File name:

Generateur De V-Bucks.exe

Full analysis: https://app.any.run/tasks/d78d9577-8c55-47dd-961d-486c9b4b7ef8
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 22, 2020, 22:28:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

45C65E651B6B90702529A9B0912060FD

SHA1:

C71893CBC637DE0F8FD0743FDB9B2D432B2AF463

SHA256:

9C074852F2B17D0A0EF5DE2CF1BDD7AFCE6D362CE28E9314B2695EB14AC05080

SSDEEP:

6144:+DRMxppSSVridF55EGOaJhaQXgFIaUHQWWiNLsqEIvooEE0Wgpg529iw4bEqF6QG:+DGxppI1wQwFXQWiNILu4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • dotNetFx45LP_Full_x86_x64fr.exe (PID: 2464)
      • dotNetFx45LP_Full_x86_x64fr.exe (PID: 3864)
      • Setup.exe (PID: 3968)
      • Generateur V-Bucks Fortnite.exe (PID: 2492)

    • Downloads executable files from the Internet

      • Generateur De V-Bucks.exe (PID: 3828)

    • Loads dropped or rewritten executable

      • Setup.exe (PID: 3968)
      • dfsvc.exe (PID: 3808)
      • Generateur V-Bucks Fortnite.exe (PID: 2492)

    • Changes settings of System certificates

      • Setup.exe (PID: 3968)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Generateur De V-Bucks.exe (PID: 3828)
      • dotNetFx45LP_Full_x86_x64fr.exe (PID: 2464)
      • dfsvc.exe (PID: 3808)
      • msiexec.exe (PID: 2752)

    • Reads Internet Cache Settings

      • Generateur De V-Bucks.exe (PID: 3828)
      • dfsvc.exe (PID: 3808)

    • Reads Environment values

      • dfsvc.exe (PID: 3808)

    • Creates COM task schedule object

      • aspnet_regiis.exe (PID: 3912)

    • Reads internet explorer settings

      • dfsvc.exe (PID: 3808)

    • Removes files from Windows directory

      • aspnet_regiis.exe (PID: 3912)

    • Creates files in the user directory

      • dfsvc.exe (PID: 3808)

    • Creates a software uninstall entry

      • dfsvc.exe (PID: 3808)

    • Creates files in the Windows directory

      • msiexec.exe (PID: 2752)
      • aspnet_regiis.exe (PID: 3912)

    • Adds / modifies Windows certificates

      • Setup.exe (PID: 3968)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • dotNetFx45LP_Full_x86_x64fr.exe (PID: 2464)
      • msiexec.exe (PID: 2752)
      • dfsvc.exe (PID: 3808)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 3928)
      • MsiExec.exe (PID: 3736)

    • Application launched itself

      • msiexec.exe (PID: 2752)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 2752)

    • Reads settings of System Certificates

      • Setup.exe (PID: 3968)
      • Generateur De V-Bucks.exe (PID: 3828)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (36.8)
.exe | Win32 Executable MS Visual C++ (generic) (26.6)
.exe | Win64 Executable (generic) (23.6)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2013:10:05 06:40:50+02:00
PEType: PE32
LinkerVersion: 12
CodeSize: 331264
InitializedDataSize: 103936
UninitializedDataSize: -
EntryPoint: 0x2fafd
OSVersion: 5.1
ImageVersion: 10
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 12.0.21005.1
ProductVersionNumber: 12.0.21005.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: -
FileDescription: Setup
FileVersion: 12.0.21005.1 built by: REL
InternalName: setup.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: setup.exe
ProductName: -
ProductVersion: 12.0.21005.1

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 05-Oct-2013 04:40:50
Detected languages:
  • English - United States
Debug artifacts:
  • setup.pdb
CompanyName: -
FileDescription: Setup
FileVersion: 12.0.21005.1 built by: REL
InternalName: setup.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: setup.exe
ProductName: -
ProductVersion: 12.0.21005.1

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000F8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 05-Oct-2013 04:40:50
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00050DC8
0x00050E00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.37701
.data
0x00052000
0x0000460C
0x00002000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.79845
.idata
0x00057000
0x000014A4
0x00001600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.33464
.rsrc
0x00059000
0x0001267C
0x00012800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.0963
.reloc
0x0006C000
0x00003608
0x00003800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.54791

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.22003
1286
Latin 1 / Western European
English - United States
RT_MANIFEST
2
3.01125
296
Latin 1 / Western European
English - United States
RT_ICON
3
2.66147
2216
Latin 1 / Western European
English - United States
RT_ICON
4
1.69902
1384
Latin 1 / Western European
English - United States
RT_ICON
5
3.52655
4264
Latin 1 / Western European
English - United States
RT_ICON
6
3.83804
1128
Latin 1 / Western European
English - United States
RT_ICON
7
2.22476
744
Latin 1 / Western European
English - United States
RT_ICON
8
2.497
296
Latin 1 / Western European
English - United States
RT_ICON
9
1.78194
2216
Latin 1 / Western European
English - United States
RT_ICON
10
1.0882
1384
Latin 1 / Western European
English - United States
RT_ICON

Imports

ADVAPI32.dll (delay-loaded)
CRYPT32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
Secur32.dll
USER32.dll
WININET.dll
msi.dll
ole32.dll

Exports

Title
Ordinal
Address
_DecodePointerInternal@4
1
0x0001CE3B
_EncodePointerInternal@4
2
0x0001CE56
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
11
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start generateur de v-bucks.exe dotnetfx45lp_full_x86_x64fr.exe no specs dotnetfx45lp_full_x86_x64fr.exe setup.exe msiexec.exe msiexec.exe no specs msiexec.exe no specs aspnet_regiis.exe no specs mofcomp.exe no specs dfsvc.exe generateur v-bucks fortnite.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2464"C:\Users\admin\AppData\Local\Temp\VSD6BB2.tmp\DotNetFX45\dotNetFx45LP_Full_x86_x64fr.exe" /q /norestart /ChainingPackage FullX64ClickOnceC:\Users\admin\AppData\Local\Temp\VSD6BB2.tmp\DotNetFX45\dotNetFx45LP_Full_x86_x64fr.exe
Generateur De V-Bucks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Framework 4.5 FRA Language Pack Setup
Exit code:
0
Version:
4.5.50709.17929
Modules
Images
c:\users\admin\appdata\local\temp\vsd6bb2.tmp\dotnetfx45\dotnetfx45lp_full_x86_x64fr.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
2492"C:\Users\admin\AppData\Local\Apps\2.0\J8CTCATM.CMJ\RXEKCHAD.Y7H\gene..tion_178ed3282882857f_0004.0000_49471e47caae9c14\Generateur V-Bucks Fortnite.exe"C:\Users\admin\AppData\Local\Apps\2.0\J8CTCATM.CMJ\RXEKCHAD.Y7H\gene..tion_178ed3282882857f_0004.0000_49471e47caae9c14\Generateur V-Bucks Fortnite.exe—dfsvc.exe
User:
admin
Company:
OldModz95
Integrity Level:
MEDIUM
Description:
Generateur Code Promo
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\apps\2.0\j8ctcatm.cmj\rxekchad.y7h\gene..tion_178ed3282882857f_0004.0000_49471e47caae9c14\generateur v-bucks fortnite.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2752C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3736C:\Windows\system32\MsiExec.exe -Embedding C781CC0081A7E6F124E9A7221C8CB70EC:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3808"C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe
Generateur De V-Bucks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
ClickOnce
Exit code:
0
Version:
4.7.3062.0 built by: NET472REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\dfsvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3828"C:\Users\admin\Desktop\Generateur De V-Bucks.exe" C:\Users\admin\Desktop\Generateur De V-Bucks.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup
Exit code:
0
Version:
12.0.21005.1 built by: REL
Modules
Images
c:\users\admin\desktop\generateur de v-bucks.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
3864"C:\Users\admin\AppData\Local\Temp\VSD6BB2.tmp\DotNetFX45\dotNetFx45LP_Full_x86_x64fr.exe" /q /norestart /ChainingPackage FullX64ClickOnceC:\Users\admin\AppData\Local\Temp\VSD6BB2.tmp\DotNetFX45\dotNetFx45LP_Full_x86_x64fr.exe—Generateur De V-Bucks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Framework 4.5 FRA Language Pack Setup
Exit code:
3221226540
Version:
4.5.50709.17929
Modules
Images
c:\users\admin\appdata\local\temp\vsd6bb2.tmp\dotnetfx45\dotnetfx45lp_full_x86_x64fr.exe
c:\systemroot\system32\ntdll.dll
3912"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe" -iruC:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe—MsiExec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
aspnet_regiis.exe
Exit code:
0
Version:
4.7.3062.0 built by: NET472REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\aspnet_regiis.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcr120_clr0400.dll
c:\windows\system32\gdi32.dll
3928C:\Windows\system32\MsiExec.exe -Embedding 47D49FB276A35127F9F8DE150E244DF1 M Global\MSI0000C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3968C:\2decdd6bf63ea23def2f565d0ddc\\Setup.exe /q /norestart /ChainingPackage FullX64ClickOnce /x86 /x64 /lcid 1036C:\2decdd6bf63ea23def2f565d0ddc\Setup.exe
dotNetFx45LP_Full_x86_x64fr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Setup Installer
Exit code:
0
Version:
11.0.50709.17929 built by: FX45RTMREL
Modules
Images
c:\2decdd6bf63ea23def2f565d0ddc\setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\2decdd6bf63ea23def2f565d0ddc\setupengine.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
Total events
9 375
Read events
7 084
Write events
2 251
Delete events
40

Modification events

(PID) Process:(3828) Generateur De V-Bucks.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3828) Generateur De V-Bucks.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3828) Generateur De V-Bucks.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3828) Generateur De V-Bucks.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A1000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(3828) Generateur De V-Bucks.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3828) Generateur De V-Bucks.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3828) Generateur De V-Bucks.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3828) Generateur De V-Bucks.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3968) Setup.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3968) Setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CDD4EEAE6000AC7F40C3802C171E30148030C072
Operation:writeName:Blob
Value:
0F0000000100000014000000391BE92883D52509155BFEAE27B9BD340170B76B030000000100000014000000CDD4EEAE6000AC7F40C3802C171E30148030C0720B000000010000004A0000004D006900630072006F0073006F0066007400200052006F006F007400200043006500720074006900660069006300610074006500200041007500740068006F007200690074007900000069000000010000000E000000300C060A2B0601040182373C030220000000010000009D0500003082059930820381A003020102021079AD16A14AA0A5AD4C7358F407132E65300D06092A864886F70D0101050500305F31133011060A0992268993F22C6401191603636F6D31193017060A0992268993F22C64011916096D6963726F736F6674312D302B060355040313244D6963726F736F667420526F6F7420436572746966696361746520417574686F72697479301E170D3031303530393233313932325A170D3231303530393233323831335A305F31133011060A0992268993F22C6401191603636F6D31193017060A0992268993F22C64011916096D6963726F736F6674312D302B060355040313244D6963726F736F667420526F6F7420436572746966696361746520417574686F7269747930820222300D06092A864886F70D01010105000382020F003082020A0282020100F35DFA8067D45AA7A90C2C9020D035083C7584CDB707899C89DADECEC360FA91685A9E94712918767CC2E0C82576940E58FA043436E6DFAFF780BAE9580B2B93E59D05E3772291F734643C22911D5EE10990BC14FEFC755819E179B70792A3AE885908D89F07CA0358FC68296D32D7D2A8CB4BFCE10B48324FE6EBB8AD4FE45C6F139499DB95D575DBA81AB79491B4775BF5480C8F6A797D1470047D6DAF90F5DA70D847B7BF9B2F6CE705B7E11160AC7991147CC5D6A6E4E17ED5C37EE592D23C00B53682DE79E16DF3B56EF89F33C9CB527D739836DB8BA16BA295979BA3DEC24D26FF0696672506C8E7ACE4EE1233953199C835084E34CA7953D5B5BE6332594036C0A54E044D3DDB5B0733E458BFEF3F5364D842593557FD0F457C24044D9ED6387411972290CE684474926FD54B6FB086E3C73642A0D0FCC1C05AF9A361B9304771960A16B091C04295EF107F286AE32A1FB1E4CD033F777104C720FC490F1D4588A4D7CB7E88AD8E2DEC45DBC45104C92AFCEC869E9A11975BDECE5388E6E2B7FDAC95C22840DBEF0490DF813339D9B245A5238706A5558931BB062D600E41187D1F2EB597CB11EB15D524A594EF151489FD4B73FA325BFCD13300F95962700732EA2EAB402D7BCADD21671B30998F16AA23A841D1B06E119B36C4DE40749CE15865C1601E7A5B38C88FBB04267CD41640E5B66B6CAA86FD00BFCEC1350203010001A351304F300B0603551D0F0404030201C6300F0603551D130101FF040530030101FF301D0603551D0E041604140EAC826040562797E52513FC2AE10A539559E4A4301006092B06010401823715010403020100300D06092A864886F70D01010505000382020100C5114D033A60DD5D5211778FB2BB36C8B205BFB4B7A8D8209D5C1303B61C22FA061335B6C863D49A476F2657D255F104B1265FD6A95068A0BCD2B86ECCC3E9ACDF19CD78AC5974AC663436C41B3E6C384C330E30120DA326FE515300FFAF5A4E840D0F1FE46D052E4E854B8D6C336F54D264ABBF50AF7D7A39A037ED63030FFC1306CE1636D4543B951B51623AE54D17D40539929A27A85BAABDECBBBEE3208960716C56B3A513D06D0E237E9503ED683DF2D863B86B4DB6E830B5E1CA944BF7A2AA5D9930B23DA7C2516C28200124272B4B00B79D116B70BEB21082BC0C9B68D08D3B2487AA9928729D335F5990BDF5DE939E3A625A3439E288551DB906B0C1896B2DD769C319123684D0C9A0DAFF2F6978B2E57ADAEBD70CC0F7BD6317B8391338A2365B7BF285566A1D6462C138E2AABF5166A294F5129C6622106BF2B730922DF229F03D3B144368A2F19C2937CBCE3820256D7C67F37E24122403088147ECA59E97F518D7CFBBD5EF7696EFFDCEDB569D95A042F99758E1D73122D35F59E63E6E2200EA4384B625DBD9F3085668C0646B1D7CECB693A262576E2ED8E7588FC4314926DDDE293587F53071705B143C69BD89127DEB2EA3FED87F9E825A520A2BC1432BD930889FC810FB898DE6A18575337E6C9EDB7313646269A52F7DCA966D9FF8044D30923D6E211421C93DE0C3FD8A6B9D4AFDD1A19D9943773FB0DA
Executable files
324
Suspicious files
35
Text files
255
Unknown types
6

Dropped files

PID
Process
Filename
Type
3828Generateur De V-Bucks.exeC:\Users\admin\AppData\Local\Temp\Cab8BCE.tmp —
MD5:—
SHA256:—
3828Generateur De V-Bucks.exeC:\Users\admin\AppData\Local\Temp\Tar8BCF.tmp —
MD5:—
SHA256:—
3828Generateur De V-Bucks.exeC:\Users\admin\AppData\Local\Temp\VSD6BB2.tmp\Generateur De V-Bucks.exeexecutable
MD5:—
SHA256:—
3828Generateur De V-Bucks.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1F657678CDAD5400251B323D207EA54Fbinary
MD5:—
SHA256:—
3828Generateur De V-Bucks.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\696F3DE637E6DE85B458996D49D759ADbinary
MD5:—
SHA256:—
3828Generateur De V-Bucks.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\696F3DE637E6DE85B458996D49D759ADder
MD5:—
SHA256:—
3828Generateur De V-Bucks.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7396C420A8E1BC1DA97F1AF0D10BAD21binary
MD5:—
SHA256:—
3828Generateur De V-Bucks.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7396C420A8E1BC1DA97F1AF0D10BAD21der
MD5:—
SHA256:—
3828Generateur De V-Bucks.exeC:\Users\admin\AppData\Local\Temp\VSD6BB2.tmp\DotNetFX45\dotNetFx45LP_Full_x86_x64fr.exeexecutable
MD5:5902D72ACE6D8878184E4439B5D28CDD
SHA256:E5ED7D9D7103456A0F5925314D0B85C15E7EEE648C10E1C01EFAE04667A780B3
2464dotNetFx45LP_Full_x86_x64fr.exeC:\2decdd6bf63ea23def2f565d0ddc\SplashScreen.bmpimage
MD5:0966FCD5A4AB0DDF71F46C01EFF3CDD5
SHA256:31C13ECFC0EB27F34036FB65CC0E735CD444EEC75376EEA2642F926AC162DCB3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
10
DNS requests
7
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3828
Generateur De V-Bucks.exe
GET
302
2.19.38.59:80
http://go.microsoft.com/fwlink/?linkid=249114&clcid=0x40c
unknown
—
—
whitelisted
3968
Setup.exe
GET
200
2.16.186.120:80
http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl
unknown
der
550 b
whitelisted
3828
Generateur De V-Bucks.exe
GET
200
2.18.233.19:80
http://download.microsoft.com/download/C/6/4/C641D358-2DDD-4C86-9F17-08D83F375BB7/fra_netfx/x64/dotnetfx45lp_full_x86_x64fr.exe
unknown
executable
4.04 Mb
whitelisted
3828
Generateur De V-Bucks.exe
GET
200
2.18.233.62:80
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt
unknown
der
1.44 Kb
whitelisted
3828
Generateur De V-Bucks.exe
GET
200
2.16.186.120:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl
unknown
der
555 b
whitelisted
3828
Generateur De V-Bucks.exe
GET
200
2.16.186.120:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
unknown
der
781 b
whitelisted
3828
Generateur De V-Bucks.exe
GET
200
72.21.91.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAilokbNS1yMg9cCtLurU0k%3D
US
der
471 b
whitelisted
3808
dfsvc.exe
GET
200
93.184.221.240:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
57.4 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3828
Generateur De V-Bucks.exe
2.19.38.59:80
go.microsoft.com
Akamai International B.V.
—
whitelisted
3828
Generateur De V-Bucks.exe
2.18.233.62:80
www.microsoft.com
Akamai International B.V.
—
whitelisted
3828
Generateur De V-Bucks.exe
2.18.233.19:80
download.microsoft.com
Akamai International B.V.
—
whitelisted
3968
Setup.exe
2.16.186.120:80
crl.microsoft.com
Akamai International B.V.
—
whitelisted
3828
Generateur De V-Bucks.exe
2.16.186.120:80
crl.microsoft.com
Akamai International B.V.
—
whitelisted
3828
Generateur De V-Bucks.exe
145.14.144.51:443
oldmodz95.000webhostapp.com
Hostinger International Limited
US
shared
3828
Generateur De V-Bucks.exe
72.21.91.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3808
dfsvc.exe
145.14.144.51:443
oldmodz95.000webhostapp.com
Hostinger International Limited
US
shared
3808
dfsvc.exe
93.184.221.240:80
www.download.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
go.microsoft.com
  • 2.19.38.59
whitelisted
download.microsoft.com
  • 2.18.233.19
whitelisted
www.microsoft.com
  • 2.18.233.62
whitelisted
crl.microsoft.com
  • 2.16.186.120
  • 2.16.186.74
whitelisted
oldmodz95.000webhostapp.com
  • 145.14.144.51
shared
ocsp.digicert.com
  • 72.21.91.29
whitelisted
www.download.windowsupdate.com
  • 93.184.221.240
whitelisted

Threats

PID
Process
Class
Message
3828
Generateur De V-Bucks.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1052
svchost.exe
Not Suspicious Traffic
ET INFO Observed Free Hosting Domain (*.000webhostapp .com in DNS Lookup)
3828
Generateur De V-Bucks.exe
Not Suspicious Traffic
ET INFO Observed SSL Cert for Free Hosting Domain (*.000webhostapp .com)
3808
dfsvc.exe
Not Suspicious Traffic
ET INFO Observed SSL Cert for Free Hosting Domain (*.000webhostapp .com)
3808
dfsvc.exe
Not Suspicious Traffic
ET INFO Observed SSL Cert for Free Hosting Domain (*.000webhostapp .com)
Process
Message
Setup.exe
The operation completed successfully.
dfsvc.exe
*** Status originated: -1073741811 *** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741811 *** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741811 *** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741811 *** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status originated: -1073741811 *** Source File: d:\iso_whid\x86fre\base\isolation\hier_hierarchy.cpp, line 230
dfsvc.exe
*** Status Originated: -1073741772 *** Source File: d:\iso_whid\x86fre\base\isolation\win32\isoreg_direct.cpp, line 1127
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Generateur De V-Bucks.exe