| File name: | dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe |
| Full analysis: | https://app.any.run/tasks/f7bbabb5-9f04-44ce-aad0-5db7af23c05e |
| Verdict: | Malicious activity |
| Threats: | Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks. |
| Analysis date: | July 03, 2024, 06:43:28 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | ACD738C0840861A12F13ACFF7C6FD7E5 |
| SHA1: | 113B1470AF40D3BD3A2AF70F57390BA5D8B1162A |
| SHA256: | DDE34F614758E4D68E6732F7DE0C9E210E6E8D56D65AAE0F2CB1EE5D953D587C |
| SSDEEP: | 98304:UuOW5SVG8Jzm2jjlss9Gb1oiDWIxwsNDUh4aoF6400aGp2lf4vNrVf+VHfSKTEGK:UBxsMu |
| .exe | | | Win64 Executable (generic) (64.6) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (15.4) |
| .exe | | | Win32 Executable (generic) (10.5) |
| .exe | | | Generic Win/DOS Executable (4.6) |
| .exe | | | DOS Executable Generic (4.6) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2024:07:01 23:55:34+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 10 |
| CodeSize: | 109568 |
| InitializedDataSize: | 2222080 |
| UninitializedDataSize: | - |
| EntryPoint: | 0xbee8c8 |
| OSVersion: | 5.1 |
| ImageVersion: | - |
| SubsystemVersion: | 5.1 |
| Subsystem: | Windows GUI |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1428 | "C:\Users\admin\AppData\Local\Temp\1000006001\c8cd85da02.exe" | C:\Users\admin\AppData\Local\Temp\1000006001\c8cd85da02.exe | — | explorti.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 | |||||||||||||||
| 1644 | "C:\Users\admin\AppData\Local\Temp\ad40971b6b\explorti.exe" | C:\Users\admin\AppData\Local\Temp\ad40971b6b\explorti.exe | — | svchost.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 | |||||||||||||||
| 2044 | "C:\Users\admin\AppData\Local\Temp\ad40971b6b\explorti.exe" | C:\Users\admin\AppData\Local\Temp\ad40971b6b\explorti.exe | BAFIEGIECG.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
Amadey(PID) Process(2044) explorti.exe C277.91.77.82 URLhttp://77.91.77.82/Hun4Ko/index.php Version4.30 Options Drop directoryad40971b6b Drop nameexplorti.exe Strings (113)2019 un: explorti.exe .jpg Content-Type: application/x-www-form-urlencoded SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce exe "
Content-Type: application/octet-stream shutdown -s -t 0 vs: 4.30 Avira &unit= = -executionpolicy remotesigned -File " <c> ::: rundll32 " && timeout 1 && del POST dm: ESET 2022 Comodo "taskkill /f /im " st=s -%lu Bitdefender 2016 SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\ && Exit" SOFTWARE\Microsoft\Windows\CurrentVersion\Run d1 Powershell.exe ComputerName sd: ad40971b6b " && ren <d> r= \App ProgramData\ https:// WinDefender # SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName id: pc: /k Content-Type: multipart/form-data; boundary=---- VideoID wb rb lv: /Hun4Ko/index.php Startup ------ \0000 AVAST Software GetNativeSystemInfo rundll32.exe SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders cmd /C RMDIR /s/q Main ProductName \ SOFTWARE\Microsoft\Windows NT\CurrentVersion av: +++ -unicode- && e0 cmd bi: DefaultSettings.XResolution AVG os: -- Norton S-%lu- ?scr=1 Content-Disposition: form-data; name="data"; filename=" " 77.91.77.82 kernel32.dll GET DefaultSettings.YResolution SYSTEM\ControlSet001\Services\BasicDisplay\Video | ps1 /Plugins/ dll og: Sophos %-lu Programs abcdefghijklmnopqrstuvwxyz0123456789-_ random ------ Panda Security 0123456789 cred.dll|clip.dll| Rem CurrentBuild http:// Kaspersky Lab ar: %USERPROFILE% shell32.dll 360TotalSecurity Doctor Web e1 | |||||||||||||||
| 2132 | "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\admin\AppData\Local\Temp\HIIIIEGHDG.exe" | C:\Windows\SysWOW64\cmd.exe | — | dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2220 | "C:\Users\admin\AppData\Local\Temp\dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe" | C:\Users\admin\AppData\Local\Temp\dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
Stealc(PID) Process(2220) dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe C285.28.47.4 Strings (102)INSERT_KEY_HERE 22 07 20 24 GetProcAddress LoadLibraryA lstrcatA OpenEventA CreateEventA CloseHandle Sleep GetUserDefaultLangID VirtualAllocExNuma VirtualFree GetSystemInfo VirtualAlloc HeapAlloc GetComputerNameA lstrcpyA GetProcessHeap GetCurrentProcess lstrlenA ExitProcess GlobalMemoryStatusEx GetSystemTime SystemTimeToFileTime advapi32.dll gdi32.dll user32.dll crypt32.dll ntdll.dll GetUserNameA CreateDCA GetDeviceCaps ReleaseDC CryptStringToBinaryA sscanf VMwareVMware HAL9TH JohnDoe DISPLAY %hu/%hu/%hu http://85.28.47.4 /920475a59bac849d.php /69934896f997d5bb/ jony GetEnvironmentVariableA GetFileAttributesA GlobalLock HeapFree GetFileSize GlobalSize CreateToolhelp32Snapshot IsWow64Process Process32Next GetLocalTime FreeLibrary GetTimeZoneInformation GetSystemPowerStatus GetVolumeInformationA GetWindowsDirectoryA Process32First GetLocaleInfoA GetUserDefaultLocaleName GetModuleFileNameA DeleteFileA FindNextFileA LocalFree FindClose SetEnvironmentVariableA LocalAlloc GetFileSizeEx ReadFile SetFilePointer WriteFile CreateFileA FindFirstFileA CopyFileA VirtualProtect GetLogicalProcessorInformationEx GetLastError lstrcpynA MultiByteToWideChar GlobalFree WideCharToMultiByte GlobalAlloc OpenProcess TerminateProcess GetCurrentProcessId gdiplus.dll ole32.dll bcrypt.dll wininet.dll shlwapi.dll shell32.dll psapi.dll rstrtmgr.dll CreateCompatibleBitmap SelectObject BitBlt DeleteObject | |||||||||||||||
| 4440 | "C:\Users\admin\AppData\Local\Temp\HIIIIEGHDG.exe" | C:\Users\admin\AppData\Local\Temp\HIIIIEGHDG.exe | cmd.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 5232 | "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\admin\AppData\Local\Temp\BAFIEGIECG.exe" | C:\Windows\SysWOW64\cmd.exe | — | dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5344 | "C:\Users\admin\AppData\Local\Temp\BAFIEGIECG.exe" | C:\Users\admin\AppData\Local\Temp\BAFIEGIECG.exe | cmd.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 5444 | "C:\Users\admin\AppData\Local\Temp\ad40971b6b\explorti.exe" | C:\Users\admin\AppData\Local\Temp\ad40971b6b\explorti.exe | HIIIIEGHDG.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 5456 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| (PID) Process: | (2220) dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (2220) dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (2220) dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (2220) dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (2220) dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (2220) dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
| (PID) Process: | (2220) dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | AutoDetect |
Value: 0 | |||
| (PID) Process: | (5344) BAFIEGIECG.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (5344) BAFIEGIECG.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (5344) BAFIEGIECG.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2220 | dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | C:\ProgramData\EGDGCGCFHIEHIDGDBAAE | binary | |
MD5:A45465CDCDC6CB30C8906F3DA4EC114C | SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209 | |||
| 2220 | dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | C:\ProgramData\DHDBGHCB | binary | |
MD5:77A1AFF2DA29DD2F8E9E6B2A0CDE8562 | SHA256:C479E249237494E65B4D4220499072D69829E6649DEC2B4FB8762256A55D6AB6 | |||
| 2220 | dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | C:\ProgramData\HJJDGHCBGDHIECBGIDAEHCGDGC | — | |
MD5:— | SHA256:— | |||
| 2220 | dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | C:\ProgramData\CBGCGDBKEGHIEBGDBFHDHIDAFC | sqlite | |
MD5:06AD9E737639FDC745B3B65312857109 | SHA256:C8925892CA8E213746633033AE95ACFB8DD9531BC376B82066E686AC6F40A404 | |||
| 2220 | dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | C:\ProgramData\ECGDBFCB | binary | |
MD5:F6C33AC5E1032A0873BE7BFC65169287 | SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83 | |||
| 2220 | dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | C:\ProgramData\AKKKECBKKECGCAAAEHJK | sqlite | |
MD5:29A644B1F0D96166A05602FE27B3F4AD | SHA256:BF96902FEB97E990A471492F78EE8386BCF430D66BDAEFDEAFBF912C8CF7CE46 | |||
| 2220 | dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | C:\ProgramData\msvcp140.dll | executable | |
MD5:5FF1FCA37C466D6723EC67BE93B51442 | SHA256:5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062 | |||
| 2220 | dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | C:\ProgramData\freebl3.dll | executable | |
MD5:550686C0EE48C386DFCB40199BD076AC | SHA256:EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA | |||
| 2220 | dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\AH8CR9J5\vcruntime140[1].dll | executable | |
MD5:A37EE36B536409056A86F50E67777DD7 | SHA256:8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825 | |||
| 2220 | dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | C:\ProgramData\KKJJEBFCGDAKFIEBAAFBFCGCBF | sqlite | |
MD5:F22EDD4E28E57033993F2F3E6F879EB8 | SHA256:4EA1511F508E6DA130F9CE4220C3BBD8635AA0BEB4836542222C300641278356 | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2220 | dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | POST | 200 | 85.28.47.4:80 | http://85.28.47.4/920475a59bac849d.php | unknown | — | — | unknown |
2220 | dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | POST | 200 | 85.28.47.4:80 | http://85.28.47.4/920475a59bac849d.php | unknown | — | — | unknown |
2220 | dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | POST | 200 | 85.28.47.4:80 | http://85.28.47.4/920475a59bac849d.php | unknown | — | — | unknown |
2220 | dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | POST | 200 | 85.28.47.4:80 | http://85.28.47.4/920475a59bac849d.php | unknown | — | — | unknown |
2220 | dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | GET | 200 | 85.28.47.4:80 | http://85.28.47.4/69934896f997d5bb/freebl3.dll | unknown | — | — | unknown |
2868 | svchost.exe | GET | 200 | 2.16.164.9:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | unknown |
2220 | dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | GET | 200 | 85.28.47.4:80 | http://85.28.47.4/69934896f997d5bb/mozglue.dll | unknown | — | — | unknown |
2220 | dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | GET | 200 | 85.28.47.4:80 | http://85.28.47.4/69934896f997d5bb/msvcp140.dll | unknown | — | — | unknown |
2220 | dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | GET | 200 | 85.28.47.4:80 | http://85.28.47.4/69934896f997d5bb/softokn3.dll | unknown | — | — | unknown |
2220 | dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | GET | 200 | 85.28.47.4:80 | http://85.28.47.4/69934896f997d5bb/nss3.dll | unknown | — | — | unknown |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4032 | svchost.exe | 239.255.255.250:1900 | — | — | — | whitelisted |
3396 | MoUsoCoreWorker.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2220 | dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | 85.28.47.4:80 | — | — | RU | malicious |
2868 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5952 | RUXIMICS.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2868 | svchost.exe | 2.16.164.9:80 | crl.microsoft.com | Akamai International B.V. | NL | unknown |
2868 | svchost.exe | 95.101.149.131:80 | www.microsoft.com | Akamai International B.V. | NL | unknown |
3040 | OfficeClickToRun.exe | 20.42.73.27:443 | self.events.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | unknown |
3040 | OfficeClickToRun.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
4656 | SearchApp.exe | 2.23.209.154:443 | — | Akamai International B.V. | GB | unknown |
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
self.events.data.microsoft.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
login.live.com |
| whitelisted |
r.bing.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
arc.msn.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
2220 | dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | Misc Attack | ET DROP Spamhaus DROP Listed Traffic Inbound group 9 |
2220 | dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | Malware Command and Control Activity Detected | STEALER [ANY.RUN] Stealc |
2220 | dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | Malware Command and Control Activity Detected | ET MALWARE Win32/Stealc Requesting plugins Config from C2 |
2220 | dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | Malware Command and Control Activity Detected | ET MALWARE Win32/Stealc Requesting browsers Config from C2 |
2220 | dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | Malware Command and Control Activity Detected | ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in |
2220 | dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | Potentially Bad Traffic | ET INFO Dotted Quad Host DLL Request |
2220 | dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | Malware Command and Control Activity Detected | ET MALWARE Win32/Stealc Submitting System Information to C2 |
2220 | dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | A suspicious filename was detected | ET HUNTING HTTP GET Request for sqlite3.dll - Possible Infostealer Activity |
2220 | dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
2220 | dde34f614758e4d68e6732f7de0c9e210e6e8d56d65aae0f2cb1ee5d953d587c.exe | Potentially Bad Traffic | ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download |
Process | Message |
|---|---|
BAFIEGIECG.exe |
%s------------------------------------------------
--- Themida Professional ---
--- (c)2012 Oreans Technologies ---
------------------------------------------------
|
HIIIIEGHDG.exe |
%s------------------------------------------------
--- Themida Professional ---
--- (c)2012 Oreans Technologies ---
------------------------------------------------
|
explorti.exe |
%s------------------------------------------------
--- Themida Professional ---
--- (c)2012 Oreans Technologies ---
------------------------------------------------
|
explorti.exe |
%s------------------------------------------------
--- Themida Professional ---
--- (c)2012 Oreans Technologies ---
------------------------------------------------
|