File name:

oculus.exe

Full analysis: https://app.any.run/tasks/7dd1b538-77db-4fcb-86ce-0148c7942bb1
Verdict: Malicious activity
Analysis date: July 11, 2024, 20:01:37
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

FDBCB6A25136C9CBC24D159E863BAE13

SHA1:

A8D379375EC516EDC86951A20B89D82155B12713

SHA256:

A4A31D6D1AF581F983398DB33BBC0FDFE3B321EF45A9E7658306E0459C59D24D

SSDEEP:

98304:scyZDo3oAhWqs0nkLn54RBm7tVnytHB1V14eaDn3q1CPwDv3uF/XWDS5mwIoQuc5:j1CPwDv3uF/X0

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • oculus.exe (PID: 2416)
      • OculusSetup.exe (PID: 3668)
      • avira_en_sptl1_675585946-1720726949-1720726948-1__phpws-spotlight-release.exe (PID: 6760)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 6788)
      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 7068)
      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 6704)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 3396)

    • Uses Task Scheduler to run other applications

      • avira_en_sptl1_675585946-1720726949-1720726948-1__phpws-spotlight-release.exe (PID: 6760)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • oculus.exe (PID: 2416)
      • OculusSetup.exe (PID: 3668)
      • avira_en_sptl1_675585946-1720726949-1720726948-1__phpws-spotlight-release.exe (PID: 6760)
      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 7068)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 6788)
      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 6704)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 3396)

    • Reads the Windows owner or organization settings

      • OculusSetup.exe (PID: 3668)

    • Reads security settings of Internet Explorer

      • OculusSetup.exe (PID: 3668)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 6788)
      • ShellExperienceHost.exe (PID: 6364)
      • MicrosoftEdgeUpdate.exe (PID: 1228)
      • MicrosoftEdgeUpdate.exe (PID: 6812)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 3396)

    • The process creates files with name similar to system file names

      • avira_en_sptl1_675585946-1720726949-1720726948-1__phpws-spotlight-release.exe (PID: 6760)
      • avira_en_sptl1_675585946-1720726949-1720726948-1__phpws-spotlight-release.exe (PID: 4796)

    • Searches for installed software

      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 6788)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 3396)

    • Checks Windows Trust Settings

      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 6788)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 3396)

    • The process verifies whether the antivirus software is installed

      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 6788)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 3396)

    • Starts a Microsoft application from unusual location

      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 7068)
      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 6704)
      • MicrosoftEdgeUpdate.exe (PID: 1228)
      • MicrosoftEdgeUpdate.exe (PID: 6812)

    • Process drops legitimate windows executable

      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 7068)
      • MicrosoftEdgeUpdate.exe (PID: 1228)
      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 6704)
      • MicrosoftEdgeUpdate.exe (PID: 6812)

    • Adds/modifies Windows certificates

      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 6788)

    • Disables SEHOP

      • MicrosoftEdgeUpdate.exe (PID: 1228)
      • MicrosoftEdgeUpdate.exe (PID: 6812)

    • Reads the date of Windows installation

      • MicrosoftEdgeUpdate.exe (PID: 1228)
      • MicrosoftEdgeUpdate.exe (PID: 6812)

    • Creates a software uninstall entry

      • MicrosoftEdgeUpdate.exe (PID: 1228)
      • MicrosoftEdgeUpdate.exe (PID: 6812)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 3396)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 3128)

  • INFO

    • Create files in a temporary directory

      • oculus.exe (PID: 2416)
      • OculusSetup.exe (PID: 3668)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 6788)
      • avira_en_sptl1_675585946-1720726949-1720726948-1__phpws-spotlight-release.exe (PID: 6760)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 3396)
      • avira_en_sptl1_675585946-1720726949-1720726948-1__phpws-spotlight-release.exe (PID: 4796)

    • Reads the computer name

      • oculus.exe (PID: 2416)
      • OculusSetup.exe (PID: 3668)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 6788)
      • ShellExperienceHost.exe (PID: 6364)
      • MicrosoftEdgeUpdate.exe (PID: 1228)
      • MicrosoftEdgeUpdate.exe (PID: 6812)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.REPORTINGTOOL.EXE (PID: 6644)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 3396)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.REPORTINGTOOL.EXE (PID: 6432)

    • Checks supported languages

      • oculus.exe (PID: 2416)
      • OculusSetup.exe (PID: 3668)
      • avira_en_sptl1_675585946-1720726949-1720726948-1__phpws-spotlight-release.exe (PID: 6760)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 6788)
      • ShellExperienceHost.exe (PID: 6364)
      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 7068)
      • ACSSIGNEDIC.EXE (PID: 6928)
      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 6704)
      • MicrosoftEdgeUpdate.exe (PID: 1228)
      • MicrosoftEdgeUpdate.exe (PID: 6812)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.REPORTINGTOOL.EXE (PID: 6644)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 3396)
      • avira_en_sptl1_675585946-1720726949-1720726948-1__phpws-spotlight-release.exe (PID: 4796)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.REPORTINGTOOL.EXE (PID: 6432)
      • ACSSIGNEDIC.EXE (PID: 2064)

    • Creates files or folders in the user directory

      • OculusSetup.exe (PID: 3668)

    • Reads the machine GUID from the registry

      • OculusSetup.exe (PID: 3668)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 6788)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 3396)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.REPORTINGTOOL.EXE (PID: 6644)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.REPORTINGTOOL.EXE (PID: 6432)

    • Reads Environment values

      • OculusSetup.exe (PID: 3668)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 6788)
      • MicrosoftEdgeUpdate.exe (PID: 1228)
      • MicrosoftEdgeUpdate.exe (PID: 6812)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.REPORTINGTOOL.EXE (PID: 6644)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 3396)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.REPORTINGTOOL.EXE (PID: 6432)

    • Disables trace logs

      • OculusSetup.exe (PID: 3668)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 6788)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 3396)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.REPORTINGTOOL.EXE (PID: 6432)

    • Checks proxy server information

      • OculusSetup.exe (PID: 3668)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 6788)
      • MicrosoftEdgeUpdate.exe (PID: 1228)
      • wermgr.exe (PID: 5980)
      • MicrosoftEdgeUpdate.exe (PID: 6812)
      • wermgr.exe (PID: 6732)
      • slui.exe (PID: 2808)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 3396)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.REPORTINGTOOL.EXE (PID: 6432)

    • Reads CPU info

      • OculusSetup.exe (PID: 3668)

    • Reads the software policy settings

      • OculusSetup.exe (PID: 3668)
      • slui.exe (PID: 6612)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 6788)
      • MicrosoftEdgeUpdate.exe (PID: 1228)
      • wermgr.exe (PID: 5980)
      • wermgr.exe (PID: 6732)
      • MicrosoftEdgeUpdate.exe (PID: 6812)
      • slui.exe (PID: 2808)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 3396)

    • Reads product name

      • OculusSetup.exe (PID: 3668)

    • Manual execution by a user

      • avira_en_sptl1_675585946-1720726949-1720726948-1__phpws-spotlight-release.exe (PID: 6760)

    • Creates files in the program directory

      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 6788)
      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 7068)
      • MicrosoftEdgeWebView2RuntimeInstallerX64.exe (PID: 6704)
      • AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE (PID: 3396)

    • Process checks computer location settings

      • MicrosoftEdgeUpdate.exe (PID: 1228)
      • MicrosoftEdgeUpdate.exe (PID: 6812)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:05:01 21:19:10+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 57344
InitializedDataSize: 4702720
UninitializedDataSize: -
EntryPoint: 0x2a6c
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.97.0.0
ProductVersionNumber: 1.97.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Facebook Technologies, LLC
FileDescription: Oculus Setup
FileVersion: 1.97.0.0
InternalName: OculusSetup.exe
LegalCopyright: Copyright © Facebook Technologies, LLC
OriginalFileName: OculusSetup.exe
ProductName: Oculus Setup
ProductVersion: 1.97.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
177
Monitored processes
27
Malicious processes
10
Suspicious processes
0

Behavior graph

Click at the process to see the details
start oculus.exe oculussetup.exe avira_en_sptl1_675585946-1720726949-1720726948-1__phpws-spotlight-release.exe avira.spotlight.bootstrapper.exe schtasks.exe no specs conhost.exe no specs acssignedic.exe no specs sppextcomobj.exe no specs slui.exe shellexperiencehost.exe no specs slui.exe microsoftedgewebview2runtimeinstallerx64.exe microsoftedgeupdate.exe wermgr.exe microsoftedgewebview2runtimeinstallerx64.exe microsoftedgeupdate.exe wermgr.exe avira.spotlight.bootstrapper.reportingtool.exe no specs avira_en_sptl1_675585946-1720726949-1720726948-1__phpws-spotlight-release.exe no specs conhost.exe no specs avira.spotlight.bootstrapper.exe acssignedic.exe no specs schtasks.exe no specs conhost.exe no specs avira.spotlight.bootstrapper.reportingtool.exe no specs conhost.exe no specs oculus.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
452\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1228"C:\Program Files (x86)\Microsoft\Temp\EU3801.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20WebView2%20Runtime&needsadmin=Prefers"C:\Program Files (x86)\Microsoft\Temp\EU3801.tmp\MicrosoftEdgeUpdate.exe
MicrosoftEdgeWebView2RuntimeInstallerX64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge Update
Exit code:
2147747592
Version:
1.3.187.41
Modules
Images
c:\program files (x86)\microsoft\temp\eu3801.tmp\microsoftedgeupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
2064"C:\Users\admin\AppData\Local\Temp\.CR.20942\1a623b46-bf17-4eb0-8e5b-5bfb789b5e0d\.CR.14135\ACSSignedIC.exe"C:\Users\admin\AppData\Local\Temp\.CR.20942\1a623b46-bf17-4eb0-8e5b-5bfb789b5e0d\.CR.14135\ACSSIGNEDIC.EXE—AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE
User:
admin
Company:
Avira Operations GmbH
Integrity Level:
HIGH
Description:
ASCSigned
Exit code:
0
Version:
255.255.255.255
Modules
Images
c:\users\admin\appdata\local\temp\.cr.20942\1a623b46-bf17-4eb0-8e5b-5bfb789b5e0d\.cr.14135\acssignedic.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\kernel.appcore.dll
2416"C:\Users\admin\Desktop\oculus.exe" C:\Users\admin\Desktop\oculus.exe
explorer.exe
User:
admin
Company:
Facebook Technologies, LLC
Integrity Level:
HIGH
Description:
Oculus Setup
Exit code:
1
Version:
1.97.0.0
Modules
Images
c:\users\admin\desktop\oculus.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2472C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
2808C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
3128"C:\WINDOWS\system32\schtasks.exe" /Delete /F /TN "Avira_Security_Installation"C:\Windows\SysWOW64\schtasks.exe—avira_en_sptl1_675585946-1720726949-1720726948-1__phpws-spotlight-release.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3396"C:\Users\admin\AppData\Local\Temp\.CR.20942\1a623b46-bf17-4eb0-8e5b-5bfb789b5e0d\.CR.14135\Avira.Spotlight.Bootstrapper.exe" "C:\Users\admin\AppData\Local\Temp\.CR.20942\1a623b46-bf17-4eb0-8e5b-5bfb789b5e0d\.CR.14135\Avira.Spotlight.Bootstrapper.exe" OriginalFileName=avira_en_sptl1_675585946-1720726949-1720726948-1__phpws-spotlight-release.exe Action=RegisterFallbackUpdater AllowMultipleInstances=true C:\Users\admin\AppData\Local\Temp\.CR.20942\1a623b46-bf17-4eb0-8e5b-5bfb789b5e0d\.CR.14135\AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXE
avira_en_sptl1_675585946-1720726949-1720726948-1__phpws-spotlight-release.exe
User:
admin
Company:
Avira Operations GmbH
Integrity Level:
HIGH
Description:
Avira Security
Exit code:
0
Version:
1.0.49.727
Modules
Images
c:\users\admin\appdata\local\temp\.cr.20942\1a623b46-bf17-4eb0-8e5b-5bfb789b5e0d\.cr.14135\avira.spotlight.bootstrapper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
3668C:\Users\admin\AppData\Local\Temp\\OculusSetup-c7f30283-a675-42e1-886d-cd686f397b11\OculusSetup.exe --setupPath "C:\Users\admin\Desktop\oculus.exe"C:\Users\admin\AppData\Local\Temp\OculusSetup-c7f30283-a675-42e1-886d-cd686f397b11\OculusSetup.exe
oculus.exe
User:
admin
Company:
Facebook Technologies, LLC
Integrity Level:
HIGH
Description:
Oculus Setup
Exit code:
1
Version:
1.97.0.0
Modules
Images
c:\users\admin\appdata\local\temp\oculussetup-c7f30283-a675-42e1-886d-cd686f397b11\oculussetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
4180"C:\Users\admin\Desktop\oculus.exe" C:\Users\admin\Desktop\oculus.exe—explorer.exe
User:
admin
Company:
Facebook Technologies, LLC
Integrity Level:
MEDIUM
Description:
Oculus Setup
Exit code:
3221226540
Version:
1.97.0.0
Modules
Images
c:\users\admin\desktop\oculus.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
84 546
Read events
83 466
Write events
1 044
Delete events
36

Modification events

(PID) Process:(3668) OculusSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3668) OculusSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\OculusSetup_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3668) OculusSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\OculusSetup_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(3668) OculusSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\OculusSetup_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3668) OculusSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\OculusSetup_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(3668) OculusSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\OculusSetup_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(3668) OculusSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\OculusSetup_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3668) OculusSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\OculusSetup_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3668) OculusSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\OculusSetup_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3668) OculusSetup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\OculusSetup_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
314
Suspicious files
3
Text files
17
Unknown types
2

Dropped files

PID
Process
Filename
Type
6788AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXEC:\Users\admin\AppData\Local\Temp\.CR.20942\289ceed2-db77-40f7-b8bb-7977282262bb\b2848fba-66a2-4a49-ad6f-b4a15c165b91.tmp —
MD5:—
SHA256:—
6788AVIRA.SPOTLIGHT.BOOTSTRAPPER.EXEC:\Users\admin\AppData\Local\Temp\.CR.20942\289ceed2-db77-40f7-b8bb-7977282262bb\MicrosoftEdgeWebView2RuntimeInstallerX64.exe —
MD5:—
SHA256:—
2416oculus.exeC:\Users\admin\AppData\Local\Temp\OculusSetup-c7f30283-a675-42e1-886d-cd686f397b11\OculusSetup.exeexecutable
MD5:42AFEB7C2C6204BB372ABF8899A8FF5C
SHA256:3DBC59CCED7356559DAB60D9072648A012FF25C01EDC1B9D655705B2973AE004
3668OculusSetup.exeC:\Users\admin\AppData\Local\Temp\OculusSetup-e07441b6-7294-44fa-be36-c41e9ba33024\libcrypto.dllexecutable
MD5:5E346D3611A909C930C81A1B852C7D17
SHA256:AD2698AA52E4ECFDE9FAAE4793E871E9DB4C4D5C927B0AC44FF2067A2EA491E1
3668OculusSetup.exeC:\Users\admin\AppData\Local\Oculus\OculusSetup.logtext
MD5:04DB431FB5EB32FF2A0C263B28424465
SHA256:B1B8A55EE68E78F97FCD4A2A7E78828C16FF86199809323B046A2D4CF3E96E39
3668OculusSetup.exeC:\Users\admin\AppData\Local\Temp\OculusSetup-e07441b6-7294-44fa-be36-c41e9ba33024\DaybreakNative.dllexecutable
MD5:D7219F79F4E7CDE626B56E8B5F5092EB
SHA256:68600D7F1F63C212085743D2842D59BF9E8BDD0B88ADF393F6DF7726501306BE
7068MicrosoftEdgeWebView2RuntimeInstallerX64.exeC:\Program Files (x86)\Microsoft\Temp\EU3801.tmp\MicrosoftEdgeUpdateBroker.exeexecutable
MD5:7B9B54420237168F4FBDDDF7808890A1
SHA256:9FE5381D8CC3F3942CCAAB40435F41DAFA51E98F741461E7EC21A06EC33E7B1F
7068MicrosoftEdgeWebView2RuntimeInstallerX64.exeC:\Program Files (x86)\Microsoft\Temp\EU3801.tmp\msedgeupdate.dllexecutable
MD5:1125E435063E7C722C0079FDF0A5B751
SHA256:7D8D1756343598BC651D62A0E81835820E0D6CF7A995503BB6B129B4BCC37DF4
7068MicrosoftEdgeWebView2RuntimeInstallerX64.exeC:\Program Files (x86)\Microsoft\Temp\EU3801.tmp\MicrosoftEdgeUpdate.exeexecutable
MD5:E3F7C1C2E2013558284331586BA2BBB2
SHA256:D19616AC12D3D536C8FBF034513A4977C88EF2D1676D358A2358FA051C8A42BA
6760avira_en_sptl1_675585946-1720726949-1720726948-1__phpws-spotlight-release.exeC:\Users\admin\AppData\Local\Temp\.CR.26477\Avira_Security_Installation.xmlxml
MD5:FB043A5187139008C1726D14B60010F6
SHA256:6647A4A561C33D50975B785A8020B1C502CC3650B1A1DF8EC524463575F77EF1
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
92
DNS requests
46
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2056
svchost.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2056
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4656
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6604
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6604
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3716
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3972
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
436
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
3040
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5980
wermgr.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
900
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2056
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2476
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3668
OculusSetup.exe
157.240.0.128:443
graph.oculus.com
FACEBOOK
US
unknown
2056
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2056
svchost.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
unknown
2056
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 51.124.78.146
  • 40.127.240.158
whitelisted
google.com
  • 216.58.206.78
whitelisted
graph.oculus.com
  • 157.240.0.128
whitelisted
securecdn.oculus.com
  • 157.240.0.128
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
  • 23.48.23.143
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 23.35.229.160
whitelisted
graph.facebook.com
  • 157.240.0.13
whitelisted
www.bing.com
  • 92.123.104.22
  • 92.123.104.34
  • 92.123.104.21
  • 92.123.104.30
  • 92.123.104.23
  • 92.123.104.32
  • 92.123.104.31
  • 92.123.104.26
  • 92.123.104.18
whitelisted
login.live.com
  • 40.126.31.73
  • 20.190.159.71
  • 20.190.159.64
  • 40.126.31.69
  • 40.126.31.71
  • 20.190.159.0
  • 20.190.159.2
  • 20.190.159.23
  • 20.190.160.14
  • 20.190.160.22
  • 40.126.32.74
  • 40.126.32.134
  • 40.126.32.140
  • 20.190.160.17
  • 20.190.160.20
  • 40.126.32.136
  • 40.126.32.138
  • 40.126.32.72
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
oculus.exe