File name:

Attachment1.1.htm

Full analysis: https://app.any.run/tasks/8b9ef998-facc-4e2f-a6b5-60f2718e52c3
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 14, 2019, 08:25:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: text/html
File info: HTML document, Non-ISO extended-ASCII text, with very long lines, with CRLF, LF line terminators
MD5:

0989C189E6BCA8D6E28BD3B01F0B7CED

SHA1:

E7EC184DCD65C08EE45A37E6A1EA03F826E6ED1B

SHA256:

2729807C953493FE35B912DB05C3917710D5CB41EDF36582969D1D786748C86F

SSDEEP:

768:IjYLgjgOCjC9KGKWHeYEYRJaszjo8jLojo7hjjoitjMj0:SYL6dfXOM9G0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • mail[1].exe (PID: 3392)
      • mailmaster.exe (PID: 3192)
      • setup.exe (PID: 2744)
      • mailmaster.exe (PID: 3204)
      • setup.exe (PID: 2924)

    • Downloads executable files from the Internet

      • iexplore.exe (PID: 3908)

    • Loads dropped or rewritten executable

      • svchost.exe (PID: 844)
      • mailmaster.exe (PID: 3192)
      • setup.exe (PID: 2924)
      • mailmaster.exe (PID: 3204)

    • Changes the autorun value in the registry

      • setup.exe (PID: 2924)

  • SUSPICIOUS

    • Reads Internet Cache Settings

      • OUTLOOK.EXE (PID: 3164)

    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 3164)
      • setup.exe (PID: 2924)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3500)
      • iexplore.exe (PID: 3908)
      • mail[1].exe (PID: 3392)
      • setup.exe (PID: 2924)

    • Application launched itself

      • setup.exe (PID: 2744)
      • mailmaster.exe (PID: 3192)

    • Creates a software uninstall entry

      • setup.exe (PID: 2924)

    • Creates COM task schedule object

      • setup.exe (PID: 2924)

    • Modifies the open verb of a shell class

      • setup.exe (PID: 2924)

    • Connects to unusual port

      • mailmaster.exe (PID: 3192)

    • Creates files in the program directory

      • setup.exe (PID: 2924)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 3500)

    • Application launched itself

      • iexplore.exe (PID: 3500)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3756)
      • iexplore.exe (PID: 3908)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3756)
      • iexplore.exe (PID: 3500)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3756)
      • iexplore.exe (PID: 3500)
      • iexplore.exe (PID: 3908)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 4048)
      • OUTLOOK.EXE (PID: 3164)

    • Creates files in the user directory

      • iexplore.exe (PID: 3908)

    • Dropped object may contain Bitcoin addresses

      • setup.exe (PID: 2924)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.html | HyperText Markup Language (100)

EXIF

HTML

ContentType: text/html; charset=utf-8
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
13
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start start drop and start iexplore.exe iexplore.exe iexplore.exe outlook.exe no specs outlook.exe outlook.exe no specs outlook.exe no specs mail[1].exe setup.exe setup.exe mailmaster.exe svchost.exe mailmaster.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
844C:\Windows\system32\svchost.exe -k netsvcsC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2744"C:\Users\admin\AppData\Local\Temp\CR_0F9E2.tmp\setup.exe" --install-archive="C:\Users\admin\AppData\Local\Temp\CR_0F9E2.tmp\MAILMASTER.PACKED.7Z" --verbose-logging --mini_installer="C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\mail[1].exe" --mailmaster-channel="81"C:\Users\admin\AppData\Local\Temp\CR_0F9E2.tmp\setup.exe
mail[1].exe
User:
admin
Company:
NetEase(Hangzhou) Network Co. Ltd.
Integrity Level:
MEDIUM
Description:
网易邮箱大师安装程序
Exit code:
0
Version:
4.12.1.1011
Modules
Images
c:\users\admin\appdata\local\temp\cr_0f9e2.tmp\setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\psapi.dll
c:\windows\system32\user32.dll
2924"C:\Users\admin\AppData\Local\Temp\CR_0F9E2.tmp\setup.exe" --install-archive="C:\Users\admin\AppData\Local\Temp\CR_0F9E2.tmp\MAILMASTER.PACKED.7Z" --verbose-logging --mini_installer="C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\mail[1].exe" --mailmaster-channel=81 --run-as-admin --system-levelC:\Users\admin\AppData\Local\Temp\CR_0F9E2.tmp\setup.exe
setup.exe
User:
admin
Company:
NetEase(Hangzhou) Network Co. Ltd.
Integrity Level:
HIGH
Description:
网易邮箱大师安装程序
Exit code:
62
Version:
4.12.1.1011
Modules
Images
c:\users\admin\appdata\local\temp\cr_0f9e2.tmp\setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\psapi.dll
c:\windows\system32\user32.dll
3164"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" -c IPM.Note /m "mailto:amilia_mw84@163.com"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
Modules
Images
c:\progra~1\micros~1\office14\outlook.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
3192"C:\Program Files\Netease\MailMaster\Application\mailmaster.exe" --setup-first-runC:\Program Files\Netease\MailMaster\Application\mailmaster.exe
setup.exe
User:
admin
Company:
NetEase(Hangzhou) Network Co. Ltd.
Integrity Level:
MEDIUM
Description:
网易邮箱大师
Exit code:
0
Version:
4.12.1.1011
Modules
Images
c:\program files\netease\mailmaster\application\mailmaster.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
3200"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" -c IPM.Note /m "mailto:amilia_mw84@163.com"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
Modules
Images
c:\progra~1\micros~1\office14\outlook.exe
c:\systemroot\system32\ntdll.dll
3204"C:\Program Files\Netease\MailMaster\Application\mailmaster.exe" --type=renderer --force-device-scale-factor=1 --lang=en-US --lang=zh-CN --log-file="C:\Users\admin\AppData\Local\Netease\MailMaster\logs\web.log" --product-version="Chrome/49.0.2623.110 MailMasterPC/4.12.1.1011" --device-scale-factor=1 --num-raster-threads=2 --content-image-texture-target=3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553,3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="3192.0.694888999\1630087761" /prefetch:1C:\Program Files\Netease\MailMaster\Application\mailmaster.exe—mailmaster.exe
User:
admin
Company:
NetEase(Hangzhou) Network Co. Ltd.
Integrity Level:
LOW
Description:
网易邮箱大师
Exit code:
0
Version:
4.12.1.1011
Modules
Images
c:\program files\netease\mailmaster\application\mailmaster.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
3392"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\mail[1].exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\mail[1].exe
iexplore.exe
User:
admin
Company:
NetEase(Hangzhou) Network Co. Ltd.
Integrity Level:
MEDIUM
Description:
网易邮箱大师安装程序
Exit code:
0
Version:
4.12.1.1011
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\rb73mz6y\mail[1].exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
3500"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\Attachment1.1.htm.htmlC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3560"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" -c IPM.Note /m "mailto:amilia_mw84@163.com"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
Modules
Images
c:\progra~1\micros~1\office14\outlook.exe
c:\systemroot\system32\ntdll.dll
Total events
3 511
Read events
2 858
Write events
627
Delete events
26

Modification events

(PID) Process:(3500) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3500) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3500) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3500) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(3500) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3500) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000069000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3500) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery\Active
Operation:writeName:{2DFBECF9-3032-11E9-91D7-5254004A04AF}
Value:
0
(PID) Process:(3500) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Type
Value:
4
(PID) Process:(3500) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Count
Value:
3
(PID) Process:(3500) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2670000A-7350-4F3C-8081-5663EE0C6C49}\iexplore
Operation:writeName:Time
Value:
E307020004000E0008001A000A00C101
Executable files
12
Suspicious files
67
Text files
141
Unknown types
19

Dropped files

PID
Process
Filename
Type
3500iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\favicon[1].ico —
MD5:—
SHA256:—
3500iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
3500iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFED7E1C2C0A0A767B.TMP —
MD5:—
SHA256:—
3164OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR2074.tmp.cvr —
MD5:—
SHA256:—
3756iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012019021420190215\index.datdat
MD5:—
SHA256:—
844svchost.exeC:\Windows\appcompat\programs\RecentFileCache.bcftxt
MD5:—
SHA256:—
3164OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:—
SHA256:—
3500iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{4822B826-3032-11E9-91D7-5254004A04AF}.datbinary
MD5:—
SHA256:—
3756iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\qiyelogo_defaultAvatar[1].pngimage
MD5:8BC2158C19AD2EEB610F011DC18D2B64
SHA256:5F755AEC0DF2ADCF45542B63D257396F40E7E55318FAA26D6F289B9808823B9D
3908iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\dnserror[1]html
MD5:68E03ED57EC741A4AFBBCD11FAB1BDBE
SHA256:1FF3334C3EB27033F8F37029FD72F648EDD4551FCE85FC1F5159FEAEA1439630
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
66
TCP/UDP connections
36
DNS requests
16
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3164
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
—
—
whitelisted
3908
iexplore.exe
GET
200
54.64.105.68:80
http://mail.163.com/dashi/?from=mail81&gotodownload=1
JP
html
5.06 Kb
shared
3908
iexplore.exe
GET
200
103.129.252.34:80
http://mimg.127.net/hxm/dashi-home/p/20151107/js/respond-1854be559b.js
unknown
html
2.09 Kb
suspicious
3908
iexplore.exe
GET
200
103.129.252.34:80
http://mimg.127.net/hxm/dashi-home/p/20151107/style/css/index-6531a18a74.css
unknown
text
2.84 Kb
suspicious
3908
iexplore.exe
GET
200
103.129.252.34:80
http://mimg.127.net/hxm/dashi-home/p/20151107/style/img/newHome/section1/02_logo-7b5a16da8d.png
unknown
image
3.18 Kb
suspicious
3908
iexplore.exe
GET
200
103.129.252.34:80
http://mimg.127.net/hxm/dashi-home/p/20151107/style/img/newHome/weixin@2x-c0399c8b73.png
unknown
image
623 b
suspicious
3908
iexplore.exe
GET
200
103.129.252.34:80
http://mimg.127.net/hxm/dashi-home/p/20151107/style/css/common-6a923c3e0a.css
unknown
text
4.17 Kb
suspicious
3908
iexplore.exe
GET
200
103.129.252.34:80
http://mimg.127.net/hxm/dashi-home/p/20151107/style/css/common-6a923c3e0a.css
unknown
text
4.17 Kb
suspicious
3908
iexplore.exe
GET
200
103.129.252.34:80
http://mimg.127.net/hxm/dashi-home/p/20151107/style/img/newHome/WechatQR-7591fe4833.png
unknown
image
4.62 Kb
suspicious
3908
iexplore.exe
GET
200
103.129.252.34:80
http://mimg.127.net/hxm/dashi-home/p/20151107/style/img/newHome/section1/phone_bg1-b8769697a0.jpg
unknown
image
145 Kb
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3908
iexplore.exe
163.171.132.117:80
client.dl.126.net
—
US
malicious
3192
mailmaster.exe
123.58.182.103:443
update.client.163.com
Guangzhou NetEase Computer System Co., Ltd.
CN
unknown
3192
mailmaster.exe
103.129.252.32:8080
lbs.client.163.com
—
—
unknown
3192
mailmaster.exe
103.129.252.31:8080
lbs.client.163.com
—
—
unknown
3192
mailmaster.exe
123.58.182.102:80
update.client.163.com
Guangzhou NetEase Computer System Co., Ltd.
CN
unknown
3192
mailmaster.exe
103.129.252.32:9800
lbs.client.163.com
—
—
unknown
3192
mailmaster.exe
163.171.128.148:443
mail-online.nosdn.127.net
—
US
malicious
3192
mailmaster.exe
123.125.50.97:443
u.163.com
China Unicom Beijing Province Network
CN
unknown
3500
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3756
iexplore.exe
163.171.128.148:443
mail-online.nosdn.127.net
—
US
malicious

DNS requests

Domain
IP
Reputation
mail-online.nosdn.127.net
  • 163.171.128.148
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared
config.messenger.msn.com
  • 64.4.26.155
whitelisted
mail.163.com
  • 54.64.105.68
shared
mimg.127.net
  • 103.129.252.34
suspicious
stat.mail.163.com
  • 123.125.50.67
suspicious
u.163.com
  • 123.125.50.97
unknown
client.dl.126.net
  • 163.171.132.117
malicious
lbs.client.163.com
  • 103.129.252.32
  • 103.129.252.31
unknown

Threats

PID
Process
Class
Message
3908
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
Process
Message
setup.exe
[2744:2636:0214/082834:2530781:VERBOSE1:setup_main.cpp(109)] Command Line: "C:\Users\admin\AppData\Local\Temp\CR_0F9E2.tmp\setup.exe" --install-archive="C:\Users\admin\AppData\Local\Temp\CR_0F9E2.tmp\MAILMASTER.PACKED.7Z" --verbose-logging --mini_installer="C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\mail[1].exe" --mailmaster-channel=81
setup.exe
[2744:2636:0214/082834:2530781:VERBOSE1:install_util.cpp(169)] Windows NT 6.1 SP1
setup.exe
[2924:2896:0214/082836:2532203:VERBOSE1:setup_main.cpp(109)] Command Line: "C:\Users\admin\AppData\Local\Temp\CR_0F9E2.tmp\setup.exe" --install-archive="C:\Users\admin\AppData\Local\Temp\CR_0F9E2.tmp\MAILMASTER.PACKED.7Z" --verbose-logging --mini_installer="C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RB73MZ6Y\mail[1].exe" --mailmaster-channel=81 --run-as-admin --system-level
setup.exe
[2924:2896:0214/082836:2532203:VERBOSE1:install_util.cpp(169)] Windows NT 6.1 SP1
setup.exe
[2924:2896:0214/082836:2532218:INFO:install_service.cpp(163)] Checking Install path: C:\Program Files\Neteasewith install type: 1(1.new 2.down 3.eq 4.up)
setup.exe
[2924:2896:0214/082836:2532218:INFO:disk_util.cpp(33)] current path is match free space requirementC:\Program Files\Netease
setup.exe
[2924:2896:0214/082836:2532218:INFO:install_service.cpp(168)] Disk space is enough to install: C:\Program Files\Netease
setup.exe
[2924:2896:0214/082838:2534437:INFO:setup_window.cpp(219)] checking install path: C:\Program Files\Netease
setup.exe
[2924:3816:0214/082838:2534437:VERBOSE1:setup.cpp(662)] multi install is 0
setup.exe
[2924:3816:0214/082838:2534437:VERBOSE1:setup.cpp(665)] system install is 1
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Attachment1.1.htm