File name:

bomb.exe

Full analysis: https://app.any.run/tasks/138269c6-93a1-4e97-a4e6-5a7d347051da
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Analysis date: June 12, 2024, 21:40:39
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
phorpiex
miner
smtp
exfiltration
stealer
discord
opendir
stealc
risepro
evasion
amadey
botnet
agenttesla
redline
meta
metastealer
adware
neoreklami
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

55DBA6E7AA4E8CC73415F4E3F9F6BDAE

SHA1:

87C9F29D58F57A5E025061D389BE2655EE879D5D

SHA256:

3CEA805F1396DF15BDBCD4317388A046A41A6079DBA04576A58BA7B2C812338A

SSDEEP:

192:HLmmmmlmtYz0wZick7pDMj4GbCrMz+MCZLa7HhdSbwxz1OLU87glpp/bI6J4yfm4:pmi7k7pMiLLaLhM6OLU870NJqoI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    • Drops the executable file immediately after the start

      • bomb.exe (PID: 3956)
      • http185.215.113.66pei.exe.exe (PID: 820)
      • http185.215.113.66newtpp.exe.exe (PID: 748)
      • httpsraw.githubusercontent.comsirvivor32sirvivormainLukeJazz.exe.exe (PID: 2972)
      • cmd.exe (PID: 2956)
      • Ul.pif (PID: 3424)
      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
      • 1389215329.exe (PID: 1832)
      • http147.45.47.81conhost.exe.exe (PID: 1440)
      • httpsraw.githubusercontent.comr1antxxxmainUcxnbz.exe.exe (PID: 2224)
      • 6AyaE0gmxvQm8WQqeKRC.exe (PID: 5048)
      • explortu.exe (PID: 5760)
      • httpupdate.cg100iii.comcg100Update.exe.exe (PID: 2720)
      • Ul.pif (PID: 5524)
      • 1e207f0b58.exe (PID: 4860)
      • axplong.exe (PID: 3052)
      • loader-1002.exe (PID: 1960)
      • Update.exe (PID: 4524)
      • NewR.exe (PID: 4300)
      • 8fc809.exe (PID: 4940)
      • http77.91.77.81lendaudiodrive.exe.exe (PID: 992)
      • http77.91.77.81lendaudiodrive.exe.exe (PID: 2044)
      • setup.exe (PID: 1796)
      • Install.exe (PID: 336)
      • Dctooux.exe (PID: 2764)
      • Install.exe (PID: 5424)
      • CpYtKIq.exe (PID: 5692)
      • NNZNoGq.exe (PID: 6024)
    • Changes the autorun value in the registry

      • http185.215.113.66newtpp.exe.exe (PID: 748)
      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
      • 1389215329.exe (PID: 1832)
      • Ul.pif (PID: 5524)
      • explortu.exe (PID: 5760)
      • NewR.exe (PID: 4300)
      • http77.91.77.81lendaudiodrive.exe.exe (PID: 992)
    • Changes appearance of the Explorer extensions

      • sysmablsvr.exe (PID: 660)
    • Changes the Windows auto-update feature

      • sysmablsvr.exe (PID: 660)
    • Changes Security Center notification settings

      • sysmablsvr.exe (PID: 660)
    • Connects to the CnC server

      • sysmablsvr.exe (PID: 660)
      • http185.172.128.159timeSync.exe.exe (PID: 3440)
      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
      • http185.172.128.159timeSync.exe.exe (PID: 2348)
      • explortu.exe (PID: 5760)
      • Ul.pif (PID: 5524)
      • axplong.exe (PID: 3052)
      • redline123123.exe (PID: 4436)
      • NewR.exe (PID: 4300)
    • Actions looks like stealing of personal data

      • RegSvcs.exe (PID: 848)
      • redline123123.exe (PID: 4436)
      • rundll32.exe (PID: 4920)
      • rundll32.exe (PID: 6000)
      • CpYtKIq.exe (PID: 5692)
      • rundll32.exe (PID: 4076)
      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
      • NNZNoGq.exe (PID: 6024)
      • Ul.pif (PID: 5524)
    • Steals credentials from Web Browsers

      • RegSvcs.exe (PID: 848)
      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
      • Ul.pif (PID: 5524)
      • redline123123.exe (PID: 4436)
      • rundll32.exe (PID: 4920)
      • rundll32.exe (PID: 6000)
      • rundll32.exe (PID: 4076)
      • NNZNoGq.exe (PID: 6024)
    • Antivirus name has been found in the command line (generic signature)

      • findstr.exe (PID: 2756)
      • findstr.exe (PID: 3144)
    • Create files in the Startup directory

      • cmd.exe (PID: 3536)
      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
    • STEALC has been detected (SURICATA)

      • http185.172.128.159timeSync.exe.exe (PID: 3440)
      • http185.172.128.159timeSync.exe.exe (PID: 2348)
    • Uses Task Scheduler to run other applications

      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
      • Ul.pif (PID: 5524)
      • NewR.exe (PID: 4300)
      • Install.exe (PID: 5424)
      • CpYtKIq.exe (PID: 5692)
      • NNZNoGq.exe (PID: 6024)
    • Uses Task Scheduler to autorun other applications

      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
      • Ul.pif (PID: 5524)
      • NNZNoGq.exe (PID: 6024)
    • RISEPRO has been detected (SURICATA)

      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
      • j3BulqBW6IWYjU8Jp5_e.exe (PID: 3264)
      • Ul.pif (PID: 5524)
      • 3013f75976.exe (PID: 5096)
    • Steals credentials

      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
      • Ul.pif (PID: 5524)
      • rundll32.exe (PID: 4920)
      • rundll32.exe (PID: 6000)
      • rundll32.exe (PID: 4076)
    • RISEPRO has been detected (YARA)

      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
      • j3BulqBW6IWYjU8Jp5_e.exe (PID: 3264)
      • Ul.pif (PID: 5524)
      • 3013f75976.exe (PID: 5096)
    • PHORPIEX has been detected (SURICATA)

      • winblrsnrcs.exe (PID: 1248)
    • AGENTTESLA has been detected (YARA)

      • RegSvcs.exe (PID: 848)
    • AMADEY has been detected (YARA)

      • explortu.exe (PID: 5760)
      • axplong.exe (PID: 3052)
      • NewR.exe (PID: 4300)
      • Dctooux.exe (PID: 2764)
      • rundll32.exe (PID: 5492)
      • rundll32.exe (PID: 2252)
      • rundll32.exe (PID: 3844)
    • AMADEY has been detected (SURICATA)

      • explortu.exe (PID: 5760)
      • axplong.exe (PID: 3052)
      • NewR.exe (PID: 4300)
      • Dctooux.exe (PID: 2764)
    • Amadey has been detected

      • NewR.exe (PID: 4300)
      • NewR.exe (PID: 2252)
      • NewR.exe (PID: 5736)
      • NewR.exe (PID: 6384)
    • REDLINE has been detected (SURICATA)

      • redline123123.exe (PID: 4436)
    • METASTEALER has been detected (SURICATA)

      • redline123123.exe (PID: 4436)
    • REDLINE has been detected (YARA)

      • redline123123.exe (PID: 4436)
      • gold.exe (PID: 5520)
      • upd.exe (PID: 3840)
    • Run PowerShell with an invisible window

      • powershell.exe (PID: 4076)
      • powershell.exe (PID: 2360)
      • powershell.EXE (PID: 5244)
      • powershell.exe (PID: 124)
      • powershell.exe (PID: 5728)
      • powershell.exe (PID: 1652)
      • powershell.exe (PID: 3620)
      • powershell.exe (PID: 5628)
    • Uses WMIC.EXE to add exclusions to the Windows Defender

      • powershell.exe (PID: 2360)
      • powershell.exe (PID: 5728)
      • powershell.exe (PID: 3620)
      • powershell.exe (PID: 5628)
    • Creates a writable file in the system directory

      • powershell.exe (PID: 124)
      • NNZNoGq.exe (PID: 6024)
    • Modifies exclusions in Windows Defender

      • reg.exe (PID: 1128)
      • reg.exe (PID: 904)
      • reg.exe (PID: 4804)
      • reg.exe (PID: 2336)
      • reg.exe (PID: 2556)
      • reg.exe (PID: 5736)
      • reg.exe (PID: 5060)
      • reg.exe (PID: 2524)
      • reg.exe (PID: 1008)
      • reg.exe (PID: 1804)
      • reg.exe (PID: 588)
    • Modifies files in the Chrome extension folder

      • NNZNoGq.exe (PID: 6024)
    • NEOREKLAMI has been detected (SURICATA)

      • rundll32.exe (PID: 5276)
  • SUSPICIOUS

    • Reads settings of System Certificates

      • bomb.exe (PID: 3956)
      • RegSvcs.exe (PID: 848)
      • httpsraw.githubusercontent.comr1antxxxmainNngraprczwe.exe.exe (PID: 3808)
      • httpsraw.githubusercontent.comr1antxxxmainUcxnbz.exe.exe (PID: 3664)
      • httpsraw.githubusercontent.comr1antxxxmainUcxnbz.exe.exe (PID: 2224)
      • httpsraw.githubusercontent.comr1antxxxmainNngraprczwe.exe.exe (PID: 2652)
      • j3BulqBW6IWYjU8Jp5_e.exe (PID: 3264)
      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
      • Ul.pif (PID: 5524)
      • 3013f75976.exe (PID: 5096)
      • NewR.exe (PID: 4300)
      • loader-1002.exe (PID: 1960)
      • MicrosoftEdgeUpdate.exe (PID: 5824)
    • Executable content was dropped or overwritten

      • bomb.exe (PID: 3956)
      • http185.215.113.66pei.exe.exe (PID: 820)
      • http185.215.113.66newtpp.exe.exe (PID: 748)
      • cmd.exe (PID: 2956)
      • Ul.pif (PID: 3424)
      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
      • http147.45.47.81conhost.exe.exe (PID: 1440)
      • 1389215329.exe (PID: 1832)
      • httpsraw.githubusercontent.comr1antxxxmainUcxnbz.exe.exe (PID: 2224)
      • 6AyaE0gmxvQm8WQqeKRC.exe (PID: 5048)
      • httpupdate.cg100iii.comcg100Update.exe.exe (PID: 2720)
      • explortu.exe (PID: 5760)
      • Ul.pif (PID: 5524)
      • 1e207f0b58.exe (PID: 4860)
      • Update.exe (PID: 4524)
      • axplong.exe (PID: 3052)
      • NewR.exe (PID: 4300)
      • loader-1002.exe (PID: 1960)
      • 8fc809.exe (PID: 4940)
      • http77.91.77.81lendaudiodrive.exe.exe (PID: 992)
      • http77.91.77.81lendaudiodrive.exe.exe (PID: 2044)
      • Install.exe (PID: 336)
      • setup.exe (PID: 1796)
      • Dctooux.exe (PID: 2764)
      • Install.exe (PID: 5424)
      • CpYtKIq.exe (PID: 5692)
      • NNZNoGq.exe (PID: 6024)
    • Reads the Internet Settings

      • bomb.exe (PID: 3956)
      • http185.215.113.66pei.exe.exe (PID: 820)
      • sysmablsvr.exe (PID: 660)
      • 2214010094.exe (PID: 2516)
      • httpsraw.githubusercontent.comsirvivor32sirvivormainLukeJazz.exe.exe (PID: 2972)
      • http185.172.128.159timeSync.exe.exe (PID: 3440)
      • httpsraw.githubusercontent.comr1antxxxmainNngraprczwe.exe.exe (PID: 3808)
      • httpsraw.githubusercontent.comr1antxxxmainUcxnbz.exe.exe (PID: 3664)
      • http185.172.128.159timeSync.exe.exe (PID: 2348)
      • http147.45.47.81conhost.exe.exe (PID: 1440)
      • cmd.exe (PID: 1520)
      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
      • httpsraw.githubusercontent.comr1antxxxmainUcxnbz.exe.exe (PID: 2224)
      • httpsraw.githubusercontent.comr1antxxxmainNngraprczwe.exe.exe (PID: 2652)
      • winblrsnrcs.exe (PID: 1248)
      • YnQhdmLrVDwIN64klieX.exe (PID: 3676)
      • 3437830441.exe (PID: 4928)
      • 6AyaE0gmxvQm8WQqeKRC.exe (PID: 5048)
      • powershell.exe (PID: 5336)
      • powershell.exe (PID: 5248)
      • explortu.exe (PID: 5760)
      • http77.91.77.81lendaudiodrive.exe.exe (PID: 2808)
      • 1e207f0b58.exe (PID: 4860)
      • axplong.exe (PID: 3052)
      • d34aaa08b3.exe (PID: 5968)
      • NewR.exe (PID: 4300)
      • loader-1002.exe (PID: 1960)
      • 8fc809.exe (PID: 4940)
      • Dctooux.exe (PID: 2764)
      • http77.91.77.81lendaudiodrive.exe.exe (PID: 992)
      • powershell.exe (PID: 5100)
      • redline123123.exe (PID: 4436)
      • Install.exe (PID: 5424)
      • powershell.exe (PID: 4076)
      • WMIC.exe (PID: 4016)
      • rundll32.exe (PID: 4920)
      • rundll32.exe (PID: 6000)
      • powershell.EXE (PID: 5244)
      • rundll32.exe (PID: 4076)
      • rundll32.exe (PID: 5492)
      • rundll32.exe (PID: 3844)
      • rundll32.exe (PID: 2252)
      • MicrosoftEdgeUpdate.exe (PID: 5824)
    • Potential Corporate Privacy Violation

      • bomb.exe (PID: 3956)
      • http185.215.113.66pei.exe.exe (PID: 820)
      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
      • httpupdate.cg100iii.comcg100Update.exe.exe (PID: 2720)
      • explortu.exe (PID: 5760)
      • Update.exe (PID: 4524)
      • axplong.exe (PID: 3052)
      • NewR.exe (PID: 4300)
      • Dctooux.exe (PID: 2764)
    • Reads security settings of Internet Explorer

      • bomb.exe (PID: 3956)
      • http185.215.113.66pei.exe.exe (PID: 820)
      • sysmablsvr.exe (PID: 660)
      • 2214010094.exe (PID: 2516)
      • httpsraw.githubusercontent.comsirvivor32sirvivormainLukeJazz.exe.exe (PID: 2972)
      • http185.172.128.159timeSync.exe.exe (PID: 3440)
      • http185.172.128.159timeSync.exe.exe (PID: 2348)
      • http147.45.47.81conhost.exe.exe (PID: 1440)
      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
      • httpsraw.githubusercontent.comr1antxxxmainNngraprczwe.exe.exe (PID: 3808)
      • httpsraw.githubusercontent.comr1antxxxmainUcxnbz.exe.exe (PID: 3664)
      • winblrsnrcs.exe (PID: 1248)
      • httpsraw.githubusercontent.comr1antxxxmainNngraprczwe.exe.exe (PID: 2652)
      • httpsraw.githubusercontent.comr1antxxxmainUcxnbz.exe.exe (PID: 2224)
      • 6AyaE0gmxvQm8WQqeKRC.exe (PID: 5048)
      • http77.91.77.81lendaudiodrive.exe.exe (PID: 2808)
      • explortu.exe (PID: 5760)
      • 1e207f0b58.exe (PID: 4860)
      • axplong.exe (PID: 3052)
      • d34aaa08b3.exe (PID: 5968)
      • NewR.exe (PID: 4300)
      • loader-1002.exe (PID: 1960)
      • 8fc809.exe (PID: 4940)
      • Dctooux.exe (PID: 2764)
      • http77.91.77.81lendaudiodrive.exe.exe (PID: 992)
      • Install.exe (PID: 5424)
      • CpYtKIq.exe (PID: 5692)
      • NNZNoGq.exe (PID: 6024)
    • Connects to the server without a host name

      • bomb.exe (PID: 3956)
      • sysmablsvr.exe (PID: 660)
      • http185.172.128.159timeSync.exe.exe (PID: 2348)
      • winblrsnrcs.exe (PID: 1248)
      • explortu.exe (PID: 5760)
      • axplong.exe (PID: 3052)
      • NewR.exe (PID: 4300)
    • Process requests binary or script from the Internet

      • bomb.exe (PID: 3956)
      • http185.215.113.66pei.exe.exe (PID: 820)
      • httpupdate.cg100iii.comcg100Update.exe.exe (PID: 2720)
      • explortu.exe (PID: 5760)
      • axplong.exe (PID: 3052)
      • Update.exe (PID: 4524)
      • Dctooux.exe (PID: 2764)
      • NewR.exe (PID: 4300)
    • Starts itself from another location

      • http185.215.113.66newtpp.exe.exe (PID: 748)
      • 1389215329.exe (PID: 1832)
      • 6AyaE0gmxvQm8WQqeKRC.exe (PID: 5048)
      • httpupdate.cg100iii.comcg100Update.exe.exe (PID: 2720)
      • 1e207f0b58.exe (PID: 4860)
      • 8fc809.exe (PID: 4940)
      • setup.exe (PID: 1796)
    • Creates file in the systems drive root

      • ntvdm.exe (PID: 616)
      • rundll32.exe (PID: 4920)
      • rundll32.exe (PID: 6000)
      • rundll32.exe (PID: 4076)
    • Crypto Currency Mining Activity Detected

      • bomb.exe (PID: 3956)
    • The process checks if it is being run in the virtual environment

      • httpslechiavetteusb.itimgsusblogospiralitykSzkj.exe.exe (PID: 2868)
    • The process connected to a server suspected of theft

      • RegSvcs.exe (PID: 848)
      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
      • Ul.pif (PID: 5524)
      • redline123123.exe (PID: 4436)
    • Connects to SMTP port

      • RegSvcs.exe (PID: 848)
      • lohid.exe (PID: 4444)
    • Executing commands from ".cmd" file

      • httpsraw.githubusercontent.comsirvivor32sirvivormainLukeJazz.exe.exe (PID: 2972)
    • Accesses Microsoft Outlook profiles

      • RegSvcs.exe (PID: 848)
      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
      • Ul.pif (PID: 5524)
      • rundll32.exe (PID: 4920)
      • rundll32.exe (PID: 6000)
      • rundll32.exe (PID: 4076)
    • The process creates files with name similar to system file names

      • bomb.exe (PID: 3956)
    • Starts CMD.EXE for commands execution

      • httpsraw.githubusercontent.comsirvivor32sirvivormainLukeJazz.exe.exe (PID: 2972)
      • cmd.exe (PID: 2956)
      • http147.45.47.81conhost.exe.exe (PID: 1440)
      • httpsraw.githubusercontent.comr1antxxxmainUcxnbz.exe.exe (PID: 3664)
      • httpsraw.githubusercontent.comr1antxxxmainNngraprczwe.exe.exe (PID: 3808)
      • http77.91.77.81lendaudiodrive.exe.exe (PID: 2808)
      • loader-1002.exe (PID: 1960)
      • Install.exe (PID: 5424)
      • forfiles.exe (PID: 5620)
      • forfiles.exe (PID: 4196)
      • forfiles.exe (PID: 2504)
      • forfiles.exe (PID: 3624)
      • forfiles.exe (PID: 4368)
      • forfiles.exe (PID: 1900)
      • forfiles.exe (PID: 5936)
      • CpYtKIq.exe (PID: 5692)
      • forfiles.exe (PID: 4404)
      • forfiles.exe (PID: 5476)
      • forfiles.exe (PID: 2728)
      • forfiles.exe (PID: 4748)
      • forfiles.exe (PID: 4768)
      • forfiles.exe (PID: 3844)
      • forfiles.exe (PID: 3040)
      • forfiles.exe (PID: 4380)
      • forfiles.exe (PID: 4304)
      • NNZNoGq.exe (PID: 6024)
      • forfiles.exe (PID: 5616)
      • forfiles.exe (PID: 2752)
      • forfiles.exe (PID: 4632)
      • forfiles.exe (PID: 5700)
    • Get information on the list of running processes

      • cmd.exe (PID: 2956)
    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 2956)
    • Application launched itself

      • cmd.exe (PID: 2956)
      • explortu.exe (PID: 5760)
      • http77.91.77.81lendaudiodrive.exe.exe (PID: 992)
      • lohid.exe (PID: 3512)
      • lohid.exe (PID: 3136)
      • lohid.exe (PID: 6368)
    • Drops a file with a rarely used extension (PIF)

      • cmd.exe (PID: 2956)
      • Ul.pif (PID: 3424)
    • Suspicious file concatenation

      • cmd.exe (PID: 3264)
    • The executable file from the user directory is run by the CMD process

      • Ul.pif (PID: 3424)
    • Starts application with an unusual extension

      • cmd.exe (PID: 2956)
    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 2956)
    • Windows Defender mutex has been found

      • http185.172.128.159timeSync.exe.exe (PID: 3440)
      • http185.172.128.159timeSync.exe.exe (PID: 2348)
    • Contacting a server suspected of hosting an CnC

      • http185.172.128.159timeSync.exe.exe (PID: 3440)
      • http185.172.128.159timeSync.exe.exe (PID: 2348)
      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
      • j3BulqBW6IWYjU8Jp5_e.exe (PID: 3264)
      • Ul.pif (PID: 5524)
      • explortu.exe (PID: 5760)
      • axplong.exe (PID: 3052)
      • 3013f75976.exe (PID: 5096)
      • NewR.exe (PID: 4300)
      • Dctooux.exe (PID: 2764)
    • Connects to unusual port

      • bomb.exe (PID: 3956)
      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
      • j3BulqBW6IWYjU8Jp5_e.exe (PID: 3264)
      • Ul.pif (PID: 5524)
      • httpsraw.githubusercontent.comr1antxxxmainUcxnbz.exe.exe (PID: 2224)
      • sysmablsvr.exe (PID: 660)
      • 3013f75976.exe (PID: 5096)
      • redline123123.exe (PID: 4436)
      • lohid.exe (PID: 4444)
    • Checks for external IP

      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
      • j3BulqBW6IWYjU8Jp5_e.exe (PID: 3264)
      • Ul.pif (PID: 5524)
      • 3013f75976.exe (PID: 5096)
    • Reads browser cookies

      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
      • Ul.pif (PID: 5524)
      • redline123123.exe (PID: 4436)
    • Drops 7-zip archiver for unpacking

      • http147.45.47.81conhost.exe.exe (PID: 1440)
      • NewR.exe (PID: 4300)
      • setup.exe (PID: 1796)
    • Executing commands from a ".bat" file

      • http147.45.47.81conhost.exe.exe (PID: 1440)
      • loader-1002.exe (PID: 1960)
    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 1520)
    • Searches for installed software

      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
      • Ul.pif (PID: 5524)
      • redline123123.exe (PID: 4436)
    • Adds/modifies Windows certificates

      • httpsraw.githubusercontent.comr1antxxxmainUcxnbz.exe.exe (PID: 2224)
    • Reads the BIOS version

      • 6AyaE0gmxvQm8WQqeKRC.exe (PID: 5048)
      • explortu.exe (PID: 5760)
      • 1e207f0b58.exe (PID: 4860)
      • axplong.exe (PID: 3052)
      • Install.exe (PID: 5424)
    • Base64-obfuscated command line is found

      • httpsraw.githubusercontent.comr1antxxxmainNngraprczwe.exe.exe (PID: 2652)
      • httpsraw.githubusercontent.comr1antxxxmainUcxnbz.exe.exe (PID: 2224)
      • http77.91.77.81lendaudiodrive.exe.exe (PID: 992)
    • Starts POWERSHELL.EXE for commands execution

      • httpsraw.githubusercontent.comr1antxxxmainNngraprczwe.exe.exe (PID: 2652)
      • httpsraw.githubusercontent.comr1antxxxmainUcxnbz.exe.exe (PID: 2224)
      • http77.91.77.81lendaudiodrive.exe.exe (PID: 992)
      • cmd.exe (PID: 3020)
      • cmd.exe (PID: 5552)
      • rundll32.exe (PID: 4920)
      • cmd.exe (PID: 4556)
      • rundll32.exe (PID: 6000)
      • rundll32.exe (PID: 4076)
      • cmd.exe (PID: 3352)
      • cmd.exe (PID: 928)
      • cmd.exe (PID: 1072)
      • cmd.exe (PID: 4992)
    • BASE64 encoded PowerShell command has been detected

      • httpsraw.githubusercontent.comr1antxxxmainUcxnbz.exe.exe (PID: 2224)
      • httpsraw.githubusercontent.comr1antxxxmainNngraprczwe.exe.exe (PID: 2652)
      • http77.91.77.81lendaudiodrive.exe.exe (PID: 992)
    • Using PowerShell to operate with local accounts

      • powershell.exe (PID: 5248)
      • powershell.exe (PID: 5336)
      • powershell.exe (PID: 5100)
    • Checks Windows Trust Settings

      • NewR.exe (PID: 4300)
      • loader-1002.exe (PID: 1960)
      • NNZNoGq.exe (PID: 6024)
    • Process drops legitimate windows executable

      • axplong.exe (PID: 3052)
      • Update.exe (PID: 4524)
    • Found strings related to reading or modifying Windows Defender settings

      • Install.exe (PID: 5424)
      • forfiles.exe (PID: 5620)
      • forfiles.exe (PID: 2504)
      • forfiles.exe (PID: 4196)
      • forfiles.exe (PID: 1900)
      • forfiles.exe (PID: 4368)
      • CpYtKIq.exe (PID: 5692)
      • forfiles.exe (PID: 4768)
      • forfiles.exe (PID: 5476)
      • forfiles.exe (PID: 2728)
      • forfiles.exe (PID: 4404)
      • forfiles.exe (PID: 3844)
      • forfiles.exe (PID: 3040)
      • forfiles.exe (PID: 5616)
      • forfiles.exe (PID: 4304)
      • NNZNoGq.exe (PID: 6024)
      • forfiles.exe (PID: 4380)
      • forfiles.exe (PID: 2752)
      • forfiles.exe (PID: 5700)
    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 5500)
      • cmd.exe (PID: 3120)
      • cmd.exe (PID: 5148)
      • cmd.exe (PID: 2840)
      • cmd.exe (PID: 2248)
      • cmd.exe (PID: 4012)
      • cmd.exe (PID: 5468)
      • cmd.exe (PID: 4636)
      • cmd.exe (PID: 5708)
      • cmd.exe (PID: 4316)
      • wscript.exe (PID: 2972)
      • cmd.exe (PID: 4284)
      • cmd.exe (PID: 4652)
      • cmd.exe (PID: 1556)
      • cmd.exe (PID: 3412)
    • Searches and executes a command on selected files

      • forfiles.exe (PID: 4196)
      • forfiles.exe (PID: 2504)
      • forfiles.exe (PID: 1900)
      • forfiles.exe (PID: 5620)
      • forfiles.exe (PID: 3624)
      • forfiles.exe (PID: 4368)
      • forfiles.exe (PID: 5936)
      • forfiles.exe (PID: 4768)
      • forfiles.exe (PID: 5476)
      • forfiles.exe (PID: 2728)
      • forfiles.exe (PID: 4748)
      • forfiles.exe (PID: 4404)
      • forfiles.exe (PID: 3844)
      • forfiles.exe (PID: 3040)
      • forfiles.exe (PID: 5616)
      • forfiles.exe (PID: 4304)
      • forfiles.exe (PID: 4632)
      • forfiles.exe (PID: 4380)
      • forfiles.exe (PID: 2752)
      • forfiles.exe (PID: 5700)
    • Powershell scripting: start process

      • cmd.exe (PID: 3020)
      • cmd.exe (PID: 4556)
      • cmd.exe (PID: 928)
    • Uses RUNDLL32.EXE to load library

      • Dctooux.exe (PID: 2764)
    • Loads DLL from Mozilla Firefox

      • rundll32.exe (PID: 4920)
      • rundll32.exe (PID: 6000)
      • rundll32.exe (PID: 4076)
    • Uses NETSH.EXE to obtain data on the network

      • rundll32.exe (PID: 4920)
      • rundll32.exe (PID: 6000)
      • rundll32.exe (PID: 4076)
    • The process executes via Task Scheduler

      • CpYtKIq.exe (PID: 5692)
      • powershell.EXE (PID: 5244)
      • lohid.exe (PID: 3512)
      • NewR.exe (PID: 2252)
      • NNZNoGq.exe (PID: 6024)
      • rundll32.exe (PID: 5276)
      • chrome.exe (PID: 2072)
      • MicrosoftEdgeUpdate.exe (PID: 5824)
      • NewR.exe (PID: 5736)
      • lohid.exe (PID: 3136)
      • lohid.exe (PID: 6368)
      • NewR.exe (PID: 6384)
    • Gets file extension (POWERSHELL)

      • powershell.exe (PID: 5600)
      • powershell.exe (PID: 2904)
      • powershell.exe (PID: 1652)
    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 2972)
    • Creates a software uninstall entry

      • NNZNoGq.exe (PID: 6024)
    • Access to an unwanted program domain was detected

      • rundll32.exe (PID: 5276)
  • INFO

    • Checks supported languages

      • bomb.exe (PID: 3956)
      • http185.215.113.66pei.exe.exe (PID: 820)
      • http185.215.113.66newtpp.exe.exe (PID: 748)
      • wmpnscfg.exe (PID: 4076)
      • sysmablsvr.exe (PID: 660)
      • 2320213981.exe (PID: 1080)
      • 2214010094.exe (PID: 2516)
      • http147.45.47.81WatchDog.exe.exe (PID: 1244)
      • httpsipfs.ioipfsbafybeia2u445gx6mtora6gfczdqhdqi752tdi23je2d4buqo4sdjghaxpuDIP.exe.exe (PID: 2680)
      • RegSvcs.exe (PID: 2660)
      • httpsipfs.ioipfsbafybeifi3b7zwgsfwv7ed7ajhul52mflcrh6vjoxzk3jormtf3fm2ougtytwapcdhuj20shds2WOP90sdhy.exe.exe (PID: 2424)
      • http77.91.77.81lendaudiodrive.exe.exe (PID: 2808)
      • 399333563.exe (PID: 1032)
      • RegSvcs.exe (PID: 848)
      • httpslechiavetteusb.itimgsusblogospiralitykSzkj.exe.exe (PID: 2868)
      • httpsraw.githubusercontent.comsirvivor32sirvivormainLukeJazz.exe.exe (PID: 2972)
      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
      • http185.172.128.159timeSync.exe.exe (PID: 3440)
      • Ul.pif (PID: 3424)
      • 763524471.exe (PID: 3616)
      • http185.172.128.159timeSync.exe.exe (PID: 2348)
      • http5.42.65.116meta0906.exe.exe (PID: 1704)
      • http147.45.47.81conhost.exe.exe (PID: 1440)
      • http185.172.128.159tiktok.exe.exe (PID: 820)
      • httpsraw.githubusercontent.comr1antxxxmainUcxnbz.exe.exe (PID: 3664)
      • httpsraw.githubusercontent.comr1antxxxmainNngraprczwe.exe.exe (PID: 3808)
      • 1389215329.exe (PID: 1832)
      • mode.com (PID: 1028)
      • winblrsnrcs.exe (PID: 1248)
      • httpsraw.githubusercontent.comr1antxxxmainUcxnbz.exe.exe (PID: 2224)
      • YnQhdmLrVDwIN64klieX.exe (PID: 3676)
      • httpsraw.githubusercontent.comr1antxxxmainNngraprczwe.exe.exe (PID: 2652)
      • httpupdate.cg100iii.comcg100Update.exe.exe (PID: 2720)
      • j3BulqBW6IWYjU8Jp5_e.exe (PID: 3264)
      • 3437830441.exe (PID: 4928)
      • 6AyaE0gmxvQm8WQqeKRC.exe (PID: 5048)
      • explortu.exe (PID: 5760)
      • http77.91.77.81lendaudiodrive.exe.exe (PID: 992)
      • 1108723491.exe (PID: 3372)
      • Ul.pif (PID: 5524)
      • Update.exe (PID: 4524)
      • 1e207f0b58.exe (PID: 4860)
      • axplong.exe (PID: 3052)
      • 2838414552.exe (PID: 5080)
      • 3013f75976.exe (PID: 5096)
      • d34aaa08b3.exe (PID: 5968)
      • redline123123.exe (PID: 4436)
      • NewR.exe (PID: 4300)
      • upd.exe (PID: 3840)
      • 8fc809.exe (PID: 4940)
      • gold.exe (PID: 5520)
      • loader-1002.exe (PID: 1960)
      • Dctooux.exe (PID: 2764)
      • lummac2.exe (PID: 5048)
      • http77.91.77.81lendaudiodrive.exe.exe (PID: 2044)
      • setup.exe (PID: 1796)
      • Install.exe (PID: 336)
      • Install.exe (PID: 5424)
      • CpYtKIq.exe (PID: 5692)
      • NewR.exe (PID: 2252)
      • lohid.exe (PID: 3512)
      • NNZNoGq.exe (PID: 6024)
      • lohid.exe (PID: 4444)
      • MicrosoftEdgeUpdate.exe (PID: 5824)
      • NewR.exe (PID: 5736)
      • lohid.exe (PID: 3136)
      • lohid.exe (PID: 3276)
      • NewR.exe (PID: 6384)
      • lohid.exe (PID: 6368)
      • lohid.exe (PID: 8848)
    • Reads the computer name

      • bomb.exe (PID: 3956)
      • wmpnscfg.exe (PID: 4076)
      • http185.215.113.66pei.exe.exe (PID: 820)
      • http147.45.47.81WatchDog.exe.exe (PID: 1244)
      • 2214010094.exe (PID: 2516)
      • sysmablsvr.exe (PID: 660)
      • RegSvcs.exe (PID: 2660)
      • http77.91.77.81lendaudiodrive.exe.exe (PID: 2808)
      • RegSvcs.exe (PID: 848)
      • httpslechiavetteusb.itimgsusblogospiralitykSzkj.exe.exe (PID: 2868)
      • httpsraw.githubusercontent.comsirvivor32sirvivormainLukeJazz.exe.exe (PID: 2972)
      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
      • http185.172.128.159timeSync.exe.exe (PID: 3440)
      • Ul.pif (PID: 3424)
      • httpsraw.githubusercontent.comr1antxxxmainUcxnbz.exe.exe (PID: 3664)
      • httpsraw.githubusercontent.comr1antxxxmainNngraprczwe.exe.exe (PID: 3808)
      • http185.172.128.159timeSync.exe.exe (PID: 2348)
      • httpsraw.githubusercontent.comr1antxxxmainUcxnbz.exe.exe (PID: 2224)
      • httpsraw.githubusercontent.comr1antxxxmainNngraprczwe.exe.exe (PID: 2652)
      • YnQhdmLrVDwIN64klieX.exe (PID: 3676)
      • winblrsnrcs.exe (PID: 1248)
      • httpupdate.cg100iii.comcg100Update.exe.exe (PID: 2720)
      • j3BulqBW6IWYjU8Jp5_e.exe (PID: 3264)
      • 3437830441.exe (PID: 4928)
      • http147.45.47.81conhost.exe.exe (PID: 1440)
      • 6AyaE0gmxvQm8WQqeKRC.exe (PID: 5048)
      • explortu.exe (PID: 5760)
      • http77.91.77.81lendaudiodrive.exe.exe (PID: 992)
      • Update.exe (PID: 4524)
      • 1e207f0b58.exe (PID: 4860)
      • Ul.pif (PID: 5524)
      • axplong.exe (PID: 3052)
      • 3013f75976.exe (PID: 5096)
      • d34aaa08b3.exe (PID: 5968)
      • redline123123.exe (PID: 4436)
      • NewR.exe (PID: 4300)
      • loader-1002.exe (PID: 1960)
      • 8fc809.exe (PID: 4940)
      • Dctooux.exe (PID: 2764)
      • http77.91.77.81lendaudiodrive.exe.exe (PID: 2044)
      • Install.exe (PID: 5424)
      • CpYtKIq.exe (PID: 5692)
      • lohid.exe (PID: 3512)
      • NNZNoGq.exe (PID: 6024)
      • MicrosoftEdgeUpdate.exe (PID: 5824)
      • lohid.exe (PID: 3136)
      • lohid.exe (PID: 4444)
      • lohid.exe (PID: 6368)
    • Reads Environment values

      • bomb.exe (PID: 3956)
      • RegSvcs.exe (PID: 2660)
      • RegSvcs.exe (PID: 848)
      • httpsraw.githubusercontent.comr1antxxxmainUcxnbz.exe.exe (PID: 3664)
      • httpsraw.githubusercontent.comr1antxxxmainNngraprczwe.exe.exe (PID: 3808)
      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
      • httpsraw.githubusercontent.comr1antxxxmainUcxnbz.exe.exe (PID: 2224)
      • httpsraw.githubusercontent.comr1antxxxmainNngraprczwe.exe.exe (PID: 2652)
      • Ul.pif (PID: 5524)
      • redline123123.exe (PID: 4436)
      • MicrosoftEdgeUpdate.exe (PID: 5824)
    • Reads the machine GUID from the registry

      • bomb.exe (PID: 3956)
      • http185.215.113.66pei.exe.exe (PID: 820)
      • sysmablsvr.exe (PID: 660)
      • http147.45.47.81WatchDog.exe.exe (PID: 1244)
      • RegSvcs.exe (PID: 2660)
      • http77.91.77.81lendaudiodrive.exe.exe (PID: 2808)
      • 2214010094.exe (PID: 2516)
      • RegSvcs.exe (PID: 848)
      • httpsraw.githubusercontent.comr1antxxxmainUcxnbz.exe.exe (PID: 3664)
      • http185.172.128.159timeSync.exe.exe (PID: 3440)
      • httpsraw.githubusercontent.comr1antxxxmainNngraprczwe.exe.exe (PID: 3808)
      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
      • http185.172.128.159timeSync.exe.exe (PID: 2348)
      • httpsraw.githubusercontent.comr1antxxxmainUcxnbz.exe.exe (PID: 2224)
      • winblrsnrcs.exe (PID: 1248)
      • httpsraw.githubusercontent.comr1antxxxmainNngraprczwe.exe.exe (PID: 2652)
      • httpupdate.cg100iii.comcg100Update.exe.exe (PID: 2720)
      • j3BulqBW6IWYjU8Jp5_e.exe (PID: 3264)
      • explortu.exe (PID: 5760)
      • Update.exe (PID: 4524)
      • http77.91.77.81lendaudiodrive.exe.exe (PID: 992)
      • 1e207f0b58.exe (PID: 4860)
      • Ul.pif (PID: 5524)
      • axplong.exe (PID: 3052)
      • 3013f75976.exe (PID: 5096)
      • redline123123.exe (PID: 4436)
      • NewR.exe (PID: 4300)
      • 8fc809.exe (PID: 4940)
      • loader-1002.exe (PID: 1960)
      • Dctooux.exe (PID: 2764)
      • Install.exe (PID: 5424)
      • lohid.exe (PID: 3512)
      • NNZNoGq.exe (PID: 6024)
      • MicrosoftEdgeUpdate.exe (PID: 5824)
      • lohid.exe (PID: 3136)
      • lohid.exe (PID: 6368)
    • Disables trace logs

      • bomb.exe (PID: 3956)
      • httpsraw.githubusercontent.comr1antxxxmainNngraprczwe.exe.exe (PID: 3808)
      • httpsraw.githubusercontent.comr1antxxxmainUcxnbz.exe.exe (PID: 3664)
      • httpsraw.githubusercontent.comr1antxxxmainUcxnbz.exe.exe (PID: 2224)
      • httpsraw.githubusercontent.comr1antxxxmainNngraprczwe.exe.exe (PID: 2652)
      • redline123123.exe (PID: 4436)
      • MicrosoftEdgeUpdate.exe (PID: 5824)
    • Reads the software policy settings

      • bomb.exe (PID: 3956)
      • RegSvcs.exe (PID: 848)
      • httpsraw.githubusercontent.comr1antxxxmainUcxnbz.exe.exe (PID: 3664)
      • httpsraw.githubusercontent.comr1antxxxmainNngraprczwe.exe.exe (PID: 3808)
      • httpsraw.githubusercontent.comr1antxxxmainUcxnbz.exe.exe (PID: 2224)
      • httpsraw.githubusercontent.comr1antxxxmainNngraprczwe.exe.exe (PID: 2652)
      • j3BulqBW6IWYjU8Jp5_e.exe (PID: 3264)
      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
      • Ul.pif (PID: 5524)
      • 3013f75976.exe (PID: 5096)
      • NewR.exe (PID: 4300)
      • loader-1002.exe (PID: 1960)
      • NNZNoGq.exe (PID: 6024)
      • MicrosoftEdgeUpdate.exe (PID: 5824)
    • Manual execution by a user

      • wmpnscfg.exe (PID: 4076)
      • cmd.exe (PID: 3536)
      • chrome.exe (PID: 4304)
      • Ul.pif (PID: 5524)
      • chrome.exe (PID: 4676)
    • Checks proxy server information

      • http185.215.113.66pei.exe.exe (PID: 820)
      • 2214010094.exe (PID: 2516)
      • sysmablsvr.exe (PID: 660)
      • http185.172.128.159timeSync.exe.exe (PID: 3440)
      • http185.172.128.159timeSync.exe.exe (PID: 2348)
      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
      • winblrsnrcs.exe (PID: 1248)
      • explortu.exe (PID: 5760)
      • axplong.exe (PID: 3052)
      • NewR.exe (PID: 4300)
      • loader-1002.exe (PID: 1960)
      • Dctooux.exe (PID: 2764)
      • rundll32.exe (PID: 4920)
      • rundll32.exe (PID: 6000)
      • rundll32.exe (PID: 4076)
      • rundll32.exe (PID: 5492)
      • rundll32.exe (PID: 3844)
      • NNZNoGq.exe (PID: 6024)
      • rundll32.exe (PID: 2252)
      • rundll32.exe (PID: 5276)
    • Create files in a temporary directory

      • http185.215.113.66pei.exe.exe (PID: 820)
      • sysmablsvr.exe (PID: 660)
      • 2214010094.exe (PID: 2516)
      • httpsipfs.ioipfsbafybeifi3b7zwgsfwv7ed7ajhul52mflcrh6vjoxzk3jormtf3fm2ougtytwapcdhuj20shds2WOP90sdhy.exe.exe (PID: 2424)
      • httpsipfs.ioipfsbafybeia2u445gx6mtora6gfczdqhdqi752tdi23je2d4buqo4sdjghaxpuDIP.exe.exe (PID: 2680)
      • bomb.exe (PID: 3956)
      • httpsraw.githubusercontent.comsirvivor32sirvivormainLukeJazz.exe.exe (PID: 2972)
      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
      • http147.45.47.81conhost.exe.exe (PID: 1440)
      • winblrsnrcs.exe (PID: 1248)
      • j3BulqBW6IWYjU8Jp5_e.exe (PID: 3264)
      • 6AyaE0gmxvQm8WQqeKRC.exe (PID: 5048)
      • explortu.exe (PID: 5760)
      • 1e207f0b58.exe (PID: 4860)
      • axplong.exe (PID: 3052)
      • Ul.pif (PID: 5524)
      • 3013f75976.exe (PID: 5096)
      • NewR.exe (PID: 4300)
      • loader-1002.exe (PID: 1960)
      • 8fc809.exe (PID: 4940)
      • Dctooux.exe (PID: 2764)
      • redline123123.exe (PID: 4436)
      • setup.exe (PID: 1796)
      • Install.exe (PID: 336)
      • Install.exe (PID: 5424)
    • Creates files or folders in the user directory

      • http185.215.113.66pei.exe.exe (PID: 820)
      • sysmablsvr.exe (PID: 660)
      • Ul.pif (PID: 3424)
      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
      • winblrsnrcs.exe (PID: 1248)
      • httpupdate.cg100iii.comcg100Update.exe.exe (PID: 2720)
      • httpsraw.githubusercontent.comr1antxxxmainUcxnbz.exe.exe (PID: 2224)
      • explortu.exe (PID: 5760)
      • Ul.pif (PID: 5524)
      • axplong.exe (PID: 3052)
      • Update.exe (PID: 4524)
      • NewR.exe (PID: 4300)
      • loader-1002.exe (PID: 1960)
      • http77.91.77.81lendaudiodrive.exe.exe (PID: 992)
      • Dctooux.exe (PID: 2764)
      • NNZNoGq.exe (PID: 6024)
    • Reads mouse settings

      • httpsipfs.ioipfsbafybeia2u445gx6mtora6gfczdqhdqi752tdi23je2d4buqo4sdjghaxpuDIP.exe.exe (PID: 2680)
      • httpsipfs.ioipfsbafybeifi3b7zwgsfwv7ed7ajhul52mflcrh6vjoxzk3jormtf3fm2ougtytwapcdhuj20shds2WOP90sdhy.exe.exe (PID: 2424)
      • Ul.pif (PID: 3424)
      • YnQhdmLrVDwIN64klieX.exe (PID: 3676)
      • d34aaa08b3.exe (PID: 5968)
    • Creates files in the program directory

      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
      • Ul.pif (PID: 5524)
      • http77.91.77.81lendaudiodrive.exe.exe (PID: 2044)
      • NNZNoGq.exe (PID: 6024)
    • Reads product name

      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
      • Ul.pif (PID: 5524)
      • redline123123.exe (PID: 4436)
    • Reads CPU info

      • http77.91.77.80romekenzo.exe.exe (PID: 3044)
      • Ul.pif (PID: 5524)
    • Application launched itself

      • msedge.exe (PID: 2272)
      • msedge.exe (PID: 2620)
      • msedge.exe (PID: 3816)
      • chrome.exe (PID: 4304)
      • chrome.exe (PID: 336)
      • chrome.exe (PID: 4676)
      • chrome.exe (PID: 2072)
    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 5336)
      • powershell.exe (PID: 5248)
      • powershell.exe (PID: 5100)
    • Reads security settings of Internet Explorer

      • rundll32.exe (PID: 4920)
      • rundll32.exe (PID: 6000)
      • rundll32.exe (PID: 4076)
      • rundll32.exe (PID: 5492)
      • rundll32.exe (PID: 3844)
      • rundll32.exe (PID: 2252)
    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 5600)
      • powershell.exe (PID: 5600)
      • powershell.exe (PID: 2904)
      • powershell.exe (PID: 2904)
      • powershell.exe (PID: 1652)
      • powershell.exe (PID: 1652)
    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 5600)
      • powershell.exe (PID: 2904)
      • powershell.exe (PID: 1652)
    • Process checks computer location settings

      • NNZNoGq.exe (PID: 6024)
    • The process uses the downloaded file

      • chrome.exe (PID: 1424)
      • chrome.exe (PID: 5788)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

RisePro

(PID) Process(3044) http77.91.77.80romekenzo.exe.exe
C2 (1)147.45.47.126:58709
Strings (55)\Battle.net
\config
\Local Storage
\Skype
\LunarClient
S,{w_6
\Games
UaEt,
J~|Hw
\FeatherClient
\accounts.json
\OpenVPN Connect
\.feather\accounts.json
\save.dat
VaultCloseVault
C:\program files (x86)\steam
\databases
\TLauncher
\GHISLER\wcx_ftp.ini
\Growtopia\save.dat
\TotalCommander
\Element\Local Storage
\launcher_msa_credentials.bin
\Microsoft\Skype for Desktop\Local Storage
VaultOpenVault
\.minecraft\launcher_accounts.json
\Element
\accounts.xml
\wcx_ftp.ini
frug?0
\accounts.txt
\ey_tokens.txt
\.purple
WSASend
logins
\.lunarclient\settings\games\accounts.txt
\launcher_profiles.json
\Pidgin
\Minecraft
\OpenVPN Connect\profiles
\Steam
\Messengers
\FileZilla
C:\program files\steam
APPDATA
\.minecraft\launcher_msa_credentials.bin
\Signal
\Session Storage
\ICQ\0001
\.minecraft\launcher_profiles.json
\tlauncher_profiles.json
\config.json
VaultGetItem
\Growtopia
\launcher_accounts.json
(PID) Process(3264) j3BulqBW6IWYjU8Jp5_e.exe
C2 (1)147.45.47.126:58709
Strings (55)\Battle.net
\config
\Local Storage
\Skype
\LunarClient
S,{w_6
\Games
UaEt,
J~|Hw
\FeatherClient
\accounts.json
\OpenVPN Connect
\.feather\accounts.json
\save.dat
VaultCloseVault
C:\program files (x86)\steam
\databases
\TLauncher
\GHISLER\wcx_ftp.ini
\Growtopia\save.dat
\TotalCommander
\Element\Local Storage
\launcher_msa_credentials.bin
\Microsoft\Skype for Desktop\Local Storage
VaultOpenVault
\.minecraft\launcher_accounts.json
\Element
\accounts.xml
\wcx_ftp.ini
frug?0
\accounts.txt
\ey_tokens.txt
\.purple
WSASend
logins
\.lunarclient\settings\games\accounts.txt
\launcher_profiles.json
\Pidgin
\Minecraft
\OpenVPN Connect\profiles
\Steam
\Messengers
\FileZilla
C:\program files\steam
APPDATA
\.minecraft\launcher_msa_credentials.bin
\Signal
\Session Storage
\ICQ\0001
\.minecraft\launcher_profiles.json
\tlauncher_profiles.json
\config.json
VaultGetItem
\Growtopia
\launcher_accounts.json
(PID) Process(5524) Ul.pif
C2 (1)3.36.173.8:50500
Strings (55)\Battle.net
\config
\Local Storage
\Skype
\LunarClient
S,{w_6
\Games
UaEt,
J~|Hw
\FeatherClient
\accounts.json
\OpenVPN Connect
\.feather\accounts.json
\save.dat
VaultCloseVault
C:\program files (x86)\steam
\databases
\TLauncher
\GHISLER\wcx_ftp.ini
\Growtopia\save.dat
\TotalCommander
\Element\Local Storage
\launcher_msa_credentials.bin
\Microsoft\Skype for Desktop\Local Storage
VaultOpenVault
\.minecraft\launcher_accounts.json
\Element
\accounts.xml
\wcx_ftp.ini
frug?0
\accounts.txt
\ey_tokens.txt
\.purple
WSASend
logins
\.lunarclient\settings\games\accounts.txt
\launcher_profiles.json
\Pidgin
\Minecraft
\OpenVPN Connect\profiles
\Steam
\Messengers
\FileZilla
C:\program files\steam
APPDATA
\.minecraft\launcher_msa_credentials.bin
\Signal
\Session Storage
\ICQ\0001
\.minecraft\launcher_profiles.json
\tlauncher_profiles.json
\config.json
VaultGetItem
\Growtopia
\launcher_accounts.json
(PID) Process(5096) 3013f75976.exe
C2 (1)147.45.47.126:58709
Strings (55)\Battle.net
\config
\Local Storage
\Skype
\LunarClient
S,{w_6
\Games
UaEt,
J~|Hw
\FeatherClient
\accounts.json
\OpenVPN Connect
\.feather\accounts.json
\save.dat
VaultCloseVault
C:\program files (x86)\steam
\databases
\TLauncher
\GHISLER\wcx_ftp.ini
\Growtopia\save.dat
\TotalCommander
\Element\Local Storage
\launcher_msa_credentials.bin
\Microsoft\Skype for Desktop\Local Storage
VaultOpenVault
\.minecraft\launcher_accounts.json
\Element
\accounts.xml
\wcx_ftp.ini
frug?0
\accounts.txt
\ey_tokens.txt
\.purple
WSASend
logins
\.lunarclient\settings\games\accounts.txt
\launcher_profiles.json
\Pidgin
\Minecraft
\OpenVPN Connect\profiles
\Steam
\Messengers
\FileZilla
C:\program files\steam
APPDATA
\.minecraft\launcher_msa_credentials.bin
\Signal
\Session Storage
\ICQ\0001
\.minecraft\launcher_profiles.json
\tlauncher_profiles.json
\config.json
VaultGetItem
\Growtopia
\launcher_accounts.json

AgentTesla

(PID) Process(848) RegSvcs.exe
Protocolsmtp
Hostcp8nl.hyperhost.ua
Port587
Usernamenwammuo@genesio.top
PasswordvqpF.#QRT234

Amadey

(PID) Process(5760) explortu.exe
C2147.45.47.155
URLhttp://147.45.47.155/ku4Nor9/index.php
Version4.21
Options
Drop directory9217037dc9
Drop nameexplortu.exe
Strings (113)Main
cmd /C RMDIR /s/q
/Plugins/
ESET
" && timeout 1 && del
&& Exit"
lv:
av:
SOFTWARE\Microsoft\Windows NT\CurrentVersion
st=s
Doctor Web
https://
Norton
Content-Type: application/x-www-form-urlencoded
9217037dc9
ProductName
147.45.47.155
/k
Content-Type: multipart/form-data; boundary=----
?scr=1
cred.dll|clip.dll|
vs:
<d>
exe
ComputerName
2019
id:
" && ren
ar:
:::
Sophos
sd:
#
Bitdefender
Panda Security
2016
abcdefghijklmnopqrstuvwxyz0123456789-_
-unicode-
Programs
Startup
d1
VideoID
bi:
&&
S-%lu-
Content-Disposition: form-data; name="data"; filename="
rb
Rem
\App
rundll32.exe
SYSTEM\ControlSet001\Services\BasicDisplay\Video
------
\0000
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
=
Avira
%USERPROFILE%
/ku4Nor9/index.php
og:
un:
pc:
WinDefender
r=
+++
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
e0
random
|
&unit=
DefaultSettings.YResolution
GetNativeSystemInfo
360TotalSecurity
-%lu
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
ps1
------
Comodo
AVAST Software
wb
\
AVG
GET
-executionpolicy remotesigned -File "
Powershell.exe
" Content-Type: application/octet-stream
shutdown -s -t 0
kernel32.dll
shell32.dll
dll
"taskkill /f /im "
ProgramData\
CurrentBuild
4.21
cmd
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
POST
0123456789
os:
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
"
rundll32
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
<c>
dm:
explortu.exe
e1
http://
--
%-lu
.jpg
Kaspersky Lab
2022
DefaultSettings.XResolution
(PID) Process(3052) axplong.exe
C277.91.77.81
URLhttp://77.91.77.81/Kiru9gu/index.php
Version4.30
Options
Drop directory8254624243
Drop nameaxplong.exe
Strings (113)Main
cmd /C RMDIR /s/q
/Plugins/
ESET
" && timeout 1 && del
&& Exit"
lv:
av:
SOFTWARE\Microsoft\Windows NT\CurrentVersion
st=s
Doctor Web
https://
Norton
Content-Type: application/x-www-form-urlencoded
ProductName
/k
Content-Type: multipart/form-data; boundary=----
?scr=1
cred.dll|clip.dll|
vs:
4.30
<d>
exe
8254624243
ComputerName
2019
id:
" && ren
ar:
:::
Sophos
77.91.77.81
sd:
#
Bitdefender
Panda Security
2016
abcdefghijklmnopqrstuvwxyz0123456789-_
-unicode-
Programs
Startup
d1
VideoID
bi:
&&
S-%lu-
Content-Disposition: form-data; name="data"; filename="
rb
Rem
\App
rundll32.exe
SYSTEM\ControlSet001\Services\BasicDisplay\Video
------
\0000
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
=
Avira
%USERPROFILE%
og:
un:
pc:
WinDefender
r=
+++
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
e0
axplong.exe
random
|
&unit=
DefaultSettings.YResolution
GetNativeSystemInfo
360TotalSecurity
-%lu
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
ps1
------
/Kiru9gu/index.php
Comodo
AVAST Software
wb
\
AVG
GET
-executionpolicy remotesigned -File "
Powershell.exe
" Content-Type: application/octet-stream
shutdown -s -t 0
kernel32.dll
shell32.dll
dll
"taskkill /f /im "
ProgramData\
CurrentBuild
cmd
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
POST
0123456789
os:
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
"
rundll32
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
<c>
dm:
e1
http://
--
%-lu
.jpg
Kaspersky Lab
2022
DefaultSettings.XResolution
(PID) Process(4300) NewR.exe
C2185.172.128.19
URLhttp://185.172.128.19/ghsdh39s/index.php
Version4.12
Options
Drop directorycd1f156d67
Drop nameUtsysc.exe
Strings (126)Main
cmd /C RMDIR /s/q
/Plugins/
ESET
" && timeout 1 && del
&& Exit"
lv:
av:
SOFTWARE\Microsoft\Windows NT\CurrentVersion
st=s
Doctor Web
https://
Norton
Content-Type: application/x-www-form-urlencoded
ProductName
/k
:F" /E
&&
Content-Type: multipart/form-data; boundary=----
?scr=1
cred.dll|clip.dll|
:N"
vs:
<d>
" /F
exe
ComputerName
2019
id:
" && ren
ar:
:::
Sophos
sd:
#
Bitdefender
Panda Security
cd1f156d67
2016
abcdefghijklmnopqrstuvwxyz0123456789-_
-unicode-
Programs
Startup
d1
VideoID
bi:
&&
S-%lu-
Content-Disposition: form-data; name="data"; filename="
rb
Rem
\App
rundll32.exe
SYSTEM\ControlSet001\Services\BasicDisplay\Video
------
\0000
185.172.128.19
=
Avira
%USERPROFILE%
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
og:
un:
pc:
WinDefender
r=
+++
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
&&Exit
e0
CACLS "
" /P "
|
&unit=
DefaultSettings.YResolution
GetNativeSystemInfo
360TotalSecurity
-%lu
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
ps1
------
/ghsdh39s/index.php
Comodo
AVAST Software
wb
\
AVG
Utsysc.exe
echo Y|CACLS "
GET
-executionpolicy remotesigned -File "
Powershell.exe
" Content-Type: application/octet-stream
shutdown -s -t 0
kernel32.dll
shell32.dll
dll
"taskkill /f /im "
ProgramData\
CurrentBuild
:R" /E
cmd
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
POST
0123456789
os:
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
"
/TR "
rundll32
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
<c>
dm:
/Create /SC MINUTE /MO 1 /TN
..\
e1
SCHTASKS
http://
--
%-lu
4.12
.jpg
Kaspersky Lab
2022
/Delete /TN "
DefaultSettings.XResolution
(PID) Process(2764) Dctooux.exe
C2selltix.org
Strings (117)Main
nudump.com
cmd /C RMDIR /s/q
/Plugins/
ESET
" && timeout 1 && del
&& Exit"
lv:
av:
SOFTWARE\Microsoft\Windows NT\CurrentVersion
st=s
Doctor Web
https://
Norton
Content-Type: application/x-www-form-urlencoded
ProductName
/k
Content-Type: multipart/form-data; boundary=----
?scr=1
cred.dll|clip.dll|
vs:
<d>
exe
ComputerName
2019
id:
" && ren
Dctooux.exe
ar:
:::
Sophos
sd:
#
Bitdefender
Panda Security
2016
abcdefghijklmnopqrstuvwxyz0123456789-_
-unicode-
Programs
Startup
d1
VideoID
bi:
&&
S-%lu-
b739b37d80
Content-Disposition: form-data; name="data"; filename="
rb
/forum2/index.php
/forum/index.php
Rem
\App
rundll32.exe
SYSTEM\ControlSet001\Services\BasicDisplay\Video
------
\0000
SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
=
Avira
%USERPROFILE%
og:
un:
pc:
WinDefender
r=
+++
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
e0
random
|
&unit=
DefaultSettings.YResolution
GetNativeSystemInfo
360TotalSecurity
-%lu
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
ps1
------
Comodo
AVAST Software
wb
otyt.ru
\
AVG
GET
-executionpolicy remotesigned -File "
Powershell.exe
" Content-Type: application/octet-stream
shutdown -s -t 0
kernel32.dll
shell32.dll
dll
"taskkill /f /im "
ProgramData\
CurrentBuild
cmd
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
POST
0123456789
os:
SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
"
/forum3/index.php
rundll32
SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
4.19
<c>
dm:
selltix.org
e1
http://
--
%-lu
.jpg
Kaspersky Lab
2022
DefaultSettings.XResolution
(PID) Process(5492) rundll32.exe
C2selltix.org
Strings (6)/forum/index.php
nudump.com
/forum3/index.php
/forum2/index.php
selltix.org
otyt.ru
(PID) Process(3844) rundll32.exe
C2selltix.org
Strings (6)/forum/index.php
nudump.com
/forum3/index.php
/forum2/index.php
selltix.org
otyt.ru
(PID) Process(2252) rundll32.exe
C2selltix.org
Strings (6)/forum/index.php
nudump.com
/forum3/index.php
/forum2/index.php
selltix.org
otyt.ru

RedLine

(PID) Process(4436) redline123123.exe
C2 (1)185.215.113.67:40960
Botnetnewbild
Options
ErrorMessage
Keys
XorOsteogeny
(PID) Process(3840) upd.exe
C2 (1)185.172.128.33:8970
Botnet@LOGSCLOUDYT_BOT
Options
ErrorMessage
Keys
XorLevins
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2048:07:19 19:03:26+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 9728
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x457a
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows command line
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: -
FileVersion: 1.0.0.0
InternalName: bomb.exe
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: bomb.exe
ProductName: -
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
501
Monitored processes
320
Malicious processes
56
Suspicious processes
38

Behavior graph

Click at the process to see the details
start bomb.exe wmpnscfg.exe no specs http185.215.113.66pei.exe.exe http185.215.113.66newtpp.exe.exe sysmablsvr.exe ntvdm.exe no specs 2320213981.exe no specs 2214010094.exe ntvdm.exe no specs http147.45.47.81watchdog.exe.exe ntvdm.exe no specs httpsipfs.ioipfsbafybeia2u445gx6mtora6gfczdqhdqi752tdi23je2d4buqo4sdjghaxpudip.exe.exe no specs regsvcs.exe no specs httpsipfs.ioipfsbafybeifi3b7zwgsfwv7ed7ajhul52mflcrh6vjoxzk3jormtf3fm2ougtytwapcdhuj20shds2wop90sdhy.exe.exe no specs http77.91.77.81lendaudiodrive.exe.exe no specs 399333563.exe no specs #AGENTTESLA regsvcs.exe ntvdm.exe httpslechiavetteusb.itimgsusblogospiralitykszkj.exe.exe no specs httpsraw.githubusercontent.comsirvivor32sirvivormainlukejazz.exe.exe no specs cmd.exe #RISEPRO http77.91.77.80romekenzo.exe.exe ntvdm.exe tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs #STEALC http185.172.128.159timesync.exe.exe ul.pif timeout.exe no specs cmd.exe 763524471.exe no specs ntvdm.exe no specs httpsraw.githubusercontent.comr1antxxxmainucxnbz.exe.exe httpsraw.githubusercontent.comr1antxxxmainnngraprczwe.exe.exe http5.42.65.116meta0906.exe.exe http147.45.47.81conhost.exe.exe http185.172.128.159tiktok.exe.exe no specs #STEALC http185.172.128.159timesync.exe.exe schtasks.exe no specs schtasks.exe no specs cmd.exe no specs mode.com no specs 1389215329.exe attrib.exe no specs #PHORPIEX winblrsnrcs.exe cmd.exe httpsraw.githubusercontent.comr1antxxxmainucxnbz.exe.exe cmd.exe httpsraw.githubusercontent.comr1antxxxmainnngraprczwe.exe.exe schtasks.exe no specs schtasks.exe no specs ynqhdmlrvdwin64kliex.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs httpupdate.cg100iii.comcg100update.exe.exe no specs httpupdate.cg100iii.comcg100update.exe.exe schtasks.exe no specs schtasks.exe no specs #RISEPRO j3bulqbw6iwyju8jp5_e.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs 3437830441.exe no specs msedge.exe no specs schtasks.exe no specs schtasks.exe no specs 6ayae0gmxvqm8wqqekrc.exe powershell.exe no specs powershell.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs #RISEPRO ul.pif chrome.exe no specs chrome.exe no specs #AMADEY explortu.exe msedge.exe no specs msedge.exe no specs chrome.exe no specs cmd.exe http77.91.77.81lendaudiodrive.exe.exe chrome.exe no specs 1108723491.exe no specs explortu.exe no specs update.exe 1e207f0b58.exe chrome.exe no specs chrome.exe no specs #AMADEY axplong.exe schtasks.exe no specs schtasks.exe no specs 2838414552.exe no specs #RISEPRO 3013f75976.exe d34aaa08b3.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs #REDLINE redline123123.exe #REDLINE upd.exe #AMADEY newr.exe schtasks.exe no specs 8fc809.exe loader-1002.exe no specs #REDLINE gold.exe loader-1002.exe #AMADEY dctooux.exe cmd.exe no specs lummac2.exe no specs powershell.exe no specs http77.91.77.81lendaudiodrive.exe.exe setup.exe no specs setup.exe install.exe install.exe cmd.exe no specs forfiles.exe no specs cmd.exe no specs reg.exe no specs forfiles.exe no specs reg.exe no specs cmd.exe no specs forfiles.exe no specs reg.exe no specs cmd.exe no specs forfiles.exe no specs cmd.exe no specs reg.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs gpupdate.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs wmic.exe no specs rundll32.exe netsh.exe no specs powershell.exe no specs schtasks.exe no specs forfiles.exe no specs schtasks.exe no specs cmd.exe no specs cpytkiq.exe cmd.exe no specs forfiles.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs forfiles.exe no specs reg.exe no specs forfiles.exe no specs cmd.exe no specs reg.exe no specs forfiles.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs forfiles.exe no specs powershell.exe no specs gpupdate.exe no specs rundll32.exe netsh.exe no specs schtasks.exe no specs schtasks.exe no specs powershell.exe no specs gpupdate.exe no specs powershell.exe no specs newr.exe no specs lohid.exe no specs rundll32.exe netsh.exe no specs powershell.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs schtasks.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs chrome.exe no specs wmic.exe no specs #AMADEY rundll32.exe chrome.exe no specs reg.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs wscript.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs schtasks.exe no specs schtasks.exe no specs nnznogq.exe cmd.exe no specs forfiles.exe no specs cmd.exe no specs reg.exe no specs forfiles.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs forfiles.exe no specs reg.exe no specs cmd.exe no specs forfiles.exe no specs reg.exe no specs forfiles.exe no specs cmd.exe no specs chrome.exe no specs powershell.exe no specs gpupdate.exe no specs chrome.exe no specs #AMADEY rundll32.exe schtasks.exe no specs cmd.exe no specs cmd.exe no specs forfiles.exe no specs powershell.exe no specs schtasks.exe no specs wmic.exe no specs cmd.exe no specs forfiles.exe no specs powershell.exe no specs wmic.exe no specs lohid.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs #AMADEY rundll32.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs #NEOREKLAMI rundll32.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs schtasks.exe no specs schtasks.exe no specs microsoftedgeupdate.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs lohid.exe no specs newr.exe no specs lohid.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs lohid.exe no specs newr.exe no specs chrome.exe no specs lohid.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
124powershell start-process -WindowStyle Hidden gpupdate.exe /forceC:\Windows\System32\WindowsPowerShell\v1.0\powershell.execmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
188"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd8,0x6757f598,0x6757f5a8,0x6757f5b4C:\Program Files\Microsoft\Edge\Application\msedge.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
188"C:\Windows\system32\gpupdate.exe" /force C:\Windows\System32\gpupdate.exepowershell.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® Group Policy Update Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\gpupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
312"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1304 --field-trial-handle=1364,i,17794756257549945566,9380491087224570004,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
336"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/accountC:\Program Files\Google\Chrome\Application\chrome.exed34aaa08b3.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
336.\Install.exeC:\Users\admin\AppData\Local\Temp\7zSCDBD.tmp\Install.exe
setup.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7z Setup SFX
Version:
9.20
Modules
Images
c:\users\admin\appdata\local\temp\7zscdbd.tmp\install.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
588"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1236 --field-trial-handle=1356,i,17765420270117311795,8299430817354531747,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exemsedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
588"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MUpKdfMcUwjMjiKs" /t REG_DWORD /d 0C:\Windows\System32\reg.exewscript.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
616"C:\Windows\system32\ntvdm.exe" -i1 C:\Windows\System32\ntvdm.exebomb.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
NTVDM.EXE
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntvdm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
660C:\Users\admin\sysmablsvr.exeC:\Users\admin\sysmablsvr.exe
http185.215.113.66newtpp.exe.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\sysmablsvr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
Total events
186 718
Read events
184 965
Write events
1 489
Delete events
264

Modification events

(PID) Process:(3956) bomb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3956) bomb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3956) bomb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3956) bomb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(3956) bomb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3956) bomb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3956) bomb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3956) bomb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3956) bomb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASMANCS
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3956) bomb.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\bomb_RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
Executable files
200
Suspicious files
795
Text files
342
Unknown types
238

Dropped files

PID
Process
Filename
Type
748http185.215.113.66newtpp.exe.exeC:\Users\admin\sysmablsvr.exeexecutable
MD5:4505DAF4C08FC8E8E1380911E98588AA
SHA256:A2139600C569365149894405D411EA1401BAFC8C7E8AF1983D046CF087269C40
3956bomb.exeC:\Users\admin\Desktop\http185.215.113.66pei.exe.exeexecutable
MD5:8D8E6C7952A9DC7C0C73911C4DBC5518
SHA256:FEB4C3AE4566F0ACBB9E0F55417B61FEFD89DC50A4E684DF780813FB01D61278
3956bomb.exeC:\Users\admin\Desktop\http185.215.113.66newtpp.exe.exeexecutable
MD5:4505DAF4C08FC8E8E1380911E98588AA
SHA256:A2139600C569365149894405D411EA1401BAFC8C7E8AF1983D046CF087269C40
820http185.215.113.66pei.exe.exeC:\Users\admin\AppData\Local\Temp\2320213981.exeexecutable
MD5:4505DAF4C08FC8E8E1380911E98588AA
SHA256:A2139600C569365149894405D411EA1401BAFC8C7E8AF1983D046CF087269C40
616ntvdm.exeC:\Users\admin\AppData\Local\Temp\scs78DC.tmptext
MD5:4C361DEA398F7AEEF49953BDC0AB4A9B
SHA256:06D61C23E6CA59B9DDAD1796ECCC42C032CD8F6F424AF6CFEE5D085D36FF7DFD
616ntvdm.exeC:\Users\admin\AppData\Local\Temp\scs78CC.tmptext
MD5:8CF6DDB5AA59B49F34B967CD46F013B6
SHA256:EE06792197C3E025B84860A72460EAF628C66637685F8C52C5A08A9CC35D376C
820http185.215.113.66pei.exe.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\newtpp[1].exeexecutable
MD5:4505DAF4C08FC8E8E1380911E98588AA
SHA256:A2139600C569365149894405D411EA1401BAFC8C7E8AF1983D046CF087269C40
1960ntvdm.exeC:\Users\admin\AppData\Local\Temp\scsA2EA.tmptext
MD5:4C361DEA398F7AEEF49953BDC0AB4A9B
SHA256:06D61C23E6CA59B9DDAD1796ECCC42C032CD8F6F424AF6CFEE5D085D36FF7DFD
2680httpsipfs.ioipfsbafybeia2u445gx6mtora6gfczdqhdqi752tdi23je2d4buqo4sdjghaxpuDIP.exe.exeC:\Users\admin\AppData\Local\Temp\putrefactiblebinary
MD5:C3F40D425D3A0CA4B4B41B6CAAA0D718
SHA256:EF7C97B98F5B48FB212A0644860F18DB870283D0E81A99AF7103FE40F8B111D9
2680httpsipfs.ioipfsbafybeia2u445gx6mtora6gfczdqhdqi752tdi23je2d4buqo4sdjghaxpuDIP.exe.exeC:\Users\admin\AppData\Local\Temp\autB44E.tmpbinary
MD5:C3F40D425D3A0CA4B4B41B6CAAA0D718
SHA256:EF7C97B98F5B48FB212A0644860F18DB870283D0E81A99AF7103FE40F8B111D9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
291
TCP/UDP connections
1 996
DNS requests
1 138
Threats
559

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3956
bomb.exe
GET
200
185.215.113.66:80
http://185.215.113.66/pei.exe
unknown
unknown
3956
bomb.exe
GET
200
185.215.113.66:80
http://185.215.113.66/newtpp.exe
unknown
unknown
820
http185.215.113.66pei.exe.exe
GET
200
185.215.113.66:80
http://twizt.net/newtpp.exe
unknown
unknown
820
http185.215.113.66pei.exe.exe
GET
200
185.215.113.66:80
http://twizt.net/peinstall.php
unknown
unknown
660
sysmablsvr.exe
GET
185.215.113.66:80
http://185.215.113.66/2
unknown
unknown
660
sysmablsvr.exe
GET
404
185.215.113.66:80
http://185.215.113.66/1
unknown
unknown
660
sysmablsvr.exe
GET
200
185.215.113.66:80
http://185.215.113.66/2
unknown
unknown
3956
bomb.exe
GET
200
147.45.47.81:80
http://147.45.47.81/xmrig.exe
unknown
unknown
3956
bomb.exe
GET
200
77.91.77.81:80
http://77.91.77.81/lend/theporndude.exe
unknown
unknown
3956
bomb.exe
GET
200
147.45.47.81:80
http://147.45.47.81/WatchDog.exe
unknown
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
224.0.0.252:5355
unknown
4
System
192.168.100.255:137
whitelisted
4
System
192.168.100.255:138
whitelisted
1088
svchost.exe
224.0.0.252:5355
unknown
3956
bomb.exe
151.101.130.49:443
urlhaus.abuse.ch
FASTLY
US
unknown
3956
bomb.exe
185.215.113.66:80
twizt.net
1337team Limited
SC
unknown
3956
bomb.exe
103.233.255.176:443
cnasjqw.cn
High Family Technology Co., Limited
SG
unknown
3956
bomb.exe
188.114.97.3:443
uploaddeimagens.com.br
CLOUDFLARENET
NL
unknown
820
http185.215.113.66pei.exe.exe
185.215.113.66:80
twizt.net
1337team Limited
SC
unknown
660
sysmablsvr.exe
185.215.113.66:80
twizt.net
1337team Limited
SC
unknown

DNS requests

Domain
IP
Reputation
urlhaus.abuse.ch
  • 151.101.130.49
  • 151.101.194.49
  • 151.101.2.49
  • 151.101.66.49
whitelisted
cnasjqw.cn
  • 103.233.255.176
unknown
asnwekow.com
  • 103.233.255.176
unknown
www.asjdnwe.cn
  • 103.233.255.176
unknown
www.adjefjeo.com
  • 103.233.255.176
unknown
asdqmdo.cn
  • 103.233.255.176
unknown
bndaeq.com
  • 103.233.255.176
unknown
www.asjqqe.com
  • 103.233.255.176
unknown
nbvand.cn
  • 103.233.255.176
unknown
www.cajasnq.cn
  • 103.233.255.176
unknown

Threats

PID
Process
Class
Message
3956
bomb.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 34
3956
bomb.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
3956
bomb.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
3956
bomb.exe
Potentially Bad Traffic
ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
3956
bomb.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
3956
bomb.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3956
bomb.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
820
http185.215.113.66pei.exe.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1088
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
3956
bomb.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
37 ETPRO signatures available at the full report
Process
Message
http77.91.77.80romekenzo.exe.exe
ret 345 fdhg r
http77.91.77.80romekenzo.exe.exe
er er y try rtsdh
http77.91.77.80romekenzo.exe.exe
tr 656 56 65 8658 658hfty
http77.91.77.80romekenzo.exe.exe
g 56 58y6
j3BulqBW6IWYjU8Jp5_e.exe
ret 345 fdhg r
http77.91.77.80romekenzo.exe.exe
h6rt hrd54
6AyaE0gmxvQm8WQqeKRC.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
explortu.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
j3BulqBW6IWYjU8Jp5_e.exe
tr 656 56 65 8658 658hfty
j3BulqBW6IWYjU8Jp5_e.exe
er er y try rtsdh