analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | hah.rar |
| Full analysis: | https://app.any.run/tasks/a12fe25d-cbbd-4836-aa2e-b78e3e56321d |
| Verdict: | Malicious activity |
| Threats: | Gootkit is an advanced banking trojan. It is extremely good at evading detection and has an incredibly effective persistence mechanism, making it a dangerous malware that researchers and organizations should be aware of. |
| Analysis date: | January 24, 2022, 21:48:30 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-rar |
| File info: | RAR archive data, v5 |
| MD5: | B2A07A6A9AF4A4EE733241C1E88BF174 |
| SHA1: | FE416F9832D6AD67E38584583CB4CA532AA92EE7 |
| SHA256: | 887A7B19BDFC625F8B9B3C28A94A7090D484C296F8A8E566503EE08B63918094 |
| SSDEEP: | 196608:zge8Z+qMRHC+DJvreE/IMl3OEJD6kpepUzOgj+yJdYpIVjgwLy3z/+woO:zgei+ZRHC2hrei1OEEkIpUKgCy2Ugwul |
MALICIOUS
Application was dropped or rewritten from another process
- mash_full_setup.exe (PID: 3968)
- mash_full_setup.exe (PID: 1412)
- spchapi.exe (PID: 3172)
- AgentSvr.exe (PID: 3336)
- MerlinKill 2.0.exe (PID: 1500)
- MerlinKill 2.0.exe (PID: 3544)
- xp11.exe (PID: 3464)
- meme.exe (PID: 436)
- AgentSvr.exe (PID: 3544)
- Project1.exe (PID: 712)
- SpongeBob_ScreenToy.exe (PID: 3460)
- Lego.exe (PID: 1088)
- XO.EXE (PID: 1200)
- INS4F71.tmp (PID: 2676)
- StartBlueScreen.exe (PID: 532)
Drops executable file immediately after starts
- mash_full_setup.exe (PID: 3968)
- mash_full_setup.exe (PID: 1412)
- mash_full_setup.exe.tmp (PID: 3464)
- msagent.exe (PID: 2768)
- tv_enua.exe (PID: 2812)
- spchcpl.exe (PID: 4048)
- spchapi.exe (PID: 3172)
- MerlinKill 2.0.exe (PID: 3544)
- Lego.exe (PID: 1088)
- INS4F71.tmp (PID: 2676)
- StartBlueScreen.exe (PID: 532)
Registers / Runs the DLL via REGSVR32.EXE
- mash_full_setup.exe.tmp (PID: 3464)
- msagent.exe (PID: 2768)
- tv_enua.exe (PID: 2812)
Changes the autorun value in the registry
- tv_enua.exe (PID: 2812)
- rundll32.exe (PID: 3004)
Loads dropped or rewritten executable
- regsvr32.exe (PID: 2096)
- regsvr32.exe (PID: 2348)
- regsvr32.exe (PID: 2640)
- regsvr32.exe (PID: 3180)
- regsvr32.exe (PID: 3128)
- regsvr32.exe (PID: 600)
- consent.exe (PID: 3236)
- grpconv.exe (PID: 3360)
- DllHost.exe (PID: 3412)
- regsvr32.exe (PID: 4004)
- DllHost.exe (PID: 3224)
- spchapi.exe (PID: 3172)
- regsvr32.exe (PID: 880)
- grpconv.exe (PID: 2888)
- regsvr32.exe (PID: 2388)
- AgentSvr.exe (PID: 3336)
- WinRAR.exe (PID: 3316)
- regsvr32.exe (PID: 1368)
- DllHost.exe (PID: 3280)
- mash_full_setup.exe (PID: 1412)
- mash_full_setup.exe (PID: 3968)
- MerlinKill 2.0.exe (PID: 1500)
- regsvr32.exe (PID: 2336)
- regsvr32.exe (PID: 1304)
- regsvr32.exe (PID: 1168)
- DllHost.exe (PID: 2812)
- grpconv.exe (PID: 3832)
- grpconv.exe (PID: 2436)
- consent.exe (PID: 2228)
- MerlinKill 2.0.exe (PID: 3544)
- DllHost.exe (PID: 3304)
- conhost.exe (PID: 3524)
- DllHost.exe (PID: 3480)
- cmd.exe (PID: 3412)
- xp11.exe (PID: 3464)
- PING.EXE (PID: 3268)
- rundll32.exe (PID: 3004)
- runonce.exe (PID: 2568)
- meme.exe (PID: 436)
- rundll32.exe (PID: 4072)
- Project1.exe (PID: 712)
- grpconv.exe (PID: 1480)
- AgentSvr.exe (PID: 3544)
- SpongeBob_ScreenToy.exe (PID: 3460)
- conhost.exe (PID: 1688)
- cmd.exe (PID: 2644)
- mspaint.exe (PID: 3088)
- notepad.exe (PID: 3204)
- conhost.exe (PID: 2764)
- winver.exe (PID: 3816)
- cmd.exe (PID: 4052)
- wordpad.exe (PID: 3764)
- svchost.exe (PID: 3520)
- consent.exe (PID: 888)
- consent.exe (PID: 744)
- osk.exe (PID: 3160)
- Lego.exe (PID: 1088)
- INS4F71.tmp (PID: 2676)
- XO.EXE (PID: 1200)
- Narrator.exe (PID: 2076)
- DllHost.exe (PID: 832)
- SearchProtocolHost.exe (PID: 3256)
- DllHost.exe (PID: 3956)
- SearchFilterHost.exe (PID: 2244)
- conhost.exe (PID: 3324)
- taskkill.exe (PID: 3652)
- cmd.exe (PID: 2856)
- wmiprvse.exe (PID: 272)
- cmd.exe (PID: 2332)
- conhost.exe (PID: 2248)
- StartBlueScreen.exe (PID: 532)
GOOTKIT detected
- spchapi.exe (PID: 3172)
Runs PING.EXE for delay simulation
- cmd.exe (PID: 3412)
Runs app for hidden code execution
- cmd.exe (PID: 4052)
Tries to delete the host file
- cmd.exe (PID: 2856)
SUSPICIOUS
Checks supported languages
- mash_full_setup.exe (PID: 3968)
- WinRAR.exe (PID: 3316)
- mash_full_setup.exe.tmp (PID: 3268)
- mash_full_setup.exe (PID: 1412)
- mash_full_setup.exe.tmp (PID: 3464)
- msagent.exe (PID: 2768)
- tv_enua.exe (PID: 2812)
- AgentSvr.exe (PID: 3336)
- spchcpl.exe (PID: 4048)
- spchapi.exe (PID: 3172)
- MerlinKill 2.0.exe (PID: 1500)
- MerlinKill 2.0.exe (PID: 3544)
- cmd.exe (PID: 3412)
- xp11.exe (PID: 3464)
- conhost.exe (PID: 3524)
- AgentSvr.exe (PID: 3544)
- meme.exe (PID: 436)
- conhost.exe (PID: 1688)
- Project1.exe (PID: 712)
- cmd.exe (PID: 4052)
- SpongeBob_ScreenToy.exe (PID: 3460)
- cmd.exe (PID: 2644)
- wordpad.exe (PID: 3764)
- conhost.exe (PID: 2764)
- Lego.exe (PID: 1088)
- XO.EXE (PID: 1200)
- INS4F71.tmp (PID: 2676)
- conhost.exe (PID: 3324)
- cmd.exe (PID: 2856)
- wmiprvse.exe (PID: 272)
- cmd.exe (PID: 2332)
- conhost.exe (PID: 2248)
- StartBlueScreen.exe (PID: 532)
Reads the computer name
- WinRAR.exe (PID: 3316)
- mash_full_setup.exe.tmp (PID: 3268)
- mash_full_setup.exe.tmp (PID: 3464)
- msagent.exe (PID: 2768)
- tv_enua.exe (PID: 2812)
- spchcpl.exe (PID: 4048)
- spchapi.exe (PID: 3172)
- MerlinKill 2.0.exe (PID: 1500)
- MerlinKill 2.0.exe (PID: 3544)
- AgentSvr.exe (PID: 3544)
- meme.exe (PID: 436)
- cmd.exe (PID: 4052)
- wordpad.exe (PID: 3764)
- INS4F71.tmp (PID: 2676)
- wmiprvse.exe (PID: 272)
- StartBlueScreen.exe (PID: 532)
Executable content was dropped or overwritten
- mash_full_setup.exe (PID: 3968)
- WinRAR.exe (PID: 3316)
- mash_full_setup.exe (PID: 1412)
- mash_full_setup.exe.tmp (PID: 3464)
- msagent.exe (PID: 2768)
- tv_enua.exe (PID: 2812)
- spchcpl.exe (PID: 4048)
- spchapi.exe (PID: 3172)
- MerlinKill 2.0.exe (PID: 3544)
- Lego.exe (PID: 1088)
- INS4F71.tmp (PID: 2676)
- StartBlueScreen.exe (PID: 532)
Drops a file with too old compile date
- WinRAR.exe (PID: 3316)
- mash_full_setup.exe (PID: 3968)
- mash_full_setup.exe (PID: 1412)
- mash_full_setup.exe.tmp (PID: 3464)
- msagent.exe (PID: 2768)
- tv_enua.exe (PID: 2812)
- spchapi.exe (PID: 3172)
- spchcpl.exe (PID: 4048)
- MerlinKill 2.0.exe (PID: 3544)
- Lego.exe (PID: 1088)
- INS4F71.tmp (PID: 2676)
- StartBlueScreen.exe (PID: 532)
Drops a file that was compiled in debug mode
- WinRAR.exe (PID: 3316)
- mash_full_setup.exe.tmp (PID: 3464)
- msagent.exe (PID: 2768)
- tv_enua.exe (PID: 2812)
- spchcpl.exe (PID: 4048)
- spchapi.exe (PID: 3172)
- MerlinKill 2.0.exe (PID: 3544)
- INS4F71.tmp (PID: 2676)
Reads the Windows organization settings
- mash_full_setup.exe.tmp (PID: 3464)
- winver.exe (PID: 3816)
Reads Windows owner or organization settings
- mash_full_setup.exe.tmp (PID: 3464)
- winver.exe (PID: 3816)
Creates a directory in Program Files
- mash_full_setup.exe.tmp (PID: 3464)
- INS4F71.tmp (PID: 2676)
Creates files in the Windows directory
- mash_full_setup.exe.tmp (PID: 3464)
- msagent.exe (PID: 2768)
- tv_enua.exe (PID: 2812)
- spchcpl.exe (PID: 4048)
- spchapi.exe (PID: 3172)
- rundll32.exe (PID: 3004)
- StartBlueScreen.exe (PID: 532)
Creates/Modifies COM task schedule object
- regsvr32.exe (PID: 1168)
- regsvr32.exe (PID: 2348)
- regsvr32.exe (PID: 600)
- regsvr32.exe (PID: 3180)
- regsvr32.exe (PID: 3128)
- regsvr32.exe (PID: 2640)
- regsvr32.exe (PID: 2096)
- regsvr32.exe (PID: 2336)
- regsvr32.exe (PID: 2388)
- regsvr32.exe (PID: 880)
- spchapi.exe (PID: 3172)
Changes default file association
- mash_full_setup.exe.tmp (PID: 3464)
Drops a file with a compile date too recent
- msagent.exe (PID: 2768)
- tv_enua.exe (PID: 2812)
- spchcpl.exe (PID: 4048)
- spchapi.exe (PID: 3172)
Removes files from Windows directory
- msagent.exe (PID: 2768)
- tv_enua.exe (PID: 2812)
- spchcpl.exe (PID: 4048)
- spchapi.exe (PID: 3172)
- rundll32.exe (PID: 3004)
- cmd.exe (PID: 2856)
Reads Microsoft Outlook installation path
- MerlinKill 2.0.exe (PID: 1500)
Reads internet explorer settings
- MerlinKill 2.0.exe (PID: 1500)
- Narrator.exe (PID: 2076)
Application launched itself
- MerlinKill 2.0.exe (PID: 1500)
- cmd.exe (PID: 4052)
Starts CMD.EXE for commands execution
- MerlinKill 2.0.exe (PID: 3544)
- cmd.exe (PID: 4052)
- meme.exe (PID: 436)
Uses RUNDLL32.EXE to load library
- xp11.exe (PID: 3464)
- runonce.exe (PID: 2568)
Reads the time zone
- runonce.exe (PID: 2568)
Executed via COM
- AgentSvr.exe (PID: 3544)
Starts application with an unusual extension
- Lego.exe (PID: 1088)
Creates files in the user directory
- Narrator.exe (PID: 2076)
Creates files in the program directory
- INS4F71.tmp (PID: 2676)
Creates a software uninstall entry
- INS4F71.tmp (PID: 2676)
Uses TASKKILL.EXE to kill process
- cmd.exe (PID: 2856)
Creates files in the driver directory
- StartBlueScreen.exe (PID: 532)
Creates or modifies windows services
- StartBlueScreen.exe (PID: 532)
INFO
Checks supported languages
- DllHost.exe (PID: 2812)
- consent.exe (PID: 3236)
- DllHost.exe (PID: 3224)
- DllHost.exe (PID: 3412)
- regsvr32.exe (PID: 4004)
- regsvr32.exe (PID: 1304)
- regsvr32.exe (PID: 1168)
- regsvr32.exe (PID: 1368)
- regsvr32.exe (PID: 2348)
- DllHost.exe (PID: 3280)
- regsvr32.exe (PID: 600)
- regsvr32.exe (PID: 2336)
- regsvr32.exe (PID: 3128)
- regsvr32.exe (PID: 3180)
- regsvr32.exe (PID: 2096)
- regsvr32.exe (PID: 2640)
- grpconv.exe (PID: 3360)
- grpconv.exe (PID: 2888)
- regsvr32.exe (PID: 2388)
- regsvr32.exe (PID: 880)
- grpconv.exe (PID: 2436)
- grpconv.exe (PID: 3832)
- consent.exe (PID: 2228)
- DllHost.exe (PID: 3480)
- DllHost.exe (PID: 3304)
- rundll32.exe (PID: 3004)
- PING.EXE (PID: 3268)
- runonce.exe (PID: 2568)
- grpconv.exe (PID: 1480)
- rundll32.exe (PID: 4072)
- mspaint.exe (PID: 3088)
- svchost.exe (PID: 3520)
- winver.exe (PID: 3816)
- notepad.exe (PID: 3204)
- consent.exe (PID: 888)
- Narrator.exe (PID: 2076)
- osk.exe (PID: 3160)
- consent.exe (PID: 744)
- DllHost.exe (PID: 832)
- SearchProtocolHost.exe (PID: 3256)
- SearchFilterHost.exe (PID: 2244)
- DllHost.exe (PID: 3956)
- taskkill.exe (PID: 3652)
Reads the computer name
- DllHost.exe (PID: 2812)
- consent.exe (PID: 3236)
- DllHost.exe (PID: 3224)
- DllHost.exe (PID: 3412)
- regsvr32.exe (PID: 1304)
- regsvr32.exe (PID: 4004)
- regsvr32.exe (PID: 1368)
- DllHost.exe (PID: 3280)
- DllHost.exe (PID: 3304)
- DllHost.exe (PID: 3480)
- consent.exe (PID: 2228)
- rundll32.exe (PID: 4072)
- runonce.exe (PID: 2568)
- PING.EXE (PID: 3268)
- rundll32.exe (PID: 3004)
- mspaint.exe (PID: 3088)
- consent.exe (PID: 888)
- svchost.exe (PID: 3520)
- consent.exe (PID: 744)
- Narrator.exe (PID: 2076)
- osk.exe (PID: 3160)
- DllHost.exe (PID: 832)
- SearchProtocolHost.exe (PID: 3256)
- SearchFilterHost.exe (PID: 2244)
- DllHost.exe (PID: 3956)
- taskkill.exe (PID: 3652)
Manual execution by user
- mash_full_setup.exe (PID: 3968)
- MerlinKill 2.0.exe (PID: 1500)
Checks Windows Trust Settings
- consent.exe (PID: 3236)
- consent.exe (PID: 2228)
- consent.exe (PID: 888)
- consent.exe (PID: 744)
Application was dropped or rewritten from another process
- mash_full_setup.exe.tmp (PID: 3268)
- mash_full_setup.exe.tmp (PID: 3464)
- msagent.exe (PID: 2768)
- tv_enua.exe (PID: 2812)
- spchcpl.exe (PID: 4048)
Loads dropped or rewritten executable
- mash_full_setup.exe.tmp (PID: 3464)
- msagent.exe (PID: 2768)
- tv_enua.exe (PID: 2812)
- spchcpl.exe (PID: 4048)
- mash_full_setup.exe.tmp (PID: 3268)
Creates files in the program directory
- mash_full_setup.exe.tmp (PID: 3464)
Reads mouse settings
- regsvr32.exe (PID: 1368)
Creates a software uninstall entry
- mash_full_setup.exe.tmp (PID: 3464)
- tv_enua.exe (PID: 2812)
Reads CPU info
- runonce.exe (PID: 2568)
Reads settings of System Certificates
- consent.exe (PID: 888)
- consent.exe (PID: 744)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .rar | | | RAR compressed archive (v5.0) (61.5) |
|---|---|---|
| .rar | | | RAR compressed archive (gen) (38.4) |
Total processes
113
Monitored processes
80
Malicious processes
22
Suspicious processes
17
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 3316 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\hah.rar" | C:\Program Files\WinRAR\WinRAR.exe | Explorer.EXE | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 3968 | "C:\Users\admin\Desktop\hah\mash_full_setup.exe" | C:\Users\admin\Desktop\hah\mash_full_setup.exe | Explorer.EXE | ||||||||||||
User: admin Company: BellCraft Technologies Integrity Level: MEDIUM Description: MASH Setup Exit code: 0 Version: Modules
| |||||||||||||||
| 3268 | "C:\Users\admin\AppData\Local\Temp\is-BV4VV.tmp\mash_full_setup.exe.tmp" /SL5="$201C2,6008127,53248,C:\Users\admin\Desktop\hah\mash_full_setup.exe" | C:\Users\admin\AppData\Local\Temp\is-BV4VV.tmp\mash_full_setup.exe.tmp | — | mash_full_setup.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Setup/Uninstall Exit code: 0 Version: 51.48.0.0 Modules
| |||||||||||||||
| 1412 | "C:\Users\admin\Desktop\hah\mash_full_setup.exe" /SPAWNWND=$2021E /NOTIFYWND=$201C2 | C:\Users\admin\Desktop\hah\mash_full_setup.exe | mash_full_setup.exe.tmp | ||||||||||||
User: admin Company: BellCraft Technologies Integrity Level: HIGH Description: MASH Setup Exit code: 0 Version: Modules
| |||||||||||||||
| 3464 | "C:\Users\admin\AppData\Local\Temp\is-70DEP.tmp\mash_full_setup.exe.tmp" /SL5="$3021C,6008127,53248,C:\Users\admin\Desktop\hah\mash_full_setup.exe" /SPAWNWND=$2021E /NOTIFYWND=$201C2 | C:\Users\admin\AppData\Local\Temp\is-70DEP.tmp\mash_full_setup.exe.tmp | mash_full_setup.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Setup/Uninstall Exit code: 0 Version: 51.48.0.0 Modules
| |||||||||||||||
| 4004 | "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\COMDLG32.OCX" | C:\Windows\system32\regsvr32.exe | — | mash_full_setup.exe.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft(C) Register Server Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1368 | "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\MSCOMCTL.OCX" | C:\Windows\system32\regsvr32.exe | — | mash_full_setup.exe.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft(C) Register Server Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1304 | "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\RICHTX32.OCX" | C:\Windows\system32\regsvr32.exe | — | mash_full_setup.exe.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft(C) Register Server Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1168 | "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\MSVBVM60.dll" | C:\Windows\system32\regsvr32.exe | — | mash_full_setup.exe.tmp | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Microsoft(C) Register Server Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2768 | "C:\Users\admin\AppData\Local\Temp\is-68PMJ.tmp\msagent.exe" /Q:A | C:\Users\admin\AppData\Local\Temp\is-68PMJ.tmp\msagent.exe | mash_full_setup.exe.tmp | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Win32 Cabinet Self-Extractor Exit code: 0 Version: 4.71.1015.0 Modules
| |||||||||||||||
Total events
15 563
Read events
13 888
Write events
0
Delete events
0
Modification events
Executable files
144
Suspicious files
15
Text files
59
Unknown types
32
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3316 | WinRAR.exe | C:\Users\admin\Desktop\hah\MerlinKill 2.0.exe | executable | |
MD5:51E2055D3467726FFE787DBDBAEA0544 | SHA256:9CC8768C526D601A04B2AA46CEB1ADF4986312FFBDFDABBECDE4F45EA10086DF | |||
| 3464 | mash_full_setup.exe.tmp | C:\Program Files\BellCraft.com\MASH\is-JHR4O.tmp | chm | |
MD5:CC7C6CF1ADAF17773589C90D65F8C173 | SHA256:7C0570592C435AC95B029762FEB25D9ACEE95FABF8BA4D3EA772DB466A5FCAE3 | |||
| 3464 | mash_full_setup.exe.tmp | C:\Program Files\BellCraft.com\MASH\is-RTJT3.tmp | text | |
MD5:816D59B6DA5F34FE80B8E2D1647FE63D | SHA256:88D20E6925F7BC11434A2793D6A9FA37FBB26366A0F8CE50B3C1779C594F13CA | |||
| 3464 | mash_full_setup.exe.tmp | C:\Users\admin\AppData\Local\Temp\is-68PMJ.tmp\_isetup\_RegDLL.tmp | executable | |
MD5:C594B792B9C556EA62A30DE541D2FB03 | SHA256:5DCC1E0A197922907BCA2C4369F778BD07EE4B1BBBDF633E987A028A314D548E | |||
| 3464 | mash_full_setup.exe.tmp | C:\Program Files\BellCraft.com\MASH\is-4M7F3.tmp | text | |
MD5:43C8F9189162D2FD142B261AC06B90C9 | SHA256:26512915E5E2E8E1FAD2F6FFB904B0A3F22EF87B8D094D423E45FA2B672AAF9F | |||
| 3464 | mash_full_setup.exe.tmp | C:\Program Files\BellCraft.com\MASH\MASH.ini | ini | |
MD5:14EE168040435559B97C3F6E16A85BD8 | SHA256:3E0493BDE8EED23B62B9C10675370F6B08E4203FD27FD903822659E12B3965EB | |||
| 3464 | mash_full_setup.exe.tmp | C:\Program Files\BellCraft.com\MASH\is-88PM5.tmp | executable | |
MD5:B3A3BDBC5F8B5BCB1B969744CEEF49EE | SHA256:6F132475676FAEEBF08272949140A54E6BA6743F93DBE5634864964504F8DD4E | |||
| 3464 | mash_full_setup.exe.tmp | C:\Program Files\BellCraft.com\MASH\is-6CHDU.tmp | ini | |
MD5:14EE168040435559B97C3F6E16A85BD8 | SHA256:3E0493BDE8EED23B62B9C10675370F6B08E4203FD27FD903822659E12B3965EB | |||
| 3464 | mash_full_setup.exe.tmp | C:\Program Files\BellCraft.com\MASH\is-632K7.tmp | executable | |
MD5:09CB2C84E23E4E0F2A6CCFA83266CF1B | SHA256:5DAE582A0F939CD8EB425D0520C242AA1FF02496695E3513D50154B7EA866601 | |||
| 3464 | mash_full_setup.exe.tmp | C:\Program Files\BellCraft.com\MASH\unins000.exe | executable | |
MD5:09CB2C84E23E4E0F2A6CCFA83266CF1B | SHA256:5DAE582A0F939CD8EB425D0520C242AA1FF02496695E3513D50154B7EA866601 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
DNS requests
Threats
Process | Message |
|---|---|
AgentSvr.exe |
++++++ ITTSCentral::Release() Called ++++++
|
AgentSvr.exe |
++++++ ITTSCentral::Release() Called ++++++
|
AgentSvr.exe | ClaimOutput
|
AgentSvr.exe | UnclaimOutput
|
AgentSvr.exe | ClaimOutput
|
AgentSvr.exe | UnclaimOutput
|
AgentSvr.exe | ClaimOutput
|
AgentSvr.exe | UnclaimOutput
|
AgentSvr.exe | ClaimOutput
|
AgentSvr.exe | UnclaimOutput
|