File name:

4363463463464363463463463.exe

Full analysis: https://app.any.run/tasks/caa70db2-d533-4b40-8833-2ce2e6562d8c
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Analysis date: July 07, 2024, 18:48:39
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
opendir
loader
hausbomber
dcrat
evasion
rhadamanthys
stealer
autoit
adware
azorult
github
ransomware
redline
metastealer
pastebin
ssh
upx
phishing
telegram
miner
smtp
exfiltration
agenttesla
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

2A94F3960C58C6E70826495F76D00B85

SHA1:

E2A1A5641295F5EBF01A37AC1C170AC0814BB71A

SHA256:

2FCAD226B17131DA4274E1B9F8F31359BDD325C9568665F08FD1F6C5D06A23CE

SSDEEP:

192:2we8sGKE6MqyG7c20L7BIW12n/ePSmzkTInu8stYcFwVc03KY:9e8sGKfMqyGg20PKn/cRaInuptYcFwVY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Drops the executable file immediately after the start

      • 4363463463464363463463463.exe (PID: 6156)
      • sc.exe (PID: 6624)
      • asdfg.exe (PID: 1888)
      • pocketrar350sc.exe (PID: 2416)
      • WezoAutoUP.exe (PID: 3992)
      • BLueHvffhw.exe (PID: 2404)
      • DownVerySync.exe (PID: 4004)
      • 4363463463464363463463463.exe (PID: 6660)
      • 5O9oJ7.exe (PID: 4180)
      • DeathRansom_1.exe (PID: 7244)
      • 4363463463464363463463463.exe (PID: 1300)
      • dbzclientUpdate.exe (PID: 7372)
      • GTA_V.tmp (PID: 7556)
      • GTA_V.exe (PID: 7660)
      • 4363463463464363463463463.exe (PID: 2516)
      • 745fefcace80371e3ae5.exe (PID: 4532)
      • Server.exe (PID: 7088)
      • RegAsm.exe (PID: 7864)
      • SteamService.exe (PID: 7856)
      • ma.exe (PID: 7320)
      • KuwaitSetupHockey.exe (PID: 1052)
      • KuwaitSetupHockey.tmp (PID: 4328)
      • igccu.exe (PID: 6648)
      • 1.exe (PID: 8068)
      • nxmr.exe (PID: 6776)
      • 8.exe (PID: 6452)
      • 8.exe (PID: 7396)
      • 8.exe (PID: 4852)
      • 8.exe (PID: 7856)
      • SrbijaSetupHokej.exe (PID: 7608)
      • 8.exe (PID: 7684)
      • SrbijaSetupHokej.tmp (PID: 5952)
    • Create files in the Startup directory

      • sc.exe (PID: 6624)
      • InstallUtil.exe (PID: 7024)
    • HAUSBOMBER has been detected (YARA)

      • 4363463463464363463463463.exe (PID: 6156)
      • 4363463463464363463463463.exe (PID: 2516)
    • DCRAT has been detected (YARA)

      • 4363463463464363463463463.exe (PID: 6156)
      • 4363463463464363463463463.exe (PID: 2516)
    • Steals credentials from Web Browsers

      • 37.exe (PID: 2208)
      • newbuild.exe (PID: 7060)
      • Server.exe (PID: 7088)
      • svhoost.exe (PID: 6744)
      • don701.exe (PID: 6864)
    • Actions looks like stealing of personal data

      • 37.exe (PID: 2208)
      • OOBE-Maintenance.exe (PID: 5116)
      • OOBE-Maintenance.exe (PID: 6640)
      • GTA_V.tmp (PID: 7556)
      • Server.exe (PID: 7088)
      • newbuild.exe (PID: 7060)
      • OOBE-Maintenance.exe (PID: 5840)
      • svhoost.exe (PID: 6744)
      • OOBE-Maintenance.exe (PID: 7520)
      • don701.exe (PID: 6864)
      • OOBE-Maintenance.exe (PID: 1120)
      • 8.exe (PID: 6452)
      • 8.exe (PID: 4852)
      • 8.exe (PID: 7684)
      • 8.exe (PID: 7856)
    • Changes the autorun value in the registry

      • WezoAutoUP.exe (PID: 3992)
      • sc.exe (PID: 6624)
      • 745fefcace80371e3ae5.exe (PID: 4532)
    • Bypass execution policy to execute commands

      • powershell.exe (PID: 884)
      • powershell.exe (PID: 3932)
      • powershell.exe (PID: 7280)
    • Run PowerShell with an invisible window

      • powershell.exe (PID: 884)
      • powershell.exe (PID: 3932)
      • powershell.exe (PID: 7280)
    • RHADAMANTHYS has been detected (SURICATA)

      • OpenWith.exe (PID: 6640)
      • OOBE-Maintenance.exe (PID: 5116)
      • OpenWith.exe (PID: 32)
      • OOBE-Maintenance.exe (PID: 6640)
      • OpenWith.exe (PID: 8012)
      • OOBE-Maintenance.exe (PID: 5840)
      • OpenWith.exe (PID: 7352)
      • OOBE-Maintenance.exe (PID: 7520)
      • OpenWith.exe (PID: 6560)
      • OOBE-Maintenance.exe (PID: 1120)
      • OpenWith.exe (PID: 7900)
    • Creates a writable file in the system directory

      • storyhosts.exe (PID: 6940)
    • Renames files like ransomware

      • DeathRansom_1.exe (PID: 7244)
    • Adds path to the Windows Defender exclusion list

      • asec.exe (PID: 7464)
      • cmd.exe (PID: 7760)
      • time2time.exe (PID: 6056)
    • Creates or modifies Windows services

      • asec.exe (PID: 7464)
    • Changes the Windows auto-update feature

      • asec.exe (PID: 7464)
    • Changes appearance of the Explorer extensions

      • asec.exe (PID: 7464)
    • Changes Security Center notification settings

      • asec.exe (PID: 7464)
    • Connects to the CnC server

      • uRA7.exe (PID: 7112)
      • 55hdQ.exe (PID: 6828)
      • newbuild.exe (PID: 7060)
      • svhoost.exe (PID: 6744)
      • 9sD9R.exe (PID: 8004)
      • .exe (PID: 7812)
      • vbc.exe (PID: 2648)
      • 79B.exe (PID: 8084)
    • AZORULT has been detected (SURICATA)

      • uRA7.exe (PID: 7112)
      • 55hdQ.exe (PID: 6828)
      • 9sD9R.exe (PID: 8004)
      • 79B.exe (PID: 8084)
    • REDLINE has been detected (SURICATA)

      • newbuild.exe (PID: 7060)
      • svhoost.exe (PID: 6744)
    • METASTEALER has been detected (SURICATA)

      • newbuild.exe (PID: 7060)
      • svhoost.exe (PID: 6744)
    • UAC/LUA settings modification

      • time2time.exe (PID: 6056)
      • reg.exe (PID: 7432)
    • Scans artifacts that could help determine the target

      • 1.exe (PID: 8068)
      • GoogleUpdate.exe (PID: 6388)
      • don701.exe (PID: 6864)
    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 5396)
    • Starts CertUtil for downloading files

      • cmd.exe (PID: 8008)
    • Uses Task Scheduler to autorun other applications

      • cmd.exe (PID: 8008)
    • AGENTTESLA has been detected (SURICATA)

      • don701.exe (PID: 6864)
  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 4363463463464363463463463.exe (PID: 6156)
      • asdfg.exe (PID: 1888)
      • pocketrar350sc.exe (PID: 2416)
      • WezoAutoUP.exe (PID: 3992)
      • file.exe (PID: 5004)
      • uninstall.exe (PID: 6824)
      • Downaqzh.exe (PID: 5076)
      • DownSysSoft.exe (PID: 1132)
      • DownVerySync.exe (PID: 4004)
      • uRA7.exe (PID: 7112)
      • 55hdQ.exe (PID: 6828)
      • 4363463463464363463463463.exe (PID: 6660)
      • asec.exe (PID: 7464)
      • 4363463463464363463463463.exe (PID: 1300)
      • wzoptBmp.exe (PID: 1164)
      • 4363463463464363463463463.exe (PID: 2516)
      • RegAsm.exe (PID: 7864)
      • time2time.exe (PID: 6056)
      • InstallUtil.exe (PID: 7024)
      • file.exe (PID: 2056)
      • 1.exe (PID: 8068)
      • 9sD9R.exe (PID: 8004)
      • .exe (PID: 7812)
      • DownSysSoft.exe (PID: 2992)
      • 79B.exe (PID: 8084)
      • GoogleUpdate.exe (PID: 3188)
      • GoogleUpdate.exe (PID: 6388)
      • Downaqzh.exe (PID: 8160)
      • 8.exe (PID: 6452)
    • Reads the date of Windows installation

      • 4363463463464363463463463.exe (PID: 6156)
      • asdfg.exe (PID: 1888)
      • pocketrar350sc.exe (PID: 2416)
      • 4363463463464363463463463.exe (PID: 6660)
      • asec.exe (PID: 7464)
      • 4363463463464363463463463.exe (PID: 1300)
      • wzoptBmp.exe (PID: 1164)
      • 4363463463464363463463463.exe (PID: 2516)
      • RegAsm.exe (PID: 7864)
      • time2time.exe (PID: 6056)
      • InstallUtil.exe (PID: 7024)
      • .exe (PID: 7812)
      • GoogleUpdate.exe (PID: 3188)
      • 1.exe (PID: 8068)
    • Executable content was dropped or overwritten

      • 4363463463464363463463463.exe (PID: 6156)
      • sc.exe (PID: 6624)
      • asdfg.exe (PID: 1888)
      • pocketrar350sc.exe (PID: 2416)
      • WezoAutoUP.exe (PID: 3992)
      • BLueHvffhw.exe (PID: 2404)
      • DownVerySync.exe (PID: 4004)
      • OOBE-Maintenance.exe (PID: 5116)
      • OOBE-Maintenance.exe (PID: 6640)
      • 4363463463464363463463463.exe (PID: 6660)
      • 5O9oJ7.exe (PID: 4180)
      • DeathRansom_1.exe (PID: 7244)
      • 4363463463464363463463463.exe (PID: 1300)
      • dbzclientUpdate.exe (PID: 7372)
      • GTA_V.tmp (PID: 7556)
      • GTA_V.exe (PID: 7660)
      • 4363463463464363463463463.exe (PID: 2516)
      • conhost.exe (PID: 7288)
      • Server.exe (PID: 7088)
      • 745fefcace80371e3ae5.exe (PID: 4532)
      • RegAsm.exe (PID: 7864)
      • SteamService.exe (PID: 7856)
      • OOBE-Maintenance.exe (PID: 5840)
      • ma.exe (PID: 7320)
      • OOBE-Maintenance.exe (PID: 7520)
      • KuwaitSetupHockey.exe (PID: 1052)
      • igccu.exe (PID: 6648)
      • KuwaitSetupHockey.tmp (PID: 4328)
      • nxmr.exe (PID: 6776)
      • 1.exe (PID: 8068)
      • 8.exe (PID: 4852)
      • 8.exe (PID: 7396)
      • 8.exe (PID: 6452)
      • 8.exe (PID: 7856)
      • SrbijaSetupHokej.exe (PID: 7608)
      • 8.exe (PID: 7684)
      • SrbijaSetupHokej.tmp (PID: 5952)
    • Application launched itself

      • BLueHvffhw.exe (PID: 3976)
      • asdfg.exe (PID: 1888)
      • net.exe (PID: 452)
      • zxcvb.exe (PID: 448)
      • uRA7.exe (PID: 5452)
      • 55hdQ.exe (PID: 4024)
      • 5O9oJ7.exe (PID: 32)
      • mP5`GbMl(.exe (PID: 7264)
      • AddInUtil.exe (PID: 7596)
      • FallbackBuffer.exe (PID: 7192)
      • InstallUtil.exe (PID: 1436)
      • wzoptBmp.exe (PID: 1164)
      • native.exe (PID: 3868)
      • ghjkl.exe (PID: 8140)
      • UseLegacyFipsThrow.exe (PID: 8028)
      • ghjk.exe (PID: 6884)
      • net.exe (PID: 7524)
      • native.exe (PID: 7980)
      • asdfg.exe (PID: 6644)
      • 9sD9R.exe (PID: 7252)
      • ruNO}Su(.exe (PID: 6552)
      • 79B.exe (PID: 6988)
      • don701.exe (PID: 4316)
      • oVlF.exe (PID: 6924)
      • ghjk.exe (PID: 6416)
      • 8.exe (PID: 6452)
      • 1.exe (PID: 8068)
      • 8.exe (PID: 7684)
    • The process checks if it is being run in the virtual environment

      • OpenWith.exe (PID: 6640)
      • OpenWith.exe (PID: 32)
      • OpenWith.exe (PID: 8012)
      • OpenWith.exe (PID: 7352)
      • OpenWith.exe (PID: 6560)
      • OpenWith.exe (PID: 7900)
    • Reads Microsoft Outlook installation path

      • pocketrar350sc.exe (PID: 2416)
    • Reads Internet Explorer settings

      • pocketrar350sc.exe (PID: 2416)
    • Process uses IPCONFIG to get network configuration information

      • cmd.exe (PID: 608)
    • The process executes via Task Scheduler

      • powershell.exe (PID: 884)
      • powershell.exe (PID: 3932)
      • FallbackBuffer.exe (PID: 7192)
      • powershell.exe (PID: 7280)
      • UseLegacyFipsThrow.exe (PID: 8028)
      • wupgrdsv.exe (PID: 6188)
    • Loads DLL from Mozilla Firefox

      • OOBE-Maintenance.exe (PID: 5116)
      • OOBE-Maintenance.exe (PID: 6640)
      • OOBE-Maintenance.exe (PID: 5840)
      • OOBE-Maintenance.exe (PID: 7520)
      • OOBE-Maintenance.exe (PID: 1120)
    • Searches for installed software

      • OOBE-Maintenance.exe (PID: 5116)
      • OOBE-Maintenance.exe (PID: 6640)
      • OOBE-Maintenance.exe (PID: 5840)
      • newbuild.exe (PID: 7060)
      • OOBE-Maintenance.exe (PID: 7520)
      • svhoost.exe (PID: 6744)
      • OOBE-Maintenance.exe (PID: 1120)
    • Starts CMD.EXE for commands execution

      • arpwriteIni.exe (PID: 1928)
      • asec.exe (PID: 7464)
      • Server.exe (PID: 7088)
      • ma.exe (PID: 7320)
      • .exe (PID: 7812)
      • av_downloader.exe (PID: 2216)
      • av_downloader.exe (PID: 6988)
    • Checks Windows Trust Settings

      • file.exe (PID: 5004)
      • file.exe (PID: 2056)
      • GoogleUpdate.exe (PID: 6388)
      • 1.exe (PID: 8068)
      • msiexec.exe (PID: 7572)
      • 8.exe (PID: 6452)
    • Creates a software uninstall entry

      • uninstall.exe (PID: 6824)
      • 745fefcace80371e3ae5.exe (PID: 4532)
    • Executes application which crashes

      • file.exe (PID: 5004)
      • gold.exe (PID: 7352)
      • 33333.exe (PID: 7260)
      • time2time.exe (PID: 6056)
      • file.exe (PID: 2056)
    • Drops 7-zip archiver for unpacking

      • DownVerySync.exe (PID: 4004)
      • dbzclientUpdate.exe (PID: 7372)
      • GTA_V.tmp (PID: 7556)
    • Potential Corporate Privacy Violation

      • WezoAutoUP.exe (PID: 3992)
      • Downaqzh.exe (PID: 5076)
      • DownSysSoft.exe (PID: 1132)
      • 4363463463464363463463463.exe (PID: 6156)
      • DownVerySync.exe (PID: 4004)
      • 4363463463464363463463463.exe (PID: 2516)
      • 4363463463464363463463463.exe (PID: 1300)
      • 4363463463464363463463463.exe (PID: 6660)
      • Steam.exe (PID: 1508)
      • win.exe (PID: 6204)
      • 1.exe (PID: 8068)
      • Server.exe (PID: 7088)
      • vbc.exe (PID: 2648)
      • DownSysSoft.exe (PID: 2992)
      • certutil.exe (PID: 6452)
      • Downaqzh.exe (PID: 8160)
    • Checks for external IP

      • 37.exe (PID: 2208)
      • GTA_V.tmp (PID: 7556)
      • Server.exe (PID: 7088)
    • Contacting a server suspected of hosting an CnC

      • OpenWith.exe (PID: 6640)
      • OpenWith.exe (PID: 32)
      • OOBE-Maintenance.exe (PID: 5116)
      • uRA7.exe (PID: 7112)
      • OOBE-Maintenance.exe (PID: 6640)
      • 55hdQ.exe (PID: 6828)
      • 4363463463464363463463463.exe (PID: 6660)
      • OpenWith.exe (PID: 8012)
      • OOBE-Maintenance.exe (PID: 5840)
      • OpenWith.exe (PID: 7352)
      • OOBE-Maintenance.exe (PID: 7520)
      • 9sD9R.exe (PID: 8004)
      • OpenWith.exe (PID: 6560)
      • 79B.exe (PID: 8084)
      • OOBE-Maintenance.exe (PID: 1120)
      • OpenWith.exe (PID: 7900)
    • Access to an unwanted program domain was detected

      • WezoAutoUP.exe (PID: 3992)
    • Process requests binary or script from the Internet

      • WezoAutoUP.exe (PID: 3992)
      • 4363463463464363463463463.exe (PID: 1300)
      • 4363463463464363463463463.exe (PID: 2516)
      • 4363463463464363463463463.exe (PID: 6660)
      • 4363463463464363463463463.exe (PID: 6156)
      • certutil.exe (PID: 6452)
      • 1.exe (PID: 8068)
    • Connects to unusual port

      • 4363463463464363463463463.exe (PID: 6156)
      • Downaqzh.exe (PID: 5076)
      • DownSysSoft.exe (PID: 1132)
      • WezoAutoUP.exe (PID: 3992)
      • RegAsm.exe (PID: 7380)
      • AddInUtil.exe (PID: 7692)
      • RegAsm.exe (PID: 7968)
      • InstallUtil.exe (PID: 7512)
      • 4363463463464363463463463.exe (PID: 2516)
      • newbuild.exe (PID: 7060)
      • svhoost.exe (PID: 6744)
      • One.exe (PID: 7256)
      • win.exe (PID: 6204)
      • vbc.exe (PID: 2648)
      • DownSysSoft.exe (PID: 2992)
      • 4363463463464363463463463.exe (PID: 6660)
      • Downaqzh.exe (PID: 8160)
      • certutil.exe (PID: 6452)
    • Creates files in the driver directory

      • storyhosts.exe (PID: 6940)
    • Creates file in the systems drive root

      • DeathRansom_1.exe (PID: 7244)
    • Creates files like ransomware instruction

      • DeathRansom_1.exe (PID: 7244)
      • Server.exe (PID: 7088)
    • Creates or modifies Windows services

      • asec.exe (PID: 7464)
    • Script adds exclusion path to Windows Defender

      • cmd.exe (PID: 7760)
      • time2time.exe (PID: 6056)
    • The process hide an interactive prompt from the user

      • cmd.exe (PID: 7760)
    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 7760)
      • time2time.exe (PID: 6056)
    • Reads the BIOS version

      • %E6%85%95%E8%AF%BE%E7%BD%91%E8%A7%86%E9%A2%91%E8%A7%A3%E6%9E%90%E5%B7%A5%E5%85%B7_2015.exe (PID: 5732)
    • Likely accesses (executes) a file from the Public directory

      • notepad.exe (PID: 7004)
    • Reads the Windows owner or organization settings

      • GTA_V.tmp (PID: 7556)
      • KuwaitSetupHockey.tmp (PID: 4328)
      • SrbijaSetupHokej.tmp (PID: 5952)
    • Process drops legitimate windows executable

      • GTA_V.tmp (PID: 7556)
      • 4363463463464363463463463.exe (PID: 6156)
      • 1.exe (PID: 8068)
    • The process verifies whether the antivirus software is installed

      • GTA_V.tmp (PID: 7556)
    • The process creates files with name similar to system file names

      • 745fefcace80371e3ae5.exe (PID: 4532)
    • Reads browser cookies

      • OOBE-Maintenance.exe (PID: 5840)
      • OOBE-Maintenance.exe (PID: 1120)
    • Write to the desktop.ini file (may be used to cloak folders)

      • Server.exe (PID: 7088)
    • Malware-specific behavior (creating "System.dll" in Temp)

      • 745fefcace80371e3ae5.exe (PID: 4532)
    • Connects to the server without a host name

      • 4363463463464363463463463.exe (PID: 1300)
      • 4363463463464363463463463.exe (PID: 2516)
      • 4363463463464363463463463.exe (PID: 6156)
    • Adds/modifies Windows certificates

      • svhoost.exe (PID: 6744)
      • 1.exe (PID: 8068)
    • Detected use of alternative data streams (AltDS)

      • powershell.exe (PID: 6192)
      • powershell.exe (PID: 8072)
    • Starts application with an unusual extension

      • cmd.exe (PID: 3164)
      • cmd.exe (PID: 7064)
    • Uses NETSH.EXE to obtain data on the network

      • cmd.exe (PID: 7064)
      • cmd.exe (PID: 3164)
    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 3164)
    • Identifying current user with WHOAMI command

      • win.exe (PID: 6204)
    • Process creates executable files without a name

      • ma.exe (PID: 7320)
      • cmd.exe (PID: 7504)
      • .exe (PID: 7812)
    • Executing commands from a ".bat" file

      • ma.exe (PID: 7320)
      • av_downloader.exe (PID: 2216)
      • av_downloader.exe (PID: 6988)
    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 7504)
      • cmd.exe (PID: 8008)
    • The process drops C-runtime libraries

      • GTA_V.tmp (PID: 7556)
    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • Server.exe (PID: 7088)
    • Crypto Currency Mining Activity Detected

      • .exe (PID: 7812)
      • vbc.exe (PID: 2648)
    • Starts a Microsoft application from unusual location

      • don701.exe (PID: 4316)
      • don701.exe (PID: 6864)
      • YandexPackSetup.exe (PID: 7040)
    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 8008)
    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 8008)
    • Connects to SMTP port

      • don701.exe (PID: 6864)
    • The process connected to a server suspected of theft

      • don701.exe (PID: 6864)
    • Starts itself from another location

      • 8.exe (PID: 6452)
  • INFO

    • Checks supported languages

      • 4363463463464363463463463.exe (PID: 6156)
      • sc.exe (PID: 6624)
      • asdfg.exe (PID: 1888)
      • 37.exe (PID: 2208)
      • file.exe (PID: 5004)
      • BLueHvffhw.exe (PID: 3976)
      • asdfg.exe (PID: 3968)
      • BLueHvffhw.exe (PID: 2404)
      • net.exe (PID: 452)
      • net.exe (PID: 7024)
      • WezoAutoUP.exe (PID: 3992)
      • pocketrar350sc.exe (PID: 2416)
      • arpwriteIni.exe (PID: 1928)
      • Downdd.exe (PID: 1052)
      • WezoEventUP.exe (PID: 3088)
      • zxcvb.exe (PID: 448)
      • zxcvb.exe (PID: 3680)
      • uninstall.exe (PID: 6824)
      • Downaqzh.exe (PID: 5076)
      • DownSysSoft.exe (PID: 1132)
      • DownVerySync.exe (PID: 4004)
      • 7z.exe (PID: 6936)
      • DelHosts.exe (PID: 5140)
      • wzoptup.exe (PID: 6628)
      • uRA7.exe (PID: 5452)
      • storyhosts.exe (PID: 6940)
      • 5O9oJ7.exe (PID: 32)
      • uRA7.exe (PID: 7112)
      • 55hdQ.exe (PID: 4024)
      • 55hdQ.exe (PID: 6828)
      • 5O9oJ7.exe (PID: 4180)
      • 4363463463464363463463463.exe (PID: 2516)
      • 4363463463464363463463463.exe (PID: 1300)
      • 4363463463464363463463463.exe (PID: 6660)
      • DeathRansom_1.exe (PID: 7244)
      • mP5`GbMl(.exe (PID: 7264)
      • mP5`GbMl(.exe (PID: 7316)
      • gold.exe (PID: 7352)
      • RegAsm.exe (PID: 7380)
      • asec.exe (PID: 7464)
      • sysup.exe (PID: 7648)
      • AddInUtil.exe (PID: 7596)
      • AddInUtil.exe (PID: 7692)
      • FallbackBuffer.exe (PID: 7192)
      • FallbackBuffer.exe (PID: 4316)
      • InstallUtil.exe (PID: 1436)
      • InstallUtil.exe (PID: 7512)
      • %E6%85%95%E8%AF%BE%E7%BD%91%E8%A7%86%E9%A2%91%E8%A7%A3%E6%9E%90%E5%B7%A5%E5%85%B7_2015.exe (PID: 5732)
      • dbzclientUpdate.exe (PID: 7372)
      • wzoptBmp.exe (PID: 1164)
      • GTA_V.tmp (PID: 7556)
      • crypted_c360a5b7.exe (PID: 7596)
      • wzoptBmp.exe (PID: 7432)
      • GTA_V.exe (PID: 7660)
      • native.exe (PID: 3868)
      • RegAsm.exe (PID: 7968)
      • native.exe (PID: 7996)
      • ghjkl.exe (PID: 8140)
      • ghjkl.exe (PID: 8104)
      • changezuhaolnk.exe (PID: 3236)
      • UseLegacyFipsThrow.exe (PID: 8028)
      • file.exe (PID: 2056)
      • UseLegacyFipsThrow.exe (PID: 8076)
      • Downdd.exe (PID: 7392)
      • newbuild.exe (PID: 7060)
      • Server.exe (PID: 7088)
      • ghjk.exe (PID: 6884)
      • net.exe (PID: 7644)
      • native.exe (PID: 7980)
      • ghjk.exe (PID: 7456)
      • net.exe (PID: 7524)
      • native.exe (PID: 7900)
      • time2time.exe (PID: 6056)
      • 745fefcace80371e3ae5.exe (PID: 4532)
      • 33333.exe (PID: 7260)
      • RegAsm.exe (PID: 7864)
      • svhoost.exe (PID: 6744)
      • One.exe (PID: 7256)
      • SteamService.exe (PID: 7856)
      • InstallUtil.exe (PID: 7024)
      • Steam.exe (PID: 1508)
      • 1.exe (PID: 8068)
      • win.exe (PID: 6204)
      • chcp.com (PID: 7076)
      • chcp.com (PID: 6100)
      • asdfg.exe (PID: 6644)
      • asdfg.exe (PID: 6508)
      • 9sD9R.exe (PID: 7252)
      • 9sD9R.exe (PID: 8004)
      • ma.exe (PID: 7320)
      • .exe (PID: 7812)
      • vbc.exe (PID: 2648)
      • ruNO}Su(.exe (PID: 6552)
      • ruNO}Su(.exe (PID: 7532)
      • nxmr.exe (PID: 6776)
      • 79B.exe (PID: 6988)
      • 79B.exe (PID: 8084)
      • DownSysSoft.exe (PID: 2992)
      • KuwaitSetupHockey.exe (PID: 1052)
      • KuwaitSetupHockey.tmp (PID: 4328)
      • ghjk.exe (PID: 6416)
      • igccu.exe (PID: 6648)
      • theporndude.exe (PID: 8028)
      • don701.exe (PID: 4316)
      • av_downloader.exe (PID: 2216)
      • oVlF.exe (PID: 6924)
      • don701.exe (PID: 6864)
      • GoogleUpdate.exe (PID: 3888)
      • GoogleUpdate.exe (PID: 3188)
      • GoogleUpdate.exe (PID: 6388)
      • oVlF.exe (PID: 4048)
      • GoogleUpdate.exe (PID: 7336)
      • av_downloader.exe (PID: 6988)
      • ghjk.exe (PID: 3508)
      • Downaqzh.exe (PID: 8160)
      • wupgrdsv.exe (PID: 6188)
      • 8.exe (PID: 6452)
      • msiexec.exe (PID: 7572)
      • 8.exe (PID: 4852)
      • YandexPackSetup.exe (PID: 7040)
      • 1.exe (PID: 7620)
      • 8.exe (PID: 7396)
      • 8.exe (PID: 7684)
      • 8.exe (PID: 7856)
      • SrbijaSetupHokej.tmp (PID: 5952)
      • SrbijaSetupHokej.exe (PID: 7608)
    • Reads the computer name

      • 4363463463464363463463463.exe (PID: 6156)
      • asdfg.exe (PID: 1888)
      • 37.exe (PID: 2208)
      • BLueHvffhw.exe (PID: 3976)
      • asdfg.exe (PID: 3968)
      • BLueHvffhw.exe (PID: 2404)
      • net.exe (PID: 452)
      • net.exe (PID: 7024)
      • WezoAutoUP.exe (PID: 3992)
      • pocketrar350sc.exe (PID: 2416)
      • zxcvb.exe (PID: 448)
      • zxcvb.exe (PID: 3680)
      • file.exe (PID: 5004)
      • uninstall.exe (PID: 6824)
      • Downaqzh.exe (PID: 5076)
      • DownSysSoft.exe (PID: 1132)
      • DownVerySync.exe (PID: 4004)
      • 7z.exe (PID: 6936)
      • uRA7.exe (PID: 5452)
      • uRA7.exe (PID: 7112)
      • storyhosts.exe (PID: 6940)
      • 5O9oJ7.exe (PID: 32)
      • 5O9oJ7.exe (PID: 4180)
      • 55hdQ.exe (PID: 4024)
      • 55hdQ.exe (PID: 6828)
      • 4363463463464363463463463.exe (PID: 2516)
      • 4363463463464363463463463.exe (PID: 1300)
      • 4363463463464363463463463.exe (PID: 6660)
      • mP5`GbMl(.exe (PID: 7316)
      • mP5`GbMl(.exe (PID: 7264)
      • DeathRansom_1.exe (PID: 7244)
      • AddInUtil.exe (PID: 7596)
      • RegAsm.exe (PID: 7380)
      • AddInUtil.exe (PID: 7692)
      • asec.exe (PID: 7464)
      • FallbackBuffer.exe (PID: 7192)
      • %E6%85%95%E8%AF%BE%E7%BD%91%E8%A7%86%E9%A2%91%E8%A7%A3%E6%9E%90%E5%B7%A5%E5%85%B7_2015.exe (PID: 5732)
      • FallbackBuffer.exe (PID: 4316)
      • InstallUtil.exe (PID: 1436)
      • wzoptBmp.exe (PID: 1164)
      • InstallUtil.exe (PID: 7512)
      • GTA_V.exe (PID: 7660)
      • GTA_V.tmp (PID: 7556)
      • wzoptBmp.exe (PID: 7432)
      • native.exe (PID: 3868)
      • native.exe (PID: 7996)
      • ghjkl.exe (PID: 8140)
      • ghjkl.exe (PID: 8104)
      • RegAsm.exe (PID: 7968)
      • UseLegacyFipsThrow.exe (PID: 8028)
      • UseLegacyFipsThrow.exe (PID: 8076)
      • Server.exe (PID: 7088)
      • ghjk.exe (PID: 6884)
      • newbuild.exe (PID: 7060)
      • net.exe (PID: 7524)
      • ghjk.exe (PID: 7456)
      • net.exe (PID: 7644)
      • time2time.exe (PID: 6056)
      • native.exe (PID: 7980)
      • native.exe (PID: 7900)
      • 745fefcace80371e3ae5.exe (PID: 4532)
      • RegAsm.exe (PID: 7864)
      • svhoost.exe (PID: 6744)
      • One.exe (PID: 7256)
      • InstallUtil.exe (PID: 7024)
      • SteamService.exe (PID: 7856)
      • Steam.exe (PID: 1508)
      • win.exe (PID: 6204)
      • file.exe (PID: 2056)
      • 1.exe (PID: 8068)
      • asdfg.exe (PID: 6644)
      • 9sD9R.exe (PID: 7252)
      • asdfg.exe (PID: 6508)
      • ma.exe (PID: 7320)
      • 9sD9R.exe (PID: 8004)
      • .exe (PID: 7812)
      • vbc.exe (PID: 2648)
      • ruNO}Su(.exe (PID: 6552)
      • ruNO}Su(.exe (PID: 7532)
      • DownSysSoft.exe (PID: 2992)
      • 79B.exe (PID: 6988)
      • 79B.exe (PID: 8084)
      • KuwaitSetupHockey.tmp (PID: 4328)
      • don701.exe (PID: 4316)
      • oVlF.exe (PID: 6924)
      • ghjk.exe (PID: 6416)
      • don701.exe (PID: 6864)
      • GoogleUpdate.exe (PID: 3888)
      • GoogleUpdate.exe (PID: 3188)
      • GoogleUpdate.exe (PID: 7336)
      • GoogleUpdate.exe (PID: 6388)
      • oVlF.exe (PID: 4048)
      • ghjk.exe (PID: 3508)
      • Downaqzh.exe (PID: 8160)
      • YandexPackSetup.exe (PID: 7040)
      • msiexec.exe (PID: 7572)
      • 8.exe (PID: 6452)
      • 8.exe (PID: 7684)
      • SrbijaSetupHokej.tmp (PID: 5952)
    • Reads the machine GUID from the registry

      • 4363463463464363463463463.exe (PID: 6156)
      • asdfg.exe (PID: 1888)
      • 37.exe (PID: 2208)
      • BLueHvffhw.exe (PID: 3976)
      • net.exe (PID: 452)
      • BLueHvffhw.exe (PID: 2404)
      • zxcvb.exe (PID: 448)
      • file.exe (PID: 5004)
      • uRA7.exe (PID: 5452)
      • uRA7.exe (PID: 7112)
      • 5O9oJ7.exe (PID: 4180)
      • 55hdQ.exe (PID: 4024)
      • 55hdQ.exe (PID: 6828)
      • 5O9oJ7.exe (PID: 32)
      • 4363463463464363463463463.exe (PID: 2516)
      • 4363463463464363463463463.exe (PID: 1300)
      • 4363463463464363463463463.exe (PID: 6660)
      • mP5`GbMl(.exe (PID: 7264)
      • mP5`GbMl(.exe (PID: 7316)
      • RegAsm.exe (PID: 7380)
      • AddInUtil.exe (PID: 7596)
      • AddInUtil.exe (PID: 7692)
      • FallbackBuffer.exe (PID: 7192)
      • FallbackBuffer.exe (PID: 4316)
      • InstallUtil.exe (PID: 1436)
      • InstallUtil.exe (PID: 7512)
      • native.exe (PID: 3868)
      • ghjkl.exe (PID: 8140)
      • GTA_V.tmp (PID: 7556)
      • UseLegacyFipsThrow.exe (PID: 8028)
      • UseLegacyFipsThrow.exe (PID: 8076)
      • Server.exe (PID: 7088)
      • ghjk.exe (PID: 6884)
      • newbuild.exe (PID: 7060)
      • net.exe (PID: 7524)
      • time2time.exe (PID: 6056)
      • native.exe (PID: 7980)
      • svhoost.exe (PID: 6744)
      • One.exe (PID: 7256)
      • InstallUtil.exe (PID: 7024)
      • file.exe (PID: 2056)
      • asdfg.exe (PID: 6644)
      • 9sD9R.exe (PID: 7252)
      • 9sD9R.exe (PID: 8004)
      • .exe (PID: 7812)
      • ruNO}Su(.exe (PID: 7532)
      • ruNO}Su(.exe (PID: 6552)
      • 79B.exe (PID: 8084)
      • 79B.exe (PID: 6988)
      • oVlF.exe (PID: 6924)
      • don701.exe (PID: 4316)
      • ghjk.exe (PID: 6416)
      • don701.exe (PID: 6864)
      • oVlF.exe (PID: 4048)
      • GoogleUpdate.exe (PID: 6388)
      • 1.exe (PID: 8068)
      • msiexec.exe (PID: 7572)
      • 8.exe (PID: 6452)
    • Checks proxy server information

      • 4363463463464363463463463.exe (PID: 6156)
      • 37.exe (PID: 2208)
      • WezoAutoUP.exe (PID: 3992)
      • pocketrar350sc.exe (PID: 2416)
      • file.exe (PID: 5004)
      • WerFault.exe (PID: 6792)
      • Downaqzh.exe (PID: 5076)
      • DownSysSoft.exe (PID: 1132)
      • DownVerySync.exe (PID: 4004)
      • uRA7.exe (PID: 7112)
      • 4363463463464363463463463.exe (PID: 2516)
      • 55hdQ.exe (PID: 6828)
      • 4363463463464363463463463.exe (PID: 1300)
      • 4363463463464363463463463.exe (PID: 6660)
      • WerFault.exe (PID: 7444)
      • InstallUtil.exe (PID: 7024)
      • WerFault.exe (PID: 7824)
      • WerFault.exe (PID: 7212)
      • Steam.exe (PID: 1508)
      • file.exe (PID: 2056)
      • 1.exe (PID: 8068)
      • Server.exe (PID: 7088)
      • 9sD9R.exe (PID: 8004)
      • .exe (PID: 7812)
      • WerFault.exe (PID: 2456)
      • 79B.exe (PID: 8084)
      • DownSysSoft.exe (PID: 2992)
      • GoogleUpdate.exe (PID: 7336)
      • mshta.exe (PID: 7752)
      • GoogleUpdate.exe (PID: 6388)
      • Downaqzh.exe (PID: 8160)
      • certutil.exe (PID: 6452)
      • 8.exe (PID: 6452)
    • Disables trace logs

      • 4363463463464363463463463.exe (PID: 6156)
      • 37.exe (PID: 2208)
      • 4363463463464363463463463.exe (PID: 2516)
      • 4363463463464363463463463.exe (PID: 1300)
      • 4363463463464363463463463.exe (PID: 6660)
      • InstallUtil.exe (PID: 7024)
      • Server.exe (PID: 7088)
      • .exe (PID: 7812)
    • Reads Environment values

      • 4363463463464363463463463.exe (PID: 6156)
      • 37.exe (PID: 2208)
      • 55hdQ.exe (PID: 6828)
      • 4363463463464363463463463.exe (PID: 2516)
      • 4363463463464363463463463.exe (PID: 6660)
      • 4363463463464363463463463.exe (PID: 1300)
      • GTA_V.exe (PID: 7660)
      • GTA_V.tmp (PID: 7556)
      • Server.exe (PID: 7088)
      • newbuild.exe (PID: 7060)
      • uRA7.exe (PID: 7112)
      • InstallUtil.exe (PID: 7024)
      • svhoost.exe (PID: 6744)
      • 9sD9R.exe (PID: 8004)
      • .exe (PID: 7812)
      • 79B.exe (PID: 8084)
      • don701.exe (PID: 6864)
    • Process checks computer location settings

      • 4363463463464363463463463.exe (PID: 6156)
      • asdfg.exe (PID: 1888)
      • pocketrar350sc.exe (PID: 2416)
      • 4363463463464363463463463.exe (PID: 6660)
      • asec.exe (PID: 7464)
      • 4363463463464363463463463.exe (PID: 1300)
      • wzoptBmp.exe (PID: 1164)
      • 4363463463464363463463463.exe (PID: 2516)
      • RegAsm.exe (PID: 7864)
      • time2time.exe (PID: 6056)
      • InstallUtil.exe (PID: 7024)
      • .exe (PID: 7812)
      • GoogleUpdate.exe (PID: 3188)
      • 1.exe (PID: 8068)
    • Creates files or folders in the user directory

      • sc.exe (PID: 6624)
      • WezoAutoUP.exe (PID: 3992)
      • file.exe (PID: 5004)
      • BLueHvffhw.exe (PID: 2404)
      • Downaqzh.exe (PID: 5076)
      • WerFault.exe (PID: 6792)
      • DownSysSoft.exe (PID: 1132)
      • DownVerySync.exe (PID: 4004)
      • OOBE-Maintenance.exe (PID: 5116)
      • OOBE-Maintenance.exe (PID: 6640)
      • 5O9oJ7.exe (PID: 4180)
      • WerFault.exe (PID: 7444)
      • DeathRansom_1.exe (PID: 7244)
      • GTA_V.tmp (PID: 7556)
      • Server.exe (PID: 7088)
      • RegAsm.exe (PID: 7864)
      • svhoost.exe (PID: 6744)
      • InstallUtil.exe (PID: 7024)
      • WerFault.exe (PID: 7824)
      • WerFault.exe (PID: 7212)
      • 1.exe (PID: 8068)
      • OOBE-Maintenance.exe (PID: 5840)
      • WerFault.exe (PID: 2456)
      • OOBE-Maintenance.exe (PID: 7520)
      • DownSysSoft.exe (PID: 2992)
      • GoogleUpdate.exe (PID: 6388)
      • Downaqzh.exe (PID: 8160)
      • certutil.exe (PID: 6452)
      • 8.exe (PID: 4852)
      • 8.exe (PID: 6452)
    • Reads the software policy settings

      • 4363463463464363463463463.exe (PID: 6156)
      • 37.exe (PID: 2208)
      • file.exe (PID: 5004)
      • WerFault.exe (PID: 6792)
      • 4363463463464363463463463.exe (PID: 2516)
      • 4363463463464363463463463.exe (PID: 1300)
      • 4363463463464363463463463.exe (PID: 6660)
      • WerFault.exe (PID: 7444)
      • GTA_V.tmp (PID: 7556)
      • slui.exe (PID: 452)
      • InstallUtil.exe (PID: 7024)
      • WerFault.exe (PID: 7212)
      • WerFault.exe (PID: 7824)
      • file.exe (PID: 2056)
      • Server.exe (PID: 7088)
      • WerFault.exe (PID: 2456)
      • GoogleUpdate.exe (PID: 7336)
      • GoogleUpdate.exe (PID: 6388)
      • don701.exe (PID: 6864)
      • 1.exe (PID: 8068)
      • msiexec.exe (PID: 7572)
      • 8.exe (PID: 6452)
    • Create files in a temporary directory

      • asdfg.exe (PID: 1888)
      • WezoAutoUP.exe (PID: 3992)
      • pocketrar350sc.exe (PID: 2416)
      • DownSysSoft.exe (PID: 1132)
      • Downaqzh.exe (PID: 5076)
      • DownVerySync.exe (PID: 4004)
      • dbzclientUpdate.exe (PID: 7372)
      • GTA_V.exe (PID: 7660)
      • GTA_V.tmp (PID: 7556)
      • Server.exe (PID: 7088)
      • 745fefcace80371e3ae5.exe (PID: 4532)
      • 1.exe (PID: 8068)
      • ma.exe (PID: 7320)
      • DownSysSoft.exe (PID: 2992)
      • KuwaitSetupHockey.exe (PID: 1052)
      • KuwaitSetupHockey.tmp (PID: 4328)
      • av_downloader.exe (PID: 2216)
      • av_downloader.exe (PID: 6988)
      • Downaqzh.exe (PID: 8160)
      • GoogleUpdate.exe (PID: 6388)
      • 1.exe (PID: 7620)
      • YandexPackSetup.exe (PID: 7040)
      • 8.exe (PID: 6452)
      • 8.exe (PID: 4852)
      • 8.exe (PID: 7396)
      • 8.exe (PID: 7856)
      • SrbijaSetupHokej.exe (PID: 7608)
      • 8.exe (PID: 7684)
      • SrbijaSetupHokej.tmp (PID: 5952)
    • Reads product name

      • 37.exe (PID: 2208)
    • Reads mouse settings

      • WezoAutoUP.exe (PID: 3992)
      • arpwriteIni.exe (PID: 1928)
      • WezoEventUP.exe (PID: 3088)
      • Downdd.exe (PID: 1052)
      • Downaqzh.exe (PID: 5076)
      • DownSysSoft.exe (PID: 1132)
      • DownVerySync.exe (PID: 4004)
      • DelHosts.exe (PID: 5140)
      • wzoptup.exe (PID: 6628)
      • storyhosts.exe (PID: 6940)
      • sysup.exe (PID: 7648)
      • dbzclientUpdate.exe (PID: 7372)
      • changezuhaolnk.exe (PID: 3236)
      • Downdd.exe (PID: 7392)
      • DownSysSoft.exe (PID: 2992)
      • Downaqzh.exe (PID: 8160)
    • Process checks Internet Explorer phishing filters

      • pocketrar350sc.exe (PID: 2416)
    • Creates files in the program directory

      • pocketrar350sc.exe (PID: 2416)
      • 745fefcace80371e3ae5.exe (PID: 4532)
      • SteamService.exe (PID: 7856)
      • Steam.exe (PID: 1508)
      • ma.exe (PID: 7320)
      • igccu.exe (PID: 6648)
      • GoogleUpdate.exe (PID: 3188)
      • GoogleUpdate.exe (PID: 3888)
      • GoogleUpdate.exe (PID: 7336)
      • GoogleUpdate.exe (PID: 6388)
    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 884)
      • powershell.exe (PID: 3932)
      • powershell.exe (PID: 7280)
      • powershell.exe (PID: 6192)
    • Drops the executable file immediately after the start

      • OOBE-Maintenance.exe (PID: 5116)
      • OOBE-Maintenance.exe (PID: 6640)
      • conhost.exe (PID: 7288)
      • OOBE-Maintenance.exe (PID: 5840)
      • OOBE-Maintenance.exe (PID: 7520)
    • Manual execution by a user

      • Taskmgr.exe (PID: 6844)
      • Taskmgr.exe (PID: 5888)
      • 4363463463464363463463463.exe (PID: 1300)
      • 4363463463464363463463463.exe (PID: 7124)
      • 4363463463464363463463463.exe (PID: 6692)
      • 4363463463464363463463463.exe (PID: 2516)
      • 4363463463464363463463463.exe (PID: 6392)
      • 4363463463464363463463463.exe (PID: 6660)
      • notepad.exe (PID: 7004)
      • Steam.exe (PID: 1508)
      • powershell.exe (PID: 8072)
      • schtasks.exe (PID: 7592)
    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 5888)
      • notepad.exe (PID: 7004)
      • certutil.exe (PID: 6452)
      • certutil.exe (PID: 6380)
    • Reads CPU info

      • GTA_V.tmp (PID: 7556)
      • Server.exe (PID: 7088)
    • Process checks whether UAC notifications are on

      • time2time.exe (PID: 6056)
    • UPX packer has been detected

      • WezoAutoUP.exe (PID: 3992)
    • Reads Internet Explorer settings

      • mshta.exe (PID: 7752)
    • Reads Microsoft Office registry keys

      • don701.exe (PID: 6864)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:12:22 08:29:10+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 80
CodeSize: 5632
InitializedDataSize: 4608
UninitializedDataSize: -
EntryPoint: 0x3552
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 0.0.0.0
InternalName: 4363463463464363463463463.exe
LegalCopyright:
OriginalFileName: 4363463463464363463463463.exe
ProductVersion: 0.0.0.0
AssemblyVersion: 0.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
374
Monitored processes
222
Malicious processes
55
Suspicious processes
12

Behavior graph

Click at the process to see the details
start #HAUSBOMBER 4363463463464363463463463.exe conhost.exe no specs sc.exe asdfg.exe 37.exe file.exe bluehvffhw.exe no specs asdfg.exe no specs bluehvffhw.exe #RHADAMANTHYS openwith.exe net.exe no specs net.exe no specs THREAT wezoautoup.exe pocketrar350sc.exe #RHADAMANTHYS oobe-maintenance.exe conhost.exe no specs arpwriteini.exe no specs cmd.exe no specs conhost.exe no specs downdd.exe no specs ipconfig.exe no specs powershell.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe wezoeventup.exe no specs zxcvb.exe no specs zxcvb.exe no specs #RHADAMANTHYS openwith.exe uninstall.exe no specs werfault.exe rundll32.exe no specs downaqzh.exe downsyssoft.exe downverysync.exe #RHADAMANTHYS oobe-maintenance.exe conhost.exe no specs 7z.exe no specs conhost.exe no specs delhosts.exe no specs wzoptup.exe no specs ura7.exe no specs #AZORULT ura7.exe taskmgr.exe no specs taskmgr.exe storyhosts.exe no specs 5o9oj7.exe no specs 5o9oj7.exe 55hdq.exe no specs #AZORULT 55hdq.exe powershell.exe no specs conhost.exe no specs 4363463463464363463463463.exe no specs #HAUSBOMBER 4363463463464363463463463.exe conhost.exe no specs 4363463463464363463463463.exe no specs 4363463463464363463463463.exe conhost.exe no specs 4363463463464363463463463.exe no specs 4363463463464363463463463.exe conhost.exe no specs deathransom_1.exe mp5`gbml(.exe no specs mp5`gbml(.exe no specs gold.exe regasm.exe werfault.exe asec.exe no specs addinutil.exe no specs sysup.exe no specs addinutil.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs fallbackbuffer.exe no specs %e6%85%95%e8%af%be%e7%bd%91%e8%a7%86%e9%a2%91%e8%a7%a3%e6%9e%90%e5%b7%a5%e5%85%b7_2015.exe no specs fallbackbuffer.exe no specs installutil.exe no specs installutil.exe dbzclientupdate.exe wzoptbmp.exe no specs notepad.exe no specs wzoptbmp.exe no specs gta_v.exe gta_v.tmp crypted_c360a5b7.exe no specs powershell.exe no specs conhost.exe no specs native.exe no specs regasm.exe no specs regasm.exe native.exe no specs #RHADAMANTHYS openwith.exe changezuhaolnk.exe no specs ghjkl.exe no specs ghjkl.exe no specs uselegacyfipsthrow.exe no specs uselegacyfipsthrow.exe no specs downdd.exe no specs file.exe #METASTEALER newbuild.exe server.exe #RHADAMANTHYS oobe-maintenance.exe conhost.exe ghjk.exe no specs ghjk.exe no specs net.exe no specs #RHADAMANTHYS openwith.exe net.exe no specs native.exe no specs native.exe no specs time2time.exe conhost.exe no specs 745fefcace80371e3ae5.exe 33333.exe regasm.exe one.exe conhost.exe no specs #REDLINE svhoost.exe werfault.exe powershell.exe no specs installutil.exe installutil.exe no specs werfault.exe conhost.exe no specs slui.exe no specs steamservice.exe conhost.exe no specs #RHADAMANTHYS oobe-maintenance.exe conhost.exe no specs steam.exe win.exe conhost.exe no specs 1.exe cmd.exe no specs conhost.exe no specs chcp.com no specs netsh.exe no specs findstr.exe no specs whoami.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs netsh.exe no specs asdfg.exe no specs asdfg.exe no specs #RHADAMANTHYS openwith.exe 9sd9r.exe no specs ma.exe #AZORULT 9sd9r.exe cmd.exe no specs conhost.exe no specs timeout.exe no specs .exe cmd.exe no specs conhost.exe no specs schtasks.exe no specs werfault.exe vbc.exe runo}su(.exe no specs runo}su(.exe no specs nxmr.exe 79b.exe no specs #RHADAMANTHYS oobe-maintenance.exe conhost.exe no specs #AZORULT 79b.exe downsyssoft.exe powershell.exe conhost.exe no specs kuwaitsetuphockey.exe kuwaitsetuphockey.tmp igccu.exe ghjk.exe no specs theporndude.exe no specs av_downloader.exe no specs conhost.exe no specs cmd.exe no specs mshta.exe no specs ovlf.exe no specs don701.exe no specs googleupdate.exe no specs #AGENTTESLA don701.exe googleupdate.exe no specs googleupdate.exe googleupdate.exe ovlf.exe no specs av_downloader.exe no specs ghjk.exe no specs conhost.exe no specs cmd.exe reg.exe no specs #RHADAMANTHYS openwith.exe reg.exe no specs reg.exe no specs attrib.exe no specs downaqzh.exe certutil.exe certutil.exe no specs schtasks.exe no specs timeout.exe no specs schtasks.exe conhost.exe no specs wupgrdsv.exe no specs yandexpacksetup.exe 1.exe no specs msiexec.exe no specs 8.exe 8.exe 8.exe 8.exe 8.exe srbijasetuphokej.exe srbijasetuphokej.tmp 4363463463464363463463463.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
32"C:\WINDOWS\system32\openwith.exe"C:\Windows\SysWOW64\OpenWith.exe
4363463463464363463463463.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Pick an app
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
32"C:\Users\admin\AppData\Local\Microsoft\5O9oJ7.exe"C:\Users\admin\AppData\Local\Microsoft\5O9oJ7.exeOOBE-Maintenance.exe
User:
admin
Integrity Level:
HIGH
Description:
PMIahpyqgai
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\microsoft\5o9oj7.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
448"C:\Users\admin\Desktop\Files\zxcvb.exe" C:\Users\admin\Desktop\Files\zxcvb.exe4363463463464363463463463.exe
User:
admin
Integrity Level:
HIGH
Description:
NATIVE
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\files\zxcvb.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
448timeout 3 C:\Windows\System32\timeout.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
452"C:\Users\admin\Desktop\Files\net.exe" C:\Users\admin\Desktop\Files\net.exe4363463463464363463463463.exe
User:
admin
Integrity Level:
HIGH
Description:
NATIVE
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\files\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
452"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
608C:\WINDOWS\system32\cmd.exe /c ipconfig C:\Windows\SysWOW64\cmd.exearpwriteIni.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
696\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exepowershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
884"powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABhAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAARgBhAGwAbABiAGEAYwBrAEIAdQBmAGYAZQByAC4AZQB4AGUAOwA=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1052"C:\Users\admin\Desktop\Files\Downdd.exe" C:\Users\admin\Desktop\Files\Downdd.exe4363463463464363463463463.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
3, 3, 9, 0
Modules
Images
c:\users\admin\desktop\files\downdd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
176 980
Read events
175 821
Write events
1 097
Delete events
62

Modification events

(PID) Process:(6156) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6156) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6156) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6156) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6156) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6156) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6156) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6156) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6156) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6156) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
226
Suspicious files
83
Text files
631
Unknown types
49

Dropped files

PID
Process
Filename
Type
3992WezoAutoUP.exeC:\Users\admin\AppData\Local\Temp\AutoUpdate.dattext
MD5:DAE1EED168A0536A275E5A15AE7DB07F
SHA256:00F26743C9486FAC7E82F9E79712C138B7A988C99EA27554283EAACA998DAB49
2416pocketrar350sc.exeC:\Users\admin\AppData\Local\Temp\gdc2741.tmpexecutable
MD5:FE763C2D71419352141C77C310E600D2
SHA256:7FDF10CA02D2238E22FDA18DFBEDE9750DA9F257221802C8B86C557C19C9BC7B
6624sc.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sc.exeexecutable
MD5:E86471DA9E0244D1D5E29B15FC9FEB80
SHA256:50DD267B25062A6C94DE3976D9A198A882A2B5801270492D32F0C0DADC6CAA81
884powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_c13d4tmc.va2.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3992WezoAutoUP.exeC:\Users\admin\AppData\Local\Temp\aut1EA6.tmpbinary
MD5:E4153373DD0754F3FE30ADD53C496576
SHA256:903D7479F85CF2592C71D6A98470DFE29C118AA131EBB19F05D7549CD400BB89
1888asdfg.exeC:\Users\admin\AppData\Local\Temp\BLueHvffhw.exeexecutable
MD5:ABF2DA5B3E7845F50463A72F8B6E6AAA
SHA256:2A4B1AE0AE67CD31F85680E6351BD5B92FF61E246C158DECB1A43A3EF01D9F2C
3992WezoAutoUP.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\Config[1].initext
MD5:DAE1EED168A0536A275E5A15AE7DB07F
SHA256:00F26743C9486FAC7E82F9E79712C138B7A988C99EA27554283EAACA998DAB49
3992WezoAutoUP.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\arpwriteIni[1].exeexecutable
MD5:8FFE154B25091CB5A8547EB4F56D112C
SHA256:21DB0FDA1ECA852D06185E4BC4939C8979771045B9A2939AC1D45CB60D05A7D3
61564363463463464363463463463.exeC:\Users\admin\Desktop\Files\sc.exeexecutable
MD5:E86471DA9E0244D1D5E29B15FC9FEB80
SHA256:50DD267B25062A6C94DE3976D9A198A882A2B5801270492D32F0C0DADC6CAA81
3992WezoAutoUP.exeC:\Users\admin\Desktop\Files\arpwriteIni.exeexecutable
MD5:8FFE154B25091CB5A8547EB4F56D112C
SHA256:21DB0FDA1ECA852D06185E4BC4939C8979771045B9A2939AC1D45CB60D05A7D3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
101
TCP/UDP connections
210
DNS requests
92
Threats
327

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6156
4363463463464363463463463.exe
GET
200
91.215.85.223:80
http://ns2.badhabits.ug/asdfg.exe
unknown
unknown
6156
4363463463464363463463463.exe
GET
200
185.172.128.121:80
http://185.172.128.121/sc.exe
unknown
unknown
6156
4363463463464363463463463.exe
GET
200
77.91.77.80:80
http://77.91.77.80/lend/37.exe
unknown
unknown
2208
37.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/?fields=11827
unknown
unknown
6156
4363463463464363463463463.exe
GET
200
36.249.46.172:8765
http://36.249.46.172:8765/WezoAutoUP.exe
unknown
unknown
6156
4363463463464363463463463.exe
GET
200
91.215.85.223:80
http://pop.partaususd.ru/net.exe
unknown
unknown
4980
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
unknown
6156
4363463463464363463463463.exe
GET
200
77.91.77.81:80
http://77.91.77.81/lend/file.exe
unknown
unknown
3992
WezoAutoUP.exe
GET
200
58.23.215.23:8765
http://wieie.cn:8765/Config.ini
unknown
unknown
3992
WezoAutoUP.exe
GET
200
58.23.215.23:8765
http://wieie.cn:8765/arpwriteIni.exe
unknown
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
3676
MoUsoCoreWorker.exe
51.104.136.2:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4032
svchost.exe
239.255.255.250:1900
whitelisted
4
System
192.168.100.255:138
whitelisted
6156
4363463463464363463463463.exe
151.101.66.49:443
urlhaus.abuse.ch
FASTLY
US
unknown
6156
4363463463464363463463463.exe
185.172.128.121:80
OOO Nadym Svyaz Service
RU
unknown
6156
4363463463464363463463463.exe
91.215.85.223:80
ns2.badhabits.ug
RU
unknown
4980
svchost.exe
20.190.160.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
4980
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1060
svchost.exe
23.213.166.81:443
go.microsoft.com
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
urlhaus.abuse.ch
  • 151.101.66.49
  • 151.101.2.49
  • 151.101.130.49
  • 151.101.194.49
whitelisted
ns2.badhabits.ug
  • 91.215.85.223
unknown
login.live.com
  • 20.190.160.14
  • 40.126.32.76
  • 40.126.32.136
  • 20.190.160.17
  • 20.190.160.22
  • 40.126.32.72
  • 40.126.32.68
  • 40.126.32.138
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.13
whitelisted
ussrconnect.ru
  • 104.21.38.193
  • 172.67.137.239
unknown
c0nnect1ng.ru
  • 104.21.44.91
  • 172.67.198.59
unknown
pop.partaususd.ru
  • 91.215.85.223
unknown
ip-api.com
  • 208.95.112.1
shared
download.skycn.com
  • 116.114.98.35
unknown

Threats

PID
Process
Class
Message
6156
4363463463464363463463463.exe
Potentially Bad Traffic
ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
6156
4363463463464363463463463.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
6156
4363463463464363463463463.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
6156
4363463463464363463463463.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 32
6156
4363463463464363463463463.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
6156
4363463463464363463463463.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
6156
4363463463464363463463463.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 13
6156
4363463463464363463463463.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
6156
4363463463464363463463463.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
6156
4363463463464363463463463.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
44 ETPRO signatures available at the full report
Process
Message
OOBE-Maintenance.exe
[thresholding] image = 0000027C2E2433D0 , (0 , 1380) (0 , 690)
OOBE-Maintenance.exe
[thresholding] image = 0000027C2E2433D0 , (0 , 1003) (0 , 502)
OOBE-Maintenance.exe
[thresholding] image = 0000027C2E2433D0 , (0 , 1381) (0 , 690)
OOBE-Maintenance.exe
[thresholding] image = 0000027C2FC3C040 , (0 , 1900) (0 , 950)
OOBE-Maintenance.exe
[thresholding] image = 0000027C2FBC6040 , (0 , 1842) (0 , 921)
OOBE-Maintenance.exe
[thresholding] image = 00000210064A33D0 , (0 , 1380) (0 , 690)
OOBE-Maintenance.exe
[thresholding] image = 0000021006225020 , (0 , 1003) (0 , 502)
OOBE-Maintenance.exe
[thresholding] image = 000002100658DE10 , (0 , 1381) (0 , 690)
OOBE-Maintenance.exe
[thresholding] image = 0000021007F37040 , (0 , 1900) (0 , 950)
OOBE-Maintenance.exe
[thresholding] image = 0000021007A86040 , (0 , 1842) (0 , 921)