File name:

netbox.exe

Full analysis: https://app.any.run/tasks/813aa363-5f6e-4b93-b1d5-b20a79464779
Verdict: Malicious activity
Analysis date: August 02, 2019, 14:22:06
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

8F849B17AFB6274E523B114CC42209B9

SHA1:

E20DEDAD065A1DE883898E707C90ED6E8F804C7F

SHA256:

8E2FF174EB4899C868E0B4F09772B43FF7532CE2561FC91FD7F96D4FB504F50C

SSDEEP:

24576:S0I5DJk6gHLxBhXXs+uYgwJhYdBYIJG3/V:SdW1X3hRUdBYIJo/V

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • netboxbrowser.exe (PID: 2504)
      • netboxbrowser.exe (PID: 3672)
      • netboxbrowser.exe (PID: 3900)
      • netboxbrowser.exe (PID: 3720)
      • netboxbrowser.exe (PID: 4044)
      • netboxbrowser.exe (PID: 1536)
      • netboxbrowser.exe (PID: 2876)
      • netboxbrowser.exe (PID: 3424)
      • netboxbrowser.exe (PID: 2200)
      • netboxbrowser.exe (PID: 3584)
      • netboxbrowser.exe (PID: 3820)
      • netboxbrowser.exe (PID: 1080)
      • netboxbrowser.exe (PID: 2168)
      • netboxbrowser.exe (PID: 3916)
      • netboxbrowser.exe (PID: 2188)

    • Application was dropped or rewritten from another process

      • browser.exe (PID: 2152)
      • setup.exe (PID: 3832)
      • setup.exe (PID: 300)
      • netboxwallet.exe (PID: 2392)
      • netboxbrowser.exe (PID: 3916)
      • netboxbrowser.exe (PID: 2168)
      • netboxbrowser.exe (PID: 4044)
      • netboxbrowser.exe (PID: 2188)
      • netboxbrowser.exe (PID: 3900)
      • netboxbrowser.exe (PID: 2504)
      • netboxbrowser.exe (PID: 3672)
      • netboxbrowser.exe (PID: 3720)
      • netboxbrowser.exe (PID: 1536)
      • netboxbrowser.exe (PID: 2876)
      • netboxbrowser.exe (PID: 2200)
      • netboxbrowser.exe (PID: 3424)
      • netboxbrowser.exe (PID: 1080)
      • netboxbrowser.exe (PID: 3584)
      • netboxbrowser.exe (PID: 3820)

    • Changes the autorun value in the registry

      • netboxbrowser.exe (PID: 3900)
      • netboxbrowser.exe (PID: 3916)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • browser.exe (PID: 2152)
      • setup.exe (PID: 3832)
      • netbox.exe (PID: 1672)

    • Application launched itself

      • netboxbrowser.exe (PID: 3916)
      • netbox.exe (PID: 1672)
      • netboxbrowser.exe (PID: 3900)

    • Creates a software uninstall entry

      • setup.exe (PID: 3832)

    • Modifies the open verb of a shell class

      • netboxbrowser.exe (PID: 3916)
      • setup.exe (PID: 3832)

    • Creates files in the user directory

      • netboxwallet.exe (PID: 2392)
      • setup.exe (PID: 3832)

  • INFO

    • Manual execution by user

      • netboxwallet.exe (PID: 2392)
      • netboxbrowser.exe (PID: 3900)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:07:29 14:04:31+02:00
PEType: PE32
LinkerVersion: 12
CodeSize: 461824
InitializedDataSize: 1480704
UninitializedDataSize: -
EntryPoint: 0x3d59d
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 75.0.3770.80
ProductVersionNumber: 75.0.3770.80
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Russian
CharacterSet: Unicode
CompanyName: Netbox LCC
FileDescription: Netbox.Browser
FileVersion: K
LegalCopyright: Copyright Netbox(C) 2019
ProductName: Netbox.Browser
ProductVersion: 75.0.3770.80
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
63
Monitored processes
21
Malicious processes
7
Suspicious processes
10

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start netbox.exe browser.exe setup.exe setup.exe no specs netbox.exe netboxbrowser.exe netboxbrowser.exe no specs netboxbrowser.exe no specs netboxbrowser.exe no specs netboxbrowser.exe no specs netboxwallet.exe netboxbrowser.exe netboxbrowser.exe no specs netboxbrowser.exe no specs netboxbrowser.exe netboxbrowser.exe no specs netboxbrowser.exe no specs netboxbrowser.exe no specs netboxbrowser.exe no specs netboxbrowser.exe no specs netboxbrowser.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
300C:\Users\admin\AppData\Local\Temp\CR_40A38.tmp\setup.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\NetboxBrowser\User Data\Crashpad" --annotation=plat=Win32 --annotation=prod=Netbox.Browser --annotation=ver=75.0.3770.80 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x123b218,0x123b228,0x123b234C:\Users\admin\AppData\Local\Temp\CR_40A38.tmp\setup.exe—setup.exe
User:
admin
Company:
The Netbox.Browser Authors
Integrity Level:
MEDIUM
Description:
Netbox.Browser
Exit code:
0
Version:
75.0.3770.80
Modules
Images
c:\users\admin\appdata\local\temp\cr_40a38.tmp\setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
1080"C:\Users\admin\AppData\Local\NetboxBrowser\Application\netboxbrowser.exe" --type=gpu-process --field-trial-handle=948,5572498113129879615,11462878605615532957,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADgAAAwAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=6064795545311348366 --mojo-platform-channel-handle=3508 /prefetch:2C:\Users\admin\AppData\Local\NetboxBrowser\Application\netboxbrowser.exe—netboxbrowser.exe
User:
admin
Company:
The Netbox.Browser Authors
Integrity Level:
MEDIUM
Description:
Netbox.Browser
Exit code:
0
Version:
75.0.3770.80
Modules
Images
c:\users\admin\appdata\local\netboxbrowser\application\netboxbrowser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\netboxbrowser\application\75.0.3770.80\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1164"C:\Users\admin\AppData\Local\Temp\netbox.exe" --add-firewall-rules --make-default-browserC:\Users\admin\AppData\Local\Temp\netbox.exe
netbox.exe
User:
admin
Company:
Netbox LCC
Integrity Level:
HIGH
Description:
Netbox.Browser
Exit code:
0
Version:
K
Modules
Images
c:\users\admin\appdata\local\temp\netbox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1536"C:\Users\admin\AppData\Local\NetboxBrowser\Application\netboxbrowser.exe" --type=utility --field-trial-handle=948,5572498113129879615,11462878605615532957,131072 --lang=en-US --service-sandbox-type=network --service-request-channel-token=17716882249243102998 --mojo-platform-channel-handle=1548 /prefetch:8C:\Users\admin\AppData\Local\NetboxBrowser\Application\netboxbrowser.exe
netboxbrowser.exe
User:
admin
Company:
The Netbox.Browser Authors
Integrity Level:
MEDIUM
Description:
Netbox.Browser
Exit code:
0
Version:
75.0.3770.80
Modules
Images
c:\users\admin\appdata\local\netboxbrowser\application\netboxbrowser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\netboxbrowser\application\75.0.3770.80\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1672"C:\Users\admin\AppData\Local\Temp\netbox.exe" C:\Users\admin\AppData\Local\Temp\netbox.exe
explorer.exe
User:
admin
Company:
Netbox LCC
Integrity Level:
MEDIUM
Description:
Netbox.Browser
Exit code:
0
Version:
K
Modules
Images
c:\users\admin\appdata\local\temp\netbox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2152"C:\Users\admin\AppData\Local\Temp\{AB6F260B-F702-4C16-822F-EEBB2C2E7B7C}\browser.exe" --do-not-launch-chromeC:\Users\admin\AppData\Local\Temp\{AB6F260B-F702-4C16-822F-EEBB2C2E7B7C}\browser.exe
netbox.exe
User:
admin
Company:
The Netbox.Browser Authors
Integrity Level:
MEDIUM
Description:
Netbox.Browser
Exit code:
0
Version:
75.0.3770.80
Modules
Images
c:\users\admin\appdata\local\temp\{ab6f260b-f702-4c16-822f-eebb2c2e7b7c}\browser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
2168"C:\Users\admin\AppData\Local\NetboxBrowser\Application\netboxbrowser.exe" --type=gpu-process --field-trial-handle=976,11768660379737605741,7247442159692170163,131072 --gpu-preferences=KAAAAAAAAADgAAAwAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=15539557372636039877 --mojo-platform-channel-handle=1000 --ignored=" --type=renderer " /prefetch:2C:\Users\admin\AppData\Local\NetboxBrowser\Application\netboxbrowser.exe—netboxbrowser.exe
User:
admin
Company:
The Netbox.Browser Authors
Integrity Level:
LOW
Description:
Netbox.Browser
Exit code:
0
Version:
75.0.3770.80
Modules
Images
c:\users\admin\appdata\local\netboxbrowser\application\netboxbrowser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\netboxbrowser\application\75.0.3770.80\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2188C:\Users\admin\AppData\Local\NetboxBrowser\Application\netboxbrowser.exe --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\NetboxBrowser\User Data" /prefetch:7 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\admin\AppData\Local\NetboxBrowser\User Data" --monitor-self-argument=/prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\NetboxBrowser\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\NetboxBrowser\User Data" --annotation=plat=Win32 --annotation=prod=Netbox.Browser --annotation=ver=75.0.3770.80-devel --initial-client-data=0x88,0x8c,0x90,0x84,0x94,0x6dc6d9f0,0x6dc6da00,0x6dc6da0cC:\Users\admin\AppData\Local\NetboxBrowser\Application\netboxbrowser.exe—netboxbrowser.exe
User:
admin
Company:
The Netbox.Browser Authors
Integrity Level:
HIGH
Description:
Netbox.Browser
Exit code:
0
Version:
75.0.3770.80
Modules
Images
c:\users\admin\appdata\local\netboxbrowser\application\netboxbrowser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\netboxbrowser\application\75.0.3770.80\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2200"C:\Users\admin\AppData\Local\NetboxBrowser\Application\netboxbrowser.exe" --type=renderer --file-url-path-alias="/gen=C:\Users\admin\AppData\Local\NetboxBrowser\Application\gen" --field-trial-handle=948,5572498113129879615,11462878605615532957,131072 --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=614989470821189409 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2240 /prefetch:1C:\Users\admin\AppData\Local\NetboxBrowser\Application\netboxbrowser.exe—netboxbrowser.exe
User:
admin
Company:
The Netbox.Browser Authors
Integrity Level:
LOW
Description:
Netbox.Browser
Exit code:
0
Version:
75.0.3770.80
Modules
Images
c:\users\admin\appdata\local\netboxbrowser\application\netboxbrowser.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\netboxbrowser\application\75.0.3770.80\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
2392"C:\Users\admin\AppData\Local\NetboxBrowser\netboxwallet.exe" --server --splash=0 --staking=0 --lang=en --hideC:\Users\admin\AppData\Local\NetboxBrowser\netboxwallet.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\netboxbrowser\netboxwallet.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
Total events
2 436
Read events
2 155
Write events
276
Delete events
5

Modification events

(PID) Process:(1672) netbox.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\72\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1672) netbox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1672) netbox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3832) setup.exeKey:HKEY_CURRENT_USER\Software\NetboxBrowser
Operation:writeName:InstallerProgress
Value:
18
(PID) Process:(3832) setup.exeKey:HKEY_CURRENT_USER\Software\NetboxBrowser
Operation:writeName:InstallerProgress
Value:
24
(PID) Process:(3832) setup.exeKey:HKEY_CURRENT_USER\Software\NetboxBrowser
Operation:writeName:InstallerProgress
Value:
37
(PID) Process:(3832) setup.exeKey:HKEY_CURRENT_USER\Software\NetboxBrowser
Operation:writeName:InstallerProgress
Value:
43
(PID) Process:(3832) setup.exeKey:HKEY_CURRENT_USER\Software\NetboxBrowser
Operation:writeName:InstallerProgress
Value:
49
(PID) Process:(3832) setup.exeKey:HKEY_CURRENT_USER\Software\NetboxBrowser
Operation:writeName:InstallerProgress
Value:
56
(PID) Process:(3832) setup.exeKey:HKEY_CURRENT_USER\Software\NetboxBrowser
Operation:writeName:UninstallString
Value:
C:\Users\admin\AppData\Local\NetboxBrowser\Application\75.0.3770.80\Installer\setup.exe
Executable files
12
Suspicious files
63
Text files
66
Unknown types
6

Dropped files

PID
Process
Filename
Type
2152browser.exeC:\Users\admin\AppData\Local\Temp\CR_40A38.tmp\CHROME.PACKED.7Z —
MD5:—
SHA256:—
2152browser.exeC:\Users\admin\AppData\Local\Temp\CR_40A38.tmp\SETUP.EX_ —
MD5:—
SHA256:—
3832setup.exeC:\Users\admin\AppData\Local\NetboxBrowser\Temp\source3832_1437\chrome.7z —
MD5:—
SHA256:—
3832setup.exeC:\Users\admin\AppData\Local\NetboxBrowser\Temp\source3832_1437\1074fff7-ece3-40bb-972b-cdb585d02c7a.tmp —
MD5:—
SHA256:—
3832setup.exeC:\Users\admin\AppData\Local\NetboxBrowser\Temp\source3832_1437\Chrome-bin\75.0.3770.80\chrome.dll —
MD5:—
SHA256:—
3832setup.exeC:\Users\admin\AppData\Local\NetboxBrowser\Temp\source3832_1437\Chrome-bin\75.0.3770.80\chrome_child.dll —
MD5:—
SHA256:—
3832setup.exeC:\Users\admin\AppData\Local\NetboxBrowser\Temp\source3832_1437\Chrome-bin\75.0.3770.80\icudtl.dat —
MD5:—
SHA256:—
3832setup.exeC:\Users\admin\AppData\Local\NetboxBrowser\Temp\source3832_1437\Chrome-bin\75.0.3770.80\libglesv2.dll —
MD5:—
SHA256:—
3832setup.exeC:\Users\admin\AppData\Local\NetboxBrowser\Temp\source3832_1437\Chrome-bin\75.0.3770.80\Locales\am.pak —
MD5:—
SHA256:—
3832setup.exeC:\Users\admin\AppData\Local\NetboxBrowser\Temp\source3832_1437\Chrome-bin\75.0.3770.80\Locales\ar.pak —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
16
DNS requests
11
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1672
netbox.exe
GET
301
151.139.128.10:80
http://cdn.netbox.global/browser.exe
US
html
169 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1672
netbox.exe
151.139.128.10:80
cdn.netbox.global
Highwinds Network Group, Inc.
US
malicious
1672
netbox.exe
151.139.128.10:443
cdn.netbox.global
Highwinds Network Group, Inc.
US
malicious
1536
netboxbrowser.exe
172.217.16.195:443
www.gstatic.com
Google Inc.
US
whitelisted
—
—
95.216.114.205:443
api.netbox.global
Hetzner Online GmbH
DE
unknown
1536
netboxbrowser.exe
172.217.16.205:443
accounts.google.com
Google Inc.
US
whitelisted
1536
netboxbrowser.exe
172.217.23.163:443
ssl.gstatic.com
Google Inc.
US
whitelisted
2392
netboxwallet.exe
159.69.116.41:28734
seed1.netbox.global
—
US
unknown
2392
netboxwallet.exe
103.242.22.250:28734
—
TM International Bangladesh Ltd.
BD
unknown
2392
netboxwallet.exe
85.140.4.57:28734
—
MTS PJSC
RU
unknown
2392
netboxwallet.exe
197.158.74.74:28734
—
Gulfsat Autonomous System
MG
unknown

DNS requests

Domain
IP
Reputation
cdn.netbox.global
  • 151.139.128.10
whitelisted
www.gstatic.com
  • 172.217.16.195
whitelisted
accounts.google.com
  • 172.217.16.205
shared
api.netbox.global
  • 95.216.114.205
unknown
ssl.gstatic.com
  • 172.217.23.163
whitelisted
seed1.netbox.global
  • 138.201.188.41
  • 116.202.104.64
  • 138.201.175.185
  • 159.69.48.243
  • 116.202.110.107
  • 116.202.102.121
  • 116.202.109.65
  • 159.69.116.41
  • 116.202.109.96
  • 159.69.113.183
  • 159.69.112.152
  • 159.69.51.187
  • 159.69.114.253
  • 116.202.102.152
  • 116.202.102.13
  • 116.202.109.77
  • 159.69.52.196
  • 116.202.108.155
  • 116.202.103.55
  • 159.69.54.82
  • 159.69.52.182
  • 116.202.109.108
  • 116.202.110.150
  • 116.202.108.226
  • 116.202.109.16
  • 116.202.109.234
  • 116.202.109.54
malicious
seed2.netbox.global
  • —
unknown
seed1.netboxglobal.com
  • 45.32.193.92
  • 116.202.96.154
  • 78.155.218.169
  • 116.202.110.143
  • 148.163.53.18
  • 138.201.158.139
  • 116.202.108.241
  • 116.202.109.96
  • 104.156.230.103
  • 116.202.109.24
  • 159.69.48.91
  • 138.201.244.227
  • 116.202.106.47
  • 116.202.107.226
  • 116.202.109.38
  • 116.202.108.227
  • 159.69.51.45
  • 116.202.26.135
  • 116.202.100.55
  • 116.202.109.204
  • 116.202.109.29
  • 167.179.81.213
  • 116.202.109.52
  • 138.201.185.66
  • 78.141.207.62
  • 159.69.55.227
  • 159.69.51.160
unknown
seed2.netboxglobal.com
  • 159.69.114.139
  • 116.202.111.198
  • 159.69.52.139
  • 77.236.93.36
  • 116.202.110.150
  • 116.202.109.222
  • 116.202.109.115
  • 138.201.175.5
  • 116.202.109.172
  • 116.202.108.246
  • 116.202.102.117
  • 155.138.237.245
  • 138.201.155.149
  • 159.69.52.196
  • 116.202.109.48
  • 42.116.230.241
  • 116.202.109.23
  • 116.202.108.189
  • 45.32.193.92
  • 159.69.115.157
  • 138.201.247.116
  • 107.178.107.142
  • 116.202.26.135
  • 116.202.104.65
  • 116.202.107.226
  • 116.202.109.34
  • 116.202.108.226
unknown
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
2392
netboxwallet.exe
Misc activity
SUSPICIOUS [PTsecurity] CoinWallet (PUA)
2392
netboxwallet.exe
Misc activity
SUSPICIOUS [PTsecurity] CoinWallet (PUA)
Process
Message
netboxwallet.exe
Invalid parameter passed to C runtime function.
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
netbox.exe