINDOWS\system32\cmd.exe /c ""C:\Program Files (x86)\Rpv\appd.bat""C:\Windows\SysWOW64\cmd.exe—instpdf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
236"C:\WINDOWS\system32\regsvr32.exe" /s "C:\WINDOWS\system32\mswinsck.OCX"C:\Windows\SysWOW64\regsvr32.exe—SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
360pdf995s.exeC:\Program Files (x86)\Rpv\Pdf995\pdf995s.exe
autosetup.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files (x86)\rpv\pdf995\pdf995s.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
1076"C:\WINDOWS\system32\regsvr32.exe" /s "C:\WINDOWS\system32\mscomctl.OCX"C:\Windows\SysWOW64\regsvr32.exe—SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1164"C:\WINDOWS\system32\regsvr32.exe" /s "C:\Program Files (x86)\Rpv\button10.ocx"C:\Windows\SysWOW64\regsvr32.exe—SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1344xcopy "pbms2021\*.*" "C:\Users\admin\AppData\Roaming\Rpv\Pbms\Pbms\*.*" /d /e /yC:\Windows\SysWOW64\xcopy.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Extended Copy Utility
Exit code:
4
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\xcopy.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1344.\pdf995\splash.exeC:\Users\admin\AppData\Local\Temp\WZSE0.TMP\pdf995\splash.exe—pdf995s.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\wzse0.tmp\pdf995\splash.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
1964"C:\WINDOWS\system32\regsvr32.exe" /s "C:\WINDOWS\system32\MSCOMCT2.OCX"C:\Windows\SysWOW64\regsvr32.exe—SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1964"C:\Program Files (x86)\Rpv\glver.exe" exe=rpv.exe&svk=X&serial=999999999999&roo=417665946&cma=demo&ver=R2024020&dte=20240731C:\Program Files (x86)\Rpv\glver.exe
Rpv.exe
User:
admin
Company:
Rpv Software
Integrity Level:
MEDIUM
Description:
Rpv GLver
Exit code:
0
Version:
1.00
Modules
Images
c:\program files (x86)\rpv\glver.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
2340xcopy "pbms2024\*.*" "C:\Users\admin\AppData\Roaming\Rpv\Pbms\Pbms2024\*.*" /d /e /yC:\Windows\SysWOW64\xcopy.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Extended Copy Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\xcopy.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
15 922
Read events
15 059
Write events
605
Delete events
258

Modification events

(PID) Process:(3812) SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
E40E000014BB305F2DE3DA01
(PID) Process:(3812) SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
DC4E54CF52492D996C8E26CF21B7BA34BD542EE78FE74F60B8C95E2E5E963C92
(PID) Process:(3812) SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(3812) SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:RegFiles0000
Value:
C:\Program Files (x86)\Rpv\rpv.chm
(PID) Process:(3812) SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:RegFilesHash
Value:
979387A8F46015104C77743CE5B75AE48FEB0738F3EA9B6A08E45B301A238608
(PID) Process:(3812) SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts
Operation:writeName:Roboto Black (TrueType)
Value:
Roboto-Black.ttf
(PID) Process:(3812) SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts
Operation:writeName:Roboto Black Italic (TrueType)
Value:
Roboto-BlackItalic.ttf
(PID) Process:(3812) SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts
Operation:writeName:Roboto Bold (TrueType)
Value:
Roboto-Bold.ttf
(PID) Process:(3812) SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts
Operation:writeName:Roboto Bold Italic (TrueType)
Value:
Roboto-BoldItalic.ttf
(PID) Process:(3812) SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts
Operation:writeName:Roboto Italic (TrueType)
Value:
Roboto-Italic.ttf
Executable files
190
Suspicious files
101
Text files
1 095
Unknown types
81

Dropped files

PID
Process
Filename
Type
3812SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmpC:\Program Files (x86)\Rpv\is-QKANF.tmpexecutable
MD5:DB6F97815D221843048EFB36AD737CBC
SHA256:E93AB9B690396B18B3485FC674CC802D530145E472F2F6A88EF988F7CC0846C6
3812SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmpC:\Program Files (x86)\Rpv\is-9CIFV.tmptext
MD5:01FBAAF40C58E26407743BCFAA5F9BE3
SHA256:B58772FF7BFEA9572598F8DA28320FFA6B5AEE152755ED22F191BDEB91E32C8D
3812SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmpC:\Program Files (x86)\Rpv\is-ULI04.tmptext
MD5:8053E319B7B2E8BC9E753C0EF617B09F
SHA256:0466283EDCE714D54458C416423AF0533473701416A9D8393BC5E263D3A70871
3812SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmpC:\Program Files (x86)\Rpv\unins000.exeexecutable
MD5:DB6F97815D221843048EFB36AD737CBC
SHA256:E93AB9B690396B18B3485FC674CC802D530145E472F2F6A88EF988F7CC0846C6
3812SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmpC:\Program Files (x86)\Rpv\Rpv.initext
MD5:01FBAAF40C58E26407743BCFAA5F9BE3
SHA256:B58772FF7BFEA9572598F8DA28320FFA6B5AEE152755ED22F191BDEB91E32C8D
3812SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmpC:\Program Files (x86)\Rpv\is-6UF31.tmpbinary
MD5:8F208E2F568522965959C3DEC31DD68D
SHA256:5F279FCA25DFDC75DE88EC53E548F42292E0016C2DCF3F81EB18572068734129
6168SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.exeC:\Users\admin\AppData\Local\Temp\is-14Q70.tmp\SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmpexecutable
MD5:1AFBD25DB5C9A90FE05309F7C4FBCF09
SHA256:3BB0EE5569FE5453C6B3FA25AA517B925D4F8D1F7BA3475E58FA09C46290658C
3812SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmpC:\Program Files (x86)\Rpv\is-3C3UL.tmpbinary
MD5:204CA90E9C8F3FBB6A45AF118D529AC7
SHA256:2B1E5CA7B28638461A77A729579FEB30748AF5C14D2928580B35777FD4E6143A
3812SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmpC:\Program Files (x86)\Rpv\Default.rpvtext
MD5:8053E319B7B2E8BC9E753C0EF617B09F
SHA256:0466283EDCE714D54458C416423AF0533473701416A9D8393BC5E263D3A70871
3812SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178.tmpC:\Program Files (x86)\Rpv\rpv.chmbinary
MD5:8F208E2F568522965959C3DEC31DD68D
SHA256:5F279FCA25DFDC75DE88EC53E548F42292E0016C2DCF3F81EB18572068734129
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
59
DNS requests
25
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5140
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6208
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5140
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6276
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5984
Rpv.exe
GET
200
104.18.38.233:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
—
—
whitelisted
5984
Rpv.exe
GET
200
172.64.149.23:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
unknown
—
—
whitelisted
5984
Rpv.exe
GET
301
143.95.110.251:80
http://www.rpvsoftware.com/add_reg7.php?serial=999999999999&email=nomail@nomail.com&name=noname&company=nocompany&svk=P&lic_name=noname&lic_company=nocompany&roo=417665946&st=1&date=20240731&ver=2024
unknown
—
—
unknown
5984
Rpv.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEQDf7Nlo3DJkFjLrYhfHmCKC
unknown
—
—
whitelisted
1964
glver.exe
GET
301
143.95.110.251:80
http://rpvsoftware.com/latest_new.php?exe=rpv.exe&svk=X&serial=999999999999&roo=417665946&cma=demo&ver=R2024020&dte=20240731
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5336
SearchApp.exe
184.86.251.16:443
www.bing.com
Akamai International B.V.
DE
unknown
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
—
—
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5140
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
6208
backgroundTaskHost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
—
—
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
google.com
  • 172.217.18.14
whitelisted
www.bing.com
  • 184.86.251.16
  • 184.86.251.20
  • 184.86.251.14
  • 184.86.251.15
  • 184.86.251.21
  • 184.86.251.13
  • 184.86.251.19
  • 184.86.251.18
  • 184.86.251.11
  • 184.86.251.31
  • 184.86.251.10
  • 184.86.251.30
  • 184.86.251.5
  • 184.86.251.28
  • 184.86.251.29
  • 184.86.251.9
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.75
  • 40.126.31.67
  • 20.190.159.73
  • 40.126.31.69
  • 20.190.159.0
  • 20.190.159.4
  • 20.190.159.23
  • 20.190.159.64
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
fd.api.iris.microsoft.com
  • 20.74.47.205
whitelisted
th.bing.com
  • 184.86.251.18
  • 184.86.251.11
  • 184.86.251.16
  • 184.86.251.20
  • 184.86.251.14
  • 184.86.251.15
  • 184.86.251.21
  • 184.86.251.13
  • 184.86.251.19
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
slscr.update.microsoft.com
  • 52.165.165.26
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SecuriteInfo.com.Trojan.Win32.Agent.xbltbw.25187.23178