File name:

file

Full analysis: https://app.any.run/tasks/c41934b1-6723-4aff-9e68-a59d8768152a
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 12, 2024, 15:46:32
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
loader
stealer
redline
metastealer
python
crypto-regex
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 6 sections
MD5:

FF1E7643A5C9294BD8E8FD743B323C8F

SHA1:

B35C6E9090B44C2DB2220C5C42C0F68210BA73A9

SHA256:

25F4451B243D5E5B05EACCF5DD58E3CFCEE7969B145D9AAD7AFF6750AB9A6D0B

SSDEEP:

3072:ObJk3T1K14kIZM6J9i3+fjSXW79QslycYh8b3Vf/QkBwYz/LQuOeEq/uTgcW:IJQK1Bjo9iaWGlbb3VfIkBw0D0q/uW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • file.exe (PID: 6440)
      • msiexec.exe (PID: 6484)
      • audiodg.exe (PID: 6492)

    • Loads dropped or rewritten executable

      • file.exe (PID: 6440)
      • WaaSMedicAgent.exe (PID: 6892)
      • conhost.exe (PID: 6900)
      • svchost.exe (PID: 6476)
      • MusNotificationUx.exe (PID: 6836)
      • RuntimeBroker.exe (PID: 6272)
      • backgroundTaskHost.exe (PID: 6740)
      • backgroundTaskHost.exe (PID: 6764)
      • MusNotifyIcon.exe (PID: 7096)
      • 665E.tmp.ctx.exe (PID: 6236)
      • 7092.tmp.vvv.exe (PID: 6384)
      • audiodg.exe (PID: 6492)
      • 665E.tmp.ctx.exe (PID: 7128)
      • msiexec.exe (PID: 6484)
      • svchost.exe (PID: 6980)
      • SIHClient.exe (PID: 5080)
      • svchost.exe (PID: 2132)
      • WmiPrvSE.exe (PID: 2728)

    • REDLINE has been detected (SURICATA)

      • 6882.tmp.fcxcx.exe (PID: 6180)

    • METASTEALER has been detected (SURICATA)

      • 6882.tmp.fcxcx.exe (PID: 6180)

    • Actions looks like stealing of personal data

      • 6882.tmp.fcxcx.exe (PID: 6180)

    • Steals credentials from Web Browsers

      • 6882.tmp.fcxcx.exe (PID: 6180)

    • Connects to the CnC server

      • 6882.tmp.fcxcx.exe (PID: 6180)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • file.exe (PID: 6440)
      • explorer.exe (PID: 4488)
      • 665E.tmp.ctx.exe (PID: 7128)

    • Process drops legitimate windows executable

      • file.exe (PID: 6440)
      • 665E.tmp.ctx.exe (PID: 7128)

    • Potential Corporate Privacy Violation

      • explorer.exe (PID: 4488)

    • Starts a Microsoft application from unusual location

      • file.exe (PID: 6440)

    • Process drops python dynamic module

      • 665E.tmp.ctx.exe (PID: 7128)

    • Process requests binary or script from the Internet

      • explorer.exe (PID: 4488)

    • Connects to the server without a host name

      • explorer.exe (PID: 4488)

    • Loads Python modules

      • 665E.tmp.ctx.exe (PID: 6236)

    • The process drops C-runtime libraries

      • 665E.tmp.ctx.exe (PID: 7128)

    • Application launched itself

      • 665E.tmp.ctx.exe (PID: 7128)

    • Connects to unusual port

      • 6882.tmp.fcxcx.exe (PID: 6180)

    • Found regular expressions for crypto-addresses (YARA)

      • svchost.exe (PID: 6476)

    • There is functionality for taking screenshot (YARA)

      • svchost.exe (PID: 6476)

  • INFO

    • The sample compiled with english language support

      • file.exe (PID: 6440)
      • 665E.tmp.ctx.exe (PID: 7128)

    • Creates files or folders in the user directory

      • file.exe (PID: 6440)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 4488)
      • backgroundTaskHost.exe (PID: 6740)
      • RuntimeBroker.exe (PID: 6272)
      • backgroundTaskHost.exe (PID: 6764)

    • Reads the time zone

      • MusNotificationUx.exe (PID: 6836)
      • MusNotifyIcon.exe (PID: 7096)
      • WmiPrvSE.exe (PID: 2728)

    • Creates files in the program directory

      • MusNotificationUx.exe (PID: 6836)
      • svchost.exe (PID: 6980)

    • Checks supported languages

      • file.exe (PID: 6440)
      • 665E.tmp.ctx.exe (PID: 7128)
      • 6882.tmp.fcxcx.exe (PID: 6180)
      • 665E.tmp.ctx.exe (PID: 6236)

    • Reads the software policy settings

      • WaaSMedicAgent.exe (PID: 6892)
      • backgroundTaskHost.exe (PID: 6764)
      • SIHClient.exe (PID: 5080)

    • Create files in a temporary directory

      • explorer.exe (PID: 4488)
      • 665E.tmp.ctx.exe (PID: 7128)

    • Reads the computer name

      • 665E.tmp.ctx.exe (PID: 7128)
      • 6882.tmp.fcxcx.exe (PID: 6180)

    • The process uses the downloaded file

      • explorer.exe (PID: 4488)

    • Reads the machine GUID from the registry

      • 665E.tmp.ctx.exe (PID: 6236)
      • 6882.tmp.fcxcx.exe (PID: 6180)

    • Reads Windows Product ID

      • WmiPrvSE.exe (PID: 2728)

    • Drops encrypted VBS script (Microsoft Script Encoder)

      • 6882.tmp.fcxcx.exe (PID: 6180)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:12:11 08:42:08+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 10
CodeSize: 14848
InitializedDataSize: 10752
UninitializedDataSize: -
EntryPoint: 0x345c
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 2.0.0.1
ProductVersionNumber: 2.0.0.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: System
FileVersion: 2.0.0.1
InternalName: Services.exe
LegalCopyright: Copyright (C) 2025
OriginalFileName: Services.exe
ProductName: Services
ProductVersion: 2.0.0.1
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
20
Malicious processes
7
Suspicious processes
1

Behavior graph

Click at the process to see the details
start file.exe svchost.exe no specs msiexec.exe audiodg.exe explorer.exe 665e.tmp.ctx.exe #REDLINE 6882.tmp.fcxcx.exe 665e.tmp.ctx.exe no specs runtimebroker.exe no specs backgroundtaskhost.exe no specs backgroundtaskhost.exe musnotificationux.exe no specs waasmedicagent.exe no specs conhost.exe no specs svchost.exe no specs musnotifyicon.exe no specs 7092.tmp.vvv.exe no specs wmiprvse.exe no specs sihclient.exe svchost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2132C:\WINDOWS\system32\svchost.exe -k wusvcs -p -s WaaSMedicSvcC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2728C:\WINDOWS\system32\wbem\wmiprvse.exe -secured -EmbeddingC:\Windows\System32\wbem\WmiPrvSE.exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
WMI Provider Host
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wbem\wmiprvse.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ncobjapi.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\wbem\fastprox.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
4488C:\WINDOWS\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\smartscreenps.dll
c:\windows\system32\mswsock.dll
c:\windows\system32\napinsp.dll
c:\windows\system32\pnrpnsp.dll
c:\windows\system32\wshbth.dll
c:\windows\system32\nlaapi.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\winrnr.dll
c:\windows\system32\fwpuclnt.dll
c:\windows\system32\rasadhlp.dll
5080C:\WINDOWS\System32\sihclient.exe /cv Xepf/9I1q06Q9ozUJoX9gQ.0.2C:\Windows\System32\SIHClient.exe
upfc.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
SIH Client
Exit code:
2379777
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sihclient.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\combase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\oleaut32.dll
6180"C:\Users\admin\AppData\Local\Temp\6882.tmp.fcxcx.exe" C:\Users\admin\AppData\Local\Temp\6882.tmp.fcxcx.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
XHP
Exit code:
0
Version:
12.9.1.22
Modules
Images
c:\users\admin\appdata\local\temp\6882.tmp.fcxcx.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6236"C:\Users\admin\AppData\Local\Temp\665E.tmp.ctx.exe" C:\Users\admin\AppData\Local\Temp\665E.tmp.ctx.exe—665E.tmp.ctx.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\665e.tmp.ctx.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6272C:\Windows\System32\RuntimeBroker.exe -EmbeddingC:\Windows\System32\RuntimeBroker.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Runtime Broker
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\runtimebroker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\powrprof.dll
6384"C:\Users\admin\AppData\Local\Temp\7092.tmp.vvv.exe" C:\Users\admin\AppData\Local\Temp\7092.tmp.vvv.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\7092.tmp.vvv.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\umpdc.dll
6440"C:\Users\admin\AppData\Local\Temp\file.exe" C:\Users\admin\AppData\Local\Temp\file.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
System
Exit code:
0
Version:
2.0.0.1
Modules
Images
c:\users\admin\appdata\local\temp\file.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6476"C:\WINDOWS\system32\svchost.exe"C:\Windows\System32\svchost.exe—file.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
17 944
Read events
17 796
Write events
145
Delete events
3

Modification events

(PID) Process:(4488) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Security and Maintenance\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
23004100430042006C006F0062000000000000000000000001000000780000006D000000
(PID) Process:(6440) file.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Services
Value:
C:\Users\admin\AppData\Roaming\2F33566DA0B91573532102\2F33566DA0B91573532102.exe
(PID) Process:(6492) audiodg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run
Operation:delete keyName:(default)
Value:
(PID) Process:(6492) audiodg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder
Operation:delete keyName:(default)
Value:
(PID) Process:(6492) audiodg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Services
Value:
C:\Users\admin\AppData\Roaming\2F33566DA0B91573532102\2F33566DA0B91573532102.exe
(PID) Process:(6484) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Services
Value:
C:\Users\admin\AppData\Roaming\2F33566DA0B91573532102\2F33566DA0B91573532102.exe
(PID) Process:(6740) backgroundTaskHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SearchSettings
Operation:writeName:SafeSearchMode
Value:
1
(PID) Process:(6740) backgroundTaskHost.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\Flighting
Operation:writeName:CachedFeatureString
Value:
(PID) Process:(6740) backgroundTaskHost.exeKey:\REGISTRY\A\{ee080948-b2ea-145a-6870-f9164b908eb9}\LocalState
Operation:writeName:BINGIDENTITY_PROP_USEREMAIL
Value:
000009C86508AD4CDB01
(PID) Process:(6740) backgroundTaskHost.exeKey:\REGISTRY\A\{ee080948-b2ea-145a-6870-f9164b908eb9}\LocalState
Operation:writeName:BINGIDENTITY_PROP_ACCOUNTTYPETEXT
Value:
000009C86508AD4CDB01
Executable files
54
Suspicious files
10
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
7128665E.tmp.ctx.exeC:\Users\admin\AppData\Local\Temp\_MEI71282\api-ms-win-core-datetime-l1-1-0.dllexecutable
MD5:5AF784F599437629DEEA9FE4E8EB4799
SHA256:7E5BD3EE263D09C7998E0D5FFA684906DDC56DA61536331C89C74B039DF00C7C
6440file.exeC:\Users\admin\AppData\Roaming\2F33566DA0B91573532102\2F33566DA0B91573532102.exeexecutable
MD5:FF1E7643A5C9294BD8E8FD743B323C8F
SHA256:25F4451B243D5E5B05EACCF5DD58E3CFCEE7969B145D9AAD7AFF6750AB9A6D0B
6980svchost.exeC:\ProgramData\regid.1991-06.com.microsoft\regid.1991-06.com.microsoft_Windows-10-Pro.swidtagxml
MD5:CAB432C4918E1CFF493C9668B2338104
SHA256:2CE9E3A7CF26A6706D8078C732D8211AEB76E9FAA5C6D3A026E32B077EDF23DF
4488explorer.exeC:\Users\admin\AppData\Local\Temp\665E.tmp.ctx.exeexecutable
MD5:AE2A4249C8389603933DF4F806546C96
SHA256:CBE157A18DF07D512F3E4939D048F6419163892BF0CC5D5694EAADC7809D2477
7128665E.tmp.ctx.exeC:\Users\admin\AppData\Local\Temp\_MEI71282\api-ms-win-core-errorhandling-l1-1-0.dllexecutable
MD5:8D6599D7C4897DCD0217070CCA074574
SHA256:A011260FAFAAAEFD7E7326D8D5290C6A76D55E5AF4E43FFA4DE5FEA9B08FA928
7128665E.tmp.ctx.exeC:\Users\admin\AppData\Local\Temp\_MEI71282\api-ms-win-core-debug-l1-1-0.dllexecutable
MD5:E1CA15CF0597C6743B3876AF23A96960
SHA256:990E46D8F7C9574A558EBDFCB8739FBCCBA59D0D3A2193C9C8E66807387A276D
7128665E.tmp.ctx.exeC:\Users\admin\AppData\Local\Temp\_MEI71282\_hashlib.pydexecutable
MD5:A6448BC5E5DA21A222DE164823ADD45C
SHA256:3692FC8E70E6E29910032240080FC8109248CE9A996F0A70D69ACF1542FCA69A
7128665E.tmp.ctx.exeC:\Users\admin\AppData\Local\Temp\_MEI71282\api-ms-win-core-file-l2-1-0.dllexecutable
MD5:7D4D4593B478B4357446C106B64E61F8
SHA256:0A6E2224CDE90A0D41926E8863F9956848FFBF19848E8855BD08953112AFC801
7128665E.tmp.ctx.exeC:\Users\admin\AppData\Local\Temp\_MEI71282\VCRUNTIME140.dllexecutable
MD5:0E675D4A7A5B7CCD69013386793F68EB
SHA256:BF5FF4603557C9959ACEC995653D052D9054AD4826DF967974EFD2F377C723D1
6836MusNotificationUx.exeC:\ProgramData\USOShared\Logs\User\NotificationUx.31f436cb-9fd7-45ef-95f1-be9085347324.1.etlbinary
MD5:5EE2585549EAEEBF332112A46579C460
SHA256:71AA23A0CA19E5878011C368E443DD3862B4E9735AC0295EC3DA83C0FDA71F07
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
40
DNS requests
17
Threats
52

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4328
svchost.exe
GET
200
23.32.238.34:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.32.238.34:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4328
svchost.exe
GET
200
23.215.121.133:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.215.121.133:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4488
explorer.exe
POST
200
185.81.68.147:80
http://185.81.68.147/tizhyf/gate.php?2F33566DA0B91573532102
unknown
—
—
malicious
4488
explorer.exe
POST
200
185.81.68.147:80
http://185.81.68.147/tizhyf/gate.php?2F33566DA0B91573532102
unknown
—
—
malicious
4488
explorer.exe
GET
—
185.81.68.147:80
http://185.81.68.147/ctx.exe
unknown
—
—
malicious
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4488
explorer.exe
GET
—
185.81.68.147:80
http://185.81.68.147/vvv.exe
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
23.32.238.34:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4328
svchost.exe
23.32.238.34:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4328
svchost.exe
23.215.121.133:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.215.121.133:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
2.16.204.148:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4488
explorer.exe
185.81.68.147:80
—
Chang Way Technologies Co. Limited
RU
malicious

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.32.238.34
  • 2.19.198.194
whitelisted
google.com
  • 142.250.185.110
whitelisted
www.microsoft.com
  • 23.215.121.133
whitelisted
www.bing.com
  • 2.16.204.148
  • 2.16.204.151
  • 2.16.204.146
  • 2.16.204.150
  • 2.16.204.144
  • 2.16.204.137
  • 2.16.204.139
  • 2.16.204.147
  • 2.16.204.141
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.74
  • 20.190.160.14
  • 40.126.32.133
  • 20.190.160.20
  • 20.190.160.22
  • 40.126.32.138
  • 40.126.32.68
  • 40.126.32.76
whitelisted
go.microsoft.com
  • 23.218.210.69
whitelisted
arc.msn.com
  • 20.74.47.205
whitelisted
fd.api.iris.microsoft.com
  • 20.103.156.88
whitelisted

Threats

PID
Process
Class
Message
4488
explorer.exe
A Network Trojan was detected
ET MALWARE Trojan Generic - POST To gate.php with no referer
4488
explorer.exe
A Network Trojan was detected
ET MALWARE Trojan Generic - POST To gate.php with no referer
4488
explorer.exe
A Network Trojan was detected
ET MALWARE Generic Request to gate.php Dotted-Quad
4488
explorer.exe
A Network Trojan was detected
ET MALWARE Generic Request to gate.php Dotted-Quad
4488
explorer.exe
A Network Trojan was detected
ET MALWARE Trojan Generic - POST To gate.php with no accept headers
4488
explorer.exe
A Network Trojan was detected
ET MALWARE Trojan Generic - POST To gate.php with no accept headers
4488
explorer.exe
A Network Trojan was detected
ET MALWARE Trojan Generic - POST To gate.php with no accept headers
4488
explorer.exe
A Network Trojan was detected
ET MALWARE Trojan Generic - POST To gate.php with no referer
4488
explorer.exe
A Network Trojan was detected
ET MALWARE Generic Request to gate.php Dotted-Quad
4488
explorer.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
No debug info