Malware analysis uTorrent.exe Malicious activity | ANY.RUN

Add for printing

File name:	uTorrent.exe
Full analysis:	https://app.any.run/tasks/3f136685-762e-4caa-acec-0881c98e8c14
Verdict:	Malicious activity
Threats:	Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security. Malware Trends Tracker >>>
Analysis date:	July 24, 2024, 15:33:50
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	pua adware
Indicators:
MIME:	application/x-dosexec
File info:	PE32 executable (GUI) Intel 80386, for MS Windows
MD5:	F83EB21E144C785913D1722E145FF946
SHA1:	18E62D2716014E77213F8D55E05CD6FECF23B5D2
SHA256:	CE7FAB69A6C10146AC89E121FBE204CA424CD886C4763674EB2E9260B2F6B722
SSDEEP:	98304:q6VnvK7vl/NfWvaN5ehEPZkvlIT1TVtaupu7GVK2pblPZLBRK4R1w7S7BMjJxfLr:/C98

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 180 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: 120 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Drops the executable file immediately after the start
  - uTorrent.exe (PID: 6916)
- ADWARE has been detected (SURICATA)
  - GenericSetup.exe (PID: 6612)
SUSPICIOUS
- The process creates files with name similar to system file names
  - uTorrent.exe (PID: 6916)
- Executable content was dropped or overwritten
  - uTorrent.exe (PID: 6916)
- Reads security settings of Internet Explorer
  - installer.exe (PID: 2380)
  - GenericSetup.exe (PID: 6612)
- Reads the date of Windows installation
  - installer.exe (PID: 2380)
- Reads the Windows owner or organization settings
  - GenericSetup.exe (PID: 6612)
- Searches for installed software
  - GenericSetup.exe (PID: 6612)
- Mutex name with non-standard characters
  - GenericSetup.exe (PID: 6612)
- Access to an unwanted program domain was detected
  - GenericSetup.exe (PID: 6612)
INFO
- Create files in a temporary directory
  - uTorrent.exe (PID: 6916)
  - installer.exe (PID: 2380)
- Checks supported languages
  - installer.exe (PID: 2380)
  - uTorrent.exe (PID: 6916)
  - GenericSetup.exe (PID: 6612)
- Process checks computer location settings
  - installer.exe (PID: 2380)
- Reads the computer name
  - uTorrent.exe (PID: 6916)
  - GenericSetup.exe (PID: 6612)
  - installer.exe (PID: 2380)
- Reads Environment values
  - GenericSetup.exe (PID: 6612)
- Reads the machine GUID from the registry
  - GenericSetup.exe (PID: 6612)
  - installer.exe (PID: 2380)
- Disables trace logs
  - GenericSetup.exe (PID: 6612)
- Checks proxy server information
  - GenericSetup.exe (PID: 6612)
  - slui.exe (PID: 6056)
- Reads the software policy settings
  - GenericSetup.exe (PID: 6612)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

TRiD

.exe	\|	InstallShield setup (29.8)
.exe	\|	Win32 Executable MS Visual C++ (generic) (21.6)
.exe	\|	Win64 Executable (generic) (19.1)
.exe	\|	UPX compressed Win32 Executable (18.7)
.dll	\|	Win32 Dynamic Link Library (generic) (4.5)

EXIF

EXE

MachineType:	Intel 386 or later, and compatibles
TimeStamp:	2011:04:18 18:54:06+00:00
ImageFileCharacteristics:	No relocs, Executable, No line numbers, No symbols, Large address aware, 32-bit
PEType:	PE32
LinkerVersion:	6
CodeSize:	104448
InitializedDataSize:	83968
UninitializedDataSize:	-
EntryPoint:	0x148d4
OSVersion:	4
ImageVersion:	-
SubsystemVersion:	4
Subsystem:	Windows GUI
FileVersionNumber:	3.5.5.45660
ProductVersionNumber:	3.5.5.45660
FileFlagsMask:	0x003f
FileFlags:	(none)
FileOS:	Windows NT 32-bit
ObjectFileType:	Executable application
FileSubtype:	-
LanguageCode:	English (U.S.)
CharacterSet:	Unicode
FileVersion:	3.5.5.45660
ProductVersion:	3.5.5.45660
CompanyName:	BitTorrent Inc.
FileDescription:	µTorrent
InternalName:	uTorrent.exe
LegalCopyright:	©2020 BitTorrent, Inc. All Rights Reserved.
OriginalFileName:	uTorrent.exe
ProductName:	µTorrent

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

137

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

464

"C:\Users\admin\AppData\Local\Temp\uTorrent.exe"

C:\Users\admin\AppData\Local\Temp\uTorrent.exe

—

explorer.exe

User:

admin

Company:

BitTorrent Inc.

Integrity Level:

MEDIUM

Description:

µTorrent

Exit code:

3221226540

Version:

3.5.5.45660

Modules

Images
c:\users\admin\appdata\local\temp\utorrent.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll

2380

.\installer.exe

C:\Users\admin\AppData\Local\Temp\7zS40BFBB1E\installer.exe

—

uTorrent.exe

User:

admin

Company:

adaware

Integrity Level:

HIGH

Description:

µTorrent

Version:

1.0.1.2857

Modules

Images
c:\users\admin\appdata\local\temp\7zs40bfbb1e\installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll

6056

C:\WINDOWS\System32\slui.exe -Embedding

C:\Windows\System32\slui.exe

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Activation Client

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

6612

"C:\Users\admin\AppData\Local\Temp\7zS40BFBB1E\GenericSetup.exe" C:\Users\admin\AppData\Local\Temp\7zS40BFBB1E\GenericSetup.exe

C:\Users\admin\AppData\Local\Temp\7zS40BFBB1E\GenericSetup.exe

installer.exe

User:

admin

Integrity Level:

HIGH

Description:

µTorrent

Version:

1.0.1.2857

Modules

Images
c:\users\admin\appdata\local\temp\7zs40bfbb1e\genericsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll

6916

"C:\Users\admin\AppData\Local\Temp\uTorrent.exe"

C:\Users\admin\AppData\Local\Temp\uTorrent.exe

explorer.exe

User:

admin

Company:

BitTorrent Inc.

Integrity Level:

HIGH

Description:

µTorrent

Version:

3.5.5.45660

Modules

Images
c:\users\admin\appdata\local\temp\utorrent.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll

Add for printing

Total events

12 678

Read events

12 555

Write events

123

Delete events

Modification events


(PID) Process:	(2380) installer.exe	Key:	HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
Operation:	write	Name:	PendingFileRenameOperations
Value: \??\C:\Users\admin\AppData\Local\Temp\7zS40BFBB1E\de\DevLib.resources.dll
(PID) Process:	(2380) installer.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	ProxyBypass
Value: 1
(PID) Process:	(2380) installer.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	IntranetName
Value: 1
(PID) Process:	(2380) installer.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	UNCAsIntranet
Value: 1
(PID) Process:	(2380) installer.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	AutoDetect
Value: 0
(PID) Process:	(6612) GenericSetup.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	ProxyBypass
Value: 1
(PID) Process:	(6612) GenericSetup.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	IntranetName
Value: 1
(PID) Process:	(6612) GenericSetup.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	UNCAsIntranet
Value: 1
(PID) Process:	(6612) GenericSetup.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:	write	Name:	AutoDetect
Value: 0
(PID) Process:	(6612) GenericSetup.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing
Operation:	write	Name:	EnableConsoleTracing
Value: 0

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
6916	uTorrent.exe	C:\Users\admin\AppData\Local\Temp\7zS40BFBB1E\Resources\tis\EventHandler.tis		text
		MD5:A716B0B9334FFCD6534A6F74165BBCC5	SHA256:92027AAE259AA695E3FECF0A5039A709171B4DD13D285CF68D38CD3001EFE090
6916	uTorrent.exe	C:\Users\admin\AppData\Local\Temp\7zS40BFBB1E\Resources\tis\TranslateOfferTemplate.tis		text
		MD5:551029A3E046C5ED6390CC85F632A689	SHA256:7B8C76A85261C5F9E40E49F97E01A14320E9B224FF3D6AF8286632CA94CF96F8
6916	uTorrent.exe	C:\Users\admin\AppData\Local\Temp\7zS40BFBB1E\Resources\tis\ViewStateLoader.tis		text
		MD5:C1B831DE5085D4B5CDAD186F08E2E3A7	SHA256:A60B9281DAD0D5E36AC7EA180058AB9E14E6146C7EC7ABBD5359248FEDC423E3
6916	uTorrent.exe	C:\Users\admin\AppData\Local\Temp\7zS40BFBB1E\BundleConfig.json		binary
		MD5:0ED7F99F49EE89A66B5C6FFF6B82AF75	SHA256:B50C6F2E98946D4C56A06D035051FD1356308C7B33540FB3E2C9D633EA88E1B2
6916	uTorrent.exe	C:\Users\admin\AppData\Local\Temp\7zS40BFBB1E\GenericSetup.exe.config		xml
		MD5:7F333011CCAE6D7E0125BC6AE5385333	SHA256:8F48AEDC5ECF10FA28858C14A64999DF80E68EF0ECB486C0F9027C27A9EDAEEB
6916	uTorrent.exe	C:\Users\admin\AppData\Local\Temp\7zS40BFBB1E\Resources\tis\Config.tis		text
		MD5:FB1C09FC31CE983ED99D8913BB9F1474	SHA256:293959C3F8EBB87BFFE885CE2331F0B40AB5666F9D237BE4791ED4903CE17BF4
6916	uTorrent.exe	C:\Users\admin\AppData\Local\Temp\7zS40BFBB1E\Resources\WelcomePage.html		html
		MD5:26D4E8AC8004F8CD9D622A6C46F15E6B	SHA256:168B5C9528FFDF1E188712DB475390301DA90575C50EF99C35B43DBF317FE8BA
6916	uTorrent.exe	C:\Users\admin\AppData\Local\Temp\7zS40BFBB1E\Resources\SettingPage1.html		html
		MD5:55A4C91743FD057A8C430767A32AC9A5	SHA256:361F60D1C7DE5B16C3C0FCA967A8B729D85AC19CA4BD847DBA8AAFB2CB5C8BBF
6916	uTorrent.exe	C:\Users\admin\AppData\Local\Temp\7zS40BFBB1E\Resources\images\loader.gif		image
		MD5:2B26F73D382AB69F3914A7D9FDA97B0F	SHA256:A6A0B05B1D5C52303DD3E9E2F9CDA1E688A490FBE84EA0D6E22A051AB6EFD643
6916	uTorrent.exe	C:\Users\admin\AppData\Local\Temp\7zS40BFBB1E\Carrier.exe		executable
		MD5:761F0D4E20E45645D65248DA00CBCE22	SHA256:CC4F07476A60752087F5C46143C632F89B315C896D161B0EFBDC4F81912DCA0C

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
7112	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
6332	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:138	—	—	—	whitelisted
3952	svchost.exe	239.255.255.250:1900	—	—	—	whitelisted
4	System	192.168.100.255:137	—	—	—	whitelisted
—	—	20.73.194.208:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
6012	MoUsoCoreWorker.exe	20.73.194.208:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
—	—	2.23.209.148:443	www.bing.com	Akamai International B.V.	GB	unknown
4204	svchost.exe	4.208.221.206:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	US	unknown
6612	GenericSetup.exe	104.16.213.94:443	sos.adaware.com	CLOUDFLARENET	—	unknown
5368	SearchApp.exe	2.23.209.176:443	www.bing.com	Akamai International B.V.	GB	unknown
5272	svchost.exe	20.190.160.17:443	login.live.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted

DNS requests

Domain	IP	Reputation
google.com	216.58.206.78	whitelisted
www.google.com	172.217.16.196	whitelisted
sos.adaware.com	104.16.213.94 104.16.212.94	whitelisted
www.bing.com	2.23.209.176 2.23.209.140 2.23.209.133 2.23.209.149 2.23.209.158 2.23.209.177 2.23.209.150 2.23.209.148 2.23.209.135	whitelisted
login.live.com	20.190.160.17 40.126.32.134 20.190.160.20 20.190.160.14 40.126.32.76 40.126.32.138 40.126.32.136 40.126.32.72	whitelisted
client.wns.windows.com	40.113.103.199	whitelisted
arc.msn.com	20.103.156.88 20.223.35.26	whitelisted
ocsp.digicert.com	192.229.221.95	whitelisted
fd.api.iris.microsoft.com	20.223.35.26	whitelisted
go.microsoft.com	184.28.89.167	whitelisted

Threats

Found threats are available for the paid subscriptions

2 ETPRO signatures available at the full report

Add for printing

Process	Message
GenericSetup.exe	Error: File not found - h2osciter:console.tis
GenericSetup.exe	at sciter:init-script.tis
GenericSetup.exe
GenericSetup.exe
GenericSetup.exe	file:resources/tis/TranslateOfferTemplate.tis(82) : warning :'async' does not contain any 'await'

General Info

uTorrent.exe

F83EB21E144C785913D1722E145FF946

18E62D2716014E77213F8D55E05CD6FECF23B5D2

CE7FAB69A6C10146AC89E121FBE204CA424CD886C4763674EB2E9260B2F6B722

98304:q6VnvK7vl/NfWvaN5ehEPZkvlIT1TVtaupu7GVK2pblPZLBRK4R1w7S7BMjJxfLr:/C98

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Drops the executable file immediately after the start

ADWARE has been detected (SURICATA)

SUSPICIOUS

The process creates files with name similar to system file names

Executable content was dropped or overwritten

Reads security settings of Internet Explorer

Reads the date of Windows installation

Reads the Windows owner or organization settings

Searches for installed software

Mutex name with non-standard characters

Access to an unwanted program domain was detected

INFO

Create files in a temporary directory

Checks supported languages

Process checks computer location settings

Reads the computer name

Reads Environment values

Reads the machine GUID from the registry

Disables trace logs

Checks proxy server information

Reads the software policy settings

Malware configuration

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings