URL:

https://filecr.com/windows/malwarebytes-premium/

Full analysis: https://app.any.run/tasks/ed7f0d89-d079-4f9a-a1b4-203fb8a000ad
Verdict: Malicious activity
Analysis date: May 17, 2025, 12:56:36
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
evasion
Indicators:
MD5:

27FAA7448D11F759BD96EB7E0B5199AF

SHA1:

5E10630D2A19F71F4C06080297F56D2C4F7723D2

SHA256:

6D16BC70CF8FBB6D7FCFE1005B8DE76E4CCEC0855D1BA0AE3D7AA30EC9610C21

SSDEEP:

3:N8JTCqXYzKAWIK:2hJXYmAWIK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • _iu14D2N.tmp (PID: 1004)

    • Antivirus name has been found in the command line (generic signature)

      • cmd.exe (PID: 7584)
      • tasklist.exe (PID: 7836)

    • Adds process to the Windows Defender exclusion list

      • cmd.exe (PID: 7036)

    • Adds path to the Windows Defender exclusion list

      • cmd.exe (PID: 7036)

    • Changes Windows Defender settings

      • cmd.exe (PID: 7036)

  • SUSPICIOUS

    • Application launched itself

      • WinRAR.exe (PID: 6108)
      • cmd.exe (PID: 2140)
      • cmd.exe (PID: 7104)
      • cmd.exe (PID: 4776)
      • cmd.exe (PID: 7036)
      • WinRAR.exe (PID: 3032)
      • VC_redist.x86.exe (PID: 8128)
      • VC_redist.x86.exe (PID: 7528)

    • Starts CMD.EXE for commands execution

      • Patch_MB_5.x.exe (PID: 3900)
      • cmd.exe (PID: 2140)
      • cmd.exe (PID: 4776)
      • cmd.exe (PID: 7104)
      • cmd.exe (PID: 7036)
      • wzone.exe (PID: 2340)

    • Executable content was dropped or overwritten

      • Patch_MB_5.x.exe (PID: 3900)
      • 7z2201.exe (PID: 3156)
      • rs.exe (PID: 5972)
      • MBAMService.exe (PID: 1088)
      • MBAMService.exe (PID: 7232)
      • rs.tmp (PID: 5864)
      • unins000.exe (PID: 3796)
      • _iu14D2N.tmp (PID: 1004)
      • VC_redist.x86.exe (PID: 8052)
      • 7z.exe (PID: 7684)
      • VC_redist.x86.exe (PID: 1628)
      • VC_redist.x86.exe (PID: 5416)
      • VC_redist.x86.exe (PID: 7528)
      • VC_redist.x86.exe (PID: 7792)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6108)

    • The executable file from the user directory is run by the CMD process

      • 7z2201.exe (PID: 3156)
      • VC_redist.x86.exe (PID: 1628)
      • wzone.exe (PID: 2340)

    • Executing commands from a ".bat" file

      • Patch_MB_5.x.exe (PID: 3900)
      • cmd.exe (PID: 2140)

    • Drops 7-zip archiver for unpacking

      • Patch_MB_5.x.exe (PID: 3900)
      • 7z2201.exe (PID: 3156)
      • rs.tmp (PID: 5864)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 2140)
      • cmd.exe (PID: 7036)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 8012)
      • cmd.exe (PID: 8024)
      • cmd.exe (PID: 720)
      • cmd.exe (PID: 7824)
      • cmd.exe (PID: 8056)
      • cmd.exe (PID: 2084)
      • cmd.exe (PID: 8024)

    • Executing commands from ".cmd" file

      • cmd.exe (PID: 2140)
      • cmd.exe (PID: 4776)
      • wzone.exe (PID: 2340)

    • Starts application with an unusual extension

      • cmd.exe (PID: 4776)
      • unins000.exe (PID: 3796)

    • Starts process via Powershell

      • powershell.exe (PID: 4652)
      • powershell.exe (PID: 1328)
      • powershell.exe (PID: 5528)

    • Process drops legitimate windows executable

      • rs.tmp (PID: 5864)
      • _iu14D2N.tmp (PID: 1004)
      • 7z.exe (PID: 7684)
      • VC_redist.x86.exe (PID: 8052)
      • VC_redist.x86.exe (PID: 1628)
      • VC_redist.x86.exe (PID: 5416)
      • msiexec.exe (PID: 4284)
      • VC_redist.x86.exe (PID: 7792)

    • The process drops C-runtime libraries

      • rs.tmp (PID: 5864)
      • msiexec.exe (PID: 4284)

    • Drops a system driver (possible attempt to evade defenses)

      • rs.tmp (PID: 5864)
      • MBAMService.exe (PID: 7232)
      • MBAMService.exe (PID: 1088)

    • Executes as Windows Service

      • MBAMService.exe (PID: 1088)
      • VSSVC.exe (PID: 5204)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 4776)
      • cmd.exe (PID: 2140)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 2140)
      • cmd.exe (PID: 7036)

    • Starts itself from another location

      • unins000.exe (PID: 3796)
      • VC_redist.x86.exe (PID: 8052)

    • Uses WMIC.EXE

      • cmd.exe (PID: 7216)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 2140)
      • cmd.exe (PID: 7036)

    • Get information on the list of running processes

      • cmd.exe (PID: 7740)
      • cmd.exe (PID: 2140)
      • cmd.exe (PID: 5352)
      • cmd.exe (PID: 1180)
      • cmd.exe (PID: 7584)
      • cmd.exe (PID: 7476)
      • cmd.exe (PID: 7896)
      • cmd.exe (PID: 1660)
      • cmd.exe (PID: 6652)
      • cmd.exe (PID: 7304)
      • cmd.exe (PID: 5588)
      • cmd.exe (PID: 7700)
      • cmd.exe (PID: 8064)
      • cmd.exe (PID: 5796)
      • cmd.exe (PID: 3264)
      • cmd.exe (PID: 832)
      • cmd.exe (PID: 5348)
      • cmd.exe (PID: 6244)
      • cmd.exe (PID: 5868)
      • cmd.exe (PID: 7156)
      • cmd.exe (PID: 6248)
      • cmd.exe (PID: 4376)
      • cmd.exe (PID: 4776)
      • cmd.exe (PID: 2344)
      • cmd.exe (PID: 5708)
      • cmd.exe (PID: 4672)
      • cmd.exe (PID: 4052)
      • cmd.exe (PID: 1004)
      • cmd.exe (PID: 7100)
      • cmd.exe (PID: 8028)
      • cmd.exe (PID: 7964)
      • cmd.exe (PID: 7992)
      • cmd.exe (PID: 2568)
      • cmd.exe (PID: 8072)
      • cmd.exe (PID: 660)
      • cmd.exe (PID: 4408)
      • cmd.exe (PID: 5044)
      • cmd.exe (PID: 7220)
      • cmd.exe (PID: 7496)
      • cmd.exe (PID: 7184)
      • cmd.exe (PID: 7308)
      • cmd.exe (PID: 4000)
      • cmd.exe (PID: 2316)
      • cmd.exe (PID: 5640)
      • cmd.exe (PID: 6724)
      • cmd.exe (PID: 7528)
      • cmd.exe (PID: 6192)
      • cmd.exe (PID: 5624)
      • cmd.exe (PID: 7888)
      • cmd.exe (PID: 5484)
      • cmd.exe (PID: 6480)
      • cmd.exe (PID: 2800)
      • cmd.exe (PID: 7640)
      • cmd.exe (PID: 8032)
      • cmd.exe (PID: 3748)
      • cmd.exe (PID: 2612)
      • cmd.exe (PID: 4188)
      • cmd.exe (PID: 3416)
      • cmd.exe (PID: 232)
      • cmd.exe (PID: 4784)
      • cmd.exe (PID: 644)
      • cmd.exe (PID: 7408)
      • cmd.exe (PID: 5952)
      • cmd.exe (PID: 1704)
      • cmd.exe (PID: 7908)
      • cmd.exe (PID: 7740)
      • cmd.exe (PID: 3156)
      • cmd.exe (PID: 7368)
      • cmd.exe (PID: 8024)
      • cmd.exe (PID: 7608)
      • cmd.exe (PID: 444)
      • cmd.exe (PID: 8156)
      • cmd.exe (PID: 2268)
      • cmd.exe (PID: 1116)
      • cmd.exe (PID: 6244)
      • cmd.exe (PID: 2780)
      • cmd.exe (PID: 7428)
      • cmd.exe (PID: 3332)
      • cmd.exe (PID: 7552)
      • cmd.exe (PID: 632)
      • cmd.exe (PID: 1020)
      • cmd.exe (PID: 920)
      • cmd.exe (PID: 5740)
      • cmd.exe (PID: 4736)
      • cmd.exe (PID: 7988)
      • cmd.exe (PID: 6908)
      • cmd.exe (PID: 8116)
      • cmd.exe (PID: 1272)
      • cmd.exe (PID: 5484)
      • cmd.exe (PID: 7640)
      • cmd.exe (PID: 8032)
      • cmd.exe (PID: 3748)
      • cmd.exe (PID: 2612)
      • cmd.exe (PID: 3416)
      • cmd.exe (PID: 6612)
      • cmd.exe (PID: 3804)
      • cmd.exe (PID: 3080)
      • cmd.exe (PID: 4040)
      • cmd.exe (PID: 4284)
      • cmd.exe (PID: 7328)
      • cmd.exe (PID: 1544)
      • cmd.exe (PID: 3032)
      • cmd.exe (PID: 7680)
      • cmd.exe (PID: 7192)
      • cmd.exe (PID: 4308)
      • cmd.exe (PID: 6584)
      • cmd.exe (PID: 5408)
      • cmd.exe (PID: 4448)
      • cmd.exe (PID: 7480)
      • cmd.exe (PID: 7272)
      • cmd.exe (PID: 7560)
      • cmd.exe (PID: 7816)
      • cmd.exe (PID: 7844)
      • cmd.exe (PID: 8016)
      • cmd.exe (PID: 1548)
      • cmd.exe (PID: 5452)
      • cmd.exe (PID: 2796)
      • cmd.exe (PID: 6576)
      • cmd.exe (PID: 788)
      • cmd.exe (PID: 1168)
      • cmd.exe (PID: 4348)
      • cmd.exe (PID: 1700)
      • cmd.exe (PID: 7324)
      • cmd.exe (PID: 5600)
      • cmd.exe (PID: 2848)
      • cmd.exe (PID: 6744)
      • cmd.exe (PID: 7216)
      • cmd.exe (PID: 5976)
      • cmd.exe (PID: 7960)
      • cmd.exe (PID: 5072)
      • cmd.exe (PID: 1616)
      • cmd.exe (PID: 6272)
      • cmd.exe (PID: 5936)
      • cmd.exe (PID: 1504)
      • cmd.exe (PID: 4244)
      • cmd.exe (PID: 3164)
      • cmd.exe (PID: 6872)
      • cmd.exe (PID: 7292)
      • cmd.exe (PID: 7192)
      • cmd.exe (PID: 5132)
      • cmd.exe (PID: 7680)
      • cmd.exe (PID: 5408)
      • cmd.exe (PID: 6584)
      • cmd.exe (PID: 7480)
      • cmd.exe (PID: 4448)
      • cmd.exe (PID: 7560)
      • cmd.exe (PID: 7272)
      • cmd.exe (PID: 7844)
      • cmd.exe (PID: 3332)
      • cmd.exe (PID: 7552)
      • cmd.exe (PID: 7232)
      • cmd.exe (PID: 920)
      • cmd.exe (PID: 4220)
      • cmd.exe (PID: 7872)
      • cmd.exe (PID: 7856)
      • cmd.exe (PID: 7868)
      • cmd.exe (PID: 6112)
      • cmd.exe (PID: 2216)
      • cmd.exe (PID: 7200)
      • cmd.exe (PID: 2340)
      • cmd.exe (PID: 1496)
      • cmd.exe (PID: 2204)
      • cmd.exe (PID: 2476)
      • cmd.exe (PID: 2896)
      • cmd.exe (PID: 2656)
      • cmd.exe (PID: 7880)
      • cmd.exe (PID: 4040)
      • cmd.exe (PID: 1020)
      • cmd.exe (PID: 2236)
      • cmd.exe (PID: 7220)
      • cmd.exe (PID: 7604)
      • cmd.exe (PID: 5136)
      • cmd.exe (PID: 744)
      • cmd.exe (PID: 1116)
      • cmd.exe (PID: 6244)
      • cmd.exe (PID: 2780)
      • cmd.exe (PID: 7428)
      • cmd.exe (PID: 5528)
      • cmd.exe (PID: 8128)
      • cmd.exe (PID: 7696)
      • cmd.exe (PID: 4308)
      • cmd.exe (PID: 6272)
      • cmd.exe (PID: 5392)
      • cmd.exe (PID: 7368)
      • cmd.exe (PID: 7608)
      • cmd.exe (PID: 7716)
      • cmd.exe (PID: 7208)
      • cmd.exe (PID: 2800)
      • cmd.exe (PID: 4276)
      • cmd.exe (PID: 7104)
      • cmd.exe (PID: 3744)
      • cmd.exe (PID: 3976)
      • cmd.exe (PID: 616)
      • cmd.exe (PID: 8184)
      • cmd.exe (PID: 6500)
      • cmd.exe (PID: 6576)
      • cmd.exe (PID: 5608)
      • cmd.exe (PID: 904)
      • cmd.exe (PID: 5744)
      • cmd.exe (PID: 1244)
      • cmd.exe (PID: 6660)
      • cmd.exe (PID: 2268)
      • cmd.exe (PID: 1052)
      • cmd.exe (PID: 7812)
      • cmd.exe (PID: 5036)
      • cmd.exe (PID: 7476)
      • cmd.exe (PID: 6048)
      • cmd.exe (PID: 2344)
      • cmd.exe (PID: 5772)
      • cmd.exe (PID: 2148)
      • cmd.exe (PID: 7484)
      • cmd.exe (PID: 1616)
      • cmd.exe (PID: 1676)
      • cmd.exe (PID: 4868)
      • cmd.exe (PID: 4892)
      • cmd.exe (PID: 5352)
      • cmd.exe (PID: 2812)
      • cmd.exe (PID: 7268)
      • cmd.exe (PID: 7876)
      • cmd.exe (PID: 6136)
      • cmd.exe (PID: 7548)
      • cmd.exe (PID: 4948)
      • cmd.exe (PID: 3796)
      • cmd.exe (PID: 3160)
      • cmd.exe (PID: 7216)
      • cmd.exe (PID: 6908)
      • cmd.exe (PID: 2644)
      • cmd.exe (PID: 8000)
      • cmd.exe (PID: 7768)
      • cmd.exe (PID: 8112)
      • cmd.exe (PID: 7728)
      • cmd.exe (PID: 5228)
      • cmd.exe (PID: 5408)
      • cmd.exe (PID: 208)
      • cmd.exe (PID: 8092)
      • cmd.exe (PID: 6208)
      • cmd.exe (PID: 7844)
      • cmd.exe (PID: 7776)
      • cmd.exe (PID: 7880)
      • cmd.exe (PID: 7020)
      • cmd.exe (PID: 1056)
      • cmd.exe (PID: 7220)
      • cmd.exe (PID: 6816)
      • cmd.exe (PID: 7304)
      • cmd.exe (PID: 448)
      • cmd.exe (PID: 7612)
      • cmd.exe (PID: 828)
      • cmd.exe (PID: 7892)
      • cmd.exe (PID: 4188)
      • cmd.exe (PID: 4308)
      • cmd.exe (PID: 2236)
      • cmd.exe (PID: 6900)
      • cmd.exe (PID: 4728)
      • cmd.exe (PID: 7216)
      • cmd.exe (PID: 4408)
      • cmd.exe (PID: 4868)
      • cmd.exe (PID: 7840)
      • cmd.exe (PID: 6652)
      • cmd.exe (PID: 7700)

    • Uses WMIC.EXE to obtain operating system information

      • cmd.exe (PID: 2140)

    • Hides command output

      • cmd.exe (PID: 720)
      • cmd.exe (PID: 2084)
      • cmd.exe (PID: 8024)
      • cmd.exe (PID: 7824)
      • cmd.exe (PID: 8056)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • curl.exe (PID: 6392)
      • curl.exe (PID: 7496)
      • curl.exe (PID: 1660)
      • curl.exe (PID: 6032)

    • Execution of CURL command

      • cmd.exe (PID: 2140)

    • Script adds exclusion process to Windows Defender

      • cmd.exe (PID: 7036)

    • Script adds exclusion path to Windows Defender

      • cmd.exe (PID: 7036)

    • Starts a Microsoft application from unusual location

      • VC_redist.x86.exe (PID: 8052)
      • VC_redist.x86.exe (PID: 5416)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • cmd.exe (PID: 7036)

  • INFO

    • Reads the software policy settings

      • slui.exe (PID: 1180)
      • slui.exe (PID: 7508)

    • Application launched itself

      • firefox.exe (PID: 7376)
      • firefox.exe (PID: 7420)

    • Checks proxy server information

      • slui.exe (PID: 7508)

    • Manual execution by a user

      • Patch_MB_5.x.exe (PID: 924)
      • Patch_MB_5.x.exe (PID: 3900)
      • WinRAR.exe (PID: 6108)
      • WinRAR.exe (PID: 3032)

    • The sample compiled with russian language support

      • 7z2201.exe (PID: 3156)

    • The sample compiled with english language support

      • Patch_MB_5.x.exe (PID: 3900)
      • 7z2201.exe (PID: 3156)
      • rs.tmp (PID: 5864)
      • MBAMService.exe (PID: 7232)
      • _iu14D2N.tmp (PID: 1004)
      • MBAMService.exe (PID: 1088)
      • 7z.exe (PID: 7684)
      • VC_redist.x86.exe (PID: 1628)
      • VC_redist.x86.exe (PID: 8052)
      • VC_redist.x86.exe (PID: 5416)
      • msiexec.exe (PID: 4284)
      • VC_redist.x86.exe (PID: 7528)
      • VC_redist.x86.exe (PID: 7792)

    • Starts MODE.COM to configure console settings

      • mode.com (PID: 6572)
      • mode.com (PID: 7244)

    • Changes the display of characters in the console

      • cmd.exe (PID: 4776)

    • The executable file from the user directory is run by the Powershell process

      • rs.exe (PID: 5972)

    • The sample compiled with spanish language support

      • rs.tmp (PID: 5864)

    • Creates or changes the value of an item property via Powershell

      • cmd.exe (PID: 2140)

    • Execution of CURL command

      • cmd.exe (PID: 7300)
      • cmd.exe (PID: 7596)
      • cmd.exe (PID: 6488)
      • cmd.exe (PID: 7552)
      • cmd.exe (PID: 8128)
      • cmd.exe (PID: 6944)
      • cmd.exe (PID: 2140)
      • cmd.exe (PID: 5608)
      • cmd.exe (PID: 8064)
      • cmd.exe (PID: 7036)

    • Manages system restore points

      • SrTasks.exe (PID: 1664)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 4284)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
810
Monitored processes
669
Malicious processes
9
Suspicious processes
8

Behavior graph

Click at the process to see the details
start firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs sppextcomobj.exe no specs slui.exe firefox.exe no specs slui.exe winrar.exe no specs winrar.exe no specs patch_mb_5.x.exe no specs patch_mb_5.x.exe cmd.exe no specs conhost.exe no specs 7z2201.exe attrib.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs 7z.exe no specs conhost.exe no specs mode.com no specs chcp.com no specs mode.com no specs cmd.exe no specs 7z.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs timeout.exe no specs powershell.exe no specs powershell.exe no specs timeout.exe no specs rs.exe rs.tmp timeout.exe no specs timeout.exe no specs timeout.exe no specs certutil.exe no specs conhost.exe no specs certutil.exe no specs conhost.exe no specs mbamservice.exe mbamservice.exe timeout.exe no specs mbamtray.exe timeout.exe no specs timeout.exe no specs timeout.exe no specs timeout.exe no specs mbamwsc.exe no specs timeout.exe no specs attrib.exe no specs xcopy.exe no specs xcopy.exe no specs powershell.exe no specs timeout.exe no specs unins000.exe _iu14d2n.tmp timeout.exe no specs mbamwsc.exe no specs mbamservice.exe no specs mbamwsc.exe no specs regsvr32.exe no specs timeout.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs tasklist.exe no specs reg.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs curl.exe cmd.exe no specs curl.exe wmic.exe no specs cmd.exe no specs findstr.exe no specs svchost.exe winrar.exe no specs wmic.exe no specs cmd.exe no specs findstr.exe no specs wmic.exe no specs cmd.exe no specs findstr.exe no specs wmic.exe no specs cmd.exe no specs findstr.exe no specs wmic.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs curl.exe cmd.exe no specs curl.exe cmd.exe no specs curl.exe cmd.exe no specs curl.exe curl.exe 7z.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs curl.exe cmd.exe no specs curl.exe powershell.exe no specs timeout.exe no specs powershell.exe no specs powershell.exe no specs timeout.exe no specs powershell.exe no specs winrar.exe no specs curl.exe timeout.exe no specs attrib.exe no specs 7z.exe timeout.exe no specs timeout.exe no specs netsh.exe no specs reg.exe no specs attrib.exe no specs vc_redist.x86.exe vc_redist.x86.exe vc_redist.x86.exe SPPSurrogate no specs vssvc.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs srtasks.exe no specs conhost.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs msiexec.exe cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs vc_redist.x86.exe no specs cmd.exe no specs vc_redist.x86.exe tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs vc_redist.x86.exe cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs wzone.exe no specs curl.exe cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs tasklist.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs tasklist.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
132tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nhC:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
132tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nhC:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
208tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nhC:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
208C:\WINDOWS\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nhC:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
232C:\WINDOWS\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nhC:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
236findstr /ilc:"Windows 11" C:\Windows\System32\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
300tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nhC:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
300tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nhC:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
444C:\WINDOWS\system32\cmd.exe /c tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nhC:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
448tasklist /fi "imagename eq Malwarebytes.exe" /fo csv /nhC:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
131 565
Read events
128 785
Write events
1 123
Delete events
1 657

Modification events

(PID) Process:(7420) firefox.exeKey:HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe
Value:
0
(PID) Process:(6108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Downloads\Malwarebytes Premium 5.1.1.106 Multilingual [FileCR].zip
(PID) Process:(6108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6108) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
Executable files
446
Suspicious files
546
Text files
480
Unknown types
3

Dropped files

PID
Process
Filename
Type
7420firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
7420firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.json.tmpbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
7420firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
7420firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite —
MD5:—
SHA256:—
7420firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cookies.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
7420firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.jsonbinary
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A
SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA
7420firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
7420firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
7420firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\urlCache-current.binbinary
MD5:297E88D7CEB26E549254EC875649F4EB
SHA256:8B75D4FB1845BAA06122888D11F6B65E6A36B140C54A72CC13DF390FD7C95702
7420firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shmbinary
MD5:B7C14EC6110FA820CA6B65F5AEC85911
SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
34
TCP/UDP connections
110
DNS requests
140
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.177:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7420
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
7420
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/success.txt?ipv4
unknown
—
—
whitelisted
7420
firefox.exe
POST
200
184.24.77.56:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
7420
firefox.exe
POST
200
172.64.149.23:80
http://ocsp.sectigo.com/
unknown
—
—
whitelisted
7420
firefox.exe
POST
200
184.24.77.56:80
http://r11.o.lencr.org/
unknown
—
—
whitelisted
7420
firefox.exe
POST
200
216.58.206.35:80
http://o.pki.goog/s/wr3/FIY
unknown
—
—
whitelisted
7420
firefox.exe
POST
200
184.24.77.58:80
http://r10.o.lencr.org/
unknown
—
—
whitelisted
7420
firefox.exe
POST
200
216.58.206.35:80
http://o.pki.goog/we2
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.48.23.177:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7420
firefox.exe
34.36.137.203:443
contile.services.mozilla.com
—
—
whitelisted
7420
firefox.exe
217.156.123.203:443
filecr.com
—
RO
unknown
7420
firefox.exe
34.107.221.82:80
detectportal.firefox.com
GOOGLE
US
whitelisted
7420
firefox.exe
34.160.144.191:443
content-signature-2.cdn.mozilla.net
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.48.23.177
  • 23.48.23.156
  • 23.48.23.173
  • 23.48.23.167
  • 23.48.23.180
  • 23.48.23.141
  • 23.48.23.164
  • 23.48.23.145
  • 23.48.23.166
  • 2.16.168.124
  • 2.16.168.114
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 2.23.246.101
whitelisted
google.com
  • 142.250.185.174
whitelisted
filecr.com
  • 217.156.123.203
unknown
detectportal.firefox.com
  • 34.107.221.82
whitelisted
prod.detectportal.prod.cloudops.mozgcp.net
  • 34.107.221.82
  • 2600:1901:0:38d7::
whitelisted
example.org
  • 23.215.0.133
  • 96.7.128.186
  • 96.7.128.192
  • 23.215.0.132
whitelisted
ipv4only.arpa
  • 192.0.0.171
  • 192.0.0.170
whitelisted
contile.services.mozilla.com
  • 34.36.137.203
whitelisted

Threats

PID
Process
Class
Message
7496
curl.exe
Device Retrieving External IP Address Detected
ET INFO Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
7496
curl.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup SSL Cert Observed (ipinfo .io)
6392
curl.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup SSL Cert Observed (ipinfo .io)
6392
curl.exe
Device Retrieving External IP Address Detected
ET INFO Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ipinfo .io)
1660
curl.exe
Device Retrieving External IP Address Detected
ET INFO Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
1660
curl.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup SSL Cert Observed (ipinfo .io)
6032
curl.exe
Device Retrieving External IP Address Detected
ET INFO Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
6032
curl.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup SSL Cert Observed (ipinfo .io)
Process
Message
MBAMService.exe
Retry XPE file open
MBAMService.exe
Retry log file open from dll
MBAMService.exe
Retry XPE file open
MBAMService.exe
Retry XPE file open
MBAMService.exe
Stop called from an external process
MBAMService.exe
Calling implementation stop
MBAMService.exe
Firing service stop event
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://filecr.com/windows/malwarebytes-premium/