URL:

https://www.yuanta.com.tw/eYuanta/securities/ApOrder

Full analysis: https://app.any.run/tasks/30be60d9-4212-44b0-b94a-3f04b9268bc7
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: July 03, 2020, 10:19:01
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

33C3B5F37F61AF0F87398864172F841C

SHA1:

06AE93BD321A390F24D4CCEC49909B2310703AB2

SHA256:

C897BE9DD4E09AD3875F5940B97E2B5A4C338645DE27DA6F1C21FD43C7CA2540

SSDEEP:

3:N8DSL4bTLdtUpPkVqmXn:2OL4rdtUpcVqmXn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Downloads executable files from the Internet

      • chrome.exe (PID: 3868)

    • Application was dropped or rewritten from another process

      • YESWIN.exe (PID: 2996)
      • YESTool.exe (PID: 4084)
      • YESWIN.exe (PID: 1592)
      • YESHost.EXE (PID: 3196)
      • YESHost.EXE (PID: 2144)

    • Loads dropped or rewritten executable

      • YESHost.EXE (PID: 3196)
      • YESHost.EXE (PID: 2144)
      • YESTool.exe (PID: 4084)

  • SUSPICIOUS

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 1312)

    • Starts Microsoft Installer

      • chrome.exe (PID: 1312)

    • Executed as Windows Service

      • vssvc.exe (PID: 3056)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3936)
      • YESHost.EXE (PID: 3196)
      • YESWIN.exe (PID: 2996)

    • Reads Internet Cache Settings

      • YESWIN.exe (PID: 2996)
      • YESWIN.exe (PID: 1592)

    • Reads Environment values

      • YESWIN.exe (PID: 1592)
      • YESHost.EXE (PID: 2144)
      • YESWIN.exe (PID: 2996)
      • YESHost.EXE (PID: 3196)

    • Reads internet explorer settings

      • YESWIN.exe (PID: 1592)
      • YESWIN.exe (PID: 2996)
      • YESHost.EXE (PID: 3196)
      • YESHost.EXE (PID: 2144)

  • INFO

    • Reads the hosts file

      • chrome.exe (PID: 1312)
      • chrome.exe (PID: 3868)

    • Modifies the open verb of a shell class

      • chrome.exe (PID: 1312)

    • Reads Internet Cache Settings

      • chrome.exe (PID: 1312)

    • Application launched itself

      • chrome.exe (PID: 1312)
      • msiexec.exe (PID: 3936)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 840)
      • MsiExec.exe (PID: 2820)

    • Creates files in the program directory

      • msiexec.exe (PID: 3936)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3936)

    • Searches for installed software

      • msiexec.exe (PID: 3936)

    • Manual execution by user

      • YESWIN.exe (PID: 2996)
      • YESWIN.exe (PID: 1592)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 3056)

    • Reads settings of System Certificates

      • YESTool.exe (PID: 4084)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
77
Monitored processes
37
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msiexec.exe no specs msiexec.exe msiexec.exe no specs chrome.exe no specs vssvc.exe no specs msiexec.exe no specs yeswin.exe yeshost.exe yeswin.exe yeshost.exe yestool.exe

Process information

PID
CMD
Path
Indicators
Parent process
584"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=960,8433384966294522136,16919312675289632293,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=12752273101685825078 --mojo-platform-channel-handle=4152 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
780"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=960,8433384966294522136,16919312675289632293,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=7687390783122462839 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2240 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
840C:\Windows\system32\MsiExec.exe -Embedding F5AAC9B7152E32DBD9E9CE8C27A5D096 CC:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
952"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=960,8433384966294522136,16919312675289632293,131072 --enable-features=PasswordImport --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=1543802586065362615 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2272 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
976"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=960,8433384966294522136,16919312675289632293,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=18257463813383598073 --mojo-platform-channel-handle=3340 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1088"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=960,8433384966294522136,16919312675289632293,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=16505163499330791835 --mojo-platform-channel-handle=3760 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1136"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=watcher --main-thread-id=304 --on-initialized-event-handle=324 --parent-handle=328 /prefetch:6C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1312"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.yuanta.com.tw/eYuanta/securities/ApOrder"C:\Program Files\Google\Chrome\Application\chrome.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1592"C:\Yuanta\yeswin\YESWIN.exe" C:\Yuanta\yeswin\YESWIN.exe
explorer.exe
User:
admin
Company:
元大證券
Integrity Level:
MEDIUM
Description:
yeswin 越是贏
Exit code:
0
Version:
3.0.7487.29659
Modules
Images
c:\yuanta\yeswin\yeswin.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1968"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=960,8433384966294522136,16919312675289632293,131072 --enable-features=PasswordImport --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=KAAAAAAAAADgAAAgAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --service-request-channel-token=1328298662773619059 --mojo-platform-channel-handle=3892 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
Total events
2 749
Read events
1 914
Write events
813
Delete events
22

Modification events

(PID) Process:(1312) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(1312) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(1312) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(1312) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(1312) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(1136) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:1312-13238245156238875
Value:
259
(PID) Process:(1312) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(1312) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(1312) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3120-13213713943555664
Value:
0
(PID) Process:(1312) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
59
Suspicious files
77
Text files
568
Unknown types
46

Dropped files

PID
Process
Filename
Type
1312chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5EFF0625-520.pma —
MD5:—
SHA256:—
1312chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old —
MD5:—
SHA256:—
1312chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old —
MD5:—
SHA256:—
1312chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF109ee2.TMP —
MD5:—
SHA256:—
1312chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\75f5098d-0c4c-44fc-8c61-10f34efd1a62.tmp —
MD5:—
SHA256:—
1312chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000028.dbtmp —
MD5:—
SHA256:—
1312chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase\LOG.old~RF109f30.TMPtext
MD5:—
SHA256:—
1312chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Last Tabsbinary
MD5:—
SHA256:—
1312chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old —
MD5:—
SHA256:—
1312chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old~RF10a0d6.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
87
TCP/UDP connections
58
DNS requests
37
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3868
chrome.exe
GET
200
173.194.182.136:80
http://r3---sn-hpa7znsz.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvY2Y1QUFXUjZlVjI5UldyLVpDTFJFcEx6QQ/7719.805.0.2_pkedcjkdefgpdelpbcmbmeomcjbeemfm.crx?cms_redirect=yes&mh=Nf&mip=185.183.105.213&mm=28&mn=sn-hpa7znsz&ms=nvh&mt=1593771493&mv=m&mvi=2&pl=24&shardbypass=yes
US
crx
823 Kb
whitelisted
3868
chrome.exe
GET
200
203.69.51.222:80
http://ys.yuanta.com.tw/ysite/yeswin/install/yeswin.msi
TW
executable
7.14 Mb
suspicious
2996
YESWIN.exe
GET
200
203.69.51.222:80
http://ys.yuanta.com.tw/YSite/YESWIN/Update/AGENT/FONTAWESOME.WPF.DLL.ZIP?637293720638121172
TW
compressed
140 Kb
suspicious
2996
YESWIN.exe
GET
200
203.69.51.222:80
http://ys.yuanta.com.tw/YSite/YESWIN/Update/AGENT/NEWTONSOFT.JSON.DLL.ZIP?637293720657027422
TW
compressed
237 Kb
suspicious
2996
YESWIN.exe
GET
200
203.69.51.222:80
http://ys.yuanta.com.tw/yeswin_notice/notice.aspx
TW
html
1.97 Kb
suspicious
2996
YESWIN.exe
GET
200
203.69.51.222:80
http://ys.yuanta.com.tw/YSite/YESWIN/Update/AGENT/NLOG.CONFIG.ZIP?637293720663902422
TW
compressed
1.20 Kb
suspicious
2996
YESWIN.exe
GET
200
203.69.51.222:80
http://ys.yuanta.com.tw/YSite/YESWIN/Update/MODULESET/YESWIN/CONFIGURE/SERVICES.XML.ZIP?637293720767964922
TW
compressed
810 b
suspicious
2996
YESWIN.exe
GET
200
203.69.51.222:80
http://ys.yuanta.com.tw/YSite/YESWIN/Update/AGENT/YSTRADER.AGENT.EXE.CONFIG.ZIP?637293720682496172
TW
compressed
354 b
suspicious
2996
YESWIN.exe
GET
200
203.69.51.222:80
http://ys.yuanta.com.tw/YSite/YESWIN/Update/AGENT/NLOG.DLL.ZIP?637293720667027422
TW
compressed
309 Kb
suspicious
2996
YESWIN.exe
GET
200
203.69.51.222:80
http://ys.yuanta.com.tw/YSite/YESWIN/Update/MODULESET/YESWIN/CONFIGURE/NEWWAR.XML.ZIP?637293720764839922
TW
compressed
233 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3868
chrome.exe
172.217.22.4:443
www.google.com
Google Inc.
US
whitelisted
3868
chrome.exe
172.217.16.195:443
ssl.gstatic.com
Google Inc.
US
whitelisted
3868
chrome.exe
172.217.18.170:443
translate.googleapis.com
Google Inc.
US
whitelisted
3868
chrome.exe
203.69.51.226:443
jdata.yuanta.com.tw
Data Communication Business Group
TW
unknown
3868
chrome.exe
172.217.21.206:80
redirector.gvt1.com
Google Inc.
US
whitelisted
3868
chrome.exe
172.217.23.136:443
www.googletagmanager.com
Google Inc.
US
whitelisted
3868
chrome.exe
172.217.23.161:443
clients2.googleusercontent.com
Google Inc.
US
whitelisted
—
—
172.217.21.206:80
redirector.gvt1.com
Google Inc.
US
whitelisted
3868
chrome.exe
173.194.182.136:80
r3---sn-hpa7znsz.gvt1.com
Google Inc.
US
whitelisted
3868
chrome.exe
172.217.22.14:443
clients1.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.yuanta.com.tw
  • 203.69.51.72
unknown
clientservices.googleapis.com
  • 172.217.22.3
whitelisted
accounts.google.com
  • 216.58.207.77
shared
www.googletagmanager.com
  • 172.217.23.136
whitelisted
www.google.com
  • 172.217.22.4
malicious
jdata.yuanta.com.tw
  • 203.69.51.226
unknown
www.google-analytics.com
  • 216.58.212.174
whitelisted
ssl.gstatic.com
  • 172.217.16.195
whitelisted
stats.g.doubleclick.net
  • 142.250.13.157
  • 142.250.13.154
  • 142.250.13.155
  • 142.250.13.156
whitelisted
clients1.google.com
  • 172.217.22.14
whitelisted

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
POLICY [PTsecurity] Executable application_x-msi Download
Process
Message
YESHost.EXE
!Aura OS Windows 7 Professional SP1
YESHost.EXE
!Aura NF 4.7.03062
YESHost.EXE
!Aura OV 6.1.7601
YESHost.EXE
!Aura NR 4.0.30319
YESHost.EXE
!Aura OL en-US
YESHost.EXE
!Aura SC 1
YESHost.EXE
!Rate CR 3.0
YESHost.EXE
!Aura SX 1280
YESHost.EXE
!Rate CP 3.0*04
YESHost.EXE
!Rate CF 3.5
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.yuanta.com.tw/eYuanta/securities/ApOrder