URL:

https://www.3dsexvilla.com/?ts=3&aid=9681504&pr=8

Full analysis: https://app.any.run/tasks/71440a31-5d53-4f41-a72d-858f552ca749
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 19, 2022, 23:03:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

D75691A42BFF7A105DA8D8D7229BC4A8

SHA1:

1996AB87199F29B71864E6DA96DA34A9505C8C06

SHA256:

CDE70BD35F4BB5687C62B2835C1BE33A950DF46A4697493FE65232D8E7EA8FCE

SSDEEP:

3:N8DSLGW4sJlKIBGDWn:2OLG9oQqGDWn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • 3DSexVilla2Installer.exe (PID: 2520)
      • launcher_vs2012_sp4_vcredist_x86.exe (PID: 868)
      • launcher_vs2012_sp4_vcredist_x64.exe (PID: 2696)

    • Application was dropped or rewritten from another process

      • 3DSexVilla2Installer.exe (PID: 3984)
      • 3DSexVilla2Installer.exe (PID: 2520)
      • launcher_vs2010_sp1_vcredist_x64.exe (PID: 3756)
      • Setup.exe (PID: 3696)
      • launcher_vs2012_sp4_vcredist_x86.exe (PID: 868)
      • launcher_vs2012_sp4_vcredist_x86.exe (PID: 1940)
      • LauncherStarter.exe (PID: 868)
      • launcher_vs2012_sp4_vcredist_x64.exe (PID: 3736)
      • dxsetup.exe (PID: 3424)
      • Launcher.exe (PID: 2324)
      • launcher_vs2012_sp4_vcredist_x64.exe (PID: 2696)
      • crash_service.exe (PID: 2436)
      • BionicWeb.exe (PID: 1352)

    • Loads dropped or rewritten executable

      • 3DSexVilla2Installer.exe (PID: 2520)
      • Setup.exe (PID: 3696)
      • launcher_vs2012_sp4_vcredist_x86.exe (PID: 868)
      • launcher_vs2012_sp4_vcredist_x64.exe (PID: 2696)
      • RegAsm.exe (PID: 2212)
      • LauncherStarter.exe (PID: 868)
      • dxsetup.exe (PID: 3424)
      • Launcher.exe (PID: 2324)
      • BionicWeb.exe (PID: 1352)

    • Actions looks like stealing of personal data

      • launcher_vs2010_sp1_vcredist_x64.exe (PID: 3756)

    • Changes the autorun value in the registry

      • launcher_vs2012_sp4_vcredist_x86.exe (PID: 1940)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 1820)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 1820)
      • iexplore.exe (PID: 3660)
      • 3DSexVilla2Installer.exe (PID: 2520)
      • launcher_vs2010_sp1_vcredist_x64.exe (PID: 3756)
      • launcher_vs2012_sp4_vcredist_x86.exe (PID: 868)
      • launcher_vs2012_sp4_vcredist_x86.exe (PID: 1940)
      • msiexec.exe (PID: 3048)
      • launcher_vs2012_sp4_vcredist_x64.exe (PID: 2696)
      • dxsetup.exe (PID: 3424)
      • LauncherStarter.exe (PID: 868)
      • Launcher.exe (PID: 2324)

    • Checks supported languages

      • 3DSexVilla2Installer.exe (PID: 2520)
      • launcher_vs2010_sp1_vcredist_x64.exe (PID: 3756)
      • Setup.exe (PID: 3696)
      • launcher_vs2012_sp4_vcredist_x86.exe (PID: 1940)
      • launcher_vs2012_sp4_vcredist_x86.exe (PID: 868)
      • launcher_vs2012_sp4_vcredist_x64.exe (PID: 3736)
      • launcher_vs2012_sp4_vcredist_x64.exe (PID: 2696)
      • dxsetup.exe (PID: 3424)
      • RegAsm.exe (PID: 2212)
      • LauncherStarter.exe (PID: 868)
      • Launcher.exe (PID: 2324)
      • crash_service.exe (PID: 2436)
      • BionicWeb.exe (PID: 1352)

    • Reads the computer name

      • 3DSexVilla2Installer.exe (PID: 2520)
      • launcher_vs2010_sp1_vcredist_x64.exe (PID: 3756)
      • Setup.exe (PID: 3696)
      • launcher_vs2012_sp4_vcredist_x86.exe (PID: 868)
      • launcher_vs2012_sp4_vcredist_x86.exe (PID: 1940)
      • launcher_vs2012_sp4_vcredist_x64.exe (PID: 3736)
      • launcher_vs2012_sp4_vcredist_x64.exe (PID: 2696)
      • dxsetup.exe (PID: 3424)
      • RegAsm.exe (PID: 2212)
      • LauncherStarter.exe (PID: 868)
      • Launcher.exe (PID: 2324)
      • crash_service.exe (PID: 2436)

    • Drops a file with too old compile date

      • 3DSexVilla2Installer.exe (PID: 2520)
      • launcher_vs2010_sp1_vcredist_x64.exe (PID: 3756)
      • dxsetup.exe (PID: 3424)

    • Drops a file that was compiled in debug mode

      • 3DSexVilla2Installer.exe (PID: 2520)
      • launcher_vs2010_sp1_vcredist_x64.exe (PID: 3756)
      • launcher_vs2012_sp4_vcredist_x86.exe (PID: 868)
      • launcher_vs2012_sp4_vcredist_x86.exe (PID: 1940)
      • msiexec.exe (PID: 3048)
      • launcher_vs2012_sp4_vcredist_x64.exe (PID: 2696)
      • dxsetup.exe (PID: 3424)
      • LauncherStarter.exe (PID: 868)
      • Launcher.exe (PID: 2324)

    • Reads Environment values

      • launcher_vs2010_sp1_vcredist_x64.exe (PID: 3756)
      • vssvc.exe (PID: 488)
      • LauncherStarter.exe (PID: 868)
      • Launcher.exe (PID: 2324)

    • Reads CPU info

      • Setup.exe (PID: 3696)

    • Application launched itself

      • launcher_vs2012_sp4_vcredist_x86.exe (PID: 1940)
      • launcher_vs2012_sp4_vcredist_x64.exe (PID: 3736)

    • Searches for installed software

      • launcher_vs2012_sp4_vcredist_x86.exe (PID: 868)
      • launcher_vs2012_sp4_vcredist_x86.exe (PID: 1940)
      • launcher_vs2012_sp4_vcredist_x64.exe (PID: 2696)
      • dxsetup.exe (PID: 3424)
      • DllHost.exe (PID: 3720)

    • Executed as Windows Service

      • vssvc.exe (PID: 488)
      • msiexec.exe (PID: 3048)

    • Creates files in the program directory

      • launcher_vs2012_sp4_vcredist_x86.exe (PID: 1940)
      • 3DSexVilla2Installer.exe (PID: 2520)
      • Launcher.exe (PID: 2324)
      • LauncherStarter.exe (PID: 868)

    • Creates a software uninstall entry

      • launcher_vs2012_sp4_vcredist_x86.exe (PID: 1940)
      • msiexec.exe (PID: 3048)
      • 3DSexVilla2Installer.exe (PID: 2520)

    • Reads the Windows organization settings

      • msiexec.exe (PID: 3048)

    • Creates files in the Windows directory

      • msiexec.exe (PID: 3048)
      • dxsetup.exe (PID: 3424)

    • Reads Windows owner or organization settings

      • msiexec.exe (PID: 3048)

    • Creates files in the user directory

      • 3DSexVilla2Installer.exe (PID: 2520)
      • LauncherStarter.exe (PID: 868)
      • Launcher.exe (PID: 2324)

    • Changes default file association

      • 3DSexVilla2Installer.exe (PID: 2520)

    • Executed via COM

      • DllHost.exe (PID: 3720)
      • explorer.exe (PID: 2944)

    • Creates a directory in Program Files

      • 3DSexVilla2Installer.exe (PID: 2520)
      • Launcher.exe (PID: 2324)

    • Creates/Modifies COM task schedule object

      • RegAsm.exe (PID: 2212)
      • dxsetup.exe (PID: 3424)

    • Removes files from Windows directory

      • dxsetup.exe (PID: 3424)

    • Check for Java to be installed

      • Launcher.exe (PID: 2324)

  • INFO

    • Reads the computer name

      • iexplore.exe (PID: 3660)
      • iexplore.exe (PID: 1820)
      • vssvc.exe (PID: 488)
      • msiexec.exe (PID: 3048)
      • DllHost.exe (PID: 3720)
      • explorer.exe (PID: 4008)
      • explorer.exe (PID: 2944)
      • WISPTIS.EXE (PID: 3500)
      • tracert.exe (PID: 2160)
      • WISPTIS.EXE (PID: 2336)
      • tracert.exe (PID: 1472)

    • Checks supported languages

      • iexplore.exe (PID: 3660)
      • iexplore.exe (PID: 1820)
      • vssvc.exe (PID: 488)
      • msiexec.exe (PID: 3048)
      • DllHost.exe (PID: 3720)
      • explorer.exe (PID: 4008)
      • explorer.exe (PID: 2944)
      • WISPTIS.EXE (PID: 3500)
      • tracert.exe (PID: 2160)
      • WISPTIS.EXE (PID: 2336)
      • tracert.exe (PID: 1472)

    • Changes internet zones settings

      • iexplore.exe (PID: 3660)

    • Application launched itself

      • iexplore.exe (PID: 3660)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3660)

    • Creates files in the user directory

      • iexplore.exe (PID: 1820)
      • iexplore.exe (PID: 3660)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 1820)
      • iexplore.exe (PID: 3660)
      • launcher_vs2012_sp4_vcredist_x86.exe (PID: 1940)
      • msiexec.exe (PID: 3048)
      • dxsetup.exe (PID: 3424)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 1820)
      • iexplore.exe (PID: 3660)
      • msiexec.exe (PID: 3048)
      • launcher_vs2012_sp4_vcredist_x86.exe (PID: 1940)
      • dxsetup.exe (PID: 3424)
      • LauncherStarter.exe (PID: 868)
      • Launcher.exe (PID: 2324)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3660)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1820)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3660)

    • Dropped object may contain Bitcoin addresses

      • launcher_vs2012_sp4_vcredist_x86.exe (PID: 1940)
      • msiexec.exe (PID: 3048)
      • 3DSexVilla2Installer.exe (PID: 2520)
      • LauncherStarter.exe (PID: 868)

    • Reads the hosts file

      • Launcher.exe (PID: 2324)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
78
Monitored processes
27
Malicious processes
11
Suspicious processes
4

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe 3dsexvilla2installer.exe no specs 3dsexvilla2installer.exe launcher_vs2010_sp1_vcredist_x64.exe setup.exe launcher_vs2012_sp4_vcredist_x86.exe launcher_vs2012_sp4_vcredist_x86.exe vssvc.exe no specs msiexec.exe launcher_vs2012_sp4_vcredist_x64.exe no specs launcher_vs2012_sp4_vcredist_x64.exe dxsetup.exe DllHost.exe no specs regasm.exe no specs explorer.exe no specs explorer.exe no specs launcherstarter.exe wisptis.exe no specs wisptis.exe tracert.exe no specs launcher.exe wisptis.exe no specs wisptis.exe tracert.exe no specs crash_service.exe no specs bionicweb.exe

Process information

PID
CMD
Path
Indicators
Parent process
488C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft� Volume Shadow Copy Service
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
868"C:\Users\admin\AppData\Local\Temp\launcher_vs2012_sp4_vcredist_x86.exe" /q /norestart -burn.unelevated BurnPipe.{0BAB0011-BFD7-4BAD-A7A6-292E1DC9821A} {33D1A78F-18AD-4B13-BA49-817C81651100} 1940C:\Users\admin\AppData\Local\Temp\launcher_vs2012_sp4_vcredist_x86.exe
launcher_vs2012_sp4_vcredist_x86.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030
Exit code:
0
Version:
11.0.61030.0
Modules
Images
c:\users\admin\appdata\local\temp\launcher_vs2012_sp4_vcredist_x86.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
868"C:\Program Files\thriXXX\Launcher\LauncherStarter.exe" C:\Program Files\thriXXX\Launcher\LauncherStarter.exe
explorer.exe
User:
admin
Company:
thriXXX technology
Integrity Level:
MEDIUM
Description:
LauncherStarter
Exit code:
0
Version:
1.4.0.76
Modules
Images
c:\program files\thrixxx\launcher\launcherstarter.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
1352"C:\Windows\SYSTEM32\WISPTIS.EXE" /ManualLaunch;C:\Windows\SYSTEM32\WISPTIS.EXE—LauncherStarter.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Pen and Touch Input Component
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wisptis.exe
c:\windows\system32\ntdll.dll
1352"C:\ProgramData\thriXXX\Launcher\BionicWeb.exe" --type=renderer --disable-fullscreen --log-level=0 --no-sandbox --lang=en-US --user-data-dir="C:\Users\admin\AppData\Roaming\thriXXX\Launcher\Web" --lang=en-US --webex-app-id=Launcher --webex-disable-media-libs --disable-webgl --disable-pepper-3d-for-untrusted-use --disable-gl-multisampling --disable-accelerated-compositing --disable-accelerated-2d-canvas --disable-accelerated-video-decode --channel="2324.0.923396633\920430591" /prefetch:3C:\ProgramData\thriXXX\Launcher\BionicWeb.exe
Launcher.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Version:
1.4.0 2013-12-03 (Tue) 14:25:29
Modules
Images
c:\programdata\thrixxx\launcher\bionicweb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\winmm.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
1472"tracert.exe" cdn.content.thrixxx.comC:\Windows\system32\tracert.exe—Launcher.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Traceroute Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\tracert.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\icmp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rpcrt4.dll
1820"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3660 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
1940"C:\Users\admin\AppData\Local\Temp\launcher_vs2012_sp4_vcredist_x86.exe" /q /norestartC:\Users\admin\AppData\Local\Temp\launcher_vs2012_sp4_vcredist_x86.exe
3DSexVilla2Installer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030
Exit code:
0
Version:
11.0.61030.0
Modules
Images
c:\users\admin\appdata\local\temp\launcher_vs2012_sp4_vcredist_x86.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
2160"tracert.exe" cdn.content.thrixxx.comC:\Windows\system32\tracert.exe—LauncherStarter.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Traceroute Command
Exit code:
4294967295
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\tracert.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\icmp.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
c:\windows\system32\winnsi.dll
c:\windows\system32\rpcrt4.dll
2212"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" Launcher.ActiveXControl.dll /codebaseC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe—3DSexVilla2Installer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
4.0.30319.34209 built by: FX452RTMGDR
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regasm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
Total events
56 859
Read events
55 744
Write events
1 083
Delete events
32

Modification events

(PID) Process:(3660) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3660) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3660) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30942692
(PID) Process:(3660) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3660) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30942692
(PID) Process:(3660) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3660) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3660) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3660) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3660) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
119
Suspicious files
182
Text files
363
Unknown types
50

Dropped files

PID
Process
Filename
Type
1820iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\JI0P2CGQ.htmhtml
MD5:—
SHA256:—
1820iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
1820iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:—
SHA256:—
1820iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506binary
MD5:—
SHA256:—
1820iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\08E4966219807206CA76747A7CF6F1FBder
MD5:—
SHA256:—
1820iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\04OE5SJG.txttext
MD5:—
SHA256:—
1820iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27der
MD5:—
SHA256:—
1820iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\N8CW9XZG.txttext
MD5:—
SHA256:—
1820iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\08E4966219807206CA76747A7CF6F1FBbinary
MD5:—
SHA256:—
1820iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\8SYW954S.txttext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
108
TCP/UDP connections
193
DNS requests
39
Threats
195

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1820
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
US
der
471 b
whitelisted
1820
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
US
der
1.47 Kb
whitelisted
3660
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
1820
iexplore.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
1820
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJ9L2KGL92BpjF3kAtaDtxauTmhgQUPdNQpdagre7zSmAKZdMh1Pj41g8CEALfEJNp%2F3EHwfL0H5WQQ5Q%3D
US
der
471 b
whitelisted
1820
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTk45WiKdPUwcMf8JgMC07ACYqr2AQUt2ui6qiqhIx56rTaD5iyxZV2ufQCEAQc%2FwknnvRv4hMCswhjZmU%3D
US
der
471 b
whitelisted
1820
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D
US
der
471 b
whitelisted
1820
iexplore.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
1820
iexplore.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCYyccBU%2BO5JwoAAAABM%2FlK
US
der
472 b
whitelisted
1820
iexplore.exe
GET
200
142.250.186.131:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEC5GLYwFefbxEgAAAAAAYIc%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1820
iexplore.exe
66.115.187.24:443
www.3dsexvilla.com
NationalNet, Inc.
US
suspicious
1820
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1820
iexplore.exe
2.16.186.19:80
r3.o.lencr.org
Akamai International B.V.
—
whitelisted
1820
iexplore.exe
23.45.105.185:80
x1.c.lencr.org
Akamai International B.V.
NL
unknown
1820
iexplore.exe
172.217.16.138:443
fonts.googleapis.com
Google Inc.
US
whitelisted
1820
iexplore.exe
104.16.19.94:443
cdnjs.cloudflare.com
Cloudflare Inc
US
suspicious
1820
iexplore.exe
8.253.145.89:443
cdn.punux.com
Level 3 Communications, Inc.
US
unknown
1820
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1820
iexplore.exe
142.250.186.131:80
ocsp.pki.goog
Google Inc.
US
whitelisted
3660
iexplore.exe
204.79.197.200:443
www.bing.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
www.3dsexvilla.com
  • 66.115.187.24
suspicious
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
x1.c.lencr.org
  • 23.45.105.185
whitelisted
r3.o.lencr.org
  • 2.16.186.19
  • 2.16.186.41
  • 2.16.186.27
  • 2.16.186.35
  • 2.16.186.25
  • 2.16.186.8
  • 2.16.186.10
  • 2.16.186.33
  • 2.16.186.16
shared
cdn.punux.com
  • 8.253.145.89
unknown
fonts.googleapis.com
  • 172.217.16.138
whitelisted
cdnjs.cloudflare.com
  • 104.16.19.94
  • 104.16.18.94
whitelisted
www.thrixxx.com
  • 66.115.187.24
suspicious
ocsp.digicert.com
  • 93.184.220.29
whitelisted
ocsp.pki.goog
  • 142.250.186.131
whitelisted

Threats

PID
Process
Class
Message
868
LauncherStarter.exe
Potential Corporate Privacy Violation
ET POLICY User-Agent (Launcher)
868
LauncherStarter.exe
Potential Corporate Privacy Violation
AV POLICY User-Agent (Launcher)
868
LauncherStarter.exe
Potential Corporate Privacy Violation
ET POLICY User-Agent (Launcher)
868
LauncherStarter.exe
Potential Corporate Privacy Violation
AV POLICY User-Agent (Launcher)
868
LauncherStarter.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
868
LauncherStarter.exe
Misc activity
ET INFO EXE IsDebuggerPresent (Used in Malware Anti-Debugging)
868
LauncherStarter.exe
Potential Corporate Privacy Violation
ET POLICY User-Agent (Launcher)
868
LauncherStarter.exe
Potential Corporate Privacy Violation
AV POLICY User-Agent (Launcher)
868
LauncherStarter.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
868
LauncherStarter.exe
Potential Corporate Privacy Violation
ET POLICY User-Agent (Launcher)
Process
Message
Setup.exe
A StopBlock was hit or a System Requirement was not met.
dxsetup.exe
DLL_PROCESS_ATTACH
dxsetup.exe
DLL_PROCESS_ATTACH
dxsetup.exe
DLL_PROCESS_DETACH
dxsetup.exe
DLL_PROCESS_DETACH
Launcher.exe
[E:2324:3800:1497140:gpu_info_collector_win.cc(135)] Could not read gaming score from assessment results.
Launcher.exe
[I:2324:3800:1497140:web_core_impl.cc(1357)] BionicWeb 1.4.0 (r523) startup, dll: C:\ProgramData\thriXXX\Launcher\BionicWeb.dll
Launcher.exe
[I:2324:3800:1497140:web_core_impl.cc(1365)] using core configuration parameters:
Launcher.exe
[I:2324:3800:1497140:web_core_impl.cc(1372)] parameter: 'WCC_DisableFatalExitCore' (103)
Launcher.exe
[I:2324:3800:1497140:web_core_impl.cc(1372)] parameter: 'WCC_Cs_AutoStart' (300)
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.3dsexvilla.com/?ts=3&aid=9681504&pr=8