File name:

Vega X Windows_40538334.exe

Full analysis: https://app.any.run/tasks/438256d3-6cd8-4d83-8624-0ec9d6f7b254
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: April 11, 2025, 21:05:55
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
generic
ossproxy
premieropinion
adware
relevantknowledge
stealer
opera
tool
pua
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

15D1C495FF66BF7CEA8A6D14BFDF0A20

SHA1:

942814521FA406A225522F208AC67F90DBDE0AE7

SHA256:

61C2C4A5D7C14F77EE88871DED4CC7F1E49DAE3E4EF209504C66FEDF4D22DE42

SSDEEP:

98304:DtjM+LgnHM8mNLNpOmMGl2p9tjIQh+1GHp8PGmDFzMVv3kdcpR41TBN14BC6SkPT:Kw8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GENERIC has been found (auto)

      • Vega X Windows_40538334.exe (PID: 7804)

    • OSSPROXY mutex has been found

      • ContentI3.exe (PID: 6156)
      • ContentI3.exe (PID: 1532)
      • pmropn.exe (PID: 6480)
      • pmropn32.exe (PID: 7348)
      • pmropn64.exe (PID: 6816)
      • firefox.exe (PID: 7740)
      • pmropn.exe (PID: 1804)
      • pmropn.exe (PID: 1568)
      • opera.exe (PID: 7852)
      • pmropn.exe (PID: 1300)

    • PREMIEROPINION mutex has been found

      • ContentI3.exe (PID: 6156)
      • pmropn.exe (PID: 6480)
      • ContentI3.exe (PID: 1532)
      • firefox.exe (PID: 7740)
      • pmropn.exe (PID: 1804)
      • pmropn.exe (PID: 1568)
      • opera.exe (PID: 7852)
      • pmropn.exe (PID: 1300)

    • RELEVANTKNOWLEDGE mutex has been found

      • rundll32.exe (PID: 7420)
      • pmropn.exe (PID: 6480)
      • pmropn.exe (PID: 1568)
      • pmropn32.exe (PID: 7348)
      • cmd.exe (PID: 4728)
      • Vega X Windows_40538334.exe (PID: 7804)
      • notepad.exe (PID: 7496)
      • firefox.exe (PID: 7740)
      • opera_crashreporter.exe (PID: 7908)
      • opera.exe (PID: 7584)
      • firefox.exe (PID: 3396)
      • installer.exe (PID: 6964)
      • installer.exe (PID: 1760)
      • setup.exe (PID: 6068)
      • opera_crashreporter.exe (PID: 2560)
      • setup.exe (PID: 2320)
      • firefox.exe (PID: 7992)
      • firefox.exe (PID: 2064)
      • opera.exe (PID: 7852)
      • dllhost.exe (PID: 3676)
      • setup.exe (PID: 8104)
      • firefox.exe (PID: 8148)
      • firefox.exe (PID: 456)
      • firefox.exe (PID: 7328)
      • setup.exe (PID: 8080)
      • firefox.exe (PID: 8084)
      • firefox.exe (PID: 5352)
      • firefox.exe (PID: 8248)
      • opera.exe (PID: 5988)
      • opera.exe (PID: 8672)
      • opera_gx_splash.exe (PID: 9160)
      • notepad.exe (PID: 5528)
      • opera_autoupdate.exe (PID: 8464)
      • opera_autoupdate.exe (PID: 8344)
      • installer.exe (PID: 8276)
      • opera_autoupdate.exe (PID: 1280)
      • installer.exe (PID: 4736)
      • opera_autoupdate.exe (PID: 8212)
      • powershell.exe (PID: 8436)

    • Application was injected by another process

      • svchost.exe (PID: 1260)

    • Runs injected code in another process

      • rundll32.exe (PID: 7420)

    • Actions looks like stealing of personal data

      • pmropn.exe (PID: 1568)
      • opera.exe (PID: 7852)

    • Change Internet Settings

      • pmropn.exe (PID: 1568)

    • Changes the autorun value in the registry

      • opera.exe (PID: 7852)

    • Steals credentials from Web Browsers

      • opera.exe (PID: 7852)
      • pmropn.exe (PID: 1568)

    • ADWARE has been detected (SURICATA)

      • pmropn.exe (PID: 1568)

    • OSSPROXY has been detected (SURICATA)

      • pmropn.exe (PID: 1568)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • OperaGX.exe (PID: 7996)
      • setup.exe (PID: 8080)
      • setup.exe (PID: 8104)
      • setup.exe (PID: 780)
      • Vega X Windows_40538334.exe (PID: 7804)
      • setup.exe (PID: 6068)
      • setup.exe (PID: 2320)
      • ContentI3.exe (PID: 6156)
      • pmropn.exe (PID: 6480)
      • Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (PID: 7880)
      • installer.exe (PID: 6964)
      • installer.exe (PID: 1760)
      • installer.exe (PID: 8276)
      • installer.exe (PID: 4736)
      • opera_autoupdate.exe (PID: 8212)
      • installer.exe (PID: 9376)
      • opera.exe (PID: 4944)

    • Starts itself from another location

      • setup.exe (PID: 8080)

    • Reads security settings of Internet Explorer

      • Vega X Windows_40538334.exe (PID: 7804)
      • setup.exe (PID: 8080)
      • ContentI3.exe (PID: 1532)
      • ContentI3.exe (PID: 6156)
      • pmropn.exe (PID: 6480)
      • pmropn.exe (PID: 1568)
      • installer.exe (PID: 6964)
      • pmropn.exe (PID: 1300)

    • Application launched itself

      • setup.exe (PID: 8080)
      • setup.exe (PID: 6068)
      • assistant_installer.exe (PID: 7236)
      • installer.exe (PID: 6964)
      • opera.exe (PID: 7852)
      • opera_autoupdate.exe (PID: 8344)
      • opera_autoupdate.exe (PID: 8212)
      • installer.exe (PID: 8276)

    • There is functionality for taking screenshot (YARA)

      • setup.exe (PID: 8080)
      • Vega X Windows_40538334.exe (PID: 7804)
      • setup.exe (PID: 8104)
      • setup.exe (PID: 6068)
      • setup.exe (PID: 2320)

    • Creates a software uninstall entry

      • pmropn.exe (PID: 6480)
      • pmservice.exe (PID: 7424)
      • ContentI3.exe (PID: 6156)
      • pmropn.exe (PID: 1568)
      • installer.exe (PID: 6964)

    • Adds/modifies Windows certificates

      • pmropn.exe (PID: 6480)
      • pmservice.exe (PID: 7424)

    • Executes as Windows Service

      • pmservice.exe (PID: 7424)

    • Searches for installed software

      • rundll32.exe (PID: 7420)
      • svchost.exe (PID: 1260)
      • pmservice.exe (PID: 7424)
      • pmropn.exe (PID: 6480)
      • reg.exe (PID: 7436)
      • ContentI3.exe (PID: 6156)
      • installer.exe (PID: 6964)
      • pmropn32.exe (PID: 7348)
      • pmropn64.exe (PID: 6816)
      • cmd.exe (PID: 4728)
      • notepad.exe (PID: 7496)
      • unsecapp.exe (PID: 6252)
      • opera_crashreporter.exe (PID: 7908)
      • Vega X Windows_40538334.exe (PID: 7804)
      • installer.exe (PID: 1760)
      • setup.exe (PID: 6068)
      • opera_crashreporter.exe (PID: 2560)
      • opera.exe (PID: 7584)
      • setup.exe (PID: 2320)
      • opera.exe (PID: 7852)
      • setup.exe (PID: 8080)
      • setup.exe (PID: 8104)
      • pmropn.exe (PID: 1804)
      • dllhost.exe (PID: 3676)
      • opera.exe (PID: 8672)
      • opera.exe (PID: 5988)
      • opera_gx_splash.exe (PID: 9160)
      • notepad.exe (PID: 5528)
      • opera.exe (PID: 9136)
      • opera.exe (PID: 8564)
      • opera.exe (PID: 7292)
      • opera.exe (PID: 9124)
      • opera.exe (PID: 9364)
      • pmropn.exe (PID: 1568)
      • CompPkgSrv.exe (PID: 8968)
      • opera_autoupdate.exe (PID: 8464)
      • opera_autoupdate.exe (PID: 1280)
      • installer.exe (PID: 8276)
      • opera_autoupdate.exe (PID: 8344)
      • installer.exe (PID: 4736)
      • pmropn.exe (PID: 1300)
      • opera.exe (PID: 6228)
      • opera_autoupdate.exe (PID: 8212)

    • Uses RUNDLL32.EXE to load library

      • pmservice.exe (PID: 7424)

    • Start notepad (likely ransomware note)

      • Vega X Windows_40538334.exe (PID: 7804)

    • Reads the date of Windows installation

      • installer.exe (PID: 6964)
      • opera.exe (PID: 7852)
      • pmropn.exe (PID: 1568)

    • Starts CMD.EXE for commands execution

      • pmservice.exe (PID: 7424)

    • Reads Microsoft Outlook installation path

      • pmropn.exe (PID: 1568)

    • Reads Internet Explorer settings

      • pmropn.exe (PID: 1568)

    • The process executes via Task Scheduler

      • opera_autoupdate.exe (PID: 8212)

    • The process checks if it is being run in the virtual environment

      • opera.exe (PID: 7852)

    • Reads Mozilla Firefox installation path

      • opera.exe (PID: 7852)

    • Potential Corporate Privacy Violation

      • pmropn.exe (PID: 1568)

    • Starts POWERSHELL.EXE for commands execution

      • pmropn.exe (PID: 1568)

    • Connects to unusual port

      • pmropn.exe (PID: 1568)

    • Reads the Windows owner or organization settings

      • pmropn.exe (PID: 1568)

  • INFO

    • Reads the machine GUID from the registry

      • Vega X Windows_40538334.exe (PID: 7804)
      • setup.exe (PID: 8080)
      • pmropn.exe (PID: 6480)
      • pmservice.exe (PID: 7424)
      • pmropn.exe (PID: 1568)
      • opera.exe (PID: 7852)
      • opera_autoupdate.exe (PID: 8344)
      • opera_autoupdate.exe (PID: 8464)
      • opera_autoupdate.exe (PID: 8212)
      • opera_autoupdate.exe (PID: 1280)
      • opera.exe (PID: 6228)

    • Reads the software policy settings

      • Vega X Windows_40538334.exe (PID: 7804)
      • setup.exe (PID: 8080)
      • pmropn.exe (PID: 6480)
      • pmservice.exe (PID: 7424)
      • pmropn.exe (PID: 1568)
      • slui.exe (PID: 7156)

    • Checks supported languages

      • Vega X Windows_40538334.exe (PID: 7804)
      • setup.exe (PID: 8080)
      • setup.exe (PID: 8104)
      • OperaGX.exe (PID: 7996)
      • setup.exe (PID: 6068)
      • setup.exe (PID: 780)
      • setup.exe (PID: 2320)
      • ContentI3.exe (PID: 1532)
      • ContentI3.exe (PID: 6156)
      • pmropn.exe (PID: 6480)
      • pmservice.exe (PID: 7424)
      • Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (PID: 7880)
      • assistant_installer.exe (PID: 7236)
      • assistant_installer.exe (PID: 7388)
      • pmropn.exe (PID: 1568)
      • installer.exe (PID: 6964)
      • pmropn32.exe (PID: 7348)
      • installer.exe (PID: 1760)
      • opera.exe (PID: 7584)
      • pmropn64.exe (PID: 6816)
      • opera_crashreporter.exe (PID: 7908)
      • opera.exe (PID: 7852)
      • opera_crashreporter.exe (PID: 2560)
      • pmropn.exe (PID: 1804)
      • opera.exe (PID: 8940)
      • opera.exe (PID: 8904)
      • opera.exe (PID: 5988)
      • opera.exe (PID: 8672)
      • opera.exe (PID: 8708)
      • opera.exe (PID: 8948)
      • opera.exe (PID: 8928)
      • opera_gx_splash.exe (PID: 9160)
      • opera.exe (PID: 8896)
      • opera.exe (PID: 8956)
      • opera.exe (PID: 6192)
      • opera.exe (PID: 4408)
      • opera.exe (PID: 2896)
      • opera.exe (PID: 8572)
      • opera.exe (PID: 8456)
      • opera.exe (PID: 8564)
      • opera.exe (PID: 7292)
      • opera.exe (PID: 9312)
      • opera.exe (PID: 9468)
      • opera.exe (PID: 9380)
      • opera.exe (PID: 9124)
      • opera.exe (PID: 9136)
      • opera.exe (PID: 9328)
      • opera.exe (PID: 9364)
      • opera.exe (PID: 8984)
      • opera.exe (PID: 9388)
      • opera.exe (PID: 9352)
      • opera.exe (PID: 6048)
      • installer.exe (PID: 8276)
      • opera.exe (PID: 9284)
      • opera.exe (PID: 8952)
      • opera.exe (PID: 9260)
      • opera.exe (PID: 8628)
      • opera.exe (PID: 6964)
      • opera.exe (PID: 9152)
      • opera.exe (PID: 8988)
      • opera.exe (PID: 8964)
      • opera.exe (PID: 8876)
      • opera_autoupdate.exe (PID: 8464)
      • opera.exe (PID: 8408)
      • opera.exe (PID: 9484)
      • opera.exe (PID: 8352)
      • opera.exe (PID: 8396)
      • opera.exe (PID: 8868)
      • opera.exe (PID: 9132)
      • opera.exe (PID: 8280)
      • opera_autoupdate.exe (PID: 8212)
      • opera.exe (PID: 8360)
      • opera_autoupdate.exe (PID: 8344)
      • opera_autoupdate.exe (PID: 1280)
      • opera.exe (PID: 9008)
      • installer.exe (PID: 4736)
      • opera.exe (PID: 8320)
      • opera.exe (PID: 7372)
      • opera.exe (PID: 2908)
      • opera.exe (PID: 9052)
      • opera.exe (PID: 7188)
      • opera.exe (PID: 9084)
      • opera.exe (PID: 9372)
      • opera.exe (PID: 10020)
      • opera.exe (PID: 2240)
      • installer.exe (PID: 9376)
      • opera.exe (PID: 8976)
      • opera.exe (PID: 8500)
      • opera.exe (PID: 8524)
      • opera.exe (PID: 9852)
      • opera.exe (PID: 9680)
      • opera.exe (PID: 9492)
      • opera.exe (PID: 9124)
      • opera.exe (PID: 9756)
      • opera.exe (PID: 10148)
      • opera.exe (PID: 8016)
      • opera.exe (PID: 10056)
      • opera.exe (PID: 7740)
      • opera.exe (PID: 9576)
      • opera.exe (PID: 8224)
      • opera.exe (PID: 10184)
      • opera.exe (PID: 8204)
      • opera.exe (PID: 9220)
      • opera.exe (PID: 10072)
      • opera.exe (PID: 7492)
      • opera.exe (PID: 8104)
      • opera.exe (PID: 8304)
      • opera.exe (PID: 8396)
      • opera.exe (PID: 7232)
      • opera.exe (PID: 9656)
      • opera.exe (PID: 7344)
      • opera.exe (PID: 8588)
      • opera.exe (PID: 9012)
      • pmropn.exe (PID: 1300)
      • opera.exe (PID: 8900)
      • opera.exe (PID: 2692)
      • opera.exe (PID: 4944)
      • opera.exe (PID: 8336)
      • opera.exe (PID: 6228)
      • opera.exe (PID: 3268)
      • opera.exe (PID: 456)

    • Creates files or folders in the user directory

      • Vega X Windows_40538334.exe (PID: 7804)
      • setup.exe (PID: 8080)
      • setup.exe (PID: 8104)
      • ContentI3.exe (PID: 6156)
      • ContentI3.exe (PID: 1532)
      • pmropn.exe (PID: 6480)
      • setup.exe (PID: 6068)
      • pmropn.exe (PID: 1568)
      • installer.exe (PID: 6964)
      • opera.exe (PID: 7852)
      • opera.exe (PID: 5988)
      • opera_autoupdate.exe (PID: 8212)

    • Create files in a temporary directory

      • OperaGX.exe (PID: 7996)
      • setup.exe (PID: 8104)
      • setup.exe (PID: 780)
      • setup.exe (PID: 8080)
      • setup.exe (PID: 6068)
      • setup.exe (PID: 2320)
      • Vega X Windows_40538334.exe (PID: 7804)
      • ContentI3.exe (PID: 6156)
      • Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (PID: 7880)
      • installer.exe (PID: 1760)
      • installer.exe (PID: 6964)
      • opera.exe (PID: 7852)
      • installer.exe (PID: 8276)
      • installer.exe (PID: 4736)
      • installer.exe (PID: 9376)
      • opera_autoupdate.exe (PID: 8212)

    • The sample compiled with english language support

      • OperaGX.exe (PID: 7996)
      • setup.exe (PID: 8080)
      • setup.exe (PID: 8104)
      • Vega X Windows_40538334.exe (PID: 7804)
      • setup.exe (PID: 6068)
      • setup.exe (PID: 2320)
      • setup.exe (PID: 780)
      • ContentI3.exe (PID: 6156)
      • pmropn.exe (PID: 6480)
      • Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (PID: 7880)
      • installer.exe (PID: 1760)
      • installer.exe (PID: 6964)
      • installer.exe (PID: 8276)
      • installer.exe (PID: 4736)
      • opera_autoupdate.exe (PID: 8212)
      • installer.exe (PID: 9376)
      • opera.exe (PID: 4944)

    • Reads the computer name

      • Vega X Windows_40538334.exe (PID: 7804)
      • setup.exe (PID: 8080)
      • setup.exe (PID: 6068)
      • ContentI3.exe (PID: 1532)
      • ContentI3.exe (PID: 6156)
      • pmropn.exe (PID: 6480)
      • pmservice.exe (PID: 7424)
      • assistant_installer.exe (PID: 7236)
      • pmropn.exe (PID: 1568)
      • installer.exe (PID: 6964)
      • opera.exe (PID: 7584)
      • opera.exe (PID: 7852)
      • opera.exe (PID: 8672)
      • opera.exe (PID: 5988)
      • opera_gx_splash.exe (PID: 9160)
      • opera.exe (PID: 9328)
      • opera.exe (PID: 9364)
      • opera_autoupdate.exe (PID: 8344)
      • opera_autoupdate.exe (PID: 8212)
      • installer.exe (PID: 8276)
      • pmropn.exe (PID: 1300)
      • opera.exe (PID: 6228)

    • Checks proxy server information

      • setup.exe (PID: 8080)
      • Vega X Windows_40538334.exe (PID: 7804)
      • pmropn.exe (PID: 6480)
      • pmropn.exe (PID: 1568)
      • opera_autoupdate.exe (PID: 8344)
      • opera_autoupdate.exe (PID: 8212)
      • slui.exe (PID: 7156)

    • Process checks computer location settings

      • Vega X Windows_40538334.exe (PID: 7804)
      • opera.exe (PID: 7852)
      • opera.exe (PID: 8956)
      • opera.exe (PID: 6192)
      • opera.exe (PID: 4408)
      • opera.exe (PID: 2896)
      • opera.exe (PID: 8456)
      • opera.exe (PID: 9312)
      • opera.exe (PID: 8572)
      • opera.exe (PID: 9388)
      • opera.exe (PID: 9576)
      • opera.exe (PID: 10056)
      • opera.exe (PID: 9380)
      • opera.exe (PID: 9352)
      • opera.exe (PID: 9468)
      • opera.exe (PID: 9008)
      • opera.exe (PID: 7372)
      • opera.exe (PID: 2240)
      • opera.exe (PID: 8204)
      • opera.exe (PID: 9220)
      • opera.exe (PID: 8016)
      • opera.exe (PID: 7344)

    • OSSPROXY has been detected

      • ContentI3.exe (PID: 6156)
      • pmservice.exe (PID: 7424)
      • cmd.exe (PID: 4728)
      • cmd.exe (PID: 4152)

    • Creates files in the program directory

      • ContentI3.exe (PID: 6156)
      • pmropn.exe (PID: 6480)
      • pmservice.exe (PID: 7424)
      • reg.exe (PID: 7436)
      • pmropn.exe (PID: 1568)
      • pmropn.exe (PID: 1300)

    • Reads security settings of Internet Explorer

      • notepad.exe (PID: 7496)
      • cmd.exe (PID: 4728)
      • cmd.exe (PID: 4152)
      • notepad.exe (PID: 5528)

    • Manual execution by a user

      • firefox.exe (PID: 3396)
      • opera.exe (PID: 7852)
      • notepad.exe (PID: 5528)

    • Application launched itself

      • firefox.exe (PID: 3396)
      • firefox.exe (PID: 7740)

    • Disables trace logs

      • pmropn.exe (PID: 1568)

    • Autorun file from Downloads

      • firefox.exe (PID: 7740)

    • OPERA mutex has been found

      • opera.exe (PID: 7852)
      • opera_autoupdate.exe (PID: 8344)
      • opera_autoupdate.exe (PID: 8212)

    • Reads CPU info

      • opera.exe (PID: 7852)

    • Reads Microsoft Office registry keys

      • pmropn.exe (PID: 1568)

    • Reads Windows Product ID

      • pmropn.exe (PID: 1568)

    • Reads product name

      • pmropn.exe (PID: 1568)

    • Reads Environment values

      • pmropn.exe (PID: 1568)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:10:18 17:00:18+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.22
CodeSize: 4353024
InitializedDataSize: 1675776
UninitializedDataSize: -
EntryPoint: 0x398c98
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Unknown (0)
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: Download Manager
FileVersion: 1
InternalName: Download Manager
LegalCopyright: Download Manager
OriginalFileName: Download Manager
ProductName: Download Manager
ProductVersion: 1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
413
Monitored processes
275
Malicious processes
49
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #RELEVANTKNOWLEDGE vega x windows_40538334.exe operagx.exe #RELEVANTKNOWLEDGE setup.exe #RELEVANTKNOWLEDGE setup.exe setup.exe #RELEVANTKNOWLEDGE setup.exe #RELEVANTKNOWLEDGE setup.exe #PREMIEROPINION contenti3.exe #PREMIEROPINION contenti3.exe #PREMIEROPINION pmropn.exe pmservice.exe #RELEVANTKNOWLEDGE rundll32.exe no specs reg.exe no specs conhost.exe no specs opera_gx_assistant_73.0.3856.382_setup.exe_sfx.exe assistant_installer.exe no specs assistant_installer.exe no specs #RELEVANTKNOWLEDGE pmropn.exe #RELEVANTKNOWLEDGE notepad.exe no specs #RELEVANTKNOWLEDGE installer.exe #RELEVANTKNOWLEDGE installer.exe slui.exe #RELEVANTKNOWLEDGE uiautomationcrossbitnesshook32 class no specs cmd.exe no specs #RELEVANTKNOWLEDGE cmd.exe no specs unsecapp.exe no specs pmropn64.exe no specs pmropn32.exe no specs pmropn32.exe no specs pmropn64.exe no specs #RELEVANTKNOWLEDGE opera.exe no specs #RELEVANTKNOWLEDGE pmropn32.exe no specs pmropn64.exe no specs #RELEVANTKNOWLEDGE firefox.exe no specs #PREMIEROPINION firefox.exe #RELEVANTKNOWLEDGE opera_crashreporter.exe no specs #RELEVANTKNOWLEDGE opera.exe #RELEVANTKNOWLEDGE opera_crashreporter.exe no specs #RELEVANTKNOWLEDGE firefox.exe no specs #RELEVANTKNOWLEDGE firefox.exe no specs checknetisolation.exe no specs conhost.exe no specs #PREMIEROPINION pmropn.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs #RELEVANTKNOWLEDGE firefox.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs #RELEVANTKNOWLEDGE firefox.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs #RELEVANTKNOWLEDGE firefox.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs #RELEVANTKNOWLEDGE firefox.exe no specs checknetisolation.exe no specs conhost.exe no specs #RELEVANTKNOWLEDGE firefox.exe no specs checknetisolation.exe no specs conhost.exe no specs #RELEVANTKNOWLEDGE firefox.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs #RELEVANTKNOWLEDGE opera.exe no specs #RELEVANTKNOWLEDGE opera.exe opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs #RELEVANTKNOWLEDGE opera_gx_splash.exe no specs #RELEVANTKNOWLEDGE notepad.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs comppkgsrv.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs #RELEVANTKNOWLEDGE opera_autoupdate.exe #RELEVANTKNOWLEDGE installer.exe #RELEVANTKNOWLEDGE opera_autoupdate.exe opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs #RELEVANTKNOWLEDGE opera_autoupdate.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs #RELEVANTKNOWLEDGE opera_autoupdate.exe no specs #RELEVANTKNOWLEDGE installer.exe opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs installer.exe opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs opera.exe no specs #PREMIEROPINION pmropn.exe #RELEVANTKNOWLEDGE powershell.exe no specs conhost.exe no specs opera.exe no specs opera.exe no specs opera.exe opera.exe no specs opera.exe no specs svchost.exe svchost.exe vega x windows_40538334.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
456"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2868 -childID 1 -isForBrowser -prefsHandle 2764 -prefMapHandle 2880 -prefsLen 31447 -prefMapSize 244583 -jsInitHandle 1484 -jsInitLen 235124 -parentBuildID 20240213221259 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a5d45da-4c28-4e0f-9f86-303042987afb} 7740 "\\.\pipe\gecko-crash-server-pipe.7740" 28a1539ef50 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
123.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\pmls64.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\psapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
456"C:\Users\admin\AppData\Local\Programs\Opera GX\opera.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --enable-quic --with-feature:cashback-assistant=on --with-feature:address-bar-dropdown-autocompleted-domains=off --with-feature:address-bar-dropdown-cities=off --with-feature:address-bar-dropdown-unfiltered-full=off --with-feature:ai-writing-mode-in-context-menu=on --with-feature:amazon-new-ids=on --with-feature:aria-in-tab-view=on --with-feature:cashback-assistant=on --with-feature:continue-on-booking=on --with-feature:continue-on-shopping-via-amp=off --with-feature:continue-shopping=on --with-feature:continue-shopping-2=on --with-feature:continue-shopping-5=on --with-feature:continue-shopping-amazon-us-associates=off --with-feature:continue-shopping-explore=off --with-feature:continue-shopping-structured-partners=on --with-feature:feature-remote-disable-updates-testing-flag=off --with-feature:feature-remote-updates-testing-flag=on --with-feature:game-servers=off --with-feature:gx-april1st=on --with-feature:gx-post-mortem=on --with-feature:gx-reactinator=on --with-feature:gx-spotlight=on --with-feature:gx-video-to-phone=on --with-feature:hide-navigations-from-extensions=on --with-feature:lucid-mode-hide-text=on --with-feature:panic-button=on --with-feature:password-generator=off --with-feature:play-again=on --with-feature:realtime-impressions-reporting=on --with-feature:run-at-startup-default=on --with-feature:sd-suggestions-external=on --with-feature:session-restore-attribution=on --with-feature:side-profiles=on --with-feature:sitecheck-age=on --with-feature:suggestion-redirect-handler=off --with-feature:tiktok-panel=on --with-feature:ui-compositor-multithreaded=on --with-feature:installer-experiment-test=off --ab_tests=GXCTest25-ref:DNA-99214_GXCTest25,GXCTest50-test:DNA-99214_GXCTest50 --field-trial-handle=11544,i,5303245342709050330,13071066554299605208,262144 --disable-features=CertificateTransparencyAskBeforeEnabling,PlatformSoftwareH264EncoderInGpu --variations-seed-version --mojo-platform-channel-handle=11920 /prefetch:8C:\Users\admin\AppData\Local\Programs\Opera GX\opera.exe—opera.exe
User:
admin
Company:
Opera Software
Integrity Level:
LOW
Description:
Opera GX Internet Browser
Exit code:
0
Version:
117.0.5408.213
Modules
Images
c:\users\admin\appdata\local\programs\opera gx\opera.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\programs\opera gx\117.0.5408.213\opera_elf.dll
c:\windows\system32\bcryptprimitives.dll
c:\windows\system32\winmm.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shcore.dll
c:\windows\system32\combase.dll
496CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.webpimageextension_8wekyb3d8bbweC:\Windows\SysWOW64\CheckNetIsolation.exe—pmropn.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
AppContainer Network Isolation Diagnostic Tool
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\checknetisolation.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
780"C:\Users\admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe" --versionC:\Users\admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\setup.exe
setup.exe
User:
admin
Company:
Opera Software
Integrity Level:
HIGH
Description:
Opera GX Installer
Exit code:
0
Version:
117.0.5408.213
Modules
Images
c:\users\admin\appdata\local\temp\.opera\opera gx installer temp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
856CheckNetIsolation.exe LoopbackExempt -a -n=c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewyC:\Windows\SysWOW64\CheckNetIsolation.exe—pmropn.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
AppContainer Network Isolation Diagnostic Tool
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\checknetisolation.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
976\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—CheckNetIsolation.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1260C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
1272\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—CheckNetIsolation.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1280"C:\Users\admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win64 --annotation=prod=OperaDesktopGX --annotation=ver=117.0.5408.213 --initial-client-data=0x228,0x22c,0x230,0x208,0x234,0x7ff70db7ee10,0x7ff70db7ee1c,0x7ff70db7ee28C:\Users\admin\AppData\Local\Programs\Opera GX\autoupdate\opera_autoupdate.exe
opera_autoupdate.exe
User:
admin
Company:
Opera Software
Integrity Level:
HIGH
Description:
Opera GX auto-updater
Exit code:
0
Version:
117.0.5408.213
Modules
Images
c:\users\admin\appdata\local\programs\opera gx\autoupdate\opera_autoupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1300CheckNetIsolation.exe LoopbackExempt -a -n=1527c705-839a-4832-9118-54d4bd6a0c89_cw5n1h2txyewyC:\Windows\SysWOW64\CheckNetIsolation.exe—pmropn.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
AppContainer Network Isolation Diagnostic Tool
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\checknetisolation.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
Total events
88 210
Read events
86 387
Write events
1 688
Delete events
135

Modification events

(PID) Process:(7804) Vega X Windows_40538334.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7804) Vega X Windows_40538334.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7804) Vega X Windows_40538334.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7804) Vega X Windows_40538334.exeKey:HKEY_CURRENT_USER\SOFTWARE\Opera
Operation:writeName:installed
Value:
1
(PID) Process:(8080) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(8080) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(8080) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6068) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Opera Software
Operation:writeName:Last Opera GX Stable Install Path
Value:
C:\Users\admin\AppData\Local\Programs\Opera GX\
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0CEC0B91-4AE9-4E8A-ACB2-3B4C811F442C}
Operation:writeName:DynamicInfo
Value:
0300000059EDC123AAB7D8014389D28525ABDB010000000000000000C772099125ABDB01
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\WindowsUpdate\RUXIM
Operation:writeName:SD
Value:
0100049C5C000000680000000000000014000000020048000300000000001400FF011F0001010000000000051200000000001400A900120001010000000000051300000000001800A900120001020000000000052000000020020000010100000000000512000000010100000000000512000000
Executable files
59
Suspicious files
1 128
Text files
702
Unknown types
1

Dropped files

PID
Process
Filename
Type
7804Vega X Windows_40538334.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:4A90329071AE30B759D279CCA342B0A6
SHA256:4F544379EDA8E2653F71472AB968AEFD6B5D1F4B3CE28A5EDB14196184ED3B60
7804Vega X Windows_40538334.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\logo[1].pngimage
MD5:2D4E9E8198F0C3EADE53C619CD1FE4EA
SHA256:C97E703578120C1F7A570ACAC3B461178A5E051CE16BE9E266C1789C1D610AC0
7804Vega X Windows_40538334.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:13EA1C0ED2D139F52CA3478A44D291B9
SHA256:AADB86F13BFC76E925D2AA40886B49DD51C88AF40C675297E51C2736853DE82B
7804Vega X Windows_40538334.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:9DFE47498377AF21E85AA10A35DA2AAC
SHA256:0BFCB68E3C88CDDBABD16C223E27E64E71B8F852B06CD1304E8E0766C66F1382
7804Vega X Windows_40538334.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517binary
MD5:335ECD2767DE00A47E0B3622E9D88604
SHA256:9F89BC9CC3B91531E8017821A6BEBEFC2CD65C757E2666563FBA4B4D0C2E63F2
7804Vega X Windows_40538334.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:4F7F27A1ED0D62C641A8E5C8E60337B2
SHA256:A18425010844489DCAE7EBC9362D7A83D93A673ED4BF08C160317D1D25C231C2
7804Vega X Windows_40538334.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517binary
MD5:CDF14E118F326A9D0A4A7A0E3EDE83F2
SHA256:FDD88B7092722C37284A6AD4E335E0BD9A6AFEAE1941036CBE21AF20753C5BEE
7804Vega X Windows_40538334.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\dpdv2[1].htmtext
MD5:68018D69618C49E637B89B29ABA61C43
SHA256:9ED1FCD42ABB01D8A47321650BEED55FB2A1DF6113E28986ED84E2CA2750CEFC
7804Vega X Windows_40538334.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DD2A7AB6E9F505401E82E727A63C7450_B73C7F9C4217B96C2B9DB7FC54C11C60binary
MD5:BF0EAE0E37CAE27D1DD9985B94A6C0AF
SHA256:E4E1999D44613D22E47120C3C240A949B52BF10D15D8C9232A57BCC035428BD8
7804Vega X Windows_40538334.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:1FBB37F79B317A9A248E7C4CE4F5BAC5
SHA256:9BF639C595FE335B6F694EE35990BEFD2123F5E07FD1973FF619E3FC88F5F49F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
85
TCP/UDP connections
332
DNS requests
204
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7804
Vega X Windows_40538334.exe
GET
200
142.250.185.67:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
—
—
whitelisted
7804
Vega X Windows_40538334.exe
GET
200
142.250.185.67:80
http://c.pki.goog/r/r1.crl
unknown
—
—
whitelisted
7804
Vega X Windows_40538334.exe
GET
200
142.250.185.67:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
7804
Vega X Windows_40538334.exe
GET
200
142.250.185.67:80
http://o.pki.goog/s/wr3/Vdw/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQSq0i5t2Pafi2Gw9uzwnc7KTctWgQUx4H1%2FY6I2QA8TWOiUDEkoM4j%2FiMCEFXcf42tINpLCbnQS8S2feE%3D
unknown
—
—
whitelisted
7804
Vega X Windows_40538334.exe
POST
200
165.193.78.234:80
http://post.securestudies.com/TapAction.aspx?campaign_id=1538&tpi=InstallUnion&action_id=0
unknown
—
—
malicious
8080
setup.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSnxLiz3Fu1WB6n1%2FE6xWn1b0jXiQQUdIWAwGbH3zfez70pN6oDHb7tzRcCEA17ZgsSl63KHstWnAbUez0%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7804
Vega X Windows_40538334.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
—
—
whitelisted
7804
Vega X Windows_40538334.exe
GET
200
142.250.185.67:80
http://o.pki.goog/s/wr3/mV0/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBQSq0i5t2Pafi2Gw9uzwnc7KTctWgQUx4H1%2FY6I2QA8TWOiUDEkoM4j%2FiMCEQCZXRxDEgK4oBBPRElcaU8c
unknown
—
—
whitelisted
7804
Vega X Windows_40538334.exe
GET
200
142.250.185.67:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4628
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7804
Vega X Windows_40538334.exe
35.190.60.70:443
www.dlsft.com
GOOGLE
US
whitelisted
7804
Vega X Windows_40538334.exe
142.250.185.67:80
ocsp.pki.goog
GOOGLE
US
whitelisted
7804
Vega X Windows_40538334.exe
104.21.80.1:443
filedm.com
CLOUDFLARENET
—
malicious
7804
Vega X Windows_40538334.exe
13.32.121.93:443
dpd.securestudies.com
AMAZON-02
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.180
  • 23.48.23.177
  • 23.48.23.164
  • 23.48.23.145
  • 23.48.23.156
  • 23.48.23.176
  • 23.48.23.141
  • 23.48.23.194
whitelisted
google.com
  • 142.250.186.142
whitelisted
www.dlsft.com
  • 35.190.60.70
unknown
ocsp.pki.goog
  • 142.250.185.67
whitelisted
c.pki.goog
  • 142.250.185.67
whitelisted
o.pki.goog
  • 142.250.185.67
whitelisted
dlsft.com
  • 35.190.60.70
unknown
filedm.com
  • 104.21.80.1
  • 104.21.32.1
  • 104.21.64.1
  • 104.21.96.1
  • 104.21.16.1
  • 104.21.112.1
  • 104.21.48.1
malicious
dpd.securestudies.com
  • 13.32.121.93
  • 13.32.121.27
  • 13.32.121.122
  • 13.32.121.51
whitelisted

Threats

PID
Process
Class
Message
1568
pmropn.exe
Potential Corporate Privacy Violation
ET ADWARE_PUP Suspected PUP/PUA User-Agent (OSSProxy)
1568
pmropn.exe
Potential Corporate Privacy Violation
ET ADWARE_PUP Suspected PUP/PUA User-Agent (OSSProxy)
1568
pmropn.exe
Potential Corporate Privacy Violation
ET ADWARE_PUP PUP/PUA OSSProxy HTTP Header
1568
pmropn.exe
Potential Corporate Privacy Violation
ET ADWARE_PUP PUP/PUA OSSProxy HTTP Header
1568
pmropn.exe
Potential Corporate Privacy Violation
ET ADWARE_PUP PUP/PUA OSSProxy HTTP Header
1568
pmropn.exe
Potential Corporate Privacy Violation
ET ADWARE_PUP PUP/PUA OSSProxy HTTP Header
1568
pmropn.exe
Potential Corporate Privacy Violation
ET ADWARE_PUP PUP/PUA OSSProxy HTTP Header
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Vega X Windows_40538334.exe