URL:

https://filecr.com/windows/malwarebytes-premium/

Full analysis: https://app.any.run/tasks/ed7f0d89-d079-4f9a-a1b4-203fb8a000ad
Verdict: Malicious activity
Analysis date: May 17, 2025, 12:56:36
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
Indicators:
MD5:

27FAA7448D11F759BD96EB7E0B5199AF

SHA1:

5E10630D2A19F71F4C06080297F56D2C4F7723D2

SHA256:

6D16BC70CF8FBB6D7FCFE1005B8DE76E4CCEC0855D1BA0AE3D7AA30EC9610C21

SSDEEP:

3:N8JTCqXYzKAWIK:2hJXYmAWIK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • _iu14D2N.tmp (PID: 1004)

    • Antivirus name has been found in the command line (generic signature)

      • cmd.exe (PID: 7584)
      • tasklist.exe (PID: 7836)

    • Changes Windows Defender settings

      • cmd.exe (PID: 7036)

    • Adds path to the Windows Defender exclusion list

      • cmd.exe (PID: 7036)

    • Adds process to the Windows Defender exclusion list

      • cmd.exe (PID: 7036)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6108)

    • Application launched itself

      • WinRAR.exe (PID: 6108)
      • cmd.exe (PID: 4776)
      • cmd.exe (PID: 2140)
      • cmd.exe (PID: 7104)
      • cmd.exe (PID: 7036)
      • WinRAR.exe (PID: 3032)
      • VC_redist.x86.exe (PID: 8128)
      • VC_redist.x86.exe (PID: 7528)

    • Starts CMD.EXE for commands execution

      • Patch_MB_5.x.exe (PID: 3900)
      • cmd.exe (PID: 2140)
      • cmd.exe (PID: 4776)
      • cmd.exe (PID: 7104)
      • cmd.exe (PID: 7036)
      • wzone.exe (PID: 2340)

    • Drops 7-zip archiver for unpacking

      • 7z2201.exe (PID: 3156)
      • Patch_MB_5.x.exe (PID: 3900)
      • rs.tmp (PID: 5864)

    • Executable content was dropped or overwritten

      • Patch_MB_5.x.exe (PID: 3900)
      • 7z2201.exe (PID: 3156)
      • rs.exe (PID: 5972)
      • rs.tmp (PID: 5864)
      • unins000.exe (PID: 3796)
      • MBAMService.exe (PID: 7232)
      • MBAMService.exe (PID: 1088)
      • _iu14D2N.tmp (PID: 1004)
      • 7z.exe (PID: 7684)
      • VC_redist.x86.exe (PID: 1628)
      • VC_redist.x86.exe (PID: 8052)
      • VC_redist.x86.exe (PID: 5416)
      • VC_redist.x86.exe (PID: 7528)
      • VC_redist.x86.exe (PID: 7792)

    • The executable file from the user directory is run by the CMD process

      • 7z2201.exe (PID: 3156)
      • VC_redist.x86.exe (PID: 1628)
      • wzone.exe (PID: 2340)

    • Executing commands from a ".bat" file

      • Patch_MB_5.x.exe (PID: 3900)
      • cmd.exe (PID: 2140)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 2140)
      • cmd.exe (PID: 7036)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 8012)
      • cmd.exe (PID: 8024)
      • cmd.exe (PID: 720)
      • cmd.exe (PID: 8024)
      • cmd.exe (PID: 2084)
      • cmd.exe (PID: 7824)
      • cmd.exe (PID: 8056)

    • Starts application with an unusual extension

      • cmd.exe (PID: 4776)
      • unins000.exe (PID: 3796)

    • Executing commands from ".cmd" file

      • cmd.exe (PID: 4776)
      • cmd.exe (PID: 2140)
      • wzone.exe (PID: 2340)

    • Starts process via Powershell

      • powershell.exe (PID: 4652)
      • powershell.exe (PID: 1328)
      • powershell.exe (PID: 5528)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 2140)
      • cmd.exe (PID: 7036)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 4776)
      • cmd.exe (PID: 2140)

    • Process drops legitimate windows executable

      • rs.tmp (PID: 5864)
      • _iu14D2N.tmp (PID: 1004)
      • 7z.exe (PID: 7684)
      • VC_redist.x86.exe (PID: 1628)
      • VC_redist.x86.exe (PID: 8052)
      • VC_redist.x86.exe (PID: 5416)
      • msiexec.exe (PID: 4284)
      • VC_redist.x86.exe (PID: 7792)

    • The process drops C-runtime libraries

      • rs.tmp (PID: 5864)
      • msiexec.exe (PID: 4284)

    • Drops a system driver (possible attempt to evade defenses)

      • MBAMService.exe (PID: 7232)
      • rs.tmp (PID: 5864)
      • MBAMService.exe (PID: 1088)

    • Executes as Windows Service

      • MBAMService.exe (PID: 1088)
      • VSSVC.exe (PID: 5204)

    • Starts itself from another location

      • unins000.exe (PID: 3796)
      • VC_redist.x86.exe (PID: 8052)

    • Uses WMIC.EXE

      • cmd.exe (PID: 7216)

    • Get information on the list of running processes

      • cmd.exe (PID: 7740)
      • cmd.exe (PID: 2140)
      • cmd.exe (PID: 1180)
      • cmd.exe (PID: 5352)
      • cmd.exe (PID: 7584)
      • cmd.exe (PID: 7156)
      • cmd.exe (PID: 6244)
      • cmd.exe (PID: 4776)
      • cmd.exe (PID: 2344)
      • cmd.exe (PID: 6248)
      • cmd.exe (PID: 4376)
      • cmd.exe (PID: 5868)
      • cmd.exe (PID: 7476)
      • cmd.exe (PID: 7896)
      • cmd.exe (PID: 6652)
      • cmd.exe (PID: 7304)
      • cmd.exe (PID: 1660)
      • cmd.exe (PID: 8064)
      • cmd.exe (PID: 5588)
      • cmd.exe (PID: 5796)
      • cmd.exe (PID: 832)
      • cmd.exe (PID: 1004)
      • cmd.exe (PID: 7700)
      • cmd.exe (PID: 5348)
      • cmd.exe (PID: 3264)
      • cmd.exe (PID: 5708)
      • cmd.exe (PID: 4052)
      • cmd.exe (PID: 7100)
      • cmd.exe (PID: 4672)
      • cmd.exe (PID: 2568)
      • cmd.exe (PID: 7964)
      • cmd.exe (PID: 7992)
      • cmd.exe (PID: 8028)
      • cmd.exe (PID: 4408)
      • cmd.exe (PID: 5044)
      • cmd.exe (PID: 7220)
      • cmd.exe (PID: 660)
      • cmd.exe (PID: 8072)
      • cmd.exe (PID: 7184)
      • cmd.exe (PID: 7496)
      • cmd.exe (PID: 7308)
      • cmd.exe (PID: 644)
      • cmd.exe (PID: 7840)
      • cmd.exe (PID: 5640)
      • cmd.exe (PID: 5624)
      • cmd.exe (PID: 6724)
      • cmd.exe (PID: 2316)
      • cmd.exe (PID: 7888)
      • cmd.exe (PID: 4784)
      • cmd.exe (PID: 7528)
      • cmd.exe (PID: 6192)
      • cmd.exe (PID: 6480)
      • cmd.exe (PID: 2800)
      • cmd.exe (PID: 7640)
      • cmd.exe (PID: 8032)
      • cmd.exe (PID: 5484)
      • cmd.exe (PID: 4000)
      • cmd.exe (PID: 2612)
      • cmd.exe (PID: 3748)
      • cmd.exe (PID: 4188)
      • cmd.exe (PID: 232)
      • cmd.exe (PID: 3416)
      • cmd.exe (PID: 7408)
      • cmd.exe (PID: 632)
      • cmd.exe (PID: 1704)
      • cmd.exe (PID: 5952)
      • cmd.exe (PID: 7740)
      • cmd.exe (PID: 3156)
      • cmd.exe (PID: 7368)
      • cmd.exe (PID: 444)
      • cmd.exe (PID: 7608)
      • cmd.exe (PID: 7908)
      • cmd.exe (PID: 2268)
      • cmd.exe (PID: 8156)
      • cmd.exe (PID: 1116)
      • cmd.exe (PID: 8024)
      • cmd.exe (PID: 6244)
      • cmd.exe (PID: 2780)
      • cmd.exe (PID: 7428)
      • cmd.exe (PID: 7552)
      • cmd.exe (PID: 3332)
      • cmd.exe (PID: 1020)
      • cmd.exe (PID: 920)
      • cmd.exe (PID: 4736)
      • cmd.exe (PID: 4040)
      • cmd.exe (PID: 5740)
      • cmd.exe (PID: 7988)
      • cmd.exe (PID: 6908)
      • cmd.exe (PID: 8116)
      • cmd.exe (PID: 8032)
      • cmd.exe (PID: 5484)
      • cmd.exe (PID: 2612)
      • cmd.exe (PID: 1272)
      • cmd.exe (PID: 7640)
      • cmd.exe (PID: 3748)
      • cmd.exe (PID: 3416)
      • cmd.exe (PID: 6612)
      • cmd.exe (PID: 1544)
      • cmd.exe (PID: 3804)
      • cmd.exe (PID: 3080)
      • cmd.exe (PID: 1548)
      • cmd.exe (PID: 5452)
      • cmd.exe (PID: 4284)
      • cmd.exe (PID: 7680)
      • cmd.exe (PID: 7480)
      • cmd.exe (PID: 6584)
      • cmd.exe (PID: 7328)
      • cmd.exe (PID: 5408)
      • cmd.exe (PID: 3032)
      • cmd.exe (PID: 7560)
      • cmd.exe (PID: 8016)
      • cmd.exe (PID: 7192)
      • cmd.exe (PID: 7844)
      • cmd.exe (PID: 4448)
      • cmd.exe (PID: 7272)
      • cmd.exe (PID: 7816)
      • cmd.exe (PID: 4308)
      • cmd.exe (PID: 6272)
      • cmd.exe (PID: 6576)
      • cmd.exe (PID: 2796)
      • cmd.exe (PID: 788)
      • cmd.exe (PID: 5936)
      • cmd.exe (PID: 4348)
      • cmd.exe (PID: 7324)
      • cmd.exe (PID: 5600)
      • cmd.exe (PID: 1700)
      • cmd.exe (PID: 1504)
      • cmd.exe (PID: 6744)
      • cmd.exe (PID: 5072)
      • cmd.exe (PID: 2848)
      • cmd.exe (PID: 5976)
      • cmd.exe (PID: 1168)
      • cmd.exe (PID: 7960)
      • cmd.exe (PID: 7216)
      • cmd.exe (PID: 1616)
      • cmd.exe (PID: 7232)
      • cmd.exe (PID: 3164)
      • cmd.exe (PID: 4244)
      • cmd.exe (PID: 7192)
      • cmd.exe (PID: 6584)
      • cmd.exe (PID: 5408)
      • cmd.exe (PID: 4448)
      • cmd.exe (PID: 6872)
      • cmd.exe (PID: 7292)
      • cmd.exe (PID: 5132)
      • cmd.exe (PID: 7680)
      • cmd.exe (PID: 3332)
      • cmd.exe (PID: 7480)
      • cmd.exe (PID: 7844)
      • cmd.exe (PID: 7560)
      • cmd.exe (PID: 7272)
      • cmd.exe (PID: 4040)
      • cmd.exe (PID: 7552)
      • cmd.exe (PID: 2236)
      • cmd.exe (PID: 1020)
      • cmd.exe (PID: 920)
      • cmd.exe (PID: 7872)
      • cmd.exe (PID: 7856)
      • cmd.exe (PID: 6112)
      • cmd.exe (PID: 4220)
      • cmd.exe (PID: 7868)
      • cmd.exe (PID: 2216)
      • cmd.exe (PID: 2204)
      • cmd.exe (PID: 1496)
      • cmd.exe (PID: 2476)
      • cmd.exe (PID: 2340)
      • cmd.exe (PID: 7200)
      • cmd.exe (PID: 2656)
      • cmd.exe (PID: 7880)
      • cmd.exe (PID: 7368)
      • cmd.exe (PID: 2896)
      • cmd.exe (PID: 5392)
      • cmd.exe (PID: 7608)
      • cmd.exe (PID: 7604)
      • cmd.exe (PID: 7220)
      • cmd.exe (PID: 5136)
      • cmd.exe (PID: 744)
      • cmd.exe (PID: 6244)
      • cmd.exe (PID: 2780)
      • cmd.exe (PID: 1116)
      • cmd.exe (PID: 7716)
      • cmd.exe (PID: 7428)
      • cmd.exe (PID: 5528)
      • cmd.exe (PID: 8128)
      • cmd.exe (PID: 7696)
      • cmd.exe (PID: 4308)
      • cmd.exe (PID: 6272)
      • cmd.exe (PID: 6576)
      • cmd.exe (PID: 5608)
      • cmd.exe (PID: 4276)
      • cmd.exe (PID: 7208)
      • cmd.exe (PID: 2800)
      • cmd.exe (PID: 7104)
      • cmd.exe (PID: 904)
      • cmd.exe (PID: 3744)
      • cmd.exe (PID: 616)
      • cmd.exe (PID: 3976)
      • cmd.exe (PID: 8184)
      • cmd.exe (PID: 6500)
      • cmd.exe (PID: 1616)
      • cmd.exe (PID: 1676)
      • cmd.exe (PID: 4868)
      • cmd.exe (PID: 5352)
      • cmd.exe (PID: 4892)
      • cmd.exe (PID: 6660)
      • cmd.exe (PID: 2268)
      • cmd.exe (PID: 1052)
      • cmd.exe (PID: 1244)
      • cmd.exe (PID: 7812)
      • cmd.exe (PID: 5036)
      • cmd.exe (PID: 5744)
      • cmd.exe (PID: 6048)
      • cmd.exe (PID: 2344)
      • cmd.exe (PID: 7476)
      • cmd.exe (PID: 5772)
      • cmd.exe (PID: 2148)
      • cmd.exe (PID: 7484)
      • cmd.exe (PID: 7876)
      • cmd.exe (PID: 7548)
      • cmd.exe (PID: 6136)
      • cmd.exe (PID: 4948)
      • cmd.exe (PID: 6908)
      • cmd.exe (PID: 7268)
      • cmd.exe (PID: 8000)
      • cmd.exe (PID: 2644)
      • cmd.exe (PID: 3160)
      • cmd.exe (PID: 3796)
      • cmd.exe (PID: 2812)
      • cmd.exe (PID: 7216)
      • cmd.exe (PID: 7768)
      • cmd.exe (PID: 7880)
      • cmd.exe (PID: 1056)
      • cmd.exe (PID: 7020)
      • cmd.exe (PID: 7220)
      • cmd.exe (PID: 5408)
      • cmd.exe (PID: 5228)
      • cmd.exe (PID: 7728)
      • cmd.exe (PID: 8112)
      • cmd.exe (PID: 8092)
      • cmd.exe (PID: 208)
      • cmd.exe (PID: 6208)
      • cmd.exe (PID: 6816)
      • cmd.exe (PID: 7776)
      • cmd.exe (PID: 7844)
      • cmd.exe (PID: 4308)
      • cmd.exe (PID: 6652)
      • cmd.exe (PID: 7304)
      • cmd.exe (PID: 2236)
      • cmd.exe (PID: 448)
      • cmd.exe (PID: 7612)
      • cmd.exe (PID: 7700)
      • cmd.exe (PID: 828)
      • cmd.exe (PID: 7892)
      • cmd.exe (PID: 4188)
      • cmd.exe (PID: 6900)
      • cmd.exe (PID: 4728)
      • cmd.exe (PID: 7216)
      • cmd.exe (PID: 4408)
      • cmd.exe (PID: 4868)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 2140)
      • cmd.exe (PID: 7036)

    • Uses WMIC.EXE to obtain operating system information

      • cmd.exe (PID: 2140)

    • Hides command output

      • cmd.exe (PID: 720)
      • cmd.exe (PID: 2084)
      • cmd.exe (PID: 8024)
      • cmd.exe (PID: 8056)
      • cmd.exe (PID: 7824)

    • Checks for external IP

      • curl.exe (PID: 7496)
      • svchost.exe (PID: 2196)
      • curl.exe (PID: 6392)
      • curl.exe (PID: 1660)
      • curl.exe (PID: 6032)

    • Execution of CURL command

      • cmd.exe (PID: 2140)

    • Script adds exclusion process to Windows Defender

      • cmd.exe (PID: 7036)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • cmd.exe (PID: 7036)

    • Script adds exclusion path to Windows Defender

      • cmd.exe (PID: 7036)

    • Starts a Microsoft application from unusual location

      • VC_redist.x86.exe (PID: 8052)
      • VC_redist.x86.exe (PID: 5416)

  • INFO

    • Application launched itself

      • firefox.exe (PID: 7376)
      • firefox.exe (PID: 7420)

    • The sample compiled with english language support

      • Patch_MB_5.x.exe (PID: 3900)
      • 7z2201.exe (PID: 3156)
      • MBAMService.exe (PID: 7232)
      • MBAMService.exe (PID: 1088)
      • rs.tmp (PID: 5864)
      • _iu14D2N.tmp (PID: 1004)
      • 7z.exe (PID: 7684)
      • VC_redist.x86.exe (PID: 8052)
      • VC_redist.x86.exe (PID: 1628)
      • VC_redist.x86.exe (PID: 5416)
      • msiexec.exe (PID: 4284)
      • VC_redist.x86.exe (PID: 7528)
      • VC_redist.x86.exe (PID: 7792)

    • Reads the software policy settings

      • slui.exe (PID: 1180)
      • slui.exe (PID: 7508)

    • Checks proxy server information

      • slui.exe (PID: 7508)

    • Manual execution by a user

      • Patch_MB_5.x.exe (PID: 3900)
      • WinRAR.exe (PID: 6108)
      • Patch_MB_5.x.exe (PID: 924)
      • WinRAR.exe (PID: 3032)

    • The sample compiled with russian language support

      • 7z2201.exe (PID: 3156)

    • Starts MODE.COM to configure console settings

      • mode.com (PID: 6572)
      • mode.com (PID: 7244)

    • Changes the display of characters in the console

      • cmd.exe (PID: 4776)

    • Creates or changes the value of an item property via Powershell

      • cmd.exe (PID: 2140)

    • The executable file from the user directory is run by the Powershell process

      • rs.exe (PID: 5972)

    • The sample compiled with spanish language support

      • rs.tmp (PID: 5864)

    • Execution of CURL command

      • cmd.exe (PID: 7300)
      • cmd.exe (PID: 7596)
      • cmd.exe (PID: 6488)
      • cmd.exe (PID: 8128)
      • cmd.exe (PID: 6944)
      • cmd.exe (PID: 7552)
      • cmd.exe (PID: 2140)
      • cmd.exe (PID: 5608)
      • cmd.exe (PID: 7036)
      • cmd.exe (PID: 8064)

    • Manages system restore points

      • SrTasks.exe (PID: 1664)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 4284)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
810
Monitored processes
669
Malicious processes
9
Suspicious processes
8

Behavior graph

Click at the process to see the details
start firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs sppextcomobj.exe no specs slui.exe firefox.exe no specs slui.exe winrar.exe no specs winrar.exe no specs patch_mb_5.x.exe no specs patch_mb_5.x.exe cmd.exe no specs conhost.exe no specs 7z2201.exe attrib.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs 7z.exe no specs conhost.exe no specs mode.com no specs chcp.com no specs mode.com no specs cmd.exe no specs 7z.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs timeout.exe no specs powershell.exe no specs powershell.exe no specs timeout.exe no specs rs.exe rs.tmp timeout.exe no specs timeout.exe no specs timeout.exe no specs certutil.exe no specs conhost.exe no specs certutil.exe no specs conhost.exe no specs mbamservice.exe mbamservice.exe timeout.exe no specs mbamtray.exe timeout.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs mbamwsc.exe no specs timeout.exe no specs attrib.exe no specs xcopy.exe no specs xcopy.exe no specs powershell.exe no specs timeout.exe no specs unins000.exe _iu14d2n.tmp timeout.exe no specs mbamwsc.exe no specs mbamservice.exe no specs mbamwsc.exe no specs regsvr32.exe no specs timeout.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs tasklist.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs curl.exe cmd.exe no specs curl.exe wmic.exe no specs cmd.exe no specs findstr.exe no specs svchost.exe winrar.exe no specs wmic.exe no specs cmd.exe no specs findstr.exe no specs wmic.exe no specs cmd.exe no specs findstr.exe no specs wmic.exe no specs cmd.exe no specs findstr.exe no specs wmic.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs curl.exe cmd.exe no specs curl.exe cmd.exe no specs curl.exe cmd.exe no specs curl.exe curl.exe 7z.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs curl.exe cmd.exe no specs curl.exe powershell.exe no specs timeout.exe no specs powershell.exe no specs powershell.exe no specs timeout.exe no specs powershell.exe no specs winrar.exe no specs curl.exe timeout.exe no specs attrib.exe no specs 7z.exe timeout.exe no specs timeout.exe no specs netsh.exe no specs reg.exe no specs attrib.exe no specs vc_redist.x86.exe vc_redist.x86.exe vc_redist.x86.exe SPPSurrogate no specs vssvc.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs srtasks.exe no specs conhost.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs msiexec.exe cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs vc_redist.x86.exe no specs cmd.exe no specs vc_redist.x86.exe tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs vc_redist.x86.exe cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs wzone.exe no specs curl.exe cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
132tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nhC:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
132tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nhC:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
208tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nhC:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
208C:\WINDOWS\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nhC:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
232C:\WINDOWS\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nhC:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
236findstr /ilc:"Windows 11" C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
300tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nhC:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
300tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nhC:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
444C:\WINDOWS\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nhC:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
448tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nhC:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
131 565
Read events
128 785
Write events
1 123
Delete events
1 657

Modification events

(PID) Process:(7420) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
0
(PID) Process:(6108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Downloads\Malwarebytes Premium 5.1.1.106 Multilingual [FileCR].zip
(PID) Process:(6108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
Executable files
446
Suspicious files
546
Text files
480
Unknown types
3

Dropped files

PID
Process
Filename
Type
7420firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
7420firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cookies.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
7420firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
7420firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite —
MD5:—
SHA256:—
7420firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
7420firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\datareporting\glean\db\data.safe.binbinary
MD5:4006DDC2918B16C7EF5516C58373842B
SHA256:269EA23B77EDE0874628BD8611BCC5A3E87E0C44CA8A821C0D028B929D4F468F
7420firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
7420firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cert9.dbbinary
MD5:87E77EDE01423D0C295EE58AA2B0E84E
SHA256:9E99C41AEB125FE3E5850911709BFB4AB8AF96E8EB9395D283EC53773E83B3E9
7420firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\AlternateServices.binbinary
MD5:9B81E5EFD0CABD4ACEB7B514580F22BB
SHA256:350CFCBB89CE9FC4E478DC3CEB7C8421067024EF7D8FEA062EBFD9038CFEE4E9
7420firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
34
TCP/UDP connections
110
DNS requests
140
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7420
firefox.exe
POST
200
172.64.149.23:80
http://ocsp.sectigo.com/
unknown
—
—
whitelisted
7420
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
7420
firefox.exe
POST
—
216.58.206.35:80
http://o.pki.goog/we2
unknown
—
—
whitelisted
7420
firefox.exe
POST
200
184.24.77.56:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.177:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7420
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
7420
firefox.exe
POST
200
216.58.206.35:80
http://o.pki.goog/s/wr3/FIY
unknown
—
—
whitelisted
7420
firefox.exe
POST
200
184.24.77.56:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
7420
firefox.exe
POST
200
184.24.77.58:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.177:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7420
firefox.exe
34.36.137.203:443
contile.services.mozilla.com
—
—
whitelisted
7420
firefox.exe
217.156.123.203:443
filecr.com
—
RO
unknown
7420
firefox.exe
34.107.221.82:80
detectportal.firefox.com
GOOGLE
US
whitelisted
7420
firefox.exe
34.160.144.191:443
content-signature-2.cdn.mozilla.net
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.48.23.177
  • 23.48.23.156
  • 23.48.23.173
  • 23.48.23.167
  • 23.48.23.180
  • 23.48.23.141
  • 23.48.23.164
  • 23.48.23.145
  • 23.48.23.166
  • 2.16.168.124
  • 2.16.168.114
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 2.23.246.101
whitelisted
google.com
  • 142.250.185.174
whitelisted
filecr.com
  • 217.156.123.203
unknown
detectportal.firefox.com
  • 34.107.221.82
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
example.org
  • 23.215.0.133
  • 96.7.128.186
  • 96.7.128.192
  • 23.215.0.132
whitelisted
ipv4only.arpa
  • 192.0.0.171
  • 192.0.0.170
whitelisted
contile.services.mozilla.com
  • 34.36.137.203
whitelisted

Threats

PID
Process
Class
Message
—
—
Device Retrieving External IP Address Detected
ET INFO Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
—
—
Device Retrieving External IP Address Detected
ET INFO External IP Lookup SSL Cert Observed (ipinfo .io)
—
—
Device Retrieving External IP Address Detected
ET INFO External IP Lookup SSL Cert Observed (ipinfo .io)
—
—
Device Retrieving External IP Address Detected
ET INFO Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
—
—
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ipinfo .io)
—
—
Device Retrieving External IP Address Detected
ET INFO Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
—
—
Device Retrieving External IP Address Detected
ET INFO External IP Lookup SSL Cert Observed (ipinfo .io)
—
—
Device Retrieving External IP Address Detected
ET INFO Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
—
—
Device Retrieving External IP Address Detected
ET INFO External IP Lookup SSL Cert Observed (ipinfo .io)
Process
Message
MBAMService.exe
Retry XPE file open
MBAMService.exe
Retry log file open from dll
MBAMService.exe
Retry XPE file open
MBAMService.exe
Retry XPE file open
MBAMService.exe
Stop called from an external process
MBAMService.exe
Calling implementation stop
MBAMService.exe
Firing service stop event
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://filecr.com/windows/malwarebytes-premium/