File name:

Helper.exe

Full analysis: https://app.any.run/tasks/806ee52a-2475-4539-a91b-e81d80c0efff
Verdict: Malicious activity
Analysis date: February 21, 2024, 10:46:02
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

9EC3F60F21B6C44765C085C49343B727

SHA1:

6FDD561E634F398E678EEBFFDA13E13CD5B19B70

SHA256:

DD97BF61BF700F9AF8EE93171D4AF1FCF5172FEE868B7F214093AB02B51578DD

SSDEEP:

98304:EqpNIV0wd+8Va4d5heoptuEL1rLqS/hxTLFSgU6e3ee/MyvUkJHwnLg81BpvVNX5:Uz1Z6PLZ038XKS9+iISBKTqgK6kuO8/1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Helper.exe (PID: 2964)

  • SUSPICIOUS

    • Process uses IPCONFIG to clear DNS cache

      • ns2D.tmp (PID: 2624)
      • nsFFAF.tmp (PID: 3948)
      • ns129.tmp (PID: 3276)
      • ns1A7.tmp (PID: 2292)
      • ns225.tmp (PID: 1348)
      • nsAB.tmp (PID: 4008)
      • ns2A3.tmp (PID: 1928)
      • ns321.tmp (PID: 2072)
      • ns39F.tmp (PID: 2000)
      • ns42C.tmp (PID: 2904)
      • ns4AA.tmp (PID: 2724)
      • ns528.tmp (PID: 2592)
      • ns5A6.tmp (PID: 2804)
      • ns624.tmp (PID: 3680)
      • ns6A2.tmp (PID: 3984)
      • ns720.tmp (PID: 2668)
      • ns79E.tmp (PID: 2172)
      • ns81C.tmp (PID: 2760)
      • ns89A.tmp (PID: 1584)
      • ns918.tmp (PID: 2404)
      • ns987.tmp (PID: 2584)
      • ns9F5.tmp (PID: 1592)
      • nsA73.tmp (PID: 1124)
      • nsAF1.tmp (PID: 4064)
      • nsB6F.tmp (PID: 1736)
      • nsBED.tmp (PID: 572)
      • nsC6B.tmp (PID: 3456)
      • nsCE9.tmp (PID: 3492)
      • nsD67.tmp (PID: 2380)
      • nsDE5.tmp (PID: 3316)
      • nsE54.tmp (PID: 3604)
      • nsED2.tmp (PID: 3756)
      • nsF50.tmp (PID: 3632)
      • nsFCE.tmp (PID: 3588)
      • ns105B.tmp (PID: 4036)
      • ns10D9.tmp (PID: 1388)
      • ns1167.tmp (PID: 1432)
      • ns11E5.tmp (PID: 1040)
      • ns1263.tmp (PID: 3500)
      • ns12E1.tmp (PID: 3092)
      • ns135F.tmp (PID: 3960)
      • ns13DD.tmp (PID: 2908)
      • ns145B.tmp (PID: 2960)
      • ns14E8.tmp (PID: 796)
      • ns1566.tmp (PID: 1992)
      • ns15E4.tmp (PID: 1860)
      • ns1672.tmp (PID: 1236)
      • ns16F0.tmp (PID: 1368)
      • ns177E.tmp (PID: 2484)
      • ns180B.tmp (PID: 3404)
      • ns1899.tmp (PID: 1864)
      • ns1927.tmp (PID: 3976)
      • ns19B4.tmp (PID: 844)
      • ns1A32.tmp (PID: 1596)
      • ns1ACF.tmp (PID: 316)
      • ns1B5D.tmp (PID: 2560)
      • ns1BEB.tmp (PID: 1636)
      • ns1C78.tmp (PID: 2424)
      • ns1D06.tmp (PID: 3232)
      • ns1D94.tmp (PID: 3292)
      • ns1E21.tmp (PID: 3780)
      • ns1EAF.tmp (PID: 752)
      • ns1F3C.tmp (PID: 3484)
      • ns1FCA.tmp (PID: 2492)
      • ns2058.tmp (PID: 2868)
      • ns21F1.tmp (PID: 4028)
      • ns227F.tmp (PID: 3056)
      • ns230C.tmp (PID: 560)
      • ns239A.tmp (PID: 3300)
      • ns2427.tmp (PID: 2500)
      • ns24C5.tmp (PID: 3916)
      • ns2552.tmp (PID: 2044)
      • ns25E0.tmp (PID: 3428)
      • ns266E.tmp (PID: 3664)
      • ns20E5.tmp (PID: 3412)
      • ns2163.tmp (PID: 3000)
      • ns26EC.tmp (PID: 3660)
      • ns2779.tmp (PID: 3500)
      • ns2807.tmp (PID: 3092)
      • ns2885.tmp (PID: 3960)
      • ns2922.tmp (PID: 2908)
      • ns29B0.tmp (PID: 2960)
      • ns2A2E.tmp (PID: 796)
      • ns2AAC.tmp (PID: 1992)
      • ns2B39.tmp (PID: 1860)

    • Executable content was dropped or overwritten

      • Helper.exe (PID: 2964)

    • Starts application with an unusual extension

      • Helper.exe (PID: 2964)

  • INFO

    • Checks supported languages

      • Helper.exe (PID: 2964)
      • ns2D.tmp (PID: 2624)
      • nsFFAF.tmp (PID: 3948)
      • ns1A7.tmp (PID: 2292)
      • ns225.tmp (PID: 1348)
      • nsAB.tmp (PID: 4008)
      • ns2A3.tmp (PID: 1928)
      • ns129.tmp (PID: 3276)
      • ns321.tmp (PID: 2072)
      • ns39F.tmp (PID: 2000)
      • ns42C.tmp (PID: 2904)
      • ns4AA.tmp (PID: 2724)
      • ns528.tmp (PID: 2592)
      • ns5A6.tmp (PID: 2804)
      • ns624.tmp (PID: 3680)
      • ns6A2.tmp (PID: 3984)
      • ns81C.tmp (PID: 2760)
      • ns89A.tmp (PID: 1584)
      • ns918.tmp (PID: 2404)
      • ns987.tmp (PID: 2584)
      • ns9F5.tmp (PID: 1592)
      • nsA73.tmp (PID: 1124)
      • nsAF1.tmp (PID: 4064)
      • nsB6F.tmp (PID: 1736)
      • nsBED.tmp (PID: 572)
      • ns720.tmp (PID: 2668)
      • ns79E.tmp (PID: 2172)
      • nsC6B.tmp (PID: 3456)
      • nsCE9.tmp (PID: 3492)
      • nsD67.tmp (PID: 2380)
      • nsDE5.tmp (PID: 3316)
      • nsE54.tmp (PID: 3604)
      • nsED2.tmp (PID: 3756)
      • nsF50.tmp (PID: 3632)
      • nsFCE.tmp (PID: 3588)
      • ns1167.tmp (PID: 1432)
      • ns11E5.tmp (PID: 1040)
      • ns1263.tmp (PID: 3500)
      • ns12E1.tmp (PID: 3092)
      • ns135F.tmp (PID: 3960)
      • ns13DD.tmp (PID: 2908)
      • ns145B.tmp (PID: 2960)
      • ns105B.tmp (PID: 4036)
      • ns10D9.tmp (PID: 1388)
      • ns15E4.tmp (PID: 1860)
      • ns1672.tmp (PID: 1236)
      • ns14E8.tmp (PID: 796)
      • ns1566.tmp (PID: 1992)
      • ns177E.tmp (PID: 2484)
      • ns16F0.tmp (PID: 1368)
      • ns180B.tmp (PID: 3404)
      • ns1899.tmp (PID: 1864)
      • ns1927.tmp (PID: 3976)
      • ns19B4.tmp (PID: 844)
      • ns1A32.tmp (PID: 1596)
      • ns1ACF.tmp (PID: 316)
      • ns1B5D.tmp (PID: 2560)
      • ns1BEB.tmp (PID: 1636)
      • ns1C78.tmp (PID: 2424)
      • ns1D06.tmp (PID: 3232)
      • ns1D94.tmp (PID: 3292)
      • ns1E21.tmp (PID: 3780)
      • ns1EAF.tmp (PID: 752)
      • ns1F3C.tmp (PID: 3484)
      • ns1FCA.tmp (PID: 2492)
      • ns2058.tmp (PID: 2868)
      • ns20E5.tmp (PID: 3412)
      • ns227F.tmp (PID: 3056)
      • ns230C.tmp (PID: 560)
      • ns239A.tmp (PID: 3300)
      • ns2427.tmp (PID: 2500)
      • ns24C5.tmp (PID: 3916)
      • ns2552.tmp (PID: 2044)
      • ns25E0.tmp (PID: 3428)
      • ns2163.tmp (PID: 3000)
      • ns21F1.tmp (PID: 4028)
      • ns266E.tmp (PID: 3664)
      • ns26EC.tmp (PID: 3660)
      • ns2779.tmp (PID: 3500)
      • ns2807.tmp (PID: 3092)
      • ns2885.tmp (PID: 3960)
      • ns2922.tmp (PID: 2908)
      • ns29B0.tmp (PID: 2960)
      • ns2A2E.tmp (PID: 796)
      • ns2AAC.tmp (PID: 1992)
      • wmpnscfg.exe (PID: 1900)
      • ns2B39.tmp (PID: 1860)

    • Reads the computer name

      • Helper.exe (PID: 2964)
      • wmpnscfg.exe (PID: 1900)

    • Create files in a temporary directory

      • Helper.exe (PID: 2964)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 1900)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (36.8)
.exe | Win32 Executable MS Visual C++ (generic) (26.6)
.exe | Win64 Executable (generic) (23.6)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:12:16 00:54:20+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 473088
UninitializedDataSize: 16384
EntryPoint: 0x33fa
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Hindi
CharacterSet: Unicode
Comments: -
CompanyName: KpoJIuK
FileDescription: Adobe Installer
FileVersion: 1.0.0.0
LegalCopyright: © KpoJIuK
ProductName: Adobe Installer
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
296
Monitored processes
173
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start helper.exe nsffaf.tmp no specs ipconfig.exe no specs ns2d.tmp no specs ipconfig.exe no specs nsab.tmp no specs ipconfig.exe no specs ns129.tmp no specs ipconfig.exe no specs ns1a7.tmp no specs ipconfig.exe no specs ns225.tmp no specs ipconfig.exe no specs ns2a3.tmp no specs ipconfig.exe no specs ns321.tmp no specs ipconfig.exe no specs ns39f.tmp no specs ipconfig.exe no specs ns42c.tmp no specs ipconfig.exe no specs ns4aa.tmp no specs ipconfig.exe no specs ns528.tmp no specs ipconfig.exe no specs ns5a6.tmp no specs ipconfig.exe no specs ns624.tmp no specs ipconfig.exe no specs ns6a2.tmp no specs ipconfig.exe no specs ns720.tmp no specs ipconfig.exe no specs ns79e.tmp no specs ipconfig.exe no specs ns81c.tmp no specs ipconfig.exe no specs ns89a.tmp no specs ipconfig.exe no specs ns918.tmp no specs ipconfig.exe no specs ns987.tmp no specs ipconfig.exe no specs ns9f5.tmp no specs ipconfig.exe no specs nsa73.tmp no specs ipconfig.exe no specs nsaf1.tmp no specs ipconfig.exe no specs nsb6f.tmp no specs ipconfig.exe no specs nsbed.tmp no specs ipconfig.exe no specs nsc6b.tmp no specs ipconfig.exe no specs nsce9.tmp no specs ipconfig.exe no specs nsd67.tmp no specs ipconfig.exe no specs nsde5.tmp no specs ipconfig.exe no specs nse54.tmp no specs ipconfig.exe no specs nsed2.tmp no specs ipconfig.exe no specs nsf50.tmp no specs ipconfig.exe no specs nsfce.tmp no specs ipconfig.exe no specs ns105b.tmp no specs ipconfig.exe no specs ns10d9.tmp no specs ipconfig.exe no specs ns1167.tmp no specs ipconfig.exe no specs ns11e5.tmp no specs ipconfig.exe no specs ns1263.tmp no specs ipconfig.exe no specs ns12e1.tmp no specs ipconfig.exe no specs ns135f.tmp no specs ipconfig.exe no specs ns13dd.tmp no specs ipconfig.exe no specs ns145b.tmp no specs ipconfig.exe no specs ns14e8.tmp no specs ipconfig.exe no specs ns1566.tmp no specs ipconfig.exe no specs ns15e4.tmp no specs ipconfig.exe no specs ns1672.tmp no specs ipconfig.exe no specs ns16f0.tmp no specs ipconfig.exe no specs ns177e.tmp no specs ipconfig.exe no specs ns180b.tmp no specs ipconfig.exe no specs ns1899.tmp no specs ipconfig.exe no specs ns1927.tmp no specs ipconfig.exe no specs ns19b4.tmp no specs ipconfig.exe no specs ns1a32.tmp no specs ipconfig.exe no specs ns1acf.tmp no specs ipconfig.exe no specs ns1b5d.tmp no specs ipconfig.exe no specs ns1beb.tmp no specs ipconfig.exe no specs ns1c78.tmp no specs ipconfig.exe no specs ns1d06.tmp no specs ipconfig.exe no specs ns1d94.tmp no specs ipconfig.exe no specs ns1e21.tmp no specs ipconfig.exe no specs ns1eaf.tmp no specs ipconfig.exe no specs ns1f3c.tmp no specs ipconfig.exe no specs ns1fca.tmp no specs ipconfig.exe no specs ns2058.tmp no specs ipconfig.exe no specs ns20e5.tmp no specs ipconfig.exe no specs ns2163.tmp no specs ipconfig.exe no specs ns21f1.tmp no specs ipconfig.exe no specs ns227f.tmp no specs ipconfig.exe no specs ns230c.tmp no specs ipconfig.exe no specs ns239a.tmp no specs ipconfig.exe no specs ns2427.tmp no specs ipconfig.exe no specs ns24c5.tmp no specs ipconfig.exe no specs ns2552.tmp no specs ipconfig.exe no specs ns25e0.tmp no specs ipconfig.exe no specs ns266e.tmp no specs ipconfig.exe no specs ns26ec.tmp no specs ipconfig.exe no specs ns2779.tmp no specs ipconfig.exe no specs ns2807.tmp no specs ipconfig.exe no specs ns2885.tmp no specs ipconfig.exe no specs ns2922.tmp no specs ipconfig.exe no specs ns29b0.tmp no specs ipconfig.exe no specs ns2a2e.tmp no specs ipconfig.exe no specs ns2aac.tmp no specs ipconfig.exe no specs ns2b39.tmp no specs ipconfig.exe no specs wmpnscfg.exe no specs helper.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
128ipconfig /flushdnsC:\Windows\System32\ipconfig.exe—ns81C.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
IP Configuration Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ipconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\ws2_32.dll
128ipconfig /flushdnsC:\Windows\System32\ipconfig.exe—ns1ACF.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
IP Configuration Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ipconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\ws2_32.dll
296ipconfig /flushdnsC:\Windows\System32\ipconfig.exe—ns1A32.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
IP Configuration Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ipconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\ws2_32.dll
316"C:\Users\admin\AppData\Local\Temp\nspFFAE.tmp\ns1ACF.tmp" ipconfig /flushdnsC:\Users\admin\AppData\Local\Temp\nspFFAE.tmp\ns1ACF.tmp—Helper.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nspffae.tmp\ns1acf.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
560"C:\Users\admin\AppData\Local\Temp\nspFFAE.tmp\ns230C.tmp" ipconfig /flushdnsC:\Users\admin\AppData\Local\Temp\nspFFAE.tmp\ns230C.tmp—Helper.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nspffae.tmp\ns230c.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
572"C:\Users\admin\AppData\Local\Temp\nspFFAE.tmp\nsBED.tmp" ipconfig /flushdnsC:\Users\admin\AppData\Local\Temp\nspFFAE.tmp\nsBED.tmp—Helper.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nspffae.tmp\nsbed.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
584ipconfig /flushdnsC:\Windows\System32\ipconfig.exe—nsBED.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
IP Configuration Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ipconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\ws2_32.dll
584ipconfig /flushdnsC:\Windows\System32\ipconfig.exe—ns1F3C.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
IP Configuration Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ipconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\ws2_32.dll
680ipconfig /flushdnsC:\Windows\System32\ipconfig.exe—ns177E.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
IP Configuration Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ipconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\ws2_32.dll
752"C:\Users\admin\AppData\Local\Temp\nspFFAE.tmp\ns1EAF.tmp" ipconfig /flushdnsC:\Users\admin\AppData\Local\Temp\nspFFAE.tmp\ns1EAF.tmp—Helper.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nspffae.tmp\ns1eaf.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
6 341
Read events
6 341
Write events
0
Delete events
0

Modification events

No data
Executable files
86
Suspicious files
0
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2964Helper.exeC:\Windows\system32\drivers\etc\hoststext
MD5:D8BCEF35968A80DB39F62FF867A3909B
SHA256:C748216463CCD3DA2940193163852EB0E544E9745A7DE5EDBA41DF8F4A6B7355
2964Helper.exeC:\Users\admin\AppData\Local\Temp\nspFFAE.tmp\ns2D.tmpexecutable
MD5:F27689C513E7D12C7C974D5F8EF710D6
SHA256:1F18F4126124B0551F3DBCD0FEC7F34026F930CA509F04435657CEDC32AE8C47
2964Helper.exeC:\Users\admin\AppData\Local\Temp\nspFFAE.tmp\nsExec.dllexecutable
MD5:F27689C513E7D12C7C974D5F8EF710D6
SHA256:1F18F4126124B0551F3DBCD0FEC7F34026F930CA509F04435657CEDC32AE8C47
2964Helper.exeC:\Users\admin\AppData\Local\Temp\nspFFAE.tmp\ns4AA.tmpexecutable
MD5:F27689C513E7D12C7C974D5F8EF710D6
SHA256:1F18F4126124B0551F3DBCD0FEC7F34026F930CA509F04435657CEDC32AE8C47
2964Helper.exeC:\Users\admin\AppData\Local\Temp\nspFFAE.tmp\ns528.tmpexecutable
MD5:F27689C513E7D12C7C974D5F8EF710D6
SHA256:1F18F4126124B0551F3DBCD0FEC7F34026F930CA509F04435657CEDC32AE8C47
2964Helper.exeC:\Users\admin\AppData\Local\Temp\nspFFAE.tmp\ns5A6.tmpexecutable
MD5:F27689C513E7D12C7C974D5F8EF710D6
SHA256:1F18F4126124B0551F3DBCD0FEC7F34026F930CA509F04435657CEDC32AE8C47
2964Helper.exeC:\Users\admin\AppData\Local\Temp\nspFFAE.tmp\ns624.tmpexecutable
MD5:F27689C513E7D12C7C974D5F8EF710D6
SHA256:1F18F4126124B0551F3DBCD0FEC7F34026F930CA509F04435657CEDC32AE8C47
2964Helper.exeC:\Users\admin\AppData\Local\Temp\nspFFAE.tmp\ns6A2.tmpexecutable
MD5:F27689C513E7D12C7C974D5F8EF710D6
SHA256:1F18F4126124B0551F3DBCD0FEC7F34026F930CA509F04435657CEDC32AE8C47
2964Helper.exeC:\Users\admin\AppData\Local\Temp\nspFFAE.tmp\ns129.tmpexecutable
MD5:F27689C513E7D12C7C974D5F8EF710D6
SHA256:1F18F4126124B0551F3DBCD0FEC7F34026F930CA509F04435657CEDC32AE8C47
2964Helper.exeC:\Users\admin\AppData\Local\Temp\nspFFAE.tmp\ns225.tmpexecutable
MD5:F27689C513E7D12C7C974D5F8EF710D6
SHA256:1F18F4126124B0551F3DBCD0FEC7F34026F930CA509F04435657CEDC32AE8C47
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Helper.exe