File name:

plutonium.exe

Full analysis: https://app.any.run/tasks/7a7dfe68-d91e-4dbf-b291-ccf72b322bf9
Verdict: Malicious activity
Analysis date: February 18, 2025, 11:05:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
menorah
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

72CB7C6D98E9E47274733825C9176679

SHA1:

8681469349254C5203A7F9A189833D22A14F5CD9

SHA256:

85D1D1CA4D5881D9B98928C2006FB0EEC9655E2705FE74088E6F974A19703F0F

SSDEEP:

98304:zUaMwIBAoUcmmxVA5/xDnLx0yu+5TeRXExXYAxZ:Ia+AobhATd0yH0RXUo2Z

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • MENORAH has been detected (YARA)

      • plutonium.exe (PID: 1040)

    • Changes the autorun value in the registry

      • 178bffd3-6a59-4141-93c2-1c834413002d.exe (PID: 2616)

    • Executing a file with an untrusted certificate

      • plutonium-launcher-win32.exe (PID: 3432)

  • SUSPICIOUS

    • Reads settings of System Certificates

      • plutonium.exe (PID: 1040)
      • dxwsetup.exe (PID: 3008)

    • There is functionality for taking screenshot (YARA)

      • plutonium.exe (PID: 1040)

    • Reads the Internet Settings

      • plutonium.exe (PID: 1040)
      • dxwsetup.exe (PID: 3008)

    • Executable content was dropped or overwritten

      • plutonium.exe (PID: 1040)
      • 178bffd3-6a59-4141-93c2-1c834413002d.exe (PID: 2616)
      • dxwsetup.exe (PID: 3008)

    • Process drops legitimate windows executable

      • plutonium.exe (PID: 1040)
      • 178bffd3-6a59-4141-93c2-1c834413002d.exe (PID: 2616)
      • dxwsetup.exe (PID: 3008)

    • Reads security settings of Internet Explorer

      • plutonium.exe (PID: 1040)
      • dxwsetup.exe (PID: 3008)

    • Starts a Microsoft application from unusual location

      • 178bffd3-6a59-4141-93c2-1c834413002d.exe (PID: 2912)
      • 178bffd3-6a59-4141-93c2-1c834413002d.exe (PID: 2616)
      • dxwsetup.exe (PID: 3008)

    • Searches for installed software

      • dllhost.exe (PID: 872)
      • dxwsetup.exe (PID: 3008)

    • Executes as Windows Service

      • VSSVC.exe (PID: 3392)

    • Creates/Modifies COM task schedule object

      • dxwsetup.exe (PID: 3008)

    • Checks Windows Trust Settings

      • dxwsetup.exe (PID: 3008)

  • INFO

    • Reads the machine GUID from the registry

      • plutonium.exe (PID: 1040)
      • dxwsetup.exe (PID: 3008)
      • plutonium-launcher-win32.exe (PID: 3432)

    • Checks supported languages

      • plutonium.exe (PID: 1040)
      • 178bffd3-6a59-4141-93c2-1c834413002d.exe (PID: 2616)
      • dxwsetup.exe (PID: 3008)
      • wmpnscfg.exe (PID: 1556)
      • plutonium-launcher-win32.exe (PID: 3432)

    • Creates files in the program directory

      • plutonium.exe (PID: 1040)

    • Disables trace logs

      • plutonium.exe (PID: 1040)

    • Reads Environment values

      • plutonium.exe (PID: 1040)

    • Reads the computer name

      • plutonium.exe (PID: 1040)
      • dxwsetup.exe (PID: 3008)
      • plutonium-launcher-win32.exe (PID: 3432)
      • wmpnscfg.exe (PID: 1556)

    • Reads the software policy settings

      • plutonium.exe (PID: 1040)
      • dxwsetup.exe (PID: 3008)

    • Creates files or folders in the user directory

      • plutonium.exe (PID: 1040)
      • dxwsetup.exe (PID: 3008)

    • The sample compiled with english language support

      • plutonium.exe (PID: 1040)
      • 178bffd3-6a59-4141-93c2-1c834413002d.exe (PID: 2616)
      • dxwsetup.exe (PID: 3008)

    • Drops a (possible) Coronavirus decoy

      • plutonium.exe (PID: 1040)

    • Create files in a temporary directory

      • plutonium.exe (PID: 1040)
      • 178bffd3-6a59-4141-93c2-1c834413002d.exe (PID: 2616)
      • dxwsetup.exe (PID: 3008)

    • Checks proxy server information

      • dxwsetup.exe (PID: 3008)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 1556)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2097:01:09 15:42:18+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 4820480
InitializedDataSize: 34816
UninitializedDataSize: -
EntryPoint: 0x49adde
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.221.0
ProductVersionNumber: 1.0.221.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Plutonium.Updater.App
FileDescription: Plutonium.Updater.App
FileVersion: 1.0.221.0
InternalName: Plutonium.Updater.App.exe
LegalCopyright:
OriginalFileName: Plutonium.Updater.App.exe
ProductName: Plutonium.Updater.App
ProductVersion: 1.0.221-25b01eea
AssemblyVersion: 1.0.221.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
9
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #MENORAH plutonium.exe svchost.exe 178bffd3-6a59-4141-93c2-1c834413002d.exe no specs 178bffd3-6a59-4141-93c2-1c834413002d.exe dxwsetup.exe wmpnscfg.exe no specs vssvc.exe no specs SPPSurrogate no specs plutonium-launcher-win32.exe

Process information

PID
CMD
Path
Indicators
Parent process
872C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1040"C:\Users\admin\AppData\Local\Temp\plutonium.exe" C:\Users\admin\AppData\Local\Temp\plutonium.exe
explorer.exe
User:
admin
Company:
Plutonium.Updater.App
Integrity Level:
MEDIUM
Description:
Plutonium.Updater.App
Exit code:
0
Version:
1.0.221.0
Modules
Images
c:\users\admin\appdata\local\temp\plutonium.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1108C:\Windows\system32\svchost.exe -k NetworkServiceC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1556"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2616"C:\Users\admin\AppData\Local\Temp\178bffd3-6a59-4141-93c2-1c834413002d.exe" /QC:\Users\admin\AppData\Local\Temp\178bffd3-6a59-4141-93c2-1c834413002d.exe
plutonium.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
DirectX 9.0 Web setup
Exit code:
0
Version:
9.29.1974.0
Modules
Images
c:\users\admin\appdata\local\temp\178bffd3-6a59-4141-93c2-1c834413002d.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2912"C:\Users\admin\AppData\Local\Temp\178bffd3-6a59-4141-93c2-1c834413002d.exe" /QC:\Users\admin\AppData\Local\Temp\178bffd3-6a59-4141-93c2-1c834413002d.exe—plutonium.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
DirectX 9.0 Web setup
Exit code:
3221226540
Version:
9.29.1974.0
Modules
Images
c:\users\admin\appdata\local\temp\178bffd3-6a59-4141-93c2-1c834413002d.exe
c:\windows\system32\ntdll.dll
3008C:\Users\admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe /windowsupdateC:\Users\admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
178bffd3-6a59-4141-93c2-1c834413002d.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
DirectX Setup
Exit code:
0
Version:
4.9.0.0904
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\dxwsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3392C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3432"C:\Users\admin\AppData\Local\Plutonium\bin\plutonium-launcher-win32.exe" C:\Users\admin\AppData\Local\Plutonium\bin\plutonium-launcher-win32.exe
plutonium.exe
User:
admin
Company:
Plutonium Project
Integrity Level:
MEDIUM
Description:
Plutonium Launcher
Version:
1.0.0.4542
Total events
44 170
Read events
43 824
Write events
339
Delete events
7

Modification events

(PID) Process:(1040) plutonium.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\plutonium_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1040) plutonium.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\plutonium_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(1040) plutonium.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\plutonium_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(1040) plutonium.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\plutonium_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(1040) plutonium.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\plutonium_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(1040) plutonium.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\plutonium_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(1040) plutonium.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\plutonium_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1040) plutonium.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\plutonium_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(1040) plutonium.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\plutonium_RASMANCS
Operation:writeName:FileTracingMask
Value:
(PID) Process:(1040) plutonium.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\plutonium_RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
Executable files
379
Suspicious files
653
Text files
143
Unknown types
2

Dropped files

PID
Process
Filename
Type
1040plutonium.exeC:\Users\admin\AppData\Local\Plutonium\bin\plutonium-bootstrapper-win32.exeexecutable
MD5:B4BD3FE865E88DD63496D174EF4F8F28
SHA256:E0049B7B74A2B967F9E90F94C3B1E6BF8CCC3C6D9CE6BE0E6D50693D11C69918
1040plutonium.exeC:\Users\admin\AppData\Local\Plutonium\bin\WebCore.dllexecutable
MD5:90B16ABE7F82DCAE822174B4503F4E1B
SHA256:B4D361BF13F98C96C21C3DEC94D14914FF80C3515A48CD3DF974378CD6052082
1040plutonium.exeC:\Users\admin\AppData\Local\Plutonium\bin\UltralightCore.dllexecutable
MD5:CD3768E013636A12E6CE7937A7F69365
SHA256:9ED2701BA7C3349ECBBCF276C280A09262B4DA72BE9FDCDDD81A8BAC9C9B3D69
1040plutonium.exeC:\Users\admin\AppData\Local\Plutonium\bin\Ultralight.dllexecutable
MD5:6C2949787D48F3B0C0CBD4A872253F12
SHA256:758CA54BAC8288487CFA6EA276C724FC4AD29C6D6A4294D74EA34E0726CE8661
1040plutonium.exeC:\Users\admin\AppData\Local\Plutonium\bin\discord_game_sdk.dllexecutable
MD5:955AF9BE4A97316D73AFAE1E7365E97E
SHA256:D8E7D9FEB3DE8482B186AE44FD1C9ABB41FE2B3B3D2C7CD3A4D742EBBAD30CDF
1040plutonium.exeC:\Users\admin\AppData\Local\Plutonium\bin\plutonium-launcher-win32.exeexecutable
MD5:56FC8B91D67BA4ACA65CF8FFEBF1C6A0
SHA256:83EF092C3E5E4821269E63B9F135FBE3EF811FF8A590EE4041DC6318F069728E
1040plutonium.exeC:\Users\admin\AppData\Local\Plutonium\games\iw5sp.exeexecutable
MD5:6199A36AC2928AC23AC495CC2B528477
SHA256:0EAD93EB151F1FFFE4EDD3EE3C29DB4209C951506AB44BE05735F1687123B4F0
1040plutonium.exeC:\Users\admin\AppData\Local\Plutonium\bin\AppCore.dllexecutable
MD5:80C3806A12959987AC012E28F63AD150
SHA256:B5338B858E5C65F9C36BBC817673BA5E1A05EED8F4DCF007B6BC4FF6140FC8F8
1040plutonium.exeC:\Users\admin\AppData\Local\Plutonium\launcher\assets\manifest.jsonbinary
MD5:515E59F16E9296205663258D761E2471
SHA256:B287288B090F627E66F2C492B949015BDC2F4F2B76BEEA6591D7F3D2C6F56765
1040plutonium.exeC:\Users\admin\AppData\Local\Plutonium\games\t4mp.exeexecutable
MD5:5FABA8AF039CCC3513D904AEEEA34FF7
SHA256:943BB93001AD2ED465B6652C27FB649B5F0C5B24097E18A27A588AC35B3457A0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
87
TCP/UDP connections
16
DNS requests
8
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3008
dxwsetup.exe
GET
302
23.32.101.194:80
http://download.microsoft.com/download/1/7/1/1718CCC4-6315-4D8E-9543-8E28A4E18C4C/dxupdate.cab
unknown
—
—
whitelisted
3008
dxwsetup.exe
GET
200
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?9290fe536483eb95
unknown
—
—
whitelisted
3008
dxwsetup.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
3008
dxwsetup.exe
GET
302
23.32.101.194:80
http://download.microsoft.com/download/1/7/1/1718CCC4-6315-4D8E-9543-8E28A4E18C4C/Apr2006_xinput_x86.cab
unknown
—
—
whitelisted
3008
dxwsetup.exe
GET
302
23.32.101.194:80
http://download.microsoft.com/download/1/7/1/1718CCC4-6315-4D8E-9543-8E28A4E18C4C/Feb2006_xact_x86.cab
unknown
—
—
whitelisted
3008
dxwsetup.exe
GET
302
23.32.101.194:80
http://download.microsoft.com/download/1/7/1/1718CCC4-6315-4D8E-9543-8E28A4E18C4C/Jun2006_xact_x86.cab
unknown
—
—
whitelisted
3008
dxwsetup.exe
GET
302
23.32.101.194:80
http://download.microsoft.com/download/1/7/1/1718CCC4-6315-4D8E-9543-8E28A4E18C4C/Apr2006_xact_x86.cab
unknown
—
—
whitelisted
3008
dxwsetup.exe
GET
302
23.32.101.194:80
http://download.microsoft.com/download/1/7/1/1718CCC4-6315-4D8E-9543-8E28A4E18C4C/Aug2006_xact_x86.cab
unknown
—
—
whitelisted
3008
dxwsetup.exe
GET
302
23.32.101.194:80
http://download.microsoft.com/download/1/7/1/1718CCC4-6315-4D8E-9543-8E28A4E18C4C/Aug2006_xinput_x86.cab
unknown
—
—
whitelisted
3008
dxwsetup.exe
GET
302
23.32.101.194:80
http://download.microsoft.com/download/1/7/1/1718CCC4-6315-4D8E-9543-8E28A4E18C4C/Oct2006_xact_x86.cab
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1108
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
1040
plutonium.exe
104.26.15.172:443
cdn.plutonium.pw
CLOUDFLARENET
US
suspicious
1040
plutonium.exe
104.21.16.1:443
cdn.plutoniummod.com
CLOUDFLARENET
—
unknown
1040
plutonium.exe
23.32.101.194:443
download.microsoft.com
AKAMAI-AS
SE
whitelisted
3008
dxwsetup.exe
23.32.101.194:80
download.microsoft.com
AKAMAI-AS
SE
whitelisted
3008
dxwsetup.exe
23.32.101.194:443
download.microsoft.com
AKAMAI-AS
SE
whitelisted
3008
dxwsetup.exe
199.232.214.172:80
ctldl.windowsupdate.com
FASTLY
US
whitelisted
3008
dxwsetup.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
cdn.plutonium.pw
  • 104.26.15.172
  • 172.67.71.109
  • 104.26.14.172
unknown
cdn.plutoniummod.com
  • 104.21.16.1
  • 104.21.32.1
  • 104.21.48.1
  • 104.21.64.1
  • 104.21.80.1
  • 104.21.96.1
  • 104.21.112.1
unknown
download.microsoft.com
  • 23.32.101.194
whitelisted
ctldl.windowsupdate.com
  • 199.232.214.172
  • 199.232.210.172
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
use.typekit.net
  • 23.72.250.86
  • 23.72.250.92
whitelisted
kit.fontawesome.com
  • 104.18.40.68
  • 172.64.147.188
whitelisted
p.typekit.net
  • 184.24.77.146
  • 184.24.77.154
whitelisted

Threats

PID
Process
Class
Message
1108
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.pw domain - Likely Hostile
Process
Message
dxwsetup.exe
DLL_PROCESS_ATTACH
dxwsetup.exe
DLL_PROCESS_ATTACH
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
plutonium.exe