File name:

EaseUS+Partition+Master+v16.5+(x64)+WinPE+Bootable+ISO.zip

Full analysis: https://app.any.run/tasks/e605982a-3a2c-4803-b13b-3c6f3a00cbad
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: December 27, 2021, 01:20:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
trojan
loader
rat
redline
stealer
vidar
opendir
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

074ECB04CE55D125FE5496D8703B1519

SHA1:

7F46AD3FD5477237C4EB1E89519EEA89153BCE21

SHA256:

3BB76F4859FAEA9EF4FE2ADD7E0999385B82E1B7B160981320DC94832556C036

SSDEEP:

1536:zdR38+ckL/DfxuX190ntOuhpWOvhSvdcXoWKzcuqc63nKjHamuJgdQm:3nDxuX1ylhhsd1nXqFnu6Lm

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • Setup.exe (PID: 3088)
      • Setup.exe (PID: 3024)
      • ElEMd1CxhRNZeDpKLkETdrkZ.exe (PID: 2336)
      • Setup.exe (PID: 2928)
      • Setup.exe (PID: 3552)
      • Ef0crPgRczAgGzghRIBCZSM_.exe (PID: 3764)
      • Q9E_G81uqw6phhYdkdj4r451.exe (PID: 4032)
      • 4c51caQPI4UqwnOZ3lxgNRTI.exe (PID: 3640)
      • 2Ld68_MTjyZ03jXmPN0v7Yu3.exe (PID: 3828)
      • RBf87uuH6_mnjcM1ZmuHmocI.exe (PID: 684)
      • K6UhJRYkzWzgDaJgc9H5RKDw.exe (PID: 2716)
      • pJchOMzCqCmb4ysvN1ZygsuH.exe (PID: 2748)
      • 4akRWxwrYAC8lcXso9jEasou.exe (PID: 3016)
      • PJ3k324Fy5Lk7oA7Na5U9g7O.exe (PID: 2588)
      • 405104d7-1ff3-44c2-bb34-f1e1b709b759.exe (PID: 3720)
      • Wyshygyloqi.exe (PID: 3820)
      • 0e1c3664-d80e-4fbf-8a10-5a1146d7cc00.exe (PID: 2908)
      • 3252117132521171.exe (PID: 2124)
      • Wyshygyloqi.exe (PID: 4060)
      • ezAwMuC9EjnY4UJW5vfffcle.exe (PID: 2940)
      • Xaelifaelive.exe (PID: 388)
      • Nuholaenysu.exe (PID: 1240)
      • foldershare.exe (PID: 456)
      • foldershare.exe (PID: 492)
      • 167e9098-496c-45c3-8e84-34db442fa9bc.exe (PID: 2512)
      • df244149-12bb-493b-9189-a9beda885c87.exe (PID: 2716)
      • llEIBj9dvZlfmcyBbRmUBlNB.exe (PID: 5224)
      • vghSoREneeOWphSb7T71LI_s.exe (PID: 6868)
      • lKZcDnrfU7pj0sN9fWuChskc.exe (PID: 6988)
      • K6WtD8S_9UIOZjaWwYPfQLgT.exe (PID: 4852)
      • K6WtD8S_9UIOZjaWwYPfQLgT.exe (PID: 756)
      • installer.exe (PID: 4376)
      • installer.exe (PID: 6508)
      • random.exe (PID: 9316)
      • Boshohygaecae.exe (PID: 7404)
      • Wycozhaecome.exe (PID: 7168)
      • random.exe (PID: 6884)
      • 2270810.exe (PID: 2944)
      • yangxiuying.exe (PID: 9168)
      • yangxiuying.exe (PID: 7176)
      • Setup.exe (PID: 3840)
      • Install.exe (PID: 5028)
      • installer.exe (PID: 8660)
      • askinstall42.exe (PID: 3012)
      • f.exe (PID: 4180)
      • random.exe (PID: 5760)
      • random.exe (PID: 2472)
      • installer.exe (PID: 8684)

    • Disables Windows Defender

      • Setup.exe (PID: 3024)
      • Setup.exe (PID: 3552)
      • 4akRWxwrYAC8lcXso9jEasou.exe (PID: 3016)

    • Actions looks like stealing of personal data

      • WinRAR.exe (PID: 1584)
      • svchost.exe (PID: 876)
      • 405104d7-1ff3-44c2-bb34-f1e1b709b759.exe (PID: 3720)
      • RBf87uuH6_mnjcM1ZmuHmocI.exe (PID: 684)
      • gKGi3YMnTHQFfECvW0hRvley.exe (PID: 1976)
      • 3XP2DSF86macEpvlIsIJBG2h.exe (PID: 3432)
      • 2dAtfMfiuAk66GgckxVitW9M.exe (PID: 2700)
      • 167e9098-496c-45c3-8e84-34db442fa9bc.exe (PID: 2512)
      • hhcNvPPSmcWzO3K8ZKWDT0H9.exe (PID: 6104)
      • WXNM6CCc299CENNTXOdZfFH6.exe (PID: 8016)
      • LzmwAqmV.exe (PID: 2196)
      • 42d8f7b8-1c86-498b-b5aa-0d0b16bb44bc.exe (PID: 4976)
      • cmd.exe (PID: 6660)
      • Setup.exe (PID: 3840)
      • Outlab01.exe (PID: 10172)
      • Proxyupd.exe (PID: 10076)
      • cRRjQiD_Bxu1hwbS2DAyqG25.exe (PID: 5040)
      • AppLaunch.exe (PID: 4620)

    • Changes settings of System certificates

      • Setup.exe (PID: 3024)
      • 2Ld68_MTjyZ03jXmPN0v7Yu3.exe (PID: 3828)
      • 2dAtfMfiuAk66GgckxVitW9M.exe (PID: 2700)
      • Nuholaenysu.exe (PID: 1240)
      • chrome.exe (PID: 3412)

    • Connects to CnC server

      • Setup.exe (PID: 3024)
      • Setup.exe (PID: 3552)
      • RBf87uuH6_mnjcM1ZmuHmocI.exe (PID: 684)
      • 2Ld68_MTjyZ03jXmPN0v7Yu3.exe (PID: 3828)
      • gKGi3YMnTHQFfECvW0hRvley.exe (PID: 1976)
      • 3XP2DSF86macEpvlIsIJBG2h.exe (PID: 3432)
      • 4akRWxwrYAC8lcXso9jEasou.exe (PID: 3016)
      • 167e9098-496c-45c3-8e84-34db442fa9bc.exe (PID: 2512)
      • hhcNvPPSmcWzO3K8ZKWDT0H9.exe (PID: 6104)
      • WXNM6CCc299CENNTXOdZfFH6.exe (PID: 8016)
      • AppLaunch.exe (PID: 4620)
      • 41e98be2-adf5-48f7-b0e0-0d049838b03d.exe (PID: 4468)
      • cRRjQiD_Bxu1hwbS2DAyqG25.exe (PID: 5040)
      • md9_1sjm.exe (PID: 5684)

    • Drops executable file immediately after starts

      • ElEMd1CxhRNZeDpKLkETdrkZ.exe (PID: 2336)
      • 4c51caQPI4UqwnOZ3lxgNRTI.exe (PID: 3640)
      • Q9E_G81uqw6phhYdkdj4r451.exe (PID: 4032)
      • PJ3k324Fy5Lk7oA7Na5U9g7O.exe (PID: 2588)
      • pJchOMzCqCmb4ysvN1ZygsuH.exe (PID: 2748)
      • PJ3k324Fy5Lk7oA7Na5U9g7O.tmp (PID: 2352)
      • pJchOMzCqCmb4ysvN1ZygsuH.tmp (PID: 1032)
      • 0e1c3664-d80e-4fbf-8a10-5a1146d7cc00.exe (PID: 2908)

    • Loads dropped or rewritten executable

      • 4c51caQPI4UqwnOZ3lxgNRTI.exe (PID: 3640)
      • Q9E_G81uqw6phhYdkdj4r451.exe (PID: 4032)
      • 2dAtfMfiuAk66GgckxVitW9M.exe (PID: 2700)
      • WerFault.exe (PID: 3604)
      • Outlab01.exe (PID: 10172)

    • REDLINE was detected

      • RBf87uuH6_mnjcM1ZmuHmocI.exe (PID: 684)
      • gKGi3YMnTHQFfECvW0hRvley.exe (PID: 1976)
      • 3XP2DSF86macEpvlIsIJBG2h.exe (PID: 3432)
      • 167e9098-496c-45c3-8e84-34db442fa9bc.exe (PID: 2512)
      • hhcNvPPSmcWzO3K8ZKWDT0H9.exe (PID: 6104)
      • WXNM6CCc299CENNTXOdZfFH6.exe (PID: 8016)
      • AppLaunch.exe (PID: 4620)
      • 41e98be2-adf5-48f7-b0e0-0d049838b03d.exe (PID: 4468)
      • cRRjQiD_Bxu1hwbS2DAyqG25.exe (PID: 5040)

    • Uses Task Scheduler to run other applications

      • 2Ld68_MTjyZ03jXmPN0v7Yu3.exe (PID: 3828)
      • Install.exe (PID: 5028)

    • Uses Task Scheduler to autorun other applications

      • 2Ld68_MTjyZ03jXmPN0v7Yu3.exe (PID: 3828)

    • VIDAR was detected

      • 2dAtfMfiuAk66GgckxVitW9M.exe (PID: 2700)
      • Outlab01.exe (PID: 10172)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 1952)
      • schtasks.exe (PID: 584)
      • MsiExec.exe (PID: 7132)
      • schtasks.exe (PID: 6704)
      • schtasks.exe (PID: 5280)
      • schtasks.exe (PID: 9948)
      • svchost.exe (PID: 876)

    • Changes the autorun value in the registry

      • 0e1c3664-d80e-4fbf-8a10-5a1146d7cc00.exe (PID: 2908)
      • Bouderbela.exe (PID: 1008)
      • Bouderbela.exe (PID: 3416)

    • Steals credentials from Web Browsers

      • RBf87uuH6_mnjcM1ZmuHmocI.exe (PID: 684)
      • 405104d7-1ff3-44c2-bb34-f1e1b709b759.exe (PID: 3720)
      • 3XP2DSF86macEpvlIsIJBG2h.exe (PID: 3432)
      • 2dAtfMfiuAk66GgckxVitW9M.exe (PID: 2700)
      • gKGi3YMnTHQFfECvW0hRvley.exe (PID: 1976)
      • 167e9098-496c-45c3-8e84-34db442fa9bc.exe (PID: 2512)
      • hhcNvPPSmcWzO3K8ZKWDT0H9.exe (PID: 6104)
      • WXNM6CCc299CENNTXOdZfFH6.exe (PID: 8016)
      • Outlab01.exe (PID: 10172)
      • AppLaunch.exe (PID: 4620)

    • Stealing of credential data

      • 405104d7-1ff3-44c2-bb34-f1e1b709b759.exe (PID: 3720)
      • 2dAtfMfiuAk66GgckxVitW9M.exe (PID: 2700)

    • Application was injected by another process

      • svchost.exe (PID: 876)

    • Runs injected code in another process

      • rundll32.exe (PID: 5596)
      • rundll32.exe (PID: 4380)
      • rundll32.exe (PID: 7044)

    • Registers / Runs the DLL via REGSVR32.EXE

      • acaWMbzUfCXTkWlKZUPnciF_.exe (PID: 5944)

    • Loads the Task Scheduler DLL interface

      • schtasks.exe (PID: 2500)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 1248)
      • WinRAR.exe (PID: 1584)
      • Setup.exe (PID: 3024)
      • ElEMd1CxhRNZeDpKLkETdrkZ.exe (PID: 2336)
      • Setup.exe (PID: 3552)
      • 4c51caQPI4UqwnOZ3lxgNRTI.exe (PID: 3640)
      • Q9E_G81uqw6phhYdkdj4r451.exe (PID: 4032)
      • Ef0crPgRczAgGzghRIBCZSM_.exe (PID: 3764)
      • 2Ld68_MTjyZ03jXmPN0v7Yu3.exe (PID: 3828)
      • RBf87uuH6_mnjcM1ZmuHmocI.exe (PID: 684)
      • K6UhJRYkzWzgDaJgc9H5RKDw.exe (PID: 2716)
      • EcDpXKnyihU3lPRDXQU4CQRG.exe (PID: 3416)
      • 2dAtfMfiuAk66GgckxVitW9M.exe (PID: 2700)
      • cmd.exe (PID: 588)
      • PJ3k324Fy5Lk7oA7Na5U9g7O.exe (PID: 2588)
      • pJchOMzCqCmb4ysvN1ZygsuH.exe (PID: 2748)
      • pJchOMzCqCmb4ysvN1ZygsuH.tmp (PID: 1032)
      • PJ3k324Fy5Lk7oA7Na5U9g7O.tmp (PID: 2352)
      • gKGi3YMnTHQFfECvW0hRvley.exe (PID: 1976)
      • dJW70TPBhg88Utq3oX9qOr5q.exe (PID: 2504)
      • 3XP2DSF86macEpvlIsIJBG2h.exe (PID: 3432)
      • Bouderbela.exe (PID: 1008)
      • Bouderbela.exe (PID: 3416)
      • 4akRWxwrYAC8lcXso9jEasou.exe (PID: 3016)
      • 405104d7-1ff3-44c2-bb34-f1e1b709b759.exe (PID: 3720)
      • 0e1c3664-d80e-4fbf-8a10-5a1146d7cc00.exe (PID: 2908)
      • 3252117132521171.exe (PID: 2124)
      • Wyshygyloqi.exe (PID: 3820)
      • Wyshygyloqi.exe (PID: 4060)
      • Nuholaenysu.exe (PID: 1240)
      • Xaelifaelive.exe (PID: 388)
      • foldershare.exe (PID: 456)
      • foldershare.exe (PID: 492)
      • foldershare.tmp (PID: 3664)
      • foldershare.tmp (PID: 3252)
      • df244149-12bb-493b-9189-a9beda885c87.exe (PID: 2716)
      • 167e9098-496c-45c3-8e84-34db442fa9bc.exe (PID: 2512)
      • ezAwMuC9EjnY4UJW5vfffcle.exe (PID: 2940)
      • FolderShare.exe (PID: 2664)
      • dg10x768J4Xvl7eYitBXGvVA.exe (PID: 2592)
      • 49kyiytYIRHKNCaDq_Mjafgg.exe (PID: 4252)
      • cmd.exe (PID: 2628)
      • cmd.exe (PID: 4208)
      • Install.exe (PID: 5028)
      • Install.exe (PID: 5180)
      • cmd.exe (PID: 5420)
      • powershell.exe (PID: 5796)
      • hhcNvPPSmcWzO3K8ZKWDT0H9.exe (PID: 6104)
      • WMIC.exe (PID: 4076)
      • pdCklnBKzox0uAWhJ7HCXrmD.exe (PID: 2264)
      • powershell.exe (PID: 4660)
      • WMIC.exe (PID: 6012)
      • powershell.exe (PID: 4548)
      • WMIC.exe (PID: 5024)
      • powershell.exe (PID: 5036)
      • K6WtD8S_9UIOZjaWwYPfQLgT.exe (PID: 4852)
      • K6WtD8S_9UIOZjaWwYPfQLgT.exe (PID: 756)
      • tYb8JVCRCQVwz0yiMHiE1Oak.exe (PID: 5716)
      • cmd.exe (PID: 5852)
      • WMIC.exe (PID: 4056)
      • llEIBj9dvZlfmcyBbRmUBlNB.exe (PID: 5224)
      • WXNM6CCc299CENNTXOdZfFH6.exe (PID: 8016)
      • vghSoREneeOWphSb7T71LI_s.tmp (PID: 7112)
      • vghSoREneeOWphSb7T71LI_s.exe (PID: 6868)
      • lKZcDnrfU7pj0sN9fWuChskc.exe (PID: 6988)
      • lKZcDnrfU7pj0sN9fWuChskc.tmp (PID: 6600)
      • cmd.exe (PID: 5540)
      • installer.exe (PID: 4376)
      • sToriB34ieJP5moZGEiTjEB3.exe (PID: 9136)
      • skhUn7Sqcc_uurDy1JBayMmk.exe (PID: 7572)
      • powershell.EXE (PID: 2320)
      • cRRjQiD_Bxu1hwbS2DAyqG25.exe (PID: 7820)
      • Bouderbela.exe (PID: 7948)
      • Bouderbela.exe (PID: 7832)
      • acaWMbzUfCXTkWlKZUPnciF_.exe (PID: 5944)
      • AppLaunch.exe (PID: 4620)
      • 2270810.exe (PID: 2944)
      • cmd.exe (PID: 6256)
      • installer.exe (PID: 6508)
      • cRRjQiD_Bxu1hwbS2DAyqG25.exe (PID: 5040)
      • cmd.exe (PID: 8556)
      • cmd.exe (PID: 9004)
      • random.exe (PID: 6884)
      • Wycozhaecome.exe (PID: 7168)
      • Boshohygaecae.exe (PID: 7404)
      • LzmwAqmV.exe (PID: 2196)
      • random.exe (PID: 9316)
      • RobCleanerInstll33132.exe (PID: 9532)
      • Proxyupd.exe (PID: 10076)
      • Outlab01.exe (PID: 10172)
      • jli.exe (PID: 7620)
      • inst.exe (PID: 7876)
      • setup.exe (PID: 6616)
      • askinstall25.exe (PID: 5304)
      • jli.exe (PID: 9728)
      • chrome update.exe (PID: 2748)
      • MyNotes Installation.exe (PID: 5852)
      • logger.exe (PID: 8628)
      • chrome1.exe (PID: 8020)
      • chrome.exe (PID: 3412)
      • cmd.exe (PID: 9200)
      • chrome2.exe (PID: 4236)
      • 42d8f7b8-1c86-498b-b5aa-0d0b16bb44bc.exe (PID: 4976)
      • cmd.exe (PID: 6660)
      • 5f0b7a81-e18b-43ab-89bd-6ddb21393f7f.exe (PID: 4420)
      • Setup.exe (PID: 3840)
      • askinstall35.exe (PID: 9252)
      • yangxiuying.exe (PID: 9168)
      • md9_1sjm.exe (PID: 5684)
      • setup.exe (PID: 9308)
      • yangxiuying.exe (PID: 7176)
      • Cube_WW6.exe (PID: 8076)
      • cmd.exe (PID: 4356)
      • cmd.exe (PID: 6276)
      • cmd.exe (PID: 5312)
      • installer.exe (PID: 8660)
      • askinstall42.exe (PID: 3012)
      • cmd.exe (PID: 9504)
      • 41e98be2-adf5-48f7-b0e0-0d049838b03d.exe (PID: 4468)
      • cmd.exe (PID: 5672)
      • f.exe (PID: 4180)
      • cmd.exe (PID: 9464)
      • random.exe (PID: 2472)
      • random.exe (PID: 5760)
      • cmd.exe (PID: 6972)
      • installer.exe (PID: 8684)

    • Reads the computer name

      • WinRAR.exe (PID: 1248)
      • WinRAR.exe (PID: 1584)
      • Setup.exe (PID: 3024)
      • Setup.exe (PID: 3552)
      • Q9E_G81uqw6phhYdkdj4r451.exe (PID: 4032)
      • 4c51caQPI4UqwnOZ3lxgNRTI.exe (PID: 3640)
      • 2Ld68_MTjyZ03jXmPN0v7Yu3.exe (PID: 3828)
      • RBf87uuH6_mnjcM1ZmuHmocI.exe (PID: 684)
      • EcDpXKnyihU3lPRDXQU4CQRG.exe (PID: 3416)
      • 2dAtfMfiuAk66GgckxVitW9M.exe (PID: 2700)
      • gKGi3YMnTHQFfECvW0hRvley.exe (PID: 1976)
      • PJ3k324Fy5Lk7oA7Na5U9g7O.tmp (PID: 2352)
      • pJchOMzCqCmb4ysvN1ZygsuH.tmp (PID: 1032)
      • 3XP2DSF86macEpvlIsIJBG2h.exe (PID: 3432)
      • dJW70TPBhg88Utq3oX9qOr5q.exe (PID: 2504)
      • Bouderbela.exe (PID: 3416)
      • Bouderbela.exe (PID: 1008)
      • 405104d7-1ff3-44c2-bb34-f1e1b709b759.exe (PID: 3720)
      • 4akRWxwrYAC8lcXso9jEasou.exe (PID: 3016)
      • 0e1c3664-d80e-4fbf-8a10-5a1146d7cc00.exe (PID: 2908)
      • 3252117132521171.exe (PID: 2124)
      • Wyshygyloqi.exe (PID: 3820)
      • Wyshygyloqi.exe (PID: 4060)
      • Nuholaenysu.exe (PID: 1240)
      • Xaelifaelive.exe (PID: 388)
      • foldershare.tmp (PID: 3664)
      • foldershare.tmp (PID: 3252)
      • 167e9098-496c-45c3-8e84-34db442fa9bc.exe (PID: 2512)
      • FolderShare.exe (PID: 2664)
      • df244149-12bb-493b-9189-a9beda885c87.exe (PID: 2716)
      • Install.exe (PID: 5028)
      • powershell.exe (PID: 5796)
      • hhcNvPPSmcWzO3K8ZKWDT0H9.exe (PID: 6104)
      • WMIC.exe (PID: 4076)
      • pdCklnBKzox0uAWhJ7HCXrmD.exe (PID: 2264)
      • powershell.exe (PID: 4660)
      • WMIC.exe (PID: 6012)
      • WMIC.exe (PID: 5024)
      • powershell.exe (PID: 4548)
      • powershell.exe (PID: 5036)
      • K6WtD8S_9UIOZjaWwYPfQLgT.exe (PID: 4852)
      • K6WtD8S_9UIOZjaWwYPfQLgT.exe (PID: 756)
      • tYb8JVCRCQVwz0yiMHiE1Oak.exe (PID: 5716)
      • WMIC.exe (PID: 4056)
      • WXNM6CCc299CENNTXOdZfFH6.exe (PID: 8016)
      • lKZcDnrfU7pj0sN9fWuChskc.tmp (PID: 6600)
      • installer.exe (PID: 4376)
      • dg10x768J4Xvl7eYitBXGvVA.exe (PID: 2592)
      • vghSoREneeOWphSb7T71LI_s.tmp (PID: 7112)
      • sToriB34ieJP5moZGEiTjEB3.exe (PID: 9136)
      • powershell.EXE (PID: 2320)
      • cRRjQiD_Bxu1hwbS2DAyqG25.exe (PID: 7820)
      • Bouderbela.exe (PID: 7832)
      • Bouderbela.exe (PID: 7948)
      • acaWMbzUfCXTkWlKZUPnciF_.exe (PID: 5944)
      • AppLaunch.exe (PID: 4620)
      • 2270810.exe (PID: 2944)
      • installer.exe (PID: 6508)
      • cRRjQiD_Bxu1hwbS2DAyqG25.exe (PID: 5040)
      • random.exe (PID: 9316)
      • random.exe (PID: 6884)
      • Wycozhaecome.exe (PID: 7168)
      • Boshohygaecae.exe (PID: 7404)
      • LzmwAqmV.exe (PID: 2196)
      • jli.exe (PID: 9728)
      • jli.exe (PID: 7620)
      • RobCleanerInstll33132.exe (PID: 9532)
      • askinstall25.exe (PID: 5304)
      • Proxyupd.exe (PID: 10076)
      • chrome update.exe (PID: 2748)
      • MyNotes Installation.exe (PID: 5852)
      • setup.exe (PID: 6616)
      • logger.exe (PID: 8628)
      • chrome1.exe (PID: 8020)
      • chrome.exe (PID: 3412)
      • chrome2.exe (PID: 4236)
      • 42d8f7b8-1c86-498b-b5aa-0d0b16bb44bc.exe (PID: 4976)
      • Outlab01.exe (PID: 10172)
      • 5f0b7a81-e18b-43ab-89bd-6ddb21393f7f.exe (PID: 4420)
      • Setup.exe (PID: 3840)
      • askinstall35.exe (PID: 9252)
      • yangxiuying.exe (PID: 9168)
      • yangxiuying.exe (PID: 7176)
      • Cube_WW6.exe (PID: 8076)
      • setup.exe (PID: 9308)
      • md9_1sjm.exe (PID: 5684)
      • installer.exe (PID: 8660)
      • askinstall42.exe (PID: 3012)
      • f.exe (PID: 4180)
      • 41e98be2-adf5-48f7-b0e0-0d049838b03d.exe (PID: 4468)
      • random.exe (PID: 5760)
      • random.exe (PID: 2472)
      • installer.exe (PID: 8684)

    • Application launched itself

      • WinRAR.exe (PID: 1248)
      • K6WtD8S_9UIOZjaWwYPfQLgT.exe (PID: 4852)
      • msiexec.exe (PID: 4416)
      • cRRjQiD_Bxu1hwbS2DAyqG25.exe (PID: 7820)
      • random.exe (PID: 9316)
      • jli.exe (PID: 9728)
      • yangxiuying.exe (PID: 9168)
      • random.exe (PID: 2472)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1584)
      • Setup.exe (PID: 3024)
      • ElEMd1CxhRNZeDpKLkETdrkZ.exe (PID: 2336)
      • Setup.exe (PID: 3552)
      • 4c51caQPI4UqwnOZ3lxgNRTI.exe (PID: 3640)
      • Q9E_G81uqw6phhYdkdj4r451.exe (PID: 4032)
      • PJ3k324Fy5Lk7oA7Na5U9g7O.exe (PID: 2588)
      • pJchOMzCqCmb4ysvN1ZygsuH.exe (PID: 2748)
      • 2Ld68_MTjyZ03jXmPN0v7Yu3.exe (PID: 3828)
      • PJ3k324Fy5Lk7oA7Na5U9g7O.tmp (PID: 2352)
      • pJchOMzCqCmb4ysvN1ZygsuH.tmp (PID: 1032)
      • 2dAtfMfiuAk66GgckxVitW9M.exe (PID: 2700)
      • dJW70TPBhg88Utq3oX9qOr5q.exe (PID: 2504)
      • 0e1c3664-d80e-4fbf-8a10-5a1146d7cc00.exe (PID: 2908)
      • Bouderbela.exe (PID: 3416)
      • Bouderbela.exe (PID: 1008)
      • 4akRWxwrYAC8lcXso9jEasou.exe (PID: 3016)
      • Nuholaenysu.exe (PID: 1240)
      • Xaelifaelive.exe (PID: 388)
      • df244149-12bb-493b-9189-a9beda885c87.exe (PID: 2716)
      • Install.exe (PID: 5028)
      • RobCleanerInstll33132.exe (PID: 9532)
      • foldershare.tmp (PID: 3252)
      • cRRjQiD_Bxu1hwbS2DAyqG25.exe (PID: 5040)

    • Adds / modifies Windows certificates

      • Setup.exe (PID: 3024)
      • 2Ld68_MTjyZ03jXmPN0v7Yu3.exe (PID: 3828)
      • 2dAtfMfiuAk66GgckxVitW9M.exe (PID: 2700)
      • Nuholaenysu.exe (PID: 1240)
      • chrome.exe (PID: 3412)

    • Checks for external IP

      • Setup.exe (PID: 3024)
      • Setup.exe (PID: 3552)
      • 2Ld68_MTjyZ03jXmPN0v7Yu3.exe (PID: 3828)
      • Bouderbela.exe (PID: 1008)
      • Bouderbela.exe (PID: 3416)
      • 4akRWxwrYAC8lcXso9jEasou.exe (PID: 3016)

    • Drops a file with a compile date too recent

      • Setup.exe (PID: 3552)
      • 4c51caQPI4UqwnOZ3lxgNRTI.exe (PID: 3640)
      • PJ3k324Fy5Lk7oA7Na5U9g7O.tmp (PID: 2352)
      • pJchOMzCqCmb4ysvN1ZygsuH.tmp (PID: 1032)
      • 2Ld68_MTjyZ03jXmPN0v7Yu3.exe (PID: 3828)
      • dJW70TPBhg88Utq3oX9qOr5q.exe (PID: 2504)
      • 0e1c3664-d80e-4fbf-8a10-5a1146d7cc00.exe (PID: 2908)
      • Bouderbela.exe (PID: 1008)
      • Bouderbela.exe (PID: 3416)
      • Nuholaenysu.exe (PID: 1240)
      • 4akRWxwrYAC8lcXso9jEasou.exe (PID: 3016)
      • RobCleanerInstll33132.exe (PID: 9532)
      • Xaelifaelive.exe (PID: 388)
      • cRRjQiD_Bxu1hwbS2DAyqG25.exe (PID: 5040)

    • Drops a file that was compiled in debug mode

      • Setup.exe (PID: 3552)
      • PJ3k324Fy5Lk7oA7Na5U9g7O.tmp (PID: 2352)
      • pJchOMzCqCmb4ysvN1ZygsuH.tmp (PID: 1032)
      • 2dAtfMfiuAk66GgckxVitW9M.exe (PID: 2700)
      • Bouderbela.exe (PID: 1008)
      • Bouderbela.exe (PID: 3416)
      • Nuholaenysu.exe (PID: 1240)
      • 4akRWxwrYAC8lcXso9jEasou.exe (PID: 3016)
      • Xaelifaelive.exe (PID: 388)
      • df244149-12bb-493b-9189-a9beda885c87.exe (PID: 2716)

    • Starts CMD.EXE for commands execution

      • EcDpXKnyihU3lPRDXQU4CQRG.exe (PID: 3416)
      • Nuholaenysu.exe (PID: 1240)
      • 2dAtfMfiuAk66GgckxVitW9M.exe (PID: 2700)
      • forfiles.exe (PID: 4220)
      • Install.exe (PID: 5028)
      • forfiles.exe (PID: 3124)
      • forfiles.exe (PID: 3828)
      • forfiles.exe (PID: 2492)
      • tYb8JVCRCQVwz0yiMHiE1Oak.exe (PID: 5716)
      • forfiles.exe (PID: 6704)
      • forfiles.exe (PID: 6564)
      • Xaelifaelive.exe (PID: 388)
      • setup.exe (PID: 6616)
      • setup.exe (PID: 9308)
      • Boshohygaecae.exe (PID: 7404)
      • Outlab01.exe (PID: 10172)
      • Wycozhaecome.exe (PID: 7168)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 588)
      • cmd.exe (PID: 4208)
      • cmd.exe (PID: 5852)
      • MsiExec.exe (PID: 8344)
      • cmd.exe (PID: 9200)
      • cmd.exe (PID: 4356)
      • cmd.exe (PID: 5672)

    • Drops a file with too old compile date

      • Setup.exe (PID: 3552)
      • PJ3k324Fy5Lk7oA7Na5U9g7O.exe (PID: 2588)
      • pJchOMzCqCmb4ysvN1ZygsuH.exe (PID: 2748)
      • PJ3k324Fy5Lk7oA7Na5U9g7O.tmp (PID: 2352)
      • pJchOMzCqCmb4ysvN1ZygsuH.tmp (PID: 1032)
      • Bouderbela.exe (PID: 1008)
      • Bouderbela.exe (PID: 3416)
      • 4akRWxwrYAC8lcXso9jEasou.exe (PID: 3016)
      • Nuholaenysu.exe (PID: 1240)
      • foldershare.tmp (PID: 3252)

    • Creates files in the program directory

      • 2Ld68_MTjyZ03jXmPN0v7Yu3.exe (PID: 3828)
      • 2dAtfMfiuAk66GgckxVitW9M.exe (PID: 2700)
      • WerFault.exe (PID: 3604)
      • msiexec.exe (PID: 4416)
      • Setup.exe (PID: 3840)
      • Outlab01.exe (PID: 10172)
      • svchost.exe (PID: 876)

    • Creates a directory in Program Files

      • 2Ld68_MTjyZ03jXmPN0v7Yu3.exe (PID: 3828)
      • Bouderbela.exe (PID: 1008)
      • Bouderbela.exe (PID: 3416)
      • foldershare.tmp (PID: 3664)
      • msiexec.exe (PID: 4416)
      • Setup.exe (PID: 3840)

    • Reads the Windows organization settings

      • PJ3k324Fy5Lk7oA7Na5U9g7O.tmp (PID: 2352)
      • pJchOMzCqCmb4ysvN1ZygsuH.tmp (PID: 1032)
      • foldershare.tmp (PID: 3664)
      • foldershare.tmp (PID: 3252)
      • vghSoREneeOWphSb7T71LI_s.tmp (PID: 7112)
      • lKZcDnrfU7pj0sN9fWuChskc.tmp (PID: 6600)
      • installer.exe (PID: 4376)
      • msiexec.exe (PID: 4416)

    • Reads Windows owner or organization settings

      • PJ3k324Fy5Lk7oA7Na5U9g7O.tmp (PID: 2352)
      • pJchOMzCqCmb4ysvN1ZygsuH.tmp (PID: 1032)
      • foldershare.tmp (PID: 3664)
      • foldershare.tmp (PID: 3252)
      • vghSoREneeOWphSb7T71LI_s.tmp (PID: 7112)
      • lKZcDnrfU7pj0sN9fWuChskc.tmp (PID: 6600)
      • installer.exe (PID: 4376)
      • msiexec.exe (PID: 4416)

    • Reads Environment values

      • RBf87uuH6_mnjcM1ZmuHmocI.exe (PID: 684)
      • dJW70TPBhg88Utq3oX9qOr5q.exe (PID: 2504)
      • Bouderbela.exe (PID: 1008)
      • Bouderbela.exe (PID: 3416)
      • gKGi3YMnTHQFfECvW0hRvley.exe (PID: 1976)
      • 405104d7-1ff3-44c2-bb34-f1e1b709b759.exe (PID: 3720)
      • 3XP2DSF86macEpvlIsIJBG2h.exe (PID: 3432)
      • Wyshygyloqi.exe (PID: 3820)
      • Wyshygyloqi.exe (PID: 4060)
      • 2dAtfMfiuAk66GgckxVitW9M.exe (PID: 2700)
      • Nuholaenysu.exe (PID: 1240)
      • Xaelifaelive.exe (PID: 388)
      • df244149-12bb-493b-9189-a9beda885c87.exe (PID: 2716)
      • 167e9098-496c-45c3-8e84-34db442fa9bc.exe (PID: 2512)
      • pdCklnBKzox0uAWhJ7HCXrmD.exe (PID: 2264)
      • hhcNvPPSmcWzO3K8ZKWDT0H9.exe (PID: 6104)
      • installer.exe (PID: 4376)
      • MsiExec.exe (PID: 4308)
      • MsiExec.exe (PID: 8344)
      • WXNM6CCc299CENNTXOdZfFH6.exe (PID: 8016)
      • Bouderbela.exe (PID: 7832)
      • Bouderbela.exe (PID: 7948)
      • Wycozhaecome.exe (PID: 7168)
      • Boshohygaecae.exe (PID: 7404)
      • RobCleanerInstll33132.exe (PID: 9532)
      • AppLaunch.exe (PID: 4620)
      • chrome update.exe (PID: 2748)
      • logger.exe (PID: 8628)
      • cRRjQiD_Bxu1hwbS2DAyqG25.exe (PID: 5040)
      • chrome1.exe (PID: 8020)
      • chrome.exe (PID: 3412)
      • chrome2.exe (PID: 4236)
      • Proxyupd.exe (PID: 10076)
      • 42d8f7b8-1c86-498b-b5aa-0d0b16bb44bc.exe (PID: 4976)
      • Outlab01.exe (PID: 10172)

    • Searches for installed software

      • RBf87uuH6_mnjcM1ZmuHmocI.exe (PID: 684)
      • 405104d7-1ff3-44c2-bb34-f1e1b709b759.exe (PID: 3720)
      • gKGi3YMnTHQFfECvW0hRvley.exe (PID: 1976)
      • 2dAtfMfiuAk66GgckxVitW9M.exe (PID: 2700)
      • 3XP2DSF86macEpvlIsIJBG2h.exe (PID: 3432)
      • foldershare.tmp (PID: 3252)
      • 167e9098-496c-45c3-8e84-34db442fa9bc.exe (PID: 2512)
      • hhcNvPPSmcWzO3K8ZKWDT0H9.exe (PID: 6104)
      • WXNM6CCc299CENNTXOdZfFH6.exe (PID: 8016)
      • Outlab01.exe (PID: 10172)
      • 42d8f7b8-1c86-498b-b5aa-0d0b16bb44bc.exe (PID: 4976)
      • AppLaunch.exe (PID: 4620)
      • cRRjQiD_Bxu1hwbS2DAyqG25.exe (PID: 5040)

    • Creates files in the Windows directory

      • svchost.exe (PID: 876)
      • schtasks.exe (PID: 2500)

    • Creates files in the user directory

      • 0e1c3664-d80e-4fbf-8a10-5a1146d7cc00.exe (PID: 2908)
      • installer.exe (PID: 4376)
      • df244149-12bb-493b-9189-a9beda885c87.exe (PID: 2716)
      • powershell.EXE (PID: 2320)
      • f.exe (PID: 4180)

    • Starts itself from another location

      • 0e1c3664-d80e-4fbf-8a10-5a1146d7cc00.exe (PID: 2908)
      • 49kyiytYIRHKNCaDq_Mjafgg.exe (PID: 4252)

    • Reads the cookies of Mozilla Firefox

      • RBf87uuH6_mnjcM1ZmuHmocI.exe (PID: 684)
      • 3XP2DSF86macEpvlIsIJBG2h.exe (PID: 3432)
      • gKGi3YMnTHQFfECvW0hRvley.exe (PID: 1976)
      • hhcNvPPSmcWzO3K8ZKWDT0H9.exe (PID: 6104)
      • 167e9098-496c-45c3-8e84-34db442fa9bc.exe (PID: 2512)
      • WXNM6CCc299CENNTXOdZfFH6.exe (PID: 8016)
      • AppLaunch.exe (PID: 4620)

    • Reads the cookies of Google Chrome

      • RBf87uuH6_mnjcM1ZmuHmocI.exe (PID: 684)
      • 3XP2DSF86macEpvlIsIJBG2h.exe (PID: 3432)
      • gKGi3YMnTHQFfECvW0hRvley.exe (PID: 1976)
      • hhcNvPPSmcWzO3K8ZKWDT0H9.exe (PID: 6104)
      • 167e9098-496c-45c3-8e84-34db442fa9bc.exe (PID: 2512)
      • WXNM6CCc299CENNTXOdZfFH6.exe (PID: 8016)
      • AppLaunch.exe (PID: 4620)

    • Reads CPU info

      • 2dAtfMfiuAk66GgckxVitW9M.exe (PID: 2700)
      • Outlab01.exe (PID: 10172)

    • Starts Internet Explorer

      • Wyshygyloqi.exe (PID: 3820)
      • Wyshygyloqi.exe (PID: 4060)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3984)
      • iexplore.exe (PID: 1684)

    • Starts CMD.EXE for self-deleting

      • 2dAtfMfiuAk66GgckxVitW9M.exe (PID: 2700)
      • Outlab01.exe (PID: 10172)

    • Executes PowerShell scripts

      • cmd.exe (PID: 5624)
      • cmd.exe (PID: 4848)
      • cmd.exe (PID: 4572)
      • cmd.exe (PID: 5296)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 6908)
      • cmd.exe (PID: 7200)

    • Executed as Windows Service

      • msiexec.exe (PID: 4416)

    • Starts Microsoft Installer

      • installer.exe (PID: 4376)

    • Executed via Task Scheduler

      • powershell.EXE (PID: 2320)

    • PowerShell script executed

      • powershell.EXE (PID: 2320)

    • Reads the date of Windows installation

      • powershell.EXE (PID: 2320)

    • Executed via WMI

      • rundll32.exe (PID: 5596)
      • rundll32.exe (PID: 4380)
      • rundll32.exe (PID: 7044)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 4416)
      • Setup.exe (PID: 3840)

    • Reads default file associations for system extensions

      • 2270810.exe (PID: 2944)

    • Uses RUNDLL32.EXE to load library

      • control.exe (PID: 520)

    • Removes files from Windows directory

      • svchost.exe (PID: 876)

    • Executes application which crashes

      • chrome2.exe (PID: 4236)
      • chrome1.exe (PID: 8020)

  • INFO

    • Reads settings of System Certificates

      • Setup.exe (PID: 3024)
      • Setup.exe (PID: 3552)
      • 2Ld68_MTjyZ03jXmPN0v7Yu3.exe (PID: 3828)
      • 2dAtfMfiuAk66GgckxVitW9M.exe (PID: 2700)
      • dJW70TPBhg88Utq3oX9qOr5q.exe (PID: 2504)
      • Bouderbela.exe (PID: 1008)
      • Bouderbela.exe (PID: 3416)
      • 4akRWxwrYAC8lcXso9jEasou.exe (PID: 3016)
      • Wyshygyloqi.exe (PID: 4060)
      • Wyshygyloqi.exe (PID: 3820)
      • 405104d7-1ff3-44c2-bb34-f1e1b709b759.exe (PID: 3720)
      • Xaelifaelive.exe (PID: 388)
      • Nuholaenysu.exe (PID: 1240)
      • iexplore.exe (PID: 3984)
      • iexplore.exe (PID: 1684)
      • iexplore.exe (PID: 572)
      • iexplore.exe (PID: 2300)
      • 167e9098-496c-45c3-8e84-34db442fa9bc.exe (PID: 2512)
      • pdCklnBKzox0uAWhJ7HCXrmD.exe (PID: 2264)
      • K6WtD8S_9UIOZjaWwYPfQLgT.exe (PID: 756)
      • df244149-12bb-493b-9189-a9beda885c87.exe (PID: 2716)
      • installer.exe (PID: 4376)
      • msiexec.exe (PID: 4416)
      • MsiExec.exe (PID: 8344)
      • Bouderbela.exe (PID: 7832)
      • Bouderbela.exe (PID: 7948)
      • random.exe (PID: 6884)
      • Boshohygaecae.exe (PID: 7404)
      • Wycozhaecome.exe (PID: 7168)
      • RobCleanerInstll33132.exe (PID: 9532)
      • askinstall25.exe (PID: 5304)
      • jli.exe (PID: 7620)
      • chrome update.exe (PID: 2748)
      • Outlab01.exe (PID: 10172)
      • logger.exe (PID: 8628)
      • chrome.exe (PID: 3412)
      • chrome2.exe (PID: 4236)
      • MyNotes Installation.exe (PID: 5852)
      • chrome1.exe (PID: 8020)
      • yangxiuying.exe (PID: 7176)
      • Cube_WW6.exe (PID: 8076)
      • askinstall42.exe (PID: 3012)
      • random.exe (PID: 5760)
      • f.exe (PID: 4180)
      • 42d8f7b8-1c86-498b-b5aa-0d0b16bb44bc.exe (PID: 4976)

    • Checks Windows Trust Settings

      • Setup.exe (PID: 3024)
      • Setup.exe (PID: 3552)
      • 2dAtfMfiuAk66GgckxVitW9M.exe (PID: 2700)
      • 4akRWxwrYAC8lcXso9jEasou.exe (PID: 3016)
      • iexplore.exe (PID: 3984)
      • iexplore.exe (PID: 1684)
      • iexplore.exe (PID: 572)
      • iexplore.exe (PID: 2300)
      • powershell.exe (PID: 5796)
      • powershell.exe (PID: 4660)
      • powershell.exe (PID: 4548)
      • powershell.exe (PID: 5036)
      • installer.exe (PID: 4376)
      • msiexec.exe (PID: 4416)
      • MsiExec.exe (PID: 8344)
      • askinstall25.exe (PID: 5304)
      • Outlab01.exe (PID: 10172)
      • MyNotes Installation.exe (PID: 5852)
      • powershell.EXE (PID: 2320)
      • Cube_WW6.exe (PID: 8076)
      • askinstall42.exe (PID: 3012)
      • f.exe (PID: 4180)

    • Checks supported languages

      • taskkill.exe (PID: 2248)
      • schtasks.exe (PID: 1952)
      • schtasks.exe (PID: 584)
      • svchost.exe (PID: 876)
      • WerFault.exe (PID: 3604)
      • iexplore.exe (PID: 2300)
      • iexplore.exe (PID: 572)
      • iexplore.exe (PID: 1684)
      • iexplore.exe (PID: 3984)
      • taskkill.exe (PID: 4720)
      • timeout.exe (PID: 5168)
      • forfiles.exe (PID: 4220)
      • cmd.exe (PID: 5624)
      • cmd.exe (PID: 4848)
      • forfiles.exe (PID: 3124)
      • forfiles.exe (PID: 3828)
      • cmd.exe (PID: 4572)
      • forfiles.exe (PID: 2492)
      • cmd.exe (PID: 5296)
      • cmd.exe (PID: 6908)
      • forfiles.exe (PID: 6564)
      • forfiles.exe (PID: 6704)
      • reg.exe (PID: 7008)
      • cmd.exe (PID: 7200)
      • reg.exe (PID: 7292)
      • taskkill.exe (PID: 4444)
      • msiexec.exe (PID: 4416)
      • MsiExec.exe (PID: 4308)
      • msiexec.exe (PID: 6532)
      • MsiExec.exe (PID: 7132)
      • schtasks.exe (PID: 6704)
      • schtasks.exe (PID: 5280)
      • MsiExec.exe (PID: 8344)
      • taskkill.exe (PID: 8716)
      • rundll32.exe (PID: 5596)
      • regsvr32.exe (PID: 9028)
      • control.exe (PID: 520)
      • rundll32.exe (PID: 5928)
      • taskkill.exe (PID: 6976)
      • schtasks.exe (PID: 9948)
      • rundll32.exe (PID: 4380)
      • ntvdm.exe (PID: 5988)
      • schtasks.exe (PID: 2500)
      • ntvdm.exe (PID: 7116)
      • taskkill.exe (PID: 8208)
      • rundll32.exe (PID: 7044)
      • gpupdate.exe (PID: 3172)
      • taskkill.exe (PID: 6036)
      • timeout.exe (PID: 7468)

    • Reads the computer name

      • taskkill.exe (PID: 2248)
      • schtasks.exe (PID: 1952)
      • schtasks.exe (PID: 584)
      • WerFault.exe (PID: 3604)
      • iexplore.exe (PID: 2300)
      • iexplore.exe (PID: 572)
      • iexplore.exe (PID: 3984)
      • iexplore.exe (PID: 1684)
      • taskkill.exe (PID: 4720)
      • taskkill.exe (PID: 4444)
      • msiexec.exe (PID: 4416)
      • msiexec.exe (PID: 6532)
      • MsiExec.exe (PID: 4308)
      • taskkill.exe (PID: 8716)
      • MsiExec.exe (PID: 7132)
      • schtasks.exe (PID: 6704)
      • MsiExec.exe (PID: 8344)
      • schtasks.exe (PID: 5280)
      • rundll32.exe (PID: 5596)
      • control.exe (PID: 520)
      • taskkill.exe (PID: 6976)
      • schtasks.exe (PID: 9948)
      • schtasks.exe (PID: 2500)
      • rundll32.exe (PID: 4380)
      • taskkill.exe (PID: 8208)
      • rundll32.exe (PID: 7044)
      • gpupdate.exe (PID: 3172)
      • taskkill.exe (PID: 6036)

    • Application was dropped or rewritten from another process

      • Bouderbela.exe (PID: 3416)
      • Bouderbela.exe (PID: 1008)
      • pJchOMzCqCmb4ysvN1ZygsuH.tmp (PID: 1032)
      • PJ3k324Fy5Lk7oA7Na5U9g7O.tmp (PID: 2352)
      • vghSoREneeOWphSb7T71LI_s.tmp (PID: 7112)
      • lKZcDnrfU7pj0sN9fWuChskc.tmp (PID: 6600)
      • Bouderbela.exe (PID: 7832)
      • Bouderbela.exe (PID: 7948)

    • Loads dropped or rewritten executable

      • pJchOMzCqCmb4ysvN1ZygsuH.tmp (PID: 1032)
      • PJ3k324Fy5Lk7oA7Na5U9g7O.tmp (PID: 2352)
      • foldershare.tmp (PID: 3664)
      • foldershare.tmp (PID: 3252)
      • vghSoREneeOWphSb7T71LI_s.tmp (PID: 7112)
      • lKZcDnrfU7pj0sN9fWuChskc.tmp (PID: 6600)

    • Creates files in the program directory

      • Bouderbela.exe (PID: 1008)
      • Bouderbela.exe (PID: 3416)
      • foldershare.tmp (PID: 3664)
      • foldershare.tmp (PID: 3252)

    • Changes internet zones settings

      • iexplore.exe (PID: 2300)
      • iexplore.exe (PID: 572)

    • Application launched itself

      • iexplore.exe (PID: 2300)
      • iexplore.exe (PID: 572)

    • Creates a software uninstall entry

      • foldershare.tmp (PID: 3664)

    • Creates files in the user directory

      • iexplore.exe (PID: 3984)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3984)
      • iexplore.exe (PID: 1684)

    • Dropped object may contain Bitcoin addresses

      • 4akRWxwrYAC8lcXso9jEasou.exe (PID: 3016)

    • Check for Java to be installed

      • MsiExec.exe (PID: 4308)
      • MsiExec.exe (PID: 8344)

    • Reads Microsoft Office registry keys

      • MsiExec.exe (PID: 4308)
      • MsiExec.exe (PID: 8344)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: Setup/
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2021:09:11 22:15:01
ZipCompression: None
ZipBitFlag: -
ZipRequiredVersion: 10
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
280
Monitored processes
180
Malicious processes
57
Suspicious processes
19

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start download and start download and start inject winrar.exe no specs winrar.exe setup.exe no specs setup.exe elemd1cxhrnzedpklketdrkz.exe setup.exe no specs setup.exe ef0crpgrczaggzghribczsm_.exe no specs 4c51caqpi4uqwnoz3lxgnrti.exe q9e_g81uqw6phhydkdj4r451.exe 2ld68_mtjyz03jxmpn0v7yu3.exe #REDLINE rbf87uuh6_mnjcm1zmuhmoci.exe k6uhjrykzwzgdajgc9h5rkdw.exe ecdpxknyihu3lprdxqu4cqrg.exe #VIDAR 2datfmfiuak66ggckxvitw9m.exe cmd.exe no specs taskkill.exe no specs pj3k324fy5lk7oa7na5u9g7o.exe pjchomzcqcmb4ysvn1zygsuh.exe #REDLINE gkgi3ymnthqffecvw0hrvley.exe pjchomzcqcmb4ysvn1zygsuh.tmp pj3k324fy5lk7oa7na5u9g7o.tmp #REDLINE 3xp2dsf86macepvlisijbg2h.exe djw70tpbhg88utq3ox9qor5q.exe bouderbela.exe bouderbela.exe 4akrwxwryac8lcxso9jeasou.exe schtasks.exe no specs schtasks.exe no specs 405104d7-1ff3-44c2-bb34-f1e1b709b759.exe 0e1c3664-d80e-4fbf-8a10-5a1146d7cc00.exe 3252117132521171.exe no specs wyshygyloqi.exe wyshygyloqi.exe xaelifaelive.exe nuholaenysu.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe foldershare.exe no specs foldershare.exe no specs foldershare.tmp no specs foldershare.tmp #REDLINE 167e9098-496c-45c3-8e84-34db442fa9bc.exe foldershare.exe no specs ezawmuc9ejny4ujw5vfffcle.exe no specs df244149-12bb-493b-9189-a9beda885c87.exe cmd.exe no specs dg10x768j4xvl7eyitbxgvva.exe cmd.exe no specs 49kyiytyirhkncadq_mjafgg.exe no specs taskkill.exe no specs timeout.exe no specs install.exe no specs install.exe cmd.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs #REDLINE hhcnvppsmcwzo3k8zkwdt0h9.exe wmic.exe no specs forfiles.exe no specs pdcklnbkzox0uawhj7hcxrmd.exe cmd.exe no specs powershell.exe no specs wmic.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs wmic.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs k6wtd8s_9uiozjawwypfqlgt.exe no specs wmic.exe no specs k6wtd8s_9uiozjawwypfqlgt.exe lleibj9dvzlfmcybbrmublnb.exe tyb8jvcrcqvwz0yimhie1oak.exe werfault.exe no specs cmd.exe no specs taskkill.exe no specs forfiles.exe no specs forfiles.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs #REDLINE wxnm6ccc299cenntxodzffh6.exe vghsoreneeowphsb7t71li_s.exe no specs lkzcdnrfu7pj0sn9fwuchskc.exe no specs vghsoreneeowphsb7t71li_s.tmp lkzcdnrfu7pj0sn9fwuchskc.tmp cmd.exe no specs installer.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe taskkill.exe no specs storib34iejp5mozgeitjeb3.exe no specs msiexec.exe no specs schtasks.exe no specs schtasks.exe no specs powershell.exe no specs rundll32.exe no specs skhun7sqcc_uurdy1jbaymmk.exe no specs crrjqid_bxu1hwbs2dayqg25.exe no specs bouderbela.exe bouderbela.exe #REDLINE crrjqid_bxu1hwbs2dayqg25.exe acawmbzufcxtkwlkzupncif_.exe no specs #REDLINE applaunch.exe 2270810.exe no specs cmd.exe no specs installer.exe no specs cmd.exe no specs cmd.exe no specs regsvr32.exe no specs random.exe no specs random.exe wycozhaecome.exe boshohygaecae.exe lzmwaqmv.exe control.exe no specs rundll32.exe no specs robcleanerinstll33132.exe jli.exe no specs proxyupd.exe #VIDAR outlab01.exe jli.exe inst.exe no specs setup.exe askinstall25.exe chrome update.exe mynotes installation.exe logger.exe cmd.exe no specs chrome.exe chrome1.exe taskkill.exe no specs chrome2.exe 42d8f7b8-1c86-498b-b5aa-0d0b16bb44bc.exe 5f0b7a81-e18b-43ab-89bd-6ddb21393f7f.exe no specs schtasks.exe no specs cmd.exe setup.exe rundll32.exe no specs ntvdm.exe schtasks.exe no specs md9_1sjm.exe yangxiuying.exe no specs askinstall35.exe no specs setup.exe cube_ww6.exe yangxiuying.exe ntvdm.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs taskkill.exe no specs askinstall42.exe installer.exe no specs rundll32.exe no specs cmd.exe no specs svchost.exe f.exe cmd.exe no specs #REDLINE 41e98be2-adf5-48f7-b0e0-0d049838b03d.exe taskkill.exe no specs gpupdate.exe no specs cmd.exe no specs random.exe no specs random.exe timeout.exe no specs cmd.exe no specs installer.exe no specs cmd.exe no specs 1.exe no specs rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
388"C:\Users\admin\AppData\Local\Temp\13-2405d-0b8-7bda3-8007e10b75c5a\Xaelifaelive.exe" C:\Users\admin\AppData\Local\Temp\13-2405d-0b8-7bda3-8007e10b75c5a\Xaelifaelive.exe
Bouderbela.exe
User:
admin
Company:
degla87760_art_
Integrity Level:
HIGH
Description:
degla87760_art_
Exit code:
0
Version:
2.2.1.2
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\13-2405d-0b8-7bda3-8007e10b75c5a\xaelifaelive.exe
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\shlwapi.dll
456"C:\Program Files\Windows Portable Devices\BHIKKHODGN\foldershare.exe" /VERYSILENTC:\Program Files\Windows Portable Devices\BHIKKHODGN\foldershare.exe—Bouderbela.exe
User:
admin
Company:
FolderShare
Integrity Level:
HIGH
Description:
FolderShare Setup
Exit code:
0
Version:
Modules
Images
c:\program files\windows portable devices\bhikkhodgn\foldershare.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
492"C:\Program Files\Microsoft\WYVFZKZWEZ\foldershare.exe" /VERYSILENTC:\Program Files\Microsoft\WYVFZKZWEZ\foldershare.exe—Bouderbela.exe
User:
admin
Company:
FolderShare
Integrity Level:
HIGH
Description:
FolderShare Setup
Exit code:
0
Version:
Modules
Images
c:\program files\microsoft\wyvfzkzwez\foldershare.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
520"C:\Windows\System32\control.exe" "C:\Users\admin\AppData\Local\Temp\EdRGQQA5.cPl", C:\Windows\System32\control.exe—2270810.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Control Panel
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\control.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
572"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6C:\Program Files\Internet Explorer\iexplore.exe
Wyshygyloqi.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\iertutil.dll
584schtasks /create /f /RU "admin" /tr "C:\Program Files\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHESTC:\Windows\system32\schtasks.exe—2Ld68_MTjyZ03jXmPN0v7Yu3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
588"C:\Windows\System32\cmd.exe" /c taskkill /im "EcDpXKnyihU3lPRDXQU4CQRG.exe" /f & erase "C:\Users\admin\Pictures\Adobe Films\EcDpXKnyihU3lPRDXQU4CQRG.exe" & exitC:\Windows\System32\cmd.exe—EcDpXKnyihU3lPRDXQU4CQRG.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
684"C:\Users\admin\Pictures\Adobe Films\RBf87uuH6_mnjcM1ZmuHmocI.exe" C:\Users\admin\Pictures\Adobe Films\RBf87uuH6_mnjcM1ZmuHmocI.exe
Setup.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\pictures\adobe films\rbf87uuh6_mnjcm1zmuhmoci.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
756"C:\Users\admin\Pictures\Adobe Films\K6WtD8S_9UIOZjaWwYPfQLgT.exe" -uC:\Users\admin\Pictures\Adobe Films\K6WtD8S_9UIOZjaWwYPfQLgT.exe
K6WtD8S_9UIOZjaWwYPfQLgT.exe
User:
admin
Company:
initool
Integrity Level:
HIGH
Description:
initool
Exit code:
0
Version:
1, 0, 0, 1
Modules
Images
c:\users\admin\pictures\adobe films\k6wtd8s_9uiozjawwypfqlgt.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
876C:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
224 416
Read events
221 878
Write events
2 481
Delete events
57

Modification events

(PID) Process:(1248) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1248) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1248) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1248) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(1248) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(1248) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\EaseUS+Partition+Master+v16.5+(x64)+WinPE+Bootable+ISO.zip
(PID) Process:(1248) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1248) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1248) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1248) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
92
Suspicious files
81
Text files
78
Unknown types
47

Dropped files

PID
Process
Filename
Type
1248WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb1248.17429\Setup.zipcompressed
MD5:—
SHA256:—
1584WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb1584.17870\Setup.exeexecutable
MD5:—
SHA256:—
3024Setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
3024Setup.exeC:\Users\admin\Documents\T9aZunTSaNJLBVfIkgF5mtQo.dllbinary
MD5:—
SHA256:—
3024Setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\NiceProcessX32[1].bmpexecutable
MD5:—
SHA256:—
3024Setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27der
MD5:—
SHA256:—
3024Setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:—
SHA256:—
876svchost.exeC:\Windows\appcompat\programs\RecentFileCache.bcftxt
MD5:—
SHA256:—
3552Setup.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\PL_Client[1].bmpbinary
MD5:—
SHA256:—
3024Setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_811809BE12AFE5624F00A379DF595152der
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
236
TCP/UDP connections
512
DNS requests
156
Threats
628

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3024
Setup.exe
GET
—
45.133.1.107:80
http://45.133.1.107/server.txt
unknown
—
—
malicious
3552
Setup.exe
GET
—
45.133.1.107:80
http://45.133.1.107/server.txt
unknown
—
—
malicious
3024
Setup.exe
HEAD
200
45.144.225.57:80
http://45.144.225.57/download/NiceProcessX32.bmp
unknown
—
—
malicious
3552
Setup.exe
HEAD
200
45.144.225.57:80
http://45.144.225.57/download/NiceProcessX32.bmp
unknown
—
—
malicious
3552
Setup.exe
HEAD
200
212.193.30.29:80
http://212.193.30.29/download/Service.bmp
RU
—
—
malicious
3552
Setup.exe
HEAD
404
212.193.30.29:80
http://212.193.30.29/WW/file1.exe
RU
—
—
malicious
3024
Setup.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
3024
Setup.exe
GET
200
45.144.225.57:80
http://45.144.225.57/download/NiceProcessX32.bmp
unknown
executable
259 Kb
malicious
3024
Setup.exe
POST
200
2.56.59.42:80
http://2.56.59.42/base/api/getData.php
unknown
text
5.38 Kb
malicious
3024
Setup.exe
POST
200
2.56.59.42:80
http://2.56.59.42/base/api/getData.php
unknown
text
108 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3024
Setup.exe
45.133.1.107:80
—
—
—
malicious
3024
Setup.exe
104.23.98.190:443
pastebin.com
Cloudflare Inc
US
malicious
3024
Setup.exe
162.159.130.233:80
cdn.discordapp.com
Cloudflare Inc
—
shared
3024
Setup.exe
2.56.59.42:80
—
—
—
malicious
3024
Setup.exe
162.159.130.233:443
cdn.discordapp.com
Cloudflare Inc
—
shared
3024
Setup.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3024
Setup.exe
45.144.225.57:80
—
—
—
malicious
3552
Setup.exe
45.133.1.107:80
—
—
—
malicious
3024
Setup.exe
212.193.30.29:80
—
—
RU
malicious
3024
Setup.exe
52.219.170.22:80
ellissa.s3.eu-central-1.amazonaws.com
—
US
unknown

DNS requests

Domain
IP
Reputation
pastebin.com
  • 104.23.98.190
  • 104.23.99.190
malicious
cdn.discordapp.com
  • 162.159.130.233
  • 162.159.135.233
  • 162.159.129.233
  • 162.159.134.233
  • 162.159.133.233
shared
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
ipinfo.io
  • 34.117.59.81
shared
ellissa.s3.eu-central-1.amazonaws.com
  • 52.219.170.22
  • 52.219.72.245
  • 52.219.47.152
  • 52.219.169.102
malicious
stylesheet.faseaegasdfase.com
  • 85.209.157.230
malicious
jjjjjjjjjjjj.s3.eu-central-1.amazonaws.com
  • 52.219.169.114
  • 52.219.170.114
  • 52.219.47.45
unknown
tg8.cllgxx.com
  • 85.209.157.230
malicious
baanrabiengfah.com
  • 91.224.22.193
suspicious

Threats

PID
Process
Class
Message
3024
Setup.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
3024
Setup.exe
Generic Protocol Command Decode
SURICATA Applayer Mismatch protocol both directions
3024
Setup.exe
A Network Trojan was detected
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
3024
Setup.exe
Potential Corporate Privacy Violation
ET POLICY Possible External IP Lookup SSL Cert Observed (ipinfo.io)
3024
Setup.exe
A Network Trojan was detected
ET TROJAN Win32/Unk.HRESQ! MultiDownloader Checkin
3024
Setup.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3024
Setup.exe
Potentially Bad Traffic
ET INFO SUSPICIOUS Dotted Quad Host MZ Response
3024
Setup.exe
A Network Trojan was detected
AV POLICY EXE or DLL in HTTP Image Content Inbound - Likely Malicious
3024
Setup.exe
A Network Trojan was detected
ET TROJAN Win32/Unk.HRESQ! MultiDownloader Checkin
3024
Setup.exe
A Network Trojan was detected
ET TROJAN Win32/Unk.HRESQ! MultiDownloader Checkin
328 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
EaseUS+Partition+Master+v16.5+(x64)+WinPE+Bootable+ISO.zip