File name:

Setup_x32_x64.exe

Full analysis: https://app.any.run/tasks/811f38c3-a337-430e-b89d-a70f19df2e1d
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 08, 2022, 13:08:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
trojan
rat
redline
loader
stealer
raccoon
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

5F7F42F26F25E4E7342C00E05C0176FA

SHA1:

582EA6AA20547C8B7F83CECCBA5B3B4B1E7E4FB7

SHA256:

9E719C4DD5E1086D5197FDED7B8CDB0D3D592C0636B0D469FCDA22C9723E8E7C

SSDEEP:

49152:PbA37xyPeKsyMV/mmzApSr+EHgHjCLZsMbGEpD6e3h3igtpz+vDzfvmWvoDH:PbReKyAugDmZsMwO3TpgfuWvQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • Setup_x32_x64.exe (PID: 2512)
      • HfrJYnCVUfWLmZibeOJHOiXF.exe (PID: 2940)
      • _DfkDxZBfNifS4WriPXKnwcK.exe (PID: 1252)
      • AppLaunch.exe (PID: 2728)

    • Application was dropped or rewritten from another process

      • Folder.exe (PID: 2924)
      • Folder.exe (PID: 3304)
      • RobCleanerInstl3183813.exe (PID: 2360)
      • soft.exe (PID: 2364)
      • Proxyupd.exe (PID: 504)
      • File.exe (PID: 3260)
      • askinstall49.exe (PID: 2572)
      • ff369556-e407-4fd9-a0ef-78eb74d88b5a.exe (PID: 3828)
      • HfrJYnCVUfWLmZibeOJHOiXF.exe (PID: 2940)
      • hRDZLtloH9iv5ztTZGQGIEL_.exe (PID: 1784)
      • aBQzBF38K4aUSFN64wFswO4U.exe (PID: 3396)
      • q0jP28LN5mYpElyFnupoPz8m.exe (PID: 832)
      • QbZcTumuihKhBJ4QhWHhSRLK.exe (PID: 3408)
      • NUAQfNodVd871kHStBJOKRHC.exe (PID: 2592)
      • 2TMnMSVEw2BEwaDNMDE1yoIq.exe (PID: 3080)
      • 22dzcEZcXjvNqtyA_EL2hG8i.exe (PID: 3888)
      • _DfkDxZBfNifS4WriPXKnwcK.exe (PID: 1252)
      • jg1_1faf.exe (PID: 488)
      • GmV0y09dRW8Mj9uNHWVp6uqf.exe (PID: 2588)
      • b5TXfJR0JJbfYfpmHjfakXqO.exe (PID: 3716)
      • Install.exe (PID: 2384)
      • Install.exe (PID: 3388)
      • 03WLtgsXxD8w7TNxuestpZuQ.exe (PID: 2008)
      • Djov791sT40YGjobGJtcXkuo.exe (PID: 1696)
      • _zt_s7L3im8WaK8Wpzis2NKZ.exe (PID: 2168)
      • Xuo7kZMzP1a8y5VMxbhkaWCb.exe (PID: 3248)
      • rCKsue5HLiZQTijDFfdZOtVQ.exe (PID: 2784)
      • uDahvyJ85YfcmzzTqMua7v6M.exe (PID: 3784)
      • asd.exe (PID: 1536)
      • AppLaunch.exe (PID: 3608)
      • AppLaunch.exe (PID: 484)
      • AppLaunch.exe (PID: 3132)
      • AppLaunch.exe (PID: 2728)
      • mjlooy.exe (PID: 3888)
      • MdoYYbe.exe (PID: 1696)
      • ncbGeWF.exe (PID: 2680)

    • Actions looks like stealing of personal data

      • ff369556-e407-4fd9-a0ef-78eb74d88b5a.exe (PID: 3828)
      • hRDZLtloH9iv5ztTZGQGIEL_.exe (PID: 1784)
      • unlodctr.exe (PID: 3544)
      • 03WLtgsXxD8w7TNxuestpZuQ.exe (PID: 2008)
      • _zt_s7L3im8WaK8Wpzis2NKZ.exe (PID: 2168)
      • Djov791sT40YGjobGJtcXkuo.exe (PID: 1696)
      • AppLaunch.exe (PID: 3608)
      • AppLaunch.exe (PID: 484)
      • AppLaunch.exe (PID: 3132)
      • jg1_1faf.exe (PID: 488)
      • 22dzcEZcXjvNqtyA_EL2hG8i.exe (PID: 3888)
      • ncbGeWF.exe (PID: 2680)

    • Steals credentials from Web Browsers

      • ff369556-e407-4fd9-a0ef-78eb74d88b5a.exe (PID: 3828)
      • unlodctr.exe (PID: 3544)
      • hRDZLtloH9iv5ztTZGQGIEL_.exe (PID: 1784)
      • 03WLtgsXxD8w7TNxuestpZuQ.exe (PID: 2008)
      • Djov791sT40YGjobGJtcXkuo.exe (PID: 1696)
      • AppLaunch.exe (PID: 484)
      • AppLaunch.exe (PID: 3608)
      • _zt_s7L3im8WaK8Wpzis2NKZ.exe (PID: 2168)
      • jg1_1faf.exe (PID: 488)
      • AppLaunch.exe (PID: 3132)
      • 22dzcEZcXjvNqtyA_EL2hG8i.exe (PID: 3888)
      • ncbGeWF.exe (PID: 2680)

    • REDLINE was detected

      • soft.exe (PID: 2364)
      • hRDZLtloH9iv5ztTZGQGIEL_.exe (PID: 1784)
      • 03WLtgsXxD8w7TNxuestpZuQ.exe (PID: 2008)
      • _zt_s7L3im8WaK8Wpzis2NKZ.exe (PID: 2168)
      • Djov791sT40YGjobGJtcXkuo.exe (PID: 1696)
      • AppLaunch.exe (PID: 3608)
      • AppLaunch.exe (PID: 484)
      • AppLaunch.exe (PID: 3132)

    • Connects to CnC server

      • soft.exe (PID: 2364)
      • File.exe (PID: 3260)
      • hRDZLtloH9iv5ztTZGQGIEL_.exe (PID: 1784)
      • aBQzBF38K4aUSFN64wFswO4U.exe (PID: 3396)
      • jg1_1faf.exe (PID: 488)
      • 03WLtgsXxD8w7TNxuestpZuQ.exe (PID: 2008)
      • Djov791sT40YGjobGJtcXkuo.exe (PID: 1696)
      • _zt_s7L3im8WaK8Wpzis2NKZ.exe (PID: 2168)
      • AppLaunch.exe (PID: 3608)
      • AppLaunch.exe (PID: 484)
      • AppLaunch.exe (PID: 3132)
      • 22dzcEZcXjvNqtyA_EL2hG8i.exe (PID: 3888)

    • Disables Windows Defender

      • File.exe (PID: 3260)

    • Changes settings of System certificates

      • File.exe (PID: 3260)
      • aBQzBF38K4aUSFN64wFswO4U.exe (PID: 3396)
      • unlodctr.exe (PID: 3544)

    • Stealing of credential data

      • unlodctr.exe (PID: 3544)
      • 22dzcEZcXjvNqtyA_EL2hG8i.exe (PID: 3888)

    • Uses Task Scheduler to autorun other applications

      • aBQzBF38K4aUSFN64wFswO4U.exe (PID: 3396)
      • ncbGeWF.exe (PID: 2680)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2460)
      • schtasks.exe (PID: 3224)
      • schtasks.exe (PID: 1532)
      • schtasks.exe (PID: 2880)
      • schtasks.exe (PID: 2500)
      • schtasks.exe (PID: 3696)
      • schtasks.exe (PID: 1248)
      • schtasks.exe (PID: 2948)
      • schtasks.exe (PID: 1080)
      • schtasks.exe (PID: 3468)
      • schtasks.exe (PID: 3440)
      • schtasks.exe (PID: 2516)
      • schtasks.exe (PID: 3260)
      • schtasks.exe (PID: 2908)
      • schtasks.exe (PID: 3436)
      • schtasks.exe (PID: 2852)
      • schtasks.exe (PID: 2920)
      • schtasks.exe (PID: 2132)
      • schtasks.exe (PID: 2988)
      • schtasks.exe (PID: 3468)

    • Uses Task Scheduler to run other applications

      • aBQzBF38K4aUSFN64wFswO4U.exe (PID: 3396)
      • Install.exe (PID: 3388)
      • MdoYYbe.exe (PID: 1696)
      • ncbGeWF.exe (PID: 2680)
      • rundll32.EXE (PID: 1404)

    • Loads the Task Scheduler DLL interface

      • schtasks.exe (PID: 3472)
      • schtasks.exe (PID: 3004)
      • schtasks.exe (PID: 1652)
      • schtasks.exe (PID: 2008)

    • RACCOON was detected

      • 22dzcEZcXjvNqtyA_EL2hG8i.exe (PID: 3888)

    • Modifies exclusions in Windows Defender

      • reg.exe (PID: 1576)
      • reg.exe (PID: 1816)
      • reg.exe (PID: 3332)
      • reg.exe (PID: 3552)
      • reg.exe (PID: 2476)
      • reg.exe (PID: 464)
      • reg.exe (PID: 420)
      • reg.exe (PID: 3436)
      • reg.exe (PID: 500)

    • Modifies files in Chrome extension folder

      • ncbGeWF.exe (PID: 2680)

  • SUSPICIOUS

    • Checks supported languages

      • Setup_x32_x64.exe (PID: 3144)
      • Setup_x32_x64.exe (PID: 2512)
      • Proxyupd.exe (PID: 504)
      • Folder.exe (PID: 2924)
      • RobCleanerInstl3183813.exe (PID: 2360)
      • Folder.exe (PID: 3304)
      • soft.exe (PID: 2364)
      • askinstall49.exe (PID: 2572)
      • File.exe (PID: 3260)
      • ff369556-e407-4fd9-a0ef-78eb74d88b5a.exe (PID: 3828)
      • HfrJYnCVUfWLmZibeOJHOiXF.exe (PID: 2940)
      • aBQzBF38K4aUSFN64wFswO4U.exe (PID: 3396)
      • hRDZLtloH9iv5ztTZGQGIEL_.exe (PID: 1784)
      • NUAQfNodVd871kHStBJOKRHC.exe (PID: 2592)
      • q0jP28LN5mYpElyFnupoPz8m.exe (PID: 832)
      • QbZcTumuihKhBJ4QhWHhSRLK.exe (PID: 3408)
      • cmd.exe (PID: 2356)
      • _DfkDxZBfNifS4WriPXKnwcK.exe (PID: 1252)
      • jg1_1faf.exe (PID: 488)
      • 22dzcEZcXjvNqtyA_EL2hG8i.exe (PID: 3888)
      • b5TXfJR0JJbfYfpmHjfakXqO.exe (PID: 3716)
      • GmV0y09dRW8Mj9uNHWVp6uqf.exe (PID: 2588)
      • Install.exe (PID: 2384)
      • 03WLtgsXxD8w7TNxuestpZuQ.exe (PID: 2008)
      • Install.exe (PID: 3388)
      • Djov791sT40YGjobGJtcXkuo.exe (PID: 1696)
      • powershell.EXE (PID: 1964)
      • _zt_s7L3im8WaK8Wpzis2NKZ.exe (PID: 2168)
      • cmd.exe (PID: 3804)
      • AppLaunch.exe (PID: 3608)
      • rCKsue5HLiZQTijDFfdZOtVQ.exe (PID: 2784)
      • AppLaunch.exe (PID: 484)
      • Xuo7kZMzP1a8y5VMxbhkaWCb.exe (PID: 3248)
      • uDahvyJ85YfcmzzTqMua7v6M.exe (PID: 3784)
      • AppLaunch.exe (PID: 3132)
      • cmd.exe (PID: 1040)
      • asd.exe (PID: 1536)
      • AppLaunch.exe (PID: 2728)
      • mjlooy.exe (PID: 3888)
      • MdoYYbe.exe (PID: 1696)
      • powershell.EXE (PID: 1548)
      • cmd.exe (PID: 3492)
      • cmd.exe (PID: 3836)
      • cmd.exe (PID: 2804)
      • wscript.exe (PID: 2616)
      • ncbGeWF.exe (PID: 2680)
      • cmd.exe (PID: 3536)
      • cmd.exe (PID: 420)
      • cmd.exe (PID: 2304)
      • cmd.exe (PID: 3920)

    • Reads the computer name

      • Setup_x32_x64.exe (PID: 3144)
      • Setup_x32_x64.exe (PID: 2512)
      • soft.exe (PID: 2364)
      • Folder.exe (PID: 2924)
      • Proxyupd.exe (PID: 504)
      • RobCleanerInstl3183813.exe (PID: 2360)
      • Folder.exe (PID: 3304)
      • askinstall49.exe (PID: 2572)
      • File.exe (PID: 3260)
      • ff369556-e407-4fd9-a0ef-78eb74d88b5a.exe (PID: 3828)
      • aBQzBF38K4aUSFN64wFswO4U.exe (PID: 3396)
      • q0jP28LN5mYpElyFnupoPz8m.exe (PID: 832)
      • QbZcTumuihKhBJ4QhWHhSRLK.exe (PID: 3408)
      • hRDZLtloH9iv5ztTZGQGIEL_.exe (PID: 1784)
      • NUAQfNodVd871kHStBJOKRHC.exe (PID: 2592)
      • _DfkDxZBfNifS4WriPXKnwcK.exe (PID: 1252)
      • b5TXfJR0JJbfYfpmHjfakXqO.exe (PID: 3716)
      • 22dzcEZcXjvNqtyA_EL2hG8i.exe (PID: 3888)
      • 03WLtgsXxD8w7TNxuestpZuQ.exe (PID: 2008)
      • jg1_1faf.exe (PID: 488)
      • Install.exe (PID: 3388)
      • Djov791sT40YGjobGJtcXkuo.exe (PID: 1696)
      • _zt_s7L3im8WaK8Wpzis2NKZ.exe (PID: 2168)
      • powershell.EXE (PID: 1964)
      • AppLaunch.exe (PID: 3608)
      • AppLaunch.exe (PID: 484)
      • rCKsue5HLiZQTijDFfdZOtVQ.exe (PID: 2784)
      • uDahvyJ85YfcmzzTqMua7v6M.exe (PID: 3784)
      • AppLaunch.exe (PID: 3132)
      • asd.exe (PID: 1536)
      • AppLaunch.exe (PID: 2728)
      • powershell.EXE (PID: 1548)
      • wscript.exe (PID: 2616)
      • ncbGeWF.exe (PID: 2680)

    • Drops a file that was compiled in debug mode

      • Setup_x32_x64.exe (PID: 2512)
      • File.exe (PID: 3260)
      • _DfkDxZBfNifS4WriPXKnwcK.exe (PID: 1252)
      • jg1_1faf.exe (PID: 488)
      • 22dzcEZcXjvNqtyA_EL2hG8i.exe (PID: 3888)
      • AppLaunch.exe (PID: 2728)

    • Application launched itself

      • Setup_x32_x64.exe (PID: 3144)
      • Folder.exe (PID: 2924)

    • Executed via COM

      • iexplore.exe (PID: 2716)

    • Drops a file with a compile date too recent

      • Setup_x32_x64.exe (PID: 2512)
      • RobCleanerInstl3183813.exe (PID: 2360)
      • File.exe (PID: 3260)
      • aBQzBF38K4aUSFN64wFswO4U.exe (PID: 3396)
      • AppLaunch.exe (PID: 484)
      • AppLaunch.exe (PID: 3132)
      • 22dzcEZcXjvNqtyA_EL2hG8i.exe (PID: 3888)
      • AppLaunch.exe (PID: 3608)

    • Executes application which crashes

      • Setup_x32_x64.exe (PID: 2512)

    • Executable content was dropped or overwritten

      • Setup_x32_x64.exe (PID: 2512)
      • RobCleanerInstl3183813.exe (PID: 2360)
      • File.exe (PID: 3260)
      • HfrJYnCVUfWLmZibeOJHOiXF.exe (PID: 2940)
      • aBQzBF38K4aUSFN64wFswO4U.exe (PID: 3396)
      • _DfkDxZBfNifS4WriPXKnwcK.exe (PID: 1252)
      • jg1_1faf.exe (PID: 488)
      • Install.exe (PID: 2384)
      • GmV0y09dRW8Mj9uNHWVp6uqf.exe (PID: 2588)
      • Install.exe (PID: 3388)
      • AppLaunch.exe (PID: 484)
      • AppLaunch.exe (PID: 3132)
      • AppLaunch.exe (PID: 3608)
      • 22dzcEZcXjvNqtyA_EL2hG8i.exe (PID: 3888)
      • AppLaunch.exe (PID: 2728)
      • MdoYYbe.exe (PID: 1696)
      • ncbGeWF.exe (PID: 2680)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 1948)
      • iexplore.exe (PID: 2316)
      • iexplore.exe (PID: 2672)

    • Reads Windows owner or organization settings

      • soft.exe (PID: 2364)
      • ff369556-e407-4fd9-a0ef-78eb74d88b5a.exe (PID: 3828)

    • Reads Environment values

      • RobCleanerInstl3183813.exe (PID: 2360)
      • ff369556-e407-4fd9-a0ef-78eb74d88b5a.exe (PID: 3828)
      • hRDZLtloH9iv5ztTZGQGIEL_.exe (PID: 1784)
      • 03WLtgsXxD8w7TNxuestpZuQ.exe (PID: 2008)
      • QbZcTumuihKhBJ4QhWHhSRLK.exe (PID: 3408)
      • Djov791sT40YGjobGJtcXkuo.exe (PID: 1696)
      • _zt_s7L3im8WaK8Wpzis2NKZ.exe (PID: 2168)
      • AppLaunch.exe (PID: 3608)
      • AppLaunch.exe (PID: 484)
      • AppLaunch.exe (PID: 3132)
      • 22dzcEZcXjvNqtyA_EL2hG8i.exe (PID: 3888)

    • Reads the cookies of Google Chrome

      • ff369556-e407-4fd9-a0ef-78eb74d88b5a.exe (PID: 3828)
      • hRDZLtloH9iv5ztTZGQGIEL_.exe (PID: 1784)
      • 03WLtgsXxD8w7TNxuestpZuQ.exe (PID: 2008)
      • Djov791sT40YGjobGJtcXkuo.exe (PID: 1696)
      • AppLaunch.exe (PID: 484)
      • AppLaunch.exe (PID: 3608)
      • _zt_s7L3im8WaK8Wpzis2NKZ.exe (PID: 2168)
      • jg1_1faf.exe (PID: 488)
      • AppLaunch.exe (PID: 3132)

    • Reads the cookies of Mozilla Firefox

      • ff369556-e407-4fd9-a0ef-78eb74d88b5a.exe (PID: 3828)
      • hRDZLtloH9iv5ztTZGQGIEL_.exe (PID: 1784)
      • 03WLtgsXxD8w7TNxuestpZuQ.exe (PID: 2008)
      • Djov791sT40YGjobGJtcXkuo.exe (PID: 1696)
      • AppLaunch.exe (PID: 484)
      • AppLaunch.exe (PID: 3608)
      • _zt_s7L3im8WaK8Wpzis2NKZ.exe (PID: 2168)
      • jg1_1faf.exe (PID: 488)
      • AppLaunch.exe (PID: 3132)

    • Searches for installed software

      • ff369556-e407-4fd9-a0ef-78eb74d88b5a.exe (PID: 3828)
      • Djov791sT40YGjobGJtcXkuo.exe (PID: 1696)
      • hRDZLtloH9iv5ztTZGQGIEL_.exe (PID: 1784)
      • AppLaunch.exe (PID: 484)
      • _zt_s7L3im8WaK8Wpzis2NKZ.exe (PID: 2168)
      • AppLaunch.exe (PID: 3132)
      • 03WLtgsXxD8w7TNxuestpZuQ.exe (PID: 2008)
      • AppLaunch.exe (PID: 3608)
      • 22dzcEZcXjvNqtyA_EL2hG8i.exe (PID: 3888)

    • Checks for external IP

      • File.exe (PID: 3260)
      • aBQzBF38K4aUSFN64wFswO4U.exe (PID: 3396)

    • Adds / modifies Windows certificates

      • File.exe (PID: 3260)
      • aBQzBF38K4aUSFN64wFswO4U.exe (PID: 3396)
      • unlodctr.exe (PID: 3544)

    • Starts CMD.EXE for commands execution

      • NUAQfNodVd871kHStBJOKRHC.exe (PID: 2592)
      • forfiles.exe (PID: 2668)
      • forfiles.exe (PID: 2928)
      • unlodctr.exe (PID: 3544)
      • 22dzcEZcXjvNqtyA_EL2hG8i.exe (PID: 3888)
      • MdoYYbe.exe (PID: 1696)
      • ncbGeWF.exe (PID: 2680)

    • Drops a file with too old compile date

      • File.exe (PID: 3260)
      • _DfkDxZBfNifS4WriPXKnwcK.exe (PID: 1252)
      • 22dzcEZcXjvNqtyA_EL2hG8i.exe (PID: 3888)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2356)

    • Executed via WMI

      • rundll32.exe (PID: 2160)

    • Creates files in the program directory

      • aBQzBF38K4aUSFN64wFswO4U.exe (PID: 3396)
      • _DfkDxZBfNifS4WriPXKnwcK.exe (PID: 1252)
      • jg1_1faf.exe (PID: 488)
      • ncbGeWF.exe (PID: 2680)

    • Creates files in the user directory

      • unlodctr.exe (PID: 3544)
      • powershell.EXE (PID: 1964)
      • AppLaunch.exe (PID: 3608)
      • powershell.EXE (PID: 1548)
      • ncbGeWF.exe (PID: 2680)

    • Creates a directory in Program Files

      • _DfkDxZBfNifS4WriPXKnwcK.exe (PID: 1252)
      • aBQzBF38K4aUSFN64wFswO4U.exe (PID: 3396)
      • ncbGeWF.exe (PID: 2680)

    • Creates a software uninstall entry

      • _DfkDxZBfNifS4WriPXKnwcK.exe (PID: 1252)
      • ncbGeWF.exe (PID: 2680)

    • Reads default file associations for system extensions

      • b5TXfJR0JJbfYfpmHjfakXqO.exe (PID: 3716)

    • Uses RUNDLL32.EXE to load library

      • control.exe (PID: 3360)

    • Starts itself from another location

      • GmV0y09dRW8Mj9uNHWVp6uqf.exe (PID: 2588)
      • AppLaunch.exe (PID: 2728)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 2496)
      • cmd.exe (PID: 2356)
      • cmd.exe (PID: 2804)
      • wscript.exe (PID: 2616)
      • cmd.exe (PID: 3492)
      • cmd.exe (PID: 3536)
      • cmd.exe (PID: 420)
      • cmd.exe (PID: 2304)
      • cmd.exe (PID: 3920)

    • Executed via Task Scheduler

      • powershell.EXE (PID: 1964)
      • MdoYYbe.exe (PID: 1696)
      • powershell.EXE (PID: 1548)
      • ncbGeWF.exe (PID: 2680)
      • rundll32.EXE (PID: 1404)

    • PowerShell script executed

      • powershell.EXE (PID: 1964)
      • powershell.EXE (PID: 1548)

    • Reads the date of Windows installation

      • powershell.EXE (PID: 1964)
      • powershell.EXE (PID: 1548)

    • Creates files in the Windows directory

      • schtasks.exe (PID: 3472)
      • cmd.exe (PID: 3836)
      • MdoYYbe.exe (PID: 1696)
      • schtasks.exe (PID: 3004)
      • ncbGeWF.exe (PID: 2680)
      • schtasks.exe (PID: 1652)
      • schtasks.exe (PID: 2008)

    • Starts CMD.EXE for self-deleting

      • 22dzcEZcXjvNqtyA_EL2hG8i.exe (PID: 3888)

    • Executes scripts

      • MdoYYbe.exe (PID: 1696)

    • Removes files from Windows directory

      • MdoYYbe.exe (PID: 1696)

  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 2716)
      • ntvdm.exe (PID: 2648)
      • iexplore.exe (PID: 1948)
      • iexplore.exe (PID: 2316)
      • iexplore.exe (PID: 2672)
      • rundll32.exe (PID: 2160)
      • unlodctr.exe (PID: 3544)
      • taskkill.exe (PID: 3668)
      • schtasks.exe (PID: 2460)
      • schtasks.exe (PID: 3224)
      • control.exe (PID: 3360)
      • rundll32.exe (PID: 2840)
      • forfiles.exe (PID: 2668)
      • reg.exe (PID: 3248)
      • schtasks.exe (PID: 2880)
      • cmd.exe (PID: 2496)
      • forfiles.exe (PID: 2928)
      • reg.exe (PID: 584)
      • cmd.exe (PID: 2356)
      • schtasks.exe (PID: 1532)
      • gpupdate.exe (PID: 2576)
      • schtasks.exe (PID: 2500)
      • schtasks.exe (PID: 3472)
      • timeout.exe (PID: 3712)
      • schtasks.exe (PID: 2948)
      • schtasks.exe (PID: 3696)
      • gpupdate.exe (PID: 3448)
      • schtasks.exe (PID: 1248)
      • reg.exe (PID: 1576)
      • reg.exe (PID: 3124)
      • reg.exe (PID: 3332)
      • reg.exe (PID: 1816)
      • reg.exe (PID: 2476)
      • reg.exe (PID: 3552)
      • reg.exe (PID: 3948)
      • reg.exe (PID: 500)
      • reg.exe (PID: 3436)
      • reg.exe (PID: 420)
      • reg.exe (PID: 464)
      • reg.exe (PID: 4076)
      • reg.exe (PID: 3068)
      • reg.exe (PID: 2468)
      • schtasks.exe (PID: 3004)
      • schtasks.exe (PID: 1080)
      • reg.exe (PID: 1536)
      • reg.exe (PID: 2260)
      • reg.exe (PID: 3824)
      • reg.exe (PID: 4012)
      • schtasks.exe (PID: 3468)
      • reg.exe (PID: 2864)
      • reg.exe (PID: 832)
      • schtasks.exe (PID: 3440)
      • schtasks.exe (PID: 3260)
      • schtasks.exe (PID: 1652)
      • schtasks.exe (PID: 2920)
      • schtasks.exe (PID: 3436)
      • schtasks.exe (PID: 2852)
      • schtasks.exe (PID: 2008)
      • schtasks.exe (PID: 2908)
      • schtasks.exe (PID: 2516)
      • reg.exe (PID: 3988)
      • reg.exe (PID: 2764)
      • schtasks.exe (PID: 2132)
      • schtasks.exe (PID: 2988)
      • schtasks.exe (PID: 3468)
      • rundll32.EXE (PID: 1404)

    • Reads the computer name

      • iexplore.exe (PID: 1948)
      • iexplore.exe (PID: 2716)
      • iexplore.exe (PID: 2316)
      • iexplore.exe (PID: 2672)
      • unlodctr.exe (PID: 3544)
      • taskkill.exe (PID: 3668)
      • schtasks.exe (PID: 2460)
      • schtasks.exe (PID: 3224)
      • control.exe (PID: 3360)
      • schtasks.exe (PID: 2880)
      • schtasks.exe (PID: 1532)
      • gpupdate.exe (PID: 2576)
      • schtasks.exe (PID: 3472)
      • schtasks.exe (PID: 2500)
      • schtasks.exe (PID: 3696)
      • gpupdate.exe (PID: 3448)
      • schtasks.exe (PID: 2948)
      • schtasks.exe (PID: 1248)
      • schtasks.exe (PID: 1080)
      • schtasks.exe (PID: 3004)
      • schtasks.exe (PID: 3468)
      • schtasks.exe (PID: 3440)
      • schtasks.exe (PID: 3260)
      • schtasks.exe (PID: 2516)
      • schtasks.exe (PID: 1652)
      • schtasks.exe (PID: 2908)
      • schtasks.exe (PID: 3436)
      • schtasks.exe (PID: 2920)
      • schtasks.exe (PID: 2852)
      • schtasks.exe (PID: 2008)
      • schtasks.exe (PID: 3468)
      • rundll32.EXE (PID: 1404)
      • schtasks.exe (PID: 2132)
      • schtasks.exe (PID: 2988)

    • Changes internet zones settings

      • iexplore.exe (PID: 2716)

    • Application launched itself

      • iexplore.exe (PID: 2716)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 2316)
      • iexplore.exe (PID: 1948)
      • askinstall49.exe (PID: 2572)
      • iexplore.exe (PID: 2672)
      • iexplore.exe (PID: 2716)
      • File.exe (PID: 3260)
      • unlodctr.exe (PID: 3544)
      • powershell.EXE (PID: 1964)
      • powershell.EXE (PID: 1548)
      • wscript.exe (PID: 2616)
      • ncbGeWF.exe (PID: 2680)

    • Reads settings of System Certificates

      • Folder.exe (PID: 3304)
      • iexplore.exe (PID: 2316)
      • iexplore.exe (PID: 1948)
      • RobCleanerInstl3183813.exe (PID: 2360)
      • askinstall49.exe (PID: 2572)
      • iexplore.exe (PID: 2672)
      • iexplore.exe (PID: 2716)
      • File.exe (PID: 3260)
      • ff369556-e407-4fd9-a0ef-78eb74d88b5a.exe (PID: 3828)
      • aBQzBF38K4aUSFN64wFswO4U.exe (PID: 3396)
      • unlodctr.exe (PID: 3544)
      • AppLaunch.exe (PID: 484)
      • AppLaunch.exe (PID: 3132)
      • AppLaunch.exe (PID: 3608)
      • ncbGeWF.exe (PID: 2680)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2316)
      • iexplore.exe (PID: 2716)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2316)
      • iexplore.exe (PID: 2716)

    • Creates files in the user directory

      • iexplore.exe (PID: 2672)
      • iexplore.exe (PID: 2316)
      • iexplore.exe (PID: 1948)
      • iexplore.exe (PID: 2716)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2672)
      • iexplore.exe (PID: 2316)
      • iexplore.exe (PID: 1948)

    • Dropped object may contain Bitcoin addresses

      • File.exe (PID: 3260)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x1ec40
UninitializedDataSize: -
InitializedDataSize: 143360
CodeSize: 201216
LinkerVersion: 14
PEType: PE32
TimeStamp: 2020:12:01 19:00:55+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 01-Dec-2020 18:00:55
Detected languages:
  • English - United States
  • Process Default Language
Debug artifacts:
  • D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000118

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 01-Dec-2020 18:00:55
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x000310EA
0x00031200
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.70808
.rdata
0x00033000
0x0000A612
0x0000A800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.22174
.data
0x0003E000
0x00023728
0x00001000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.70882
.didat
0x00062000
0x00000188
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.29825
.rsrc
0x00063000
0x00015168
0x00015200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
6.24093
.reloc
0x00079000
0x00002268
0x00002400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.55486

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.25329
1875
Latin 1 / Western European
English - United States
RT_MANIFEST
7
3.1586
482
Latin 1 / Western European
English - United States
RT_STRING
8
3.11685
460
Latin 1 / Western European
English - United States
RT_STRING
9
3.11236
440
Latin 1 / Western European
English - United States
RT_STRING
10
2.99727
326
Latin 1 / Western European
English - United States
RT_STRING
11
3.2036
1094
Latin 1 / Western European
English - United States
RT_STRING
12
3.12889
358
Latin 1 / Western European
English - United States
RT_STRING
13
3.01704
338
Latin 1 / Western European
English - United States
RT_STRING
14
2.94627
266
Latin 1 / Western European
English - United States
RT_STRING
15
2.83619
188
Latin 1 / Western European
English - United States
RT_STRING

Imports

KERNEL32.dll
USER32.dll (delay-loaded)
gdiplus.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
234
Monitored processes
117
Malicious processes
34
Suspicious processes
14

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start download and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start setup_x32_x64.exe no specs setup_x32_x64.exe ntvdm.exe no specs iexplore.exe iexplore.exe proxyupd.exe iexplore.exe folder.exe no specs robcleanerinstl3183813.exe #REDLINE soft.exe folder.exe iexplore.exe askinstall49.exe file.exe ff369556-e407-4fd9-a0ef-78eb74d88b5a.exe rundll32.exe no specs hfrjyncvufwlmzibeojhoixf.exe abqzbf38k4ausfn64wfswo4u.exe #REDLINE hrdzltloh9iv5zttzgqgiel_.exe nuaqfnodvd871khstbjokrhc.exe q0jp28ln5mypelyfnupopz8m.exe no specs qbzctumuihkhbj4qhwhhsrlk.exe unlodctr.exe cmd.exe no specs taskkill.exe no specs _dfkdxzbfnifs4wripxknwck.exe jg1_1faf.exe #RACCOON 22dzcezcxjvnqtya_el2hg8i.exe 2tmnmsvew2bewadnmde1yoiq.exe no specs schtasks.exe no specs schtasks.exe no specs b5txfjr0jjbfyfpmhjfakxqo.exe no specs gmv0y09drw8mj9unhwvp6uqf.exe control.exe no specs rundll32.exe no specs install.exe #REDLINE 03wltgsxxd8w7tnxuestpzuq.exe install.exe forfiles.exe no specs forfiles.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs #REDLINE djov791st40ygjobgjtcxkuo.exe schtasks.exe no specs schtasks.exe no specs powershell.exe no specs #REDLINE _zt_s7l3im8wak8wpzis2nkz.exe cmd.exe no specs gpupdate.exe no specs xuo7kzmzp1a8y5vmxbhkawcb.exe #REDLINE applaunch.exe rcksue5hlizqtijdffdzotvq.exe #REDLINE applaunch.exe udahvyj85yfcmzztqmua7v6m.exe #REDLINE applaunch.exe schtasks.exe no specs schtasks.exe no specs cmd.exe no specs timeout.exe no specs asd.exe applaunch.exe mjlooy.exe no specs mdoyybe.exe schtasks.exe no specs schtasks.exe no specs powershell.exe no specs gpupdate.exe no specs schtasks.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs wscript.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs schtasks.exe no specs schtasks.exe no specs ncbgewf.exe schtasks.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs rundll32.exe cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs schtasks.exe no specs schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
420"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\ZvEHJNdJDJxIeVVB" /t REG_DWORD /d 0C:\Windows\System32\reg.exe—wscript.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
420cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /fC:\Windows\system32\cmd.exe—ncbGeWF.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
464"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\HvrIGoRDYaykjTnO" /t REG_DWORD /d 0C:\Windows\System32\reg.exe—wscript.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
484"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
rCKsue5HLiZQTijDFfdZOtVQ.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET ClickOnce Launch Utility
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
488"C:\Program Files\Company\NewProduct\jg1_1faf.exe" C:\Program Files\Company\NewProduct\jg1_1faf.exe
_DfkDxZBfNifS4WriPXKnwcK.exe
User:
admin
Company:
TODO: <???>
Integrity Level:
HIGH
Description:
FbRobot
Exit code:
0
Version:
1.0.0.1
500"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files\wjTkFrExU" /t REG_DWORD /d 0C:\Windows\System32\reg.exe—wscript.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
504"C:\Proxyupd.exe" C:\Proxyupd.exe
Setup_x32_x64.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
584REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0c:\windows\system32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
832"C:\Users\admin\Pictures\Adobe Films\q0jP28LN5mYpElyFnupoPz8m.exe" C:\Users\admin\Pictures\Adobe Films\q0jP28LN5mYpElyFnupoPz8m.exe—File.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
832REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /fC:\Windows\system32\reg.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Registry Console Tool
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
114
Suspicious files
99
Text files
141
Unknown types
50

Dropped files

PID
Process
Filename
Type
2316iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
2572askinstall49.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_28699ABAC9273C08DCF1E93A8F6BFD1Dder
MD5:—
SHA256:—
2512Setup_x32_x64.exeC:\Uponruner.exehtml
MD5:1BB797B159991465A4CEEF0A13533805
SHA256:0E52663D6A86B622ACAA750C2CC5D7F5F5988DD14B6004B12D3FA71D0377CC8C
2316iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:—
SHA256:—
2572askinstall49.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_28699ABAC9273C08DCF1E93A8F6BFD1Dbinary
MD5:—
SHA256:—
2512Setup_x32_x64.exeC:\RobCleanerInstl3183813.exeexecutable
MD5:3D84583F1C9579C143908CD10995192D
SHA256:6D42D81B33383DEC14C27239B249849101FAF172A6B3BC9C6CB460F299BD5309
2512Setup_x32_x64.exeC:\updl.urlurl
MD5:63ECA19A06A3306A8809412209B18736
SHA256:3B36FB19771EF78578C65167A7718441208E84DDFA8C172A25DC544759B8BB31
2512Setup_x32_x64.exeC:\prxza.urlurl
MD5:3E507ECAAC6710D93C101C67AE45FDAB
SHA256:083F728D22BC6F1ED6BFA9ECAEB68528A9EB433C0E8E67A52426047EC3E41488
2512Setup_x32_x64.exeC:\Folder.exeexecutable
MD5:4538DA85464E576893AEC470FC71229A
SHA256:8AFF0E13328A2129CA13284D80BED1F72100A78A2C4FA696B2AA95A6152F2983
2512Setup_x32_x64.exeC:\ghsd.urlurl
MD5:1A83DE9519636DD32D9BFEBAB86931AE
SHA256:232F93603256C390B8C9447F2CA528BC50B859831189B0EF4E57A2E4B5A79369
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
74
TCP/UDP connections
246
DNS requests
59
Threats
308

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3260
File.exe
GET
400
212.193.30.45:80
http://212.193.30.45/proxies.txt
RU
html
301 b
malicious
3260
File.exe
GET
400
45.144.225.57:80
http://45.144.225.57/server.txt
unknown
html
301 b
malicious
2572
askinstall49.exe
GET
200
93.184.220.29:80
http://statuse.digitalcertvalidation.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJrF0xYA49jC3D83fgDGesaUkzIQQUf9OZ86BHDjEAVlYijrfMnt3KAYoCEAYJR5FkG19ljPHMaGsuvmc%3D
US
der
471 b
whitelisted
3260
File.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
2716
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
3260
File.exe
GET
200
104.21.5.208:80
http://wfsdragon.ru/api/setStats.php
US
text
18 b
malicious
3260
File.exe
POST
200
212.193.30.21:80
http://212.193.30.21/base/api/getData.php
RU
text
108 b
malicious
3260
File.exe
POST
200
212.193.30.21:80
http://212.193.30.21/base/api/getData.php
RU
text
108 b
malicious
2572
askinstall49.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAWAJn8G8pVTNI4cGFpe7i4%3D
US
der
471 b
whitelisted
1948
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2316
iexplore.exe
148.251.234.83:443
iplogger.org
Hetzner Online GmbH
DE
malicious
1948
iexplore.exe
148.251.234.83:443
iplogger.org
Hetzner Online GmbH
DE
malicious
3304
Folder.exe
104.21.27.252:443
gp.gamebuy768.com
Cloudflare Inc
US
unknown
2364
soft.exe
81.177.49.219:80
—
JSC RTComm.RU
RU
malicious
1948
iexplore.exe
67.27.235.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
2360
RobCleanerInstl3183813.exe
67.27.235.254:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
suspicious
2572
askinstall49.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3260
File.exe
212.193.30.45:80
—
—
RU
malicious
2672
iexplore.exe
104.89.32.83:80
x1.c.lencr.org
Akamai Technologies, Inc.
NL
suspicious
1948
iexplore.exe
104.89.32.83:80
x1.c.lencr.org
Akamai Technologies, Inc.
NL
suspicious

DNS requests

Domain
IP
Reputation
iplogger.org
  • 148.251.234.83
shared
gp.gamebuy768.com
  • 104.21.27.252
  • 172.67.143.210
malicious
www.listincode.com
  • 149.28.253.196
whitelisted
ctldl.windowsupdate.com
  • 67.27.235.254
  • 8.248.119.254
  • 8.253.95.121
  • 67.27.233.126
  • 67.26.139.254
whitelisted
dpcapps.me
  • 172.67.177.36
  • 104.21.88.113
malicious
ocsp.digicert.com
  • 93.184.220.29
whitelisted
statuse.digitalcertvalidation.com
  • 93.184.220.29
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
x1.c.lencr.org
  • 104.89.32.83
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted

Threats

PID
Process
Class
Message
3260
File.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
3260
File.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
3260
File.exe
A Network Trojan was detected
ET MALWARE User-Agent (???)
3260
File.exe
Generic Protocol Command Decode
SURICATA Applayer Mismatch protocol both directions
3260
File.exe
A Network Trojan was detected
ET MALWARE User-Agent (???)
3260
File.exe
Generic Protocol Command Decode
SURICATA Applayer Mismatch protocol both directions
3260
File.exe
A Network Trojan was detected
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
3260
File.exe
Potential Corporate Privacy Violation
ET POLICY Possible External IP Lookup SSL Cert Observed (ipinfo.io)
3260
File.exe
A Network Trojan was detected
ET TROJAN Win32/Unk.HRESQ! MultiDownloader Checkin
3260
File.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
209 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Setup_x32_x64.exe