File name:

Adobe Download Manager.exe

Full analysis: https://app.any.run/tasks/9f3031b1-0217-46dc-82ae-8285c2425728
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Malware Trends Tracker     >>>
Analysis date: August 23, 2024, 21:24:44
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
rat
quasar
sinkhole
stealer
azorult
evasion
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

7648BEC482B7A6BB22407308C882CF12

SHA1:

EDB98D630998A2852DE05C4C2B5D9A3400F52418

SHA256:

2C6AB1EFE207F8A2F8528CE232DCD1E2FF0B0DD82C5B460F51457A7BF97F60D9

SSDEEP:

98304:GAGQX21RBt7QjTmcaTH/vU4do9Pcjq1GvXB1sg58N32+Rr181vWDZT3FcIwEAiRU:zQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops/Copies Quasar RAT executable

      • Adobe Download Manager.exe (PID: 6616)
      • windef.exe (PID: 6692)

    • Uses Task Scheduler to run other applications

      • Adobe Download Manager.exe (PID: 6616)
      • SystemPropertiesPerformance.exe (PID: 6228)

    • Changes the autorun value in the registry

      • windef.exe (PID: 6692)
      • winsock.exe (PID: 7160)
      • winsock.exe (PID: 6840)
      • winsock.exe (PID: 2868)
      • winsock.exe (PID: 5532)
      • winsock.exe (PID: 2680)
      • winsock.exe (PID: 2032)
      • winsock.exe (PID: 3660)
      • winsock.exe (PID: 4748)

    • QUASAR has been detected (YARA)

      • Adobe Download Manager.exe (PID: 6616)
      • winsock.exe (PID: 7160)
      • SystemPropertiesPerformance.exe (PID: 6228)
      • winsock.exe (PID: 6840)
      • winsock.exe (PID: 2868)
      • winsock.exe (PID: 5532)
      • winsock.exe (PID: 2680)
      • winsock.exe (PID: 2032)
      • winsock.exe (PID: 3660)
      • winsock.exe (PID: 4748)

    • AZORULT has been detected (SURICATA)

      • Adobe Download Manager.exe (PID: 6700)
      • SystemPropertiesPerformance.exe (PID: 6824)

    • Request for a sinkholed resource

      • Adobe Download Manager.exe (PID: 6700)

    • Connects to the CnC server

      • Adobe Download Manager.exe (PID: 6700)
      • SystemPropertiesPerformance.exe (PID: 6824)

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • Adobe Download Manager.exe (PID: 6616)
      • windef.exe (PID: 6692)

    • Reads the date of Windows installation

      • Adobe Download Manager.exe (PID: 6616)
      • SystemPropertiesPerformance.exe (PID: 6228)
      • winsock.exe (PID: 7160)
      • winsock.exe (PID: 6840)
      • winsock.exe (PID: 2868)
      • winsock.exe (PID: 5532)
      • winsock.exe (PID: 2680)
      • winsock.exe (PID: 2032)
      • winsock.exe (PID: 3660)

    • Reads security settings of Internet Explorer

      • Adobe Download Manager.exe (PID: 6616)
      • Adobe Download Manager.exe (PID: 6700)
      • SystemPropertiesPerformance.exe (PID: 6228)
      • SystemPropertiesPerformance.exe (PID: 6824)
      • winsock.exe (PID: 7160)
      • winsock.exe (PID: 6840)
      • winsock.exe (PID: 2868)
      • winsock.exe (PID: 5532)
      • winsock.exe (PID: 2680)
      • winsock.exe (PID: 2032)
      • winsock.exe (PID: 3660)

    • Executable content was dropped or overwritten

      • Adobe Download Manager.exe (PID: 6616)
      • windef.exe (PID: 6692)

    • Application launched itself

      • Adobe Download Manager.exe (PID: 6616)
      • SystemPropertiesPerformance.exe (PID: 6228)

    • Starts itself from another location

      • windef.exe (PID: 6692)

    • Executes application which crashes

      • vnc.exe (PID: 6660)
      • vnc.exe (PID: 6332)
      • winsock.exe (PID: 7160)
      • winsock.exe (PID: 6840)
      • winsock.exe (PID: 2868)
      • winsock.exe (PID: 5532)
      • winsock.exe (PID: 2680)
      • winsock.exe (PID: 2032)
      • winsock.exe (PID: 3660)

    • Connects to unusual port

      • Adobe Download Manager.exe (PID: 6700)
      • SystemPropertiesPerformance.exe (PID: 6824)

    • The process executes via Task Scheduler

      • SystemPropertiesPerformance.exe (PID: 6228)

    • Contacting a server suspected of hosting an CnC

      • Adobe Download Manager.exe (PID: 6700)
      • SystemPropertiesPerformance.exe (PID: 6824)

    • Checks for external IP

      • svchost.exe (PID: 2256)
      • windef.exe (PID: 6692)
      • winsock.exe (PID: 7160)
      • winsock.exe (PID: 6840)
      • winsock.exe (PID: 2868)
      • winsock.exe (PID: 5532)
      • winsock.exe (PID: 2680)
      • winsock.exe (PID: 2032)
      • winsock.exe (PID: 3660)
      • winsock.exe (PID: 4748)

    • Starts CMD.EXE for commands execution

      • winsock.exe (PID: 7160)
      • winsock.exe (PID: 6840)
      • winsock.exe (PID: 2868)
      • winsock.exe (PID: 5532)
      • winsock.exe (PID: 2680)
      • winsock.exe (PID: 2032)
      • winsock.exe (PID: 3660)

    • Starts application with an unusual extension

      • cmd.exe (PID: 1104)
      • cmd.exe (PID: 6512)
      • cmd.exe (PID: 2992)
      • cmd.exe (PID: 6268)
      • cmd.exe (PID: 3144)
      • cmd.exe (PID: 5976)
      • cmd.exe (PID: 3004)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 1104)
      • cmd.exe (PID: 6512)
      • cmd.exe (PID: 2992)
      • cmd.exe (PID: 6268)
      • cmd.exe (PID: 3144)
      • cmd.exe (PID: 5976)
      • cmd.exe (PID: 3004)

    • Executing commands from a ".bat" file

      • winsock.exe (PID: 7160)
      • winsock.exe (PID: 6840)
      • winsock.exe (PID: 2868)
      • winsock.exe (PID: 5532)
      • winsock.exe (PID: 2680)
      • winsock.exe (PID: 2032)
      • winsock.exe (PID: 3660)

    • The executable file from the user directory is run by the CMD process

      • winsock.exe (PID: 6840)
      • winsock.exe (PID: 2868)
      • winsock.exe (PID: 5532)
      • winsock.exe (PID: 2680)
      • winsock.exe (PID: 2032)
      • winsock.exe (PID: 3660)
      • winsock.exe (PID: 4748)

  • INFO

    • Reads mouse settings

      • Adobe Download Manager.exe (PID: 6616)
      • SystemPropertiesPerformance.exe (PID: 6228)

    • Reads the machine GUID from the registry

      • Adobe Download Manager.exe (PID: 6616)
      • Adobe Download Manager.exe (PID: 6700)
      • windef.exe (PID: 6692)
      • winsock.exe (PID: 7160)
      • SystemPropertiesPerformance.exe (PID: 6228)
      • windef.exe (PID: 6680)
      • SystemPropertiesPerformance.exe (PID: 6824)
      • winsock.exe (PID: 6840)
      • winsock.exe (PID: 2868)
      • winsock.exe (PID: 5532)
      • winsock.exe (PID: 2680)
      • winsock.exe (PID: 2032)
      • winsock.exe (PID: 3660)
      • winsock.exe (PID: 4748)

    • Reads the computer name

      • Adobe Download Manager.exe (PID: 6616)
      • Adobe Download Manager.exe (PID: 6700)
      • windef.exe (PID: 6692)
      • winsock.exe (PID: 7160)
      • windef.exe (PID: 6680)
      • SystemPropertiesPerformance.exe (PID: 6228)
      • SystemPropertiesPerformance.exe (PID: 6824)
      • winsock.exe (PID: 6840)
      • winsock.exe (PID: 2868)
      • winsock.exe (PID: 5532)
      • winsock.exe (PID: 2680)
      • winsock.exe (PID: 2032)
      • winsock.exe (PID: 3660)
      • winsock.exe (PID: 4748)

    • Checks supported languages

      • Adobe Download Manager.exe (PID: 6616)
      • vnc.exe (PID: 6660)
      • windef.exe (PID: 6692)
      • Adobe Download Manager.exe (PID: 6700)
      • winsock.exe (PID: 7160)
      • SystemPropertiesPerformance.exe (PID: 6228)
      • vnc.exe (PID: 6332)
      • windef.exe (PID: 6680)
      • SystemPropertiesPerformance.exe (PID: 6824)
      • chcp.com (PID: 2132)
      • winsock.exe (PID: 6840)
      • winsock.exe (PID: 2868)
      • chcp.com (PID: 1064)
      • chcp.com (PID: 7096)
      • winsock.exe (PID: 5532)
      • chcp.com (PID: 4772)
      • winsock.exe (PID: 2680)
      • winsock.exe (PID: 2032)
      • chcp.com (PID: 5900)
      • chcp.com (PID: 2904)
      • winsock.exe (PID: 3660)
      • winsock.exe (PID: 4748)
      • chcp.com (PID: 3964)

    • Create files in a temporary directory

      • Adobe Download Manager.exe (PID: 6616)
      • SystemPropertiesPerformance.exe (PID: 6228)
      • winsock.exe (PID: 7160)
      • winsock.exe (PID: 6840)
      • winsock.exe (PID: 2868)
      • winsock.exe (PID: 5532)
      • winsock.exe (PID: 2680)
      • winsock.exe (PID: 2032)
      • winsock.exe (PID: 3660)

    • Process checks computer location settings

      • Adobe Download Manager.exe (PID: 6616)
      • SystemPropertiesPerformance.exe (PID: 6228)
      • winsock.exe (PID: 7160)
      • winsock.exe (PID: 6840)
      • winsock.exe (PID: 2868)
      • winsock.exe (PID: 5532)
      • winsock.exe (PID: 2680)
      • winsock.exe (PID: 2032)
      • winsock.exe (PID: 3660)

    • Reads Environment values

      • Adobe Download Manager.exe (PID: 6700)
      • windef.exe (PID: 6692)
      • winsock.exe (PID: 7160)
      • SystemPropertiesPerformance.exe (PID: 6824)
      • winsock.exe (PID: 6840)
      • winsock.exe (PID: 2868)
      • winsock.exe (PID: 5532)
      • winsock.exe (PID: 2680)
      • winsock.exe (PID: 2032)
      • winsock.exe (PID: 3660)
      • winsock.exe (PID: 4748)

    • Checks proxy server information

      • Adobe Download Manager.exe (PID: 6700)
      • windef.exe (PID: 6692)
      • WerFault.exe (PID: 6904)
      • winsock.exe (PID: 7160)
      • WerFault.exe (PID: 6852)
      • SystemPropertiesPerformance.exe (PID: 6824)
      • WerFault.exe (PID: 1492)
      • winsock.exe (PID: 6840)
      • winsock.exe (PID: 2868)
      • WerFault.exe (PID: 1744)
      • WerFault.exe (PID: 1480)
      • winsock.exe (PID: 5532)
      • winsock.exe (PID: 2680)
      • WerFault.exe (PID: 4708)
      • WerFault.exe (PID: 6636)
      • WerFault.exe (PID: 6108)
      • winsock.exe (PID: 2032)
      • winsock.exe (PID: 3660)
      • WerFault.exe (PID: 3244)
      • winsock.exe (PID: 4748)

    • Reads the software policy settings

      • WerFault.exe (PID: 6904)
      • WerFault.exe (PID: 6852)
      • WerFault.exe (PID: 1492)
      • WerFault.exe (PID: 1744)
      • WerFault.exe (PID: 1480)
      • WerFault.exe (PID: 4708)
      • WerFault.exe (PID: 6636)
      • WerFault.exe (PID: 6108)
      • WerFault.exe (PID: 3244)

    • Disables trace logs

      • windef.exe (PID: 6692)
      • winsock.exe (PID: 7160)
      • winsock.exe (PID: 6840)
      • winsock.exe (PID: 2868)
      • winsock.exe (PID: 5532)
      • winsock.exe (PID: 2680)
      • winsock.exe (PID: 2032)
      • winsock.exe (PID: 3660)
      • winsock.exe (PID: 4748)

    • Creates files or folders in the user directory

      • windef.exe (PID: 6692)
      • WerFault.exe (PID: 6904)
      • winsock.exe (PID: 7160)
      • WerFault.exe (PID: 6852)
      • WerFault.exe (PID: 1492)
      • WerFault.exe (PID: 1744)
      • WerFault.exe (PID: 1480)
      • WerFault.exe (PID: 4708)
      • WerFault.exe (PID: 6636)
      • WerFault.exe (PID: 6108)
      • WerFault.exe (PID: 3244)

    • Changes the display of characters in the console

      • chcp.com (PID: 2132)
      • chcp.com (PID: 1064)
      • chcp.com (PID: 7096)
      • chcp.com (PID: 4772)
      • chcp.com (PID: 5900)
      • chcp.com (PID: 2904)
      • chcp.com (PID: 3964)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Quasar

(PID) Process(7160) winsock.exe
Version1.3.0.0
C2 (3)5.8.88.191:443
sockartek.icu:443
Sub_DirSubDir
Install_Namewinsock.exe
MutexQSR_MUTEX_0kBRNrRz5TDLEQouI0
Startupwin defender run
TagEbayProfiles
LogDirLogs
Signature
Certificate
(PID) Process(6840) winsock.exe
Version1.3.0.0
C2 (3)5.8.88.191:443
sockartek.icu:443
Sub_DirSubDir
Install_Namewinsock.exe
MutexQSR_MUTEX_0kBRNrRz5TDLEQouI0
Startupwin defender run
TagEbayProfiles
LogDirLogs
Signature
Certificate
(PID) Process(2868) winsock.exe
Version1.3.0.0
C2 (3)5.8.88.191:443
sockartek.icu:443
Sub_DirSubDir
Install_Namewinsock.exe
MutexQSR_MUTEX_0kBRNrRz5TDLEQouI0
Startupwin defender run
TagEbayProfiles
LogDirLogs
Signature
Certificate
(PID) Process(5532) winsock.exe
Version1.3.0.0
C2 (3)5.8.88.191:443
sockartek.icu:443
Sub_DirSubDir
Install_Namewinsock.exe
MutexQSR_MUTEX_0kBRNrRz5TDLEQouI0
Startupwin defender run
TagEbayProfiles
LogDirLogs
Signature
Certificate
(PID) Process(2680) winsock.exe
Version1.3.0.0
C2 (3)5.8.88.191:443
sockartek.icu:443
Sub_DirSubDir
Install_Namewinsock.exe
MutexQSR_MUTEX_0kBRNrRz5TDLEQouI0
Startupwin defender run
TagEbayProfiles
LogDirLogs
Signature
Certificate
(PID) Process(2032) winsock.exe
Version1.3.0.0
C2 (3)5.8.88.191:443
sockartek.icu:443
Sub_DirSubDir
Install_Namewinsock.exe
MutexQSR_MUTEX_0kBRNrRz5TDLEQouI0
Startupwin defender run
TagEbayProfiles
LogDirLogs
Signature
Certificate
(PID) Process(3660) winsock.exe
Version1.3.0.0
C2 (3)5.8.88.191:443
sockartek.icu:443
Sub_DirSubDir
Install_Namewinsock.exe
MutexQSR_MUTEX_0kBRNrRz5TDLEQouI0
Startupwin defender run
TagEbayProfiles
LogDirLogs
Signature
Certificate
(PID) Process(4748) winsock.exe
Version1.3.0.0
C2 (3)5.8.88.191:443
sockartek.icu:443
Sub_DirSubDir
Install_Namewinsock.exe
MutexQSR_MUTEX_0kBRNrRz5TDLEQouI0
Startupwin defender run
TagEbayProfiles
LogDirLogs
Signature
Certificate
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (17.3)
.dll | Win32 Dynamic Link Library (generic) (4.1)
.exe | Win32 Executable (generic) (2.8)
.exe | Generic Win/DOS Executable (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:03:12 13:38:44+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 581120
InitializedDataSize: 1527296
UninitializedDataSize: -
EntryPoint: 0x27dcd
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: Adobe Download Manager
OriginalFileName: Adobe Download Manager
CompanyName: Adobe Systems Incorporated
FileVersion: ...
LegalCopyright: Copyright 2018 Adobe Incorporated. All rights reserved.
ProductName: Adobe Download Manager
ProductVersion: ...
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
204
Monitored processes
60
Malicious processes
21
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #QUASAR adobe download manager.exe vnc.exe svchost.exe no specs windef.exe #AZORULT adobe download manager.exe schtasks.exe no specs conhost.exe no specs werfault.exe #QUASAR winsock.exe svchost.exe #QUASAR systempropertiesperformance.exe no specs vnc.exe svchost.exe no specs windef.exe no specs werfault.exe #AZORULT systempropertiesperformance.exe schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs werfault.exe #QUASAR winsock.exe cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs werfault.exe #QUASAR winsock.exe cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs werfault.exe #QUASAR winsock.exe cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs werfault.exe #QUASAR winsock.exe cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs werfault.exe #QUASAR winsock.exe cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs werfault.exe #QUASAR winsock.exe cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs werfault.exe #QUASAR winsock.exe

Process information

PID
CMD
Path
Indicators
Parent process
236C:\WINDOWS\system32\svchost.exe -kC:\Windows\System32\svchost.exe—vnc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
780\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1064chcp 65001C:\Windows\SysWOW64\chcp.com—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Change CodePage Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\chcp.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1104C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Iof31Hixriys.bat" "C:\Windows\SysWOW64\cmd.exe—winsock.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1432\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1480C:\WINDOWS\SysWOW64\WerFault.exe -u -p 2868 -s 1844C:\Windows\SysWOW64\WerFault.exe
winsock.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1492C:\WINDOWS\SysWOW64\WerFault.exe -u -p 7160 -s 2084C:\Windows\SysWOW64\WerFault.exe
winsock.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1668ping -n 10 localhost C:\Windows\SysWOW64\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1684ping -n 10 localhost C:\Windows\SysWOW64\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1744C:\WINDOWS\SysWOW64\WerFault.exe -u -p 6840 -s 2064C:\Windows\SysWOW64\WerFault.exe
winsock.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
85 456
Read events
85 320
Write events
136
Delete events
0

Modification events

(PID) Process:(6616) Adobe Download Manager.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6616) Adobe Download Manager.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6616) Adobe Download Manager.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6616) Adobe Download Manager.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6700) Adobe Download Manager.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6700) Adobe Download Manager.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6700) Adobe Download Manager.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6700) Adobe Download Manager.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6700) Adobe Download Manager.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6700) Adobe Download Manager.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
Executable files
4
Suspicious files
14
Text files
25
Unknown types
0

Dropped files

PID
Process
Filename
Type
6904WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_vnc.exe_11dadb6a71afb88abcfcb9dd2dff3abfa557f294_c40a04ad_7dca3aeb-a304-411d-a22e-f65e7652a95d\Report.wer —
MD5:—
SHA256:—
6852WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_vnc.exe_11dadb6a71afb88abcfcb9dd2dff3abfa557f294_c40a04ad_7d03bf38-42b8-440f-840e-7a74aa2899a8\Report.wer —
MD5:—
SHA256:—
1492WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_winsock.exe_4ec29f32368eb0b92941df6619f6579b4b16f5a8_e8bd1e0d_663422c4-ed76-4138-a54c-9abf212af209\Report.wer —
MD5:—
SHA256:—
1492WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\winsock.exe.7160.dmp —
MD5:—
SHA256:—
7160winsock.exeC:\Users\admin\AppData\Roaming\Logs\08-23-2024binary
MD5:83F7247B826E6C6E2C686E04AA6877D8
SHA256:62733E127D0CAE8674CFA403A8C5CC42D9C85CD12CE633D35801A4E0A8F3A1A9
6852WerFault.exeC:\ProgramData\Microsoft\Windows\WER\Temp\WER847.tmp.xmlxml
MD5:F713A278570FF6AFA7CF87E7609EE42B
SHA256:3ECCD6E4D67ABA71B712B86EB5E8CD18B2DBDE2EE7B26059698445AF51AF2CFD
7160winsock.exeC:\Users\admin\AppData\Local\Temp\Iof31Hixriys.battext
MD5:4C4606D40860D49AD348CB37554DFE82
SHA256:6F456D76E45AD0B560B8BCA696BB7733B9AF1B2966A9E820F79D33D56D950CB5
6852WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\vnc.exe.6332.dmpbinary
MD5:B5B6B44EE41511F2BE832FFF7EBD02BF
SHA256:63A5784F091AD5633B56D994B13005405BD1FB11E886F64F3D34FEF0273D717B
1744WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_winsock.exe_4ec29f32368eb0b92941df6619f6579b4b16f5a8_e8bd1e0d_a05ebe9d-d5c9-4640-b60b-5c5cfbaf1a24\Report.wer —
MD5:—
SHA256:—
1744WerFault.exeC:\Users\admin\AppData\Local\CrashDumps\winsock.exe.6840.dmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
60
DNS requests
37
Threats
36

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6700
Adobe Download Manager.exe
POST
200
44.221.84.105:8000
http://0x21.in:8000/_az/
unknown
—
—
unknown
6700
Adobe Download Manager.exe
POST
—
44.221.84.105:8000
http://0x21.in:8000/_az/
unknown
—
—
unknown
6692
windef.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
—
—
shared
7160
winsock.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
—
—
shared
6824
SystemPropertiesPerformance.exe
POST
—
44.221.84.105:8000
http://0x21.in:8000/_az/
unknown
—
—
unknown
6824
SystemPropertiesPerformance.exe
POST
200
44.221.84.105:8000
http://0x21.in:8000/_az/
unknown
—
—
unknown
5372
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6496
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6936
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6840
winsock.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
—
—
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2480
RUXIMICS.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2120
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2876
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6700
Adobe Download Manager.exe
44.221.84.105:8000
0x21.in
AMAZON-AES
US
unknown
6904
WerFault.exe
52.182.143.212:443
watson.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
6692
windef.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
unknown
7160
winsock.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
unknown
7160
winsock.exe
5.8.88.191:443
—
PINVDS OU
RU
malicious
2876
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.110
whitelisted
0x21.in
  • 44.221.84.105
unknown
watson.events.data.microsoft.com
  • 52.182.143.212
  • 20.189.173.22
  • 20.189.173.21
  • 52.168.117.173
  • 104.208.16.94
whitelisted
ip-api.com
  • 208.95.112.1
shared
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
  • 51.124.78.146
whitelisted
client.wns.windows.com
  • 20.198.162.76
whitelisted
login.live.com
  • 40.126.32.134
  • 40.126.32.72
  • 20.190.160.20
  • 20.190.160.22
  • 40.126.32.74
  • 20.190.160.17
  • 20.190.160.14
  • 40.126.32.138
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
slscr.update.microsoft.com
  • 13.85.23.86
whitelisted

Threats

PID
Process
Class
Message
6700
Adobe Download Manager.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
6700
Adobe Download Manager.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/AZORult V3.2 Client Checkin M13
6700
Adobe Download Manager.exe
Malware Command and Control Activity Detected
ET MALWARE Win32/AZORult V3.2 Client Checkin M13
6700
Adobe Download Manager.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst
2256
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
6692
windef.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
2256
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
6692
windef.exe
A Network Trojan was detected
ET MALWARE Common RAT Connectivity Check Observed
7160
winsock.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
7160
winsock.exe
A Network Trojan was detected
ET MALWARE Common RAT Connectivity Check Observed
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Adobe Download Manager.exe