File name:

VolDrvConfig.exe

Full analysis: https://app.any.run/tasks/b863b446-2627-4f68-af25-ebc6dc82b22e
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: October 21, 2024, 11:09:55
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
phorpiex
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

A318CC45E79498B93E40D5E5B9B76BE4

SHA1:

4EBC9969CC3C330741C377E22A5FB0CDB8CE5FD5

SHA256:

4B4E596641D0DD9EECE8A24556FD1246056CBC315A79675A7400927858BBD7C2

SSDEEP:

3072:RT/hMNfDU6NP/mAyp/8+62bSKI2agz1anQL5lJcVbxEIiZ9dAfAYfWBkgFHKs5Jk:7RmqK+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • VolDrvConfig.exe (PID: 1196)

    • Changes Security Center notification settings

      • syslmgrsvc.exe (PID: 6256)

    • PHORPIEX has been detected (SURICATA)

      • syslmgrsvc.exe (PID: 6256)

    • Changes the Windows auto-update feature

      • syslmgrsvc.exe (PID: 6256)

    • Changes appearance of the Explorer extensions

      • syslmgrsvc.exe (PID: 6256)

    • PHORPIEX has been detected (YARA)

      • syslmgrsvc.exe (PID: 6256)

    • Connects to the CnC server

      • syslmgrsvc.exe (PID: 6256)
      • dwm.exe (PID: 4004)

    • MINER has been detected (SURICATA)

      • dwm.exe (PID: 4004)

  • SUSPICIOUS

    • Starts itself from another location

      • VolDrvConfig.exe (PID: 1196)

    • Executable content was dropped or overwritten

      • VolDrvConfig.exe (PID: 1196)
      • 981114858.exe (PID: 6296)
      • 1331410950.exe (PID: 6412)
      • winupsecvmgr.exe (PID: 3128)

    • Starts CMD.EXE for commands execution

      • 2703432174.exe (PID: 5892)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 6548)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 4448)

    • Connects to unusual port

      • syslmgrsvc.exe (PID: 6256)

    • Potential Corporate Privacy Violation

      • 981114858.exe (PID: 6296)
      • dwm.exe (PID: 4004)

    • Connects to the server without a host name

      • syslmgrsvc.exe (PID: 6256)
      • 981114858.exe (PID: 6296)

    • Process requests binary or script from the Internet

      • 981114858.exe (PID: 6296)

    • Drops a system driver (possible attempt to evade defenses)

      • winupsecvmgr.exe (PID: 3128)

    • Crypto Currency Mining Activity Detected

      • dwm.exe (PID: 4004)

  • INFO

    • The process uses the downloaded file

      • syslmgrsvc.exe (PID: 6256)
      • VolDrvConfig.exe (PID: 1196)

    • Checks supported languages

      • syslmgrsvc.exe (PID: 6256)
      • VolDrvConfig.exe (PID: 1196)

    • Manual execution by a user

      • reg.exe (PID: 2796)
      • winupsecvmgr.exe (PID: 3128)
      • conhost.exe (PID: 4816)
      • reg.exe (PID: 2364)
      • dwm.exe (PID: 4004)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:05:14 07:56:17+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 59904
InitializedDataSize: 38912
UninitializedDataSize: -
EntryPoint: 0x7500
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
21
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start voldrvconfig.exe #PHORPIEX syslmgrsvc.exe 2703432174.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs schtasks.exe no specs sppextcomobj.exe no specs slui.exe no specs 1162623644.exe no specs 981114858.exe 1331410950.exe reg.exe no specs conhost.exe no specs winupsecvmgr.exe reg.exe no specs conhost.exe no specs conhost.exe no specs #MINER dwm.exe

Process information

PID
CMD
Path
Indicators
Parent process
1112\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1196"C:\Users\admin\AppData\Local\Temp\VolDrvConfig.exe" C:\Users\admin\AppData\Local\Temp\VolDrvConfig.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\voldrvconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
2364C:\WINDOWS\System32\reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Microsoft Windows Security" /t REG_SZ /f /d "C:\Users\admin\Microsoft Windows Security\winupsecvmgr.exe"C:\Windows\System32\reg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
2576"C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"C:\Windows\System32\cmd.exe—2703432174.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
2796C:\WINDOWS\System32\reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Microsoft Windows Security" /t REG_SZ /f /d "C:\Users\admin\Microsoft Windows Security\winupsecvmgr.exe"C:\Windows\System32\reg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
2816\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—reg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3000C:\Users\admin\AppData\Local\Temp\1162623644.exeC:\Users\admin\AppData\Local\Temp\1162623644.exe—syslmgrsvc.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\1162623644.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
3128C:\Users\admin\Microsoft Windows Security\winupsecvmgr.exeC:\Users\admin\Microsoft Windows Security\winupsecvmgr.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\microsoft windows security\winupsecvmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
4004C:\WINDOWS\System32\dwm.exeC:\Windows\System32\dwm.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Desktop Window Manager
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\jacrzswcvuml.tmp
c:\windows\system32\dwm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\psapi.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\ucrtbase.dll
4144"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
3 353
Read events
3 322
Write events
19
Delete events
12

Modification events

(PID) Process:(1196) VolDrvConfig.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Windows Settings
Value:
C:\Users\admin\syslmgrsvc.exe
(PID) Process:(6256) syslmgrsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
Operation:writeName:DisableWindowsUpdateAccess
Value:
1
(PID) Process:(6256) syslmgrsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
Operation:writeName:NoAutoUpdate
Value:
1
(PID) Process:(6256) syslmgrsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
Operation:writeName:CheckedValue
Value:
0
(PID) Process:(6256) syslmgrsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:FirewallOverride
Value:
1
(PID) Process:(6256) syslmgrsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:FirewallDisableNotify
Value:
1
(PID) Process:(6256) syslmgrsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:AntiSpywareOverride
Value:
1
(PID) Process:(6256) syslmgrsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:AntiVirusOverride
Value:
1
(PID) Process:(6256) syslmgrsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:AntiVirusDisableNotify
Value:
1
(PID) Process:(6256) syslmgrsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center
Operation:writeName:UpdatesOverride
Value:
1
Executable files
7
Suspicious files
13
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
6256syslmgrsvc.exeC:\Users\admin\AppData\Local\Temp\864616981.exebinary
MD5:1FCB78FB6CF9720E9D9494C42142D885
SHA256:84652BB8C63CA4FD7EB7A2D6EF44029801F3057AA2961867245A3A765928DD02
6256syslmgrsvc.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\1[1]binary
MD5:1FCB78FB6CF9720E9D9494C42142D885
SHA256:84652BB8C63CA4FD7EB7A2D6EF44029801F3057AA2961867245A3A765928DD02
1196VolDrvConfig.exeC:\Users\admin\syslmgrsvc.exeexecutable
MD5:A318CC45E79498B93E40D5E5B9B76BE4
SHA256:4B4E596641D0DD9EECE8A24556FD1246056CBC315A79675A7400927858BBD7C2
6256syslmgrsvc.exeC:\Users\admin\AppData\Local\Temp\120044653.exebinary
MD5:1FCB78FB6CF9720E9D9494C42142D885
SHA256:84652BB8C63CA4FD7EB7A2D6EF44029801F3057AA2961867245A3A765928DD02
6256syslmgrsvc.exeC:\Users\admin\tbtnds.datbinary
MD5:24E32C48062C631414883E6F4D9A9AEC
SHA256:6B7B4FB1FC19912ED18051A55C8628C2812C2C1A8029274C5C2CAB5A8CBC31F3
6256syslmgrsvc.exeC:\Users\admin\AppData\Local\Temp\1162623644.exebinary
MD5:1568EFB715BD9797610F55AA48DFB18E
SHA256:F42EF51C4C7C8F607A0405848593369BFC193B771E8ED687540632CAD1376216
6256syslmgrsvc.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\4[1]binary
MD5:2266F0AECD351E1B4092E82B941211EA
SHA256:CBBAD0AB02CD973C9C4E73336E3BCD0849AEB2232A7BDBC38F0B50696B5C28C3
6256syslmgrsvc.exeC:\Users\admin\AppData\Local\Temp\189745867.exebinary
MD5:1FCB78FB6CF9720E9D9494C42142D885
SHA256:84652BB8C63CA4FD7EB7A2D6EF44029801F3057AA2961867245A3A765928DD02
6256syslmgrsvc.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\3[1]binary
MD5:1568EFB715BD9797610F55AA48DFB18E
SHA256:F42EF51C4C7C8F607A0405848593369BFC193B771E8ED687540632CAD1376216
6256syslmgrsvc.exeC:\Users\admin\AppData\Local\Temp\981114858.exebinary
MD5:2266F0AECD351E1B4092E82B941211EA
SHA256:CBBAD0AB02CD973C9C4E73336E3BCD0849AEB2232A7BDBC38F0B50696B5C28C3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
19
TCP/UDP connections
77
DNS requests
23
Threats
29

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6944
svchost.exe
GET
200
23.36.225.233:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6256
syslmgrsvc.exe
GET
—
185.215.113.66:80
http://185.215.113.66/1
unknown
—
—
malicious
6256
syslmgrsvc.exe
GET
200
185.215.113.66:80
http://185.215.113.66/1
unknown
—
—
malicious
5600
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6256
syslmgrsvc.exe
GET
200
185.215.113.66:80
http://185.215.113.66/2
unknown
—
—
malicious
6256
syslmgrsvc.exe
GET
200
185.215.113.66:80
http://185.215.113.66/1
unknown
—
—
malicious
3764
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6900
SIHClient.exe
GET
200
23.36.225.233:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
6944
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3952
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5488
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.23.209.137:443
—
Akamai International B.V.
GB
unknown
6944
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6944
svchost.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
6944
svchost.exe
23.36.225.233:80
www.microsoft.com
AKAMAI-AS
CH
whitelisted
6256
syslmgrsvc.exe
185.215.113.66:80
—
1337team Limited
SC
malicious
5488
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
  • 51.104.136.2
  • 51.124.78.146
whitelisted
google.com
  • 142.250.181.238
whitelisted
crl.microsoft.com
  • 2.16.164.49
whitelisted
www.microsoft.com
  • 23.36.225.233
whitelisted
login.live.com
  • 20.190.159.68
  • 20.190.159.23
  • 20.190.159.4
  • 20.190.159.64
  • 20.190.159.2
  • 40.126.31.69
  • 40.126.31.67
  • 20.190.159.73
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
th.bing.com
  • 2.23.209.164
  • 2.23.209.171
  • 2.23.209.160
  • 2.23.209.157
  • 2.23.209.168
  • 2.23.209.169
  • 2.23.209.162
  • 2.23.209.158
  • 2.23.209.170
whitelisted
www.bing.com
  • 2.23.209.164
  • 2.23.209.171
  • 2.23.209.160
  • 2.23.209.157
  • 2.23.209.168
  • 2.23.209.169
  • 2.23.209.162
  • 2.23.209.158
  • 2.23.209.170
whitelisted
go.microsoft.com
  • 23.32.113.166
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted

Threats

PID
Process
Class
Message
6256
syslmgrsvc.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 32
—
—
A Network Trojan was detected
ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC
6296
981114858.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 32
6296
981114858.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
6256
syslmgrsvc.exe
A Network Trojan was detected
ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC
6296
981114858.exe
Misc activity
ET INFO Packed Executable Download
6296
981114858.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
6296
981114858.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
6256
syslmgrsvc.exe
A Network Trojan was detected
ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC
6256
syslmgrsvc.exe
A Network Trojan was detected
ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC
16 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
VolDrvConfig.exe