File name:

4363463463464363463463463.exe

Full analysis: https://app.any.run/tasks/caa70db2-d533-4b40-8833-2ce2e6562d8c
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Analysis date: July 07, 2024, 18:48:39
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
opendir
loader
hausbomber
dcrat
evasion
rhadamanthys
stealer
autoit
adware
azorult
github
ransomware
redline
metastealer
pastebin
ssh
upx
phishing
telegram
miner
smtp
exfiltration
agenttesla
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

2A94F3960C58C6E70826495F76D00B85

SHA1:

E2A1A5641295F5EBF01A37AC1C170AC0814BB71A

SHA256:

2FCAD226B17131DA4274E1B9F8F31359BDD325C9568665F08FD1F6C5D06A23CE

SSDEEP:

192:2we8sGKE6MqyG7c20L7BIW12n/ePSmzkTInu8stYcFwVc03KY:9e8sGKfMqyGg20PKn/cRaInuptYcFwVY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Drops the executable file immediately after the start

      • 4363463463464363463463463.exe (PID: 6156)
      • sc.exe (PID: 6624)
      • asdfg.exe (PID: 1888)
      • pocketrar350sc.exe (PID: 2416)
      • WezoAutoUP.exe (PID: 3992)
      • BLueHvffhw.exe (PID: 2404)
      • DownVerySync.exe (PID: 4004)
      • 4363463463464363463463463.exe (PID: 6660)
      • 5O9oJ7.exe (PID: 4180)
      • DeathRansom_1.exe (PID: 7244)
      • 4363463463464363463463463.exe (PID: 1300)
      • dbzclientUpdate.exe (PID: 7372)
      • GTA_V.exe (PID: 7660)
      • GTA_V.tmp (PID: 7556)
      • 4363463463464363463463463.exe (PID: 2516)
      • 745fefcace80371e3ae5.exe (PID: 4532)
      • Server.exe (PID: 7088)
      • RegAsm.exe (PID: 7864)
      • SteamService.exe (PID: 7856)
      • ma.exe (PID: 7320)
      • KuwaitSetupHockey.tmp (PID: 4328)
      • KuwaitSetupHockey.exe (PID: 1052)
      • igccu.exe (PID: 6648)
      • 1.exe (PID: 8068)
      • nxmr.exe (PID: 6776)
      • 8.exe (PID: 4852)
      • 8.exe (PID: 6452)
      • 8.exe (PID: 7396)
      • 8.exe (PID: 7684)
      • 8.exe (PID: 7856)
      • SrbijaSetupHokej.exe (PID: 7608)
      • SrbijaSetupHokej.tmp (PID: 5952)
    • Create files in the Startup directory

      • sc.exe (PID: 6624)
      • InstallUtil.exe (PID: 7024)
    • Changes the autorun value in the registry

      • sc.exe (PID: 6624)
      • WezoAutoUP.exe (PID: 3992)
      • 745fefcace80371e3ae5.exe (PID: 4532)
    • HAUSBOMBER has been detected (YARA)

      • 4363463463464363463463463.exe (PID: 6156)
      • 4363463463464363463463463.exe (PID: 2516)
    • DCRAT has been detected (YARA)

      • 4363463463464363463463463.exe (PID: 6156)
      • 4363463463464363463463463.exe (PID: 2516)
    • Steals credentials from Web Browsers

      • 37.exe (PID: 2208)
      • newbuild.exe (PID: 7060)
      • Server.exe (PID: 7088)
      • svhoost.exe (PID: 6744)
      • don701.exe (PID: 6864)
    • Actions looks like stealing of personal data

      • 37.exe (PID: 2208)
      • OOBE-Maintenance.exe (PID: 5116)
      • OOBE-Maintenance.exe (PID: 6640)
      • GTA_V.tmp (PID: 7556)
      • newbuild.exe (PID: 7060)
      • Server.exe (PID: 7088)
      • OOBE-Maintenance.exe (PID: 5840)
      • svhoost.exe (PID: 6744)
      • OOBE-Maintenance.exe (PID: 7520)
      • OOBE-Maintenance.exe (PID: 1120)
      • don701.exe (PID: 6864)
      • 8.exe (PID: 6452)
      • 8.exe (PID: 4852)
      • 8.exe (PID: 7856)
      • 8.exe (PID: 7684)
    • Bypass execution policy to execute commands

      • powershell.exe (PID: 884)
      • powershell.exe (PID: 3932)
      • powershell.exe (PID: 7280)
    • Run PowerShell with an invisible window

      • powershell.exe (PID: 884)
      • powershell.exe (PID: 3932)
      • powershell.exe (PID: 7280)
    • RHADAMANTHYS has been detected (SURICATA)

      • OpenWith.exe (PID: 32)
      • OpenWith.exe (PID: 6640)
      • OOBE-Maintenance.exe (PID: 5116)
      • OOBE-Maintenance.exe (PID: 6640)
      • OpenWith.exe (PID: 8012)
      • OOBE-Maintenance.exe (PID: 5840)
      • OpenWith.exe (PID: 7352)
      • OOBE-Maintenance.exe (PID: 7520)
      • OpenWith.exe (PID: 6560)
      • OOBE-Maintenance.exe (PID: 1120)
      • OpenWith.exe (PID: 7900)
    • Creates a writable file in the system directory

      • storyhosts.exe (PID: 6940)
    • Renames files like ransomware

      • DeathRansom_1.exe (PID: 7244)
    • Creates or modifies Windows services

      • asec.exe (PID: 7464)
    • Changes appearance of the Explorer extensions

      • asec.exe (PID: 7464)
    • Changes Security Center notification settings

      • asec.exe (PID: 7464)
    • Adds path to the Windows Defender exclusion list

      • cmd.exe (PID: 7760)
      • asec.exe (PID: 7464)
      • time2time.exe (PID: 6056)
    • AZORULT has been detected (SURICATA)

      • uRA7.exe (PID: 7112)
      • 55hdQ.exe (PID: 6828)
      • 9sD9R.exe (PID: 8004)
      • 79B.exe (PID: 8084)
    • Changes the Windows auto-update feature

      • asec.exe (PID: 7464)
    • Connects to the CnC server

      • uRA7.exe (PID: 7112)
      • 55hdQ.exe (PID: 6828)
      • newbuild.exe (PID: 7060)
      • svhoost.exe (PID: 6744)
      • 9sD9R.exe (PID: 8004)
      • .exe (PID: 7812)
      • vbc.exe (PID: 2648)
      • 79B.exe (PID: 8084)
    • REDLINE has been detected (SURICATA)

      • newbuild.exe (PID: 7060)
      • svhoost.exe (PID: 6744)
    • METASTEALER has been detected (SURICATA)

      • newbuild.exe (PID: 7060)
      • svhoost.exe (PID: 6744)
    • UAC/LUA settings modification

      • time2time.exe (PID: 6056)
      • reg.exe (PID: 7432)
    • Scans artifacts that could help determine the target

      • 1.exe (PID: 8068)
      • GoogleUpdate.exe (PID: 6388)
      • don701.exe (PID: 6864)
    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 5396)
    • Starts CertUtil for downloading files

      • cmd.exe (PID: 8008)
    • AGENTTESLA has been detected (SURICATA)

      • don701.exe (PID: 6864)
    • Uses Task Scheduler to autorun other applications

      • cmd.exe (PID: 8008)
  • SUSPICIOUS

    • Reads the date of Windows installation

      • 4363463463464363463463463.exe (PID: 6156)
      • asdfg.exe (PID: 1888)
      • pocketrar350sc.exe (PID: 2416)
      • 4363463463464363463463463.exe (PID: 6660)
      • asec.exe (PID: 7464)
      • 4363463463464363463463463.exe (PID: 1300)
      • wzoptBmp.exe (PID: 1164)
      • 4363463463464363463463463.exe (PID: 2516)
      • RegAsm.exe (PID: 7864)
      • time2time.exe (PID: 6056)
      • InstallUtil.exe (PID: 7024)
      • .exe (PID: 7812)
      • GoogleUpdate.exe (PID: 3188)
      • 1.exe (PID: 8068)
    • Reads security settings of Internet Explorer

      • 4363463463464363463463463.exe (PID: 6156)
      • asdfg.exe (PID: 1888)
      • WezoAutoUP.exe (PID: 3992)
      • pocketrar350sc.exe (PID: 2416)
      • file.exe (PID: 5004)
      • uninstall.exe (PID: 6824)
      • DownSysSoft.exe (PID: 1132)
      • Downaqzh.exe (PID: 5076)
      • DownVerySync.exe (PID: 4004)
      • uRA7.exe (PID: 7112)
      • 55hdQ.exe (PID: 6828)
      • 4363463463464363463463463.exe (PID: 6660)
      • asec.exe (PID: 7464)
      • 4363463463464363463463463.exe (PID: 1300)
      • wzoptBmp.exe (PID: 1164)
      • 4363463463464363463463463.exe (PID: 2516)
      • RegAsm.exe (PID: 7864)
      • time2time.exe (PID: 6056)
      • InstallUtil.exe (PID: 7024)
      • file.exe (PID: 2056)
      • 1.exe (PID: 8068)
      • 9sD9R.exe (PID: 8004)
      • .exe (PID: 7812)
      • 79B.exe (PID: 8084)
      • DownSysSoft.exe (PID: 2992)
      • GoogleUpdate.exe (PID: 3188)
      • GoogleUpdate.exe (PID: 6388)
      • Downaqzh.exe (PID: 8160)
      • 8.exe (PID: 6452)
    • Executable content was dropped or overwritten

      • 4363463463464363463463463.exe (PID: 6156)
      • sc.exe (PID: 6624)
      • asdfg.exe (PID: 1888)
      • pocketrar350sc.exe (PID: 2416)
      • WezoAutoUP.exe (PID: 3992)
      • BLueHvffhw.exe (PID: 2404)
      • DownVerySync.exe (PID: 4004)
      • OOBE-Maintenance.exe (PID: 5116)
      • OOBE-Maintenance.exe (PID: 6640)
      • 5O9oJ7.exe (PID: 4180)
      • 4363463463464363463463463.exe (PID: 6660)
      • DeathRansom_1.exe (PID: 7244)
      • 4363463463464363463463463.exe (PID: 1300)
      • dbzclientUpdate.exe (PID: 7372)
      • GTA_V.exe (PID: 7660)
      • 4363463463464363463463463.exe (PID: 2516)
      • GTA_V.tmp (PID: 7556)
      • conhost.exe (PID: 7288)
      • 745fefcace80371e3ae5.exe (PID: 4532)
      • Server.exe (PID: 7088)
      • RegAsm.exe (PID: 7864)
      • SteamService.exe (PID: 7856)
      • OOBE-Maintenance.exe (PID: 5840)
      • ma.exe (PID: 7320)
      • OOBE-Maintenance.exe (PID: 7520)
      • KuwaitSetupHockey.exe (PID: 1052)
      • KuwaitSetupHockey.tmp (PID: 4328)
      • igccu.exe (PID: 6648)
      • 1.exe (PID: 8068)
      • nxmr.exe (PID: 6776)
      • 8.exe (PID: 4852)
      • 8.exe (PID: 7396)
      • 8.exe (PID: 7684)
      • 8.exe (PID: 6452)
      • 8.exe (PID: 7856)
      • SrbijaSetupHokej.exe (PID: 7608)
      • SrbijaSetupHokej.tmp (PID: 5952)
    • Application launched itself

      • asdfg.exe (PID: 1888)
      • BLueHvffhw.exe (PID: 3976)
      • net.exe (PID: 452)
      • zxcvb.exe (PID: 448)
      • uRA7.exe (PID: 5452)
      • 55hdQ.exe (PID: 4024)
      • 5O9oJ7.exe (PID: 32)
      • mP5`GbMl(.exe (PID: 7264)
      • AddInUtil.exe (PID: 7596)
      • FallbackBuffer.exe (PID: 7192)
      • InstallUtil.exe (PID: 1436)
      • wzoptBmp.exe (PID: 1164)
      • ghjkl.exe (PID: 8140)
      • native.exe (PID: 3868)
      • UseLegacyFipsThrow.exe (PID: 8028)
      • ghjk.exe (PID: 6884)
      • net.exe (PID: 7524)
      • native.exe (PID: 7980)
      • 9sD9R.exe (PID: 7252)
      • asdfg.exe (PID: 6644)
      • ruNO}Su(.exe (PID: 6552)
      • 79B.exe (PID: 6988)
      • don701.exe (PID: 4316)
      • oVlF.exe (PID: 6924)
      • ghjk.exe (PID: 6416)
      • 1.exe (PID: 8068)
      • 8.exe (PID: 6452)
      • 8.exe (PID: 7684)
    • Reads Microsoft Outlook installation path

      • pocketrar350sc.exe (PID: 2416)
    • The process checks if it is being run in the virtual environment

      • OpenWith.exe (PID: 6640)
      • OpenWith.exe (PID: 32)
      • OpenWith.exe (PID: 8012)
      • OpenWith.exe (PID: 7352)
      • OpenWith.exe (PID: 6560)
      • OpenWith.exe (PID: 7900)
    • Reads Internet Explorer settings

      • pocketrar350sc.exe (PID: 2416)
    • Starts CMD.EXE for commands execution

      • arpwriteIni.exe (PID: 1928)
      • asec.exe (PID: 7464)
      • Server.exe (PID: 7088)
      • ma.exe (PID: 7320)
      • .exe (PID: 7812)
      • av_downloader.exe (PID: 2216)
      • av_downloader.exe (PID: 6988)
    • Process uses IPCONFIG to get network configuration information

      • cmd.exe (PID: 608)
    • The process executes via Task Scheduler

      • powershell.exe (PID: 884)
      • powershell.exe (PID: 3932)
      • FallbackBuffer.exe (PID: 7192)
      • powershell.exe (PID: 7280)
      • UseLegacyFipsThrow.exe (PID: 8028)
      • wupgrdsv.exe (PID: 6188)
    • Loads DLL from Mozilla Firefox

      • OOBE-Maintenance.exe (PID: 5116)
      • OOBE-Maintenance.exe (PID: 6640)
      • OOBE-Maintenance.exe (PID: 5840)
      • OOBE-Maintenance.exe (PID: 7520)
      • OOBE-Maintenance.exe (PID: 1120)
    • Searches for installed software

      • OOBE-Maintenance.exe (PID: 5116)
      • OOBE-Maintenance.exe (PID: 6640)
      • OOBE-Maintenance.exe (PID: 5840)
      • newbuild.exe (PID: 7060)
      • svhoost.exe (PID: 6744)
      • OOBE-Maintenance.exe (PID: 7520)
      • OOBE-Maintenance.exe (PID: 1120)
    • Executes application which crashes

      • file.exe (PID: 5004)
      • gold.exe (PID: 7352)
      • 33333.exe (PID: 7260)
      • time2time.exe (PID: 6056)
      • file.exe (PID: 2056)
    • Creates a software uninstall entry

      • uninstall.exe (PID: 6824)
      • 745fefcace80371e3ae5.exe (PID: 4532)
    • Checks Windows Trust Settings

      • file.exe (PID: 5004)
      • file.exe (PID: 2056)
      • GoogleUpdate.exe (PID: 6388)
      • 1.exe (PID: 8068)
      • msiexec.exe (PID: 7572)
      • 8.exe (PID: 6452)
    • Drops 7-zip archiver for unpacking

      • DownVerySync.exe (PID: 4004)
      • dbzclientUpdate.exe (PID: 7372)
      • GTA_V.tmp (PID: 7556)
    • Contacting a server suspected of hosting an CnC

      • OpenWith.exe (PID: 6640)
      • OpenWith.exe (PID: 32)
      • OOBE-Maintenance.exe (PID: 5116)
      • OOBE-Maintenance.exe (PID: 6640)
      • uRA7.exe (PID: 7112)
      • 55hdQ.exe (PID: 6828)
      • 4363463463464363463463463.exe (PID: 6660)
      • OpenWith.exe (PID: 8012)
      • OOBE-Maintenance.exe (PID: 5840)
      • OpenWith.exe (PID: 7352)
      • OOBE-Maintenance.exe (PID: 7520)
      • 9sD9R.exe (PID: 8004)
      • OpenWith.exe (PID: 6560)
      • 79B.exe (PID: 8084)
      • OOBE-Maintenance.exe (PID: 1120)
      • OpenWith.exe (PID: 7900)
    • Checks for external IP

      • 37.exe (PID: 2208)
      • GTA_V.tmp (PID: 7556)
      • Server.exe (PID: 7088)
    • Potential Corporate Privacy Violation

      • WezoAutoUP.exe (PID: 3992)
      • 4363463463464363463463463.exe (PID: 6156)
      • DownSysSoft.exe (PID: 1132)
      • Downaqzh.exe (PID: 5076)
      • DownVerySync.exe (PID: 4004)
      • 4363463463464363463463463.exe (PID: 2516)
      • 4363463463464363463463463.exe (PID: 1300)
      • 4363463463464363463463463.exe (PID: 6660)
      • Steam.exe (PID: 1508)
      • 1.exe (PID: 8068)
      • win.exe (PID: 6204)
      • Server.exe (PID: 7088)
      • vbc.exe (PID: 2648)
      • DownSysSoft.exe (PID: 2992)
      • Downaqzh.exe (PID: 8160)
      • certutil.exe (PID: 6452)
    • Access to an unwanted program domain was detected

      • WezoAutoUP.exe (PID: 3992)
    • Process requests binary or script from the Internet

      • WezoAutoUP.exe (PID: 3992)
      • 4363463463464363463463463.exe (PID: 1300)
      • 4363463463464363463463463.exe (PID: 2516)
      • 4363463463464363463463463.exe (PID: 6660)
      • 4363463463464363463463463.exe (PID: 6156)
      • certutil.exe (PID: 6452)
      • 1.exe (PID: 8068)
    • Connects to unusual port

      • Downaqzh.exe (PID: 5076)
      • 4363463463464363463463463.exe (PID: 6156)
      • WezoAutoUP.exe (PID: 3992)
      • DownSysSoft.exe (PID: 1132)
      • RegAsm.exe (PID: 7380)
      • AddInUtil.exe (PID: 7692)
      • InstallUtil.exe (PID: 7512)
      • RegAsm.exe (PID: 7968)
      • 4363463463464363463463463.exe (PID: 2516)
      • newbuild.exe (PID: 7060)
      • svhoost.exe (PID: 6744)
      • One.exe (PID: 7256)
      • win.exe (PID: 6204)
      • vbc.exe (PID: 2648)
      • DownSysSoft.exe (PID: 2992)
      • 4363463463464363463463463.exe (PID: 6660)
      • Downaqzh.exe (PID: 8160)
      • certutil.exe (PID: 6452)
    • Creates files in the driver directory

      • storyhosts.exe (PID: 6940)
    • Creates file in the systems drive root

      • DeathRansom_1.exe (PID: 7244)
    • Creates files like ransomware instruction

      • DeathRansom_1.exe (PID: 7244)
      • Server.exe (PID: 7088)
    • The process hide an interactive prompt from the user

      • cmd.exe (PID: 7760)
    • Creates or modifies Windows services

      • asec.exe (PID: 7464)
    • Script adds exclusion path to Windows Defender

      • cmd.exe (PID: 7760)
      • time2time.exe (PID: 6056)
    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 7760)
      • time2time.exe (PID: 6056)
    • Reads the BIOS version

      • %E6%85%95%E8%AF%BE%E7%BD%91%E8%A7%86%E9%A2%91%E8%A7%A3%E6%9E%90%E5%B7%A5%E5%85%B7_2015.exe (PID: 5732)
    • Reads the Windows owner or organization settings

      • GTA_V.tmp (PID: 7556)
      • KuwaitSetupHockey.tmp (PID: 4328)
      • SrbijaSetupHokej.tmp (PID: 5952)
    • Likely accesses (executes) a file from the Public directory

      • notepad.exe (PID: 7004)
    • Process drops legitimate windows executable

      • GTA_V.tmp (PID: 7556)
      • 4363463463464363463463463.exe (PID: 6156)
      • 1.exe (PID: 8068)
    • The process drops C-runtime libraries

      • GTA_V.tmp (PID: 7556)
    • The process verifies whether the antivirus software is installed

      • GTA_V.tmp (PID: 7556)
    • Malware-specific behavior (creating "System.dll" in Temp)

      • 745fefcace80371e3ae5.exe (PID: 4532)
    • The process creates files with name similar to system file names

      • 745fefcace80371e3ae5.exe (PID: 4532)
    • Reads browser cookies

      • OOBE-Maintenance.exe (PID: 5840)
      • OOBE-Maintenance.exe (PID: 1120)
    • Write to the desktop.ini file (may be used to cloak folders)

      • Server.exe (PID: 7088)
    • Connects to the server without a host name

      • 4363463463464363463463463.exe (PID: 1300)
      • 4363463463464363463463463.exe (PID: 2516)
      • 4363463463464363463463463.exe (PID: 6156)
    • Adds/modifies Windows certificates

      • svhoost.exe (PID: 6744)
      • 1.exe (PID: 8068)
    • Detected use of alternative data streams (AltDS)

      • powershell.exe (PID: 6192)
      • powershell.exe (PID: 8072)
    • Starts application with an unusual extension

      • cmd.exe (PID: 3164)
      • cmd.exe (PID: 7064)
    • Uses NETSH.EXE to obtain data on the network

      • cmd.exe (PID: 3164)
      • cmd.exe (PID: 7064)
    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 3164)
    • Identifying current user with WHOAMI command

      • win.exe (PID: 6204)
    • Process creates executable files without a name

      • cmd.exe (PID: 7504)
      • ma.exe (PID: 7320)
      • .exe (PID: 7812)
    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 7504)
      • cmd.exe (PID: 8008)
    • Executing commands from a ".bat" file

      • ma.exe (PID: 7320)
      • av_downloader.exe (PID: 2216)
      • av_downloader.exe (PID: 6988)
    • Process communicates with Telegram (possibly using it as an attacker's C2 server)

      • Server.exe (PID: 7088)
    • Crypto Currency Mining Activity Detected

      • .exe (PID: 7812)
      • vbc.exe (PID: 2648)
    • Starts a Microsoft application from unusual location

      • don701.exe (PID: 4316)
      • don701.exe (PID: 6864)
      • YandexPackSetup.exe (PID: 7040)
    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 8008)
    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 8008)
    • Connects to SMTP port

      • don701.exe (PID: 6864)
    • The process connected to a server suspected of theft

      • don701.exe (PID: 6864)
    • Starts itself from another location

      • 8.exe (PID: 6452)
  • INFO

    • Checks supported languages

      • 4363463463464363463463463.exe (PID: 6156)
      • sc.exe (PID: 6624)
      • asdfg.exe (PID: 1888)
      • 37.exe (PID: 2208)
      • file.exe (PID: 5004)
      • asdfg.exe (PID: 3968)
      • net.exe (PID: 7024)
      • net.exe (PID: 452)
      • BLueHvffhw.exe (PID: 2404)
      • BLueHvffhw.exe (PID: 3976)
      • WezoAutoUP.exe (PID: 3992)
      • pocketrar350sc.exe (PID: 2416)
      • arpwriteIni.exe (PID: 1928)
      • Downdd.exe (PID: 1052)
      • WezoEventUP.exe (PID: 3088)
      • zxcvb.exe (PID: 448)
      • zxcvb.exe (PID: 3680)
      • Downaqzh.exe (PID: 5076)
      • uninstall.exe (PID: 6824)
      • DownSysSoft.exe (PID: 1132)
      • DownVerySync.exe (PID: 4004)
      • 7z.exe (PID: 6936)
      • DelHosts.exe (PID: 5140)
      • wzoptup.exe (PID: 6628)
      • uRA7.exe (PID: 5452)
      • uRA7.exe (PID: 7112)
      • storyhosts.exe (PID: 6940)
      • 5O9oJ7.exe (PID: 32)
      • 55hdQ.exe (PID: 4024)
      • 5O9oJ7.exe (PID: 4180)
      • 55hdQ.exe (PID: 6828)
      • 4363463463464363463463463.exe (PID: 2516)
      • 4363463463464363463463463.exe (PID: 6660)
      • 4363463463464363463463463.exe (PID: 1300)
      • DeathRansom_1.exe (PID: 7244)
      • mP5`GbMl(.exe (PID: 7264)
      • mP5`GbMl(.exe (PID: 7316)
      • RegAsm.exe (PID: 7380)
      • gold.exe (PID: 7352)
      • asec.exe (PID: 7464)
      • AddInUtil.exe (PID: 7596)
      • sysup.exe (PID: 7648)
      • AddInUtil.exe (PID: 7692)
      • FallbackBuffer.exe (PID: 7192)
      • %E6%85%95%E8%AF%BE%E7%BD%91%E8%A7%86%E9%A2%91%E8%A7%A3%E6%9E%90%E5%B7%A5%E5%85%B7_2015.exe (PID: 5732)
      • FallbackBuffer.exe (PID: 4316)
      • dbzclientUpdate.exe (PID: 7372)
      • wzoptBmp.exe (PID: 1164)
      • InstallUtil.exe (PID: 1436)
      • InstallUtil.exe (PID: 7512)
      • wzoptBmp.exe (PID: 7432)
      • GTA_V.exe (PID: 7660)
      • GTA_V.tmp (PID: 7556)
      • crypted_c360a5b7.exe (PID: 7596)
      • native.exe (PID: 3868)
      • RegAsm.exe (PID: 7968)
      • changezuhaolnk.exe (PID: 3236)
      • ghjkl.exe (PID: 8140)
      • ghjkl.exe (PID: 8104)
      • native.exe (PID: 7996)
      • UseLegacyFipsThrow.exe (PID: 8028)
      • UseLegacyFipsThrow.exe (PID: 8076)
      • Downdd.exe (PID: 7392)
      • file.exe (PID: 2056)
      • Server.exe (PID: 7088)
      • ghjk.exe (PID: 6884)
      • ghjk.exe (PID: 7456)
      • net.exe (PID: 7524)
      • newbuild.exe (PID: 7060)
      • native.exe (PID: 7980)
      • native.exe (PID: 7900)
      • time2time.exe (PID: 6056)
      • net.exe (PID: 7644)
      • 745fefcace80371e3ae5.exe (PID: 4532)
      • RegAsm.exe (PID: 7864)
      • 33333.exe (PID: 7260)
      • One.exe (PID: 7256)
      • svhoost.exe (PID: 6744)
      • InstallUtil.exe (PID: 7024)
      • SteamService.exe (PID: 7856)
      • Steam.exe (PID: 1508)
      • win.exe (PID: 6204)
      • 1.exe (PID: 8068)
      • chcp.com (PID: 7076)
      • chcp.com (PID: 6100)
      • asdfg.exe (PID: 6644)
      • asdfg.exe (PID: 6508)
      • 9sD9R.exe (PID: 7252)
      • ma.exe (PID: 7320)
      • 9sD9R.exe (PID: 8004)
      • .exe (PID: 7812)
      • vbc.exe (PID: 2648)
      • ruNO}Su(.exe (PID: 6552)
      • ruNO}Su(.exe (PID: 7532)
      • nxmr.exe (PID: 6776)
      • 79B.exe (PID: 6988)
      • 79B.exe (PID: 8084)
      • DownSysSoft.exe (PID: 2992)
      • KuwaitSetupHockey.tmp (PID: 4328)
      • igccu.exe (PID: 6648)
      • KuwaitSetupHockey.exe (PID: 1052)
      • theporndude.exe (PID: 8028)
      • ghjk.exe (PID: 6416)
      • GoogleUpdate.exe (PID: 3188)
      • oVlF.exe (PID: 6924)
      • don701.exe (PID: 4316)
      • GoogleUpdate.exe (PID: 3888)
      • don701.exe (PID: 6864)
      • GoogleUpdate.exe (PID: 6388)
      • oVlF.exe (PID: 4048)
      • GoogleUpdate.exe (PID: 7336)
      • av_downloader.exe (PID: 6988)
      • ghjk.exe (PID: 3508)
      • Downaqzh.exe (PID: 8160)
      • 1.exe (PID: 7620)
      • wupgrdsv.exe (PID: 6188)
      • msiexec.exe (PID: 7572)
      • 8.exe (PID: 6452)
      • 8.exe (PID: 4852)
      • YandexPackSetup.exe (PID: 7040)
      • 8.exe (PID: 7396)
      • 8.exe (PID: 7684)
      • SrbijaSetupHokej.exe (PID: 7608)
      • SrbijaSetupHokej.tmp (PID: 5952)
      • 8.exe (PID: 7856)
      • av_downloader.exe (PID: 2216)
    • Reads Environment values

      • 4363463463464363463463463.exe (PID: 6156)
      • 37.exe (PID: 2208)
      • uRA7.exe (PID: 7112)
      • 55hdQ.exe (PID: 6828)
      • 4363463463464363463463463.exe (PID: 2516)
      • 4363463463464363463463463.exe (PID: 6660)
      • 4363463463464363463463463.exe (PID: 1300)
      • GTA_V.exe (PID: 7660)
      • GTA_V.tmp (PID: 7556)
      • Server.exe (PID: 7088)
      • newbuild.exe (PID: 7060)
      • InstallUtil.exe (PID: 7024)
      • svhoost.exe (PID: 6744)
      • 9sD9R.exe (PID: 8004)
      • .exe (PID: 7812)
      • 79B.exe (PID: 8084)
      • don701.exe (PID: 6864)
    • Reads the computer name

      • 4363463463464363463463463.exe (PID: 6156)
      • 37.exe (PID: 2208)
      • asdfg.exe (PID: 1888)
      • BLueHvffhw.exe (PID: 3976)
      • BLueHvffhw.exe (PID: 2404)
      • asdfg.exe (PID: 3968)
      • net.exe (PID: 452)
      • net.exe (PID: 7024)
      • WezoAutoUP.exe (PID: 3992)
      • pocketrar350sc.exe (PID: 2416)
      • zxcvb.exe (PID: 448)
      • zxcvb.exe (PID: 3680)
      • file.exe (PID: 5004)
      • uninstall.exe (PID: 6824)
      • DownSysSoft.exe (PID: 1132)
      • DownVerySync.exe (PID: 4004)
      • Downaqzh.exe (PID: 5076)
      • 7z.exe (PID: 6936)
      • uRA7.exe (PID: 5452)
      • uRA7.exe (PID: 7112)
      • storyhosts.exe (PID: 6940)
      • 5O9oJ7.exe (PID: 4180)
      • 55hdQ.exe (PID: 4024)
      • 55hdQ.exe (PID: 6828)
      • 5O9oJ7.exe (PID: 32)
      • 4363463463464363463463463.exe (PID: 2516)
      • 4363463463464363463463463.exe (PID: 6660)
      • 4363463463464363463463463.exe (PID: 1300)
      • DeathRansom_1.exe (PID: 7244)
      • RegAsm.exe (PID: 7380)
      • mP5`GbMl(.exe (PID: 7316)
      • mP5`GbMl(.exe (PID: 7264)
      • AddInUtil.exe (PID: 7596)
      • asec.exe (PID: 7464)
      • AddInUtil.exe (PID: 7692)
      • %E6%85%95%E8%AF%BE%E7%BD%91%E8%A7%86%E9%A2%91%E8%A7%A3%E6%9E%90%E5%B7%A5%E5%85%B7_2015.exe (PID: 5732)
      • FallbackBuffer.exe (PID: 7192)
      • FallbackBuffer.exe (PID: 4316)
      • InstallUtil.exe (PID: 7512)
      • InstallUtil.exe (PID: 1436)
      • wzoptBmp.exe (PID: 7432)
      • GTA_V.exe (PID: 7660)
      • GTA_V.tmp (PID: 7556)
      • wzoptBmp.exe (PID: 1164)
      • native.exe (PID: 3868)
      • ghjkl.exe (PID: 8140)
      • native.exe (PID: 7996)
      • RegAsm.exe (PID: 7968)
      • ghjkl.exe (PID: 8104)
      • UseLegacyFipsThrow.exe (PID: 8028)
      • UseLegacyFipsThrow.exe (PID: 8076)
      • Server.exe (PID: 7088)
      • ghjk.exe (PID: 6884)
      • ghjk.exe (PID: 7456)
      • net.exe (PID: 7524)
      • newbuild.exe (PID: 7060)
      • native.exe (PID: 7980)
      • native.exe (PID: 7900)
      • time2time.exe (PID: 6056)
      • net.exe (PID: 7644)
      • 745fefcace80371e3ae5.exe (PID: 4532)
      • RegAsm.exe (PID: 7864)
      • svhoost.exe (PID: 6744)
      • One.exe (PID: 7256)
      • InstallUtil.exe (PID: 7024)
      • SteamService.exe (PID: 7856)
      • Steam.exe (PID: 1508)
      • win.exe (PID: 6204)
      • file.exe (PID: 2056)
      • 1.exe (PID: 8068)
      • asdfg.exe (PID: 6644)
      • 9sD9R.exe (PID: 7252)
      • asdfg.exe (PID: 6508)
      • ma.exe (PID: 7320)
      • 9sD9R.exe (PID: 8004)
      • .exe (PID: 7812)
      • vbc.exe (PID: 2648)
      • ruNO}Su(.exe (PID: 6552)
      • ruNO}Su(.exe (PID: 7532)
      • 79B.exe (PID: 6988)
      • 79B.exe (PID: 8084)
      • DownSysSoft.exe (PID: 2992)
      • KuwaitSetupHockey.tmp (PID: 4328)
      • ghjk.exe (PID: 6416)
      • GoogleUpdate.exe (PID: 3188)
      • don701.exe (PID: 4316)
      • oVlF.exe (PID: 6924)
      • GoogleUpdate.exe (PID: 3888)
      • don701.exe (PID: 6864)
      • GoogleUpdate.exe (PID: 7336)
      • GoogleUpdate.exe (PID: 6388)
      • oVlF.exe (PID: 4048)
      • ghjk.exe (PID: 3508)
      • Downaqzh.exe (PID: 8160)
      • 8.exe (PID: 6452)
      • YandexPackSetup.exe (PID: 7040)
      • msiexec.exe (PID: 7572)
      • 8.exe (PID: 7684)
      • SrbijaSetupHokej.tmp (PID: 5952)
    • Reads the machine GUID from the registry

      • 4363463463464363463463463.exe (PID: 6156)
      • asdfg.exe (PID: 1888)
      • 37.exe (PID: 2208)
      • BLueHvffhw.exe (PID: 3976)
      • BLueHvffhw.exe (PID: 2404)
      • net.exe (PID: 452)
      • zxcvb.exe (PID: 448)
      • file.exe (PID: 5004)
      • uRA7.exe (PID: 5452)
      • uRA7.exe (PID: 7112)
      • 5O9oJ7.exe (PID: 4180)
      • 55hdQ.exe (PID: 6828)
      • 5O9oJ7.exe (PID: 32)
      • 55hdQ.exe (PID: 4024)
      • 4363463463464363463463463.exe (PID: 2516)
      • 4363463463464363463463463.exe (PID: 1300)
      • 4363463463464363463463463.exe (PID: 6660)
      • mP5`GbMl(.exe (PID: 7264)
      • mP5`GbMl(.exe (PID: 7316)
      • RegAsm.exe (PID: 7380)
      • AddInUtil.exe (PID: 7596)
      • AddInUtil.exe (PID: 7692)
      • FallbackBuffer.exe (PID: 7192)
      • FallbackBuffer.exe (PID: 4316)
      • InstallUtil.exe (PID: 7512)
      • InstallUtil.exe (PID: 1436)
      • native.exe (PID: 3868)
      • GTA_V.tmp (PID: 7556)
      • ghjkl.exe (PID: 8140)
      • UseLegacyFipsThrow.exe (PID: 8028)
      • UseLegacyFipsThrow.exe (PID: 8076)
      • newbuild.exe (PID: 7060)
      • Server.exe (PID: 7088)
      • ghjk.exe (PID: 6884)
      • net.exe (PID: 7524)
      • time2time.exe (PID: 6056)
      • native.exe (PID: 7980)
      • svhoost.exe (PID: 6744)
      • One.exe (PID: 7256)
      • InstallUtil.exe (PID: 7024)
      • file.exe (PID: 2056)
      • asdfg.exe (PID: 6644)
      • 9sD9R.exe (PID: 7252)
      • 9sD9R.exe (PID: 8004)
      • .exe (PID: 7812)
      • ruNO}Su(.exe (PID: 7532)
      • ruNO}Su(.exe (PID: 6552)
      • 79B.exe (PID: 6988)
      • 79B.exe (PID: 8084)
      • oVlF.exe (PID: 6924)
      • don701.exe (PID: 4316)
      • don701.exe (PID: 6864)
      • ghjk.exe (PID: 6416)
      • oVlF.exe (PID: 4048)
      • GoogleUpdate.exe (PID: 6388)
      • 1.exe (PID: 8068)
      • msiexec.exe (PID: 7572)
      • 8.exe (PID: 6452)
    • Disables trace logs

      • 4363463463464363463463463.exe (PID: 6156)
      • 37.exe (PID: 2208)
      • 4363463463464363463463463.exe (PID: 2516)
      • 4363463463464363463463463.exe (PID: 1300)
      • 4363463463464363463463463.exe (PID: 6660)
      • InstallUtil.exe (PID: 7024)
      • Server.exe (PID: 7088)
      • .exe (PID: 7812)
    • Checks proxy server information

      • 4363463463464363463463463.exe (PID: 6156)
      • 37.exe (PID: 2208)
      • WezoAutoUP.exe (PID: 3992)
      • pocketrar350sc.exe (PID: 2416)
      • file.exe (PID: 5004)
      • WerFault.exe (PID: 6792)
      • DownSysSoft.exe (PID: 1132)
      • DownVerySync.exe (PID: 4004)
      • Downaqzh.exe (PID: 5076)
      • uRA7.exe (PID: 7112)
      • 55hdQ.exe (PID: 6828)
      • 4363463463464363463463463.exe (PID: 2516)
      • 4363463463464363463463463.exe (PID: 1300)
      • 4363463463464363463463463.exe (PID: 6660)
      • WerFault.exe (PID: 7444)
      • WerFault.exe (PID: 7824)
      • WerFault.exe (PID: 7212)
      • InstallUtil.exe (PID: 7024)
      • Steam.exe (PID: 1508)
      • file.exe (PID: 2056)
      • 1.exe (PID: 8068)
      • Server.exe (PID: 7088)
      • 9sD9R.exe (PID: 8004)
      • .exe (PID: 7812)
      • WerFault.exe (PID: 2456)
      • 79B.exe (PID: 8084)
      • DownSysSoft.exe (PID: 2992)
      • GoogleUpdate.exe (PID: 7336)
      • mshta.exe (PID: 7752)
      • GoogleUpdate.exe (PID: 6388)
      • Downaqzh.exe (PID: 8160)
      • certutil.exe (PID: 6452)
      • 8.exe (PID: 6452)
    • Process checks computer location settings

      • 4363463463464363463463463.exe (PID: 6156)
      • asdfg.exe (PID: 1888)
      • pocketrar350sc.exe (PID: 2416)
      • 4363463463464363463463463.exe (PID: 6660)
      • asec.exe (PID: 7464)
      • 4363463463464363463463463.exe (PID: 1300)
      • wzoptBmp.exe (PID: 1164)
      • 4363463463464363463463463.exe (PID: 2516)
      • RegAsm.exe (PID: 7864)
      • time2time.exe (PID: 6056)
      • InstallUtil.exe (PID: 7024)
      • .exe (PID: 7812)
      • GoogleUpdate.exe (PID: 3188)
      • 1.exe (PID: 8068)
    • Creates files or folders in the user directory

      • sc.exe (PID: 6624)
      • WezoAutoUP.exe (PID: 3992)
      • file.exe (PID: 5004)
      • BLueHvffhw.exe (PID: 2404)
      • Downaqzh.exe (PID: 5076)
      • WerFault.exe (PID: 6792)
      • DownSysSoft.exe (PID: 1132)
      • DownVerySync.exe (PID: 4004)
      • OOBE-Maintenance.exe (PID: 5116)
      • OOBE-Maintenance.exe (PID: 6640)
      • 5O9oJ7.exe (PID: 4180)
      • WerFault.exe (PID: 7444)
      • DeathRansom_1.exe (PID: 7244)
      • GTA_V.tmp (PID: 7556)
      • svhoost.exe (PID: 6744)
      • RegAsm.exe (PID: 7864)
      • WerFault.exe (PID: 7212)
      • InstallUtil.exe (PID: 7024)
      • WerFault.exe (PID: 7824)
      • 1.exe (PID: 8068)
      • OOBE-Maintenance.exe (PID: 5840)
      • WerFault.exe (PID: 2456)
      • Server.exe (PID: 7088)
      • OOBE-Maintenance.exe (PID: 7520)
      • DownSysSoft.exe (PID: 2992)
      • GoogleUpdate.exe (PID: 6388)
      • certutil.exe (PID: 6452)
      • Downaqzh.exe (PID: 8160)
      • 8.exe (PID: 4852)
      • 8.exe (PID: 6452)
    • Reads the software policy settings

      • 4363463463464363463463463.exe (PID: 6156)
      • 37.exe (PID: 2208)
      • file.exe (PID: 5004)
      • WerFault.exe (PID: 6792)
      • 4363463463464363463463463.exe (PID: 2516)
      • 4363463463464363463463463.exe (PID: 1300)
      • 4363463463464363463463463.exe (PID: 6660)
      • WerFault.exe (PID: 7444)
      • GTA_V.tmp (PID: 7556)
      • slui.exe (PID: 452)
      • InstallUtil.exe (PID: 7024)
      • WerFault.exe (PID: 7824)
      • WerFault.exe (PID: 7212)
      • file.exe (PID: 2056)
      • Server.exe (PID: 7088)
      • WerFault.exe (PID: 2456)
      • GoogleUpdate.exe (PID: 7336)
      • GoogleUpdate.exe (PID: 6388)
      • don701.exe (PID: 6864)
      • 1.exe (PID: 8068)
      • msiexec.exe (PID: 7572)
      • 8.exe (PID: 6452)
    • Create files in a temporary directory

      • asdfg.exe (PID: 1888)
      • WezoAutoUP.exe (PID: 3992)
      • pocketrar350sc.exe (PID: 2416)
      • Downaqzh.exe (PID: 5076)
      • DownSysSoft.exe (PID: 1132)
      • DownVerySync.exe (PID: 4004)
      • dbzclientUpdate.exe (PID: 7372)
      • GTA_V.exe (PID: 7660)
      • GTA_V.tmp (PID: 7556)
      • 745fefcace80371e3ae5.exe (PID: 4532)
      • Server.exe (PID: 7088)
      • 1.exe (PID: 8068)
      • ma.exe (PID: 7320)
      • DownSysSoft.exe (PID: 2992)
      • KuwaitSetupHockey.exe (PID: 1052)
      • KuwaitSetupHockey.tmp (PID: 4328)
      • av_downloader.exe (PID: 2216)
      • av_downloader.exe (PID: 6988)
      • GoogleUpdate.exe (PID: 6388)
      • Downaqzh.exe (PID: 8160)
      • 8.exe (PID: 6452)
      • 8.exe (PID: 4852)
      • 1.exe (PID: 7620)
      • YandexPackSetup.exe (PID: 7040)
      • 8.exe (PID: 7396)
      • 8.exe (PID: 7684)
      • 8.exe (PID: 7856)
      • SrbijaSetupHokej.tmp (PID: 5952)
      • SrbijaSetupHokej.exe (PID: 7608)
    • Reads product name

      • 37.exe (PID: 2208)
    • Reads mouse settings

      • WezoAutoUP.exe (PID: 3992)
      • arpwriteIni.exe (PID: 1928)
      • Downdd.exe (PID: 1052)
      • WezoEventUP.exe (PID: 3088)
      • Downaqzh.exe (PID: 5076)
      • DownSysSoft.exe (PID: 1132)
      • DownVerySync.exe (PID: 4004)
      • DelHosts.exe (PID: 5140)
      • wzoptup.exe (PID: 6628)
      • storyhosts.exe (PID: 6940)
      • sysup.exe (PID: 7648)
      • dbzclientUpdate.exe (PID: 7372)
      • changezuhaolnk.exe (PID: 3236)
      • Downdd.exe (PID: 7392)
      • DownSysSoft.exe (PID: 2992)
      • Downaqzh.exe (PID: 8160)
    • Process checks Internet Explorer phishing filters

      • pocketrar350sc.exe (PID: 2416)
    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 884)
      • powershell.exe (PID: 3932)
      • powershell.exe (PID: 7280)
      • powershell.exe (PID: 6192)
    • Creates files in the program directory

      • pocketrar350sc.exe (PID: 2416)
      • 745fefcace80371e3ae5.exe (PID: 4532)
      • Steam.exe (PID: 1508)
      • SteamService.exe (PID: 7856)
      • ma.exe (PID: 7320)
      • igccu.exe (PID: 6648)
      • GoogleUpdate.exe (PID: 3188)
      • GoogleUpdate.exe (PID: 7336)
      • GoogleUpdate.exe (PID: 3888)
      • GoogleUpdate.exe (PID: 6388)
    • Drops the executable file immediately after the start

      • OOBE-Maintenance.exe (PID: 5116)
      • OOBE-Maintenance.exe (PID: 6640)
      • conhost.exe (PID: 7288)
      • OOBE-Maintenance.exe (PID: 5840)
      • OOBE-Maintenance.exe (PID: 7520)
    • Manual execution by a user

      • Taskmgr.exe (PID: 5888)
      • Taskmgr.exe (PID: 6844)
      • 4363463463464363463463463.exe (PID: 7124)
      • 4363463463464363463463463.exe (PID: 2516)
      • 4363463463464363463463463.exe (PID: 6692)
      • 4363463463464363463463463.exe (PID: 1300)
      • 4363463463464363463463463.exe (PID: 6660)
      • 4363463463464363463463463.exe (PID: 6392)
      • notepad.exe (PID: 7004)
      • Steam.exe (PID: 1508)
      • powershell.exe (PID: 8072)
      • schtasks.exe (PID: 7592)
    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 5888)
      • notepad.exe (PID: 7004)
      • certutil.exe (PID: 6380)
      • certutil.exe (PID: 6452)
    • Reads CPU info

      • GTA_V.tmp (PID: 7556)
      • Server.exe (PID: 7088)
    • Process checks whether UAC notifications are on

      • time2time.exe (PID: 6056)
    • UPX packer has been detected

      • WezoAutoUP.exe (PID: 3992)
    • Reads Internet Explorer settings

      • mshta.exe (PID: 7752)
    • Reads Microsoft Office registry keys

      • don701.exe (PID: 6864)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:12:22 08:29:10+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 80
CodeSize: 5632
InitializedDataSize: 4608
UninitializedDataSize: -
EntryPoint: 0x3552
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription:
FileVersion: 0.0.0.0
InternalName: 4363463463464363463463463.exe
LegalCopyright:
OriginalFileName: 4363463463464363463463463.exe
ProductVersion: 0.0.0.0
AssemblyVersion: 0.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
374
Monitored processes
222
Malicious processes
55
Suspicious processes
12

Behavior graph

Click at the process to see the details
start #HAUSBOMBER 4363463463464363463463463.exe conhost.exe no specs sc.exe asdfg.exe 37.exe file.exe bluehvffhw.exe no specs asdfg.exe no specs bluehvffhw.exe #RHADAMANTHYS openwith.exe net.exe no specs net.exe no specs THREAT wezoautoup.exe pocketrar350sc.exe #RHADAMANTHYS oobe-maintenance.exe conhost.exe no specs arpwriteini.exe no specs cmd.exe no specs conhost.exe no specs downdd.exe no specs ipconfig.exe no specs powershell.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe wezoeventup.exe no specs zxcvb.exe no specs zxcvb.exe no specs #RHADAMANTHYS openwith.exe uninstall.exe no specs werfault.exe rundll32.exe no specs downaqzh.exe downsyssoft.exe downverysync.exe #RHADAMANTHYS oobe-maintenance.exe conhost.exe no specs 7z.exe no specs conhost.exe no specs delhosts.exe no specs wzoptup.exe no specs ura7.exe no specs #AZORULT ura7.exe taskmgr.exe no specs taskmgr.exe storyhosts.exe no specs 5o9oj7.exe no specs 5o9oj7.exe 55hdq.exe no specs #AZORULT 55hdq.exe powershell.exe no specs conhost.exe no specs 4363463463464363463463463.exe no specs #HAUSBOMBER 4363463463464363463463463.exe conhost.exe no specs 4363463463464363463463463.exe no specs 4363463463464363463463463.exe conhost.exe no specs 4363463463464363463463463.exe no specs 4363463463464363463463463.exe conhost.exe no specs deathransom_1.exe mp5`gbml(.exe no specs mp5`gbml(.exe no specs gold.exe regasm.exe werfault.exe asec.exe no specs addinutil.exe no specs sysup.exe no specs addinutil.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs sc.exe no specs fallbackbuffer.exe no specs %e6%85%95%e8%af%be%e7%bd%91%e8%a7%86%e9%a2%91%e8%a7%a3%e6%9e%90%e5%b7%a5%e5%85%b7_2015.exe no specs fallbackbuffer.exe no specs installutil.exe no specs installutil.exe dbzclientupdate.exe wzoptbmp.exe no specs notepad.exe no specs wzoptbmp.exe no specs gta_v.exe gta_v.tmp crypted_c360a5b7.exe no specs powershell.exe no specs conhost.exe no specs native.exe no specs regasm.exe no specs regasm.exe native.exe no specs #RHADAMANTHYS openwith.exe changezuhaolnk.exe no specs ghjkl.exe no specs ghjkl.exe no specs uselegacyfipsthrow.exe no specs uselegacyfipsthrow.exe no specs downdd.exe no specs file.exe #METASTEALER newbuild.exe server.exe #RHADAMANTHYS oobe-maintenance.exe conhost.exe ghjk.exe no specs ghjk.exe no specs net.exe no specs #RHADAMANTHYS openwith.exe net.exe no specs native.exe no specs native.exe no specs time2time.exe conhost.exe no specs 745fefcace80371e3ae5.exe 33333.exe regasm.exe one.exe conhost.exe no specs #REDLINE svhoost.exe werfault.exe powershell.exe no specs installutil.exe installutil.exe no specs werfault.exe conhost.exe no specs slui.exe no specs steamservice.exe conhost.exe no specs #RHADAMANTHYS oobe-maintenance.exe conhost.exe no specs steam.exe win.exe conhost.exe no specs 1.exe cmd.exe no specs conhost.exe no specs chcp.com no specs netsh.exe no specs findstr.exe no specs whoami.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs netsh.exe no specs asdfg.exe no specs asdfg.exe no specs #RHADAMANTHYS openwith.exe 9sd9r.exe no specs ma.exe #AZORULT 9sd9r.exe cmd.exe no specs conhost.exe no specs timeout.exe no specs .exe cmd.exe no specs conhost.exe no specs schtasks.exe no specs werfault.exe vbc.exe runo}su(.exe no specs runo}su(.exe no specs nxmr.exe 79b.exe no specs #RHADAMANTHYS oobe-maintenance.exe conhost.exe no specs #AZORULT 79b.exe downsyssoft.exe powershell.exe conhost.exe no specs kuwaitsetuphockey.exe kuwaitsetuphockey.tmp igccu.exe ghjk.exe no specs theporndude.exe no specs av_downloader.exe no specs conhost.exe no specs cmd.exe no specs mshta.exe no specs ovlf.exe no specs don701.exe no specs googleupdate.exe no specs #AGENTTESLA don701.exe googleupdate.exe no specs googleupdate.exe googleupdate.exe ovlf.exe no specs av_downloader.exe no specs ghjk.exe no specs conhost.exe no specs cmd.exe reg.exe no specs #RHADAMANTHYS openwith.exe reg.exe no specs reg.exe no specs attrib.exe no specs downaqzh.exe certutil.exe certutil.exe no specs schtasks.exe no specs timeout.exe no specs schtasks.exe conhost.exe no specs wupgrdsv.exe no specs yandexpacksetup.exe 1.exe no specs msiexec.exe no specs 8.exe 8.exe 8.exe 8.exe 8.exe srbijasetuphokej.exe srbijasetuphokej.tmp 4363463463464363463463463.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
32"C:\WINDOWS\system32\openwith.exe"C:\Windows\SysWOW64\OpenWith.exe
4363463463464363463463463.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Pick an app
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
32"C:\Users\admin\AppData\Local\Microsoft\5O9oJ7.exe"C:\Users\admin\AppData\Local\Microsoft\5O9oJ7.exeOOBE-Maintenance.exe
User:
admin
Integrity Level:
HIGH
Description:
PMIahpyqgai
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\microsoft\5o9oj7.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
448"C:\Users\admin\Desktop\Files\zxcvb.exe" C:\Users\admin\Desktop\Files\zxcvb.exe4363463463464363463463463.exe
User:
admin
Integrity Level:
HIGH
Description:
NATIVE
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\files\zxcvb.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
448timeout 3 C:\Windows\System32\timeout.execmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
452"C:\Users\admin\Desktop\Files\net.exe" C:\Users\admin\Desktop\Files\net.exe4363463463464363463463463.exe
User:
admin
Integrity Level:
HIGH
Description:
NATIVE
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\files\net.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
452"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
608C:\WINDOWS\system32\cmd.exe /c ipconfig C:\Windows\SysWOW64\cmd.exearpwriteIni.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
696\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exepowershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
884"powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwALABDADoAXABVAHMAZQByAHMAXABhAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAARgBhAGwAbABiAGEAYwBrAEIAdQBmAGYAZQByAC4AZQB4AGUAOwA=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1052"C:\Users\admin\Desktop\Files\Downdd.exe" C:\Users\admin\Desktop\Files\Downdd.exe4363463463464363463463463.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
3, 3, 9, 0
Modules
Images
c:\users\admin\desktop\files\downdd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
176 980
Read events
175 821
Write events
1 097
Delete events
62

Modification events

(PID) Process:(6156) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6156) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6156) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(6156) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(6156) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(6156) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(6156) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(6156) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(6156) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6156) 4363463463464363463463463.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\4363463463464363463463463_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
226
Suspicious files
83
Text files
631
Unknown types
49

Dropped files

PID
Process
Filename
Type
3992WezoAutoUP.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\Config[1].initext
MD5:DAE1EED168A0536A275E5A15AE7DB07F
SHA256:00F26743C9486FAC7E82F9E79712C138B7A988C99EA27554283EAACA998DAB49
1888asdfg.exeC:\Users\admin\AppData\Local\Temp\BLueHvffhw.exeexecutable
MD5:ABF2DA5B3E7845F50463A72F8B6E6AAA
SHA256:2A4B1AE0AE67CD31F85680E6351BD5B92FF61E246C158DECB1A43A3EF01D9F2C
61564363463463464363463463463.exeC:\Users\admin\Desktop\Files\sc.exeexecutable
MD5:E86471DA9E0244D1D5E29B15FC9FEB80
SHA256:50DD267B25062A6C94DE3976D9A198A882A2B5801270492D32F0C0DADC6CAA81
3992WezoAutoUP.exeC:\Users\admin\AppData\Local\Temp\AutoUpdate.dattext
MD5:DAE1EED168A0536A275E5A15AE7DB07F
SHA256:00F26743C9486FAC7E82F9E79712C138B7A988C99EA27554283EAACA998DAB49
61564363463463464363463463463.exeC:\Users\admin\Desktop\Files\net.exeexecutable
MD5:A2A9C309C5300A53D2C2FC41B71B174B
SHA256:7CCFAE8644C3BC7439B88F2DC0DE06BB5082DE09B0BF5E143DE17487FF252224
2416pocketrar350sc.exeC:\Users\admin\AppData\Local\Temp\gdc2741.tmpexecutable
MD5:FE763C2D71419352141C77C310E600D2
SHA256:7FDF10CA02D2238E22FDA18DFBEDE9750DA9F257221802C8B86C557C19C9BC7B
3992WezoAutoUP.exeC:\Users\admin\AppData\Local\Temp\aut1EA6.tmpbinary
MD5:E4153373DD0754F3FE30ADD53C496576
SHA256:903D7479F85CF2592C71D6A98470DFE29C118AA131EBB19F05D7549CD400BB89
3992WezoAutoUP.exeC:\Users\admin\AppData\Local\Temp\rwcbgjgtext
MD5:CFCD5FC0E571398B318EB19ECAA77D0E
SHA256:5E74A8F714CD9BB5D881F41B3B34B11B8F4B1FE768CAB9DD97CD26E2758A8EBA
61564363463463464363463463463.exeC:\Users\admin\Desktop\Files\pocketrar350sc.exeexecutable
MD5:A6A4DAA74D974F2D92B35392207070CE
SHA256:38E1821B1289F087CFD17799A47081A368348FDEF2C45DD216390269F8E52BB3
6624sc.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sc.exeexecutable
MD5:E86471DA9E0244D1D5E29B15FC9FEB80
SHA256:50DD267B25062A6C94DE3976D9A198A882A2B5801270492D32F0C0DADC6CAA81
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
101
TCP/UDP connections
210
DNS requests
92
Threats
327

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5940
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
unknown
6156
4363463463464363463463463.exe
GET
200
36.249.46.173:8765
http://36.249.46.173:8765/Downaqzh.exe
unknown
unknown
3992
WezoAutoUP.exe
GET
200
58.23.215.23:8765
http://wieie.cn:8765/DownVerySync.exe
unknown
unknown
5940
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
unknown
6156
4363463463464363463463463.exe
GET
200
91.215.85.223:80
http://ns2.badhabits.ug/asdfg.exe
unknown
unknown
6156
4363463463464363463463463.exe
GET
200
185.172.128.121:80
http://185.172.128.121/sc.exe
unknown
unknown
4980
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
unknown
6156
4363463463464363463463463.exe
GET
200
77.91.77.80:80
http://77.91.77.80/lend/37.exe
unknown
unknown
6156
4363463463464363463463463.exe
GET
200
77.91.77.81:80
http://77.91.77.81/lend/file.exe
unknown
unknown
6156
4363463463464363463463463.exe
GET
200
91.215.85.223:80
http://pop.partaususd.ru/net.exe
unknown
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
whitelisted
3676
MoUsoCoreWorker.exe
51.104.136.2:443
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4032
svchost.exe
239.255.255.250:1900
whitelisted
4
System
192.168.100.255:138
whitelisted
6156
4363463463464363463463463.exe
151.101.66.49:443
urlhaus.abuse.ch
FASTLY
US
unknown
6156
4363463463464363463463463.exe
185.172.128.121:80
OOO Nadym Svyaz Service
RU
unknown
6156
4363463463464363463463463.exe
91.215.85.223:80
ns2.badhabits.ug
RU
unknown
4980
svchost.exe
20.190.160.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
4980
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1060
svchost.exe
23.213.166.81:443
go.microsoft.com
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
urlhaus.abuse.ch
  • 151.101.66.49
  • 151.101.2.49
  • 151.101.130.49
  • 151.101.194.49
whitelisted
ns2.badhabits.ug
  • 91.215.85.223
unknown
login.live.com
  • 20.190.160.14
  • 40.126.32.76
  • 40.126.32.136
  • 20.190.160.17
  • 20.190.160.22
  • 40.126.32.72
  • 40.126.32.68
  • 40.126.32.138
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.13
whitelisted
ussrconnect.ru
  • 104.21.38.193
  • 172.67.137.239
unknown
c0nnect1ng.ru
  • 104.21.44.91
  • 172.67.198.59
unknown
pop.partaususd.ru
  • 91.215.85.223
unknown
ip-api.com
  • 208.95.112.1
shared
download.skycn.com
  • 116.114.98.35
unknown

Threats

PID
Process
Class
Message
6156
4363463463464363463463463.exe
Potentially Bad Traffic
ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
6156
4363463463464363463463463.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
6156
4363463463464363463463463.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
6156
4363463463464363463463463.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 32
6156
4363463463464363463463463.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
6156
4363463463464363463463463.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
6156
4363463463464363463463463.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 13
6156
4363463463464363463463463.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
6156
4363463463464363463463463.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
6156
4363463463464363463463463.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
44 ETPRO signatures available at the full report
Process
Message
OOBE-Maintenance.exe
[thresholding] image = 0000027C2E2433D0 , (0 , 1380) (0 , 690)
OOBE-Maintenance.exe
[thresholding] image = 0000027C2E2433D0 , (0 , 1003) (0 , 502)
OOBE-Maintenance.exe
[thresholding] image = 0000027C2E2433D0 , (0 , 1381) (0 , 690)
OOBE-Maintenance.exe
[thresholding] image = 0000027C2FC3C040 , (0 , 1900) (0 , 950)
OOBE-Maintenance.exe
[thresholding] image = 0000027C2FBC6040 , (0 , 1842) (0 , 921)
OOBE-Maintenance.exe
[thresholding] image = 00000210064A33D0 , (0 , 1380) (0 , 690)
OOBE-Maintenance.exe
[thresholding] image = 0000021006225020 , (0 , 1003) (0 , 502)
OOBE-Maintenance.exe
[thresholding] image = 000002100658DE10 , (0 , 1381) (0 , 690)
OOBE-Maintenance.exe
[thresholding] image = 0000021007F37040 , (0 , 1900) (0 , 950)
OOBE-Maintenance.exe
[thresholding] image = 0000021007A86040 , (0 , 1842) (0 , 921)