File name:

bytebreaker.cc Exploit_12633821.exe

Full analysis: https://app.any.run/tasks/9f019ff3-bd82-4f96-bda2-7695caa8f9d7
Verdict: Malicious activity
Analysis date: February 09, 2025, 18:44:32
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
auto
generic
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

15D1C495FF66BF7CEA8A6D14BFDF0A20

SHA1:

942814521FA406A225522F208AC67F90DBDE0AE7

SHA256:

61C2C4A5D7C14F77EE88871DED4CC7F1E49DAE3E4EF209504C66FEDF4D22DE42

SSDEEP:

98304:DtjM+LgnHM8mNLNpOmMGl2p9tjIQh+1GHp8PGmDFzMVv3kdcpR41TBN14BC6SkPT:Kw8

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • GENERIC has been found (auto)

      • bytebreaker.cc Exploit_12633821.exe (PID: 6320)

    • PREMIEROPINION mutex has been found

      • ContentI3.exe (PID: 6596)

    • OSSPROXY mutex has been found

      • ContentI3.exe (PID: 6596)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • bytebreaker.cc Exploit_12633821.exe (PID: 6320)
      • OperaGX.exe (PID: 6864)
      • setup.exe (PID: 6920)
      • setup.exe (PID: 7008)
      • setup.exe (PID: 6896)
      • setup.exe (PID: 7044)
      • setup.exe (PID: 7100)
      • Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (PID: 4392)

    • Application launched itself

      • setup.exe (PID: 6896)
      • setup.exe (PID: 7044)
      • assistant_installer.exe (PID: 6712)

    • Checks Windows Trust Settings

      • bytebreaker.cc Exploit_12633821.exe (PID: 6320)
      • setup.exe (PID: 6896)

    • Reads security settings of Internet Explorer

      • bytebreaker.cc Exploit_12633821.exe (PID: 6320)
      • setup.exe (PID: 6896)
      • ContentI3.exe (PID: 6596)

    • Starts itself from another location

      • setup.exe (PID: 6896)

  • INFO

    • The sample compiled with english language support

      • bytebreaker.cc Exploit_12633821.exe (PID: 6320)
      • OperaGX.exe (PID: 6864)
      • setup.exe (PID: 6896)
      • setup.exe (PID: 7008)
      • setup.exe (PID: 7044)
      • setup.exe (PID: 7100)
      • setup.exe (PID: 6920)
      • Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (PID: 4392)

    • Reads the computer name

      • bytebreaker.cc Exploit_12633821.exe (PID: 6320)
      • setup.exe (PID: 7044)
      • setup.exe (PID: 6896)
      • assistant_installer.exe (PID: 6712)
      • ContentI3.exe (PID: 6596)

    • Reads the machine GUID from the registry

      • bytebreaker.cc Exploit_12633821.exe (PID: 6320)
      • setup.exe (PID: 6896)

    • Creates files or folders in the user directory

      • bytebreaker.cc Exploit_12633821.exe (PID: 6320)
      • setup.exe (PID: 6920)
      • setup.exe (PID: 6896)
      • setup.exe (PID: 7044)
      • ContentI3.exe (PID: 6596)

    • Checks supported languages

      • bytebreaker.cc Exploit_12633821.exe (PID: 6320)
      • OperaGX.exe (PID: 6864)
      • setup.exe (PID: 6920)
      • setup.exe (PID: 6896)
      • setup.exe (PID: 7044)
      • setup.exe (PID: 7100)
      • Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (PID: 4392)
      • setup.exe (PID: 7008)
      • assistant_installer.exe (PID: 6712)
      • ContentI3.exe (PID: 6596)
      • assistant_installer.exe (PID: 6736)

    • Checks proxy server information

      • bytebreaker.cc Exploit_12633821.exe (PID: 6320)
      • setup.exe (PID: 6896)

    • Reads the software policy settings

      • bytebreaker.cc Exploit_12633821.exe (PID: 6320)
      • setup.exe (PID: 6896)

    • Create files in a temporary directory

      • OperaGX.exe (PID: 6864)
      • setup.exe (PID: 6896)
      • setup.exe (PID: 6920)
      • setup.exe (PID: 7008)
      • setup.exe (PID: 7044)
      • setup.exe (PID: 7100)
      • bytebreaker.cc Exploit_12633821.exe (PID: 6320)
      • Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe (PID: 4392)

    • Process checks computer location settings

      • bytebreaker.cc Exploit_12633821.exe (PID: 6320)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:10:18 17:00:18+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.22
CodeSize: 4353024
InitializedDataSize: 1675776
UninitializedDataSize: -
EntryPoint: 0x398c98
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Unknown (0)
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: Download Manager
FileVersion: 1
InternalName: Download Manager
LegalCopyright: Download Manager
OriginalFileName: Download Manager
ProductName: Download Manager
ProductVersion: 1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
13
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start bytebreaker.cc exploit_12633821.exe operagx.exe setup.exe setup.exe setup.exe setup.exe setup.exe opera_gx_assistant_73.0.3856.382_setup.exe_sfx.exe assistant_installer.exe assistant_installer.exe no specs #PREMIEROPINION contenti3.exe svchost.exe bytebreaker.cc exploit_12633821.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4392"C:\Users\admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202502091844531\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe"C:\Users\admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202502091844531\assistant\Opera_GX_assistant_73.0.3856.382_Setup.exe_sfx.exe
setup.exe
User:
admin
Integrity Level:
HIGH
Description:
Opera installer SFX
Exit code:
0
Version:
73.0.3856.382
Modules
Images
c:\users\admin\appdata\local\temp\.opera\opera gx installer temp\opera_package_202502091844531\assistant\opera_gx_assistant_73.0.3856.382_setup.exe_sfx.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shell32.dll
6184"C:\Users\admin\AppData\Local\Temp\bytebreaker.cc Exploit_12633821.exe" C:\Users\admin\AppData\Local\Temp\bytebreaker.cc Exploit_12633821.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Download Manager
Exit code:
3221226540
Version:
1
Modules
Images
c:\users\admin\appdata\local\temp\bytebreaker.cc exploit_12633821.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6320"C:\Users\admin\AppData\Local\Temp\bytebreaker.cc Exploit_12633821.exe" C:\Users\admin\AppData\Local\Temp\bytebreaker.cc Exploit_12633821.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Download Manager
Version:
1
Modules
Images
c:\users\admin\appdata\local\temp\bytebreaker.cc exploit_12633821.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6596"C:\Users\admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe" -c:1538 -t:InstallUnionC:\Users\admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
bytebreaker.cc Exploit_12633821.exe
User:
admin
Company:
VoiceFive Networks, Inc.
Integrity Level:
HIGH
Description:
PremierOpinion Installer
Exit code:
0
Version:
1.0.8.1 (Build 1)
Modules
Images
c:\users\admin\appdata\local\temp\premieropinion\contenti3.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6712"C:\Users\admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202502091844531\assistant\assistant_installer.exe" --versionC:\Users\admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202502091844531\assistant\assistant_installer.exe
setup.exe
User:
admin
Company:
Opera Software
Integrity Level:
HIGH
Description:
Opera GX Browser Assistant Installer
Exit code:
0
Version:
73.0.3856.382
Modules
Images
c:\users\admin\appdata\local\temp\.opera\opera gx installer temp\opera_package_202502091844531\assistant\assistant_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6736"C:\Users\admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202502091844531\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=73.0.3856.382 --initial-client-data=0x2a4,0x2a8,0x2ac,0x280,0x2b0,0x354f48,0x354f58,0x354f64C:\Users\admin\AppData\Local\Temp\.opera\Opera GX Installer Temp\opera_package_202502091844531\assistant\assistant_installer.exe—assistant_installer.exe
User:
admin
Company:
Opera Software
Integrity Level:
HIGH
Description:
Opera GX Browser Assistant Installer
Exit code:
0
Version:
73.0.3856.382
Modules
Images
c:\users\admin\appdata\local\temp\.opera\opera gx installer temp\opera_package_202502091844531\assistant\assistant_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6864C:\Users\admin\AppData\Local\OperaGX.exe --silent --allusers=0C:\Users\admin\AppData\Local\OperaGX.exe
bytebreaker.cc Exploit_12633821.exe
User:
admin
Integrity Level:
HIGH
Description:
Opera installer SFX
Version:
116.0.5366.103
Modules
Images
c:\users\admin\appdata\local\operagx.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6896C:\Users\admin\AppData\Local\Temp\7zS0DAEC1E3\setup.exe --silent --allusers=0 --server-tracking-blob=MGFkYzI2N2UwMTkxNmIyN2Q0YmYzZmUwNmQ1OWI3ZDhhZTZmNzk5ZDdlM2VmYjBlMjRmYmFlN2I3ODBhZWVmMzp7ImNvdW50cnkiOiJERSIsImVkaXRpb24iOiJzdGQtMiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFHWFNldHVwLmV4ZSIsInByb2R1Y3QiOiJvcGVyYV9neCIsInF1ZXJ5IjoiL29wZXJhX2d4L3N0YWJsZS9lZGl0aW9uL3N0ZC0yP3V0bV9zb3VyY2U9UFdOZ2FtZXMmdXRtX21lZGl1bT1wYSZ1dG1fY2FtcGFpZ249UFdOX0RFX1BCNV85NDE2XzM1NzUmdXRtX2lkPTBjZjAyOGMzMWMxMjQ0MDM4MzBiMDAxOWVhMjdmZDY4IiwidGltZXN0YW1wIjoiMTczOTEyNjY5MC41MDAwIiwidXNlcmFnZW50IjoiTW96aWxsYS80LjAgKGNvbXBhdGlibGU7IE1TSUUgNy4wOyBXaW5kb3dzIE5UIDYuMjsgV09XNjQ7IFRyaWRlbnQvNy4wOyAuTkVUNC4wQzsgLk5FVDQuMEU7IC5ORVQgQ0xSIDIuMC41MDcyNzsgLk5FVCBDTFIgMy4wLjMwNzI5OyAuTkVUIENMUiAzLjUuMzA3MjkpIiwidXRtIjp7ImNhbXBhaWduIjoiUFdOX0RFX1BCNV85NDE2XzM1NzUiLCJpZCI6IjBjZjAyOGMzMWMxMjQ0MDM4MzBiMDAxOWVhMjdmZDY4IiwibWVkaXVtIjoicGEiLCJzb3VyY2UiOiJQV05nYW1lcyJ9LCJ1dWlkIjoiMGJjYWI3NGItYTNiYS00YjFhLWFjNDgtZTEwMWZlMmZjYzNkIn0=C:\Users\admin\AppData\Local\Temp\7zS0DAEC1E3\setup.exe
OperaGX.exe
User:
admin
Company:
Opera Software
Integrity Level:
HIGH
Description:
Opera GX Installer
Version:
116.0.5366.103
Modules
Images
c:\users\admin\appdata\local\temp\7zs0daec1e3\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
6920C:\Users\admin\AppData\Local\Temp\7zS0DAEC1E3\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Roaming\Opera Software\Opera GX Stable\Crash Reports" "--crash-count-file=C:\Users\admin\AppData\Roaming\Opera Software\Opera GX Stable\crash_count.txt" --url=https://crashstats-collector-2.opera.com/ --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktopGX --annotation=ver=116.0.5366.103 --initial-client-data=0x32c,0x330,0x334,0x308,0x338,0x71be300c,0x71be3018,0x71be3024C:\Users\admin\AppData\Local\Temp\7zS0DAEC1E3\setup.exe
setup.exe
User:
admin
Company:
Opera Software
Integrity Level:
HIGH
Description:
Opera GX Installer
Version:
116.0.5366.103
Modules
Images
c:\users\admin\appdata\local\temp\7zs0daec1e3\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
Total events
7 436
Read events
7 416
Write events
18
Delete events
2

Modification events

(PID) Process:(6320) bytebreaker.cc Exploit_12633821.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6320) bytebreaker.cc Exploit_12633821.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6320) bytebreaker.cc Exploit_12633821.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6320) bytebreaker.cc Exploit_12633821.exeKey:HKEY_CURRENT_USER\SOFTWARE\Opera
Operation:writeName:installed
Value:
1
(PID) Process:(6896) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6896) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6896) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7044) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Opera Software
Operation:writeName:Last Opera GX Stable Install Path
Value:
C:\Users\admin\AppData\Local\Programs\Opera GX\
(PID) Process:(6320) bytebreaker.cc Exploit_12633821.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\InstallUnion\1538
Operation:writeName:BundleOfferActionUid
Value:
qE2Aawm_QDsaO10rT55555
(PID) Process:(6320) bytebreaker.cc Exploit_12633821.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\InstallUnion\1538
Operation:writeName:dt_age
Value:
1
Executable files
17
Suspicious files
48
Text files
13
Unknown types
0

Dropped files

PID
Process
Filename
Type
6320bytebreaker.cc Exploit_12633821.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:A2AF0C53E5EAA5F2DE32D74B9F34D259
SHA256:C6DC96C138BD731A05FC0B020EAAF2D70285A7E2C9A43FEDDBFFB4203AEFFD3B
6320bytebreaker.cc Exploit_12633821.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C2C9D7FCC58B6FD9BF152E66809C1BBE_9962014287DF49023620C3F0C27B8ACEbinary
MD5:6FA696E9B12D7B375A94320660FEE26B
SHA256:370FE589348211626B8B2BB0503C66D4A21BDFD430F0569E9287178A29FF190B
6320bytebreaker.cc Exploit_12633821.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\service[1].htmtext
MD5:1894A65D335B50555DAE4F84DFC3D19C
SHA256:B70098A064973CA926DBF950F5320E696A894EB88E81E2059D8547E9966CCDAC
6320bytebreaker.cc Exploit_12633821.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\923CD0F3EDBB3759A875E7FE664C6C90_E177412028F15791C29E67CACD8927FCbinary
MD5:53D1D70D928A5A5F1938BA3F97102707
SHA256:738166E3C800F8B8317CAD076B3574CB891F235860A30DB6BB4F76A98304EAEB
6320bytebreaker.cc Exploit_12633821.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C2C9D7FCC58B6FD9BF152E66809C1BBE_9962014287DF49023620C3F0C27B8ACEbinary
MD5:8A42BA5FC10C31769D97C1C3EB8DC434
SHA256:8B634DF94073701A1A8A5BCD84B702C0EFC3429E36BF0EADE8BE6A0C8CEEA172
6320bytebreaker.cc Exploit_12633821.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_645BC4A49DCDC40FE5917FA45C6D4517binary
MD5:D119897FBDDDB080405A20C79718FBF6
SHA256:4013C873FCE99E8A978679B1B5EEFEC8AF4CA9927B674657315278087FF630C3
6320bytebreaker.cc Exploit_12633821.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\E4DJRUXW\logo[1].pngimage
MD5:2D4E9E8198F0C3EADE53C619CD1FE4EA
SHA256:C97E703578120C1F7A570ACAC3B461178A5E051CE16BE9E266C1789C1D610AC0
6320bytebreaker.cc Exploit_12633821.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:2210D281C7E81480AE9F7BAAC3290874
SHA256:3D7CFB1724055E7C8EF758FCF4B039D2BC506BA7D12E8172F0A375C3FB201A88
6320bytebreaker.cc Exploit_12633821.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:1ADD356FABA5A9EADD0891F092E2BB3E
SHA256:16F36AEC287B23C934F38F49E3BB40746B6230C65417AD671969E2A67C53B22F
6320bytebreaker.cc Exploit_12633821.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_B7ED31D77D311A56FDCB56A0083B3E0Bbinary
MD5:34E32028CC5D70E1374D6C6E0FC7CAFC
SHA256:CB1CAB4018A94D6ECA790E1C4F4B687C280EBF0914D8D1F7BE17556985E5FC95
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
27
TCP/UDP connections
57
DNS requests
33
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6320
bytebreaker.cc Exploit_12633821.exe
GET
200
142.250.184.227:80
http://c.pki.goog/r/r1.crl
unknown
—
—
whitelisted
6320
bytebreaker.cc Exploit_12633821.exe
GET
200
142.250.184.227:80
http://o.pki.goog/s/wr3/URM/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQSq0i5t2Pafi2Gw9uzwnc7KTctWgQUx4H1%2FY6I2QA8TWOiUDEkoM4j%2FiMCEFET1OsgXJOMCsceBPevDRA%3D
unknown
—
—
whitelisted
6320
bytebreaker.cc Exploit_12633821.exe
GET
200
142.250.184.227:80
http://o.pki.goog/s/wr3/fgA/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQSq0i5t2Pafi2Gw9uzwnc7KTctWgQUx4H1%2FY6I2QA8TWOiUDEkoM4j%2FiMCEH4AzC8CtsuHCuCmoKpV7Vk%3D
unknown
—
—
whitelisted
6320
bytebreaker.cc Exploit_12633821.exe
GET
200
142.250.184.227:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6320
bytebreaker.cc Exploit_12633821.exe
GET
200
142.250.184.227:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
6320
bytebreaker.cc Exploit_12633821.exe
GET
200
18.245.38.41:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkzUBtJnwJkc3SmanzgxeYU%3D
unknown
—
—
whitelisted
6320
bytebreaker.cc Exploit_12633821.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAsA6S1NbXMfyjBZx8seGIY%3D
unknown
—
—
whitelisted
6320
bytebreaker.cc Exploit_12633821.exe
POST
200
165.193.78.234:80
http://post.securestudies.com/TapAction.aspx?campaign_id=1538&tpi=InstallUnion&action_id=1&uid=qE2Aawm_QDsaO10rT55555
unknown
—
—
malicious
6320
bytebreaker.cc Exploit_12633821.exe
POST
200
165.193.78.234:80
http://post.securestudies.com/TapAction.aspx?campaign_id=1538&tpi=InstallUnion&action_id=0
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
6076
svchost.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6320
bytebreaker.cc Exploit_12633821.exe
35.190.60.70:443
www.dlsft.com
GOOGLE
US
whitelisted
6320
bytebreaker.cc Exploit_12633821.exe
142.250.184.227:80
ocsp.pki.goog
GOOGLE
US
whitelisted
6320
bytebreaker.cc Exploit_12633821.exe
104.21.96.1:443
filedm.com
CLOUDFLARENET
—
malicious
1076
svchost.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
1176
svchost.exe
40.126.31.129:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
6320
bytebreaker.cc Exploit_12633821.exe
13.32.121.122:443
dpd.securestudies.com
AMAZON-02
US
whitelisted

DNS requests

Domain
IP
Reputation
www.dlsft.com
  • 35.190.60.70
unknown
ocsp.pki.goog
  • 142.250.184.227
whitelisted
c.pki.goog
  • 142.250.184.227
whitelisted
o.pki.goog
  • 142.250.184.227
whitelisted
dlsft.com
  • 35.190.60.70
unknown
filedm.com
  • 104.21.96.1
  • 104.21.16.1
  • 104.21.32.1
  • 104.21.48.1
  • 104.21.112.1
  • 104.21.80.1
  • 104.21.64.1
malicious
go.microsoft.com
  • 23.35.238.131
whitelisted
login.live.com
  • 40.126.31.129
  • 20.190.159.71
  • 20.190.159.131
  • 40.126.31.67
  • 20.190.159.75
  • 20.190.159.68
  • 20.190.159.64
  • 20.190.159.0
whitelisted
dpd.securestudies.com
  • 13.32.121.122
  • 13.32.121.27
  • 13.32.121.93
  • 13.32.121.51
whitelisted
ocsp.rootca1.amazontrust.com
  • 18.245.38.41
whitelisted

Threats

No threats detected
Process
Message
bytebreaker.cc Exploit_12633821.exe
at getFileInfo.@307@46 (this://app/main.html(329))
bytebreaker.cc Exploit_12633821.exe
Error: (undefined) has no property - value
bytebreaker.cc Exploit_12633821.exe
bytebreaker.cc Exploit_12633821.exe
bytebreaker.cc Exploit_12633821.exe
at initializeDynamicVariables (this://app/main.html(351))
bytebreaker.cc Exploit_12633821.exe
scanning node questions /questions
bytebreaker.cc Exploit_12633821.exe
scanning node question /questions/question
bytebreaker.cc Exploit_12633821.exe
scanning node question /questions/question
bytebreaker.cc Exploit_12633821.exe
scanning node question /questions/question
bytebreaker.cc Exploit_12633821.exe
scanning node question /questions/question
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
bytebreaker.cc Exploit_12633821.exe