File name:

file

Full analysis: https://app.any.run/tasks/c41934b1-6723-4aff-9e68-a59d8768152a
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 12, 2024, 15:46:32
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
loader
stealer
redline
metastealer
python
crypto-regex
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 6 sections
MD5:

FF1E7643A5C9294BD8E8FD743B323C8F

SHA1:

B35C6E9090B44C2DB2220C5C42C0F68210BA73A9

SHA256:

25F4451B243D5E5B05EACCF5DD58E3CFCEE7969B145D9AAD7AFF6750AB9A6D0B

SSDEEP:

3072:ObJk3T1K14kIZM6J9i3+fjSXW79QslycYh8b3Vf/QkBwYz/LQuOeEq/uTgcW:IJQK1Bjo9iaWGlbb3VfIkBw0D0q/uW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • file.exe (PID: 6440)
      • msiexec.exe (PID: 6484)
      • audiodg.exe (PID: 6492)

    • Loads dropped or rewritten executable

      • file.exe (PID: 6440)
      • audiodg.exe (PID: 6492)
      • 665E.tmp.ctx.exe (PID: 7128)
      • WaaSMedicAgent.exe (PID: 6892)
      • conhost.exe (PID: 6900)
      • svchost.exe (PID: 6476)
      • MusNotificationUx.exe (PID: 6836)
      • svchost.exe (PID: 6980)
      • backgroundTaskHost.exe (PID: 6764)
      • backgroundTaskHost.exe (PID: 6740)
      • MusNotifyIcon.exe (PID: 7096)
      • RuntimeBroker.exe (PID: 6272)
      • 665E.tmp.ctx.exe (PID: 6236)
      • 7092.tmp.vvv.exe (PID: 6384)
      • WmiPrvSE.exe (PID: 2728)
      • msiexec.exe (PID: 6484)
      • SIHClient.exe (PID: 5080)
      • svchost.exe (PID: 2132)

    • REDLINE has been detected (SURICATA)

      • 6882.tmp.fcxcx.exe (PID: 6180)

    • METASTEALER has been detected (SURICATA)

      • 6882.tmp.fcxcx.exe (PID: 6180)

    • Actions looks like stealing of personal data

      • 6882.tmp.fcxcx.exe (PID: 6180)

    • Steals credentials from Web Browsers

      • 6882.tmp.fcxcx.exe (PID: 6180)

    • Connects to the CnC server

      • 6882.tmp.fcxcx.exe (PID: 6180)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • file.exe (PID: 6440)
      • 665E.tmp.ctx.exe (PID: 7128)

    • Starts a Microsoft application from unusual location

      • file.exe (PID: 6440)

    • Executable content was dropped or overwritten

      • file.exe (PID: 6440)
      • explorer.exe (PID: 4488)
      • 665E.tmp.ctx.exe (PID: 7128)

    • Potential Corporate Privacy Violation

      • explorer.exe (PID: 4488)

    • The process drops C-runtime libraries

      • 665E.tmp.ctx.exe (PID: 7128)

    • Process requests binary or script from the Internet

      • explorer.exe (PID: 4488)

    • Application launched itself

      • 665E.tmp.ctx.exe (PID: 7128)

    • Connects to the server without a host name

      • explorer.exe (PID: 4488)

    • Loads Python modules

      • 665E.tmp.ctx.exe (PID: 6236)

    • Process drops python dynamic module

      • 665E.tmp.ctx.exe (PID: 7128)

    • Connects to unusual port

      • 6882.tmp.fcxcx.exe (PID: 6180)

    • Found regular expressions for crypto-addresses (YARA)

      • svchost.exe (PID: 6476)

    • There is functionality for taking screenshot (YARA)

      • svchost.exe (PID: 6476)

  • INFO

    • The sample compiled with english language support

      • file.exe (PID: 6440)
      • 665E.tmp.ctx.exe (PID: 7128)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 4488)
      • backgroundTaskHost.exe (PID: 6740)
      • RuntimeBroker.exe (PID: 6272)
      • backgroundTaskHost.exe (PID: 6764)

    • Creates files or folders in the user directory

      • file.exe (PID: 6440)

    • Checks supported languages

      • file.exe (PID: 6440)
      • 665E.tmp.ctx.exe (PID: 7128)
      • 6882.tmp.fcxcx.exe (PID: 6180)
      • 665E.tmp.ctx.exe (PID: 6236)

    • Creates files in the program directory

      • MusNotificationUx.exe (PID: 6836)
      • svchost.exe (PID: 6980)

    • Reads the time zone

      • MusNotificationUx.exe (PID: 6836)
      • MusNotifyIcon.exe (PID: 7096)
      • WmiPrvSE.exe (PID: 2728)

    • Reads the software policy settings

      • WaaSMedicAgent.exe (PID: 6892)
      • backgroundTaskHost.exe (PID: 6764)
      • SIHClient.exe (PID: 5080)

    • Create files in a temporary directory

      • explorer.exe (PID: 4488)
      • 665E.tmp.ctx.exe (PID: 7128)

    • The process uses the downloaded file

      • explorer.exe (PID: 4488)

    • Reads the machine GUID from the registry

      • 665E.tmp.ctx.exe (PID: 6236)
      • 6882.tmp.fcxcx.exe (PID: 6180)

    • Reads the computer name

      • 6882.tmp.fcxcx.exe (PID: 6180)
      • 665E.tmp.ctx.exe (PID: 7128)

    • Drops encrypted VBS script (Microsoft Script Encoder)

      • 6882.tmp.fcxcx.exe (PID: 6180)

    • Reads Windows Product ID

      • WmiPrvSE.exe (PID: 2728)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:12:11 08:42:08+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 10
CodeSize: 14848
InitializedDataSize: 10752
UninitializedDataSize: -
EntryPoint: 0x345c
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 2.0.0.1
ProductVersionNumber: 2.0.0.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: System
FileVersion: 2.0.0.1
InternalName: Services.exe
LegalCopyright: Copyright (C) 2025
OriginalFileName: Services.exe
ProductName: Services
ProductVersion: 2.0.0.1
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
20
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start file.exe svchost.exe no specs msiexec.exe audiodg.exe explorer.exe 665e.tmp.ctx.exe #REDLINE 6882.tmp.fcxcx.exe 665e.tmp.ctx.exe no specs runtimebroker.exe no specs backgroundtaskhost.exe no specs backgroundtaskhost.exe musnotificationux.exe no specs waasmedicagent.exe no specs conhost.exe no specs svchost.exe no specs musnotifyicon.exe no specs 7092.tmp.vvv.exe no specs wmiprvse.exe no specs sihclient.exe svchost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2132C:\WINDOWS\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvcC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2728C:\WINDOWS\system32\wbem\wmiprvse.exe -secured -EmbeddingC:\Windows\System32\wbem\WmiPrvSE.exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
WMI Provider Host
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmiprvse.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ncobjapi.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\wbem\fastprox.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
4488C:\WINDOWS\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\smartscreenps.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\napinsp.dll
c:\windows\system32\pnrpnsp.dll
c:\windows\system32\wshbth.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\winrnr.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\rasadhlp.dll
5080C:\WINDOWS\System32\sihclient.exe /cv Xepf/9I1q06Q9ozUJoX9gQ.0.2C:\Windows\System32\SIHClient.exe
upfc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
SIH Client
Exit code:
2379777
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sihclient.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\combase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\oleaut32.dll
6180"C:\Users\admin\AppData\Local\Temp\6882.tmp.fcxcx.exe" C:\Users\admin\AppData\Local\Temp\6882.tmp.fcxcx.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
XHP
Exit code:
0
Version:
12.9.1.22
Modules
Images
c:\users\admin\appdata\local\temp\6882.tmp.fcxcx.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6236"C:\Users\admin\AppData\Local\Temp\665E.tmp.ctx.exe" C:\Users\admin\AppData\Local\Temp\665E.tmp.ctx.exe—665E.tmp.ctx.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\665e.tmp.ctx.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6272C:\Windows\System32\RuntimeBroker.exe -EmbeddingC:\Windows\System32\RuntimeBroker.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Runtime Broker
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\runtimebroker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\powrprof.dll
6384"C:\Users\admin\AppData\Local\Temp\7092.tmp.vvv.exe" C:\Users\admin\AppData\Local\Temp\7092.tmp.vvv.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\7092.tmp.vvv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\umpdc.dll
6440"C:\Users\admin\AppData\Local\Temp\file.exe" C:\Users\admin\AppData\Local\Temp\file.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
System
Exit code:
0
Version:
2.0.0.1
Modules
Images
c:\users\admin\appdata\local\temp\file.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6476"C:\WINDOWS\system32\svchost.exe"C:\Windows\System32\svchost.exe—file.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
17 944
Read events
17 796
Write events
145
Delete events
3

Modification events

(PID) Process:(4488) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Security and Maintenance\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
23004100430042006C006F0062000000000000000000000001000000780000006D000000
(PID) Process:(6440) file.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Services
Value:
C:\Users\admin\AppData\Roaming\2F33566DA0B91573532102\2F33566DA0B91573532102.exe
(PID) Process:(6492) audiodg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run
Operation:delete keyName:(default)
Value:
(PID) Process:(6492) audiodg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder
Operation:delete keyName:(default)
Value:
(PID) Process:(6492) audiodg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Services
Value:
C:\Users\admin\AppData\Roaming\2F33566DA0B91573532102\2F33566DA0B91573532102.exe
(PID) Process:(6484) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Services
Value:
C:\Users\admin\AppData\Roaming\2F33566DA0B91573532102\2F33566DA0B91573532102.exe
(PID) Process:(6740) backgroundTaskHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SearchSettings
Operation:writeName:SafeSearchMode
Value:
1
(PID) Process:(6740) backgroundTaskHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\Flighting
Operation:writeName:CachedFeatureString
Value:
(PID) Process:(6740) backgroundTaskHost.exeKey:\REGISTRY\A\{ee080948-b2ea-145a-6870-f9164b908eb9}\LocalState
Operation:writeName:BINGIDENTITY_PROP_USEREMAIL
Value:
000009C86508AD4CDB01
(PID) Process:(6740) backgroundTaskHost.exeKey:\REGISTRY\A\{ee080948-b2ea-145a-6870-f9164b908eb9}\LocalState
Operation:writeName:BINGIDENTITY_PROP_ACCOUNTTYPETEXT
Value:
000009C86508AD4CDB01
Executable files
54
Suspicious files
10
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
7128665E.tmp.ctx.exeC:\Users\admin\AppData\Local\Temp\_MEI71282\_ctypes.pydexecutable
MD5:F1E33A8F6F91C2ED93DC5049DD50D7B8
SHA256:9459D246DF7A3C638776305CF3683946BA8DB26A7DE90DF8B60E1BE0B27E53C4
7128665E.tmp.ctx.exeC:\Users\admin\AppData\Local\Temp\_MEI71282\api-ms-win-core-datetime-l1-1-0.dllexecutable
MD5:5AF784F599437629DEEA9FE4E8EB4799
SHA256:7E5BD3EE263D09C7998E0D5FFA684906DDC56DA61536331C89C74B039DF00C7C
7128665E.tmp.ctx.exeC:\Users\admin\AppData\Local\Temp\_MEI71282\_hashlib.pydexecutable
MD5:A6448BC5E5DA21A222DE164823ADD45C
SHA256:3692FC8E70E6E29910032240080FC8109248CE9A996F0A70D69ACF1542FCA69A
7128665E.tmp.ctx.exeC:\Users\admin\AppData\Local\Temp\_MEI71282\api-ms-win-core-debug-l1-1-0.dllexecutable
MD5:E1CA15CF0597C6743B3876AF23A96960
SHA256:990E46D8F7C9574A558EBDFCB8739FBCCBA59D0D3A2193C9C8E66807387A276D
4488explorer.exeC:\Users\admin\AppData\Local\Temp\665E.tmp.ctx.exeexecutable
MD5:AE2A4249C8389603933DF4F806546C96
SHA256:CBE157A18DF07D512F3E4939D048F6419163892BF0CC5D5694EAADC7809D2477
7128665E.tmp.ctx.exeC:\Users\admin\AppData\Local\Temp\_MEI71282\api-ms-win-core-handle-l1-1-0.dllexecutable
MD5:7BC1B8712E266DB746914DB48B27EF9C
SHA256:F82D05AEA21BCF6337EF45FBDAD6D647D17C043A67B44C7234F149F861A012B9
7128665E.tmp.ctx.exeC:\Users\admin\AppData\Local\Temp\_MEI71282\_lzma.pydexecutable
MD5:37057C92F50391D0751F2C1D7AD25B02
SHA256:9442DC46829485670A6AC0C02EF83C54B401F1570D1D5D1D85C19C1587487764
7128665E.tmp.ctx.exeC:\Users\admin\AppData\Local\Temp\_MEI71282\api-ms-win-core-interlocked-l1-1-0.dllexecutable
MD5:1DCCF27F2967601CE6666C8611317F03
SHA256:6A83AB9A413AFD74D77A090F52784B0128527BEE9CB0A4224C59D5C75FC18387
7128665E.tmp.ctx.exeC:\Users\admin\AppData\Local\Temp\_MEI71282\api-ms-win-core-file-l1-2-0.dllexecutable
MD5:F0C73F7454A5CE6FB8E3D795FDB0235D
SHA256:2A59DD891533A028FAE7A81E690E4C28C9074C2F327393FAB17329AFFE53FD7B
7128665E.tmp.ctx.exeC:\Users\admin\AppData\Local\Temp\_MEI71282\api-ms-win-core-file-l2-1-0.dllexecutable
MD5:7D4D4593B478B4357446C106B64E61F8
SHA256:0A6E2224CDE90A0D41926E8863F9956848FFBF19848E8855BD08953112AFC801
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
40
DNS requests
17
Threats
52

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4488
explorer.exe
POST
200
185.81.68.147:80
http://185.81.68.147/tizhyf/gate.php?2F33566DA0B91573532102
unknown
—
—
malicious
4488
explorer.exe
POST
200
185.81.68.147:80
http://185.81.68.147/tizhyf/gate.php?2F33566DA0B91573532102
unknown
—
—
malicious
4488
explorer.exe
GET
—
185.81.68.147:80
http://185.81.68.147/ctx.exe
unknown
—
—
malicious
4488
explorer.exe
POST
200
185.81.68.147:80
http://185.81.68.147/tizhyf/gate.php?2F33566DA0B91573532102
unknown
—
—
malicious
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4488
explorer.exe
GET
—
185.81.68.147:80
http://185.81.68.147/vvv.exe
unknown
—
—
malicious
5080
SIHClient.exe
GET
200
23.215.121.133:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4488
explorer.exe
POST
200
185.81.68.147:80
http://185.81.68.147/tizhyf/gate.php?2F33566DA0B91573532102
unknown
—
—
malicious
4488
explorer.exe
GET
200
185.81.68.147:80
http://185.81.68.147/fcxcx.exe
unknown
—
—
malicious
6764
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
23.32.238.34:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4328
svchost.exe
23.32.238.34:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4328
svchost.exe
23.215.121.133:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.215.121.133:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
2.16.204.148:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4488
explorer.exe
185.81.68.147:80
—
Chang Way Technologies Co. Limited
RU
malicious

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.32.238.34
  • 2.19.198.194
whitelisted
google.com
  • 142.250.185.110
whitelisted
www.microsoft.com
  • 23.215.121.133
whitelisted
www.bing.com
  • 2.16.204.148
  • 2.16.204.151
  • 2.16.204.146
  • 2.16.204.150
  • 2.16.204.144
  • 2.16.204.137
  • 2.16.204.139
  • 2.16.204.147
  • 2.16.204.141
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.74
  • 20.190.160.14
  • 40.126.32.133
  • 20.190.160.20
  • 20.190.160.22
  • 40.126.32.138
  • 40.126.32.68
  • 40.126.32.76
whitelisted
go.microsoft.com
  • 23.218.210.69
whitelisted
arc.msn.com
  • 20.74.47.205
whitelisted
fd.api.iris.microsoft.com
  • 20.103.156.88
whitelisted

Threats

PID
Process
Class
Message
4488
explorer.exe
A Network Trojan was detected
ET MALWARE Trojan Generic - POST To gate.php with no referer
4488
explorer.exe
A Network Trojan was detected
ET MALWARE Trojan Generic - POST To gate.php with no referer
4488
explorer.exe
A Network Trojan was detected
ET MALWARE Generic Request to gate.php Dotted-Quad
4488
explorer.exe
A Network Trojan was detected
ET MALWARE Generic Request to gate.php Dotted-Quad
4488
explorer.exe
A Network Trojan was detected
ET MALWARE Trojan Generic - POST To gate.php with no accept headers
4488
explorer.exe
A Network Trojan was detected
ET MALWARE Trojan Generic - POST To gate.php with no accept headers
4488
explorer.exe
A Network Trojan was detected
ET MALWARE Trojan Generic - POST To gate.php with no accept headers
4488
explorer.exe
A Network Trojan was detected
ET MALWARE Trojan Generic - POST To gate.php with no referer
4488
explorer.exe
A Network Trojan was detected
ET MALWARE Generic Request to gate.php Dotted-Quad
4488
explorer.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
No debug info