analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

10.exe

Full analysis: https://app.any.run/tasks/66a27848-3710-42a5-a5c0-ffd4bb0c7c74
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 22, 2019, 21:31:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

2C4E9FC74EF957BE4806CF746E6A502B

SHA1:

33EB2040823531BE784A6485E2A5F54371A0E4EB

SHA256:

C5C2E1D49E8319D8AD3C36C794A7F73EA6F83BCAA14FB66DF03571E5586C2F2C

SSDEEP:

24576:RycS9PP/bOtgUWDAiIqyEbsucDdooZ1s9ZtODv/oDTE/EbKBXLhG7x1qTVRwN2:RfStKwIFeMBSZwDYvE//BoLqTVRj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SUPERAntiSpyware[1].exe (PID: 3024)
      • REGSVR32.EXE (PID: 2360)
      • SASCORE.EXE (PID: 3716)

    • Application was dropped or rewritten from another process

      • SASCORE.EXE (PID: 3716)
      • SASCORE.EXE (PID: 2492)
      • SSUPDATE.EXE (PID: 2440)
      • SUPERAntiSpyware.exe (PID: 3628)
      • sas_enum_cookies.exe (PID: 2216)

    • Registers / Runs the DLL via REGSVR32.EXE

      • SUPERAntiSpyware[1].exe (PID: 3024)

    • Downloads executable files from the Internet

      • iexplore.exe (PID: 2512)

    • Changes the autorun value in the registry

      • SASCORE.EXE (PID: 3716)

    • Loads the Task Scheduler DLL interface

      • SUPERAntiSpyware.exe (PID: 3628)

    • Loads the Task Scheduler COM API

      • SUPERAntiSpyware.exe (PID: 3628)

    • Changes settings of System certificates

      • SUPERAntiSpyware.exe (PID: 3628)

  • SUSPICIOUS

    • Creates or modifies windows services

      • SASCORE.EXE (PID: 2492)
      • SUPERAntiSpyware[1].exe (PID: 3024)

    • Executable content was dropped or overwritten

      • SUPERAntiSpyware[1].exe (PID: 3024)

    • Creates a software uninstall entry

      • SUPERAntiSpyware[1].exe (PID: 3024)

    • Creates files in the program directory

      • SUPERAntiSpyware[1].exe (PID: 3024)
      • SUPERAntiSpyware[1].exe (PID: 3976)
      • SASCORE.EXE (PID: 3716)
      • SUPERAntiSpyware.exe (PID: 3628)

    • Application launched itself

      • SUPERAntiSpyware[1].exe (PID: 3976)

    • Creates COM task schedule object

      • REGSVR32.EXE (PID: 2360)

    • Creates files in the user directory

      • SUPERAntiSpyware[1].exe (PID: 3024)
      • SASCORE.EXE (PID: 3716)
      • SUPERAntiSpyware.exe (PID: 3628)

    • Removes files from Windows directory

      • SUPERAntiSpyware.exe (PID: 3628)
      • SASCORE.EXE (PID: 3716)

    • Creates files in the Windows directory

      • SUPERAntiSpyware.exe (PID: 3628)

    • Reads the cookies of Google Chrome

      • SUPERAntiSpyware.exe (PID: 3628)

    • Reads Internet Cache Settings

      • sas_enum_cookies.exe (PID: 2216)

    • Reads the cookies of Mozilla Firefox

      • SUPERAntiSpyware.exe (PID: 3628)

    • Uses NETSH.EXE for network configuration

      • SUPERAntiSpyware.exe (PID: 3628)

    • Searches for installed software

      • SASCORE.EXE (PID: 3716)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 4036)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2512)

    • Changes internet zones settings

      • iexplore.exe (PID: 4036)

    • Dropped object may contain Bitcoin addresses

      • SUPERAntiSpyware[1].exe (PID: 3024)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2512)
      • iexplore.exe (PID: 4036)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (50)
.exe | InstallShield setup (19.6)
.exe | Win32 EXE PECompact compressed (generic) (18.9)
.exe | Win32 Executable Delphi generic (6.4)
.exe | Win32 Executable (generic) (2)

EXIF

EXE

ProductVersion: 1.0.0.0
ProductName: Build with Mess Box DVI
OriginalFileName: -
LegalTrademarks: -
LegalCopyright: -
InternalName: -
FileVersion: 1.0.0.0
FileDescription:
CompanyName:
CharacterSet: Windows, Latin1
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.0.0.0
FileVersionNumber: 1.0.0.0
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: -
OSVersion: 4
EntryPoint: 0x19426c
UninitializedDataSize: -
InitializedDataSize: 238080
CodeSize: 1651712
LinkerVersion: 2.25
PEType: PE32
TimeStamp: 1992:06:20 00:22:17+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 19-Jun-1992 22:22:17
Detected languages:
  • English - United States
  • Russian - Russia
CompanyName: -
FileDescription: -
FileVersion: 1.0.0.0
InternalName: -
LegalCopyright: -
LegalTrademarks: -
OriginalFilename: -
ProductName: Build with Mess Box DVI
ProductVersion: 1.0.0.0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0050
Pages in file: 0x0002
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x000F
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x001A
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000100

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 8
Time date stamp: 19-Jun-1992 22:22:17
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_BYTES_REVERSED_HI
  • IMAGE_FILE_BYTES_REVERSED_LO
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
CODE
0x00001000
0x0019330C
0x00193400
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.5522
DATA
0x00195000
0x00006D94
0x00006E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
6.14906
BSS
0x0019C000
0x003D305D
0x00000000
IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.idata
0x00570000
0x00003184
0x00003200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.01843
.tls
0x00574000
0x00000110
0x00000000
IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rdata
0x00575000
0x00000018
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED
0.20692
.reloc
0x00576000
0x000166F0
0x00016800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED
6.72826
.rsrc
0x0058D000
0x00019660
0x00019800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_SHARED
5.4975

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.95218
581
UNKNOWN
UNKNOWN
RT_MANIFEST
2
2.80231
308
UNKNOWN
UNKNOWN
RT_CURSOR
3
3.00046
308
UNKNOWN
UNKNOWN
RT_CURSOR
4
2.56318
308
UNKNOWN
UNKNOWN
RT_CURSOR
5
2.6949
308
UNKNOWN
UNKNOWN
RT_CURSOR
6
2.62527
308
UNKNOWN
UNKNOWN
RT_CURSOR
7
2.91604
308
UNKNOWN
UNKNOWN
RT_CURSOR
50
2.80295
744
UNKNOWN
UNKNOWN
RT_ICON
3682
2.04342
76
UNKNOWN
UNKNOWN
RT_STRING
3683
3.42796
298
UNKNOWN
UNKNOWN
RT_STRING

Imports

advapi32.dll
comctl32.dll
comdlg32.dll
gdi32.dll
kernel32.dll
msimg32.dll
ole32.dll
oleaut32.dll
shell32.dll
user32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
60
Monitored processes
15
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start 10.exe no specs iexplore.exe iexplore.exe superantispyware[1].exe no specs superantispyware[1].exe sascore.exe no specs sascore.exe regsvr32.exe no specs superantispyware.exe ssupdate.exe no specs cacls.exe no specs sas_enum_cookies.exe no specs cacls.exe no specs netsh.exe netsh.exe

Process information

PID
CMD
Path
Indicators
Parent process
3128"C:\Users\admin\AppData\Local\Temp\10.exe" C:\Users\admin\AppData\Local\Temp\10.exe—explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
Exit code:
0
Version:
1.0.0.0
4036"C:\Program Files\Internet Explorer\iexplore.exe" C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
2512"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:4036 CREDAT:71937C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
3976"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\SUPERAntiSpyware[1].exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\SUPERAntiSpyware[1].exe—iexplore.exe
User:
admin
Company:
SUPERAntiSpyware
Integrity Level:
MEDIUM
Description:
SUPERAntiSpyware Free Edition Setup
Exit code:
0
Version:
8, 0, 0, 1026
3024"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\SUPERAntiSpyware[1].exe" /runasadmin C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\SUPERAntiSpyware[1].exe
SUPERAntiSpyware[1].exe
User:
admin
Company:
SUPERAntiSpyware
Integrity Level:
HIGH
Description:
SUPERAntiSpyware Free Edition Setup
Exit code:
0
Version:
8, 0, 0, 1026
2492"C:\Program Files\SUPERAntiSpyware\SASCORE.EXE" -install -name:!SASCORE -display:"SAS Core Service" -description:"SUPERAntiSpyware Core Service" -pipe:sascoreservicepipeC:\Program Files\SUPERAntiSpyware\SASCORE.EXE—SUPERAntiSpyware[1].exe
User:
admin
Company:
SUPERAntiSpyware.com
Integrity Level:
HIGH
Description:
Core Service
Exit code:
0
Version:
6, 0, 0, 1082
3716"C:\Program Files\SUPERAntiSpyware\SASCORE.EXE"C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
services.exe
User:
SYSTEM
Company:
SUPERAntiSpyware.com
Integrity Level:
SYSTEM
Description:
Core Service
Version:
6, 0, 0, 1082
2360"C:\Windows\system32\REGSVR32.EXE" /s "C:\Program Files\SUPERAntiSpyware\SASCTXMN.DLL"C:\Windows\system32\REGSVR32.EXE—SUPERAntiSpyware[1].exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3628"C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
SUPERAntiSpyware[1].exe
User:
admin
Company:
SUPERAntiSpyware
Integrity Level:
MEDIUM
Description:
SUPERAntiSpyware Application
Version:
8, 0, 0, 1026
2440"C:\Program Files\SUPERAntiSpyware\SSUPDATE.EXE" *8.0.1026!{06CD588E-4BD7-4ab9-9938-0949231C9484}C:\Program Files\SUPERAntiSpyware\SSUPDATE.EXE—SUPERAntiSpyware.exe
User:
admin
Company:
SUPERAntiSpyware.com
Integrity Level:
MEDIUM
Description:
SUPERAntiSpyware Update Application
Exit code:
4294967295
Version:
1, 0, 0, 1080
Total events
22 499
Read events
22 159
Write events
0
Delete events
0

Modification events

No data
Executable files
21
Suspicious files
59
Text files
22
Unknown types
41

Dropped files

PID
Process
Filename
Type
312810.exeC:\Users\admin\AppData\Local\Temp\DKSJHKJHSD8976876.Bmp —
MD5:—
SHA256:—
4036iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9ZEWH8D\favicon[1].ico —
MD5:—
SHA256:—
4036iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico —
MD5:—
SHA256:—
2512iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\OCDM6JB6\SUPERAntiSpyware[1].exe —
MD5:—
SHA256:—
4036iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0UU90R59\SUPERAntiSpyware[1].exe —
MD5:—
SHA256:—
3976SUPERAntiSpyware[1].exeC:\ProgramData\SUPERSetup\setupvars-journal —
MD5:—
SHA256:—
312810.exeC:\Users\admin\AppData\Local\Temp\MSB4Res1\Sprites\logo1.jpgimage
MD5:F4A8C0990FEE1CCA66E8BC046E87CFE1
SHA256:71953D2029BDA24378185626F7E853EB469DC6936D4FB789B84982832ED634D3
4036iexplore.exeC:\Users\admin\AppData\Local\Temp\StructuredQuery.logtext
MD5:EE3B45A1D589824553B9AF1136D80836
SHA256:523E43B133E179E7588B9E125B74C2FBE448CD05320AD54799E8916034A7CE62
2512iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\History\Low\History.IE5\MSHist012019012220190123\index.datdat
MD5:5BF2C07E250ECA1B55662BC2D7422432
SHA256:1A504314A2222EFAE73912BB61081EF07F904BC003275CDC8C02AD4B4F0013C8
312810.exeC:\Users\admin\AppData\Local\Temp\MSB4Res1\Buttons\Default.pcximage
MD5:BD95BE46ECDAA507AC2ACFFC56B1A781
SHA256:DD07EC5E2023340480A948C1F57ABC65475A6E637BE0E1A200D93CF5EB8CE539
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
27
TCP/UDP connections
17
DNS requests
6
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3628
SUPERAntiSpyware.exe
GET
200
74.201.114.183:80
http://events.webflowmetrics.com/metrics.asmx/RecordEvent?sEventName=SASRPI_Expired&sEventData=tag:SUPERAntiSpyware.exe_V6_Unknown%7Czo-sasref
US
xml
80 b
suspicious
3628
SUPERAntiSpyware.exe
GET
200
74.201.114.183:80
http://events.webflowmetrics.com/metrics.asmx/RecordEvent?sEventName=SASRPI_TrialOffer&sEventData=tag:SUPERAntiSpyware.exe_V6_Accepted%7Czo-sasref
US
xml
80 b
suspicious
2512
iexplore.exe
GET
200
93.184.221.133:80
http://cdn.superantispyware.com/SUPERAntiSpyware.exe
US
executable
36.0 Mb
whitelisted
3628
SUPERAntiSpyware.exe
GET
200
74.201.114.183:80
http://events.webflowmetrics.com/metrics.asmx/RecordEvent?sEventName=SASRPI_Expired&sEventData=tag:SUPERAntiSpyware.exe_V6_Declined%7Czo-sasref
US
xml
80 b
suspicious
3628
SUPERAntiSpyware.exe
POST
200
74.201.114.185:80
http://www.superantispyware.com/application.php
US
text
16 b
suspicious
3024
SUPERAntiSpyware[1].exe
GET
200
74.201.114.183:80
http://events.webflowmetrics.com/metrics.asmx/RecordEvent?sEventName=SASRPI_Install&sEventData=tag:SUPERAntiSpywareChrome.exe_Chrome_V5_NotShown:2|zo-sasref
US
xml
80 b
suspicious
3628
SUPERAntiSpyware.exe
POST
200
74.201.114.185:80
http://www.superantispyware.com/application.php
US
text
125 b
suspicious
3628
SUPERAntiSpyware.exe
GET
200
74.201.114.183:80
http://events.webflowmetrics.com/metrics.asmx/RecordEvent?sEventName=SASRPI_Expired&sEventData=tag:SUPERAntiSpyware.exe_V6_Unknown%7Czo-sasref
US
xml
80 b
suspicious
3628
SUPERAntiSpyware.exe
POST
200
74.201.114.185:80
http://www.superantispyware.com/application.php
US
text
2 b
suspicious
3628
SUPERAntiSpyware.exe
GET
200
93.184.221.240:80
http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
US
compressed
55.2 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4036
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3628
SUPERAntiSpyware.exe
91.199.212.52:80
crt.comodoca.com
Comodo CA Ltd
GB
suspicious
3628
SUPERAntiSpyware.exe
74.201.114.185:80
www.superantispyware.com
Internap Network Services Corporation
US
unknown
3628
SUPERAntiSpyware.exe
93.184.221.240:80
www.download.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2512
iexplore.exe
93.184.221.133:80
cdn.superantispyware.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3024
SUPERAntiSpyware[1].exe
74.201.114.183:80
events.webflowmetrics.com
Internap Network Services Corporation
US
unknown
3628
SUPERAntiSpyware.exe
74.201.114.183:80
events.webflowmetrics.com
Internap Network Services Corporation
US
unknown

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
cdn.superantispyware.com
  • 93.184.221.133
whitelisted
events.webflowmetrics.com
  • 74.201.114.183
suspicious
www.superantispyware.com
  • 74.201.114.185
suspicious
www.download.windowsupdate.com
  • 93.184.221.240
whitelisted
crt.comodoca.com
  • 91.199.212.52
whitelisted

Threats

PID
Process
Class
Message
2512
iexplore.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
Process
Message
SUPERAntiSpyware.exe
start menu folder
SUPERAntiSpyware.exe
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
10.exe