File name:

702ab38086350094b28c8df1b670f84f.exe

Full analysis: https://app.any.run/tasks/5ad2aa1b-6e72-4b70-a841-8ff51037d505
Verdict: Malicious activity
Threats:

Rhadamanthys is a C++ information-stealing malware that extracts sensitive data from infiltrated machines. Its layered operational chain and advanced evasion tactics make it a major risk in cybersecurity landscapes.

Malware Trends Tracker     >>>
Analysis date: August 20, 2024, 07:37:43
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
rhadamanthys
stealer
shellcode
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

702AB38086350094B28C8DF1B670F84F

SHA1:

3A6FF038D4E70D9F5E4A48F617612F9FC330BC03

SHA256:

8B738C9057BAA2C3219120919226E95659CCCEC0DC61ACA579BBA58C7090719E

SSDEEP:

98304:B/kvuFbGjL9rLTNamBbetKeDB7hZlPUffCFG3VGGqw:L

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Antivirus name has been found in the command line (generic signature)

      • findstr.exe (PID: 6428)
      • findstr.exe (PID: 7056)

    • Create files in the Startup directory

      • cmd.exe (PID: 6164)

    • RHADAMANTHYS has been detected (SURICATA)

      • OpenWith.exe (PID: 6992)
      • OOBE-Maintenance.exe (PID: 6364)
      • dllhost.exe (PID: 7024)

    • Actions looks like stealing of personal data

      • OOBE-Maintenance.exe (PID: 6364)

    • Stealers network behavior

      • OOBE-Maintenance.exe (PID: 6364)

    • RHADAMANTHYS has been detected (YARA)

      • OOBE-Maintenance.exe (PID: 6364)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 702ab38086350094b28c8df1b670f84f.exe (PID: 6884)

    • Get information on the list of running processes

      • cmd.exe (PID: 6968)

    • Application launched itself

      • cmd.exe (PID: 6968)

    • Executing commands from ".cmd" file

      • 702ab38086350094b28c8df1b670f84f.exe (PID: 6884)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 6968)
      • 702ab38086350094b28c8df1b670f84f.exe (PID: 6884)

    • Executable content was dropped or overwritten

      • cmd.exe (PID: 6968)
      • Internet.pif (PID: 5492)

    • The executable file from the user directory is run by the CMD process

      • Internet.pif (PID: 5492)

    • Drops a file with a rarely used extension (PIF)

      • cmd.exe (PID: 6968)
      • Internet.pif (PID: 5492)

    • Starts application with an unusual extension

      • cmd.exe (PID: 6968)

    • Drops the executable file immediately after the start

      • cmd.exe (PID: 6968)
      • Internet.pif (PID: 5492)
      • 702ab38086350094b28c8df1b670f84f.exe (PID: 6884)

    • Connects to unusual port

      • OpenWith.exe (PID: 6992)
      • OOBE-Maintenance.exe (PID: 6364)

    • Executes application which crashes

      • Internet.pif (PID: 5492)

    • The process checks if it is being run in the virtual environment

      • OpenWith.exe (PID: 6992)

    • Contacting a server suspected of hosting an CnC

      • OOBE-Maintenance.exe (PID: 6364)
      • OpenWith.exe (PID: 6992)
      • dllhost.exe (PID: 7024)

    • Loads DLL from Mozilla Firefox

      • OOBE-Maintenance.exe (PID: 6364)

    • Searches for installed software

      • OOBE-Maintenance.exe (PID: 6364)

    • Using 'findstr.exe' to search for text patterns in files and output

      • cmd.exe (PID: 6968)

    • Reads the date of Windows installation

      • 702ab38086350094b28c8df1b670f84f.exe (PID: 6884)

  • INFO

    • Create files in a temporary directory

      • 702ab38086350094b28c8df1b670f84f.exe (PID: 6884)

    • Checks supported languages

      • 702ab38086350094b28c8df1b670f84f.exe (PID: 6884)
      • Internet.pif (PID: 5492)
      • wmpshare.exe (PID: 3304)

    • Reads the computer name

      • 702ab38086350094b28c8df1b670f84f.exe (PID: 6884)
      • Internet.pif (PID: 5492)

    • Process checks computer location settings

      • 702ab38086350094b28c8df1b670f84f.exe (PID: 6884)

    • Reads mouse settings

      • Internet.pif (PID: 5492)

    • Manual execution by a user

      • OOBE-Maintenance.exe (PID: 6364)
      • cmd.exe (PID: 6164)
      • OpenWith.exe (PID: 6992)

    • Creates files or folders in the user directory

      • Internet.pif (PID: 5492)

    • Reads the machine GUID from the registry

      • wmpshare.exe (PID: 3304)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2010:04:10 12:19:38+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 26624
InitializedDataSize: 475136
UninitializedDataSize: 16896
EntryPoint: 0x3415
OSVersion: 5
ImageVersion: 6
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 7.6292.0.5224
ProductVersionNumber: 7.6292.0.5224
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: Empowers creative minds with cutting-edge tools for design and innovation.
CompanyName: DesignWave Technologies
FileDescription: Empowers creative minds with cutting-edge tools for design and innovation.
FileVersion: 7.6292.0.5224
LegalCopyright: Copyright © DesignWave Technologies 2017 All rights reserved.
LegalTrademarks: InnoWave is a trademark of DesignWave Technologies
ProductName: InnoWave
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
152
Monitored processes
20
Malicious processes
5
Suspicious processes
2

Behavior graph

Click at the process to see the details
start 702ab38086350094b28c8df1b670f84f.exe no specs cmd.exe conhost.exe no specs tasklist.exe no specs findstr.exe no specs tasklist.exe no specs findstr.exe no specs cmd.exe no specs findstr.exe no specs cmd.exe no specs internet.pif choice.exe no specs cmd.exe conhost.exe no specs #RHADAMANTHYS openwith.exe werfault.exe no specs #RHADAMANTHYS oobe-maintenance.exe conhost.exe no specs wmpshare.exe no specs #RHADAMANTHYS dllhost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2208\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3176cmd /c copy /b ..\Reports + ..\Ontario + ..\Contacting + ..\Midlands + ..\Guestbook + ..\Placement + ..\Patricia + ..\Saving + ..\Addition + ..\Publisher + ..\Machine + ..\Blowjobs + ..\Ni E C:\Windows\SysWOW64\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3304"C:\Program Files\Windows Media Player\wmpshare.exe"C:\Program Files\Windows Media Player\wmpshare.exe—OOBE-Maintenance.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Folder Sharing Executable
Version:
12.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\program files\windows media player\wmpshare.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5492Internet.pif E C:\Users\admin\AppData\Local\Temp\561944\Internet.pif
cmd.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
3221225477
Version:
3, 3, 14, 5
Modules
Images
c:\users\admin\appdata\local\temp\561944\internet.pif
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
6164cmd /k echo [InternetShortcut] > "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoWave.url" & echo URL="C:\Users\admin\AppData\Local\DesignWave Technologies\InnoWave.js" >> "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\InnoWave.url" & exitC:\Windows\SysWOW64\cmd.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6352\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—OOBE-Maintenance.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6364"C:\WINDOWS\system32\OOBE-Maintenance.exe"C:\Windows\System32\OOBE-Maintenance.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
OOBE-Maintenance
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\oobe-maintenance.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\shcore.dll
6408choice /d y /t 5C:\Windows\SysWOW64\choice.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Offers the user a choice
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\choice.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6428findstr /I "avastui.exe avgui.exe bdservicehost.exe ekrn.exe nswscsvc.exe sophoshealth.exe" C:\Windows\SysWOW64\findstr.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Find String (QGREP) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\findstr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6488tasklist C:\Windows\SysWOW64\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
6 479
Read events
6 465
Write events
9
Delete events
5

Modification events

(PID) Process:(6884) 702ab38086350094b28c8df1b670f84f.exeKey:HKEY_CURRENT_USER
Operation:delete valueName:JobCrisis
Value:
(PID) Process:(6884) 702ab38086350094b28c8df1b670f84f.exeKey:HKEY_CURRENT_USER
Operation:delete valueName:WishWasher
Value:
(PID) Process:(6884) 702ab38086350094b28c8df1b670f84f.exeKey:HKEY_CURRENT_USER
Operation:delete valueName:IncreasesFees
Value:
(PID) Process:(6884) 702ab38086350094b28c8df1b670f84f.exeKey:HKEY_CURRENT_USER
Operation:delete valueName:CohenAware
Value:
(PID) Process:(6884) 702ab38086350094b28c8df1b670f84f.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6884) 702ab38086350094b28c8df1b670f84f.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6884) 702ab38086350094b28c8df1b670f84f.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6884) 702ab38086350094b28c8df1b670f84f.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6884) 702ab38086350094b28c8df1b670f84f.exeKey:HKEY_CURRENT_USER
Operation:delete valueName:BecauseEquilibrium
Value:
(PID) Process:(5492) Internet.pifKey:HKEY_CURRENT_USER\SOFTWARE\SibCode
Operation:writeName:sn2
Value:
C659EAF00D41CB2BF6BC589924FF76AA0F95F4EDD1D40368556CEE15391B9632B46F0F0C3B3F3FE0C9404F47EE4215ABF12C942420C3DF64B8FF98B245B8706F
Executable files
2
Suspicious files
17
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
6884702ab38086350094b28c8df1b670f84f.exeC:\Users\admin\AppData\Local\Temp\Almosttext
MD5:F629C391BB2A555D7201BA313533CB61
SHA256:A841624B9936A625F45CFFFC446271BE2191C3204BF7BAA7BDF8890E6DB691F3
6884702ab38086350094b28c8df1b670f84f.exeC:\Users\admin\AppData\Local\Temp\Reportsbinary
MD5:ABD0E032EEA4B26922CE864C12450B46
SHA256:215D9E7FB728FE11BFE89FB072D4F6BD2903504C466ED5C8CA0C5029B12CA5B2
6884702ab38086350094b28c8df1b670f84f.exeC:\Users\admin\AppData\Local\Temp\Ontariobinary
MD5:8B6E671BCDE125B3094E8A844DC83EB9
SHA256:05536696A886B9FFC228F97BF9399113E0E335F6D416C53AE15053F595D8AB78
6884702ab38086350094b28c8df1b670f84f.exeC:\Users\admin\AppData\Local\Temp\Additionbinary
MD5:A7D7793318E8460F41BC73FFDAA4BF3C
SHA256:FFFBC97502FC6B21552CA1FE3537A78A56A2553632938B2D4916295C47A26DE9
6884702ab38086350094b28c8df1b670f84f.exeC:\Users\admin\AppData\Local\Temp\Contactingbinary
MD5:9EB5963E5D1F1B50EDA17EC0743189AA
SHA256:761AF1F43943C43177D47EBB89FADA2583481AFB3C9655C25665D22A39994D67
6968cmd.exeC:\Users\admin\AppData\Local\Temp\561944\Internet.pifexecutable
MD5:C7F4524EE853537A20DE830FCEAA3346
SHA256:BAF7B144B41F37B997C2D238FD5C1813AFD538CBCA9CBE29E8C020AF59960AA6
6884702ab38086350094b28c8df1b670f84f.exeC:\Users\admin\AppData\Local\Temp\Guestbookbinary
MD5:79EFBA76FD8B1B30963707B8BF350501
SHA256:7A41B11BB70E4BABB6ED10A663A67CC5B9B74C3112BB2B2258DB5AB74082E141
6884702ab38086350094b28c8df1b670f84f.exeC:\Users\admin\AppData\Local\Temp\Savinggpg
MD5:1CF6C3AB870856B9143535D189DFD914
SHA256:090C755E487D0512DBA6B57C4AEF1E97BED9E68F4A2BF9FA7FE8056CB8231A6D
6884702ab38086350094b28c8df1b670f84f.exeC:\Users\admin\AppData\Local\Temp\Blowjobsbinary
MD5:195A96EDF53FF80A7CF419744723A51E
SHA256:366FD97E3CED8777B98C5203C9684482E56EB38288BE159D31ED54BA4E38D0B3
6884702ab38086350094b28c8df1b670f84f.exeC:\Users\admin\AppData\Local\Temp\Machinebinary
MD5:71426D9AA93B60C078ED07AD60C6A8E2
SHA256:DFACBE1A810D928348AF9A9E49C57532EBAE04209C0250733512656AC9719786
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
31
DNS requests
15
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7136
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6792
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2628
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3412
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
252
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
—
—
192.168.100.255:138
—
—
—
whitelisted
3260
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2628
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2628
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
7136
backgroundTaskHost.exe
20.103.156.88:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
7136
backgroundTaskHost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.142
whitelisted
client.wns.windows.com
  • 40.115.3.253
  • 40.113.103.199
whitelisted
login.live.com
  • 20.190.159.73
  • 20.190.159.75
  • 20.190.159.4
  • 20.190.159.23
  • 20.190.159.2
  • 40.126.31.73
  • 20.190.159.64
  • 40.126.31.69
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
fkoPkbWVIq.fkoPkbWVIq
  • —
unknown
arc.msn.com
  • 20.103.156.88
whitelisted
slscr.update.microsoft.com
  • 20.114.59.183
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

PID
Process
Class
Message
6364
OOBE-Maintenance.exe
A Network Trojan was detected
STEALER [ANY.RUN] Rhadamanthys SSL Certificate and JA3s
6364
OOBE-Maintenance.exe
A Network Trojan was detected
STEALER [ANY.RUN] Rhadamanthys SSL Certificate and JA3s
6 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
702ab38086350094b28c8df1b670f84f.exe