File name:

dxwebsetup.exe

Full analysis: https://app.any.run/tasks/3d483951-1ad5-4987-b4a1-b5bcd1ddfc41
Verdict: Malicious activity
Analysis date: December 15, 2024, 11:58:57
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, MS CAB-Installer self-extracting archive, 3 sections
MD5:

2CBD6AD183914A0C554F0739069E77D7

SHA1:

7BF35F2AFCA666078DB35CA95130BEB2E3782212

SHA256:

2CF71D098C608C56E07F4655855A886C3102553F648DF88458DF616B26FD612F

SSDEEP:

6144:kWK8fc2liXmrLxcdRDLiH1vVRGVOhMp421/7YQV:VcvgLARDI1KIOzO0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • dxwebsetup.exe (PID: 6272)

    • Executing a file with an untrusted certificate

      • infinst.exe (PID: 6900)
      • infinst.exe (PID: 6668)
      • infinst.exe (PID: 6684)
      • infinst.exe (PID: 6844)
      • infinst.exe (PID: 6940)
      • infinst.exe (PID: 6880)
      • infinst.exe (PID: 6860)
      • infinst.exe (PID: 5160)
      • infinst.exe (PID: 5316)
      • infinst.exe (PID: 6608)
      • infinst.exe (PID: 2828)
      • infinst.exe (PID: 7088)
      • infinst.exe (PID: 7116)
      • infinst.exe (PID: 3984)
      • infinst.exe (PID: 448)
      • infinst.exe (PID: 6292)
      • infinst.exe (PID: 3576)
      • infinst.exe (PID: 3568)
      • infinst.exe (PID: 4864)
      • infinst.exe (PID: 4160)
      • infinst.exe (PID: 7016)
      • infinst.exe (PID: 6464)
      • infinst.exe (PID: 2152)
      • infinst.exe (PID: 2844)
      • infinst.exe (PID: 432)
      • infinst.exe (PID: 4328)
      • infinst.exe (PID: 5040)
      • infinst.exe (PID: 1172)
      • infinst.exe (PID: 4012)
      • infinst.exe (PID: 3172)
      • infinst.exe (PID: 6376)
      • infinst.exe (PID: 6324)
      • infinst.exe (PID: 6416)
      • infinst.exe (PID: 6352)
      • infinst.exe (PID: 2088)
      • infinst.exe (PID: 5892)
      • infinst.exe (PID: 3220)
      • infinst.exe (PID: 6412)
      • infinst.exe (PID: 4360)
      • infinst.exe (PID: 6428)
      • infinst.exe (PID: 6400)
      • infinst.exe (PID: 7152)
      • infinst.exe (PID: 1016)
      • infinst.exe (PID: 6760)
      • infinst.exe (PID: 3552)
      • infinst.exe (PID: 6148)
      • infinst.exe (PID: 4520)
      • infinst.exe (PID: 2956)
      • infinst.exe (PID: 3144)
      • infinst.exe (PID: 2744)
      • infinst.exe (PID: 5256)
      • infinst.exe (PID: 5320)
      • infinst.exe (PID: 6912)
      • infinst.exe (PID: 6380)
      • infinst.exe (PID: 6904)
      • infinst.exe (PID: 6936)
      • infinst.exe (PID: 6864)
      • infinst.exe (PID: 5988)
      • infinst.exe (PID: 6916)
      • infinst.exe (PID: 1704)
      • infinst.exe (PID: 2076)
      • infinst.exe (PID: 4536)
      • infinst.exe (PID: 3820)
      • infinst.exe (PID: 7012)
      • infinst.exe (PID: 5964)
      • infinst.exe (PID: 5568)
      • infinst.exe (PID: 3984)
      • infinst.exe (PID: 7116)
      • infinst.exe (PID: 3912)
      • infinst.exe (PID: 4188)
      • infinst.exe (PID: 6292)
      • infinst.exe (PID: 448)
      • infinst.exe (PID: 3576)
      • infinst.exe (PID: 1512)

    • Registers / Runs the DLL via REGSVR32.EXE

      • dxwsetup.exe (PID: 6308)

    • Uses TASKKILL.EXE to kill security tools

      • cmd.exe (PID: 6408)
      • cmd.exe (PID: 3760)
      • cmd.exe (PID: 7148)
      • cmd.exe (PID: 5680)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • dxwebsetup.exe (PID: 6272)
      • dxwsetup.exe (PID: 6308)
      • infinst.exe (PID: 6900)
      • infinst.exe (PID: 6668)
      • infinst.exe (PID: 6844)
      • infinst.exe (PID: 6940)
      • infinst.exe (PID: 6880)
      • infinst.exe (PID: 6684)
      • infinst.exe (PID: 6860)
      • infinst.exe (PID: 5316)
      • infinst.exe (PID: 5160)
      • infinst.exe (PID: 2828)
      • infinst.exe (PID: 7088)
      • infinst.exe (PID: 6608)
      • infinst.exe (PID: 3984)
      • infinst.exe (PID: 7116)
      • infinst.exe (PID: 6292)
      • infinst.exe (PID: 448)
      • infinst.exe (PID: 3576)
      • infinst.exe (PID: 4864)
      • infinst.exe (PID: 4160)
      • infinst.exe (PID: 7016)
      • infinst.exe (PID: 3568)
      • infinst.exe (PID: 6464)
      • infinst.exe (PID: 2152)
      • infinst.exe (PID: 2844)
      • infinst.exe (PID: 4328)
      • infinst.exe (PID: 432)
      • infinst.exe (PID: 5040)
      • infinst.exe (PID: 1172)
      • infinst.exe (PID: 6324)
      • infinst.exe (PID: 4012)
      • infinst.exe (PID: 3172)
      • infinst.exe (PID: 6376)
      • infinst.exe (PID: 6416)
      • infinst.exe (PID: 6352)
      • infinst.exe (PID: 2088)
      • infinst.exe (PID: 5892)
      • infinst.exe (PID: 4360)
      • infinst.exe (PID: 3220)
      • infinst.exe (PID: 6412)
      • infinst.exe (PID: 6428)
      • infinst.exe (PID: 6400)
      • infinst.exe (PID: 7152)
      • infinst.exe (PID: 6760)
      • infinst.exe (PID: 3552)
      • infinst.exe (PID: 6148)
      • infinst.exe (PID: 1016)
      • infinst.exe (PID: 4520)
      • infinst.exe (PID: 2956)
      • infinst.exe (PID: 5320)
      • infinst.exe (PID: 2744)
      • infinst.exe (PID: 5256)
      • infinst.exe (PID: 3144)
      • infinst.exe (PID: 6380)
      • infinst.exe (PID: 6904)
      • infinst.exe (PID: 6912)
      • infinst.exe (PID: 6936)
      • infinst.exe (PID: 6864)
      • infinst.exe (PID: 6916)
      • infinst.exe (PID: 5988)
      • infinst.exe (PID: 4536)
      • infinst.exe (PID: 2076)
      • infinst.exe (PID: 1704)
      • infinst.exe (PID: 7012)
      • infinst.exe (PID: 5964)
      • infinst.exe (PID: 3820)
      • infinst.exe (PID: 5568)
      • infinst.exe (PID: 3984)
      • infinst.exe (PID: 3912)
      • infinst.exe (PID: 4188)
      • infinst.exe (PID: 448)
      • infinst.exe (PID: 6292)
      • infinst.exe (PID: 7116)
      • infinst.exe (PID: 3576)
      • infinst.exe (PID: 1512)

    • Executable content was dropped or overwritten

      • dxwebsetup.exe (PID: 6272)
      • dxwsetup.exe (PID: 6308)
      • infinst.exe (PID: 6900)
      • infinst.exe (PID: 6684)
      • infinst.exe (PID: 6668)
      • infinst.exe (PID: 6880)
      • infinst.exe (PID: 6844)
      • infinst.exe (PID: 6940)
      • infinst.exe (PID: 6860)
      • infinst.exe (PID: 5160)
      • infinst.exe (PID: 6608)
      • infinst.exe (PID: 2828)
      • infinst.exe (PID: 5316)
      • infinst.exe (PID: 7088)
      • infinst.exe (PID: 3984)
      • infinst.exe (PID: 7116)
      • infinst.exe (PID: 448)
      • infinst.exe (PID: 6292)
      • infinst.exe (PID: 3576)
      • infinst.exe (PID: 3568)
      • infinst.exe (PID: 4864)
      • infinst.exe (PID: 4160)
      • infinst.exe (PID: 7016)
      • infinst.exe (PID: 6464)
      • infinst.exe (PID: 2152)
      • infinst.exe (PID: 2844)
      • infinst.exe (PID: 5040)
      • infinst.exe (PID: 432)
      • infinst.exe (PID: 4328)
      • infinst.exe (PID: 4012)
      • infinst.exe (PID: 3172)
      • infinst.exe (PID: 1172)
      • infinst.exe (PID: 6324)
      • infinst.exe (PID: 6376)
      • infinst.exe (PID: 6416)
      • infinst.exe (PID: 6352)
      • infinst.exe (PID: 2088)
      • infinst.exe (PID: 4360)
      • infinst.exe (PID: 3220)
      • infinst.exe (PID: 5892)
      • infinst.exe (PID: 6428)
      • infinst.exe (PID: 6400)
      • infinst.exe (PID: 7152)
      • infinst.exe (PID: 6412)
      • infinst.exe (PID: 1016)
      • infinst.exe (PID: 6760)
      • infinst.exe (PID: 3552)
      • infinst.exe (PID: 4520)
      • infinst.exe (PID: 2956)
      • infinst.exe (PID: 3144)
      • infinst.exe (PID: 6148)
      • infinst.exe (PID: 5320)
      • infinst.exe (PID: 2744)
      • infinst.exe (PID: 5256)
      • infinst.exe (PID: 6380)
      • infinst.exe (PID: 6904)
      • infinst.exe (PID: 6916)
      • infinst.exe (PID: 6864)
      • infinst.exe (PID: 6912)
      • infinst.exe (PID: 6936)
      • infinst.exe (PID: 5988)
      • infinst.exe (PID: 2076)
      • infinst.exe (PID: 4536)
      • infinst.exe (PID: 1704)
      • infinst.exe (PID: 3820)
      • infinst.exe (PID: 7012)
      • infinst.exe (PID: 5964)
      • infinst.exe (PID: 3912)
      • infinst.exe (PID: 5568)
      • infinst.exe (PID: 3984)
      • infinst.exe (PID: 7116)
      • infinst.exe (PID: 4188)
      • infinst.exe (PID: 448)
      • infinst.exe (PID: 6292)
      • infinst.exe (PID: 3576)
      • infinst.exe (PID: 1512)

    • Starts a Microsoft application from unusual location

      • dxwebsetup.exe (PID: 6272)
      • dxwsetup.exe (PID: 6308)
      • dxwebsetup.exe (PID: 5916)

    • Reads security settings of Internet Explorer

      • dxwsetup.exe (PID: 6308)

    • Write to the desktop.ini file (may be used to cloak folders)

      • dxwsetup.exe (PID: 6308)

    • Searches for installed software

      • dllhost.exe (PID: 5300)

    • Executes as Windows Service

      • VSSVC.exe (PID: 716)

    • Checks Windows Trust Settings

      • dxwsetup.exe (PID: 6308)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 6948)
      • dxwsetup.exe (PID: 6308)
      • regsvr32.exe (PID: 1200)
      • regsvr32.exe (PID: 7012)
      • regsvr32.exe (PID: 5792)
      • regsvr32.exe (PID: 2496)
      • regsvr32.exe (PID: 4968)
      • regsvr32.exe (PID: 4132)
      • regsvr32.exe (PID: 2120)
      • regsvr32.exe (PID: 776)
      • regsvr32.exe (PID: 1292)
      • regsvr32.exe (PID: 6744)
      • regsvr32.exe (PID: 736)
      • regsvr32.exe (PID: 7076)
      • regsvr32.exe (PID: 5432)
      • regsvr32.exe (PID: 4056)
      • regsvr32.exe (PID: 5740)
      • regsvr32.exe (PID: 5680)
      • regsvr32.exe (PID: 5544)
      • regsvr32.exe (PID: 5880)
      • regsvr32.exe (PID: 6716)
      • regsvr32.exe (PID: 6892)
      • regsvr32.exe (PID: 7032)
      • regsvr32.exe (PID: 4724)
      • regsvr32.exe (PID: 848)
      • regsvr32.exe (PID: 2356)
      • regsvr32.exe (PID: 6576)
      • regsvr32.exe (PID: 4500)

    • Hides command output

      • cmd.exe (PID: 6408)
      • cmd.exe (PID: 3760)
      • cmd.exe (PID: 5460)
      • cmd.exe (PID: 424)
      • cmd.exe (PID: 732)
      • cmd.exe (PID: 6708)
      • cmd.exe (PID: 6692)
      • cmd.exe (PID: 7024)
      • cmd.exe (PID: 1536)
      • cmd.exe (PID: 7124)
      • cmd.exe (PID: 4628)
      • cmd.exe (PID: 4500)
      • cmd.exe (PID: 6988)
      • cmd.exe (PID: 4640)
      • cmd.exe (PID: 6376)
      • cmd.exe (PID: 2736)
      • cmd.exe (PID: 6252)
      • cmd.exe (PID: 5252)
      • cmd.exe (PID: 7148)
      • cmd.exe (PID: 5680)
      • cmd.exe (PID: 732)
      • cmd.exe (PID: 6664)
      • cmd.exe (PID: 6896)
      • cmd.exe (PID: 736)
      • cmd.exe (PID: 4668)
      • cmd.exe (PID: 7028)
      • cmd.exe (PID: 7116)
      • cmd.exe (PID: 536)
      • cmd.exe (PID: 5912)
      • cmd.exe (PID: 2680)
      • cmd.exe (PID: 3920)
      • cmd.exe (PID: 6492)
      • cmd.exe (PID: 6564)
      • cmd.exe (PID: 3824)
      • cmd.exe (PID: 6096)
      • cmd.exe (PID: 6408)
      • cmd.exe (PID: 7164)
      • cmd.exe (PID: 6012)
      • cmd.exe (PID: 3420)
      • cmd.exe (PID: 3144)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 5460)
      • cmd.exe (PID: 4640)
      • cmd.exe (PID: 732)
      • cmd.exe (PID: 5252)
      • cmd.exe (PID: 4668)
      • cmd.exe (PID: 6376)
      • cmd.exe (PID: 736)
      • cmd.exe (PID: 6252)
      • cmd.exe (PID: 7164)
      • cmd.exe (PID: 6012)
      • cmd.exe (PID: 3144)
      • cmd.exe (PID: 3420)
      • cmd.exe (PID: 3824)
      • cmd.exe (PID: 6408)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 732)
      • cmd.exe (PID: 6708)
      • cmd.exe (PID: 6692)
      • cmd.exe (PID: 424)
      • cmd.exe (PID: 2736)
      • cmd.exe (PID: 7124)
      • cmd.exe (PID: 4628)
      • cmd.exe (PID: 6988)
      • cmd.exe (PID: 7024)
      • cmd.exe (PID: 1536)
      • cmd.exe (PID: 4500)
      • cmd.exe (PID: 6664)
      • cmd.exe (PID: 6896)
      • cmd.exe (PID: 6096)
      • cmd.exe (PID: 536)
      • cmd.exe (PID: 5912)
      • cmd.exe (PID: 2680)
      • cmd.exe (PID: 6492)
      • cmd.exe (PID: 3920)
      • cmd.exe (PID: 6564)
      • cmd.exe (PID: 7028)
      • cmd.exe (PID: 7116)

    • Starts CMD.EXE for commands execution

      • sppednew.exe (PID: 3220)

  • INFO

    • The sample compiled with english language support

      • dxwebsetup.exe (PID: 6272)
      • dxwsetup.exe (PID: 6308)
      • infinst.exe (PID: 6900)
      • infinst.exe (PID: 6668)
      • infinst.exe (PID: 6880)
      • infinst.exe (PID: 6684)
      • infinst.exe (PID: 6844)
      • infinst.exe (PID: 6940)
      • infinst.exe (PID: 6860)
      • infinst.exe (PID: 5160)
      • infinst.exe (PID: 5316)
      • infinst.exe (PID: 2828)
      • infinst.exe (PID: 7088)
      • infinst.exe (PID: 6608)
      • infinst.exe (PID: 3984)
      • infinst.exe (PID: 448)
      • infinst.exe (PID: 7116)
      • infinst.exe (PID: 6292)
      • infinst.exe (PID: 3576)
      • infinst.exe (PID: 3568)
      • infinst.exe (PID: 4864)
      • infinst.exe (PID: 4160)
      • infinst.exe (PID: 7016)
      • infinst.exe (PID: 6464)
      • infinst.exe (PID: 2152)
      • infinst.exe (PID: 2844)
      • infinst.exe (PID: 4328)
      • infinst.exe (PID: 5040)
      • infinst.exe (PID: 1172)
      • infinst.exe (PID: 432)
      • infinst.exe (PID: 6324)
      • infinst.exe (PID: 4012)
      • infinst.exe (PID: 3172)
      • infinst.exe (PID: 6376)
      • infinst.exe (PID: 6416)
      • infinst.exe (PID: 6352)
      • infinst.exe (PID: 2088)
      • infinst.exe (PID: 5892)
      • infinst.exe (PID: 4360)
      • infinst.exe (PID: 3220)
      • infinst.exe (PID: 6412)
      • infinst.exe (PID: 6428)
      • infinst.exe (PID: 6400)
      • infinst.exe (PID: 7152)
      • infinst.exe (PID: 6760)
      • infinst.exe (PID: 3552)
      • infinst.exe (PID: 6148)
      • infinst.exe (PID: 1016)
      • infinst.exe (PID: 4520)
      • infinst.exe (PID: 2956)
      • infinst.exe (PID: 3144)
      • infinst.exe (PID: 5320)
      • infinst.exe (PID: 2744)
      • infinst.exe (PID: 5256)
      • infinst.exe (PID: 6380)
      • infinst.exe (PID: 6904)
      • infinst.exe (PID: 6916)
      • infinst.exe (PID: 6936)
      • infinst.exe (PID: 6864)
      • infinst.exe (PID: 6912)
      • infinst.exe (PID: 5988)
      • infinst.exe (PID: 4536)
      • infinst.exe (PID: 1704)
      • infinst.exe (PID: 2076)
      • infinst.exe (PID: 3820)
      • infinst.exe (PID: 7012)
      • infinst.exe (PID: 5964)
      • infinst.exe (PID: 5568)
      • infinst.exe (PID: 3984)
      • infinst.exe (PID: 3912)
      • infinst.exe (PID: 4188)
      • infinst.exe (PID: 448)
      • infinst.exe (PID: 6292)
      • infinst.exe (PID: 7116)
      • infinst.exe (PID: 1512)
      • infinst.exe (PID: 3576)

    • Create files in a temporary directory

      • dxwebsetup.exe (PID: 6272)
      • dxwsetup.exe (PID: 6308)

    • Checks supported languages

      • dxwebsetup.exe (PID: 6272)
      • dxwsetup.exe (PID: 6308)
      • infinst.exe (PID: 6900)
      • infinst.exe (PID: 6668)
      • infinst.exe (PID: 6684)
      • infinst.exe (PID: 6844)
      • infinst.exe (PID: 6940)
      • infinst.exe (PID: 6880)
      • infinst.exe (PID: 6860)
      • infinst.exe (PID: 5160)
      • infinst.exe (PID: 5316)
      • infinst.exe (PID: 6608)
      • infinst.exe (PID: 2828)
      • infinst.exe (PID: 3984)
      • infinst.exe (PID: 7116)
      • infinst.exe (PID: 7088)
      • infinst.exe (PID: 6292)
      • infinst.exe (PID: 448)
      • infinst.exe (PID: 3576)
      • infinst.exe (PID: 4864)
      • infinst.exe (PID: 4160)
      • infinst.exe (PID: 7016)
      • infinst.exe (PID: 3568)
      • infinst.exe (PID: 2152)
      • infinst.exe (PID: 2844)
      • infinst.exe (PID: 432)
      • infinst.exe (PID: 6464)
      • infinst.exe (PID: 4328)
      • infinst.exe (PID: 5040)
      • infinst.exe (PID: 1172)
      • infinst.exe (PID: 6324)
      • infinst.exe (PID: 4012)
      • infinst.exe (PID: 3172)
      • infinst.exe (PID: 6416)
      • infinst.exe (PID: 6352)
      • infinst.exe (PID: 2088)
      • infinst.exe (PID: 6376)
      • infinst.exe (PID: 4360)
      • infinst.exe (PID: 3220)
      • infinst.exe (PID: 6412)
      • infinst.exe (PID: 5892)
      • infinst.exe (PID: 6428)
      • infinst.exe (PID: 6400)
      • infinst.exe (PID: 7152)
      • infinst.exe (PID: 6760)
      • infinst.exe (PID: 3552)
      • infinst.exe (PID: 6148)
      • infinst.exe (PID: 1016)
      • infinst.exe (PID: 4520)
      • infinst.exe (PID: 2956)
      • infinst.exe (PID: 3144)
      • infinst.exe (PID: 2744)
      • infinst.exe (PID: 5256)
      • infinst.exe (PID: 5320)
      • infinst.exe (PID: 6912)
      • infinst.exe (PID: 6380)
      • infinst.exe (PID: 6904)
      • infinst.exe (PID: 6936)
      • infinst.exe (PID: 6864)
      • infinst.exe (PID: 6916)
      • infinst.exe (PID: 5988)
      • infinst.exe (PID: 1704)
      • infinst.exe (PID: 2076)
      • infinst.exe (PID: 4536)
      • infinst.exe (PID: 3912)
      • infinst.exe (PID: 5964)
      • infinst.exe (PID: 3820)
      • infinst.exe (PID: 7012)
      • infinst.exe (PID: 5568)
      • infinst.exe (PID: 3984)
      • infinst.exe (PID: 7116)
      • infinst.exe (PID: 4188)
      • infinst.exe (PID: 448)
      • infinst.exe (PID: 6292)
      • infinst.exe (PID: 3576)
      • infinst.exe (PID: 1512)
      • KA-LicenseKey_x86_x64_v1.1.exe (PID: 1744)
      • KA-MemIntegrity_x86_x64_v1.1.exe (PID: 640)
      • sppednew.exe (PID: 3220)

    • Reads the software policy settings

      • dxwsetup.exe (PID: 6308)

    • Sends debugging messages

      • dxwsetup.exe (PID: 6308)

    • Creates files or folders in the user directory

      • dxwsetup.exe (PID: 6308)

    • Reads the computer name

      • dxwsetup.exe (PID: 6308)
      • KA-LicenseKey_x86_x64_v1.1.exe (PID: 1744)
      • KA-MemIntegrity_x86_x64_v1.1.exe (PID: 640)
      • sppednew.exe (PID: 3220)

    • Checks proxy server information

      • dxwsetup.exe (PID: 6308)

    • Manages system restore points

      • SrTasks.exe (PID: 4592)

    • Reads the machine GUID from the registry

      • dxwsetup.exe (PID: 6308)

    • Manual execution by a user

      • WinRAR.exe (PID: 2120)
      • KA-LicenseKey_x86_x64_v1.1.exe (PID: 1744)
      • KA-LicenseKey_x86_x64_v1.1.exe (PID: 1916)
      • KA-MemIntegrity_x86_x64_v1.1.exe (PID: 6364)
      • KA-MemIntegrity_x86_x64_v1.1.exe (PID: 640)
      • sppednew.exe (PID: 3888)
      • sppednew.exe (PID: 3220)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 2120)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2120)

    • Gets the hash of the file via CERTUTIL.EXE

      • certutil.exe (PID: 6972)

    • Creates files in the program directory

      • sppednew.exe (PID: 3220)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2001:08:18 01:42:57+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 7
CodeSize: 34816
InitializedDataSize: 250368
UninitializedDataSize: -
EntryPoint: 0x5a5e
OSVersion: 5.1
ImageVersion: 5.1
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 6.0.2600.0
ProductVersionNumber: 6.0.2600.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: DirectX 9.0 Web setup
FileVersion: 9.29.1974.0
InternalName: DXWebSetup
LegalCopyright: Copyright (c) Microsoft Corporation. All rights reserved.
OriginalFileName: dxwebsetup.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 9.29.1974.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
378
Monitored processes
245
Malicious processes
77
Suspicious processes
4

Behavior graph

Click at the process to see the details
start dxwebsetup.exe dxwsetup.exe SPPSurrogate no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs infinst.exe infinst.exe infinst.exe infinst.exe infinst.exe infinst.exe infinst.exe regsvr32.exe no specs infinst.exe infinst.exe regsvr32.exe no specs infinst.exe infinst.exe regsvr32.exe no specs infinst.exe infinst.exe regsvr32.exe no specs infinst.exe infinst.exe regsvr32.exe no specs infinst.exe infinst.exe infinst.exe regsvr32.exe no specs infinst.exe regsvr32.exe no specs infinst.exe infinst.exe infinst.exe regsvr32.exe no specs infinst.exe infinst.exe infinst.exe infinst.exe regsvr32.exe no specs infinst.exe infinst.exe infinst.exe regsvr32.exe no specs infinst.exe infinst.exe infinst.exe infinst.exe regsvr32.exe no specs infinst.exe infinst.exe infinst.exe infinst.exe regsvr32.exe no specs infinst.exe regsvr32.exe no specs infinst.exe infinst.exe infinst.exe infinst.exe regsvr32.exe no specs infinst.exe regsvr32.exe no specs infinst.exe infinst.exe infinst.exe regsvr32.exe no specs infinst.exe regsvr32.exe no specs infinst.exe infinst.exe regsvr32.exe no specs infinst.exe regsvr32.exe no specs infinst.exe infinst.exe infinst.exe infinst.exe regsvr32.exe no specs infinst.exe regsvr32.exe no specs infinst.exe infinst.exe infinst.exe infinst.exe infinst.exe infinst.exe infinst.exe infinst.exe regsvr32.exe no specs infinst.exe regsvr32.exe no specs infinst.exe infinst.exe regsvr32.exe no specs infinst.exe regsvr32.exe no specs infinst.exe infinst.exe infinst.exe infinst.exe infinst.exe infinst.exe regsvr32.exe no specs infinst.exe regsvr32.exe no specs SPPSurrogate no specs winrar.exe rundll32.exe no specs ka-licensekey_x86_x64_v1.1.exe no specs ka-licensekey_x86_x64_v1.1.exe conhost.exe no specs ka-memintegrity_x86_x64_v1.1.exe no specs ka-memintegrity_x86_x64_v1.1.exe conhost.exe no specs sppednew.exe no specs sppednew.exe cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs taskkill.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs certutil.exe no specs find.exe no specs find.exe no specs svchost.exe dxwebsetup.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
424C:\WINDOWS\system32\cmd.exe /c taskkill /FI "IMAGENAME eq cheatengine*" /IM * /F /T >nul 2>&1C:\Windows\System32\cmd.exe—sppednew.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
424\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
432C:\Users\admin\AppData\Local\Temp\DX1E8F.tmp\infinst.exe d3dx10_34_x64.infC:\Users\admin\AppData\Local\Temp\DX1E8F.tmp\infinst.exe
dxwsetup.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\dx1e8f.tmp\infinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
448C:\Users\admin\AppData\Local\Temp\DX1E8F.tmp\infinst.exe XACT2_4_x64.infC:\Users\admin\AppData\Local\Temp\DX1E8F.tmp\infinst.exe
dxwsetup.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\dx1e8f.tmp\infinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
448C:\Users\admin\AppData\Local\Temp\DX1E8F.tmp\infinst.exe d3dcsx_43_x64.infC:\Users\admin\AppData\Local\Temp\DX1E8F.tmp\infinst.exe
dxwsetup.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
536C:\WINDOWS\system32\cmd.exe /c taskkill /FI "IMAGENAME eq wireshark*" /IM * /F /T >nul 2>&1C:\Windows\System32\cmd.exe—sppednew.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
640"C:\Users\admin\Desktop\speedy cracked\KA-MemIntegrity_x86_x64_v1.1.exe" C:\Users\admin\Desktop\speedy cracked\KA-MemIntegrity_x86_x64_v1.1.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
716C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
732C:\WINDOWS\system32\cmd.exe /c taskkill /FI "IMAGENAME eq httpdebugger*" /IM * /F /T >nul 2>&1C:\Windows\System32\cmd.exe—sppednew.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
732C:\WINDOWS\system32\cmd.exe /c sc stop HTTPDebuggerPro >nul 2>&1C:\Windows\System32\cmd.exe—sppednew.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Total events
21 286
Read events
20 959
Write events
307
Delete events
20

Modification events

(PID) Process:(6272) dxwebsetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:wextract_cleanup0
Value:
rundll32.exe C:\WINDOWS\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\admin\AppData\Local\Temp\IXP000.TMP\"
(PID) Process:(6308) dxwsetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6308) dxwsetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6308) dxwsetup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6308) dxwsetup.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
400000000000000072EF9AF9E84EDB01A4180000CC160000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5300) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Enter)
Value:
4800000000000000DF549DF9E84EDB01B4140000D0020000D20700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5300) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Leave)
Value:
48000000000000006253DBF9E84EDB01B4140000D0020000D10700000100000000000000010000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5300) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
480000000000000026B7DDF9E84EDB01B4140000D0020000D00700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5300) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppGetSnapshots (Leave)
Value:
48000000000000003EF0D8F9E84EDB01B4140000D0020000D20700000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(5300) dllhost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Operation:writeName:SppEnumGroups (Enter)
Value:
48000000000000003EF0D8F9E84EDB01B4140000D0020000D10700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
656
Suspicious files
1 045
Text files
55
Unknown types
15

Dropped files

PID
Process
Filename
Type
6272dxwebsetup.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.infini
MD5:AD8982EAA02C7AD4D7CDCBC248CAA941
SHA256:D63C35E9B43EB0F28FFC28F61C9C9A306DA9C9DE3386770A7EB19FAA44DBFC00
6272dxwebsetup.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\dsetup32.dllexecutable
MD5:A5412A144F63D639B47FCC1BA68CB029
SHA256:8A011DA043A4B81E2B3D41A332E0FF23A65D546BD7636E8BC74885E8746927D6
6308dxwsetup.exeC:\Windows\SysWOW64\directx\websetup\SET53D0.tmpexecutable
MD5:984CAD22FA542A08C5D22941B888D8DC
SHA256:57BC22850BB8E0BCC511A9B54CD3DA18EEC61F3088940C07D63B9B74E7FE2308
6308dxwsetup.exeC:\Windows\SysWOW64\directx\websetup\dsetup32.dllexecutable
MD5:A5412A144F63D639B47FCC1BA68CB029
SHA256:8A011DA043A4B81E2B3D41A332E0FF23A65D546BD7636E8BC74885E8746927D6
6272dxwebsetup.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\dsetup.dllexecutable
MD5:984CAD22FA542A08C5D22941B888D8DC
SHA256:57BC22850BB8E0BCC511A9B54CD3DA18EEC61F3088940C07D63B9B74E7FE2308
6308dxwsetup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\dxupdate[1].cabcompressed
MD5:4AFD7F5C0574A0EFD163740ECB142011
SHA256:6E39B3FDB6722EA8AA0DC8F46AE0D8BD6496DD0F5F56BAC618A0A7DD22D6CFB2
6308dxwsetup.exeC:\Windows\SysWOW64\directx\websetup\filelist.dattext
MD5:CC85D7649546D3C0B1607F761B73FEC2
SHA256:E1C85577FEE77B7535AF5918DE16479D5B38F08D7AADBF1B3613D275C7797920
6308dxwsetup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04der
MD5:BB71B013E563B7AE869761FE2B37C4E5
SHA256:114EB2409B821E694DF21047F77FB8B36D212D2C4766AC8ABF6814D6D594A274
6308dxwsetup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37C951188967C8EB88D99893D9D191FEder
MD5:FA84E4BCC92AA5DB735AB50711040CDE
SHA256:6D7205E794FDE4219A62D9692ECDDF612663A5CF20399E79BE87B851FCA4CA33
6308dxwsetup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C0018BB1B5834735BFA60CD063B31956binary
MD5:3E3AED1C0BA46C98A8EF6B3BEC083998
SHA256:3FAB079F84B987B1A1E305228BD9D2C7DC9A4033B62D3715073C009391FC949F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
172
TCP/UDP connections
46
DNS requests
21
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5340
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5340
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6308
dxwsetup.exe
GET
302
23.32.101.194:80
http://download.microsoft.com/download/1/7/1/1718CCC4-6315-4D8E-9543-8E28A4E18C4C/dxupdate.cab
unknown
—
—
whitelisted
6308
dxwsetup.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
6308
dxwsetup.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6308
dxwsetup.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5340
svchost.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5340
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
104.126.37.130:443
www.bing.com
Akamai International B.V.
DE
whitelisted
1176
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.181.238
whitelisted
www.bing.com
  • 104.126.37.130
  • 104.126.37.171
  • 104.126.37.128
  • 104.126.37.185
  • 104.126.37.136
  • 104.126.37.131
  • 104.126.37.186
  • 104.126.37.176
  • 104.126.37.123
whitelisted
login.live.com
  • 20.190.159.0
  • 20.190.159.4
  • 20.190.159.64
  • 20.190.159.2
  • 20.190.159.71
  • 40.126.31.67
  • 40.126.31.71
  • 20.190.159.68
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 23.35.238.131
  • 184.28.89.167
whitelisted
download.microsoft.com
  • 23.32.101.194
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted

Threats

PID
Process
Class
Message
2192
svchost.exe
Potentially Bad Traffic
ET INFO KeyAuth Open-source Authentication System Domain in DNS Lookup (keyauth .win)
3220
sppednew.exe
Potentially Bad Traffic
ET INFO KeyAuth Open-source Authentication System Domain (keyauth .win) in TLS SNI
Process
Message
dxwsetup.exe
Invalid parameter passed to C runtime function.
dxwsetup.exe
DLL_PROCESS_ATTACH
dxwsetup.exe
DLL_PROCESS_ATTACH
dxwsetup.exe
Invalid parameter passed to C runtime function.
dxwsetup.exe
DLL_PROCESS_DETACH
dxwsetup.exe
DLL_PROCESS_DETACH
dxwsetup.exe
DLL_PROCESS_ATTACH
dxwsetup.exe
DLL_PROCESS_ATTACH
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
dxwebsetup.exe