File name:

file

Full analysis: https://app.any.run/tasks/6f363954-a682-4059-9003-6bfd476cb833
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: November 14, 2023, 08:57:58
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
loader
smoke
sinkhole
stealer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

4133EF730B6780D9EFD87FD4882A4360

SHA1:

D0E7BFB42ED8520742AB700852FFCB844C78BDAF

SHA256:

95396F2372D133A24CB6A06307C865F37441CB985BAA6CE021387AC7B0A2DE91

SSDEEP:

6144:vaS7uBrqVTKTtECCcyoSF49tPA/zS8GxdIWDnzp+qQw0pIExhX:10GVTKTtEjcPSFse7Gx6un1YX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was injected by another process

      • explorer.exe (PID: 1944)

    • Runs injected code in another process

      • file.exe (PID: 2700)

    • Drops the executable file immediately after the start

      • 41ED.exe (PID: 2216)

    • SMOKE has been detected (SURICATA)

      • explorer.exe (PID: 1944)
      • explorer.exe (PID: 648)
      • explorer.exe (PID: 2800)

    • Steals credentials from Web Browsers

      • explorer.exe (PID: 2800)

    • Steals credentials

      • explorer.exe (PID: 2800)

    • Unusual connection from system programs

      • explorer.exe (PID: 2800)

    • Connects to the CnC server

      • explorer.exe (PID: 2800)
      • explorer.exe (PID: 648)
      • explorer.exe (PID: 1944)

    • Actions looks like stealing of personal data

      • explorer.exe (PID: 2800)

    • Registers / Runs the DLL via REGSVR32.EXE

      • explorer.exe (PID: 1944)

  • SUSPICIOUS

    • Reads the Internet Settings

      • 41ED.exe (PID: 2216)
      • explorer.exe (PID: 2800)

    • Process drops legitimate windows executable

      • explorer.exe (PID: 1944)
      • 41ED.exe (PID: 2216)

    • Reads browser cookies

      • explorer.exe (PID: 2800)

    • Application launched itself

      • explorer.exe (PID: 1944)

    • Loads DLL from Mozilla Firefox

      • explorer.exe (PID: 648)

    • Accesses Microsoft Outlook profiles

      • explorer.exe (PID: 2800)

    • The process executes via Task Scheduler

      • jbhtujv (PID: 2660)

    • The process creates files with name similar to system file names

      • 41ED.exe (PID: 2216)

  • INFO

    • Reads the Internet Settings

      • explorer.exe (PID: 1944)
      • explorer.exe (PID: 648)

    • Checks supported languages

      • file.exe (PID: 2700)
      • notepad.exe (PID: 848)
      • F3F8.exe (PID: 980)
      • B4A.exe (PID: 2924)
      • jbhtujv (PID: 2660)
      • 41ED.exe (PID: 2216)

    • Create files in a temporary directory

      • 41ED.exe (PID: 2216)
      • explorer.exe (PID: 1944)
      • explorer.exe (PID: 2800)

    • Reads the machine GUID from the registry

      • notepad.exe (PID: 848)
      • F3F8.exe (PID: 980)

    • Creates files or folders in the user directory

      • explorer.exe (PID: 1944)

    • Drops the executable file immediately after the start

      • explorer.exe (PID: 1944)

    • Reads settings of System Certificates

      • explorer.exe (PID: 1944)

    • Reads the computer name

      • F3F8.exe (PID: 980)
      • 41ED.exe (PID: 2216)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (41)
.exe | Win64 Executable (generic) (36.3)
.dll | Win32 Dynamic Link Library (generic) (8.6)
.exe | Win32 Executable (generic) (5.9)
.exe | Clipper DOS Executable (2.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:02:16 07:18:44+01:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 166912
InitializedDataSize: 3770368
UninitializedDataSize: -
EntryPoint: 0x7c59
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 85.0.0.0
ProductVersionNumber: 80.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Unknown (0371)
CharacterSet: Unknown (63B1)
FileDescriptions: Buttis
InternalName: FantasticFlow.exe
LegalTrademark1: Pascal
OriginalFileName: Blamer.exe
ProductVersion: 58.38.74.74
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
43
Monitored processes
11
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
inject start file.exe no specs #SMOKE explorer.exe regsvr32.exe no specs regsvr32.exe no specs 41ed.exe no specs notepad.exe no specs f3f8.exe no specs b4a.exe no specs #SMOKE explorer.exe #SMOKE explorer.exe jbhtujv no specs

Process information

PID
CMD
Path
Indicators
Parent process
648C:\Windows\explorer.exeC:\Windows\explorer.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
848"C:\Users\admin\AppData\Local\Temp\RarSFX0\notepad.exe" C:\Users\admin\AppData\Local\Temp\RarSFX0\notepad.exe—41ED.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
MEDIUM
Description:
Notepad++
Exit code:
0
Version:
8.5.8
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
980C:\Users\admin\AppData\Local\Temp\F3F8.exeC:\Users\admin\AppData\Local\Temp\F3F8.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\f3f8.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
1944C:\Windows\Explorer.EXEC:\Windows\explorer.exe
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2092regsvr32 /s C:\Users\admin\AppData\Local\Temp\2F00.dllC:\Windows\System32\regsvr32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2216C:\Users\admin\AppData\Local\Temp\41ED.exeC:\Users\admin\AppData\Local\Temp\41ED.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\41ed.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2340 /s C:\Users\admin\AppData\Local\Temp\2F00.dllC:\Windows\SysWOW64\regsvr32.exe—regsvr32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2660C:\Users\admin\AppData\Roaming\jbhtujv C:\Users\admin\AppData\Roaming\jbhtujv—taskeng.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\jbhtujv
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2700"C:\Users\admin\AppData\Local\Temp\file.exe" C:\Users\admin\AppData\Local\Temp\file.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\file.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
2800C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\syswow64\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\system32\kernel32.dll
c:\windows\syswow64\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\syswow64\kernelbase.dll
Total events
2 210
Read events
2 178
Write events
32
Delete events
0

Modification events

(PID) Process:(1944) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000088AF72B0747534094337F63DE35C94A000000000200000000001066000000010000200000003A7AE26404D75DF41C31FF40C5EA8CE90BAF74FA9E9BD7A9ACA34C7048350C1E000000000E8000000002000020000000BD2D56D46506C12C41A6A70B10E79EE53CB79EF36FD2BA8CDD2460CB8F4BE86A300000009B5D1418CBF2EB49F3C4BD4C21D58CA55B82FA3D3ED08AF0EF59D6C7ECAFC1055FA323A80FF7C154B1C9B60253392B6640000000DED9FDCC168073324C3013F1BB125E066EB1A2F09FD2C8E7CC7A793AA992E21EF1C942BF7294D04E036428704009B863B1CB981B97312E2530E3E816780CF7C9
(PID) Process:(1944) explorer.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\156\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2216) 41ED.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2216) 41ED.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2216) 41ED.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2216) 41ED.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(848) notepad.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\156\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1944) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{CEBFF5CD-ACE2-4F4F-9178-9926F41749EA}\Count
Operation:writeName:HRZR_PGYFRFFVBA
Value:
00000000CA0000000101000098986A0015000000070000004F2206007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C0063006D0064002E006500780065000000100300000000B0493900000000000F5D6D09000000000A000080000000004DBC20FEFE070000000000000000000080DF100300000000D8ED10030000000001000000000000000A0000800000000004FE20FEFE0700000000000000000000D8ED100300000000D8ED1003000000000200000000000000040008005E04000010812B000000000001100211200441000F5D6D090000000000D3A70200000000B049390000000000C0A32B0000000000880000000000000040B35CFEFE0700000000000000000000000000000000000000002B0000000000C803CE77000000000000000000000000D00300000000000000002B0000000000C006760900000000280CBF770000000048062B000000000048DDC177000000000000000000000000C103000000000000010002000E00000010812B0000000000E0007309000000000000000000000000D0ED100300000000080000000000000040B7CE0300000000207D2B0000000000C8225DFEFE0700001C7F2B0000000000A0C42D00000000005B590EFFFE070000020000000000000028DD99070000000040B7CE0300000000A54208FFFE070000C803CE7707000000250000004B7A0B004D006900630072006F0073006F00660074002E00570069006E0064006F00770073002E0043006F006E00740072006F006C00500061006E0065006C00000075006C0074000000000000000000010000000000000088E2EA0200000000000000000000000030E0EA020000000028E0EA020000000020E0EA0200000000586705FCFE070000000000000000000040E0EA0200000000000000000000000000000000000000003E00400000000000B0E8EA02000000003053A203000000000000000000000000000000000000000022BBD2FF0000000000003D4A62B00000E000070000000000A210000000000000E0F1EA02000000000000000000000000300B8B0200000000A4768F0200000000D4AF17FEFE070000B0E3EA0200000000200C9C0A000000000100000000000000D46905FCFE0700001500000007000000790E06007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C0063006D0064002E006500780065000000EA02000000000540008000000000542D8CFFFE070000000000000000000068006C02000000005C0001000000000000000000000000000000280000000000EB1A6E770000000068006C020000000000000000FE070000282595FFFE070000A00D33000000000018006C02000000001B000000E8261C007B00310041004300310034004500370037002D0030003200450037002D0034004500350044002D0042003700340034002D003200450042003100410045003500310039003800420037007D005C007400610073006B006D00670072002E006500780065000000008000000000542DC9FDFE070000000000000000000068009902000000005800010000000000000000000000000000002B0000000000EB1AC07700000000680099020000000000000000FE0700002825D2FDFE070000F099A90200000000180099020000000000000000000000000100000000000000BF1DC9FDFE07000030E010030000000010D1AB020000000000000000000000003B94B8FDFE070000B04EAB020000000008009902000000005800010000000000869AAE7700000000C7F7CF529EC5000082020000000000000000000000000000580001000000000000000000000000008202000000000000020000000000000058000100000000000000000000000000820200000000000080A630FF00000000C81222FF00000000B04EAB020000000001000000000000000F0000C00000000090DFDD0300000000820200000000000001000000000000008202000000000000DB9BAE77000000005800010000000000000000000000000000000000000000000100000000000000000000000000000081020000000000000000000000000000000000000000000000000000
Executable files
22
Suspicious files
13
Text files
232
Unknown types
0

Dropped files

PID
Process
Filename
Type
1944explorer.exeC:\Users\admin\AppData\Roaming\jbhtujvexecutable
MD5:4133EF730B6780D9EFD87FD4882A4360
SHA256:95396F2372D133A24CB6A06307C865F37441CB985BAA6CE021387AC7B0A2DE91
221641ED.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\functionList\ada.xmlxml
MD5:C7F9FC66E6B1FEF3E9F8A37552314BAE
SHA256:DAB30F330F8C5A2DB0DFE27E5D8F2D1666B067BE35612984B344575A49F50668
1944explorer.exeC:\Users\admin\AppData\Local\Temp\41ED.exeexecutable
MD5:90FAEFCAB022C57B69DDFDFABB4797EF
SHA256:C111DF87370C358E5E8B5F562489C073B576E50AD37F72B9AA811A967B98B5BC
221641ED.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\functionList\bash.xmlxml
MD5:162DED022D600DCF4BA4B7E9AC6917A2
SHA256:2AE1142B08D296C25000E451237EA919F981DA28F6A723D39540F43F18BAC762
1944explorer.exeC:\Users\admin\AppData\Roaming\icihibrbinary
MD5:84ADD315EE17361C3CF5F0837D2EF057
SHA256:3BC7E0442B2E27AA12E7F0A1FE6BA62CDD123A43E7FFDA9362DB5E71DB9E42A1
221641ED.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\functionList\cobol.xmlxml
MD5:42E52D6BCC674ECACA09FEABF0C46DC2
SHA256:057784451E3442F381F6A8AF931A7050F88D19BDA6BC939D37607532A353DA1C
221641ED.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\functionList\asm.xmlxml
MD5:2C5F4897D7F169E06AEA28310C8AB9EC
SHA256:73526DDB1D23D595680BADD6BD87F5DD82869606A7CF7E8707758D48D848257E
221641ED.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\functionList\baanc.xmlxml
MD5:0FCE87843F5245BD9A4D5DDCE156C7C4
SHA256:EC249B0DAB6FDA20CC24F0F25A504C55A05B23FB6CBB4938AA7A41DF0C8744B6
221641ED.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\functionList\fortran.xmlxml
MD5:24EFE929C0A64D0728082696EAE24E47
SHA256:5B324FB16C96737C266D4FEC05476017C8547E3F59A16BEBCBAC0086ED4AE14B
1944explorer.exeC:\Users\admin\AppData\Local\Temp\2F00.dllexecutable
MD5:99B330B7E799FFD31BC193669EFE851E
SHA256:708B6078AEC10BFEA030F49003BE077D998E860711AC4919241A89B05116CA7A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
21
DNS requests
16
Threats
45

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1944
explorer.exe
GET
—
190.12.87.61:80
http://pocketvpn.cc/ufc/index.php
unknown
—
—
unknown
1944
explorer.exe
POST
200
34.94.245.237:80
http://sumagulituyo.org/
unknown
—
—
unknown
1944
explorer.exe
POST
200
34.143.166.163:80
http://lightseinsteniki.org/
unknown
—
—
unknown
1944
explorer.exe
POST
200
104.198.2.251:80
http://snukerukeutit.org/
unknown
—
—
unknown
1944
explorer.exe
POST
200
34.143.166.163:80
http://liuliuoumumy.org/
unknown
—
—
unknown
1944
explorer.exe
POST
404
91.215.85.17:80
http://stualialuyastrelia.net/
unknown
binary
2.27 Mb
unknown
1944
explorer.exe
POST
404
91.215.85.17:80
http://stualialuyastrelia.net/
unknown
binary
243 Kb
unknown
1944
explorer.exe
POST
404
91.215.85.17:80
http://stualialuyastrelia.net/
unknown
html
410 b
unknown
1944
explorer.exe
POST
404
91.215.85.17:80
http://stualialuyastrelia.net/
unknown
html
410 b
unknown
1944
explorer.exe
POST
404
91.215.85.17:80
http://stualialuyastrelia.net/
unknown
binary
47 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
324
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
1956
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1944
explorer.exe
34.94.245.237:80
sumagulituyo.org
GOOGLE-CLOUD-PLATFORM
US
unknown
1944
explorer.exe
104.198.2.251:80
snukerukeutit.org
GOOGLE-CLOUD-PLATFORM
US
unknown
1944
explorer.exe
34.143.166.163:80
lightseinsteniki.org
GOOGLE-CLOUD-PLATFORM
SG
unknown
1944
explorer.exe
91.215.85.17:80
stualialuyastrelia.net
—
RU
unknown
1944
explorer.exe
185.172.128.19:80
—
OOO Nadym Svyaz Service
RU
unknown
1944
explorer.exe
172.67.196.133:443
montereyclub.org
CLOUDFLARENET
US
unknown

DNS requests

Domain
IP
Reputation
onualituyrs.org
  • —
unknown
sumagulituyo.org
  • 34.94.245.237
unknown
snukerukeutit.org
  • 104.198.2.251
unknown
lightseinsteniki.org
  • 34.143.166.163
unknown
liuliuoumumy.org
  • 34.143.166.163
unknown
stualialuyastrelia.net
  • 91.215.85.17
unknown
dns.msftncsi.com
  • 131.107.255.255
shared
montereyclub.org
  • 172.67.196.133
  • 104.21.21.57
malicious
loveperry.org
  • 172.67.213.185
  • 104.21.86.8
unknown
pocketvpn.cc
  • 190.12.87.61
  • 109.175.29.39
  • 190.187.52.42
  • 123.140.161.243
  • 201.119.129.11
  • 201.124.204.70
  • 37.234.244.168
  • 211.40.39.251
  • 180.94.156.61
  • 123.213.233.131
unknown

Threats

PID
Process
Class
Message
1944
explorer.exe
A Network Trojan was detected
ET MALWARE Suspected Smokeloader Activity (POST)
1944
explorer.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst
1944
explorer.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
1944
explorer.exe
A Network Trojan was detected
ET MALWARE Suspected Smokeloader Activity (POST)
1944
explorer.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
1944
explorer.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst
1944
explorer.exe
A Network Trojan was detected
ET MALWARE Suspected Smokeloader Activity (POST)
1944
explorer.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz
1944
explorer.exe
A Network Trojan was detected
ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst
1944
explorer.exe
A Network Trojan was detected
ET MALWARE Suspected Smokeloader Activity (POST)
12 ETPRO signatures available at the full report
No debug info