File name:

4363463463464363463463463.exe

Full analysis: https://app.any.run/tasks/2b205c3d-5301-44ac-8da0-a09c1f9aceff
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Analysis date: March 03, 2025, 13:46:50
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
github
loader
auto
meterpreter
hausbomber
opendir
qjwmonkey
adware
generic
asyncrat
rat
evasion
tool
rdp
screenconnect
autoit
remcos
tas17
quasarrat
njrat
telegram
python
discord
azorult
ransomware
stealer
m0yv
sinkhole
miner
xmrig
systembc
proxyware
metasploit
quasar
dcrat
netreactor
bladabindi
wmi-base64
api-base64
ims-api
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

2A94F3960C58C6E70826495F76D00B85

SHA1:

E2A1A5641295F5EBF01A37AC1C170AC0814BB71A

SHA256:

2FCAD226B17131DA4274E1B9F8F31359BDD325C9568665F08FD1F6C5D06A23CE

SSDEEP:

192:2we8sGKE6MqyG7c20L7BIW12n/ePSmzkTInu8stYcFwVc03KY:9e8sGKfMqyGg20PKn/cRaInuptYcFwVY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • METERPRETER has been found (auto)

      • 4363463463464363463463463.exe (PID: 7184)
    • HAUSBOMBER has been detected (YARA)

      • 4363463463464363463463463.exe (PID: 7184)
    • Uses Task Scheduler to autorun other applications

      • JJSPLOIT.V2.exe (PID: 6644)
      • windows 3543.exe (PID: 7608)
      • cmd.exe (PID: 4980)
      • Client-built.exe (PID: 4228)
      • runtime.exe (PID: 7204)
      • Mph.pif (PID: 7668)
      • cmd.exe (PID: 9196)
      • windows 3543.exe (PID: 896)
      • cmd.exe (PID: 7560)
      • Java32.exe (PID: 9992)
      • java.exe (PID: 9856)
      • discord.exe (PID: 10336)
      • java.exe (PID: 10604)
      • windows 3543.exe (PID: 11020)
      • java.exe (PID: 8380)
      • Origin.pif (PID: 10480)
      • java.exe (PID: 9972)
      • Mph.pif (PID: 9116)
      • java.exe (PID: 9484)
      • windows 3543.exe (PID: 6488)
      • java.exe (PID: 7532)
      • java.exe (PID: 10952)
      • java.exe (PID: 7400)
      • java.exe (PID: 10936)
      • java.exe (PID: 10380)
      • windows 3543.exe (PID: 3080)
    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 664)
    • GENERIC has been found (auto)

      • 4363463463464363463463463.exe (PID: 7184)
      • 4363463463464363463463463.exe (PID: 7184)
    • Actions looks like stealing of personal data

      • foobar2000_v1.6.7_beta_17@1704_129472.exe (PID: 7684)
    • QJWMONKEY mutex has been found

      • foobar2000_v1.6.7_beta_17@1704_129472.exe (PID: 7684)
    • SCREENCONNECT has been found (auto)

      • 4363463463464363463463463.exe (PID: 7184)
    • ASYNCRAT has been found (auto)

      • 4363463463464363463463463.exe (PID: 7184)
      • image%20logger.exe (PID: 7932)
      • imagelogger.exe (PID: 2564)
      • Discord3.exe (PID: 4464)
    • Executing a file with an untrusted certificate

      • rundrive.exe (PID: 7864)
      • kthtsg.exe (PID: 8864)
      • Installer.exe (PID: 780)
      • AdaptorOvernight.exe (PID: 9316)
    • Adds extension to the Windows Defender exclusion list

      • cmd.exe (PID: 8088)
      • per.exe (PID: 6080)
    • TAS17 has been detected

      • rundrive.exe (PID: 7864)
    • ASYNCRAT has been detected (MUTEX)

      • image%20logger.exe (PID: 7932)
      • AsyncClient.exe (PID: 5968)
      • syteam.exe (PID: 2284)
    • METASPLOIT has been detected (YARA)

      • crack.exe (PID: 6112)
    • QUASAR has been detected (YARA)

      • windows 3543.exe (PID: 7608)
    • REMCOS mutex has been found

      • prueba.exe (PID: 7176)
      • evetbeta.exe (PID: 1628)
    • Adds path to the Windows Defender exclusion list

      • cmd.exe (PID: 8088)
      • XClient.exe (PID: 968)
    • QUASARRAT has been found (auto)

      • Client-built.exe (PID: 4228)
      • RuntimeBroker.exe (PID: 8160)
      • Java32.exe (PID: 9992)
      • discord.exe (PID: 10336)
    • Antivirus name has been found in the command line (generic signature)

      • findstr.exe (PID: 1348)
      • findstr.exe (PID: 7408)
      • findstr.exe (PID: 8420)
      • findstr.exe (PID: 9572)
    • Bypass execution policy to execute commands

      • powershell.exe (PID: 2692)
      • powershell.exe (PID: 8632)
      • powershell.exe (PID: 8284)
      • powershell.exe (PID: 1548)
    • Changes powershell execution policy (Bypass)

      • XClient.exe (PID: 968)
    • NJRAT has been found (auto)

      • Server.exe (PID: 6372)
      • server.exe (PID: 8300)
      • njrat.exe (PID: 9308)
      • rundll32.exe (PID: 2096)
    • Adds process to the Windows Defender exclusion list

      • XClient.exe (PID: 968)
    • Changes the autorun value in the registry

      • server.exe (PID: 8300)
      • XClient.exe (PID: 968)
    • NjRAT is detected

      • server.exe (PID: 8300)
    • STEALER has been found (auto)

      • 4363463463464363463463463.exe (PID: 7184)
    • AZORULT mutex has been detected

      • cHSzTDjVl.exe (PID: 7988)
    • DCRAT has been detected (YARA)

      • smss.exe (PID: 2240)
    • Uses Task Scheduler to run other applications

      • XClient.exe (PID: 968)
      • Mph.pif (PID: 9116)
    • Starts PowerShell from an unusual location

      • per.exe (PID: 6080)
    • M0YV mutex has been found

      • kzgqdtrG.pif (PID: 2092)
      • FlashPlayerUpdateService.exe (PID: 7924)
      • AppVClient.exe (PID: 7272)
      • alg.exe (PID: 8796)
      • DiagnosticsHub.StandardCollector.Service.exe (PID: 3192)
      • FXSSVC.exe (PID: 1240)
      • elevation_service.exe (PID: 4608)
      • msdtc.exe (PID: 7632)
      • PerceptionSimulationService.exe (PID: 9268)
      • elevation_service.exe (PID: 7680)
      • maintenanceservice.exe (PID: 2596)
      • PSEXESVC.exe (PID: 9392)
      • SensorDataService.exe (PID: 9560)
      • Locator.exe (PID: 9476)
      • snmptrap.exe (PID: 9704)
      • Spectrum.exe (PID: 9772)
      • ssh-agent.exe (PID: 10032)
      • TieringEngineService.exe (PID: 10124)
      • AgentService.exe (PID: 10176)
      • vds.exe (PID: 10208)
      • wbengine.exe (PID: 8460)
      • WmiApSrv.exe (PID: 9752)
      • SearchIndexer.exe (PID: 9948)
      • FLMgrTray.exe (PID: 7628)
      • firefox.exe (PID: 10344)
      • firefox.exe (PID: 7452)
      • VSSVC.exe (PID: 8284)
      • firefox.exe (PID: 9588)
      • firefox.exe (PID: 2796)
      • firefox.exe (PID: 6712)
      • msdtc.exe (PID: 6028)
    • XMRig has been detected

      • ksoftriqd.exe (PID: 2152)
    • Connects to the CnC server

      • ksoftriqd.exe (PID: 2152)
    • MINER has been detected (SURICATA)

      • ksoftriqd.exe (PID: 2152)
    • SYSTEMBC mutex has been found

      • kthtsg.exe (PID: 8864)
  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 4363463463464363463463463.exe (PID: 7184)
      • loader.exe (PID: 4200)
      • rhsgn_protected.exe (PID: 5216)
      • ARA.exe (PID: 6564)
      • JJSPLOIT.V2.exe (PID: 6644)
      • Msblockreview.exe (PID: 4200)
      • rundll32.exe (PID: 7172)
      • rundrive.exe (PID: 7864)
      • image%20logger.exe (PID: 7932)
      • FiddlerSetup.exe (PID: 8108)
      • Jigsaw.exe (PID: 7380)
      • Client-built.exe (PID: 4228)
      • RuntimeBroker.exe (PID: 8160)
      • cmd.exe (PID: 4112)
      • Mph.pif (PID: 7668)
      • Server.exe (PID: 6372)
      • imagelogger.exe (PID: 2564)
      • server.exe (PID: 8300)
      • xs.exe (PID: 2192)
      • KuwaitSetupHockey.exe (PID: 8164)
      • XClient.exe (PID: 968)
      • KuwaitSetupHockey.tmp (PID: 8680)
      • main.exe (PID: 2984)
      • Discord3.exe (PID: 4464)
      • 444.exe (PID: 2516)
      • esentutl.exe (PID: 7996)
      • esentutl.exe (PID: 1196)
      • purchaseorder.exe (PID: 9168)
      • conhost.exe (PID: 7920)
      • NoMoreRansom.exe (PID: 3992)
      • esentutl.exe (PID: 8824)
      • Installer.exe (PID: 780)
      • esentutl.exe (PID: 7356)
      • kzgqdtrG.pif (PID: 2092)
      • tjqdq.exe (PID: 4224)
      • yz.exe (PID: 7384)
      • sys.exe (PID: 632)
      • Java32.exe (PID: 9992)
      • njrat.exe (PID: 9308)
      • rundll32.exe (PID: 2096)
      • discord.exe (PID: 10336)
      • cmd.exe (PID: 10736)
      • Origin.pif (PID: 10480)
      • 3d%20builder_12_1201419.exe (PID: 8156)
      • Mph.pif (PID: 9116)
      • alg.exe (PID: 8796)
      • elevation_service.exe (PID: 4608)
    • There is functionality for taking screenshot (YARA)

      • loader.exe (PID: 4200)
      • windows 3543.exe (PID: 7608)
      • smss.exe (PID: 2240)
    • Reads security settings of Internet Explorer

      • loader.exe (PID: 4200)
      • rhsgn_protected.exe (PID: 5216)
      • ARA.exe (PID: 6564)
      • foobar2000_v1.6.7_beta_17@1704_129472.exe (PID: 7684)
      • 4363463463464363463463463.exe (PID: 7184)
      • RuntimeBroker.exe (PID: 720)
      • windows 3543.exe (PID: 7608)
      • RuntimeBroker.exe (PID: 9148)
      • xs.exe (PID: 2192)
      • cHSzTDjVl.exe (PID: 7988)
    • Process drops legitimate windows executable

      • rhsgn_protected.exe (PID: 5216)
      • 4363463463464363463463463.exe (PID: 7184)
      • RuntimeBroker.exe (PID: 8160)
      • XClient.exe (PID: 968)
      • main.exe (PID: 2984)
      • purchaseorder.exe (PID: 9168)
      • Installer.exe (PID: 780)
      • kzgqdtrG.pif (PID: 2092)
      • 3d%20builder_12_1201419.exe (PID: 8156)
      • elevation_service.exe (PID: 4608)
    • Process requests binary or script from the Internet

      • 4363463463464363463463463.exe (PID: 7184)
      • 3d%20builder_12_1201419.exe (PID: 8156)
      • winManager.exe (PID: 9852)
      • svchost.exe (PID: 3016)
    • Connects to unusual port

      • 4363463463464363463463463.exe (PID: 7184)
      • crack.exe (PID: 6112)
      • windows 3543.exe (PID: 7608)
      • AsyncClient.exe (PID: 5968)
      • prueba.exe (PID: 7176)
      • runtime.exe (PID: 7204)
      • CrSpoofer.exe (PID: 4944)
      • svchost.exe (PID: 4284)
      • imagelogger.exe (PID: 2564)
      • server.exe (PID: 8300)
      • windows 3543.exe (PID: 896)
      • evetbeta.exe (PID: 1628)
      • aspnet_regbrowsers.exe (PID: 8772)
      • XClient.exe (PID: 968)
      • conhost.exe (PID: 7920)
      • Discord.exe (PID: 4268)
      • dick.exe (PID: 9148)
      • tjqdq.exe (PID: 4224)
      • kzgqdtrG.pif (PID: 2092)
      • kthtsg.exe (PID: 8864)
      • File.exe (PID: 9496)
      • windows 3543.exe (PID: 11020)
      • rundll32.exe (PID: 2096)
      • Origin.pif (PID: 9356)
      • Mph.pif (PID: 9116)
      • windows 3543.exe (PID: 6488)
      • sys.exe (PID: 632)
      • windows 3543.exe (PID: 3080)
    • Probably fake Windows Update file has been dropped

      • JJSPLOIT.V2.exe (PID: 6644)
    • Probably fake Windows Update

      • schtasks.exe (PID: 7616)
      • schtasks.exe (PID: 8124)
      • windows 3543.exe (PID: 7608)
      • windows 3543.exe (PID: 896)
      • schtasks.exe (PID: 4304)
      • schtasks.exe (PID: 11152)
      • windows 3543.exe (PID: 11020)
      • windows 3543.exe (PID: 6488)
      • schtasks.exe (PID: 9308)
      • windows 3543.exe (PID: 3080)
      • schtasks.exe (PID: 7652)
    • Starts itself from another location

      • JJSPLOIT.V2.exe (PID: 6644)
      • Jigsaw.exe (PID: 7380)
      • Client-built.exe (PID: 4228)
      • RuntimeBroker.exe (PID: 8160)
      • Server.exe (PID: 6372)
      • 444.exe (PID: 2516)
      • cmd.exe (PID: 3800)
      • Java32.exe (PID: 9992)
      • njrat.exe (PID: 9308)
    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 664)
    • Executing commands from a ".bat" file

      • wscript.exe (PID: 664)
      • Msblockreview.exe (PID: 4200)
      • Pack_Brout_ncrypt.exe (PID: 1272)
      • image%20logger.exe (PID: 7932)
      • RuntimeBroker.exe (PID: 720)
      • windows 3543.exe (PID: 7608)
      • RuntimeBroker.exe (PID: 9148)
      • xs.exe (PID: 2192)
      • RuntimeBroker.exe (PID: 5172)
      • Discord3.exe (PID: 4464)
      • java.exe (PID: 9856)
      • windows 3543.exe (PID: 896)
      • java.exe (PID: 10604)
      • java.exe (PID: 8380)
      • java.exe (PID: 9972)
      • windows 3543.exe (PID: 11020)
      • java.exe (PID: 9484)
      • java.exe (PID: 7532)
      • java.exe (PID: 10952)
      • java.exe (PID: 7400)
      • java.exe (PID: 10936)
      • windows 3543.exe (PID: 6488)
      • java.exe (PID: 10380)
    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 664)
      • Msblockreview.exe (PID: 4200)
      • Pack_Brout_ncrypt.exe (PID: 1272)
      • image%20logger.exe (PID: 7932)
      • OfferedBuilt.exe (PID: 8148)
      • dmshell.exe (PID: 872)
      • cmd.exe (PID: 4112)
      • RuntimeBroker.exe (PID: 720)
      • windows 3543.exe (PID: 7608)
      • RuntimeBroker.exe (PID: 9148)
      • xs.exe (PID: 2192)
      • RuntimeBroker.exe (PID: 5172)
      • main.exe (PID: 4560)
      • Discord3.exe (PID: 4464)
      • purchaseorder.exe (PID: 9168)
      • sys.exe (PID: 632)
      • java.exe (PID: 9856)
      • windows 3543.exe (PID: 896)
      • AdaptorOvernight.exe (PID: 9316)
      • java.exe (PID: 10604)
      • cmd.exe (PID: 10736)
      • java.exe (PID: 8380)
      • java.exe (PID: 9972)
      • windows 3543.exe (PID: 11020)
      • java.exe (PID: 9484)
      • java.exe (PID: 7532)
      • java.exe (PID: 10952)
      • java.exe (PID: 7400)
      • java.exe (PID: 10936)
      • windows 3543.exe (PID: 6488)
      • java.exe (PID: 10380)
    • The executable file from the user directory is run by the CMD process

      • Msblockreview.exe (PID: 4200)
      • syteam.exe (PID: 2284)
      • Mph.pif (PID: 7668)
      • RuntimeBroker.exe (PID: 9148)
      • windows 3543.exe (PID: 896)
      • aspnet_regbrowsers.exe (PID: 8772)
      • RuntimeBroker.exe (PID: 5172)
      • Discord.exe (PID: 4268)
      • ksoftriqd.exe (PID: 2152)
      • windows 3543.exe (PID: 11020)
      • java.exe (PID: 10604)
      • Origin.pif (PID: 10480)
      • java.exe (PID: 8380)
      • java.exe (PID: 9972)
      • java.exe (PID: 9484)
      • windows 3543.exe (PID: 6488)
      • java.exe (PID: 7532)
      • java.exe (PID: 10952)
      • java.exe (PID: 10936)
      • java.exe (PID: 7400)
      • java.exe (PID: 10380)
      • windows 3543.exe (PID: 3080)
      • java.exe (PID: 6576)
    • The process creates files with name similar to system file names

      • Msblockreview.exe (PID: 4200)
    • Executed via WMI

      • schtasks.exe (PID: 720)
      • schtasks.exe (PID: 2772)
      • schtasks.exe (PID: 5936)
      • schtasks.exe (PID: 4068)
      • schtasks.exe (PID: 7152)
      • schtasks.exe (PID: 5964)
      • schtasks.exe (PID: 5436)
      • schtasks.exe (PID: 5260)
      • schtasks.exe (PID: 6576)
      • schtasks.exe (PID: 856)
      • schtasks.exe (PID: 3132)
      • schtasks.exe (PID: 516)
      • schtasks.exe (PID: 6564)
      • schtasks.exe (PID: 7376)
      • schtasks.exe (PID: 7768)
      • schtasks.exe (PID: 7592)
      • schtasks.exe (PID: 7712)
      • schtasks.exe (PID: 7588)
      • schtasks.exe (PID: 5344)
      • schtasks.exe (PID: 5392)
      • schtasks.exe (PID: 7836)
      • schtasks.exe (PID: 7932)
      • schtasks.exe (PID: 6488)
      • schtasks.exe (PID: 7884)
      • schtasks.exe (PID: 7984)
      • schtasks.exe (PID: 7668)
      • schtasks.exe (PID: 7620)
      • schtasks.exe (PID: 8100)
      • schtasks.exe (PID: 8120)
      • schtasks.exe (PID: 8012)
      • schtasks.exe (PID: 5776)
      • schtasks.exe (PID: 7176)
      • schtasks.exe (PID: 8000)
      • schtasks.exe (PID: 7208)
      • schtasks.exe (PID: 7868)
      • schtasks.exe (PID: 7892)
      • schtasks.exe (PID: 5176)
      • schtasks.exe (PID: 8044)
      • schtasks.exe (PID: 8028)
      • schtasks.exe (PID: 5164)
      • schtasks.exe (PID: 2908)
      • schtasks.exe (PID: 4268)
      • schtasks.exe (PID: 6700)
      • schtasks.exe (PID: 8052)
      • schtasks.exe (PID: 6988)
      • schtasks.exe (PID: 6728)
      • schtasks.exe (PID: 7360)
      • schtasks.exe (PID: 7644)
    • Probably delay the execution using 'w32tm.exe'

      • cmd.exe (PID: 2692)
    • Potential Corporate Privacy Violation

      • 4363463463464363463463463.exe (PID: 7184)
      • svchost.exe (PID: 2196)
      • tjqdq.exe (PID: 4224)
      • ksoftriqd.exe (PID: 2152)
      • sys.exe (PID: 632)
      • svchost.exe (PID: 3016)
    • Connects to the server without a host name

      • 4363463463464363463463463.exe (PID: 7184)
      • sys.exe (PID: 632)
    • Executes as Windows Service

      • VSSVC.exe (PID: 7424)
      • ScreenConnect.ClientService.exe (PID: 8720)
      • FlashPlayerUpdateService.exe (PID: 7924)
      • armsvc.exe (PID: 812)
      • alg.exe (PID: 8796)
      • AppVClient.exe (PID: 7272)
      • DiagnosticsHub.StandardCollector.Service.exe (PID: 3192)
      • MicrosoftEdgeUpdate.exe (PID: 8080)
      • FXSSVC.exe (PID: 1240)
      • GameInputSvc.exe (PID: 7864)
      • GoogleUpdate.exe (PID: 7944)
      • msdtc.exe (PID: 7632)
      • PerceptionSimulationService.exe (PID: 9268)
      • perfhost.exe (PID: 9340)
      • maintenanceservice.exe (PID: 2596)
      • Locator.exe (PID: 9476)
      • PSEXESVC.exe (PID: 9392)
      • SensorDataService.exe (PID: 9560)
      • snmptrap.exe (PID: 9704)
      • Spectrum.exe (PID: 9772)
      • ssh-agent.exe (PID: 10032)
      • TieringEngineService.exe (PID: 10124)
      • vds.exe (PID: 10208)
      • wbengine.exe (PID: 8460)
      • AgentService.exe (PID: 10176)
      • WmiApSrv.exe (PID: 9752)
      • MicrosoftEdgeUpdate.exe (PID: 9228)
      • GoogleUpdate.exe (PID: 10920)
      • VSSVC.exe (PID: 8284)
      • msdtc.exe (PID: 6028)
    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 8088)
    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 6372)
      • cmd.exe (PID: 8088)
      • cmd.exe (PID: 4112)
      • cmd.exe (PID: 5776)
      • cmd.exe (PID: 8140)
      • cmd.exe (PID: 10736)
    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 8088)
      • XClient.exe (PID: 968)
    • Script adds exclusion extension to Windows Defender

      • cmd.exe (PID: 8088)
    • Executing commands from ".cmd" file

      • OfferedBuilt.exe (PID: 8148)
      • purchaseorder.exe (PID: 9168)
      • AdaptorOvernight.exe (PID: 9316)
    • Script adds exclusion path to Windows Defender

      • cmd.exe (PID: 8088)
      • XClient.exe (PID: 968)
    • The process hide an interactive prompt from the user

      • cmd.exe (PID: 8088)
    • Get information on the list of running processes

      • cmd.exe (PID: 4112)
      • cmd.exe (PID: 10736)
    • Starts a Microsoft application from unusual location

      • RuntimeBroker.exe (PID: 8160)
      • XClient.exe (PID: 968)
      • RuntimeBroker.exe (PID: 720)
      • RuntimeBroker.exe (PID: 9148)
      • RuntimeBroker.exe (PID: 5172)
      • alpha.pif (PID: 1052)
      • alpha.pif (PID: 8284)
      • alpha.pif (PID: 516)
      • xpha.pif (PID: 2104)
      • pha.pif (PID: 616)
      • alpha.pif (PID: 1020)
      • alpha.pif (PID: 8372)
      • alpha.pif (PID: 2104)
    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 4112)
      • cmd.exe (PID: 9160)
      • cmd.exe (PID: 10736)
    • Application launched itself

      • cmd.exe (PID: 4112)
      • main.exe (PID: 2984)
      • Mph.pif (PID: 7668)
      • MicrosoftEdgeUpdate.exe (PID: 8080)
      • MicrosoftEdgeUpdate.exe (PID: 4776)
      • GameInputSvc.exe (PID: 7864)
      • GoogleUpdate.exe (PID: 7944)
      • GoogleUpdate.exe (PID: 4200)
      • cmd.exe (PID: 10736)
      • Origin.pif (PID: 10480)
      • MicrosoftEdgeUpdate.exe (PID: 9228)
    • Suspicious file concatenation

      • cmd.exe (PID: 2284)
      • cmd.exe (PID: 10596)
    • Starts application with an unusual extension

      • cmd.exe (PID: 2192)
      • cmd.exe (PID: 4112)
      • cmd.exe (PID: 9080)
      • cmd.exe (PID: 7800)
      • cmd.exe (PID: 9140)
      • cmd.exe (PID: 3800)
      • alpha.pif (PID: 516)
      • per.exe (PID: 6080)
      • Mph.pif (PID: 7668)
      • purchaseorder.exe (PID: 9168)
      • cmd.exe (PID: 9332)
      • cmd.exe (PID: 10392)
      • cmd.exe (PID: 10408)
      • cmd.exe (PID: 10736)
      • cmd.exe (PID: 1244)
      • cmd.exe (PID: 7252)
      • Origin.pif (PID: 10480)
      • cmd.exe (PID: 9784)
      • cmd.exe (PID: 10956)
      • cmd.exe (PID: 2664)
      • cmd.exe (PID: 10560)
      • cmd.exe (PID: 10748)
      • cmd.exe (PID: 9112)
      • cmd.exe (PID: 668)
      • cmd.exe (PID: 9152)
    • Starts the AutoIt3 executable file

      • cmd.exe (PID: 4112)
      • Mph.pif (PID: 7668)
      • cmd.exe (PID: 10736)
      • Origin.pif (PID: 10480)
    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 2192)
      • cmd.exe (PID: 9080)
      • cmd.exe (PID: 7800)
      • cmd.exe (PID: 9140)
      • cmd.exe (PID: 9332)
      • cmd.exe (PID: 10392)
      • cmd.exe (PID: 10408)
      • cmd.exe (PID: 1244)
      • cmd.exe (PID: 7252)
      • cmd.exe (PID: 9784)
      • cmd.exe (PID: 10956)
      • cmd.exe (PID: 2664)
      • cmd.exe (PID: 10560)
      • cmd.exe (PID: 10748)
      • cmd.exe (PID: 9112)
      • cmd.exe (PID: 668)
      • cmd.exe (PID: 9152)
    • Checks for external IP

      • svchost.exe (PID: 2196)
      • XClient.exe (PID: 968)
      • imagelogger.exe (PID: 2564)
    • Script adds exclusion process to Windows Defender

      • XClient.exe (PID: 968)
    • SCREENCONNECT mutex has been found

      • ScreenConnect.ClientService.exe (PID: 8720)
    • The process executes via Task Scheduler

      • kthtsg.exe (PID: 8864)
    • Screenconnect has been detected

      • ScreenConnect.ClientService.exe (PID: 8720)
    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • server.exe (PID: 8300)
      • conhost.exe (PID: 7920)
      • rundll32.exe (PID: 2096)
    • Possible usage of Discord/Telegram API has been detected (YARA)

      • smss.exe (PID: 2240)
    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • XClient.exe (PID: 968)
    • Process drops python dynamic module

      • main.exe (PID: 2984)
    • The process drops C-runtime libraries

      • main.exe (PID: 2984)
      • Installer.exe (PID: 780)
      • 3d%20builder_12_1201419.exe (PID: 8156)
    • Loads Python modules

      • main.exe (PID: 4560)
    • Uses WMIC.EXE to obtain Windows Installer data

      • cmd.exe (PID: 3012)
      • cmd.exe (PID: 8524)
      • cmd.exe (PID: 6256)
      • cmd.exe (PID: 6240)
    • Accesses product unique identifier via WMI (SCRIPT)

      • WMIC.exe (PID: 8792)
      • WMIC.exe (PID: 7832)
      • WMIC.exe (PID: 8064)
      • WMIC.exe (PID: 8648)
    • Likely accesses (executes) a file from the Public directory

      • cmd.exe (PID: 3800)
      • esentutl.exe (PID: 7996)
      • esentutl.exe (PID: 1196)
      • alpha.pif (PID: 8284)
      • alpha.pif (PID: 1052)
      • alpha.pif (PID: 516)
      • xpha.pif (PID: 2104)
      • esentutl.exe (PID: 8824)
      • pha.pif (PID: 616)
      • alpha.pif (PID: 8372)
      • alpha.pif (PID: 1020)
      • alpha.pif (PID: 2104)
      • esentutl.exe (PID: 7356)
      • kzgqdtrG.pif (PID: 2092)
    • Created directory related to system

      • alpha.pif (PID: 1052)
    • Uses NETSH.EXE to obtain data on the network

      • cmd.exe (PID: 1020)
      • cmd.exe (PID: 1568)
      • cmd.exe (PID: 5776)
    • Executes application which crashes

      • msf.exe (PID: 5172)
      • kzgqdtrG.pif (PID: 2092)
      • alg.exe (PID: 8796)
      • DiagnosticsHub.StandardCollector.Service.exe (PID: 3192)
      • elevation_service.exe (PID: 4608)
      • elevation_service.exe (PID: 7680)
      • msdtc.exe (PID: 7632)
    • Drops a system driver (possible attempt to evade defenses)

      • sys.exe (PID: 632)
    • Stops a currently running service

      • sc.exe (PID: 9812)
      • sc.exe (PID: 8876)
    • Starts SC.EXE for service management

      • cmd.exe (PID: 9840)
      • cmd.exe (PID: 9880)
      • cmd.exe (PID: 9764)
      • cmd.exe (PID: 9924)
    • Windows service management via SC.EXE

      • sc.exe (PID: 9856)
      • sc.exe (PID: 9940)
      • sc.exe (PID: 9700)
      • sc.exe (PID: 10472)
      • sc.exe (PID: 3364)
    • Creates a new Windows service

      • sc.exe (PID: 9896)
    • Uses ROUTE.EXE to obtain the routing table information

      • sys.exe (PID: 632)
    • Uses TASKKILL.EXE to kill process

      • 3d%20builder_12_1201419.exe (PID: 8156)
    • Access to an unwanted program domain was detected

      • FLMgrTray.exe (PID: 7628)
    • Sets the service to start on system boot

      • sc.exe (PID: 10740)
  • INFO

    • Reads the computer name

      • 4363463463464363463463463.exe (PID: 7184)
      • loader.exe (PID: 4200)
      • rhsgn_protected.exe (PID: 5216)
      • JJSPLOIT.V2.exe (PID: 6644)
      • ARA.exe (PID: 6564)
      • windows 3543.exe (PID: 7608)
      • Msblockreview.exe (PID: 4200)
      • image%20logger.exe (PID: 7932)
      • Pack_Brout_ncrypt.exe (PID: 1272)
      • rundrive.exe (PID: 7864)
      • CrSpoofer.exe (PID: 4944)
      • runtime.exe (PID: 7204)
      • msiexec.exe (PID: 8528)
      • 3d%20builder_12_1201419.exe (PID: 8156)
    • Reads the software policy settings

      • 4363463463464363463463463.exe (PID: 7184)
      • BackgroundTransferHost.exe (PID: 720)
    • Disables trace logs

      • 4363463463464363463463463.exe (PID: 7184)
      • smss.exe (PID: 2240)
    • Checks supported languages

      • 4363463463464363463463463.exe (PID: 7184)
      • loader.exe (PID: 4200)
      • rhsgn_protected.exe (PID: 5216)
      • JJSPLOIT.V2.exe (PID: 6644)
      • crack.exe (PID: 6112)
      • ARA.exe (PID: 6564)
      • windows 3543.exe (PID: 7608)
      • Msblockreview.exe (PID: 4200)
      • foobar2000_v1.6.7_beta_17@1704_129472.exe (PID: 7684)
      • image%20logger.exe (PID: 7932)
      • syteam.exe (PID: 2284)
      • FiddlerSetup.exe (PID: 7960)
      • CrSpoofer.exe (PID: 4944)
      • msiexec.exe (PID: 5408)
      • 3d%20builder_12_1201419.exe (PID: 8156)
      • cHSzTDjVl.exe (PID: 7988)
      • KuwaitSetupHockey.tmp (PID: 8680)
    • Checks proxy server information

      • 4363463463464363463463463.exe (PID: 7184)
      • BackgroundTransferHost.exe (PID: 720)
      • smss.exe (PID: 2240)
    • Reads the machine GUID from the registry

      • 4363463463464363463463463.exe (PID: 7184)
      • JJSPLOIT.V2.exe (PID: 6644)
      • windows 3543.exe (PID: 7608)
      • Msblockreview.exe (PID: 4200)
      • smss.exe (PID: 2240)
      • runtime.exe (PID: 7204)
      • imagelogger.exe (PID: 2564)
      • drpbx.exe (PID: 7796)
      • ScreenConnect.WindowsClient.exe (PID: 8852)
      • windows 3543.exe (PID: 896)
    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 8044)
      • BackgroundTransferHost.exe (PID: 720)
      • BackgroundTransferHost.exe (PID: 1348)
      • BackgroundTransferHost.exe (PID: 5740)
      • BackgroundTransferHost.exe (PID: 3268)
    • Create files in a temporary directory

      • loader.exe (PID: 4200)
      • rhsgn_protected.exe (PID: 5216)
      • Msblockreview.exe (PID: 4200)
      • foobar2000_v1.6.7_beta_17@1704_129472.exe (PID: 7684)
      • Invoice4231284.exe (PID: 7928)
      • rundll32.exe (PID: 7172)
      • Pack_Brout_ncrypt.exe (PID: 1272)
      • image%20logger.exe (PID: 7932)
      • FiddlerSetup.exe (PID: 8108)
      • FiddlerSetup.exe (PID: 7960)
      • OfferedBuilt.exe (PID: 8148)
    • Process checks computer location settings

      • loader.exe (PID: 4200)
      • rhsgn_protected.exe (PID: 5216)
      • ARA.exe (PID: 6564)
      • 4363463463464363463463463.exe (PID: 7184)
      • image%20logger.exe (PID: 7932)
    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 720)
      • ARA.exe (PID: 6564)
      • JJSPLOIT.V2.exe (PID: 6644)
      • Msblockreview.exe (PID: 4200)
      • foobar2000_v1.6.7_beta_17@1704_129472.exe (PID: 7684)
    • The sample compiled with english language support

      • 4363463463464363463463463.exe (PID: 7184)
      • ARA.exe (PID: 6564)
      • rhsgn_protected.exe (PID: 5216)
      • Msblockreview.exe (PID: 4200)
      • FiddlerSetup.exe (PID: 8108)
      • RuntimeBroker.exe (PID: 8160)
      • Mph.pif (PID: 7668)
      • main.exe (PID: 2984)
      • esentutl.exe (PID: 7996)
      • esentutl.exe (PID: 1196)
      • purchaseorder.exe (PID: 9168)
      • esentutl.exe (PID: 8824)
      • Installer.exe (PID: 780)
      • kzgqdtrG.pif (PID: 2092)
      • Origin.pif (PID: 10480)
      • 3d%20builder_12_1201419.exe (PID: 8156)
      • Mph.pif (PID: 9116)
      • elevation_service.exe (PID: 4608)
    • Drops encrypted VBS script (Microsoft Script Encoder)

      • ARA.exe (PID: 6564)
    • Creates files in the program directory

      • Msblockreview.exe (PID: 4200)
      • rundrive.exe (PID: 7864)
    • The sample compiled with chinese language support

      • 4363463463464363463463463.exe (PID: 7184)
      • tjqdq.exe (PID: 4224)
      • yz.exe (PID: 7384)
      • 3d%20builder_12_1201419.exe (PID: 8156)
      • alg.exe (PID: 8796)
    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7980)
      • msiexec.exe (PID: 5408)
    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 7336)
      • powershell.exe (PID: 7416)
      • powershell.exe (PID: 6512)
      • powershell.exe (PID: 2692)
      • powershell.exe (PID: 8632)
      • powershell.exe (PID: 8284)
      • powershell.exe (PID: 1548)
      • pha.pif (PID: 616)
    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7336)
      • powershell.exe (PID: 7416)
      • powershell.exe (PID: 2692)
      • powershell.exe (PID: 8632)
      • powershell.exe (PID: 8284)
      • powershell.exe (PID: 1548)
      • pha.pif (PID: 616)
    • Creates a new folder

      • cmd.exe (PID: 6436)
      • cmd.exe (PID: 10496)
    • Changes the display of characters in the console

      • cmd.exe (PID: 2192)
      • cmd.exe (PID: 9080)
      • cmd.exe (PID: 7800)
      • cmd.exe (PID: 9140)
      • cmd.exe (PID: 9332)
      • cmd.exe (PID: 10392)
      • cmd.exe (PID: 10408)
      • cmd.exe (PID: 1244)
      • cmd.exe (PID: 7252)
      • cmd.exe (PID: 9784)
      • cmd.exe (PID: 10956)
      • cmd.exe (PID: 2664)
      • cmd.exe (PID: 10560)
      • cmd.exe (PID: 10748)
      • cmd.exe (PID: 9112)
      • cmd.exe (PID: 668)
      • cmd.exe (PID: 9152)
    • Execution of CURL command

      • cmd.exe (PID: 8088)
    • Manages system restore points

      • SrTasks.exe (PID: 8440)
    • .NET Reactor protector has been detected

      • smss.exe (PID: 2240)
    • Found Base64 encoded reference to AntiVirus WMI classes (YARA)

      • smss.exe (PID: 2240)
    • Found Base64 encoded reference to WMI classes (YARA)

      • smss.exe (PID: 2240)
    • Potential library load (Base64 Encoded 'LoadLibrary')

      • smss.exe (PID: 2240)
    • Potential dynamic function import (Base64 Encoded 'GetProcAddress')

      • smss.exe (PID: 2240)
    • UPX packer has been detected

      • foobar2000_v1.6.7_beta_17@1704_129472.exe (PID: 7684)
    • Checks operating system version

      • main.exe (PID: 4560)
    • Executes as Windows Service

      • elevation_service.exe (PID: 4608)
      • elevation_service.exe (PID: 7680)
      • SearchIndexer.exe (PID: 9948)
    • Prints a route via ROUTE.EXE

      • ROUTE.EXE (PID: 9976)
    • The sample compiled with japanese language support

      • sys.exe (PID: 632)
    • The sample compiled with bulgarian language support

      • kzgqdtrG.pif (PID: 2092)
    • Application launched itself

      • firefox.exe (PID: 7452)
      • firefox.exe (PID: 10344)
    • Manual execution by a user

      • firefox.exe (PID: 7452)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Quasar

(PID) Process(7608) windows 3543.exe
Version1.4.1
C2 (6)192.168.50.1:4782
10.0.0.113:4782
LETSQOOO-62766.portmap.host:62766
89.10.178.51:4782
LETSQOOO-62766.portmap.host:62766
Sub_Dirwindows updater
Install_Namewindows 3543.exe
Mutex90faf922-159d-4166-b661-4ba16af8650e
Startupwindows background updater
TagROBLOX EXECUTOR
LogDirroblox executor
SignatureDowhTcCNRmPne/jP3WQ8VLNtjW2b7COPJ9f99kZ79UFTzRFEvY6/5+otwvW1Bwmg9g0QfHHt35ZhSkuKX/JTqAAzWBJF4jgN5VBXj8eypchVIP3+JtYmO932+ak0qLmQH0HXpIdH0VUJZJaxFcaI3G20cO9f5EBgxHsey09u6g7O39z3AMmFvru9wuI2/bQkFreKMve5G63LPGchmgImAWCO+i3qtDNkH/D47EjSUKhBQjEwRNXoIahVTqBJr+eIfI/o/mQV8pWk2FKc5M20xfErtWCuSzMJ0rIULHdKHXDZ...
CertificateMIIE9DCCAtygAwIBAgIQAKXago0cfl52srIGgNzsZzANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MDgyNTE2NDk0M1oYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAhErQjQ8fpDYpYN1iZUcL3evTfxYkIWCVDolaEBfQA2elEwvnikLo+0s8mPHF86S0Qr9u+daX...

DcRat

(PID) Process(2240) smss.exe
C2 (1)http://23.227.193.58/trackwordpressdleCentral
Options
Tag#ARA 09.07
MutexDCR_MUTEX-Xz5X1RvNbk1VXCL5X1Ds
savebrowsersdatatosinglefilefalse
ignorepartiallyemptydatafalse
cookiestrue
passwordstrue
formstrue
cctrue
historyfalse
telegramtrue
steamtrue
discordtrue
filezillatrue
screenshottrue
clipboardtrue
sysinfotrue
searchpath%AppData% - Very Fast
Targetru
C2 (1)http://23.227.193.58/trackwordpressdleCentral
Options
MutexDCR_MUTEX-Xz5X1RvNbk1VXCL5X1Ds
Tag#ARA 09.07
Debugfalse
ServerConfigReplacementTable
0(
2@
H,
i$
k^
j>
I.
x)
l#
E%
g-
Z~
z
R!
o&
v|
p_
B<
d`
=*
G;
PluginConfigReplacementTable
1,
3|
d^
L%
l_
V>
T*
H$
N;
p~
U(
Y)
C<
w!
B#
R.
E&
m`
Q
J@
j-
GetWebcamsfalse
SleepTimeout5
InactivityTimeout2
CacheStorageRegistry
AutoRunSmart
StealerConfig
savebrowsersdatatosinglefilefalse
ignorepartiallyemptydatafalse
cookiestrue
passwordstrue
formstrue
cctrue
historyfalse
telegramtrue
steamtrue
discordtrue
filezillatrue
screenshottrue
clipboardtrue
sysinfotrue
searchpath%AppData% - Very Fast
StealerEnabledtrue
StealerOptionsfalse
SelfDeletefalse

ims-api

(PID) Process(2240) smss.exe
Telegram-Tokens (1)5464582216:AAGQwUk7okVws1aICy3bNbGaaTOBRnnMbwI
Telegram-Info-Links
5464582216:AAGQwUk7okVws1aICy3bNbGaaTOBRnnMbwI
Get info about bothttps://api.telegram.org/bot5464582216:AAGQwUk7okVws1aICy3bNbGaaTOBRnnMbwI/getMe
Get incoming updateshttps://api.telegram.org/bot5464582216:AAGQwUk7okVws1aICy3bNbGaaTOBRnnMbwI/getUpdates
Get webhookhttps://api.telegram.org/bot5464582216:AAGQwUk7okVws1aICy3bNbGaaTOBRnnMbwI/getWebhookInfo
Delete webhookhttps://api.telegram.org/bot5464582216:AAGQwUk7okVws1aICy3bNbGaaTOBRnnMbwI/deleteWebhook
Drop incoming updateshttps://api.telegram.org/bot5464582216:AAGQwUk7okVws1aICy3bNbGaaTOBRnnMbwI/deleteWebhook?drop_pending_updates=true
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:12:22 08:29:10+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 80
CodeSize: 5632
InitializedDataSize: 4608
UninitializedDataSize: -
EntryPoint: 0x3552
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 0.0.0.0
InternalName: 4363463463464363463463463.exe
LegalCopyright:
OriginalFileName: 4363463463464363463463463.exe
ProductVersion: 0.0.0.0
AssemblyVersion: 0.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
649
Monitored processes
482
Malicious processes
92
Suspicious processes
42

Behavior graph

Click at the process to see the details
start #METERPRETER 4363463463464363463463463.exe conhost.exe no specs sppextcomobj.exe no specs slui.exe backgroundtransferhost.exe no specs loader.exe backgroundtransferhost.exe rhsgn_protected.exe jjsploit.v2.exe ara.exe #METASPLOIT crack.exe backgroundtransferhost.exe no specs wscript.exe no specs schtasks.exe no specs conhost.exe no specs #QUASAR windows 3543.exe backgroundtransferhost.exe no specs schtasks.exe no specs conhost.exe no specs backgroundtransferhost.exe no specs cmd.exe no specs conhost.exe no specs msblockreview.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs w32tm.exe no specs #DCRAT smss.exe #QJWMONKEY foobar2000_v1.6.7_beta_17@1704_129472.exe invoice4231284.exe no specs #ASYNCRAT image%20logger.exe msiexec.exe msiexec.exe consoleapp22.exe no specs conhost.exe no specs #TAS17 rundrive.exe msiexec.exe no specs rundll32.exe pack_brout_ncrypt.exe no specs cmd.exe no specs conhost.exe no specs vssvc.exe no specs cacls.exe no specs powershell.exe no specs #ASYNCRAT asyncclient.exe cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs timeout.exe no specs #ASYNCRAT syteam.exe no specs powershell.exe no specs fiddlersetup.exe fiddlersetup.exe no specs offeredbuilt.exe no specs #REMCOS prueba.exe conhost.exe no specs cmd.exe conhost.exe no specs jigsaw.exe crspoofer.exe dmshell.exe powershell.exe no specs drpbx.exe no specs #QUASARRAT client-built.exe #NJRAT server.exe cmd.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs runtime.exe tasklist.exe no specs findstr.exe no specs #QUASARRAT runtimebroker.exe xclient.exe svchost.exe schtasks.exe no specs conhost.exe no specs #ASYNCRAT imagelogger.exe timeout.exe no specs runtimebroker.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs mph.pif timeout.exe no specs ping.exe no specs schtasks.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs svchost.exe curl.exe no specs #NJRAT server.exe srtasks.exe no specs conhost.exe no specs msiexec.exe no specs msiexec.exe no specs powershell.exe no specs conhost.exe no specs #SCREENCONNECT screenconnect.clientservice.exe screenconnect.windowsclient.exe no specs #SYSTEMBC kthtsg.exe netsh.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs runtimebroker.exe no specs chcp.com no specs ping.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs powershell.exe no specs conhost.exe no specs slui.exe 3d%20builder_12_1201419.exe xs.exe powershell.exe no specs conhost.exe no specs purchaseorder.exe chsztdjvl.exe no specs cmd.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs timeout.exe no specs schtasks.exe no specs #REMCOS evetbeta.exe conhost.exe no specs kuwaitsetuphockey.exe kuwaitsetuphockey.tmp schtasks.exe no specs conhost.exe no specs 444.exe windows 3543.exe aspnet_regbrowsers.exe runtimebroker.exe no specs schtasks.exe no specs conhost.exe no specs shellexperiencehost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs main.exe #ASYNCRAT discord3.exe conhost.exe main.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe cmd.exe no specs conhost.exe no specs conhost.exe no specs timeout.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs esentutl.exe esentutl.exe alpha.pif no specs alpha.pif no specs alpha.pif no specs xpha.pif no specs netsh.exe no specs installer.exe conhost.exe no specs discord.exe nomoreransom.exe cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs wmic.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs cmd.exe no specs conhost.exe no specs netsh.exe no specs per.exe no specs esentutl.exe conhost.exe no specs dick.exe pha.pif no specs mph.pif conhost.exe no specs alpha.pif no specs alpha.pif no specs alpha.pif no specs esentutl.exe conhost.exe no specs #M0YV kzgqdtrg.pif armsvc.exe no specs #M0YV flashplayerupdateservice.exe no specs #M0YV alg.exe #M0YV appvclient.exe no specs #M0YV diagnosticshub.standardcollector.service.exe microsoftedgeupdate.exe no specs tjqdq.exe microsoftedgeupdate.exe no specs microsoftedgeupdate.exe no specs microsoftedgeupdatecomregistershell64.exe no specs #M0YV fxssvc.exe no specs gameinputsvc.exe no specs gameinputsvc.exe no specs #M0YV elevation_service.exe googleupdate.exe no specs microsoftedgeupdatecomregistershell64.exe no specs microsoftedgeupdatecomregistershell64.exe no specs yz.exe sys.exe conhost.exe no specs microsoftedgeupdate.exe no specs googleupdate.exe no specs googleupdate.exe #M0YV elevation_service.exe googlecrashhandler.exe no specs googlecrashhandler64.exe no specs #M0YV maintenanceservice.exe no specs googleupdate.exe no specs #M0YV msdtc.exe msf.exe #M0YV perceptionsimulationservice.exe #NJRAT njrat.exe perfhost.exe no specs #M0YV psexesvc.exe no specs #M0YV locator.exe no specs file.exe #M0YV sensordataservice.exe no specs werfault.exe no specs #M0YV snmptrap.exe no specs cmd.exe no specs #M0YV spectrum.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs route.exe no specs #QUASARRAT java32.exe #M0YV ssh-agent.exe no specs #M0YV tieringengineservice.exe no specs #M0YV agentservice.exe no specs #M0YV vds.exe no specs cmd.exe no specs #M0YV wbengine.exe no specs netstat.exe no specs findstr.exe no specs schtasks.exe no specs conhost.exe no specs #M0YV wmiapsrv.exe no specs java.exe #M0YV searchindexer.exe no specs schtasks.exe no specs conhost.exe no specs cmd.exe no specs #MINER ksoftriqd.exe conhost.exe no specs #NJRAT rundll32.exe microsoftedgeupdate.exe adaptorovernight.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs netsh.exe no specs #QUASARRAT discord.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs notepad++.exe no specs chcp.com no specs java.exe schtasks.exe no specs ping.exe no specs conhost.exe no specs cmd.exe conhost.exe no specs googleupdate.exe windows 3543.exe schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs origin.pif timeout.exe no specs schtasks.exe no specs conhost.exe no specs java.exe schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs searchprotocolhost.exe no specs java.exe searchfilterhost.exe no specs schtasks.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs origin.pif java.exe schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs #M0YV flmgrtray.exe sc.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs winmanager.exe werfault.exe no specs sc.exe no specs conhost.exe no specs windows 3543.exe schtasks.exe no specs conhost.exe no specs java.exe schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs sc.exe no specs conhost.exe no specs java.exe schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs werfault.exe no specs #M0YV firefox.exe no specs #M0YV firefox.exe microsoftedgeupdate.exe java.exe schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs werfault.exe no specs #M0YV vssvc.exe no specs java.exe svchost.exe schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs #M0YV firefox.exe no specs werfault.exe no specs #M0YV firefox.exe no specs Delivery Optimization User no specs werfault.exe no specs #M0YV firefox.exe no specs werfault.exe no specs java.exe windows 3543.exe schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs firefox.exe no specs #M0YV msdtc.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs java.exe no specs 4363463463464363463463463.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
516schtasks.exe /create /tn "smsss" /sc MINUTE /mo 13 /tr "'C:\Users\Default\Pictures\smss.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exeWmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
516C:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10 C:\Users\Public\alpha.pifcmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\users\public\alpha.pif
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
616C:\WINDOWS\system32\cmd.exe /c "ver"C:\Windows\System32\cmd.exemain.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
616C:\\Users\\Public\\pha.pif -WindowStyle hidden -Command Add-MpPreference -ExclusionExtension '.exe','bat','.pif'C:\Users\Public\pha.pifper.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\users\public\pha.pif
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
616"schtasks" /create /tn "java ©" /sc ONLOGON /tr "C:\Users\admin\AppData\Roaming\Programfiles\java.exe" /rl HIGHEST /fC:\Windows\System32\schtasks.exeJava32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
632"C:\Users\admin\Desktop\Files\sys.exe" C:\Users\admin\Desktop\Files\sys.exe
4363463463464363463463463.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\files\sys.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
664"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Roaming\reviewintobrokerHost\aUs3pwix5Vd1U6IYzTsfZ9E8dEV3MF.vbe" C:\Windows\SysWOW64\wscript.exeARA.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\syswow64\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
668C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Hk5hBxJmiiEK.bat" "C:\Windows\System32\cmd.exewindows 3543.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
720"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
720schtasks.exe /create /tn "services" /sc ONLOGON /tr "'C:\Users\Default\Downloads\services.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exeWmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
167 776
Read events
161 038
Write events
6 593
Delete events
145

Modification events

(PID) Process:(7184) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7184) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7184) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(7184) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(7184) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(7184) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(7184) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(7184) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(7184) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(7184) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
Executable files
492
Suspicious files
492
Text files
182
Unknown types
0

Dropped files

PID
Process
Filename
Type
720BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\ea05367b-d4dc-4d53-ab69-e08a7e34c8db.down_data
MD5:
SHA256:
4200loader.exeC:\Users\admin\AppData\Local\Temp\rhsgn_protected.exeexecutable
MD5:D0DE8273F957E0508F8B5A0897FECCE9
SHA256:B4144CFD46AD378183A9F1D0136B8465CE80DE44423343891400524CB6CC57EB
5216rhsgn_protected.exeC:\Users\admin\AppData\Local\Temp\DMON.dllexecutable
MD5:58F7761BE8678A189604E2B61C7D7AEB
SHA256:F759CEF48A4E798BEC5AC8BAF10376E1E024E0A128B4B4A5B45F289EE31207DF
5216rhsgn_protected.exeC:\Users\admin\AppData\Local\Temp\ebehmonl.dllexecutable
MD5:2686070D4A4B5C7401B7AF185ABD71BF
SHA256:11F686ACA158EF40459B0CF92F117186B63765151BDF4295C268AE5DADCABE2A
5216rhsgn_protected.exeC:\Users\admin\AppData\Local\Temp\ARA.exeexecutable
MD5:FB10155E44F99861B4F315842AAD8117
SHA256:118F5BA14837745EEF57BF35ED413AAF13945E8651EBF361304A86B28B0A532C
71844363463463464363463463463.exeC:\Users\admin\Desktop\Files\JJSPLOIT.V2.exeexecutable
MD5:D4A776EA55E24D3124A6E0759FB0AC44
SHA256:7EF4D0236C81894178A6CFC6C27920217BEA42A3602AD7A6002834718BA7B93C
5216rhsgn_protected.exeC:\Users\admin\AppData\Local\Temp\cfgres.dllexecutable
MD5:F4C9CF4A73F3ACD5A4EF1F60F9297145
SHA256:81B4575928B6D753306848C2F9217BA076D3C0643CB20F378CD883CDB4FDD329
5216rhsgn_protected.exeC:\Users\admin\AppData\Local\Temp\concrt140.dllexecutable
MD5:119DBAD74C457A2D692CE6765028E88B
SHA256:5F6A435A4A1DA4BBBF8ADB80BD7A81F263FF98D0193AF4ED8E15D39F803DE06E
720BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\ea05367b-d4dc-4d53-ab69-e08a7e34c8db.bf2b7174-fb89-4284-9927-da496648577c.down_metabinary
MD5:0542E8AFA4455D800FE47D0EAE853619
SHA256:CC42CA40482E5DAE734CECF8FD541D0B6366D90ADC55ECB390B18E834CEFB566
71844363463463464363463463463.exeC:\Users\admin\Desktop\Files\crack.exeexecutable
MD5:53E21B02D31FA26942AEBEA39296B492
SHA256:EECDEEFFE3F7627F27EB2683D657A63503744E832702890F4BC97724AEAED73D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
577
TCP/UDP connections
112 176
DNS requests
319
Threats
227

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7708
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
whitelisted
7708
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
whitelisted
7184
4363463463464363463463463.exe
GET
200
122.143.2.98:80
http://down10d.zol.com.cn/zoldownload/foobar2000_v1.6.7_beta_17@1704_129472.exe
unknown
whitelisted
7184
4363463463464363463463463.exe
GET
200
45.59.120.8:80
http://45.59.120.8/files/catlogs/rundrive.exe
unknown
unknown
7184
4363463463464363463463463.exe
GET
200
93.176.52.107:80
http://93.176.52.107/Pack_Brout_ncrypt.exe
unknown
malicious
7184
4363463463464363463463463.exe
GET
301
140.82.121.3:80
http://github.com/heysama/afsgdhzx/raw/refs/heads/main/AsyncClient.exe
unknown
whitelisted
7184
4363463463464363463463463.exe
GET
193.123.237.45:80
http://193.123.237.45/FiddlerSetup.exe
unknown
unknown
7184
4363463463464363463463463.exe
GET
200
172.105.66.118:80
http://172-105-66-118.ip.linodeusercontent.com/payloads/dmshell.exe
unknown
unknown
7184
4363463463464363463463463.exe
GET
301
140.82.121.3:80
http://github.com/tezx11/imgui/raw/refs/heads/main/RuntimeBroker.exe
unknown
whitelisted
7184
4363463463464363463463463.exe
GET
301
140.82.121.3:80
http://github.com/Abdulah345/pizdaporc/raw/refs/heads/main/XClient.exe
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
2104
svchost.exe
4.231.128.59:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1072
RUXIMICS.exe
4.231.128.59:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4.231.128.59:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
whitelisted
5496
MoUsoCoreWorker.exe
4.231.128.59:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7184
4363463463464363463463463.exe
151.101.2.49:443
urlhaus.abuse.ch
FASTLY
US
whitelisted
7184
4363463463464363463463463.exe
210.19.94.140:443
www.maxmoney.com
TIME dotCom Berhad No. 14, Jalan Majistret U126 Hicom Glenmarie Industrial Park 40150 Shah Al
MY
unknown
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.32.74:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.110
whitelisted
urlhaus.abuse.ch
  • 151.101.2.49
  • 151.101.66.49
  • 151.101.130.49
  • 151.101.194.49
whitelisted
www.maxmoney.com
  • 210.19.94.140
unknown
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 40.126.32.74
  • 20.190.160.22
  • 20.190.160.128
  • 40.126.32.136
  • 40.126.32.76
  • 40.126.32.133
  • 20.190.160.20
  • 20.190.160.14
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 20.73.194.208
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
github.com
  • 140.82.121.3
whitelisted
objects.githubusercontent.com
  • 185.199.109.133
  • 185.199.108.133
  • 185.199.110.133
  • 185.199.111.133
whitelisted
www.bing.com
  • 2.23.227.221
  • 2.23.227.208
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
7184
4363463463464363463463463.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7184
4363463463464363463463463.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7184
4363463463464363463463463.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
7184
4363463463464363463463463.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7184
4363463463464363463463463.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
7184
4363463463464363463463463.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
7184
4363463463464363463463463.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
7184
4363463463464363463463463.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7184
4363463463464363463463463.exe
Potential Corporate Privacy Violation
ET INFO PE EXE or DLL Windows file download HTTP
No debug info