File name:

VirusTotal Scanner_64424.exe

Full analysis: https://app.any.run/tasks/7d739af5-6784-4ac6-a3a6-ad20ce0701c6
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: July 01, 2024, 22:27:50
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

BF063C97747FC43DBD0B74CC540913DE

SHA1:

79D9B261A7074442CE2C9F31E6CA6B0A8001062F

SHA256:

AA49D7526627C77BB9C987717C9E84E41A40D1D9DF73459DAA9D9CF64C538534

SSDEEP:

98304:GgzUiM4mKQTB2xjFwnjZyJzpX5Y1UgyxFZVB37f7PHRRkHBmkShNvZnz5nZ8XbcW:7HOx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • VirusTotal Scanner_64424.exe (PID: 876)
      • ContentI3.exe (PID: 4048)
      • pmropn.exe (PID: 2568)

    • Scans artifacts that could help determine the target

      • VirusTotal Scanner_64424.exe (PID: 876)
      • pmropn.exe (PID: 1224)

    • Creates a writable file in the system directory

      • pmropn.exe (PID: 2568)

    • Application was injected by another process

      • svchost.exe (PID: 1312)

    • Runs injected code in another process

      • rundll32.exe (PID: 1388)

    • Change Internet Settings

      • pmropn.exe (PID: 1224)

    • Actions looks like stealing of personal data

      • pmropn.exe (PID: 1224)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • VirusTotal Scanner_64424.exe (PID: 876)
      • ContentI3.exe (PID: 4048)
      • pmropn.exe (PID: 2568)
      • pmropn.exe (PID: 1224)
      • VirusTotal Scanner_64424.exe (PID: 6324)

    • Checks Windows Trust Settings

      • VirusTotal Scanner_64424.exe (PID: 876)
      • pmropn.exe (PID: 2568)
      • pmropn.exe (PID: 1224)
      • VirusTotal Scanner_64424.exe (PID: 6324)

    • Process requests binary or script from the Internet

      • VirusTotal Scanner_64424.exe (PID: 876)

    • Executable content was dropped or overwritten

      • VirusTotal Scanner_64424.exe (PID: 876)
      • ContentI3.exe (PID: 4048)
      • pmropn.exe (PID: 2568)

    • Reads the date of Windows installation

      • VirusTotal Scanner_64424.exe (PID: 876)

    • Potential Corporate Privacy Violation

      • VirusTotal Scanner_64424.exe (PID: 876)

    • Creates a software uninstall entry

      • pmropn.exe (PID: 2568)
      • pmservice.exe (PID: 3168)
      • ContentI3.exe (PID: 4048)
      • pmropn.exe (PID: 1224)

    • Searches for installed software

      • pmropn.exe (PID: 2568)
      • pmservice.exe (PID: 3168)
      • rundll32.exe (PID: 1388)
      • svchost.exe (PID: 1312)
      • reg.exe (PID: 5864)
      • pmropn.exe (PID: 1224)
      • ContentI3.exe (PID: 4048)
      • unsecapp.exe (PID: 6584)
      • pmropn.exe (PID: 2472)
      • VirusTotal Scanner_64424.exe (PID: 6324)
      • pmropn32.exe (PID: 6848)
      • pmropn64.exe (PID: 6860)

    • Uses RUNDLL32.EXE to load library

      • pmservice.exe (PID: 3168)

    • Adds/modifies Windows certificates

      • pmservice.exe (PID: 3168)
      • pmropn.exe (PID: 2568)

    • Executes as Windows Service

      • pmservice.exe (PID: 3168)

    • Starts CMD.EXE for commands execution

      • pmservice.exe (PID: 3168)

    • Reads Microsoft Outlook installation path

      • pmropn.exe (PID: 1224)

    • Reads Internet Explorer settings

      • pmropn.exe (PID: 1224)

  • INFO

    • Checks supported languages

      • VirusTotal Scanner_64424.exe (PID: 876)
      • ContentI3.exe (PID: 4048)
      • pmropn.exe (PID: 2568)
      • pmropn.exe (PID: 1224)
      • pmservice.exe (PID: 3168)
      • pmropn64.exe (PID: 6860)
      • VirusTotal Scanner_64424.exe (PID: 6324)
      • pmropn.exe (PID: 2472)
      • pmropn32.exe (PID: 6848)

    • Reads the computer name

      • VirusTotal Scanner_64424.exe (PID: 876)
      • ContentI3.exe (PID: 4048)
      • pmropn.exe (PID: 2568)
      • pmservice.exe (PID: 3168)
      • pmropn.exe (PID: 1224)
      • VirusTotal Scanner_64424.exe (PID: 6324)

    • Checks proxy server information

      • VirusTotal Scanner_64424.exe (PID: 876)
      • pmropn.exe (PID: 2568)
      • pmropn.exe (PID: 1224)
      • VirusTotal Scanner_64424.exe (PID: 6324)

    • Reads the machine GUID from the registry

      • VirusTotal Scanner_64424.exe (PID: 876)
      • pmropn.exe (PID: 2568)
      • pmservice.exe (PID: 3168)
      • pmropn.exe (PID: 1224)
      • VirusTotal Scanner_64424.exe (PID: 6324)

    • Reads the software policy settings

      • VirusTotal Scanner_64424.exe (PID: 876)
      • pmropn.exe (PID: 2568)
      • pmservice.exe (PID: 3168)
      • pmropn.exe (PID: 1224)
      • VirusTotal Scanner_64424.exe (PID: 6324)

    • Create files in a temporary directory

      • VirusTotal Scanner_64424.exe (PID: 876)
      • ContentI3.exe (PID: 4048)

    • Creates files or folders in the user directory

      • VirusTotal Scanner_64424.exe (PID: 876)
      • ContentI3.exe (PID: 4048)
      • pmropn.exe (PID: 2568)
      • pmropn.exe (PID: 1224)
      • VirusTotal Scanner_64424.exe (PID: 6324)

    • Process checks computer location settings

      • VirusTotal Scanner_64424.exe (PID: 876)

    • Creates files in the program directory

      • ContentI3.exe (PID: 4048)
      • pmropn.exe (PID: 2568)
      • pmservice.exe (PID: 3168)
      • pmropn.exe (PID: 1224)

    • Reads Environment values

      • pmropn.exe (PID: 2568)
      • pmropn.exe (PID: 1224)

    • Reads security settings of Internet Explorer

      • cmd.exe (PID: 6612)
      • cmd.exe (PID: 6592)

    • Disables trace logs

      • pmropn.exe (PID: 1224)

    • Manual execution by a user

      • VirusTotal Scanner_64424.exe (PID: 6324)

    • Process checks Internet Explorer phishing filters

      • pmropn.exe (PID: 1224)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:10:25 09:50:50+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.22
CodeSize: 4035584
InitializedDataSize: 1672704
UninitializedDataSize: -
EntryPoint: 0x34f7d0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
285
Monitored processes
144
Malicious processes
8
Suspicious processes
1

Behavior graph

Click at the process to see the details
start virustotal scanner_64424.exe contenti3.exe pmropn.exe pmservice.exe no specs rundll32.exe no specs reg.exe no specs conhost.exe no specs pmropn.exe rundll32.exe no specs unsecapp.exe no specs cmd.exe no specs cmd.exe no specs pmropn64.exe no specs pmropn32.exe no specs pmropn64.exe no specs pmropn32.exe no specs pmropn32.exe no specs pmropn64.exe no specs checknetisolation.exe no specs conhost.exe no specs pmropn.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs virustotal scanner_64424.exe svchost.exe virustotal scanner_64424.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
240CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.startmenuexperiencehost_cw5n1h2txyewyC:\Windows\SysWOW64\CheckNetIsolation.exe—pmropn.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
AppContainer Network Isolation Diagnostic Tool
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\checknetisolation.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
752CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.windows.peopleexperiencehost_cw5n1h2txyewyC:\Windows\SysWOW64\CheckNetIsolation.exe—pmropn.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
AppContainer Network Isolation Diagnostic Tool
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\checknetisolation.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
876"C:\Users\admin\Downloads\VirusTotal Scanner_64424.exe" C:\Users\admin\Downloads\VirusTotal Scanner_64424.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\downloads\virustotal scanner_64424.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1188\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—CheckNetIsolation.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1224"c:\program files (x86)\premieropinion\pmropn.exe" -bootC:\Program Files (x86)\PremierOpinion\pmropn.exe
pmservice.exe
User:
admin
Company:
VoiceFive, Inc.
Integrity Level:
MEDIUM
Description:
PremierOpinion
Version:
1.3.340.310 (Build 340.310)
Modules
Images
c:\program files (x86)\premieropinion\pmropn.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\rpcrt4.dll
c:\windows\syswow64\setupapi.dll
1312C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s ScheduleC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
1388C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\pmls64.dll,UpdateProcess 1312C:\Windows\System32\rundll32.exe—pmservice.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1412\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—CheckNetIsolation.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1616\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—CheckNetIsolation.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1964CheckNetIsolation.exe LoopbackExempt -a -n=microsoft.xboxgamecallableui_cw5n1h2txyewyC:\Windows\SysWOW64\CheckNetIsolation.exe—pmropn.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
AppContainer Network Isolation Diagnostic Tool
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\checknetisolation.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\sechost.dll
Total events
41 513
Read events
40 967
Write events
319
Delete events
227

Modification events

(PID) Process:(876) VirusTotal Scanner_64424.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(876) VirusTotal Scanner_64424.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(876) VirusTotal Scanner_64424.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(876) VirusTotal Scanner_64424.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(876) VirusTotal Scanner_64424.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(876) VirusTotal Scanner_64424.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(876) VirusTotal Scanner_64424.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1312) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{C2AF3602-9179-4BAE-85B3-74A4EF5CF51F}
Operation:writeName:DynamicInfo
Value:
03000000BDCB09F80A59DA01858646E905CCDA010000000000000000FB7458ED05CCDA01
(PID) Process:(1312) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F93AD50A-2FB2-4A34-88EF-786903C710ED}
Operation:writeName:DynamicInfo
Value:
03000000C09775A51C59DA01E6DC35E905CCDA010000000005400080D00F45F005CCDA01
(PID) Process:(1312) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\WindowsUpdate\RUXIM
Operation:writeName:SD
Value:
0100049C5C000000680000000000000014000000020048000300000000001400FF011F0001010000000000051200000000001400A900120001010000000000051300000000001800A900120001020000000000052000000020020000010100000000000512000000010100000000000512000000
Executable files
18
Suspicious files
34
Text files
61
Unknown types
1

Dropped files

PID
Process
Filename
Type
876VirusTotal Scanner_64424.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAder
MD5:1BB4CD492AF5181B3A13C398D41A5B26
SHA256:11F339BAD17E3CE7E2E5C5DCFED0F5F8ACB33A00B7BC3C7C51D961C358172E5F
876VirusTotal Scanner_64424.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199der
MD5:8D1040B12A663CA4EC7277CFC1CE44F0
SHA256:3086094D4198A5BBD12938B0D2D5F696C4DFC77E1EAE820ADDED346A59AA8727
876VirusTotal Scanner_64424.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\20741E915A2928FE6ADFA400761BAF2Eder
MD5:A2739505677334A77D3CFE249EF8DA93
SHA256:7DA79E71753043BD0413B1612469343D565D71C1D4B38643E81D4A7FA53253B1
4048ContentI3.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\pmf[1].bin —
MD5:—
SHA256:—
4048ContentI3.exeC:\Users\admin\AppData\Local\Temp\osi7C41.tmp —
MD5:—
SHA256:—
876VirusTotal Scanner_64424.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\39774D39DB684776460CFFC16FD8F94C_F3F6617D6C5F7BF44D149BCC4E3E74DCbinary
MD5:8AEE8447CF94B67C139C67EBBF605455
SHA256:8F81EC0574F8A3F8BA13227813F1AA197CC38710BEEB0978101374E5A7B4A694
876VirusTotal Scanner_64424.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\39774D39DB684776460CFFC16FD8F94C_F3F6617D6C5F7BF44D149BCC4E3E74DCder
MD5:9BF6523596663F8641CD6FE22A9BEDAA
SHA256:64A84936BE13DFDFD97DAB95C39927F86EBD78806BE7A20F6F552EDDB3EF5D98
876VirusTotal Scanner_64424.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\dpdv2[1].htmtext
MD5:8C5C139E63C41C8C1E17D287EFCC1845
SHA256:20A08F392D52327F504BB5100E5DDAE0076F643F2C2856766A753997168F1E3C
876VirusTotal Scanner_64424.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\ContentI3[1].exeexecutable
MD5:BF6EED6CDC17A0130189A33A55EF5209
SHA256:EF2734657B11113A433ABB7EBAC962E2BF6BF685F05C5F672997F01875430168
1312svchost.exeC:\WINDOWS\System32\Tasks\Microsoft\Windows\WindowsUpdate\RUXIM\PLUGSchedulerxml
MD5:1E0FD17505DF7FDD52708C59FCD5284C
SHA256:B374CE865F05A467798DE01B77F9AEEA861325CF274390D4C06753E77CDA564D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
31
TCP/UDP connections
137
DNS requests
40
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1544
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
unknown
876
VirusTotal Scanner_64424.exe
POST
404
35.190.60.70:80
http://dlsft.com/callback/geo/
unknown
—
—
unknown
876
VirusTotal Scanner_64424.exe
GET
200
142.250.184.195:80
http://c.pki.goog/r/r1.crl
unknown
—
—
unknown
876
VirusTotal Scanner_64424.exe
GET
200
142.250.184.195:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
—
—
unknown
876
VirusTotal Scanner_64424.exe
GET
200
142.250.184.195:80
http://o.pki.goog/s/wr3/Ejg/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQSq0i5t2Pafi2Gw9uzwnc7KTctWgQUx4H1%2FY6I2QA8TWOiUDEkoM4j%2FiMCEBI4qTOVTc2JEgKif2Kp%2FCw%3D
unknown
—
—
unknown
876
VirusTotal Scanner_64424.exe
GET
200
184.24.77.79:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgPb%2BLNzvAydKoC%2BjCc0xnmJag%3D%3D
unknown
—
—
unknown
876
VirusTotal Scanner_64424.exe
GET
200
18.245.39.64:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEkpLy9ROx7U76vGUhC06D6E%3D
unknown
—
—
unknown
876
VirusTotal Scanner_64424.exe
POST
200
165.193.78.234:80
http://post.securestudies.com/TapAction.aspx?campaign_id=1538&tpi=InstallUnion&action_id=0
unknown
—
—
unknown
3040
OfficeClickToRun.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
unknown
876
VirusTotal Scanner_64424.exe
POST
200
165.193.78.234:80
http://post.securestudies.com/TapAction.aspx?campaign_id=1538&tpi=InstallUnion&action_id=17&uid=gFsYAdpnkgEULobp655555
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5636
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2848
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2204
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4032
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
876
VirusTotal Scanner_64424.exe
35.190.60.70:80
dlsft.com
GOOGLE
US
whitelisted
876
VirusTotal Scanner_64424.exe
35.190.60.70:443
dlsft.com
GOOGLE
US
whitelisted
1544
svchost.exe
20.190.160.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
1544
svchost.exe
192.229.221.95:80
—
EDGECAST
US
whitelisted
876
VirusTotal Scanner_64424.exe
142.250.184.195:80
ocsp.pki.goog
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
dlsft.com
  • 35.190.60.70
unknown
login.live.com
  • 20.190.160.14
  • 40.126.32.134
  • 40.126.32.68
  • 40.126.32.136
  • 40.126.32.74
  • 40.126.32.140
  • 40.126.32.138
  • 40.126.32.76
whitelisted
ocsp.pki.goog
  • 142.250.184.195
whitelisted
c.pki.goog
  • 142.250.184.195
unknown
o.pki.goog
  • 142.250.184.195
unknown
img.programas-gratis.net
  • 163.172.70.17
unknown
r3.o.lencr.org
  • 184.24.77.79
  • 184.24.77.62
shared
r.bing.com
  • 104.126.37.131
  • 104.126.37.145
  • 104.126.37.168
  • 104.126.37.160
  • 104.126.37.153
  • 104.126.37.154
  • 104.126.37.155
  • 104.126.37.144
  • 104.126.37.161
whitelisted
go.microsoft.com
  • 184.30.17.189
whitelisted
self.events.data.microsoft.com
  • 20.189.173.27
whitelisted

Threats

PID
Process
Class
Message
876
VirusTotal Scanner_64424.exe
A Network Trojan was detected
ET MALWARE Possible Malicious Macro DL EXE Feb 2016
876
VirusTotal Scanner_64424.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
Process
Message
VirusTotal Scanner_64424.exe
scanning node questions /questions
VirusTotal Scanner_64424.exe
scanning node question /questions/question
VirusTotal Scanner_64424.exe
scanning node question /questions/question
VirusTotal Scanner_64424.exe
scanning node question /questions/question
VirusTotal Scanner_64424.exe
scanning node question /questions/question
VirusTotal Scanner_64424.exe
scanning node question /questions/question
VirusTotal Scanner_64424.exe
scanning node question /questions/question
VirusTotal Scanner_64424.exe
scanning node question /questions/question
VirusTotal Scanner_64424.exe
scanning node question /questions/question
VirusTotal Scanner_64424.exe
scanning node question /questions/question
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
VirusTotal Scanner_64424.exe