Malware analysis cpuz_x64.exe Malicious activity | ANY.RUN

Add for printing

File name:	cpuz_x64.exe
Full analysis:	https://app.any.run/tasks/7367f04f-7d0b-4f12-bd51-7f146c339948
Verdict:	Malicious activity
Analysis date:	August 13, 2024, 10:04:39
OS:	Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME:	application/x-dosexec
File info:	PE32 executable (GUI) Intel 80386, for MS Windows
MD5:	E0A9F8364B0BAD7067CB29C6B883D15B
SHA1:	E036B184FD0FE4877E1F414A5225FD6D97A3B4FE
SHA256:	499DD1973C114811F73F2C843FCBC8ECEA28D921672A82589CECAF9539C05943
SSDEEP:	98304:qP3oCZukctcEEqyco8+UxGy7FDEAoV7xzadDepzjHxKBa1bgJlVT904xgFx0ZuWv:PDDB904g0Zn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- UAC/LUA settings modification
  - cpuz_x64.exe (PID: 6408)
  - icsys.ico.exe (PID: 6456)
  - wininit.exe (PID: 6896)
  - spoolsv.exe (PID: 7128)
  - svchost.exe (PID: 6312)
- Changes the login/logoff helper path in the registry
  - icsys.ico.exe (PID: 6456)
  - wininit.exe (PID: 6896)
  - svchost.exe (PID: 6312)
- Changes the autorun value in the registry
  - icsys.ico.exe (PID: 6456)
- Changes appearance of the Explorer extensions
  - wininit.exe (PID: 6896)
  - svchost.exe (PID: 6312)
SUSPICIOUS
- Drops the executable file immediately after the start
  - cpuz_x64.exe (PID: 6408)
  - icsys.ico.exe (PID: 6456)
  - cpuz_x64.exe (PID: 6712)
  - wininit.exe (PID: 6896)
  - spoolsv.exe (PID: 7128)
- Executable content was dropped or overwritten
  - cpuz_x64.exe (PID: 6408)
  - icsys.ico.exe (PID: 6456)
  - cpuz_x64.exe (PID: 6712)
  - wininit.exe (PID: 6896)
  - spoolsv.exe (PID: 7128)
- Starts itself from another location
  - cpuz_x64.exe (PID: 6408)
  - icsys.ico.exe (PID: 6456)
  - wininit.exe (PID: 6896)
  - spoolsv.exe (PID: 7128)
- Starts application with an unusual extension
  - cpuz_x64.exe (PID: 6408)
- Reads security settings of Internet Explorer
  - ShellExperienceHost.exe (PID: 6544)
  - cpuz_x64.exe (PID: 6712)
  - icsys.ico.exe (PID: 6456)
  - wininit.exe (PID: 6896)
  - spoolsv.exe (PID: 7128)
- Drops a system driver (possible attempt to evade defenses)
  - cpuz_x64.exe (PID: 6712)
- Checks Windows Trust Settings
  - cpuz_x64.exe (PID: 6712)
- Reads the date of Windows installation
  - cpuz_x64.exe (PID: 6712)
  - icsys.ico.exe (PID: 6456)
  - wininit.exe (PID: 6896)
  - spoolsv.exe (PID: 7128)
- The process creates files with name similar to system file names
  - spoolsv.exe (PID: 7128)
INFO
- Reads the computer name
  - cpuz_x64.exe (PID: 6408)
  - icsys.ico.exe (PID: 6456)
  - ShellExperienceHost.exe (PID: 6544)
  - cpuz_x64.exe (PID: 6712)
  - spoolsv.exe (PID: 7128)
  - wininit.exe (PID: 6896)
  - spoolsv.exe (PID: 6288)
  - svchost.exe (PID: 6312)
- Checks supported languages
  - cpuz_x64.exe (PID: 6408)
  - icsys.ico.exe (PID: 6456)
  - ShellExperienceHost.exe (PID: 6544)
  - cpuz_x64.exe (PID: 6712)
  - spoolsv.exe (PID: 7128)
  - wininit.exe (PID: 6896)
  - svchost.exe (PID: 6312)
  - spoolsv.exe (PID: 6288)
- Process checks whether UAC notifications are on
  - cpuz_x64.exe (PID: 6408)
  - icsys.ico.exe (PID: 6456)
  - spoolsv.exe (PID: 7128)
  - wininit.exe (PID: 6896)
  - svchost.exe (PID: 6312)
- Creates files or folders in the user directory
  - cpuz_x64.exe (PID: 6408)
  - cpuz_x64.exe (PID: 6712)
  - wininit.exe (PID: 6896)
- Create files in a temporary directory
  - cpuz_x64.exe (PID: 6408)
- Checks proxy server information
  - cpuz_x64.exe (PID: 6712)
- Reads the software policy settings
  - cpuz_x64.exe (PID: 6712)
- Reads the machine GUID from the registry
  - cpuz_x64.exe (PID: 6712)
- Process checks computer location settings
  - icsys.ico.exe (PID: 6456)
  - wininit.exe (PID: 6896)
  - spoolsv.exe (PID: 7128)
- Reads Environment values
  - cpuz_x64.exe (PID: 6712)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	Inno Setup installer (34.1)
.exe	\|	InstallShield setup (13.3)
.exe	\|	Win32 EXE PECompact compressed (generic) (12.9)
.exe	\|	Win32 Executable (generic) (1.4)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2018:10:24 07:34:01+00:00
ImageFileCharacteristics:	Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType:	PE32
LinkerVersion:	2.25
CodeSize:	2472448
InitializedDataSize:	519168
UninitializedDataSize:	-
EntryPoint:	0x25c7d4
OSVersion:	5
ImageVersion:	-
SubsystemVersion:	5
Subsystem:	Windows GUI
FileVersionNumber:	1.0.0.0
ProductVersionNumber:	1.0.0.0
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Win32
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	English (U.S.)
CharacterSet:	Windows, Latin1
FileVersion:	1.0.0.0
ProductVersion:	1.0.0.0

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

138

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

6288

"C:\Users\admin\appdata\roaming\spoolsv.exe" /SE

C:\Users\admin\AppData\Roaming\spoolsv.exe

—

wininit.exe

User:

admin

Integrity Level:

HIGH

Exit code:

Version:

1.0.0.0

Modules

Images
c:\users\admin\appdata\roaming\spoolsv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\oleaut32.dll
c:\windows\syswow64\msvcp_win.dll

6312

"C:\windows\svchost.exe"

C:\Windows\svchost.exe

spoolsv.exe

User:

admin

Integrity Level:

HIGH

Version:

1.0.0.0

Modules

Images
c:\windows\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll

6360

"C:\Users\admin\AppData\Local\Temp\cpuz_x64.exe"

C:\Users\admin\AppData\Local\Temp\cpuz_x64.exe

—

explorer.exe

User:

admin

Integrity Level:

MEDIUM

Exit code:

3221226540

Version:

1.0.0.0

Modules

Images
c:\users\admin\appdata\local\temp\cpuz_x64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll

6408

"C:\Users\admin\AppData\Local\Temp\cpuz_x64.exe"

C:\Users\admin\AppData\Local\Temp\cpuz_x64.exe

explorer.exe

User:

admin

Integrity Level:

HIGH

Exit code:

Version:

1.0.0.0

Modules

Images
c:\users\admin\appdata\local\temp\cpuz_x64.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll

6456

C:\Users\admin\AppData\Roaming\icsys.ico.exe

cpuz_x64.exe

User:

admin

Integrity Level:

HIGH

Exit code:

Version:

1.0.0.0

Modules

Images
c:\users\admin\appdata\roaming\icsys.ico.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll

6544

"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca

C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe

—

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Shell Experience Host

Version:

10.0.19041.3758 (WinBuild.160101.0800)

Modules

Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\wincorlib.dll

6712

c:\users\admin\appdata\local\temp\cpuz_x64.exe

C:\Users\admin\AppData\Local\Temp\cpuz_x64.exe

cpuz_x64.exe

User:

admin

Company:

CPUID

Integrity Level:

HIGH

Description:

CPU-Z Application

Version:

2, 1, 0, 0

Modules

Images
c:\users\admin\appdata\local\temp\cpuz_x64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll

6896

"C:\windows\wininit.exe"

C:\Windows\wininit.exe

icsys.ico.exe

User:

admin

Integrity Level:

HIGH

Version:

1.0.0.0

Modules

Images
c:\windows\wininit.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll

7128

"C:\Users\admin\appdata\roaming\spoolsv.exe" /SE

C:\Users\admin\AppData\Roaming\spoolsv.exe

wininit.exe

User:

admin

Integrity Level:

HIGH

Exit code:

Version:

1.0.0.0

Modules

Images
c:\users\admin\appdata\roaming\spoolsv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll

Add for printing

Total events

10 088

Read events

10 013

Write events

Delete events

Modification events


(PID) Process:	(6408) cpuz_x64.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:	write	Name:	ConsentPromptBehaviorAdmin
Value: 0
(PID) Process:	(6408) cpuz_x64.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:	write	Name:	EnableLUA
Value: 0
(PID) Process:	(6408) cpuz_x64.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:	write	Name:	PromptOnSecureDesktop
Value: 0
(PID) Process:	(6456) icsys.ico.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:	write	Name:	ConsentPromptBehaviorAdmin
Value: 0
(PID) Process:	(6456) icsys.ico.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:	write	Name:	EnableLUA
Value: 0
(PID) Process:	(6456) icsys.ico.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:	write	Name:	PromptOnSecureDesktop
Value: 0
(PID) Process:	(6456) icsys.ico.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:	write	Name:	SlowContextMenuEntries
Value: 6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:	(6456) icsys.ico.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	ProxyBypass
Value: 1
(PID) Process:	(6456) icsys.ico.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	IntranetName
Value: 1
(PID) Process:	(6456) icsys.ico.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	UNCAsIntranet
Value: 1

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
6712	cpuz_x64.exe	C:\Windows\Temp\cpuz_driver_6712.log		text
		MD5:F984605BE6B69FF678CAAE40B1FE0E0A	SHA256:55F8D9530CB14690868D406B3078DE8625E22FF8F225CEFBD237B080B35AAB31
6408	cpuz_x64.exe	C:\Windows\Wininit		text
		MD5:DC88C4AA03F5180BBECE1ABDFEC93E70	SHA256:764DF4D37A31BE29B4D87041C66C520CF72260D05B22C92DF5F61E1EB67EF728
6456	icsys.ico.exe	C:\Windows\wininit.exe		executable
		MD5:625123D968314B6D46D1BEC732E6750A	SHA256:1B687151B4C4A69CC386EDE0E93991DCAD76C529E8D27B18A3624C297E8FD8A1
6712	cpuz_x64.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751		binary
		MD5:3DFCA46E00FFA4795C72A41375F159D3	SHA256:DCBA1A505396539BAC40A7253C9F5DCCF06CBB79957E21D56305E1FC3AF5F40E
6408	cpuz_x64.exe	C:\Users\admin\AppData\Local\Temp\cpuz_x64.exe		executable
		MD5:933612BE98B1DE1B5FB119A6B30E84DB	SHA256:C94DA0CC33CDAA8E70642330BFAA32AB0EC4B800F2B4CD30316DFFF41EF45DF2
6408	cpuz_x64.exe	C:\Users\admin\AppData\Roaming\icsys.ico.exe		executable
		MD5:625123D968314B6D46D1BEC732E6750A	SHA256:1B687151B4C4A69CC386EDE0E93991DCAD76C529E8D27B18A3624C297E8FD8A1
6712	cpuz_x64.exe	C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A4EEE1B0550754EDC37DCC5F80FA19DF		der
		MD5:62D8EFE6E2C7607FBFC8C782673756C1	SHA256:B6A3102CF5FEA340AD88108A34BCF545AA7FF998EDEB005BD03243D20A1F3F21
6712	cpuz_x64.exe	C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\cpuid[1].ver		text
		MD5:004BFA2894DBE6DD62B015B3E2CECD1B	SHA256:DE73B539E869A34A3AB54A83642284EC5CB067F12846A90AA8247F62B9B2CAA9
6712	cpuz_x64.exe	C:\Windows\Temp\cpuz159\cpuz159_x64.sys		executable
		MD5:7D571663F62629E6945D600E2A050464	SHA256:A0B2F26BDDD76F8A8B73713099EF5C71864A10B86B8E46EBD7AECB12B627B703
6896	wininit.exe	C:\Users\admin\AppData\Roaming\spoolsv.exe		executable
		MD5:625123D968314B6D46D1BEC732E6750A	SHA256:1B687151B4C4A69CC386EDE0E93991DCAD76C529E8D27B18A3624C297E8FD8A1

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
6712	cpuz_x64.exe	GET	200	184.24.77.54:80	http://r11.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBQaUrm0WeTDM5ghfoZtS72KO9ZnzgQUCLkRO6XQhRi06g%2BgrZ%2BGHo78OCcCEgSTi%2FCGxZ2Esn2oh5KTXh7Xlg%3D%3D	unknown	—	—	whitelisted
5336	SearchApp.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted
3276	svchost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
2136	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
1748	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
—	—	192.168.100.255:138	—	—	—	whitelisted
—	—	239.255.255.250:1900	—	—	—	whitelisted
3508	svchost.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
5244	RUXIMICS.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
2120	MoUsoCoreWorker.exe	51.124.78.146:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
6712	cpuz_x64.exe	195.154.81.43:443	download.cpuid.com	Online S.a.s.	FR	unknown
—	—	184.24.77.54:80	r11.o.lencr.org	Akamai International B.V.	DE	unknown
5336	SearchApp.exe	104.126.37.128:443	www.bing.com	Akamai International B.V.	DE	unknown
5336	SearchApp.exe	192.229.221.95:80	ocsp.digicert.com	EDGECAST	US	whitelisted
3260	svchost.exe	40.113.103.199:443	client.wns.windows.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	51.124.78.146 40.127.240.158	whitelisted
google.com	142.250.181.238	whitelisted
download.cpuid.com	195.154.81.43	whitelisted
r11.o.lencr.org	184.24.77.54 184.24.77.48 184.24.77.52	whitelisted
www.bing.com	104.126.37.128 104.126.37.130 104.126.37.139 104.126.37.131 104.126.37.178 104.126.37.171 104.126.37.163 104.126.37.170 104.126.37.144	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
client.wns.windows.com	40.113.103.199	whitelisted
login.live.com	20.190.159.75 40.126.31.69 40.126.31.67 20.190.159.68 20.190.159.23 20.190.159.71 20.190.159.73 40.126.31.73	whitelisted
th.bing.com	104.126.37.171 104.126.37.153 104.126.37.130 104.126.37.178 104.126.37.139 104.126.37.155 104.126.37.186 104.126.37.144 104.126.37.131	whitelisted
fd.api.iris.microsoft.com	20.103.156.88	whitelisted

Threats

No threats detected

Add for printing

No debug info

General Info

cpuz_x64.exe

E0A9F8364B0BAD7067CB29C6B883D15B

E036B184FD0FE4877E1F414A5225FD6D97A3B4FE

499DD1973C114811F73F2C843FCBC8ECEA28D921672A82589CECAF9539C05943

98304:qP3oCZukctcEEqyco8+UxGy7FDEAoV7xzadDepzjHxKBa1bgJlVT904xgFx0ZuWv:PDDB904g0Zn

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

UAC/LUA settings modification

Changes the login/logoff helper path in the registry

Changes the autorun value in the registry

Changes appearance of the Explorer extensions

SUSPICIOUS

Drops the executable file immediately after the start

Executable content was dropped or overwritten

Starts itself from another location

Starts application with an unusual extension

Reads security settings of Internet Explorer

Drops a system driver (possible attempt to evade defenses)

Checks Windows Trust Settings

Reads the date of Windows installation

The process creates files with name similar to system file names

INFO

Reads the computer name

Checks supported languages

Process checks whether UAC notifications are on

Creates files or folders in the user directory

Create files in a temporary directory

Checks proxy server information

Reads the software policy settings

Reads the machine GUID from the registry

Process checks computer location settings

Reads Environment values

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings