File name:

bill notice 05.2019.xls

Full analysis: https://app.any.run/tasks/25ec3d51-56b4-43de-8f91-64b90071df32
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: May 20, 2019, 14:06:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
macros
macros-on-open
rat
rms
stealer
Indicators:
MIME: application/vnd.ms-excel
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Author: Bob Brown, Last Saved By: Bob Brown, Name of Creating Application: Microsoft Excel, Create Time/Date: Thu May 16 10:47:19 2019, Last Saved Time/Date: Thu May 16 11:00:11 2019, Security: 0
MD5:

99AC3F1416CAC91098DAFA8400EB08D4

SHA1:

9FA4EFD792D72A2A2C166D147C5997C7258C4893

SHA256:

BF6D31FACA12C2A33477AF2C17A01049171ABEC4640B4B14067D8D8779D3BE57

SSDEEP:

3072:2c38TehYTdeHVhjqabWHLtyeGxml8/dgGxXYhh3vVx2Wq87P5H4uPF1+GGz/GrOr:r38TehYTdeHVhjqabWHLty/xml8/dgwP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executable content was dropped or overwritten

      • EXCEL.EXE (PID: 2860)

    • Application was dropped or rewritten from another process

      • exit.exe (PID: 2828)
      • veter1605_MAPS_10cr0.exe (PID: 2172)
      • wprgxyeqd79.exe (PID: 756)
      • uninstall.exe (PID: 3224)
      • rtegre.exe (PID: 1140)
      • exit.exe (PID: 2032)
      • winserv.exe (PID: 2864)

    • Unusual execution from Microsoft Office

      • EXCEL.EXE (PID: 2860)

    • Loads dropped or rewritten executable

      • cmd.exe (PID: 3484)
      • veter1605_MAPS_10cr0.exe (PID: 2172)
      • exit.exe (PID: 2032)
      • uninstall.exe (PID: 3224)
      • taskkill.exe (PID: 3304)
      • EXCEL.EXE (PID: 2860)
      • conhost.exe (PID: 2788)
      • taskkill.exe (PID: 2644)
      • taskkill.exe (PID: 3004)
      • taskkill.exe (PID: 3068)
      • taskkill.exe (PID: 3480)
      • taskkill.exe (PID: 3232)
      • taskkill.exe (PID: 2364)
      • cmd.exe (PID: 3660)
      • taskkill.exe (PID: 3232)
      • taskkill.exe (PID: 2968)
      • taskkill.exe (PID: 3876)
      • PING.EXE (PID: 2128)
      • winserv.exe (PID: 2864)
      • taskkill.exe (PID: 2512)
      • reg.exe (PID: 2596)
      • taskkill.exe (PID: 1652)
      • rtegre.exe (PID: 1140)
      • taskkill.exe (PID: 2132)
      • taskkill.exe (PID: 2288)
      • PING.EXE (PID: 2524)
      • taskkill.exe (PID: 1080)
      • wprgxyeqd79.exe (PID: 756)
      • taskkill.exe (PID: 1448)
      • taskkill.exe (PID: 952)
      • taskkill.exe (PID: 3272)
      • taskkill.exe (PID: 1276)
      • taskkill.exe (PID: 352)
      • wmiprvse.exe (PID: 2632)
      • taskkill.exe (PID: 2584)
      • taskkill.exe (PID: 2516)
      • taskkill.exe (PID: 2892)
      • taskkill.exe (PID: 764)
      • svchost.exe (PID: 3348)
      • taskkill.exe (PID: 1012)
      • taskkill.exe (PID: 2112)
      • taskkill.exe (PID: 2512)
      • taskkill.exe (PID: 2112)
      • taskkill.exe (PID: 1708)
      • taskkill.exe (PID: 3372)
      • taskkill.exe (PID: 2824)
      • exit.exe (PID: 2828)
      • conhost.exe (PID: 2608)
      • taskkill.exe (PID: 2428)
      • taskkill.exe (PID: 3436)
      • taskkill.exe (PID: 2540)
      • taskkill.exe (PID: 2516)
      • taskkill.exe (PID: 3496)
      • taskkill.exe (PID: 3868)
      • taskkill.exe (PID: 3768)
      • taskkill.exe (PID: 2472)
      • taskkill.exe (PID: 2080)
      • taskkill.exe (PID: 900)
      • taskkill.exe (PID: 1944)
      • taskkill.exe (PID: 2556)
      • taskkill.exe (PID: 3144)
      • taskkill.exe (PID: 2532)
      • taskkill.exe (PID: 1244)
      • taskkill.exe (PID: 2032)
      • taskkill.exe (PID: 2468)
      • taskkill.exe (PID: 3300)
      • taskkill.exe (PID: 3536)
      • taskkill.exe (PID: 3208)
      • taskkill.exe (PID: 3196)
      • taskkill.exe (PID: 3056)
      • taskkill.exe (PID: 2096)
      • taskkill.exe (PID: 3964)
      • taskkill.exe (PID: 3428)
      • taskkill.exe (PID: 2980)
      • taskkill.exe (PID: 592)
      • taskkill.exe (PID: 404)
      • taskkill.exe (PID: 3780)
      • taskkill.exe (PID: 3240)
      • taskkill.exe (PID: 3692)
      • taskkill.exe (PID: 416)
      • taskkill.exe (PID: 2956)
      • taskkill.exe (PID: 2324)
      • taskkill.exe (PID: 1824)
      • taskkill.exe (PID: 3632)
      • taskkill.exe (PID: 2820)
      • taskkill.exe (PID: 2836)
      • taskkill.exe (PID: 3252)
      • taskkill.exe (PID: 928)
      • taskkill.exe (PID: 3736)
      • taskkill.exe (PID: 1012)
      • taskkill.exe (PID: 3960)
      • taskkill.exe (PID: 3040)
      • taskkill.exe (PID: 2532)
      • taskkill.exe (PID: 2368)
      • taskkill.exe (PID: 2440)
      • taskkill.exe (PID: 2064)
      • taskkill.exe (PID: 3640)
      • taskkill.exe (PID: 2396)
      • taskkill.exe (PID: 3884)
      • taskkill.exe (PID: 3784)
      • taskkill.exe (PID: 3064)
      • taskkill.exe (PID: 2604)
      • taskkill.exe (PID: 2752)
      • taskkill.exe (PID: 1708)
      • taskkill.exe (PID: 3752)
      • taskkill.exe (PID: 2520)
      • taskkill.exe (PID: 3864)
      • taskkill.exe (PID: 952)
      • taskkill.exe (PID: 1532)
      • taskkill.exe (PID: 1916)
      • taskkill.exe (PID: 2960)
      • taskkill.exe (PID: 3024)
      • taskkill.exe (PID: 3056)
      • taskkill.exe (PID: 3708)
      • taskkill.exe (PID: 2836)
      • taskkill.exe (PID: 2820)
      • taskkill.exe (PID: 2528)
      • taskkill.exe (PID: 2940)
      • taskkill.exe (PID: 3020)
      • taskkill.exe (PID: 3456)
      • taskkill.exe (PID: 1652)
      • taskkill.exe (PID: 2264)
      • taskkill.exe (PID: 968)
      • taskkill.exe (PID: 932)
      • taskkill.exe (PID: 3428)
      • taskkill.exe (PID: 2288)
      • taskkill.exe (PID: 3840)
      • taskkill.exe (PID: 3928)
      • taskkill.exe (PID: 1880)
      • taskkill.exe (PID: 2892)
      • taskkill.exe (PID: 1356)
      • taskkill.exe (PID: 1768)
      • taskkill.exe (PID: 3740)
      • taskkill.exe (PID: 2352)
      • taskkill.exe (PID: 3112)
      • taskkill.exe (PID: 276)
      • taskkill.exe (PID: 1256)
      • taskkill.exe (PID: 572)
      • taskkill.exe (PID: 2916)
      • taskkill.exe (PID: 3396)
      • taskkill.exe (PID: 2752)
      • taskkill.exe (PID: 1360)
      • taskkill.exe (PID: 1664)
      • taskkill.exe (PID: 2972)
      • taskkill.exe (PID: 3256)
      • taskkill.exe (PID: 2940)
      • taskkill.exe (PID: 3880)
      • taskkill.exe (PID: 2640)
      • taskkill.exe (PID: 756)
      • taskkill.exe (PID: 3060)
      • taskkill.exe (PID: 2660)
      • taskkill.exe (PID: 2440)
      • taskkill.exe (PID: 3880)
      • taskkill.exe (PID: 1512)
      • taskkill.exe (PID: 2932)
      • taskkill.exe (PID: 1156)
      • taskkill.exe (PID: 2684)
      • taskkill.exe (PID: 3096)
      • taskkill.exe (PID: 416)
      • taskkill.exe (PID: 828)
      • taskkill.exe (PID: 3176)
      • taskkill.exe (PID: 2652)
      • taskkill.exe (PID: 900)
      • taskkill.exe (PID: 3020)
      • taskkill.exe (PID: 2472)
      • taskkill.exe (PID: 2948)
      • taskkill.exe (PID: 2884)
      • taskkill.exe (PID: 3204)
      • taskkill.exe (PID: 3800)
      • taskkill.exe (PID: 828)
      • taskkill.exe (PID: 3148)
      • taskkill.exe (PID: 2684)
      • taskkill.exe (PID: 920)
      • taskkill.exe (PID: 1464)
      • taskkill.exe (PID: 3708)
      • taskkill.exe (PID: 3768)
      • taskkill.exe (PID: 1000)
      • taskkill.exe (PID: 2996)
      • taskkill.exe (PID: 1020)
      • taskkill.exe (PID: 1532)
      • taskkill.exe (PID: 3184)
      • taskkill.exe (PID: 2724)
      • taskkill.exe (PID: 3544)
      • taskkill.exe (PID: 3540)
      • taskkill.exe (PID: 3108)
      • taskkill.exe (PID: 2932)
      • taskkill.exe (PID: 3184)
      • taskkill.exe (PID: 3192)
      • taskkill.exe (PID: 2396)
      • taskkill.exe (PID: 2980)
      • taskkill.exe (PID: 3152)
      • taskkill.exe (PID: 3696)
      • taskkill.exe (PID: 3300)
      • taskkill.exe (PID: 1396)
      • taskkill.exe (PID: 2352)
      • taskkill.exe (PID: 3392)
      • taskkill.exe (PID: 4068)
      • taskkill.exe (PID: 3540)
      • taskkill.exe (PID: 932)
      • taskkill.exe (PID: 3516)
      • taskkill.exe (PID: 3268)
      • taskkill.exe (PID: 1360)
      • taskkill.exe (PID: 3500)
      • taskkill.exe (PID: 3960)
      • taskkill.exe (PID: 592)
      • taskkill.exe (PID: 3196)
      • taskkill.exe (PID: 2468)
      • taskkill.exe (PID: 2380)
      • taskkill.exe (PID: 2896)
      • taskkill.exe (PID: 3448)
      • taskkill.exe (PID: 2884)
      • taskkill.exe (PID: 2732)
      • taskkill.exe (PID: 2300)
      • taskkill.exe (PID: 2740)
      • taskkill.exe (PID: 2192)
      • taskkill.exe (PID: 2140)
      • taskkill.exe (PID: 3392)
      • taskkill.exe (PID: 1352)
      • taskkill.exe (PID: 3096)
      • taskkill.exe (PID: 2944)
      • taskkill.exe (PID: 3728)
      • taskkill.exe (PID: 2760)
      • taskkill.exe (PID: 2224)
      • taskkill.exe (PID: 800)
      • taskkill.exe (PID: 3368)
      • taskkill.exe (PID: 3700)
      • taskkill.exe (PID: 3824)
      • taskkill.exe (PID: 3120)
      • taskkill.exe (PID: 1664)
      • taskkill.exe (PID: 3008)
      • taskkill.exe (PID: 3152)
      • taskkill.exe (PID: 3700)
      • taskkill.exe (PID: 1244)
      • taskkill.exe (PID: 2292)
      • taskkill.exe (PID: 3952)
      • taskkill.exe (PID: 3024)
      • taskkill.exe (PID: 3380)
      • taskkill.exe (PID: 3016)
      • taskkill.exe (PID: 2556)
      • taskkill.exe (PID: 3248)
      • taskkill.exe (PID: 1208)
      • taskkill.exe (PID: 2584)
      • taskkill.exe (PID: 3220)
      • taskkill.exe (PID: 2740)
      • taskkill.exe (PID: 3272)
      • taskkill.exe (PID: 180)
      • taskkill.exe (PID: 2644)
      • taskkill.exe (PID: 1336)
      • taskkill.exe (PID: 2280)
      • taskkill.exe (PID: 2928)
      • taskkill.exe (PID: 3744)
      • taskkill.exe (PID: 2432)
      • taskkill.exe (PID: 3800)
      • taskkill.exe (PID: 3980)
      • taskkill.exe (PID: 2672)
      • taskkill.exe (PID: 2580)
      • taskkill.exe (PID: 2844)
      • taskkill.exe (PID: 1308)
      • taskkill.exe (PID: 3252)
      • taskkill.exe (PID: 2100)
      • taskkill.exe (PID: 2876)
      • taskkill.exe (PID: 2080)
      • taskkill.exe (PID: 2624)
      • taskkill.exe (PID: 2728)
      • taskkill.exe (PID: 3556)
      • taskkill.exe (PID: 916)
      • taskkill.exe (PID: 3780)
      • taskkill.exe (PID: 3220)
      • taskkill.exe (PID: 1356)
      • taskkill.exe (PID: 2520)
      • taskkill.exe (PID: 2360)
      • taskkill.exe (PID: 2776)
      • taskkill.exe (PID: 3552)
      • taskkill.exe (PID: 2372)
      • taskkill.exe (PID: 2136)
      • taskkill.exe (PID: 1152)
      • taskkill.exe (PID: 3696)
      • taskkill.exe (PID: 2852)
      • taskkill.exe (PID: 2460)
      • taskkill.exe (PID: 3280)
      • taskkill.exe (PID: 3200)
      • taskkill.exe (PID: 2220)
      • taskkill.exe (PID: 3236)
      • taskkill.exe (PID: 928)
      • taskkill.exe (PID: 2280)
      • taskkill.exe (PID: 1768)
      • taskkill.exe (PID: 1324)
      • taskkill.exe (PID: 3352)
      • taskkill.exe (PID: 3456)
      • taskkill.exe (PID: 3828)
      • taskkill.exe (PID: 3812)
      • taskkill.exe (PID: 3344)
      • taskkill.exe (PID: 1904)
      • taskkill.exe (PID: 2356)
      • taskkill.exe (PID: 3412)
      • taskkill.exe (PID: 2680)
      • taskkill.exe (PID: 3916)
      • taskkill.exe (PID: 2304)
      • taskkill.exe (PID: 2236)
      • taskkill.exe (PID: 3076)
      • taskkill.exe (PID: 3044)
      • taskkill.exe (PID: 640)
      • taskkill.exe (PID: 948)
      • taskkill.exe (PID: 3256)
      • taskkill.exe (PID: 2156)
      • taskkill.exe (PID: 3640)
      • taskkill.exe (PID: 1184)
      • taskkill.exe (PID: 1380)
      • taskkill.exe (PID: 1000)
      • taskkill.exe (PID: 2800)
      • taskkill.exe (PID: 276)
      • taskkill.exe (PID: 2100)
      • taskkill.exe (PID: 2528)
      • taskkill.exe (PID: 3740)
      • taskkill.exe (PID: 1156)
      • taskkill.exe (PID: 3376)
      • taskkill.exe (PID: 3012)
      • taskkill.exe (PID: 3016)
      • taskkill.exe (PID: 2964)
      • taskkill.exe (PID: 3624)
      • taskkill.exe (PID: 2368)
      • taskkill.exe (PID: 2188)
      • taskkill.exe (PID: 2408)
      • taskkill.exe (PID: 2244)
      • taskkill.exe (PID: 4080)
      • taskkill.exe (PID: 3100)
      • taskkill.exe (PID: 2652)
      • taskkill.exe (PID: 3744)
      • taskkill.exe (PID: 3724)
      • taskkill.exe (PID: 3416)
      • taskkill.exe (PID: 2220)
      • taskkill.exe (PID: 2664)
      • taskkill.exe (PID: 3692)
      • taskkill.exe (PID: 3116)
      • taskkill.exe (PID: 1560)
      • taskkill.exe (PID: 3192)
      • taskkill.exe (PID: 2196)
      • taskkill.exe (PID: 3412)
      • taskkill.exe (PID: 3356)
      • taskkill.exe (PID: 1420)
      • taskkill.exe (PID: 3148)
      • taskkill.exe (PID: 1660)
      • taskkill.exe (PID: 2928)
      • taskkill.exe (PID: 280)
      • taskkill.exe (PID: 312)
      • taskkill.exe (PID: 3972)
      • taskkill.exe (PID: 3004)
      • taskkill.exe (PID: 2488)
      • taskkill.exe (PID: 3552)
      • taskkill.exe (PID: 2336)
      • taskkill.exe (PID: 3316)
      • taskkill.exe (PID: 2656)
      • taskkill.exe (PID: 2356)
      • taskkill.exe (PID: 3928)
      • taskkill.exe (PID: 2648)
      • taskkill.exe (PID: 1464)
      • taskkill.exe (PID: 1720)
      • taskkill.exe (PID: 1908)
      • taskkill.exe (PID: 1448)
      • taskkill.exe (PID: 2196)
      • taskkill.exe (PID: 1460)
      • taskkill.exe (PID: 4088)
      • taskkill.exe (PID: 796)
      • taskkill.exe (PID: 3452)
      • taskkill.exe (PID: 968)
      • taskkill.exe (PID: 3636)
      • taskkill.exe (PID: 3108)
      • taskkill.exe (PID: 2316)
      • taskkill.exe (PID: 4088)
      • taskkill.exe (PID: 1332)
      • taskkill.exe (PID: 1396)
      • taskkill.exe (PID: 2224)
      • taskkill.exe (PID: 2060)
      • taskkill.exe (PID: 2400)
      • taskkill.exe (PID: 3588)
      • taskkill.exe (PID: 3424)
      • taskkill.exe (PID: 3444)
      • taskkill.exe (PID: 2576)
      • taskkill.exe (PID: 1092)
      • taskkill.exe (PID: 3100)
      • taskkill.exe (PID: 1908)
      • taskkill.exe (PID: 916)
      • taskkill.exe (PID: 3828)
      • taskkill.exe (PID: 2728)
      • taskkill.exe (PID: 2120)
      • taskkill.exe (PID: 3608)
      • taskkill.exe (PID: 2732)
      • taskkill.exe (PID: 3652)
      • taskkill.exe (PID: 3332)
      • taskkill.exe (PID: 3324)
      • taskkill.exe (PID: 2180)
      • taskkill.exe (PID: 3028)
      • taskkill.exe (PID: 2776)
      • taskkill.exe (PID: 2664)
      • taskkill.exe (PID: 3388)
      • taskkill.exe (PID: 920)
      • taskkill.exe (PID: 2496)
      • taskkill.exe (PID: 1568)
      • taskkill.exe (PID: 3336)
      • taskkill.exe (PID: 1660)
      • taskkill.exe (PID: 3288)
      • taskkill.exe (PID: 2408)
      • taskkill.exe (PID: 2316)
      • taskkill.exe (PID: 2736)
      • taskkill.exe (PID: 2424)
      • taskkill.exe (PID: 3240)
      • taskkill.exe (PID: 3912)
      • taskkill.exe (PID: 2848)
      • taskkill.exe (PID: 1476)
      • taskkill.exe (PID: 2336)
      • taskkill.exe (PID: 3888)
      • taskkill.exe (PID: 3360)
      • taskkill.exe (PID: 1092)
      • taskkill.exe (PID: 2180)
      • taskkill.exe (PID: 3584)
      • taskkill.exe (PID: 2136)
      • taskkill.exe (PID: 1380)
      • taskkill.exe (PID: 3752)
      • taskkill.exe (PID: 3992)
      • taskkill.exe (PID: 4000)
      • taskkill.exe (PID: 1460)
      • taskkill.exe (PID: 3520)
      • taskkill.exe (PID: 2184)
      • taskkill.exe (PID: 3772)
      • taskkill.exe (PID: 2480)
      • taskkill.exe (PID: 3900)
      • taskkill.exe (PID: 760)
      • taskkill.exe (PID: 3776)
      • taskkill.exe (PID: 3424)
      • taskkill.exe (PID: 2208)
      • taskkill.exe (PID: 3416)
      • taskkill.exe (PID: 3824)
      • taskkill.exe (PID: 2744)
      • taskkill.exe (PID: 2332)
      • taskkill.exe (PID: 3904)
      • taskkill.exe (PID: 1720)
      • taskkill.exe (PID: 752)
      • taskkill.exe (PID: 2236)
      • taskkill.exe (PID: 2276)
      • taskkill.exe (PID: 3856)
      • taskkill.exe (PID: 3236)
      • taskkill.exe (PID: 2264)
      • taskkill.exe (PID: 1276)
      • taskkill.exe (PID: 3352)
      • taskkill.exe (PID: 1944)
      • taskkill.exe (PID: 1020)
      • taskkill.exe (PID: 252)
      • taskkill.exe (PID: 3008)
      • taskkill.exe (PID: 1472)
      • taskkill.exe (PID: 1824)
      • taskkill.exe (PID: 3788)
      • taskkill.exe (PID: 2744)
      • taskkill.exe (PID: 296)
      • taskkill.exe (PID: 2648)
      • taskkill.exe (PID: 1500)
      • taskkill.exe (PID: 3948)
      • taskkill.exe (PID: 404)
      • taskkill.exe (PID: 948)
      • taskkill.exe (PID: 1308)
      • taskkill.exe (PID: 3728)
      • taskkill.exe (PID: 3384)
      • taskkill.exe (PID: 2872)
      • taskkill.exe (PID: 3840)
      • taskkill.exe (PID: 1888)
      • taskkill.exe (PID: 2392)
      • taskkill.exe (PID: 3068)
      • taskkill.exe (PID: 1668)
      • taskkill.exe (PID: 3344)
      • taskkill.exe (PID: 1672)
      • taskkill.exe (PID: 3956)
      • taskkill.exe (PID: 896)
      • taskkill.exe (PID: 2140)
      • taskkill.exe (PID: 2144)
      • taskkill.exe (PID: 3172)
      • taskkill.exe (PID: 3924)
      • taskkill.exe (PID: 3420)
      • taskkill.exe (PID: 1484)
      • taskkill.exe (PID: 3596)
      • taskkill.exe (PID: 2268)
      • taskkill.exe (PID: 1880)
      • taskkill.exe (PID: 3420)
      • taskkill.exe (PID: 4092)
      • taskkill.exe (PID: 3788)
      • taskkill.exe (PID: 3888)
      • taskkill.exe (PID: 576)
      • taskkill.exe (PID: 672)
      • taskkill.exe (PID: 1964)
      • taskkill.exe (PID: 2848)
      • taskkill.exe (PID: 3712)
      • taskkill.exe (PID: 3624)
      • taskkill.exe (PID: 3608)
      • taskkill.exe (PID: 2508)
      • taskkill.exe (PID: 2416)
      • taskkill.exe (PID: 2256)
      • taskkill.exe (PID: 3332)
      • taskkill.exe (PID: 2248)
      • taskkill.exe (PID: 3336)
      • taskkill.exe (PID: 3364)
      • taskkill.exe (PID: 1100)
      • taskkill.exe (PID: 2200)
      • taskkill.exe (PID: 2348)
      • taskkill.exe (PID: 1780)
      • taskkill.exe (PID: 2240)
      • taskkill.exe (PID: 3656)
      • taskkill.exe (PID: 2144)
      • taskkill.exe (PID: 1916)
      • taskkill.exe (PID: 1184)
      • taskkill.exe (PID: 3168)
      • taskkill.exe (PID: 3320)
      • taskkill.exe (PID: 3720)
      • taskkill.exe (PID: 1700)
      • taskkill.exe (PID: 2592)
      • taskkill.exe (PID: 312)
      • taskkill.exe (PID: 3616)
      • taskkill.exe (PID: 3292)
      • taskkill.exe (PID: 2880)
      • taskkill.exe (PID: 2244)
      • taskkill.exe (PID: 3872)
      • taskkill.exe (PID: 3460)
      • taskkill.exe (PID: 1576)
      • taskkill.exe (PID: 832)
      • taskkill.exe (PID: 2456)
      • taskkill.exe (PID: 2540)
      • taskkill.exe (PID: 1472)
      • taskkill.exe (PID: 2600)
      • taskkill.exe (PID: 3968)
      • taskkill.exe (PID: 2184)
      • taskkill.exe (PID: 3368)
      • taskkill.exe (PID: 1080)
      • taskkill.exe (PID: 2552)
      • taskkill.exe (PID: 280)
      • taskkill.exe (PID: 3444)
      • taskkill.exe (PID: 3664)
      • taskkill.exe (PID: 4080)
      • taskkill.exe (PID: 2120)
      • taskkill.exe (PID: 3900)
      • taskkill.exe (PID: 764)
      • taskkill.exe (PID: 1416)
      • taskkill.exe (PID: 3172)
      • taskkill.exe (PID: 2168)
      • taskkill.exe (PID: 3984)
      • taskkill.exe (PID: 1256)
      • taskkill.exe (PID: 2576)
      • taskkill.exe (PID: 3492)
      • taskkill.exe (PID: 776)
      • taskkill.exe (PID: 2460)
      • taskkill.exe (PID: 1644)
      • taskkill.exe (PID: 896)
      • taskkill.exe (PID: 796)
      • taskkill.exe (PID: 3380)
      • taskkill.exe (PID: 1892)
      • taskkill.exe (PID: 3796)
      • taskkill.exe (PID: 3448)
      • taskkill.exe (PID: 3044)
      • taskkill.exe (PID: 3972)
      • taskkill.exe (PID: 2904)
      • taskkill.exe (PID: 3012)
      • taskkill.exe (PID: 2292)
      • taskkill.exe (PID: 3792)
      • taskkill.exe (PID: 2156)
      • taskkill.exe (PID: 2984)
      • taskkill.exe (PID: 2348)
      • taskkill.exe (PID: 3292)
      • taskkill.exe (PID: 180)
      • taskkill.exe (PID: 2772)
      • taskkill.exe (PID: 3924)
      • taskkill.exe (PID: 3320)
      • taskkill.exe (PID: 3992)
      • taskkill.exe (PID: 3988)
      • taskkill.exe (PID: 1836)
      • taskkill.exe (PID: 2984)
      • taskkill.exe (PID: 3032)
      • taskkill.exe (PID: 1344)
      • taskkill.exe (PID: 3544)
      • taskkill.exe (PID: 2972)
      • taskkill.exe (PID: 2272)
      • taskkill.exe (PID: 2944)
      • taskkill.exe (PID: 1700)
      • taskkill.exe (PID: 2560)
      • taskkill.exe (PID: 1524)
      • taskkill.exe (PID: 456)
      • taskkill.exe (PID: 3224)
      • taskkill.exe (PID: 2724)
      • taskkill.exe (PID: 2872)
      • taskkill.exe (PID: 2412)
      • taskkill.exe (PID: 3604)
      • taskkill.exe (PID: 3724)
      • taskkill.exe (PID: 3492)
      • taskkill.exe (PID: 3436)
      • taskkill.exe (PID: 2296)
      • taskkill.exe (PID: 2476)
      • taskkill.exe (PID: 2536)
      • taskkill.exe (PID: 2132)
      • taskkill.exe (PID: 3496)
      • taskkill.exe (PID: 2324)
      • taskkill.exe (PID: 2260)
      • taskkill.exe (PID: 3736)
      • taskkill.exe (PID: 1336)
      • taskkill.exe (PID: 1500)
      • taskkill.exe (PID: 2412)
      • taskkill.exe (PID: 3912)
      • taskkill.exe (PID: 1152)
      • taskkill.exe (PID: 3280)
      • taskkill.exe (PID: 3204)
      • taskkill.exe (PID: 3632)
      • taskkill.exe (PID: 1524)
      • taskkill.exe (PID: 2060)
      • taskkill.exe (PID: 776)
      • taskkill.exe (PID: 3260)
      • taskkill.exe (PID: 3356)
      • taskkill.exe (PID: 2668)
      • taskkill.exe (PID: 2844)
      • taskkill.exe (PID: 2192)
      • taskkill.exe (PID: 1696)
      • taskkill.exe (PID: 1208)
      • taskkill.exe (PID: 456)

    • Changes the autorun value in the registry

      • reg.exe (PID: 2596)

    • RMS RAT was detected

      • winserv.exe (PID: 2864)

    • Stealing of credential data

      • rtegre.exe (PID: 1140)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • uninstall.exe (PID: 3224)
      • wprgxyeqd79.exe (PID: 756)
      • cmd.exe (PID: 3484)
      • veter1605_MAPS_10cr0.exe (PID: 2172)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 3660)

    • Starts CMD.EXE for commands execution

      • exit.exe (PID: 2828)
      • exit.exe (PID: 2032)

    • Creates files in the program directory

      • uninstall.exe (PID: 3224)

    • Reads Windows Product ID

      • winserv.exe (PID: 2864)

    • Creates files in the user directory

      • winserv.exe (PID: 2864)

    • Reads Environment values

      • winserv.exe (PID: 2864)

    • Reads the machine GUID from the registry

      • winserv.exe (PID: 2864)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 3660)

    • Loads DLL from Mozilla Firefox

      • rtegre.exe (PID: 1140)

  • INFO

    • Reads Microsoft Office registry keys

      • EXCEL.EXE (PID: 2860)

    • Dropped object may contain Bitcoin addresses

      • wprgxyeqd79.exe (PID: 756)

    • Creates files in the user directory

      • EXCEL.EXE (PID: 2860)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.xls | Microsoft Excel sheet (78.9)

EXIF

FlashPix

Author: Bob Brown
LastModifiedBy: Bob Brown
Software: Microsoft Excel
CreateDate: 2019:05:16 09:47:19
ModifyDate: 2019:05:16 10:00:11
Security: None
CodePage: Unicode (UTF-8)
Company: Microsoft
AppVersion: 12
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts:
  • Лист1
  • Лист2
  • Лист3
HeadingPairs:
  • Листы
  • 3
CompObjUserTypeLen: -
CompObjUserType: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
650
Monitored processes
619
Malicious processes
33
Suspicious processes
90

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start drop and start excel.exe wprgxyeqd79.exe exit.exe no specs cmd.exe ping.exe no specs rtegre.exe ping.exe no specs uninstall.exe veter1605_maps_10cr0.exe exit.exe no specs cmd.exe no specs reg.exe #RMS winserv.exe taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs conhost.exe no specs wmiprvse.exe no specs conhost.exe no specs svchost.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
180taskkill /f /im "rundll32.exe" C:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
180taskkill /f /im "rundll32.exe" C:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\fastprox.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\msctf.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\netutils.dll
c:\windows\system32\wtsapi32.dll
252taskkill /f /im "rundll32.exe" C:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
276taskkill /f /im "rundll32.exe" C:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
276taskkill /f /im "rundll32.exe" C:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\fastprox.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\msctf.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\netutils.dll
c:\windows\system32\wtsapi32.dll
280taskkill /f /im "rundll32.exe" C:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
280taskkill /f /im "rundll32.exe" C:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\fastprox.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\msctf.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\netutils.dll
c:\windows\system32\wtsapi32.dll
296taskkill /f /im "rundll32.exe" C:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
312taskkill /f /im "rundll32.exe" C:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
312taskkill /f /im "rundll32.exe" C:\Windows\system32\taskkill.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\fastprox.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\msctf.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\netutils.dll
c:\windows\system32\wtsapi32.dll
Total events
2 508
Read events
2 446
Write events
55
Delete events
7

Modification events

(PID) Process:(2860) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:writeName:$m=
Value:
246D3D002C0B0000010000000000000000000000
(PID) Process:(2860) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
Off
(PID) Process:(2860) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(2860) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel
Operation:writeName:MTTT
Value:
2C0B00009AD8E853150FD50100000000
(PID) Process:(2860) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:delete valueName:$m=
Value:
246D3D002C0B0000010000000000000000000000
(PID) Process:(2860) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems
Operation:delete keyName:
Value:
(PID) Process:(2860) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency
Operation:delete keyName:
Value:
(PID) Process:(2860) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2860) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2860) EXCEL.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\DocumentRecovery\121372
Operation:writeName:121372
Value:
040000002C0B00003900000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C00620069006C006C0020006E006F0074006900630065002000300035002E0032003000310039002E0078006C007300000000002200000043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C004C006F00630061006C005C00540065006D0070005C000100000000000000D0834255150FD501721312007213120000000000AC020000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Executable files
11
Suspicious files
1
Text files
8
Unknown types
1

Dropped files

PID
Process
Filename
Type
2860EXCEL.EXEC:\Users\admin\AppData\Local\Temp\CVRD95.tmp.cvr —
MD5:—
SHA256:—
1140rtegre.exeC:\Users\admin\AppData\Local\Temp\{0534D1EF-F352-4B04-97D1-64B48896BBBA}\254523652.dll —
MD5:—
SHA256:—
756wprgxyeqd79.exeC:\Users\admin\AppData\Local\Temp\exit.exeexecutable
MD5:—
SHA256:—
3224uninstall.exeC:\ProgramData\Windows Anytime Upgrade\settings.datbinary
MD5:—
SHA256:—
1140rtegre.exeC:\Users\admin\AppData\Local\Temp\{0534D1EF-F352-4B04-97D1-64B48896BBBA}\tempsqlite
MD5:—
SHA256:—
1140rtegre.exeC:\Users\admin\AppData\Local\Temp\{0534D1EF-F352-4B04-97D1-64B48896BBBA}\logtext
MD5:—
SHA256:—
756wprgxyeqd79.exeC:\Users\admin\AppData\Local\Temp\i.cmdtext
MD5:—
SHA256:—
756wprgxyeqd79.exeC:\Users\admin\AppData\Local\Temp\veter1605_MAPS_10cr0.exeexecutable
MD5:—
SHA256:—
3224uninstall.exeC:\ProgramData\Windows Anytime Upgrade\exit.exeexecutable
MD5:—
SHA256:—
2860EXCEL.EXEC:\Users\Public\rtegre.exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
27
TCP/UDP connections
43
DNS requests
7
Threats
87

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1140
rtegre.exe
GET
—
216.239.90.19:80
http://216.239.90.19/tor/server/fp/dee57876ed1516f1317fbb85d799f5bd52128975
CA
—
—
suspicious
1140
rtegre.exe
GET
—
51.15.72.30:80
http://51.15.72.30/tor/server/fp/e8ed405e47a477d92d9efb201fadf28ff7fbaf5d
FR
—
—
suspicious
1140
rtegre.exe
GET
—
66.111.2.131:9030
http://66.111.2.131:9030/tor/status-vote/current/consensus
US
—
—
suspicious
1140
rtegre.exe
GET
—
192.99.54.193:80
http://192.99.54.193/tor/server/fp/592031cfdba17dd46e1e365e6c60ad1f81655033
CA
—
—
suspicious
1140
rtegre.exe
GET
—
216.127.173.78:80
http://216.127.173.78/tor/server/fp/5af9e9cc5903f11f6d6aa601eb212e569ae66c92
US
—
—
malicious
1140
rtegre.exe
GET
—
82.165.247.47:80
http://82.165.247.47/tor/server/fp/bc7acfac04854c77167c7d66b7e471314ed8c410
DE
—
—
suspicious
1140
rtegre.exe
GET
—
51.158.113.105:80
http://51.158.113.105/tor/server/fp/bc7acfac04854c77167c7d66b7e471314ed8c410
GB
—
—
unknown
1140
rtegre.exe
GET
—
66.155.4.213:80
http://66.155.4.213/tor/server/fp/9717573c14efd2f04abc09824b083118a05aa92d
CA
—
—
suspicious
1140
rtegre.exe
GET
—
185.26.127.24:80
http://185.26.127.24/tor/server/fp/22e975935ba77ea59a28ea1aa8387f906034fcbe
LU
—
—
suspicious
1140
rtegre.exe
GET
—
47.151.140.106:80
http://47.151.140.106/tor/server/fp/d111ca928084a907d8be9b3f1e1d05227a5fbbe0
US
—
—
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2860
EXCEL.EXE
47.245.58.124:443
kentona.su
—
US
suspicious
2864
winserv.exe
217.12.201.159:5655
—
ITL Company
NL
suspicious
1140
rtegre.exe
66.111.2.131:9030
—
The New York Internet Company
US
suspicious
1140
rtegre.exe
199.58.81.140:80
—
Koumbit
CA
suspicious
1140
rtegre.exe
54.235.124.112:443
api.ipify.org
Amazon.com, Inc.
US
suspicious
1140
rtegre.exe
23.129.64.157:80
—
—
US
malicious
1140
rtegre.exe
31.31.78.49:443
—
WEDOS Internet, a.s.
CZ
suspicious
1140
rtegre.exe
129.6.15.28:13
time-a.nist.gov
National Bureau of Standards
US
unknown
1140
rtegre.exe
216.127.173.78:80
—
MULTACOM CORPORATION
US
malicious
—
—
216.239.90.19:80
—
Concorde inc.
CA
suspicious

DNS requests

Domain
IP
Reputation
kentona.su
  • 47.245.58.124
malicious
www.cloudflare.com
  • 104.17.210.9
  • 104.17.209.9
whitelisted
api.ipify.org
  • 54.235.124.112
  • 50.19.247.198
  • 50.16.229.140
  • 23.21.121.219
  • 54.225.171.237
  • 107.22.215.20
  • 54.243.147.226
  • 54.243.198.12
shared
time-a.nist.gov
  • 129.6.15.28
whitelisted
time-a-g.nist.gov
  • 129.6.15.28
unknown
dns.msftncsi.com
  • 131.107.255.255
shared

Threats

PID
Process
Class
Message
1048
svchost.exe
Potentially Bad Traffic
ET DNS Query for .su TLD (Soviet Union) Often Malware Related
1140
rtegre.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 550
1140
rtegre.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 298
1140
rtegre.exe
Misc activity
SUSPICIOUS [PTsecurity] ipify.org External IP Check
1140
rtegre.exe
Misc activity
SUSPICIOUS [PTsecurity] ipify.org External IP Check
1140
rtegre.exe
Misc Attack
ET TOR Known Tor Exit Node Traffic group 58
1140
rtegre.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 58
1140
rtegre.exe
Potential Corporate Privacy Violation
ET P2P Tor Get Server Request
1140
rtegre.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 448
1140
rtegre.exe
Misc Attack
ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 356
6 ETPRO signatures available at the full report
Process
Message
winserv.exe
Error WTSQueryUserToken #1314
winserv.exe
20-05-2019_15:07:31:457#T:Error #20 @2
winserv.exe
20-05-2019_15:08:09:801#T:Msg Size: 104
winserv.exe
20-05-2019_15:08:09:801#T:Msg code: 3
winserv.exe
20-05-2019_15:08:09:801#T:MSG_KEEP_ALIVE
winserv.exe
MSG_KEEP_ALIVE
winserv.exe
20-05-2019_15:08:41:239#T:Msg Size: 104
winserv.exe
20-05-2019_15:08:41:239#T:Msg code: 3
winserv.exe
20-05-2019_15:08:41:239#T:MSG_KEEP_ALIVE
winserv.exe
MSG_KEEP_ALIVE
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
bill notice 05.2019.xls