| File name: | Microsoft_Office_2024.torrent |
| Full analysis: | https://app.any.run/tasks/41428b17-0fbe-4a1b-bfe6-184538204908 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | October 11, 2024, 19:09:58 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-bittorrent |
| File info: | BitTorrent file |
| MD5: | E651EDD293F04C316A039428DE03B586 |
| SHA1: | 3A46DF361C147A2DCC89DD3E3A78975CADA47096 |
| SHA256: | BB95A20DF2F81B3F52689B8DE3DC5328C73512872E81FCAF221ED13ACA39EA49 |
| SSDEEP: | 3072:E1RRuj10J3vDtybKcObHgZvpYlDpSyfLS9N5ByLSJYU:E1RU1ZKcOTgZxYlVJu9N5ALrU |
MALICIOUS
Registers / Runs the DLL via REGSVR32.EXE
- installer.exe (PID: 764)
SUSPICIOUS
Executable content was dropped or overwritten
- utweb_installer.exe (PID: 8732)
- utweb_installer.exe (PID: 8476)
- utweb_installer.tmp (PID: 8824)
- utweb_installer.exe (PID: 8952)
- utweb.exe (PID: 8272)
- saBSI.exe (PID: 9124)
- installer.exe (PID: 8052)
- installer.exe (PID: 764)
Malware-specific behavior (creating "System.dll" in Temp)
- utweb_installer.exe (PID: 8952)
Process drops legitimate windows executable
- utweb_installer.exe (PID: 8952)
- installer.exe (PID: 764)
Potential Corporate Privacy Violation
- utweb.exe (PID: 8272)
Executes as Windows Service
- servicehost.exe (PID: 7372)
Starts CMD.EXE for commands execution
- servicehost.exe (PID: 7372)
Hides command output
- cmd.exe (PID: 3852)
Connects to unusual port
- utweb.exe (PID: 8272)
INFO
Manual execution by a user
- msedge.exe (PID: 4956)
Executable content was dropped or overwritten
- msedge.exe (PID: 4956)
- msedge.exe (PID: 2432)
Reads Microsoft Office registry keys
- OpenWith.exe (PID: 6436)
Application launched itself
- msedge.exe (PID: 4956)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .torrent | | | Torrent (trackerless) (57.6) |
|---|---|---|
| .torrent | | | Torrent (42.3) |
EXIF
Torrent
| Announce: | udp://tracker.openbittorrent.com:80/announce |
|---|---|
| AnnounceList1: | udp://tracker.openbittorrent.com:80/announce |
| AnnounceList2: | udp://tracker.opentrackr.org:1337/announce |
| Comment: | Microsoft.Office.2021x64.v2023.04 |
| CreateDate: | 2024:06:05 13:31:05+00:00 |
| File1Length: | 1577 MiB |
| File1Path: | Office/Data/16.0.14332.20493/stream.x64.x-none.dat |
| File2Length: | 210 MiB |
| File2Path: | data0.bin |
| File3Length: | 2.9 MiB |
| File3Path: | data1.bin |
| File4Length: | 29 MiB |
| File4Path: | Office/Data/16.0.14332.20493/i640.cab |
| File5Length: | 2.1 MiB |
| File5Path: | Office/Data/16.0.14332.20493/s640.cab |
| File6Length: | 585 KiB |
| File6Path: | Office/Data/16.0.14332.20493/s641033.cab |
| File7Length: | 507 KiB |
| File7Path: | Office/Data/16.0.14332.20493/s641049.cab |
| File8Length: | 493 KiB |
| File8Path: | Office/Data/16.0.14332.20493/s641058.cab |
| File9Length: | 285 MiB |
| File9Path: | Office/Data/16.0.14332.20493/stream.x64.en-us.dat |
| File10Length: | 208 MiB |
| File10Path: | Office/Data/16.0.14332.20493/stream.x64.ru-ru.dat |
| File11Length: | 209 MiB |
| File11Path: | Office/Data/16.0.14332.20493/stream.x64.uk-ua.dat |
| File12Length: | 64 bytes |
| File12Path: | AUTORUN.inf |
| File13Length: | 11 KiB |
| File13Path: | Office/Data/v64.cab |
| File14Length: | 11 KiB |
| File14Path: | Office/Data/v64_16.0.14332.20493.cab |
| File15Length: | 7.1 MiB |
| File15Path: | Office/deploy.exe |
| File16Length: | 1138 KiB |
| File16Path: | Office/helper.exe |
| File17Length: | 1783 KiB |
| File17Path: | Office/Utilities/Act.exe |
| File18Length: | 69 KiB |
| File18Path: | Office/Utilities/INFO_EN.rtf |
| File19Length: | 81 KiB |
| File19Path: | Office/Utilities/INFO_RU.rtf |
| File20Length: | 2023 KiB |
| File20Path: | Office/Utilities/LPIntegrator.exe |
| File21Length: | 19 MiB |
| File21Path: | Office/Utilities/OfficeTab.exe |
| File22Length: | 1118 KiB |
| File22Path: | Office/Utilities/OUninstall.exe |
| File23Length: | 571 KiB |
| File23Path: | Office/Utilities/UBitMenuSetupRU.exe |
| File24Length: | 569 KiB |
| File24Path: | Office/Utilities/UBitMenuSetupUK.exe |
| File25Length: | 5.6 MiB |
| File25Path: | Setup.exe |
| Name: | Microsoft.Office.2021x64.v2023.04 |
| PieceLength: | 524288 |
| Pieces: | (Binary data 102500 bytes, use -b option to extract) |
Total processes
212
Monitored processes
74
Malicious processes
4
Suspicious processes
3
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 764 | "C:\Program Files\McAfee\Temp3583909745\installer.exe" /setOem:Affid=91082 /s /thirdparty /upgrade | C:\Program Files\McAfee\Temp3583909745\installer.exe | installer.exe | ||||||||||||
User: admin Company: McAfee, LLC Integrity Level: HIGH Description: McAfee WebAdvisor(installer) Exit code: 0 Version: 4,1,1,965 Modules
| |||||||||||||||
| 916 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2752 --field-trial-handle=2468,i,8821553787129746524,12835680450796263940,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 122.0.2365.59 Modules
| |||||||||||||||
| 1332 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=8328 --field-trial-handle=2468,i,8821553787129746524,12835680450796263940,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
| 1344 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://utweb.rainberrytv.com/gui/index.html?v=1.4.0.5871&firstrun=1&localauth=localapibad95eddc034f11c: | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | utweb.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
| 1748 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3844 --field-trial-handle=2468,i,8821553787129746524,12835680450796263940,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
| 2432 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2652 --field-trial-handle=2468,i,8821553787129746524,12835680450796263940,262144 --variations-seed-version /prefetch:3 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | msedge.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Version: 122.0.2365.59 Modules
| |||||||||||||||
| 2464 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5796 --field-trial-handle=2468,i,8821553787129746524,12835680450796263940,262144 --variations-seed-version /prefetch:1 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 122.0.2365.59 Modules
| |||||||||||||||
| 2660 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6500 --field-trial-handle=2468,i,8821553787129746524,12835680450796263940,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
| 3700 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=4784 --field-trial-handle=2468,i,8821553787129746524,12835680450796263940,262144 --variations-seed-version /prefetch:2 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
| |||||||||||||||
| 3852 | C:\WINDOWS\system32\cmd.exe /c dir "C:\Program Files (x86)\McAfee Security Scan" 2>nul | C:\Windows\System32\cmd.exe | — | servicehost.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Command Processor Exit code: 1 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
58 812
Read events
58 423
Write events
371
Delete events
18
Modification events
| (PID) Process: | (4616) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FeatureUsage\AppLaunch |
| Operation: | write | Name: | MSEdge |
Value: 12 | |||
| (PID) Process: | (4956) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (4956) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (4956) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (4956) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics |
| Operation: | write | Name: | user_experience_metrics.stability.exited_cleanly |
Value: 0 | |||
| (PID) Process: | (4956) msedge.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault |
| Operation: | write | Name: | S-1-5-21-1693682860-607145093-2874071422-1001 |
Value: 8EF0FE84CE822F00 | |||
| (PID) Process: | (4616) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000009021C |
| Operation: | write | Name: | VirtualDesktop |
Value: 100000003030445671D90A7D3588864C9F3CEA9EBAB7B4A7 | |||
| (PID) Process: | (4956) msedge.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault |
| Operation: | write | Name: | S-1-5-21-1693682860-607145093-2874071422-1001 |
Value: C5690A85CE822F00 | |||
| (PID) Process: | (4956) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\590364 |
| Operation: | write | Name: | WindowTabManagerFileMappingId |
Value: {66D5CDB7-1758-4279-BA4E-E3159D1CB676} | |||
| (PID) Process: | (4616) explorer.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000080258 |
| Operation: | write | Name: | VirtualDesktop |
Value: 100000003030445671D90A7D3588864C9F3CEA9EBAB7B4A7 | |||
Executable files
70
Suspicious files
938
Text files
1 178
Unknown types
6
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 4956 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF8d9af.TMP | — | |
MD5:— | SHA256:— | |||
| 4956 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 4956 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF8d9af.TMP | — | |
MD5:— | SHA256:— | |||
| 4956 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 4956 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF8d9af.TMP | — | |
MD5:— | SHA256:— | |||
| 4956 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 4956 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF8d9bf.TMP | — | |
MD5:— | SHA256:— | |||
| 4956 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old | — | |
MD5:— | SHA256:— | |||
| 4956 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF8da4b.TMP | — | |
MD5:— | SHA256:— | |||
| 4956 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old | — | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
62
TCP/UDP connections
2 478
DNS requests
248
Threats
13
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
6944 | svchost.exe | GET | 200 | 23.48.23.143:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | DE | binary | 1.01 Kb | whitelisted |
4360 | SearchApp.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | US | binary | 313 b | whitelisted |
6944 | svchost.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | DE | binary | 973 b | whitelisted |
6384 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | US | binary | 471 b | whitelisted |
3848 | backgroundTaskHost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | US | binary | 471 b | whitelisted |
7096 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | DE | binary | 419 b | whitelisted |
7096 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | DE | binary | 407 b | whitelisted |
4616 | explorer.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBT3xL4LQLXDRDM9P665TW442vrsUQQUReuir%2FSSy4IxLVGLp6chnfNtyA8CEA6bGI750C3n79tQ4ghAGFo%3D | US | binary | 471 b | whitelisted |
4616 | explorer.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfIs%2BLjDtGwQ09XEB1Yeq%2BtX%2BBgQQU7NfjgtJxXWRM3y5nP%2Be6mK4cD08CEAitQLJg0pxMn17Nqb2Trtk%3D | US | binary | 727 b | whitelisted |
4616 | explorer.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSRXerF0eFeSWRripTgTkcJWMm7iQQUaDfg67Y7%2BF8Rhvv%2BYXsIiGX0TkICEA74MnP04YNx7ulsojvPs3Y%3D | US | binary | 727 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1752 | RUXIMICS.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5488 | MoUsoCoreWorker.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
6944 | svchost.exe | 23.48.23.143:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
6944 | svchost.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4360 | SearchApp.exe | 104.126.37.153:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
4360 | SearchApp.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
6384 | svchost.exe | 40.126.32.134:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
login.live.com |
| whitelisted |
th.bing.com |
| whitelisted |
config.edge.skype.com |
| whitelisted |
ntp.msn.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
8952 | utweb_installer.exe | Potentially Bad Traffic | ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla)) |
8952 | utweb_installer.exe | Potentially Bad Traffic | ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla)) |
8272 | utweb.exe | Potential Corporate Privacy Violation | ET P2P BitTorrent DHT ping request |
8272 | utweb.exe | Potentially Bad Traffic | ET POLICY Executable served from Amazon S3 |
8272 | utweb.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
2432 | msedge.exe | Potentially Bad Traffic | ET INFO Suspicious Domain (polyfill .io) in DNS Lookup |
2432 | msedge.exe | Not Suspicious Traffic | INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net) |
2432 | msedge.exe | Not Suspicious Traffic | INFO [ANY.RUN] Requests to a free CDN for open source projects (jsdelivr .net) |
2432 | msedge.exe | Not Suspicious Traffic | INFO [ANY.RUN] Global content delivery network (unpkg .com) |
8272 | utweb.exe | Potential Corporate Privacy Violation | ET P2P Vuze BT UDP Connection (5) |
Process | Message |
|---|---|
saBSI.exe | NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
|
saBSI.exe | NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-SF5PN.tmp\component0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-SF5PN.tmp\component0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
|
saBSI.exe | NCPrivateLoadAndValidateMPTDll: Looking in current directory
|
saBSI.exe | NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
|
saBSI.exe | NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-SF5PN.tmp\component0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-SF5PN.tmp\component0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
|
saBSI.exe | NCPrivateLoadAndValidateMPTDll: Looking in current directory
|
saBSI.exe | NCPrivateLoadAndValidateMPTDll: Looking in current directory
|
saBSI.exe | NCPrivateLoadAndValidateMPTDll: Looking in EXE directory
|
saBSI.exe | NotComDllGetInterface: C:\Users\admin\AppData\Local\Temp\is-SF5PN.tmp\component0_extract\saBSI.exe loading C:\Users\admin\AppData\Local\Temp\is-SF5PN.tmp\component0_extract\mfeaaca.dll, WinVerifyTrust failed with 80092003
|
saBSI.exe | NCPrivateLoadAndValidateMPTDll: Looking in current directory
|