File name:

MDE_File_Sample_628262200e5aa807e6757db072484e02c81c8f0c.zip

Full analysis: https://app.any.run/tasks/6b9de61b-dbcd-4ad2-8443-4b257b4dfb2a
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: July 18, 2024, 00:23:33
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
loader
netreactor
miner
metastealer
cybergate
rat
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

A90902D04F2D7D6AC7BBC169CAD24A11

SHA1:

91DFABEA6FA2D81558D140C509762F63D6E21C3D

SHA256:

4B07C3077F5FE9A502DD4F6E9E54FA50F502573D5F786A3523EEBA281D314571

SSDEEP:

49152:JchLGqWF9g7JUIptN/vttIOwW9pmouKnYq4h8NLW81AwPRRXLIZrO7ErAgij5RzT:mFGqc+7JxvttIOJpmoYxaNC81Ae9MZMB

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • btweb_installer.exe (PID: 916)
      • btweb_installer.tmp (PID: 2764)
      • btweb_installer.exe (PID: 1192)
      • btweb_install_rr.exe (PID: 6784)
      • component0.exe (PID: 2032)
      • rh4qdqxx.exe (PID: 780)
      • btweb.exe (PID: 3596)
      • UnifiedStub-installer.exe (PID: 5872)

    • Actions looks like stealing of personal data

      • UnifiedStub-installer.exe (PID: 5872)
      • rsEngineSvc.exe (PID: 1300)
      • rsVPNSvc.exe (PID: 8664)
      • rsDNSSvc.exe (PID: 10184)

    • Changes the autorun value in the registry

      • btweb.exe (PID: 3596)
      • rundll32.exe (PID: 3952)
      • rundll32.exe (PID: 9548)

    • Creates a writable file in the system directory

      • UnifiedStub-installer.exe (PID: 5872)
      • rsEDRSvc.exe (PID: 3532)
      • rsEngineSvc.exe (PID: 1300)
      • rsVPNSvc.exe (PID: 8664)

    • METASTEALER has been detected (YARA)

      • rsEngineSvc.exe (PID: 1300)

    • CYBERGATE has been detected (YARA)

      • rsEngineSvc.exe (PID: 1300)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 5184)
      • btweb_installer.tmp (PID: 5708)
      • btweb_install_rr.exe (PID: 6784)
      • btweb_installer.tmp (PID: 2764)
      • component0.exe (PID: 2032)
      • btweb.exe (PID: 3596)
      • UnifiedStub-installer.exe (PID: 5872)
      • rsWSC.exe (PID: 3136)
      • rsEngineSvc.exe (PID: 7132)
      • rsEDRSvc.exe (PID: 6788)
      • rsEngineSvc.exe (PID: 1300)
      • rsVPNSvc.exe (PID: 7488)
      • rsDNSSvc.exe (PID: 10048)

    • Executable content was dropped or overwritten

      • btweb_installer.tmp (PID: 2764)
      • btweb_installer.exe (PID: 1192)
      • btweb_installer.exe (PID: 916)
      • btweb_install_rr.exe (PID: 6784)
      • component0.exe (PID: 2032)
      • rh4qdqxx.exe (PID: 780)
      • UnifiedStub-installer.exe (PID: 5872)
      • btweb.exe (PID: 3596)

    • Reads the date of Windows installation

      • btweb_installer.tmp (PID: 5708)
      • btweb_installer.tmp (PID: 2764)
      • component0.exe (PID: 2032)
      • rsEDRSvc.exe (PID: 3532)
      • rsEngineSvc.exe (PID: 1300)

    • Reads the Windows owner or organization settings

      • btweb_installer.tmp (PID: 2764)

    • Mutex name with non-standard characters

      • btweb_installer.tmp (PID: 2764)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • btweb_install_rr.exe (PID: 6784)

    • Process drops legitimate windows executable

      • btweb_install_rr.exe (PID: 6784)
      • rh4qdqxx.exe (PID: 780)
      • UnifiedStub-installer.exe (PID: 5872)

    • The process creates files with name similar to system file names

      • btweb_install_rr.exe (PID: 6784)
      • UnifiedStub-installer.exe (PID: 5872)

    • Searches for installed software

      • UnifiedStub-installer.exe (PID: 5872)
      • rsVPNSvc.exe (PID: 8664)

    • Creates a software uninstall entry

      • UnifiedStub-installer.exe (PID: 5872)

    • Executes as Windows Service

      • rsSyncSvc.exe (PID: 5516)
      • rsWSC.exe (PID: 7752)
      • rsEngineSvc.exe (PID: 1300)
      • rsClientSvc.exe (PID: 7316)
      • rsEDRSvc.exe (PID: 3532)
      • WmiApSrv.exe (PID: 8288)
      • rsVPNClientSvc.exe (PID: 1764)
      • rsVPNSvc.exe (PID: 8664)
      • WmiApSrv.exe (PID: 7672)
      • rsDNSClientSvc.exe (PID: 9752)
      • rsDNSSvc.exe (PID: 10184)
      • rsDNSResolver.exe (PID: 9956)
      • WmiApSrv.exe (PID: 9352)

    • Potential Corporate Privacy Violation

      • btweb.exe (PID: 3596)

    • Executes application which crashes

      • btweb_installer.tmp (PID: 2764)

    • Checks Windows Trust Settings

      • btweb.exe (PID: 3596)
      • rsWSC.exe (PID: 3136)
      • rsEngineSvc.exe (PID: 7132)
      • rsWSC.exe (PID: 7752)
      • rsEDRSvc.exe (PID: 6788)
      • rsEDRSvc.exe (PID: 3532)
      • rsEngineSvc.exe (PID: 1300)
      • rsVPNSvc.exe (PID: 7488)
      • rsDNSSvc.exe (PID: 10048)

    • Creates or modifies Windows services

      • rundll32.exe (PID: 3952)
      • UnifiedStub-installer.exe (PID: 5872)

    • Uses RUNDLL32.EXE to load library

      • UnifiedStub-installer.exe (PID: 5872)

    • Creates files in the driver directory

      • UnifiedStub-installer.exe (PID: 5872)

    • Drops 7-zip archiver for unpacking

      • UnifiedStub-installer.exe (PID: 5872)

    • Drops a system driver (possible attempt to evade defenses)

      • UnifiedStub-installer.exe (PID: 5872)

    • The process drops C-runtime libraries

      • UnifiedStub-installer.exe (PID: 5872)

    • Uses WEVTUTIL.EXE to install publishers and event logs from the manifest

      • UnifiedStub-installer.exe (PID: 5872)

    • Adds/modifies Windows certificates

      • rsWSC.exe (PID: 3136)
      • rsEngineSvc.exe (PID: 7132)
      • rsEngineSvc.exe (PID: 1300)

    • Dropped object may contain URLs of mainers pools

      • rsEngineSvc.exe (PID: 1300)

    • Reads the BIOS version

      • rsEDRSvc.exe (PID: 3532)
      • rsEngineSvc.exe (PID: 1300)

    • The process checks if it is being run in the virtual environment

      • rsEngineSvc.exe (PID: 1300)
      • rsVPNSvc.exe (PID: 8664)
      • rsDNSSvc.exe (PID: 10184)

    • Application launched itself

      • rsAppUI.exe (PID: 7132)
      • rsAppUI.exe (PID: 9144)
      • rsAppUI.exe (PID: 7568)

    • Process checks is Powershell's Script Block Logging on

      • rsEDRSvc.exe (PID: 3532)

    • There is functionality for taking screenshot (YARA)

      • rsEngineSvc.exe (PID: 1300)

    • Starts CMD.EXE for commands execution

      • rsDNSSvc.exe (PID: 10184)

    • Process uses IPCONFIG to clear DNS cache

      • cmd.exe (PID: 7020)
      • cmd.exe (PID: 9060)

    • There is functionality for communication over UDP network (YARA)

      • rsEngineSvc.exe (PID: 1300)

  • INFO

    • Create files in a temporary directory

      • btweb_installer.exe (PID: 1192)
      • btweb_installer.exe (PID: 916)
      • btweb_installer.tmp (PID: 2764)
      • btweb_install_rr.exe (PID: 6784)
      • component0.exe (PID: 2032)
      • rh4qdqxx.exe (PID: 780)
      • UnifiedStub-installer.exe (PID: 5872)
      • rsAppUI.exe (PID: 7132)
      • rsAppUI.exe (PID: 9144)
      • rsAppUI.exe (PID: 7568)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5184)

    • Checks supported languages

      • btweb_installer.tmp (PID: 2764)
      • btweb_installer.exe (PID: 1192)
      • btweb_installer.tmp (PID: 5708)
      • btweb_installer.exe (PID: 916)
      • btweb_install_rr.exe (PID: 6784)
      • component0.exe (PID: 2032)
      • rh4qdqxx.exe (PID: 780)
      • UnifiedStub-installer.exe (PID: 5872)
      • rsSyncSvc.exe (PID: 6920)
      • rsSyncSvc.exe (PID: 5516)
      • btweb.exe (PID: 3596)
      • identity_helper.exe (PID: 7560)
      • btweb.exe (PID: 6700)
      • helper.exe (PID: 7696)
      • rsWSC.exe (PID: 3136)
      • rsWSC.exe (PID: 7752)
      • rsClientSvc.exe (PID: 7184)
      • rsEngineSvc.exe (PID: 7132)
      • rsEngineSvc.exe (PID: 1300)
      • rsClientSvc.exe (PID: 7316)
      • rsEDRSvc.exe (PID: 6788)
      • rsEDRSvc.exe (PID: 3532)
      • EPP.exe (PID: 5856)
      • rsAppUI.exe (PID: 7132)
      • rsHelper.exe (PID: 5152)
      • rsAppUI.exe (PID: 8656)
      • rsAppUI.exe (PID: 8644)
      • rsLitmus.A.exe (PID: 8960)
      • rsAppUI.exe (PID: 8980)
      • rsVPNClientSvc.exe (PID: 7756)
      • rsVPNClientSvc.exe (PID: 1764)
      • rsAppUI.exe (PID: 8692)
      • rsVPNSvc.exe (PID: 7488)
      • rsVPNSvc.exe (PID: 8664)
      • rsAppUI.exe (PID: 9144)
      • rsAppUI.exe (PID: 8952)
      • rsAppUI.exe (PID: 8968)
      • VPN.exe (PID: 9200)
      • rsAppUI.exe (PID: 5076)
      • rsDNSClientSvc.exe (PID: 9696)
      • rsDNSClientSvc.exe (PID: 9752)
      • rsDNSResolver.exe (PID: 9788)
      • rsAppUI.exe (PID: 9140)
      • rsDNSResolver.exe (PID: 9956)
      • rsDNSSvc.exe (PID: 10048)
      • rsDNSSvc.exe (PID: 10184)
      • rsDNSResolver.exe (PID: 9876)
      • DNS.exe (PID: 9392)
      • rsAppUI.exe (PID: 7568)
      • rsAppUI.exe (PID: 9552)
      • rsAppUI.exe (PID: 9548)
      • rsAppUI.exe (PID: 9780)

    • Reads the computer name

      • btweb_installer.tmp (PID: 2764)
      • btweb_installer.tmp (PID: 5708)
      • btweb_install_rr.exe (PID: 6784)
      • component0.exe (PID: 2032)
      • UnifiedStub-installer.exe (PID: 5872)
      • rsSyncSvc.exe (PID: 6920)
      • rsSyncSvc.exe (PID: 5516)
      • btweb.exe (PID: 3596)
      • identity_helper.exe (PID: 7560)
      • helper.exe (PID: 7696)
      • rsWSC.exe (PID: 3136)
      • rsWSC.exe (PID: 7752)
      • rsClientSvc.exe (PID: 7184)
      • rsClientSvc.exe (PID: 7316)
      • rsEngineSvc.exe (PID: 7132)
      • rsEngineSvc.exe (PID: 1300)
      • rsEDRSvc.exe (PID: 3532)
      • rsEDRSvc.exe (PID: 6788)
      • rsHelper.exe (PID: 5152)
      • rsAppUI.exe (PID: 7132)
      • rsAppUI.exe (PID: 8656)
      • rsVPNClientSvc.exe (PID: 7756)
      • rsVPNClientSvc.exe (PID: 1764)
      • rsAppUI.exe (PID: 8644)
      • rsVPNSvc.exe (PID: 7488)
      • rsVPNSvc.exe (PID: 8664)
      • rsAppUI.exe (PID: 9144)
      • rsAppUI.exe (PID: 8952)
      • rsAppUI.exe (PID: 8968)
      • rsDNSClientSvc.exe (PID: 9696)
      • rsDNSClientSvc.exe (PID: 9752)
      • rsDNSResolver.exe (PID: 9956)
      • rsDNSSvc.exe (PID: 10048)
      • rsDNSResolver.exe (PID: 9876)
      • rsDNSSvc.exe (PID: 10184)
      • rsAppUI.exe (PID: 7568)
      • rsAppUI.exe (PID: 9548)
      • rsAppUI.exe (PID: 9552)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 5184)
      • msedge.exe (PID: 7768)

    • Process checks computer location settings

      • btweb_installer.tmp (PID: 5708)
      • btweb_installer.tmp (PID: 2764)
      • component0.exe (PID: 2032)
      • rsAppUI.exe (PID: 7132)
      • rsAppUI.exe (PID: 8692)
      • rsAppUI.exe (PID: 8980)
      • rsVPNSvc.exe (PID: 8664)
      • rsAppUI.exe (PID: 5076)
      • rsAppUI.exe (PID: 9140)
      • rsAppUI.exe (PID: 9144)
      • rsAppUI.exe (PID: 9780)
      • rsAppUI.exe (PID: 7568)

    • Reads the machine GUID from the registry

      • btweb_installer.tmp (PID: 2764)
      • component0.exe (PID: 2032)
      • UnifiedStub-installer.exe (PID: 5872)
      • btweb.exe (PID: 3596)
      • rsWSC.exe (PID: 3136)
      • rsWSC.exe (PID: 7752)
      • rsEngineSvc.exe (PID: 7132)
      • rsEngineSvc.exe (PID: 1300)
      • rsEDRSvc.exe (PID: 6788)
      • rsEDRSvc.exe (PID: 3532)
      • rsHelper.exe (PID: 5152)
      • rsAppUI.exe (PID: 7132)
      • rsVPNSvc.exe (PID: 7488)
      • rsVPNSvc.exe (PID: 8664)
      • rsAppUI.exe (PID: 9144)
      • rsDNSSvc.exe (PID: 10048)
      • rsDNSSvc.exe (PID: 10184)
      • rsAppUI.exe (PID: 7568)

    • Checks proxy server information

      • btweb_installer.tmp (PID: 2764)
      • component0.exe (PID: 2032)
      • btweb_install_rr.exe (PID: 6784)
      • UnifiedStub-installer.exe (PID: 5872)
      • WerFault.exe (PID: 7288)
      • WerFault.exe (PID: 7252)
      • btweb.exe (PID: 3596)
      • rsWSC.exe (PID: 3136)
      • rsEngineSvc.exe (PID: 7132)
      • rsAppUI.exe (PID: 7132)
      • rsVPNSvc.exe (PID: 7488)
      • rsAppUI.exe (PID: 9144)
      • rsDNSSvc.exe (PID: 10048)
      • rsAppUI.exe (PID: 7568)

    • Reads the software policy settings

      • btweb_installer.tmp (PID: 2764)
      • component0.exe (PID: 2032)
      • UnifiedStub-installer.exe (PID: 5872)
      • WerFault.exe (PID: 7288)
      • WerFault.exe (PID: 7252)
      • btweb.exe (PID: 3596)
      • rsWSC.exe (PID: 3136)
      • rsEngineSvc.exe (PID: 7132)
      • rsWSC.exe (PID: 7752)
      • rsEngineSvc.exe (PID: 1300)
      • rsEDRSvc.exe (PID: 6788)
      • rsEDRSvc.exe (PID: 3532)
      • rsVPNSvc.exe (PID: 7488)
      • rsVPNSvc.exe (PID: 8664)
      • rsDNSSvc.exe (PID: 10048)
      • rsDNSSvc.exe (PID: 10184)

    • Creates a software uninstall entry

      • btweb_install_rr.exe (PID: 6784)

    • Reads Environment values

      • component0.exe (PID: 2032)
      • UnifiedStub-installer.exe (PID: 5872)
      • rsEngineSvc.exe (PID: 1300)
      • rsEDRSvc.exe (PID: 3532)
      • rsAppUI.exe (PID: 7132)
      • rsVPNSvc.exe (PID: 8664)
      • rsAppUI.exe (PID: 9144)
      • rsDNSSvc.exe (PID: 10184)
      • rsAppUI.exe (PID: 7568)

    • Disables trace logs

      • component0.exe (PID: 2032)
      • UnifiedStub-installer.exe (PID: 5872)
      • rsEngineSvc.exe (PID: 1300)
      • rsEDRSvc.exe (PID: 3532)
      • rsVPNSvc.exe (PID: 8664)
      • rsDNSSvc.exe (PID: 10184)

    • Creates files or folders in the user directory

      • btweb_install_rr.exe (PID: 6784)
      • btweb.exe (PID: 3596)
      • WerFault.exe (PID: 7288)
      • WerFault.exe (PID: 7252)
      • helper.exe (PID: 7696)
      • rsWSC.exe (PID: 3136)
      • rsEngineSvc.exe (PID: 7132)
      • rsEngineSvc.exe (PID: 1300)
      • rsAppUI.exe (PID: 7132)
      • rsAppUI.exe (PID: 8656)
      • rsVPNSvc.exe (PID: 7488)
      • rsVPNSvc.exe (PID: 8664)
      • rsAppUI.exe (PID: 9144)
      • rsAppUI.exe (PID: 8968)
      • rsDNSSvc.exe (PID: 10048)
      • rsDNSSvc.exe (PID: 10184)
      • rsAppUI.exe (PID: 9548)
      • rsAppUI.exe (PID: 7568)

    • Creates files in the program directory

      • UnifiedStub-installer.exe (PID: 5872)
      • rsWSC.exe (PID: 3136)
      • rsEngineSvc.exe (PID: 7132)
      • rsEngineSvc.exe (PID: 1300)
      • rsEDRSvc.exe (PID: 6788)
      • rsEDRSvc.exe (PID: 3532)
      • rsVPNSvc.exe (PID: 7488)
      • rsVPNSvc.exe (PID: 8664)
      • rsDNSResolver.exe (PID: 9956)
      • rsDNSSvc.exe (PID: 10048)
      • rsDNSResolver.exe (PID: 9876)
      • rsDNSSvc.exe (PID: 10184)

    • Reads Microsoft Office registry keys

      • btweb.exe (PID: 3596)
      • msedge.exe (PID: 6848)

    • Application launched itself

      • msedge.exe (PID: 6848)

    • .NET Reactor protector has been detected

      • UnifiedStub-installer.exe (PID: 5872)
      • rsWSC.exe (PID: 7752)
      • rsEngineSvc.exe (PID: 1300)
      • rsEDRSvc.exe (PID: 3532)

    • Manual execution by a user

      • btweb.exe (PID: 6700)

    • Reads the time zone

      • runonce.exe (PID: 7208)
      • rsEngineSvc.exe (PID: 1300)
      • rsEDRSvc.exe (PID: 3532)
      • rsVPNSvc.exe (PID: 8664)
      • runonce.exe (PID: 9604)
      • rsDNSSvc.exe (PID: 10184)

    • Reads security settings of Internet Explorer

      • runonce.exe (PID: 7208)
      • runonce.exe (PID: 9604)

    • Reads product name

      • rsEDRSvc.exe (PID: 3532)
      • rsEngineSvc.exe (PID: 1300)
      • rsAppUI.exe (PID: 7132)
      • rsAppUI.exe (PID: 9144)
      • rsAppUI.exe (PID: 7568)

    • Reads CPU info

      • rsEngineSvc.exe (PID: 1300)
      • rsEDRSvc.exe (PID: 3532)
      • rsVPNSvc.exe (PID: 8664)
      • rsDNSSvc.exe (PID: 10184)

    • Process checks whether UAC notifications are on

      • rsEDRSvc.exe (PID: 3532)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2024:07:18 00:22:58
ZipCRC: 0x2bd1b4f7
ZipCompressedSize: 1285953
ZipUncompressedSize: 1796216
ZipFileName: btweb_installer.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
304
Monitored processes
154
Malicious processes
14
Suspicious processes
7

Behavior graph

Click at the process to see the details
start winrar.exe btweb_installer.exe btweb_installer.tmp no specs btweb_installer.exe btweb_installer.tmp btweb_install_rr.exe component0.exe rh4qdqxx.exe THREAT unifiedstub-installer.exe rssyncsvc.exe no specs conhost.exe no specs rssyncsvc.exe no specs btweb.exe msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs werfault.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs werfault.exe msedge.exe no specs helper.exe btweb.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs rundll32.exe runonce.exe no specs grpconv.exe no specs wevtutil.exe no specs conhost.exe no specs fltmc.exe no specs conhost.exe no specs wevtutil.exe no specs conhost.exe no specs rswsc.exe THREAT rswsc.exe no specs rsclientsvc.exe no specs conhost.exe no specs rsclientsvc.exe no specs rsenginesvc.exe msedge.exe no specs THREAT rsenginesvc.exe rsedrsvc.exe no specs THREAT rsedrsvc.exe rshelper.exe no specs epp.exe no specs rsappui.exe no specs wmiapsrv.exe no specs rsappui.exe no specs rsappui.exe no specs rsappui.exe no specs rslitmus.a.exe no specs conhost.exe no specs rsappui.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs rsvpnclientsvc.exe no specs conhost.exe no specs rsvpnclientsvc.exe no specs rsvpnsvc.exe rsvpnsvc.exe msedge.exe no specs vpn.exe no specs rsappui.exe no specs msedge.exe no specs wmiapsrv.exe no specs rsappui.exe no specs rsappui.exe rsappui.exe no specs rsappui.exe no specs msedge.exe no specs msedge.exe no specs rundll32.exe runonce.exe no specs grpconv.exe no specs rsdnsclientsvc.exe no specs conhost.exe no specs rsdnsclientsvc.exe no specs rsdnsresolver.exe no specs conhost.exe no specs rsdnsresolver.exe no specs conhost.exe no specs rsdnsresolver.exe no specs rsdnssvc.exe rsdnssvc.exe msedge.exe no specs cmd.exe no specs conhost.exe no specs ipconfig.exe no specs dns.exe no specs rsappui.exe no specs wmiapsrv.exe no specs rsappui.exe no specs rsappui.exe rsappui.exe no specs msedge.exe no specs cmd.exe no specs conhost.exe no specs ipconfig.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
780"C:\Users\admin\AppData\Local\Temp\rh4qdqxx.exe" /silentC:\Users\admin\AppData\Local\Temp\rh4qdqxx.exe
component0.exe
User:
admin
Company:
ReasonLabs
Integrity Level:
HIGH
Description:
ReasonLabs-setup-wizard.exe
Exit code:
0
Version:
6.0.1
Modules
Images
c:\users\admin\appdata\local\temp\rh4qdqxx.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
916"C:\Users\admin\AppData\Local\Temp\Rar$EXb5184.3961\btweb_installer.exe" /SPAWNWND=$70342 /NOTIFYWND=$50304 C:\Users\admin\AppData\Local\Temp\Rar$EXb5184.3961\btweb_installer.exe
btweb_installer.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
BіtТorrеnt Web®
Exit code:
3221226525
Version:
1.4
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb5184.3961\btweb_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1164"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=8056 --field-trial-handle=2360,i,12854855059814397164,6412798563401901516,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1192"C:\Users\admin\AppData\Local\Temp\Rar$EXb5184.3961\btweb_installer.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb5184.3961\btweb_installer.exe
WinRAR.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
BіtТorrеnt Web®
Exit code:
3221226525
Version:
1.4
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb5184.3961\btweb_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
1300"C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe"C:\Program Files\ReasonLabs\EPP\rsEngineSvc.exe
services.exe
User:
SYSTEM
Company:
Reason Software Company Inc.
Integrity Level:
SYSTEM
Description:
rsEngineSvc
Version:
3.2.0.0
Modules
Images
c:\program files\reasonlabs\epp\rsenginesvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1660"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x2fc,0x7ffd96845fd8,0x7ffd96845fe4,0x7ffd96845ff0C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1764"C:\Program Files\ReasonLabs\VPN\rsVPNClientSvc.exe"C:\Program Files\ReasonLabs\VPN\rsVPNClientSvc.exe—services.exe
User:
SYSTEM
Company:
Reason Software Company Inc.
Integrity Level:
SYSTEM
Description:
Reason Client Service
Version:
4.5.1.0
Modules
Images
c:\program files\reasonlabs\vpn\rsvpnclientsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2028"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=66 --mojo-platform-channel-handle=7876 --field-trial-handle=2360,i,12854855059814397164,6412798563401901516,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2032"C:\Users\admin\AppData\Local\Temp\is-3NS5N.tmp\component0.exe" -ip:"dui=bb926e54-e3ca-40fd-ae90-2764341e7792&dit=20240718002359&is_silent=true&oc=ZB_RAV_Cross_Tri_NCB&p=123d&a=100&b=&se=true" -vp:"dui=bb926e54-e3ca-40fd-ae90-2764341e7792&dit=20240718002359&oc=ZB_RAV_Cross_Tri_NCB&p=123d&a=100&oip=26&ptl=7&dta=true" -dp:"dui=bb926e54-e3ca-40fd-ae90-2764341e7792&dit=20240718002359&oc=ZB_RAV_Cross_Tri_NCB&p=123d&a=100" -i -v -d -se=trueC:\Users\admin\AppData\Local\Temp\is-3NS5N.tmp\component0.exe
btweb_installer.tmp
User:
admin
Company:
Reason Software Company Inc.
Integrity Level:
HIGH
Description:
rsStubActivator
Exit code:
0
Version:
1.6.1.0
Modules
Images
c:\users\admin\appdata\local\temp\is-3ns5n.tmp\component0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2080"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2752 --field-trial-handle=2360,i,12854855059814397164,6412798563401901516,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
144 990
Read events
144 085
Write events
684
Delete events
221

Modification events

(PID) Process:(5184) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(5184) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(5184) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(5184) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\MDE_File_Sample_628262200e5aa807e6757db072484e02c81c8f0c.zip
(PID) Process:(5184) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5184) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5184) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5184) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5184) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(5184) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
913
Suspicious files
1 602
Text files
382
Unknown types
35

Dropped files

PID
Process
Filename
Type
2764btweb_installer.tmpC:\Users\admin\AppData\Local\Temp\is-3NS5N.tmp\is-A9285.tmpexecutable
MD5:0846FDFFD85664D6A7FCDEA625A0A43E
SHA256:B344E06E77947AF542CAA0871006BF27A851C282F64C53D00E2F3EF355D54FB3
1192btweb_installer.exeC:\Users\admin\AppData\Local\Temp\is-PQCS2.tmp\btweb_installer.tmpexecutable
MD5:0F5EFA5F6DCDB2E20E15248F61EE434B
SHA256:070E6F59D9ED66315F97DF33037219DDE662C251D457A7539945358A187225FA
6784btweb_install_rr.exeC:\Users\admin\AppData\Roaming\BitTorrent Web\localization\de.langtext
MD5:3ABF457A7FD0E7AB549062003EAF5E5F
SHA256:2773849568EFFA2BA7FFBF628E89C75F7887FC779C2434AEF22FBA3F88A84082
2764btweb_installer.tmpC:\Users\admin\AppData\Local\Temp\is-3NS5N.tmp\RAV_Cross.pngimage
MD5:CD09F361286D1AD2622BA8A57B7613BD
SHA256:B92A31D4853D1B2C4E5B9D9624F40B439856D0C6A517E100978CBDE8D3C47DC8
2764btweb_installer.tmpC:\Users\admin\AppData\Local\Temp\is-3NS5N.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
2764btweb_installer.tmpC:\Users\admin\AppData\Local\Temp\is-3NS5N.tmp\license.rtftext
MD5:8A708BF775DE14E5FBB16F6077B454D5
SHA256:ECA753676C5C71D7BE141451CD6D1426A08ED5C254078BC585D9BA91395A971A
2764btweb_installer.tmpC:\Users\admin\AppData\Local\Temp\is-3NS5N.tmp\component0executable
MD5:0846FDFFD85664D6A7FCDEA625A0A43E
SHA256:B344E06E77947AF542CAA0871006BF27A851C282F64C53D00E2F3EF355D54FB3
2764btweb_installer.tmpC:\Users\admin\AppData\Local\Temp\is-3NS5N.tmp\Logo.pngimage
MD5:A047D3C01D1E469C5543D2679955149C
SHA256:CF090DEB874784E26829BBE05131CA859C88102F74019FE1B0162A63B412087A
2764btweb_installer.tmpC:\Users\admin\AppData\Local\Temp\is-3NS5N.tmp\is-H4JAE.tmpexecutable
MD5:1BDF4BDB4A25B481A64AD7E2491668CE
SHA256:BCA9977D73CA8E266B05CAE0AD394F8EC7FB798A3C4553DB929D6CC5F4865985
6784btweb_install_rr.exeC:\Users\admin\AppData\Local\Temp\nsdCAA6.tmp\System.dllexecutable
MD5:CFF85C549D536F651D4FB8387F1976F2
SHA256:8DC562CDA7217A3A52DB898243DE3E2ED68B80E62DDCB8619545ED0B4E7F65A8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
153
TCP/UDP connections
738
DNS requests
538
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4448
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4448
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4656
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6320
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
3760
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6428
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
3628
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3628
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6784
btweb_install_rr.exe
POST
200
44.216.255.59:80
http://i-4102.b-5825.btweb.bench.utorrent.com/e?i=4102
unknown
—
—
unknown
6784
btweb_install_rr.exe
POST
200
44.216.255.59:80
http://i-4102.b-5825.btweb.bench.utorrent.com/e?i=4102
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3676
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4656
SearchApp.exe
104.126.37.170:443
www.bing.com
Akamai International B.V.
DE
unknown
4976
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4448
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
4448
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
unknown
4656
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 20.73.194.208
whitelisted
www.bing.com
  • 104.126.37.170
  • 104.126.37.162
  • 104.126.37.171
  • 104.126.37.178
  • 104.126.37.155
  • 104.126.37.160
  • 104.126.37.128
  • 104.126.37.179
  • 104.126.37.186
  • 104.126.37.144
  • 104.126.37.131
  • 104.126.37.139
  • 104.126.37.130
  • 104.126.37.153
  • 104.126.37.163
  • 104.126.37.147
  • 104.126.37.185
  • 104.126.37.176
  • 104.126.37.177
  • 104.126.37.145
  • 104.126.37.123
  • 104.126.37.136
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
google.com
  • 172.217.16.206
whitelisted
login.live.com
  • 40.126.32.76
  • 20.190.160.14
  • 40.126.32.138
  • 40.126.32.133
  • 40.126.32.136
  • 40.126.32.140
  • 40.126.32.134
  • 40.126.32.74
  • 40.126.31.73
  • 20.190.159.68
  • 20.190.159.2
  • 20.190.159.23
  • 40.126.31.71
  • 20.190.159.4
  • 20.190.159.64
  • 20.190.159.71
whitelisted
go.microsoft.com
  • 184.30.17.189
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.13
whitelisted
arc.msn.com
  • 20.223.35.26
  • 20.223.36.55
  • 20.31.169.57
whitelisted

Threats

PID
Process
Class
Message
6784
btweb_install_rr.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
6784
btweb_install_rr.exe
Potentially Bad Traffic
ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))
3596
btweb.exe
Potential Corporate Privacy Violation
ET P2P BitTorrent DHT ping request
3596
btweb.exe
Potentially Bad Traffic
ET POLICY Executable served from Amazon S3
3596
btweb.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2400
msedge.exe
Potentially Bad Traffic
ET INFO Suspicious Domain (polyfill .io) in DNS Lookup
2400
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net)
2400
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Global content delivery network (unpkg .com)
2400
msedge.exe
Potentially Bad Traffic
ET INFO Suspicious Domain (polyfill .io) in DNS Lookup
2400
msedge.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MDE_File_Sample_628262200e5aa807e6757db072484e02c81c8f0c.zip