File name:

USBUtil_70014.exe

Full analysis: https://app.any.run/tasks/8f1b5e87-2d40-4c7b-91ad-13f18a390b2e
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: November 17, 2023, 06:52:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

BF063C97747FC43DBD0B74CC540913DE

SHA1:

79D9B261A7074442CE2C9F31E6CA6B0A8001062F

SHA256:

AA49D7526627C77BB9C987717C9E84E41A40D1D9DF73459DAA9D9CF64C538534

SSDEEP:

98304:GgzUiM4mKQTB2xjFwnjZyJzpX5Y1UgyxFZVB37f7PHRRkHBmkShNvZnz5nZ8XbcW:7HOx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • USBUtil_70014.exe (PID: 3468)
      • ContentI3.exe (PID: 4008)
      • pmropn.exe (PID: 4076)

    • Creates a writable file the system directory

      • pmropn.exe (PID: 4076)

  • SUSPICIOUS

    • Reads settings of System Certificates

      • USBUtil_70014.exe (PID: 3468)
      • pmropn.exe (PID: 4076)

    • Checks Windows Trust Settings

      • USBUtil_70014.exe (PID: 3468)
      • pmropn.exe (PID: 4076)

    • Reads the Internet Settings

      • USBUtil_70014.exe (PID: 3468)
      • ContentI3.exe (PID: 4008)
      • pmropn.exe (PID: 4076)

    • Reads security settings of Internet Explorer

      • USBUtil_70014.exe (PID: 3468)
      • pmropn.exe (PID: 4076)

    • Process requests binary or script from the Internet

      • USBUtil_70014.exe (PID: 3468)

    • Searches for installed software

      • pmservice.exe (PID: 3872)
      • pmropn.exe (PID: 4076)
      • ContentI3.exe (PID: 4008)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • pmropn.exe (PID: 4076)

    • Executes as Windows Service

      • pmservice.exe (PID: 3872)

    • Adds/modifies Windows certificates

      • ContentI3.exe (PID: 4008)

  • INFO

    • Checks supported languages

      • ContentI3.exe (PID: 4008)
      • USBUtil_70014.exe (PID: 3468)
      • wmpnscfg.exe (PID: 3944)
      • pmropn.exe (PID: 4076)
      • pmservice.exe (PID: 3872)

    • Reads the computer name

      • ContentI3.exe (PID: 4008)
      • wmpnscfg.exe (PID: 3944)
      • USBUtil_70014.exe (PID: 3468)
      • pmservice.exe (PID: 3872)
      • pmropn.exe (PID: 4076)

    • Checks proxy server information

      • USBUtil_70014.exe (PID: 3468)
      • pmropn.exe (PID: 4076)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3944)

    • Reads the machine GUID from the registry

      • USBUtil_70014.exe (PID: 3468)
      • wmpnscfg.exe (PID: 3944)
      • pmropn.exe (PID: 4076)

    • Creates files or folders in the user directory

      • USBUtil_70014.exe (PID: 3468)
      • ContentI3.exe (PID: 4008)
      • pmropn.exe (PID: 4076)

    • Create files in a temporary directory

      • USBUtil_70014.exe (PID: 3468)
      • ContentI3.exe (PID: 4008)

    • Creates files in the program directory

      • ContentI3.exe (PID: 4008)
      • pmropn.exe (PID: 4076)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:10:25 11:50:50+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.22
CodeSize: 4035584
InitializedDataSize: 1672704
UninitializedDataSize: -
EntryPoint: 0x34f7d0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
7
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start usbutil_70014.exe no specs usbutil_70014.exe wmpnscfg.exe no specs contenti3.exe pmropn.exe netsh.exe no specs pmservice.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3156"C:\Users\admin\Desktop\USBUtil_70014.exe" C:\Users\admin\Desktop\USBUtil_70014.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\usbutil_70014.exe
c:\windows\system32\ntdll.dll
3468"C:\Users\admin\Desktop\USBUtil_70014.exe" C:\Users\admin\Desktop\USBUtil_70014.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\desktop\usbutil_70014.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3944"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
4008"C:\Users\admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe" -c:1538 -t:InstallUnionC:\Users\admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
USBUtil_70014.exe
User:
admin
Company:
VoiceFive Networks, Inc.
Integrity Level:
HIGH
Description:
PremierOpinion Installer
Exit code:
0
Version:
1.0.8.1 (Build 1)
Modules
Images
c:\users\admin\appdata\local\temp\premieropinion\contenti3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wininet.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
4076C:\Program Files\PremierOpinion\pmropn.exe -install -uninst:PremierOpinion -t:InstallUnion -bid:XHwORDcHkWYqIgSB9ZPOPN -o:0C:\Program Files\PremierOpinion\pmropn.exe
ContentI3.exe
User:
admin
Company:
VoiceFive, Inc.
Integrity Level:
HIGH
Description:
PremierOpinion
Exit code:
0
Version:
1.3.338.326 (Build 338.326)
Modules
Images
c:\program files\premieropinion\pmropn.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\wininet.dll
3892netsh firewall add allowedprogram program = "c:\program files\premieropinion\pmropn.exe" name = pmropn.exe mode = ENABLE scope = ALLC:\Windows\System32\netsh.exe—pmropn.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
3872"C:\Program Files\PremierOpinion\pmservice.exe" /serviceC:\Program Files\PremierOpinion\pmservice.exe—services.exe
User:
SYSTEM
Company:
VoiceFive, Inc.
Integrity Level:
SYSTEM
Description:
PremierOpinion
Version:
1.1.24.126 (Build 24.126)
Modules
Images
c:\program files\premieropinion\pmservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\userenv.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\profapi.dll
c:\windows\system32\version.dll
c:\windows\system32\psapi.dll
Total events
11 690
Read events
11 570
Write events
114
Delete events
6

Modification events

(PID) Process:(3468) USBUtil_70014.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3468) USBUtil_70014.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3468) USBUtil_70014.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3468) USBUtil_70014.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000059010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3468) USBUtil_70014.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3468) USBUtil_70014.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3468) USBUtil_70014.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3468) USBUtil_70014.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3468) USBUtil_70014.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3468) USBUtil_70014.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8
Operation:writeName:Blob
Value:
1900000001000000100000002FE1F70BB05D7C92335BC5E05B984DA662000000010000002000000096BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C60B000000010000001A0000004900530052004700200052006F006F007400200058003100000014000000010000001400000079B459E67BB6E5E40173800888C81A58F6E99B6E1D000000010000001000000073B6876195F5D18E048510422AEF04E309000000010000000C000000300A06082B06010505070301030000000100000014000000CABD2A79A1076A31F21D253635CB039D4329A5E80F00000001000000200000003F0411EDE9C4477057D57E57883B1F205B20CDC0F3263129B1EE0269A2678F6320000000010000006F0500003082056B30820353A0030201020211008210CFB0D240E3594463E0BB63828B00300D06092A864886F70D01010B0500304F310B300906035504061302555331293027060355040A1320496E7465726E65742053656375726974792052657365617263682047726F7570311530130603550403130C4953524720526F6F74205831301E170D3135303630343131303433385A170D3335303630343131303433385A304F310B300906035504061302555331293027060355040A1320496E7465726E65742053656375726974792052657365617263682047726F7570311530130603550403130C4953524720526F6F7420583130820222300D06092A864886F70D01010105000382020F003082020A0282020100ADE82473F41437F39B9E2B57281C87BEDCB7DF38908C6E3CE657A078F775C2A2FEF56A6EF6004F28DBDE68866C4493B6B163FD14126BBF1FD2EA319B217ED1333CBA48F5DD79DFB3B8FF12F1219A4BC18A8671694A66666C8F7E3C70BFAD292206F3E4C0E680AEE24B8FB7997E94039FD347977C99482353E838AE4F0A6F832ED149578C8074B6DA2FD0388D7B0370211B75F2303CFA8FAEDDDA63ABEB164FC28E114B7ECF0BE8FFB5772EF4B27B4AE04C12250C708D0329A0E15324EC13D9EE19BF10B34A8C3F89A36151DEAC870794F46371EC2EE26F5B9881E1895C34796C76EF3B906279E6DBA49A2F26C5D010E10EDED9108E16FBB7F7A8F7C7E50207988F360895E7E237960D36759EFB0E72B11D9BBC03F94905D881DD05B42AD641E9AC0176950A0FD8DFD5BD121F352F28176CD298C1A80964776E4737BACEAC595E689D7F72D689C50641293E593EDD26F524C911A75AA34C401F46A199B5A73A516E863B9E7D72A712057859ED3E5178150B038F8DD02F05B23E7B4A1C4B730512FCC6EAE050137C439374B3CA74E78E1F0108D030D45B7136B407BAC130305C48B7823B98A67D608AA2A32982CCBABD83041BA2830341A1D605F11BC2B6F0A87C863B46A8482A88DC769A76BF1F6AA53D198FEB38F364DEC82B0D0A28FFF7DBE21542D422D0275DE179FE18E77088AD4EE6D98B3AC6DD27516EFFBC64F533434F0203010001A3423040300E0603551D0F0101FF040403020106300F0603551D130101FF040530030101FF301D0603551D0E0416041479B459E67BB6E5E40173800888C81A58F6E99B6E300D06092A864886F70D01010B05000382020100551F58A9BCB2A850D00CB1D81A6920272908AC61755C8A6EF882E5692FD5F6564BB9B8731059D321977EE74C71FBB2D260AD39A80BEA17215685F1500E59EBCEE059E9BAC915EF869D8F8480F6E4E99190DC179B621B45F06695D27C6FC2EA3BEF1FCFCBD6AE27F1A9B0C8AEFD7D7E9AFA2204EBFFD97FEA912B22B1170E8FF28A345B58D8FC01C954B9B826CC8A8833894C2D843C82DFEE965705BA2CBBF7C4B7C74E3B82BE31C822737392D1C280A43939103323824C3C9F86B255981DBE29868C229B9EE26B3B573A82704DDC09C789CB0A074D6CE85D8EC9EFCEABC7BBB52B4E45D64AD026CCE572CA086AA595E315A1F7A4EDC92C5FA5FBFFAC28022EBED77BBBE3717B9016D3075E46537C3707428CD3C4969CD599B52AE0951A8048AE4C3907CECC47A452952BBAB8FBADD233537DE51D4D6DD5A1B1C7426FE64027355CA328B7078DE78D3390E7239FFB509C796C46D5B415B3966E7E9B0C963AB8522D3FD65BE1FB08C284FE24A8A389DAAC6AE1182AB1A843615BD31FDC3B8D76F22DE88D75DF17336C3D53FB7BCB415FFFDCA2D06138E196B8AC5D8B37D775D533C09911AE9D41C1727584BE0241425F67244894D19B27BE073FB9B84F817451E17AB7ED9D23E2BEE0D52804133C31039EDD7A6C8FC60718C67FDE478E3F289E0406CFA5543477BDEC899BE91743DF5BDB5FFE8E1E57A2CD409D7E6222DADE1827
Executable files
15
Suspicious files
38
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
3468USBUtil_70014.exeC:\Users\admin\AppData\Local\Temp\Cab9B79.tmpcompressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
3468USBUtil_70014.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
3468USBUtil_70014.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506compressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
3468USBUtil_70014.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751binary
MD5:60FE01DF86BE2E5331B0CDBE86165686
SHA256:C08CCBC876CD5A7CDFA9670F9637DA57F6A1282198A9BC71FC7D7247A6E5B7A8
3468USBUtil_70014.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B8DAA588C6424587A535BD2580EA7BE4_FF7C86319CE5FA89A924F0493C0985D5binary
MD5:1A6F93746475B5978F0B69367B411943
SHA256:46276EFB412E71CC99A37CB1DD51BE4AD5D2D24546026577F4B2D3238A577CBE
3468USBUtil_70014.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EFFA13BBC5E13BFAA85DB9326A6BF150binary
MD5:0895999255245F4E8E6E064F05499643
SHA256:6B27D28D0C4B306FA0821063E34A8EDE41C5B59936D6A3D853022B006F9E19FF
3468USBUtil_70014.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62binary
MD5:41F360F316A36DE1984A4464A008EBA6
SHA256:D45AAF975BC7766A108629416749257F1EEEAD66C9AD442092587191D2314E2F
3468USBUtil_70014.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_45E3C223BCF135987E4038FB6B0DBA13binary
MD5:037AE8164352CA91E80AD33054D1906D
SHA256:07C018EB07002663D5248DAA8A65EAF587955E3DB45735E7E3AC9CB13D7D664E
3468USBUtil_70014.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\usbutil[1].pngimage
MD5:AAF4FD31BA5523186456CB96092CB922
SHA256:5F4031D7B7542FB3F7CA5F5F5BBD7C7F3BE604712630C8CD07240DA220F30111
3468USBUtil_70014.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:2D4662FB68A9CDEAE37BB471222CC6B7
SHA256:B30BCBDC0E39CF32A7B6834FA245AE1D8A55E2F2B817C4ADD00AB17E90F3DBCC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
25
TCP/UDP connections
29
DNS requests
20
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4076
pmropn.exe
HEAD
302
165.193.78.250:80
http://www.premieropinion.com/Privacy.aspx
unknown
—
—
—
3468
USBUtil_70014.exe
GET
200
142.250.186.67:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
—
3468
USBUtil_70014.exe
GET
200
142.250.186.67:80
http://ocsp.pki.goog/s/gts1d4/fBhj9wRXMMA/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSMBFDqU0NJQdZdEGU3bkhj0FoRrQQUJeIYDrJXkZQq5dRdhpCD3lOzuJICEGMmYrCWCX4LCfKe4VeZo4Q%3D
unknown
binary
471 b
—
3468
USBUtil_70014.exe
GET
200
18.245.65.219:80
http://ocsp.r2m01.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBShdVEFnSEQ0gG5CBtzM48cPMe9XwQUgbgOY4qJEhjl%2Bjs7UJWf5uWQE4UCEAwk%2BoWOqEVYRON9KYl3mS4%3D
unknown
binary
471 b
—
3468
USBUtil_70014.exe
POST
200
165.193.78.234:80
http://post.securestudies.com/TapAction.aspx?campaign_id=1538&tpi=InstallUnion&action_id=0
unknown
text
25 b
—
3468
USBUtil_70014.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b54a2c574b0476d0
unknown
compressed
4.66 Kb
—
3468
USBUtil_70014.exe
GET
200
18.66.142.79:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEjgLnWaIozse2b%2BczaaODg8%3D
unknown
binary
1.39 Kb
—
3468
USBUtil_70014.exe
GET
200
184.24.77.54:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgOWTr9peSZYSyu%2BzKUAXJw9lA%3D%3D
unknown
binary
503 b
—
3468
USBUtil_70014.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?29edbe092bc7ecf2
unknown
compressed
61.6 Kb
—
3468
USBUtil_70014.exe
GET
200
142.250.186.67:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIAjrICMzZli2TN25s%3D
unknown
binary
724 b
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3468
USBUtil_70014.exe
35.190.60.70:80
dlsft.com
GOOGLE
US
unknown
2588
svchost.exe
239.255.255.250:1900
—
—
—
unknown
3468
USBUtil_70014.exe
35.190.60.70:443
dlsft.com
GOOGLE
US
unknown
3468
USBUtil_70014.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
unknown
3468
USBUtil_70014.exe
142.250.186.67:80
ocsp.pki.goog
GOOGLE
US
unknown
3468
USBUtil_70014.exe
163.172.67.175:443
img.programas-gratis.net
Online S.a.s.
FR
unknown
3468
USBUtil_70014.exe
23.56.202.135:80
x1.c.lencr.org
AKAMAI-AS
GB
unknown
3468
USBUtil_70014.exe
184.24.77.54:80
r3.o.lencr.org
Akamai International B.V.
DE
unknown
4
System
192.168.100.255:138
—
—
—
unknown
868
svchost.exe
23.35.228.137:80
armmf.adobe.com
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
dlsft.com
  • 35.190.60.70
unknown
ctldl.windowsupdate.com
  • 93.184.221.240
unknown
ocsp.pki.goog
  • 142.250.186.67
unknown
img.programas-gratis.net
  • 163.172.67.175
unknown
x1.c.lencr.org
  • 23.56.202.135
unknown
r3.o.lencr.org
  • 184.24.77.54
  • 184.24.77.48
unknown
post.securestudies.com
  • 165.193.78.234
unknown
dpd.securestudies.com
  • 13.32.121.27
  • 13.32.121.93
  • 13.32.121.51
  • 13.32.121.122
unknown
armmf.adobe.com
  • 23.35.228.137
unknown
o.ss2.us
  • 108.138.2.173
  • 108.138.2.107
  • 108.138.2.195
  • 108.138.2.10
unknown

Threats

PID
Process
Class
Message
—
—
A Network Trojan was detected
ET MALWARE Possible Malicious Macro DL EXE Feb 2016
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
Process
Message
USBUtil_70014.exe
scanning node question /questions/question
USBUtil_70014.exe
scanning node question /questions/question
USBUtil_70014.exe
scanning node question /questions/question
USBUtil_70014.exe
scanning node questions /questions
USBUtil_70014.exe
scanning node question /questions/question
USBUtil_70014.exe
scanning node question /questions/question
USBUtil_70014.exe
scanning node question /questions/question
USBUtil_70014.exe
scanning node question /questions/question
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
USBUtil_70014.exe