File name:

1

Full analysis: https://app.any.run/tasks/8f07c38a-1bce-4324-a8cb-9e7832abeeeb
Verdict: Malicious activity
Analysis date: October 03, 2025, 16:40:41
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
zeroaccess
geo
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 3 sections
MD5:

15FC8F362186D9A44C23019B16427A47

SHA1:

604F3346C5BC98E7E5F68B237773D519D87EB650

SHA256:

32FC50A44536FDB76F91A6B03478256BE325AB5E42752826550892D497461AD2

SSDEEP:

24576:AZwpXUCHCzMq8OqpUoQKkTWKEo0FCIIrHaqTb3daEa5P1B/ocSbhaxEcKcBnRTNu:AZwpXUCHCzMq8OqpUoQKkRfsrIjaoaER

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ZEROACCESS has been detected

      • 1.exe (PID: 5708)

    • Executing a file with an untrusted certificate

      • InstallFlashPlayer.exe (PID: 6176)

    • ZEROACCESS mutex has been found

      • 1.exe (PID: 5708)
      • InstallFlashPlayer.exe (PID: 6176)

    • ZEROACCESS has been detected (SURICATA)

      • 1.exe (PID: 5708)
      • InstallFlashPlayer.exe (PID: 6176)

  • SUSPICIOUS

    • Creates/Modifies COM task schedule object

      • 1.exe (PID: 5708)

    • Reads security settings of Internet Explorer

      • 1.exe (PID: 5708)
      • InstallFlashPlayer.exe (PID: 6176)

    • Executable content was dropped or overwritten

      • 1.exe (PID: 5708)

    • Starts CMD.EXE for commands execution

      • 1.exe (PID: 5708)

    • Reads the date of Windows installation

      • 1.exe (PID: 5708)

    • There is functionality for taking screenshot (YARA)

      • InstallFlashPlayer.exe (PID: 6176)

    • There is functionality for lookup Geolocation (YARA)

      • InstallFlashPlayer.exe (PID: 6176)

  • INFO

    • Checks supported languages

      • 1.exe (PID: 5708)
      • InstallFlashPlayer.exe (PID: 6176)

    • Process checks computer location settings

      • 1.exe (PID: 5708)

    • Reads the computer name

      • 1.exe (PID: 5708)
      • InstallFlashPlayer.exe (PID: 6176)

    • The sample compiled with english language support

      • 1.exe (PID: 5708)

    • Reads the machine GUID from the registry

      • 1.exe (PID: 5708)

    • Checks proxy server information

      • InstallFlashPlayer.exe (PID: 6176)
      • BackgroundTransferHost.exe (PID: 8332)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 2004)
      • BackgroundTransferHost.exe (PID: 8332)
      • BackgroundTransferHost.exe (PID: 8532)
      • BackgroundTransferHost.exe (PID: 8748)
      • BackgroundTransferHost.exe (PID: 8960)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 8332)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 8332)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 EXE PECompact compressed (generic) (47.2)
.exe | Win32 Executable MS Visual C++ (generic) (35.5)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2004:03:30 18:48:45+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug, Bytes reversed hi
PEType: PE32
LinkerVersion: 6
CodeSize: 98057
InitializedDataSize: 80896
UninitializedDataSize: 4096
EntryPoint: 0x2461
OSVersion: 4
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
180
Monitored processes
10
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ZEROACCESS 1.exe #ZEROACCESS installflashplayer.exe cmd.exe no specs conhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
764"C:\WINDOWS\system32\cmd.exe"C:\Windows\SysWOW64\cmd.exe—1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
4294967295
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2004"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
2276C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5708"C:\Users\admin\AppData\Local\Temp\1.exe" C:\Users\admin\AppData\Local\Temp\1.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6176"C:\Users\admin\AppData\Local\Temp\InstallFlashPlayer.exe" C:\Users\admin\AppData\Local\Temp\InstallFlashPlayer.exe
1.exe
User:
admin
Company:
Adobe Systems, Inc.
Integrity Level:
HIGH
Description:
Adobe® Flash® Player Installer/Uninstaller 11.0 r1
Version:
11,0,1,152
Modules
Images
c:\users\admin\appdata\local\temp\installflashplayer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
7072\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
8332"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
8532"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
8748"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
8960"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
Total events
7 022
Read events
6 985
Write events
37
Delete events
0

Modification events

(PID) Process:(5708) 1.exeKey:HKEY_CLASSES_ROOT\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Both
(PID) Process:(5708) 1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
Operation:writeName:LastUpdate
Value:
8FFCDF6800000000
(PID) Process:(5708) 1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(5708) 1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(5708) 1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(5708) 1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(5708) 1.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6176) InstallFlashPlayer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6176) InstallFlashPlayer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6176) InstallFlashPlayer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
Executable files
3
Suspicious files
6
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
8332BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\0367e857-291e-48f2-9e3c-9536d3025e83.down_data —
MD5:—
SHA256:—
8332BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:A2459D8C15651BB81784468BC907C939
SHA256:E6360479BE8038E7443DA1855F01EC552F1B602A656A2BF713C1CD760B7CB6C8
8332BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\0367e857-291e-48f2-9e3c-9536d3025e83.fe70ec63-2c93-4734-9d85-00d20569981d.down_metabinary
MD5:29E0562FAA619A7814EBE2F2B390D227
SHA256:2BACDD6F5BAB875DD74F1052AD7BC0B16549E8012DEAB69BC64F6795F7C3A922
57081.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\$81b8c3da9d80cef97346aaa39584b477\@binary
MD5:222B409F89517B05F2B842C848F5BB07
SHA256:722D0600B2BA90B2BFE3790F1E49E30D09C6EEEEB7AA5F06F5D287FFB9F662B8
57081.exeC:\$Recycle.Bin\S-1-5-21-1693682860-607145093-2874071422-1001\$81b8c3da9d80cef97346aaa39584b477\nexecutable
MD5:9E0CD37B6D0809CF7D5FA5B521538D0D
SHA256:55D9748F0556576A8D522CF4B8DCFC9717436ADCC487D49B3320770432960DB2
57081.exeC:\Users\admin\AppData\Local\Temp\InstallFlashPlayer.exeexecutable
MD5:2FF9B590342C62748885D459D082295F
SHA256:672EC8DCEAFD429C1A09CFAFBC4951968953E2081E0D97243040DB16EDB24429
8332BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:519011CF36BD92B87BE98037627A2EEA
SHA256:9CC535C852C455837B584E431A3E7062B4CD65079EAA1398E06461BA176C79FD
57081.exeC:\Users\admin\AppData\Local\Temp\msimg32.dllexecutable
MD5:7B7AF5E7EF8E667EC78A069421056F2A
SHA256:82B3012CAA8D95765221995E9456013883259304045379A87E57F03F37F7B782
8332BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\0dd1102a-0dd4-4e43-944e-ba81f4aecc52.up_meta_securebinary
MD5:ADEE35F7E5536FED0DB84B5E23AC406C
SHA256:D05F7F7FD4A03B0FC6AB149DF04A0B23EFDDA23F3071F493A5AEE391A4DC8C0F
8332BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\0dd1102a-0dd4-4e43-944e-ba81f4aecc52.fe70ec63-2c93-4734-9d85-00d20569981d.down_metabinary
MD5:29E0562FAA619A7814EBE2F2B390D227
SHA256:2BACDD6F5BAB875DD74F1052AD7BC0B16549E8012DEAB69BC64F6795F7C3A922
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
51
DNS requests
18
Threats
17

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6176
InstallFlashPlayer.exe
GET
404
23.197.137.122:80
http://fpdownload.macromedia.com/get/flashplayer/update/current/install/install_all_win_cab_64_ax_sgn.z
US
html
196 b
whitelisted
6176
InstallFlashPlayer.exe
GET
404
23.197.137.122:80
http://fpdownload.macromedia.com/get/flashplayer/update/current/install/install_all_win_cab_64_ax_sgn.z
US
html
196 b
whitelisted
5276
svchost.exe
GET
200
172.66.2.5:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
6340
backgroundTaskHost.exe
GET
200
172.66.2.5:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
US
binary
313 b
whitelisted
5276
svchost.exe
GET
200
172.66.2.5:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
204
backgroundTaskHost.exe
GET
200
172.66.2.5:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
US
binary
471 b
whitelisted
3420
backgroundTaskHost.exe
GET
200
172.66.2.5:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
US
binary
471 b
whitelisted
8332
BackgroundTransferHost.exe
GET
200
172.66.2.5:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
US
binary
313 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6016
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4384
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5224
SearchApp.exe
95.100.100.114:443
www.bing.com
Akamai International B.V.
PT
whitelisted
5708
1.exe
194.165.17.3:53
—
—
—
malicious
5708
1.exe
66.85.130.234:53
—
—
—
malicious
4
System
192.168.100.255:138
—
—
—
whitelisted
6176
InstallFlashPlayer.exe
194.165.17.3:53
—
—
—
malicious
6176
InstallFlashPlayer.exe
66.85.130.234:53
—
—
—
malicious
6176
InstallFlashPlayer.exe
23.197.137.122:80
fpdownload.macromedia.com
Akamai International B.V.
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
www.bing.com
  • 95.100.100.114
  • 95.100.100.129
  • 95.100.100.130
  • 95.100.100.121
  • 104.126.37.128
  • 104.126.37.163
  • 104.126.37.154
  • 104.126.37.136
  • 104.126.37.145
  • 104.126.37.144
  • 104.126.37.139
whitelisted
google.com
  • 142.250.186.174
whitelisted
j.maxmind.com
  • —
shared
fpdownload.macromedia.com
  • 23.197.137.122
whitelisted
login.live.com
  • 20.190.160.2
  • 20.190.160.4
  • 20.190.160.64
  • 40.126.32.74
  • 40.126.32.68
  • 20.190.160.17
  • 20.190.160.130
  • 40.126.32.134
whitelisted
ocsp.digicert.com
  • 172.66.2.5
  • 162.159.142.9
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
arc.msn.com
  • 20.31.169.57
  • 20.223.36.55
whitelisted
fd.api.iris.microsoft.com
  • 20.74.47.205
whitelisted

Threats

PID
Process
Class
Message
5708
1.exe
A Network Trojan was detected
ET MALWARE ZeroAccess udp traffic detected
5708
1.exe
A Network Trojan was detected
ET MALWARE ZeroAccess udp traffic detected
5708
1.exe
A Network Trojan was detected
ET MALWARE ZeroAccess udp traffic detected
5708
1.exe
A Network Trojan was detected
ET MALWARE ZeroAccess udp traffic detected
5708
1.exe
A Network Trojan was detected
ET MALWARE ZeroAccess udp traffic detected
5708
1.exe
A Network Trojan was detected
ET MALWARE ZeroAccess udp traffic detected
5708
1.exe
A Network Trojan was detected
ET MALWARE ZeroAccess udp traffic detected
5708
1.exe
A Network Trojan was detected
ET MALWARE ZeroAccess udp traffic detected
5708
1.exe
A Network Trojan was detected
ET MALWARE ZeroAccess udp traffic detected
5708
1.exe
A Network Trojan was detected
ET MALWARE ZeroAccess udp traffic detected
No debug info