File name:

Dark DDoser 5.6.7z

Full analysis: https://app.any.run/tasks/a2dbeb60-1832-4304-a233-a9ec16d9c697
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: August 03, 2024, 11:28:34
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
covid19
adware
evasion
upx
crypto-regex
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

CADB6745ACD942FC5CA18CE47C3812E5

SHA1:

515900157F142014F16378A636CF2221B4737BA0

SHA256:

9211048FAC48E4099BB134C58E838F00F014CE9C5F217CE20800430E4DDE09E3

SSDEEP:

98304:eFdd0jgHubd5iZg5ky1+Wm/4+F+xVTfLvSFrRQ8GjTNurf7H5RrBLG5Na5Zv/P6r:Fr0Rci6bkngI3WVG0hUS

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Adds path to the Windows Defender exclusion list

      • Launcher.exe (PID: 2476)

    • Changes the autorun value in the registry

      • Launcher.exe (PID: 2476)

    • Create files in the Startup directory

      • Launcher.exe (PID: 2476)

    • Drops the executable file immediately after the start

      • Launcher.exe (PID: 2476)

  • SUSPICIOUS

    • Script adds exclusion path to Windows Defender

      • Launcher.exe (PID: 2476)

    • Reads security settings of Internet Explorer

      • Launcher.exe (PID: 2476)
      • DaRKDDoSeR.exe (PID: 1372)
      • ddos.exe (PID: 4060)
      • Windows Services.exe (PID: 4576)

    • Reads the date of Windows installation

      • Launcher.exe (PID: 2476)
      • DaRKDDoSeR.exe (PID: 1372)
      • Windows Services.exe (PID: 4576)

    • Starts POWERSHELL.EXE for commands execution

      • Launcher.exe (PID: 2476)

    • The process creates files with name similar to system file names

      • Launcher.exe (PID: 2476)

    • Executable content was dropped or overwritten

      • Launcher.exe (PID: 2476)

    • Found regular expressions for crypto-addresses (YARA)

      • Runtime Explorer.exe (PID: 5904)

    • Executes application which crashes

      • ddos.exe (PID: 4060)

    • Access to an unwanted program domain was detected

      • ddos.exe (PID: 4060)

    • Checks for external IP

      • svchost.exe (PID: 2256)

    • There is functionality for taking screenshot (YARA)

      • ddos.exe (PID: 4060)

  • INFO

    • Checks supported languages

      • ddos.exe (PID: 4060)
      • Launcher.exe (PID: 2476)
      • DaRKDDoSeR.exe (PID: 1372)
      • Secure System Shell.exe (PID: 904)
      • Windows Services.exe (PID: 4576)
      • Runtime Explorer.exe (PID: 5904)

    • Drops a (possible) Coronavirus decoy

      • WinRAR.exe (PID: 5760)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 5760)

    • Process checks computer location settings

      • DaRKDDoSeR.exe (PID: 1372)
      • Launcher.exe (PID: 2476)
      • Windows Services.exe (PID: 4576)

    • Reads the machine GUID from the registry

      • Launcher.exe (PID: 2476)
      • DaRKDDoSeR.exe (PID: 1372)
      • Windows Services.exe (PID: 4576)
      • Secure System Shell.exe (PID: 904)

    • Reads the computer name

      • Launcher.exe (PID: 2476)
      • DaRKDDoSeR.exe (PID: 1372)
      • ddos.exe (PID: 4060)
      • Windows Services.exe (PID: 4576)
      • Secure System Shell.exe (PID: 904)
      • Runtime Explorer.exe (PID: 5904)

    • Manual execution by a user

      • DaRKDDoSeR.exe (PID: 1372)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5760)

    • Checks proxy server information

      • ddos.exe (PID: 4060)

    • Creates files or folders in the user directory

      • Launcher.exe (PID: 2476)
      • WerFault.exe (PID: 6960)

    • Reads Environment values

      • Runtime Explorer.exe (PID: 5904)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 5920)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 5920)

    • UPX packer has been detected

      • ddos.exe (PID: 4060)

    • Create files in a temporary directory

      • Runtime Explorer.exe (PID: 5904)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
11
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe darkddoser.exe no specs launcher.exe powershell.exe no specs conhost.exe no specs THREAT ddos.exe svchost.exe windows services.exe no specs secure system shell.exe no specs THREAT runtime explorer.exe no specs werfault.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
904"C:\Windows\IMF\Secure System Shell.exe" C:\Windows\IMF\Secure System Shell.exe—Windows Services.exe
User:
admin
Integrity Level:
HIGH
Description:
Secure System Shell
Version:
1.0.0.0
Modules
Images
c:\windows\imf\secure system shell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1372"C:\Users\admin\Desktop\DaRKDDoSeR.exe" C:\Users\admin\Desktop\DaRKDDoSeR.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Launcher
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\darkddoser.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2256C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2476"C:\Users\admin\Desktop\plugin\Launcher.exe" C:\Users\admin\Desktop\plugin\Launcher.exe
DaRKDDoSeR.exe
User:
admin
Integrity Level:
HIGH
Description:
Launcher
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\plugin\launcher.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
4060"C:\Users\admin\Desktop\plugin\ddos.exe" C:\Users\admin\Desktop\plugin\ddos.exe
DaRKDDoSeR.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\plugin\ddos.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
4576"C:\Windows\IMF\Windows Services.exe" {Arguments If Needed}C:\Windows\IMF\Windows Services.exe—Launcher.exe
User:
admin
Integrity Level:
HIGH
Description:
Windows Services
Version:
1.0.0.0
Modules
Images
c:\windows\imf\windows services.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5760"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Dark DDoser 5.6.7z"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5904"C:\Windows\IMF\Runtime Explorer.exe" C:\Windows\IMF\Runtime Explorer.exe
Windows Services.exe
User:
admin
Company:
Microsoft Windows
Integrity Level:
HIGH
Version:
1.00
Modules
Images
c:\windows\imf\runtime explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
5920"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" add-mppreference -exclusionpath C:\Windows\IMF\C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—Launcher.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6960C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4060 -s 1752C:\Windows\SysWOW64\WerFault.exe—ddos.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
Total events
18 783
Read events
18 706
Write events
74
Delete events
3

Modification events

(PID) Process:(5760) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(5760) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(5760) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(5760) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Dark DDoser 5.6.7z
(PID) Process:(5760) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5760) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5760) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5760) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1372) DaRKDDoSeR.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1372) DaRKDDoSeR.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
12
Suspicious files
272
Text files
197
Unknown types
0

Dropped files

PID
Process
Filename
Type
5760WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5760.36322\Backgrounds\14.bmpimage
MD5:8261739FAA68F5C8A3F6A45EE45276FA
SHA256:211AD3E4F8D270858E9C0C410633E1880C94128E7DA278CC22196733BBC471CB
5760WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5760.36322\Backgrounds\13.bmpimage
MD5:B6DB286CA15CB80463FD1CD1629FE23A
SHA256:79137DE6A970BF6EE79516C70F86EAB315301BAB669DF3E2C793F316FBA5203A
5760WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5760.36322\Backgrounds\12.bmpimage
MD5:91594D96ADAA27F4A484EB75BD220C2C
SHA256:BE037F3B33BABAE652926EDEE9F5E9F2999237CEE419484627C30D26DFF5146B
5760WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5760.36322\Backgrounds\11.bmpimage
MD5:A8AE7C4A4A48ECA0A83F00D35BC6BC74
SHA256:D89EEA2415F3161BD8B1A3A4AD659E6496133D710A855886686790A26C261019
5760WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5760.36322\Backgrounds\5.pngimage
MD5:549A83BE6E9D72872FCD72F870AE428C
SHA256:285595396F38E6C207541BD5F9FD7EB51BB60CBCCF75A5F477CA87466377263A
5760WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5760.36322\Backgrounds\10.bmpimage
MD5:E2E6C474C58C8A5458DCFA4D80872231
SHA256:4EF049502058EA0FC78B04240605422910CE3832F7DDD34660F559E56D0C3DB7
5760WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5760.36322\Backgrounds\15.bmpimage
MD5:AA7A166E688FDE5D0AE4B9241796D9FD
SHA256:582459066FEDCEED314AFE3696E5953FD8F2ECD4654CD2E9979EF3C0AA29C793
5760WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5760.36322\Backgrounds\8.bmpimage
MD5:1D12B09EC2FCE0B67F94E2AA49542117
SHA256:126FB51131AC34F2A1874FAB354B2EC639989828A36C08732B1FD29BF331D5AC
5760WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5760.36322\Backgrounds\3.bmpimage
MD5:4D8D2B52807027B43CA07D187D29BD61
SHA256:3090E3928FA23D296EA8322BB7EC152CFDDBF19009ECB6FDC1C9742C01E94F78
5760WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa5760.36322\Backgrounds\2.bmpimage
MD5:786643E8CF256C39059B1AB5BF1411B1
SHA256:76DF94F9E199FA03A027FDE2581050DF9D76C60D1614C709550DF10D55A2F6E0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
34
DNS requests
17
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6628
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6664
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
4060
ddos.exe
GET
200
104.21.42.154:80
http://www.formyip.com/
unknown
—
—
malicious
4060
ddos.exe
GET
200
104.21.42.154:80
http://www.formyip.com/
unknown
—
—
malicious
4060
ddos.exe
GET
404
142.250.184.206:80
http://google.com/TOW/Beta/portal/?version&v=5
unknown
—
—
whitelisted
4060
ddos.exe
GET
404
142.250.184.206:80
http://google.com/TOW/Beta/portal/?info=TOW&info2=Foryouonly&v=5
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3208
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2536
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
5336
SearchApp.exe
92.123.104.16:443
www.bing.com
Akamai International B.V.
DE
unknown
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
—
—
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
—
—
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
92.123.104.53:443
th.bing.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 142.250.184.206
whitelisted
www.bing.com
  • 92.123.104.16
  • 92.123.104.13
  • 92.123.104.14
  • 92.123.104.6
  • 92.123.104.12
  • 92.123.104.65
  • 92.123.104.4
  • 92.123.104.10
  • 92.123.104.5
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.133
  • 20.190.160.20
  • 40.126.32.136
  • 20.190.160.17
  • 20.190.160.14
  • 40.126.32.138
  • 40.126.32.76
  • 20.190.160.22
whitelisted
th.bing.com
  • 92.123.104.53
  • 92.123.104.43
  • 92.123.104.52
  • 92.123.104.37
  • 92.123.104.46
  • 92.123.104.50
  • 92.123.104.41
  • 92.123.104.49
  • 92.123.104.51
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
fd.api.iris.microsoft.com
  • 20.223.36.55
whitelisted
arc.msn.com
  • 20.74.47.205
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted

Threats

PID
Process
Class
Message
2256
svchost.exe
Device Retrieving External IP Address Detected
ET POLICY Observed IP Lookup Domain (formyip .com in DNS Lookup)
4060
ddos.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP User Agent (TEST) - Likely Webhancer Related Spyware
4060
ddos.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP User Agent (TEST) - Likely Webhancer Related Spyware
4060
ddos.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP User Agent (TEST) - Likely Webhancer Related Spyware
4060
ddos.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP User Agent (TEST) - Likely Webhancer Related Spyware
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Dark DDoser 5.6.7z