download:

PsUpdate.exe

Full analysis: https://app.any.run/tasks/ad75b690-df1d-4dc3-b485-13491c194b0e
Verdict: Malicious activity
Threats:

Quasar is a very popular RAT in the world thanks to its code being available in open-source. This malware can be used to control the victim’s computer remotely.

Malware Trends Tracker     >>>
Analysis date: May 24, 2020, 20:42:59
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
trojan
rat
quasar
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

7FD1723BF1C93574458CD1EC82074CE5

SHA1:

164A35BF1EE64EC7029FE9F9D57F23D3D2EFC192

SHA256:

CF93875C89BD96957A970BEE9DF75B031C2950A5865212B1FAE40C8AE9299C5F

SSDEEP:

12288:WuSpZCjsvLSS3fvaazNnq/Tz2cgkwFlsuH6TaF0cUHTOziaekUFm5YFL0Z270d:W5pZwszRPTBnqrqcAFeuHScwOmaHUFml

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • PsUpdate.exe (PID: 3328)
      • Citrix.exe (PID: 280)

    • QUASAR was detected

      • PsUpdate.exe (PID: 3328)
      • Citrix.exe (PID: 280)

    • Application was dropped or rewritten from another process

      • Chrome_Update.exe (PID: 3212)

    • Actions looks like stealing of personal data

      • explorer.exe (PID: 3480)

    • Loads the Task Scheduler COM API

      • explorer.exe (PID: 3480)

    • Executes PowerShell scripts

      • cmd.exe (PID: 1320)

    • Runs PING.EXE for delay simulation

      • cmd.exe (PID: 1084)
      • cmd.exe (PID: 2988)
      • cmd.exe (PID: 2596)
      • cmd.exe (PID: 3688)
      • cmd.exe (PID: 2652)
      • cmd.exe (PID: 3640)
      • cmd.exe (PID: 1008)

  • SUSPICIOUS

    • Starts itself from another location

      • PsUpdate.exe (PID: 3328)

    • Application launched itself

      • PsUpdate.exe (PID: 3288)
      • Citrix.exe (PID: 3576)
      • explorer.exe (PID: 3480)
      • PsUpdate.exe (PID: 3420)
      • PsUpdate.exe (PID: 3596)
      • PsUpdate.exe (PID: 2500)
      • PsUpdate.exe (PID: 3464)
      • PsUpdate.exe (PID: 3552)
      • PsUpdate.exe (PID: 2800)

    • Checks for external IP

      • PsUpdate.exe (PID: 3328)
      • Citrix.exe (PID: 280)

    • Creates files in the user directory

      • Citrix.exe (PID: 280)
      • Chrome_Update.exe (PID: 3212)
      • PsUpdate.exe (PID: 3328)
      • powershell.exe (PID: 3616)

    • Executable content was dropped or overwritten

      • Chrome_Update.exe (PID: 3212)
      • PsUpdate.exe (PID: 3328)

    • Modifies the open verb of a shell class

      • Chrome_Update.exe (PID: 3212)

    • Starts CMD.EXE for commands execution

      • Chrome_Update.exe (PID: 3212)
      • PsUpdate.exe (PID: 3328)
      • PsUpdate.exe (PID: 1920)
      • PsUpdate.exe (PID: 2084)
      • PsUpdate.exe (PID: 376)
      • PsUpdate.exe (PID: 2692)
      • PsUpdate.exe (PID: 2896)
      • PsUpdate.exe (PID: 740)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 2736)

    • Starts application with an unusual extension

      • cmd.exe (PID: 1084)
      • cmd.exe (PID: 2988)
      • cmd.exe (PID: 2596)
      • cmd.exe (PID: 3688)
      • cmd.exe (PID: 2652)
      • cmd.exe (PID: 3640)
      • cmd.exe (PID: 1008)

    • Executed via COM

      • DllHost.exe (PID: 3448)

  • INFO

    • Manual execution by user

      • explorer.exe (PID: 2580)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:05:15 20:02:02+02:00
PEType: PE32
LinkerVersion: 6
CodeSize: 673280
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0xa6556
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 12.2.4.0
ProductVersionNumber: 12.2.4.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: 7dTools Constructor
CompanyName: Qura Corporations
FileDescription: 7dTools
FileVersion: 12.2.4
InternalName: JWwoUYFw5lANMt4.exe
LegalCopyright: Qura Corporations (C) 2020
OriginalFileName: JWwoUYFw5lANMt4.exe
ProductName: 7dTools
ProductVersion: 12.2.4
AssemblyVersion: 0.0.0.0

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 15-May-2020 18:02:02
Comments: 7dTools Constructor
CompanyName: Qura Corporations
FileDescription: 7dTools
FileVersion: 12.2.4
InternalName: JWwoUYFw5lANMt4.exe
LegalCopyright: Qura Corporations (C) 2020
OriginalFilename: JWwoUYFw5lANMt4.exe
ProductName: 7dTools
ProductVersion: 12.2.4
Assembly Version: 0.0.0.0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000080

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 3
Time date stamp: 15-May-2020 18:02:02
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00002000
0x000A455C
0x000A4600
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
7.99305
.reloc
0x000A8000
0x0000000C
0x00000200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
0.10191
.rsrc
0x000AA000
0x000005AC
0x00000600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.45455

Resources

Title
Entropy
Size
Codepage
Language
Type
1
4.94168
436
Latin 1 / Western European
UNKNOWN
RT_MANIFEST

Imports

mscoree.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
114
Monitored processes
51
Malicious processes
16
Suspicious processes
10

Behavior graph

Click at the process to see the details
start drop and start drop and start psupdate.exe no specs #QUASAR psupdate.exe citrix.exe no specs #QUASAR citrix.exe explorer.exe no specs chrome_update.exe slui.exe slui.exe cmd.exe no specs taskkill.exe no specs explorer.exe cmd.exe no specs powershell.exe no specs explorer.exe no specs cmd.exe no specs chcp.com no specs ping.exe no specs psupdate.exe no specs psupdate.exe no specs cmd.exe no specs chcp.com no specs ping.exe no specs Shell Security Editor no specs psupdate.exe no specs psupdate.exe no specs cmd.exe no specs chcp.com no specs ping.exe no specs psupdate.exe no specs psupdate.exe no specs cmd.exe no specs chcp.com no specs ping.exe no specs psupdate.exe no specs psupdate.exe no specs cmd.exe no specs chcp.com no specs ping.exe no specs psupdate.exe no specs psupdate.exe no specs cmd.exe no specs chcp.com no specs ping.exe no specs psupdate.exe no specs psupdate.exe no specs cmd.exe no specs chcp.com no specs ping.exe no specs psupdate.exe no specs psupdate.exe no specs taskmgr.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
280"C:\Users\admin\AppData\Roaming\Citrix.exe"C:\Users\admin\AppData\Roaming\Citrix.exe
Citrix.exe
User:
admin
Company:
Qura Corporations
Integrity Level:
MEDIUM
Description:
7dTools
Exit code:
0
Version:
12.2.4
Modules
Images
c:\users\admin\appdata\roaming\citrix.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
376"C:\Users\admin\AppData\Local\Temp\PsUpdate.exe"C:\Users\admin\AppData\Local\Temp\PsUpdate.exe—PsUpdate.exe
User:
admin
Company:
Qura Corporations
Integrity Level:
MEDIUM
Description:
7dTools
Exit code:
0
Version:
12.2.4
Modules
Images
c:\users\admin\appdata\local\temp\psupdate.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
740"C:\Users\admin\AppData\Local\Temp\PsUpdate.exe"C:\Users\admin\AppData\Local\Temp\PsUpdate.exe—PsUpdate.exe
User:
admin
Company:
Qura Corporations
Integrity Level:
MEDIUM
Description:
7dTools
Exit code:
0
Version:
12.2.4
Modules
Images
c:\users\admin\appdata\local\temp\psupdate.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
880ping -n 10 localhost C:\Windows\system32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
968"C:\windows\system32\slui.exe" C:\windows\system32\slui.exe
Chrome_Update.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Activation Client
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\slui.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1008cmd /c ""C:\Users\admin\AppData\Local\Temp\gA0r6a6WUuUO.bat" "C:\Windows\system32\cmd.exe—PsUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1084cmd /c ""C:\Users\admin\AppData\Local\Temp\Nr9LAhxmyuNH.bat" "C:\Windows\system32\cmd.exe—PsUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1140ping -n 10 localhost C:\Windows\system32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
1320"C:\Windows\System32\cmd.exe" /k start /b powershell –ExecutionPolicy Bypass -WindowStyle Hidden C:\Users\admin\AppData\Roaming\uac.exe -b slui -e QzpcVXNlcnNcYWRtaW5cQXBwRGF0YVxSb2FtaW5nXGV4LmV4ZQ== & exitC:\Windows\System32\cmd.exe—PsUpdate.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1356"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
7 160
Read events
6 167
Write events
983
Delete events
10

Modification events

(PID) Process:(3328) PsUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PsUpdate_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3328) PsUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PsUpdate_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3328) PsUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PsUpdate_RASAPI32
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(3328) PsUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PsUpdate_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
4294901760
(PID) Process:(3328) PsUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PsUpdate_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(3328) PsUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PsUpdate_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(3328) PsUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PsUpdate_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(3328) PsUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PsUpdate_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(3328) PsUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PsUpdate_RASMANCS
Operation:writeName:FileTracingMask
Value:
4294901760
(PID) Process:(3328) PsUpdate.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\PsUpdate_RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
4294901760
Executable files
11
Suspicious files
8
Text files
7
Unknown types
0

Dropped files

PID
Process
Filename
Type
3616powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ZTD2VWIFD9COUUC83OEM.temp —
MD5:—
SHA256:—
3328PsUpdate.exeC:\Users\admin\AppData\Roaming\Chrome_Update.exeexecutable
MD5:—
SHA256:—
280Citrix.exeC:\Users\admin\AppData\Roaming\Logs\05-24-2020binary
MD5:—
SHA256:—
3328PsUpdate.exeC:\Users\admin\AppData\Roaming\ex.exeexecutable
MD5:—
SHA256:—
3212Chrome_Update.exeC:\Users\admin\AppData\Roaming\Chrome.exeexecutable
MD5:—
SHA256:—
3212Chrome_Update.exeC:\Users\admin\AppData\Roaming\Install.exeexecutable
MD5:—
SHA256:—
3328PsUpdate.exeC:\Users\admin\AppData\Roaming\uac.exeexecutable
MD5:—
SHA256:—
3328PsUpdate.exeC:\Users\admin\AppData\Roaming\Venomx86.dllexecutable
MD5:—
SHA256:—
3328PsUpdate.exeC:\Users\admin\AppData\Roaming\Venomx64.dllexecutable
MD5:—
SHA256:—
3328PsUpdate.exeC:\Users\admin\AppData\Roaming\VenomInstall.exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
16
DNS requests
2
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3328
PsUpdate.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
text
289 b
malicious
280
Citrix.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
text
289 b
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3328
PsUpdate.exe
208.95.112.1:80
ip-api.com
IBURST
—
malicious
3328
PsUpdate.exe
145.14.145.211:443
payloads-poison.000webhostapp.com
Hostinger International Limited
US
shared
280
Citrix.exe
208.95.112.1:80
ip-api.com
IBURST
—
malicious
280
Citrix.exe
95.216.56.1:4782
—
Hetzner Online GmbH
DE
suspicious

DNS requests

Domain
IP
Reputation
ip-api.com
  • 208.95.112.1
malicious
payloads-poison.000webhostapp.com
  • 145.14.145.211
shared

Threats

PID
Process
Class
Message
1052
svchost.exe
Not Suspicious Traffic
ET INFO Observed Free Hosting Domain (*.000webhostapp .com in DNS Lookup)
3328
PsUpdate.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup ip-api.com
3328
PsUpdate.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
3328
PsUpdate.exe
A Network Trojan was detected
REMOTE [PTsecurity] Quasar.RAT IP Lookup
280
Citrix.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup ip-api.com
280
Citrix.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
280
Citrix.exe
A Network Trojan was detected
REMOTE [PTsecurity] Quasar.RAT IP Lookup
3328
PsUpdate.exe
Not Suspicious Traffic
ET INFO Observed SSL Cert for Free Hosting Domain (*.000webhostapp .com)
3328
PsUpdate.exe
Not Suspicious Traffic
ET INFO Observed SSL Cert for Free Hosting Domain (*.000webhostapp .com)
2 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
PsUpdate.exe