File name:

USBUtil_70014.exe

Full analysis: https://app.any.run/tasks/8f1b5e87-2d40-4c7b-91ad-13f18a390b2e
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: November 17, 2023, 06:52:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

BF063C97747FC43DBD0B74CC540913DE

SHA1:

79D9B261A7074442CE2C9F31E6CA6B0A8001062F

SHA256:

AA49D7526627C77BB9C987717C9E84E41A40D1D9DF73459DAA9D9CF64C538534

SSDEEP:

98304:GgzUiM4mKQTB2xjFwnjZyJzpX5Y1UgyxFZVB37f7PHRRkHBmkShNvZnz5nZ8XbcW:7HOx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • USBUtil_70014.exe (PID: 3468)
      • ContentI3.exe (PID: 4008)
      • pmropn.exe (PID: 4076)

    • Creates a writable file the system directory

      • pmropn.exe (PID: 4076)

  • SUSPICIOUS

    • Reads the Internet Settings

      • USBUtil_70014.exe (PID: 3468)
      • ContentI3.exe (PID: 4008)
      • pmropn.exe (PID: 4076)

    • Reads security settings of Internet Explorer

      • USBUtil_70014.exe (PID: 3468)
      • pmropn.exe (PID: 4076)

    • Reads settings of System Certificates

      • USBUtil_70014.exe (PID: 3468)
      • pmropn.exe (PID: 4076)

    • Checks Windows Trust Settings

      • USBUtil_70014.exe (PID: 3468)
      • pmropn.exe (PID: 4076)

    • Process requests binary or script from the Internet

      • USBUtil_70014.exe (PID: 3468)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • pmropn.exe (PID: 4076)

    • Searches for installed software

      • pmropn.exe (PID: 4076)
      • pmservice.exe (PID: 3872)
      • ContentI3.exe (PID: 4008)

    • Executes as Windows Service

      • pmservice.exe (PID: 3872)

    • Adds/modifies Windows certificates

      • ContentI3.exe (PID: 4008)

  • INFO

    • Checks supported languages

      • USBUtil_70014.exe (PID: 3468)
      • wmpnscfg.exe (PID: 3944)
      • ContentI3.exe (PID: 4008)
      • pmropn.exe (PID: 4076)
      • pmservice.exe (PID: 3872)

    • Reads the computer name

      • USBUtil_70014.exe (PID: 3468)
      • wmpnscfg.exe (PID: 3944)
      • ContentI3.exe (PID: 4008)
      • pmropn.exe (PID: 4076)
      • pmservice.exe (PID: 3872)

    • Checks proxy server information

      • USBUtil_70014.exe (PID: 3468)
      • pmropn.exe (PID: 4076)

    • Reads the machine GUID from the registry

      • USBUtil_70014.exe (PID: 3468)
      • wmpnscfg.exe (PID: 3944)
      • pmropn.exe (PID: 4076)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3944)

    • Creates files or folders in the user directory

      • USBUtil_70014.exe (PID: 3468)
      • ContentI3.exe (PID: 4008)
      • pmropn.exe (PID: 4076)

    • Create files in a temporary directory

      • USBUtil_70014.exe (PID: 3468)
      • ContentI3.exe (PID: 4008)

    • Creates files in the program directory

      • ContentI3.exe (PID: 4008)
      • pmropn.exe (PID: 4076)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:10:25 11:50:50+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.22
CodeSize: 4035584
InitializedDataSize: 1672704
UninitializedDataSize: -
EntryPoint: 0x34f7d0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
49
Monitored processes
7
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start usbutil_70014.exe wmpnscfg.exe no specs contenti3.exe pmropn.exe netsh.exe no specs pmservice.exe no specs usbutil_70014.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3156"C:\Users\admin\Desktop\USBUtil_70014.exe" C:\Users\admin\Desktop\USBUtil_70014.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\usbutil_70014.exe
c:\windows\system32\ntdll.dll
3468"C:\Users\admin\Desktop\USBUtil_70014.exe" C:\Users\admin\Desktop\USBUtil_70014.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\usbutil_70014.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
3872"C:\Program Files\PremierOpinion\pmservice.exe" /serviceC:\Program Files\PremierOpinion\pmservice.exe—services.exe
User:
SYSTEM
Company:
VoiceFive, Inc.
Integrity Level:
SYSTEM
Description:
PremierOpinion
Exit code:
0
Version:
1.1.24.126 (Build 24.126)
Modules
Images
c:\program files\premieropinion\pmservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\userenv.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\profapi.dll
c:\windows\system32\version.dll
c:\windows\system32\psapi.dll
3892netsh firewall add allowedprogram program = "c:\program files\premieropinion\pmropn.exe" name = pmropn.exe mode = ENABLE scope = ALLC:\Windows\System32\netsh.exe—pmropn.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
3944"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
4008"C:\Users\admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe" -c:1538 -t:InstallUnionC:\Users\admin\AppData\Local\Temp\PremierOpinion\ContentI3.exe
USBUtil_70014.exe
User:
admin
Company:
VoiceFive Networks, Inc.
Integrity Level:
HIGH
Description:
PremierOpinion Installer
Exit code:
0
Version:
1.0.8.1 (Build 1)
Modules
Images
c:\users\admin\appdata\local\temp\premieropinion\contenti3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\wininet.dll
c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
4076C:\Program Files\PremierOpinion\pmropn.exe -install -uninst:PremierOpinion -t:InstallUnion -bid:XHwORDcHkWYqIgSB9ZPOPN -o:0C:\Program Files\PremierOpinion\pmropn.exe
ContentI3.exe
User:
admin
Company:
VoiceFive, Inc.
Integrity Level:
HIGH
Description:
PremierOpinion
Exit code:
0
Version:
1.3.338.326 (Build 338.326)
Modules
Images
c:\program files\premieropinion\pmropn.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\wininet.dll
Total events
11 690
Read events
11 570
Write events
114
Delete events
6

Modification events

(PID) Process:(3468) USBUtil_70014.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3468) USBUtil_70014.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3468) USBUtil_70014.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3468) USBUtil_70014.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000059010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3468) USBUtil_70014.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3468) USBUtil_70014.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3468) USBUtil_70014.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3468) USBUtil_70014.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3468) USBUtil_70014.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3468) USBUtil_70014.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8
Operation:writeName:Blob
Value:
1900000001000000100000002FE1F70BB05D7C92335BC5E05B984DA662000000010000002000000096BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C60B000000010000001A0000004900530052004700200052006F006F007400200058003100000014000000010000001400000079B459E67BB6E5E40173800888C81A58F6E99B6E1D000000010000001000000073B6876195F5D18E048510422AEF04E309000000010000000C000000300A06082B06010505070301030000000100000014000000CABD2A79A1076A31F21D253635CB039D4329A5E80F00000001000000200000003F0411EDE9C4477057D57E57883B1F205B20CDC0F3263129B1EE0269A2678F6320000000010000006F0500003082056B30820353A0030201020211008210CFB0D240E3594463E0BB63828B00300D06092A864886F70D01010B0500304F310B300906035504061302555331293027060355040A1320496E7465726E65742053656375726974792052657365617263682047726F7570311530130603550403130C4953524720526F6F74205831301E170D3135303630343131303433385A170D3335303630343131303433385A304F310B300906035504061302555331293027060355040A1320496E7465726E65742053656375726974792052657365617263682047726F7570311530130603550403130C4953524720526F6F7420583130820222300D06092A864886F70D01010105000382020F003082020A0282020100ADE82473F41437F39B9E2B57281C87BEDCB7DF38908C6E3CE657A078F775C2A2FEF56A6EF6004F28DBDE68866C4493B6B163FD14126BBF1FD2EA319B217ED1333CBA48F5DD79DFB3B8FF12F1219A4BC18A8671694A66666C8F7E3C70BFAD292206F3E4C0E680AEE24B8FB7997E94039FD347977C99482353E838AE4F0A6F832ED149578C8074B6DA2FD0388D7B0370211B75F2303CFA8FAEDDDA63ABEB164FC28E114B7ECF0BE8FFB5772EF4B27B4AE04C12250C708D0329A0E15324EC13D9EE19BF10B34A8C3F89A36151DEAC870794F46371EC2EE26F5B9881E1895C34796C76EF3B906279E6DBA49A2F26C5D010E10EDED9108E16FBB7F7A8F7C7E50207988F360895E7E237960D36759EFB0E72B11D9BBC03F94905D881DD05B42AD641E9AC0176950A0FD8DFD5BD121F352F28176CD298C1A80964776E4737BACEAC595E689D7F72D689C50641293E593EDD26F524C911A75AA34C401F46A199B5A73A516E863B9E7D72A712057859ED3E5178150B038F8DD02F05B23E7B4A1C4B730512FCC6EAE050137C439374B3CA74E78E1F0108D030D45B7136B407BAC130305C48B7823B98A67D608AA2A32982CCBABD83041BA2830341A1D605F11BC2B6F0A87C863B46A8482A88DC769A76BF1F6AA53D198FEB38F364DEC82B0D0A28FFF7DBE21542D422D0275DE179FE18E77088AD4EE6D98B3AC6DD27516EFFBC64F533434F0203010001A3423040300E0603551D0F0101FF040403020106300F0603551D130101FF040530030101FF301D0603551D0E0416041479B459E67BB6E5E40173800888C81A58F6E99B6E300D06092A864886F70D01010B05000382020100551F58A9BCB2A850D00CB1D81A6920272908AC61755C8A6EF882E5692FD5F6564BB9B8731059D321977EE74C71FBB2D260AD39A80BEA17215685F1500E59EBCEE059E9BAC915EF869D8F8480F6E4E99190DC179B621B45F06695D27C6FC2EA3BEF1FCFCBD6AE27F1A9B0C8AEFD7D7E9AFA2204EBFFD97FEA912B22B1170E8FF28A345B58D8FC01C954B9B826CC8A8833894C2D843C82DFEE965705BA2CBBF7C4B7C74E3B82BE31C822737392D1C280A43939103323824C3C9F86B255981DBE29868C229B9EE26B3B573A82704DDC09C789CB0A074D6CE85D8EC9EFCEABC7BBB52B4E45D64AD026CCE572CA086AA595E315A1F7A4EDC92C5FA5FBFFAC28022EBED77BBBE3717B9016D3075E46537C3707428CD3C4969CD599B52AE0951A8048AE4C3907CECC47A452952BBAB8FBADD233537DE51D4D6DD5A1B1C7426FE64027355CA328B7078DE78D3390E7239FFB509C796C46D5B415B3966E7E9B0C963AB8522D3FD65BE1FB08C284FE24A8A389DAAC6AE1182AB1A843615BD31FDC3B8D76F22DE88D75DF17336C3D53FB7BCB415FFFDCA2D06138E196B8AC5D8B37D775D533C09911AE9D41C1727584BE0241425F67244894D19B27BE073FB9B84F817451E17AB7ED9D23E2BEE0D52804133C31039EDD7A6C8FC60718C67FDE478E3F289E0406CFA5543477BDEC899BE91743DF5BDB5FFE8E1E57A2CD409D7E6222DADE1827
Executable files
15
Suspicious files
38
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
3468USBUtil_70014.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_45E3C223BCF135987E4038FB6B0DBA13binary
MD5:037AE8164352CA91E80AD33054D1906D
SHA256:07C018EB07002663D5248DAA8A65EAF587955E3DB45735E7E3AC9CB13D7D664E
3468USBUtil_70014.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B8DAA588C6424587A535BD2580EA7BE4_FF7C86319CE5FA89A924F0493C0985D5binary
MD5:4B7EB744BA20DD7EE8508277203EE1D2
SHA256:9DD5BD826D14E63AEB83DBDCC5FA0496D936F89914A2AAD7758255B5D6F6A5AB
3468USBUtil_70014.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:3F561B1AB7BDD8FF58594F083147D11F
SHA256:A829DCBEB645E9EC3C8115A4B06915CB6F45A0F8206BCD993A757D449E6F3517
3468USBUtil_70014.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EFFA13BBC5E13BFAA85DB9326A6BF150binary
MD5:0895999255245F4E8E6E064F05499643
SHA256:6B27D28D0C4B306FA0821063E34A8EDE41C5B59936D6A3D853022B006F9E19FF
3468USBUtil_70014.exeC:\Users\admin\AppData\Local\Temp\Tar9B8A.tmpbinary
MD5:9441737383D21192400ECA82FDA910EC
SHA256:BC3A6E84E41FAEB57E7C21AA3B60C2A64777107009727C5B7C0ED8FE658909E5
3468USBUtil_70014.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\usbutil[1].pngimage
MD5:AAF4FD31BA5523186456CB96092CB922
SHA256:5F4031D7B7542FB3F7CA5F5F5BBD7C7F3BE604712630C8CD07240DA220F30111
3468USBUtil_70014.exeC:\Users\admin\AppData\Local\Temp\Cab9B79.tmpcompressed
MD5:F3441B8572AAE8801C04F3060B550443
SHA256:6720349E7D82EE0A8E73920D3C2B7CB2912D9FCF2EDB6FD98F2F12820158B0BF
3468USBUtil_70014.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751binary
MD5:60FE01DF86BE2E5331B0CDBE86165686
SHA256:C08CCBC876CD5A7CDFA9670F9637DA57F6A1282198A9BC71FC7D7247A6E5B7A8
3468USBUtil_70014.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:D62E6C4EDE7A4BBC73BC8CF1DA40DC61
SHA256:59B9A8601F43746197F532C2B08082BE9CFA1FCA9B38C1604486556F30361C5A
3468USBUtil_70014.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62binary
MD5:41F360F316A36DE1984A4464A008EBA6
SHA256:D45AAF975BC7766A108629416749257F1EEEAD66C9AD442092587191D2314E2F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
25
TCP/UDP connections
29
DNS requests
20
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4076
pmropn.exe
HEAD
302
165.193.78.250:80
http://www.premieropinion.com/Privacy.aspx
unknown
—
—
unknown
3468
USBUtil_70014.exe
GET
200
184.24.77.54:80
http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgOWTr9peSZYSyu%2BzKUAXJw9lA%3D%3D
unknown
binary
503 b
unknown
3468
USBUtil_70014.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b54a2c574b0476d0
unknown
compressed
4.66 Kb
unknown
3468
USBUtil_70014.exe
GET
200
165.193.78.234:80
http://post.securestudies.com/packages/PI1032/ContentI3.exe
unknown
executable
3.85 Mb
unknown
3468
USBUtil_70014.exe
GET
200
142.250.186.67:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
3468
USBUtil_70014.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?29edbe092bc7ecf2
unknown
compressed
61.6 Kb
unknown
3468
USBUtil_70014.exe
POST
200
165.193.78.234:80
http://post.securestudies.com/TapAction.aspx?campaign_id=1538&tpi=InstallUnion&action_id=17&uid=I9x1Fk2ZAbyqUrrq555555
unknown
text
2 b
unknown
3468
USBUtil_70014.exe
GET
200
23.56.202.135:80
http://x1.c.lencr.org/
unknown
binary
717 b
unknown
3468
USBUtil_70014.exe
POST
200
165.193.78.234:80
http://post.securestudies.com/TapAction.aspx?campaign_id=1538&tpi=InstallUnion&action_id=0
unknown
text
25 b
unknown
3468
USBUtil_70014.exe
GET
200
18.245.65.219:80
http://ocsp.r2m01.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBShdVEFnSEQ0gG5CBtzM48cPMe9XwQUgbgOY4qJEhjl%2Bjs7UJWf5uWQE4UCEAwk%2BoWOqEVYRON9KYl3mS4%3D
unknown
binary
471 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3468
USBUtil_70014.exe
35.190.60.70:80
dlsft.com
GOOGLE
US
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3468
USBUtil_70014.exe
35.190.60.70:443
dlsft.com
GOOGLE
US
whitelisted
3468
USBUtil_70014.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
3468
USBUtil_70014.exe
142.250.186.67:80
ocsp.pki.goog
GOOGLE
US
whitelisted
3468
USBUtil_70014.exe
163.172.67.175:443
img.programas-gratis.net
Online S.a.s.
FR
unknown
3468
USBUtil_70014.exe
23.56.202.135:80
x1.c.lencr.org
AKAMAI-AS
GB
unknown
3468
USBUtil_70014.exe
184.24.77.54:80
r3.o.lencr.org
Akamai International B.V.
DE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
868
svchost.exe
23.35.228.137:80
armmf.adobe.com
AKAMAI-AS
DE
unknown

DNS requests

Domain
IP
Reputation
dlsft.com
  • 35.190.60.70
unknown
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.pki.goog
  • 142.250.186.67
whitelisted
img.programas-gratis.net
  • 163.172.67.175
unknown
x1.c.lencr.org
  • 23.56.202.135
whitelisted
r3.o.lencr.org
  • 184.24.77.54
  • 184.24.77.48
shared
post.securestudies.com
  • 165.193.78.234
malicious
dpd.securestudies.com
  • 13.32.121.27
  • 13.32.121.93
  • 13.32.121.51
  • 13.32.121.122
whitelisted
armmf.adobe.com
  • 23.35.228.137
whitelisted
o.ss2.us
  • 108.138.2.173
  • 108.138.2.107
  • 108.138.2.195
  • 108.138.2.10
whitelisted

Threats

PID
Process
Class
Message
3468
USBUtil_70014.exe
A Network Trojan was detected
ET MALWARE Possible Malicious Macro DL EXE Feb 2016
3468
USBUtil_70014.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
Process
Message
USBUtil_70014.exe
scanning node question /questions/question
USBUtil_70014.exe
scanning node question /questions/question
USBUtil_70014.exe
scanning node question /questions/question
USBUtil_70014.exe
scanning node questions /questions
USBUtil_70014.exe
scanning node question /questions/question
USBUtil_70014.exe
scanning node question /questions/question
USBUtil_70014.exe
scanning node question /questions/question
USBUtil_70014.exe
scanning node question /questions/question
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
USBUtil_70014.exe