URL:

https://versaclean.com.br/wp-content/uploads/2024/archt843.7z

Full analysis: https://app.any.run/tasks/64f13aee-eafb-49db-a648-2c5fa40d155a
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: August 30, 2024, 14:41:31
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
netreactor
privateloader
evasion
stealer
loader
github
risepro
stealc
lumma
metastealer
vidar
themida
miner
socks5systemz
proxy
g0njxa
Indicators:
MD5:

6743D10B1B78461288A6555EA96949CE

SHA1:

B66EC5D03295C4260DF59509008EC44469441FFF

SHA256:

E8B8400C767DCBB023981D325909D38B343AE09BB1217CC5A6CF7E245AB00C2D

SSDEEP:

3:N80WRhLyK25lEAQyXCNZf:253MlEAZkf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • RegAsm.exe (PID: 7700)
      • RegAsm.exe (PID: 6592)
      • svchost.exe (PID: 2256)
      • SPfiLqebchPP9k4C00Ot3v9m.exe (PID: 6580)
      • RegAsm.exe (PID: 6264)
      • zmediarecode32.exe (PID: 3268)
      • RegAsm.exe (PID: 2628)

    • Actions looks like stealing of personal data

      • RegAsm.exe (PID: 7700)
      • RegAsm.exe (PID: 6592)
      • mdPezmZAVbbUdd8Ok9V5ecZw.exe (PID: 7412)
      • RegAsm.exe (PID: 8096)
      • msptjhkfda.exe (PID: 7784)
      • SPfiLqebchPP9k4C00Ot3v9m.exe (PID: 6580)
      • RegAsm.exe (PID: 2628)

    • PRIVATELOADER has been detected (SURICATA)

      • RegAsm.exe (PID: 7700)

    • Changes the autorun value in the registry

      • q2Xf2JPfVGmBHXtQ6UBLZw1D.exe (PID: 7432)

    • Create files in the Startup directory

      • q2Xf2JPfVGmBHXtQ6UBLZw1D.exe (PID: 7432)

    • Uses Task Scheduler to run other applications

      • q2Xf2JPfVGmBHXtQ6UBLZw1D.exe (PID: 7432)

    • Uses Task Scheduler to autorun other applications

      • q2Xf2JPfVGmBHXtQ6UBLZw1D.exe (PID: 7432)

    • RISEPRO has been detected (SURICATA)

      • q2Xf2JPfVGmBHXtQ6UBLZw1D.exe (PID: 7432)

    • Stealers network behavior

      • RegAsm.exe (PID: 6592)
      • q2Xf2JPfVGmBHXtQ6UBLZw1D.exe (PID: 7432)
      • mdPezmZAVbbUdd8Ok9V5ecZw.exe (PID: 7412)
      • msptjhkfda.exe (PID: 7784)
      • SPfiLqebchPP9k4C00Ot3v9m.exe (PID: 6580)
      • RegAsm.exe (PID: 8096)

    • STEALC has been detected (SURICATA)

      • RegAsm.exe (PID: 6592)
      • RegAsm.exe (PID: 6264)
      • SPfiLqebchPP9k4C00Ot3v9m.exe (PID: 6580)
      • RegAsm.exe (PID: 2628)

    • Adds path to the Windows Defender exclusion list

      • mjlery9804bcSAbQpVKnYPtT.exe (PID: 7620)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 5612)
      • powershell.exe (PID: 2900)
      • powershell.exe (PID: 448)
      • powershell.exe (PID: 892)
      • powershell.exe (PID: 8028)
      • powershell.exe (PID: 6816)
      • powershell.exe (PID: 6408)
      • powershell.exe (PID: 6508)

    • Steals credentials from Web Browsers

      • mdPezmZAVbbUdd8Ok9V5ecZw.exe (PID: 7412)
      • SPfiLqebchPP9k4C00Ot3v9m.exe (PID: 6580)
      • RegAsm.exe (PID: 6592)

    • STEALC has been detected (YARA)

      • SPfiLqebchPP9k4C00Ot3v9m.exe (PID: 6580)
      • RegAsm.exe (PID: 6592)

    • METASTEALER has been detected (SURICATA)

      • mdPezmZAVbbUdd8Ok9V5ecZw.exe (PID: 7412)

    • LUMMA has been detected (SURICATA)

      • svchost.exe (PID: 2256)
      • RegAsm.exe (PID: 8096)
      • msptjhkfda.exe (PID: 7784)

    • MINER has been detected (SURICATA)

      • svchost.exe (PID: 2256)

    • SOCKS5SYSTEMZ has been detected (SURICATA)

      • zmediarecode32.exe (PID: 3268)

    • VIDAR has been detected (YARA)

      • RegAsm.exe (PID: 2628)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 1044)
      • RegAsm.exe (PID: 7700)
      • Q9QrSbGssx8nmriX4DPihWVN.tmp (PID: 7732)
      • RegAsm.exe (PID: 6592)
      • SPfiLqebchPP9k4C00Ot3v9m.exe (PID: 6580)

    • Connects to the server without a host name

      • RegAsm.exe (PID: 7700)
      • RegAsm.exe (PID: 6592)
      • SPfiLqebchPP9k4C00Ot3v9m.exe (PID: 6580)
      • RegAsm.exe (PID: 2628)

    • Potential Corporate Privacy Violation

      • RegAsm.exe (PID: 7700)
      • RegAsm.exe (PID: 6592)
      • svchost.exe (PID: 2256)
      • SPfiLqebchPP9k4C00Ot3v9m.exe (PID: 6580)
      • RegAsm.exe (PID: 2628)

    • Checks for external IP

      • RegAsm.exe (PID: 7700)
      • svchost.exe (PID: 2256)

    • Reads security settings of Internet Explorer

      • RegAsm.exe (PID: 7700)
      • RegAsm.exe (PID: 6592)
      • RegAsm.exe (PID: 6264)
      • SPfiLqebchPP9k4C00Ot3v9m.exe (PID: 6580)
      • RegAsm.exe (PID: 2628)
      • zmediarecode32.exe (PID: 3268)

    • Process requests binary or script from the Internet

      • RegAsm.exe (PID: 7700)
      • RegAsm.exe (PID: 6592)
      • SPfiLqebchPP9k4C00Ot3v9m.exe (PID: 6580)
      • RegAsm.exe (PID: 2628)

    • Drops the executable file immediately after the start

      • RegAsm.exe (PID: 7700)
      • Q9QrSbGssx8nmriX4DPihWVN.exe (PID: 1780)
      • Q9QrSbGssx8nmriX4DPihWVN.tmp (PID: 7732)
      • q2Xf2JPfVGmBHXtQ6UBLZw1D.exe (PID: 7432)
      • RegAsm.exe (PID: 6592)
      • zmediarecode32.exe (PID: 3268)
      • Q1xWs2ck7FZDoxVcK8VXWwks.exe (PID: 1752)
      • etzpikspwykg.exe (PID: 8140)
      • mjlery9804bcSAbQpVKnYPtT.exe (PID: 7620)
      • SPfiLqebchPP9k4C00Ot3v9m.exe (PID: 6580)
      • RegAsm.exe (PID: 2628)

    • Executable content was dropped or overwritten

      • RegAsm.exe (PID: 7700)
      • Q9QrSbGssx8nmriX4DPihWVN.exe (PID: 1780)
      • Q9QrSbGssx8nmriX4DPihWVN.tmp (PID: 7732)
      • q2Xf2JPfVGmBHXtQ6UBLZw1D.exe (PID: 7432)
      • zmediarecode32.exe (PID: 3268)
      • RegAsm.exe (PID: 6592)
      • Q1xWs2ck7FZDoxVcK8VXWwks.exe (PID: 1752)
      • etzpikspwykg.exe (PID: 8140)
      • mjlery9804bcSAbQpVKnYPtT.exe (PID: 7620)
      • SPfiLqebchPP9k4C00Ot3v9m.exe (PID: 6580)
      • RegAsm.exe (PID: 2628)

    • Windows Defender mutex has been found

      • RegAsm.exe (PID: 6592)
      • SPfiLqebchPP9k4C00Ot3v9m.exe (PID: 6580)

    • Reads the Windows owner or organization settings

      • Q9QrSbGssx8nmriX4DPihWVN.tmp (PID: 7732)

    • Reads the BIOS version

      • SPfiLqebchPP9k4C00Ot3v9m.exe (PID: 6580)

    • Application launched itself

      • q2Xf2JPfVGmBHXtQ6UBLZw1D.exe (PID: 7736)
      • mdPezmZAVbbUdd8Ok9V5ecZw.exe (PID: 6204)

    • Searches for installed software

      • RegAsm.exe (PID: 6592)
      • mdPezmZAVbbUdd8Ok9V5ecZw.exe (PID: 7412)
      • RegAsm.exe (PID: 8096)
      • RegAsm.exe (PID: 6264)
      • msptjhkfda.exe (PID: 7784)
      • SPfiLqebchPP9k4C00Ot3v9m.exe (PID: 6580)
      • RegAsm.exe (PID: 2628)

    • Contacting a server suspected of hosting an CnC

      • RegAsm.exe (PID: 6592)
      • q2Xf2JPfVGmBHXtQ6UBLZw1D.exe (PID: 7432)
      • mdPezmZAVbbUdd8Ok9V5ecZw.exe (PID: 7412)
      • svchost.exe (PID: 2256)
      • RegAsm.exe (PID: 8096)
      • RegAsm.exe (PID: 6264)
      • zmediarecode32.exe (PID: 3268)
      • SPfiLqebchPP9k4C00Ot3v9m.exe (PID: 6580)
      • RegAsm.exe (PID: 2628)

    • Script adds exclusion path to Windows Defender

      • mjlery9804bcSAbQpVKnYPtT.exe (PID: 7620)

    • The process drops Mozilla's DLL files

      • RegAsm.exe (PID: 6592)
      • SPfiLqebchPP9k4C00Ot3v9m.exe (PID: 6580)

    • The process drops C-runtime libraries

      • RegAsm.exe (PID: 6592)
      • SPfiLqebchPP9k4C00Ot3v9m.exe (PID: 6580)

    • Starts POWERSHELL.EXE for commands execution

      • mjlery9804bcSAbQpVKnYPtT.exe (PID: 7620)

    • Detected use of alternative data streams (AltDS)

      • powershell.exe (PID: 5612)

    • Reads the date of Windows installation

      • RegAsm.exe (PID: 6592)

    • Starts CMD.EXE for commands execution

      • RegAsm.exe (PID: 6592)

    • Executes application which crashes

      • RegAsm.exe (PID: 6264)

    • Uses powercfg.exe to modify the power settings

      • Q1xWs2ck7FZDoxVcK8VXWwks.exe (PID: 1752)
      • etzpikspwykg.exe (PID: 8140)

    • Starts SC.EXE for service management

      • Q1xWs2ck7FZDoxVcK8VXWwks.exe (PID: 1752)

    • Executes as Windows Service

      • etzpikspwykg.exe (PID: 8140)

    • Connects to unusual port

      • mdPezmZAVbbUdd8Ok9V5ecZw.exe (PID: 7412)
      • q2Xf2JPfVGmBHXtQ6UBLZw1D.exe (PID: 7432)
      • zmediarecode32.exe (PID: 3268)

    • Drops a system driver (possible attempt to evade defenses)

      • etzpikspwykg.exe (PID: 8140)

    • Adds/modifies Windows certificates

      • mjlery9804bcSAbQpVKnYPtT.exe (PID: 7620)

    • Crypto Currency Mining Activity Detected

      • svchost.exe (PID: 2256)

  • INFO

    • Reads Microsoft Office registry keys

      • msedge.exe (PID: 304)
      • msedge.exe (PID: 4020)

    • Reads Environment values

      • identity_helper.exe (PID: 7824)
      • identity_helper.exe (PID: 4316)
      • RegAsm.exe (PID: 6592)
      • mdPezmZAVbbUdd8Ok9V5ecZw.exe (PID: 7412)
      • RegAsm.exe (PID: 6264)
      • SPfiLqebchPP9k4C00Ot3v9m.exe (PID: 6580)
      • RegAsm.exe (PID: 2628)

    • The process uses the downloaded file

      • msedge.exe (PID: 7252)
      • WinRAR.exe (PID: 4820)
      • WinRAR.exe (PID: 1044)
      • RegAsm.exe (PID: 6592)

    • Checks supported languages

      • identity_helper.exe (PID: 7824)
      • FileApp.exe (PID: 7292)
      • identity_helper.exe (PID: 4316)
      • mjlery9804bcSAbQpVKnYPtT.exe (PID: 7620)
      • RegAsm.exe (PID: 7700)
      • Q9QrSbGssx8nmriX4DPihWVN.exe (PID: 1780)
      • SPfiLqebchPP9k4C00Ot3v9m.exe (PID: 6580)
      • Q1xWs2ck7FZDoxVcK8VXWwks.exe (PID: 1752)
      • q2Xf2JPfVGmBHXtQ6UBLZw1D.exe (PID: 7736)
      • mdPezmZAVbbUdd8Ok9V5ecZw.exe (PID: 6204)
      • a0NSAVM9eHsvExOnXHPhaWZY.exe (PID: 7228)
      • omLQpz95V6guHopnZoFepU1o.exe (PID: 6948)
      • RegAsm.exe (PID: 6592)
      • Q9QrSbGssx8nmriX4DPihWVN.tmp (PID: 7732)
      • RegAsm.exe (PID: 2628)
      • q2Xf2JPfVGmBHXtQ6UBLZw1D.exe (PID: 7432)
      • mdPezmZAVbbUdd8Ok9V5ecZw.exe (PID: 7412)
      • zmediarecode32.exe (PID: 3268)
      • RegAsm.exe (PID: 8096)
      • adminJKEHIIJJEC.exe (PID: 1232)
      • adminHCFBKKEBKE.exe (PID: 6584)
      • RegAsm.exe (PID: 6264)
      • etzpikspwykg.exe (PID: 8140)
      • msptjhkfda.exe (PID: 7784)

    • Reads the computer name

      • identity_helper.exe (PID: 7824)
      • FileApp.exe (PID: 7292)
      • RegAsm.exe (PID: 7700)
      • identity_helper.exe (PID: 4316)
      • mjlery9804bcSAbQpVKnYPtT.exe (PID: 7620)
      • q2Xf2JPfVGmBHXtQ6UBLZw1D.exe (PID: 7736)
      • mdPezmZAVbbUdd8Ok9V5ecZw.exe (PID: 6204)
      • omLQpz95V6guHopnZoFepU1o.exe (PID: 6948)
      • a0NSAVM9eHsvExOnXHPhaWZY.exe (PID: 7228)
      • RegAsm.exe (PID: 6592)
      • Q9QrSbGssx8nmriX4DPihWVN.tmp (PID: 7732)
      • SPfiLqebchPP9k4C00Ot3v9m.exe (PID: 6580)
      • mdPezmZAVbbUdd8Ok9V5ecZw.exe (PID: 7412)
      • q2Xf2JPfVGmBHXtQ6UBLZw1D.exe (PID: 7432)
      • zmediarecode32.exe (PID: 3268)
      • adminHCFBKKEBKE.exe (PID: 6584)
      • RegAsm.exe (PID: 8096)
      • adminJKEHIIJJEC.exe (PID: 1232)
      • RegAsm.exe (PID: 6264)
      • msptjhkfda.exe (PID: 7784)
      • RegAsm.exe (PID: 2628)

    • Manual execution by a user

      • WinRAR.exe (PID: 4820)
      • WinRAR.exe (PID: 1044)
      • FileApp.exe (PID: 7292)

    • Application launched itself

      • msedge.exe (PID: 304)
      • msedge.exe (PID: 4020)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1044)

    • .NET Reactor protector has been detected

      • FileApp.exe (PID: 7292)
      • q2Xf2JPfVGmBHXtQ6UBLZw1D.exe (PID: 7432)

    • Reads the machine GUID from the registry

      • FileApp.exe (PID: 7292)
      • RegAsm.exe (PID: 7700)
      • mjlery9804bcSAbQpVKnYPtT.exe (PID: 7620)
      • mdPezmZAVbbUdd8Ok9V5ecZw.exe (PID: 6204)
      • q2Xf2JPfVGmBHXtQ6UBLZw1D.exe (PID: 7736)
      • mdPezmZAVbbUdd8Ok9V5ecZw.exe (PID: 7412)
      • RegAsm.exe (PID: 6264)
      • RegAsm.exe (PID: 2628)

    • Reads the software policy settings

      • RegAsm.exe (PID: 7700)
      • mjlery9804bcSAbQpVKnYPtT.exe (PID: 7620)
      • mdPezmZAVbbUdd8Ok9V5ecZw.exe (PID: 7412)
      • RegAsm.exe (PID: 8096)
      • WerFault.exe (PID: 6576)
      • msptjhkfda.exe (PID: 7784)

    • Process checks computer location settings

      • RegAsm.exe (PID: 7700)
      • RegAsm.exe (PID: 6592)

    • Checks proxy server information

      • RegAsm.exe (PID: 7700)
      • RegAsm.exe (PID: 6592)
      • RegAsm.exe (PID: 6264)
      • WerFault.exe (PID: 6576)
      • SPfiLqebchPP9k4C00Ot3v9m.exe (PID: 6580)
      • zmediarecode32.exe (PID: 3268)
      • RegAsm.exe (PID: 2628)

    • Creates files or folders in the user directory

      • RegAsm.exe (PID: 7700)
      • RegAsm.exe (PID: 6592)
      • q2Xf2JPfVGmBHXtQ6UBLZw1D.exe (PID: 7432)
      • Q9QrSbGssx8nmriX4DPihWVN.tmp (PID: 7732)
      • RegAsm.exe (PID: 6264)
      • WerFault.exe (PID: 6576)
      • SPfiLqebchPP9k4C00Ot3v9m.exe (PID: 6580)
      • RegAsm.exe (PID: 2628)

    • Create files in a temporary directory

      • Q9QrSbGssx8nmriX4DPihWVN.exe (PID: 1780)
      • RegAsm.exe (PID: 2628)
      • Q9QrSbGssx8nmriX4DPihWVN.tmp (PID: 7732)
      • q2Xf2JPfVGmBHXtQ6UBLZw1D.exe (PID: 7432)

    • Reads CPU info

      • RegAsm.exe (PID: 6592)
      • RegAsm.exe (PID: 6264)
      • SPfiLqebchPP9k4C00Ot3v9m.exe (PID: 6580)
      • RegAsm.exe (PID: 2628)

    • Reads product name

      • RegAsm.exe (PID: 6592)
      • RegAsm.exe (PID: 6264)
      • SPfiLqebchPP9k4C00Ot3v9m.exe (PID: 6580)
      • RegAsm.exe (PID: 2628)

    • Creates files in the program directory

      • q2Xf2JPfVGmBHXtQ6UBLZw1D.exe (PID: 7432)
      • zmediarecode32.exe (PID: 3268)
      • RegAsm.exe (PID: 6592)
      • RegAsm.exe (PID: 6264)
      • Q1xWs2ck7FZDoxVcK8VXWwks.exe (PID: 1752)
      • SPfiLqebchPP9k4C00Ot3v9m.exe (PID: 6580)
      • RegAsm.exe (PID: 2628)

    • Creates a software uninstall entry

      • Q9QrSbGssx8nmriX4DPihWVN.tmp (PID: 7732)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 5612)
      • powershell.exe (PID: 2900)
      • powershell.exe (PID: 448)
      • powershell.exe (PID: 892)
      • powershell.exe (PID: 8028)
      • powershell.exe (PID: 6408)
      • powershell.exe (PID: 6508)
      • powershell.exe (PID: 6816)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 5612)
      • powershell.exe (PID: 2900)
      • powershell.exe (PID: 448)
      • powershell.exe (PID: 892)
      • powershell.exe (PID: 8028)
      • powershell.exe (PID: 6508)
      • powershell.exe (PID: 6408)
      • powershell.exe (PID: 6816)

    • Themida protector has been detected

      • SPfiLqebchPP9k4C00Ot3v9m.exe (PID: 6580)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Stealc

(PID) Process(6592) RegAsm.exe
C246.8.231.109
Strings (353)INSERT_KEY_HERE
09
09
20
24
GetProcAddress
LoadLibraryA
lstrcatA
OpenEventA
CreateEventA
CloseHandle
Sleep
GetUserDefaultLangID
VirtualAllocExNuma
VirtualFree
GetSystemInfo
VirtualAlloc
HeapAlloc
GetComputerNameA
lstrcpyA
GetProcessHeap
GetCurrentProcess
lstrlenA
ExitProcess
GlobalMemoryStatusEx
GetSystemTime
SystemTimeToFileTime
advapi32.dll
gdi32.dll
user32.dll
crypt32.dll
ntdll.dll
GetUserNameA
CreateDCA
GetDeviceCaps
ReleaseDC
CryptStringToBinaryA
sscanf
VMwareVMware
HAL9TH
JohnDoe
DISPLAY
%hu/%hu/%hu
http://46.8.231.109
george
|
/c4754d4f680ead72.php
/1309cdeb8f4c8736/
default
GetEnvironmentVariableA
GetFileAttributesA
GlobalLock
HeapFree
GetFileSize
GlobalSize
CreateToolhelp32Snapshot
IsWow64Process
Process32Next
GetLocalTime
FreeLibrary
GetTimeZoneInformation
GetSystemPowerStatus
GetVolumeInformationA
GetWindowsDirectoryA
Process32First
GetLocaleInfoA
GetUserDefaultLocaleName
GetModuleFileNameA
DeleteFileA
FindNextFileA
LocalFree
FindClose
SetEnvironmentVariableA
LocalAlloc
GetFileSizeEx
ReadFile
SetFilePointer
WriteFile
CreateFileA
FindFirstFileA
CopyFileA
VirtualProtect
GetLogicalProcessorInformationEx
GetLastError
lstrcpynA
MultiByteToWideChar
GlobalFree
WideCharToMultiByte
GlobalAlloc
OpenProcess
TerminateProcess
GetCurrentProcessId
gdiplus.dll
ole32.dll
bcrypt.dll
wininet.dll
shlwapi.dll
shell32.dll
psapi.dll
rstrtmgr.dll
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteObject
CreateCompatibleDC
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreateBitmapFromHBITMAP
GdiplusStartup
GdiplusShutdown
GdipSaveImageToStream
GdipDisposeImage
GdipFree
GetHGlobalFromStream
CreateStreamOnHGlobal
CoUninitialize
CoInitialize
CoCreateInstance
BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
BCryptDecrypt
BCryptSetProperty
BCryptDestroyKey
BCryptOpenAlgorithmProvider
GetWindowRect
GetDesktopWindow
GetDC
CloseWindow
wsprintfA
EnumDisplayDevicesA
GetKeyboardLayoutList
CharToOemW
wsprintfW
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
RegCloseKey
RegEnumValueA
CryptBinaryToStringA
CryptUnprotectData
SHGetFolderPathA
ShellExecuteExA
InternetOpenUrlA
InternetConnectA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetReadFile
InternetCrackUrlA
StrCmpCA
StrStrA
StrCmpCW
PathMatchSpecA
GetModuleFileNameExA
RmStartSession
RmRegisterResources
RmGetList
RmEndSession
sqlite3_open
sqlite3_prepare_v2
sqlite3_step
sqlite3_column_text
sqlite3_finalize
sqlite3_close
sqlite3_column_bytes
sqlite3_column_blob
encrypted_key
PATH
C:\ProgramData\nss3.dll
NSS_Init
NSS_Shutdown
PK11_GetInternalKeySlot
PK11_FreeSlot
PK11_Authenticate
PK11SDR_Decrypt
C:\ProgramData\
SELECT origin_url, username_value, password_value FROM logins
browser:
profile:
url:
login:
password:
Opera
OperaGX
Network
cookies
.txt
SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
TRUE
FALSE
autofill
SELECT name, value FROM autofill
history
SELECT url FROM urls LIMIT 1000
cc
SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
name:
month:
year:
card:
Cookies
Login Data
Web Data
History
logins.json
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
guid
SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
SELECT fieldname, value FROM moz_formhistory
SELECT url FROM moz_places LIMIT 1000
cookies.sqlite
formhistory.sqlite
places.sqlite
plugins
Local Extension Settings
Sync Extension Settings
IndexedDB
Opera Stable
Opera GX Stable
CURRENT
chrome-extension_
_0.indexeddb.leveldb
Local State
profiles.ini
chrome
opera
firefox
wallets
%08lX%04lX%lu
SOFTWARE\Microsoft\Windows NT\CurrentVersion
ProductName
x32
x64
%d/%d/%d %d:%d:%d
HARDWARE\DESCRIPTION\System\CentralProcessor\0
ProcessorNameString
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
DisplayName
DisplayVersion
Network Info:
- IP: IP?
- Country: ISO?
System Summary:
- HWID:
- OS:
- Architecture:
- UserName:
- Computer Name:
- Local Time:
- UTC:
- Language:
- Keyboards:
- Laptop:
- Running Path:
- CPU:
- Threads:
- Cores:
- RAM:
- Display Resolution:
- GPU:
User Agents:
Installed Apps:
All Users:
Current User:
Process List:
system_info.txt
freebl3.dll
mozglue.dll
msvcp140.dll
nss3.dll
softokn3.dll
vcruntime140.dll
\Temp\
.exe
runas
open
/c start
%DESKTOP%
%APPDATA%
%LOCALAPPDATA%
%USERPROFILE%
%DOCUMENTS%
%PROGRAMFILES%
%PROGRAMFILES_86%
%RECENT%
*.lnk
files
\discord\
\Local Storage\leveldb\CURRENT
\Local Storage\leveldb
\Telegram Desktop\
key_datas
D877F783D5D3EF8C*
map*
A7FDF864FBC10B77*
A92DAA6EA6F891F2*
F8806DD0C461824F*
Telegram
Tox
*.tox
*.ini
Password
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
00000001
00000002
00000003
00000004
\Outlook\accounts.txt
Pidgin
\.purple\
accounts.xml
dQw4w9WgXcQ
token:
Software\Valve\Steam
SteamPath
\config\
ssfn*
config.vdf
DialogConfig.vdf
DialogConfigOverlay*.vdf
libraryfolders.vdf
loginusers.vdf
\Steam\
sqlite3.dll
browsers
done
soft
\Discord\tokens.txt
/c timeout /t 5 & del /f /q "
" & del "C:\ProgramData\*.dll"" & exit
C:\Windows\system32\cmd.exe
https
Content-Type: multipart/form-data; boundary=----
POST
HTTP/1.1
Content-Disposition: form-data; name="
hwid
build
token
file_name
file
message
ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
screenshot.jpg

Vidar

(PID) Process(2628) RegAsm.exe
C2https://t.me/iyigunl
URLhttps://steamcommunity.com/profiles/76561199761128941
Strings (239)INSERT_KEY_HERE
lstrcpyA
GetEnvironmentVariableA
GdipSaveImageToStream
History
runas
ssfn*
GetProcAddress
lstrcatA
OpenEventA
CloseHandle
Sleep
GetUserDefaultLangID
VirtualAllocExNuma
VirtualFree
GetSystemInfo
HeapAlloc
GetComputerNameA
GetProcessHeap
GetCurrentProcess
lstrlenA
ExitProcess
GlobalMemoryStatusEx
GetSystemTime
SystemTimeToFileTime
gdi32.dll
user32.dll
crypt32.dll
ntdll.dll
CreateDCA
GetDeviceCaps
ReleaseDC
CryptStringToBinaryA
sscanf
NtQueryInformationProcess
HAL9TH
JohnDoe
DISPLAY
%hu/%hu/%hu
GetFileAttributesA
GlobalLock
GlobalSize
CreateToolhelp32Snapshot
IsWow64Process
Process32Next
GetLocalTime
GetTimeZoneInformation
GetSystemPowerStatus
GetVolumeInformationA
Process32First
GetLocaleInfoA
GetUserDefaultLocaleName
GetModuleFileNameA
FindNextFileA
SetEnvironmentVariableA
LocalAlloc
GetFileSizeEx
SetFilePointer
FindFirstFileA
VirtualProtect
GetLogicalProcessorInformationEx
GetLastError
MultiByteToWideChar
GlobalFree
WideCharToMultiByte
TerminateProcess
GetCurrentProcessId
rstrtmgr.dll
CreateCompatibleBitmap
SelectObject
BitBlt
DeleteObject
CreateCompatibleDC
GdipGetImageEncodersSize
GdipGetImageEncoders
GdipCreateBitmapFromHBITMA
GdiplusStartup
GdiplusShutdown
GdipDisposeImage
GetHGlobalFromStream
CreateStreamOnHGlobal
CoUninitialize
CoInitialize
CoCreateInstance
BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
BCryptDecrypt
BCryptSetProperty
BCryptDestroyKey
BCryptOpenAlgorithmProvider
GetWindowRect
GetDesktopWindow
GetDC
EnumDisplayDevicesA
GetKeyboardLayoutList
CharToOemW
RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
RegEnumValueA
CryptBinaryToStringA
CryptUnprotectData
SHGetFolderPathA
InternetOpenUrlA
InternetConnectA
InternetCloseHandle
InternetOpenA
HttpSendRequestA
HttpOpenRequestA
InternetReadFile
InternetCrackUrlA
StrStrA
PathMatchSpecA
GetModuleFileNameExA
RmStartSession
RmRegisterResources
RmEndSession
sqlite3_open
sqlite3_prepare_v2
sqlite3_step
sqlite3_column_text
sqlite3_finalize
sqlite3_close
sqlite3_column_bytes
sqlite3_column_blob
encrypted_key
PATH
C:\ProgramData\nss3.dll
NSS_Shutdown
PK11_GetInternalKeySlot
PK11_FreeSlot
PK11_Authenticate
PK11SDR_Decrypt
C:\ProgramData\
SELECT origin_url, username_value, password_value FROM logins
Soft:
Host:
Login:
Password:
Opera
OperaGX
Network
Cookies
.txt
TRUE
FALSE
SELECT name, value FROM autofill
History
SELECT url FROM urls LIMIT 1000
CC
SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Name:
Month:
Year:
Card:
Cookies
Login Data
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
guid
SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
SELECT fieldname, value FROM moz_formhistory
SELECT url FROM moz_places LIMIT 1000
cookies.sqlite
formhistory.sqlite
places.sqlite
Plugins
Local Extension Settings
Sync Extension Settings
Opera Stable
Opera GX Stable
CURRENT
chrome-extension_
_0.indexeddb.leveldb
profiles.ini
chrome
opera
firefox
Wallets
%08lX%04lX%lu
SOFTWARE\Microsoft\Windows NT\CurrentVersion
x64
%d/%d/%d %d:%d:%d
HARDWARE\DESCRIPTION\System\CentralProcessor\0
ProcessorNameString
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
DisplayVersion
msvcp140.dll
softokn3.dll
vcruntime140.dll
\Temp\
.exe
open
%LOCALAPPDATA%
%USERPROFILE%
%PROGRAMFILES%
%PROGRAMFILES_86%
*.lnk
Files
\Local Storage\leveldb\CURRENT
\Local Storage\leveldb
\Telegram Desktop\
D877F783D5D3EF8C*
map*
A7FDF864FBC10B77*
A92DAA6EA6F891F2*
F8806DD0C461824F*
Tox
*.tox
*.ini
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375
Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Software\Microsoft\Office.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
\Outlook\accounts.txt
Pidgin
accounts.xml
token:
Software\Valve\Steam
config.vdf
DialogConfig.vdf
DialogConfigOverlay*.vdf
libraryfolders.vdf
loginusers.vdf
\Steam\
\Discord\tokens.txt
/c timeout /t 5 & del /f /q "
" & del "C:\ProgramData\*.dll"" & exit
C:\Windows\system32\cmd.exe
Content-Type: multipart/form-data; boundary=----
Content-Disposition: form-data; name="
build
token
message
ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
screenshot.jpg
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
265
Monitored processes
133
Malicious processes
25
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs rundll32.exe no specs winrar.exe no specs winrar.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs THREAT fileapp.exe msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs #PRIVATELOADER regasm.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs #LUMMA svchost.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs a0nsavm9ehsvexonxhphawzy.exe no specs mjlery9804bcsabqpvknyptt.exe conhost.exe no specs q9qrsbgssx8nmrix4dpihwvn.exe omlqpz95v6guhopnzofepu1o.exe no specs conhost.exe no specs THREAT spfilqebchpp9k4c00ot3v9m.exe q1xws2ck7fzdoxvck8vxwwks.exe mdpezmzavbbudd8ok9v5eczw.exe no specs q2xf2jpfvgmbhxtq6ublzw1d.exe no specs #STEALC regasm.exe q9qrsbgssx8nmrix4dpihwvn.tmp #VIDAR regasm.exe #METASTEALER mdpezmzavbbudd8ok9v5eczw.exe #RISEPRO q2xf2jpfvgmbhxtq6ublzw1d.exe conhost.exe no specs schtasks.exe no specs conhost.exe no specs #SOCKS5SYSTEMZ zmediarecode32.exe schtasks.exe no specs conhost.exe no specs msedge.exe powershell.exe no specs conhost.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs adminhcfbkkebke.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs #STEALC regasm.exe adminjkehiijjec.exe no specs conhost.exe no specs #LUMMA regasm.exe powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs werfault.exe powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs sc.exe no specs sc.exe no specs conhost.exe no specs conhost.exe no specs etzpikspwykg.exe powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs svchost.exe powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs #LUMMA msptjhkfda.exe

Process information

PID
CMD
Path
Indicators
Parent process
304"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://versaclean.com.br/wp-content/uploads/2024/archt843.7z"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
376"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5072 --field-trial-handle=2368,i,12156393120669154349,2741601138954870947,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
448powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files'"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—mjlery9804bcSAbQpVKnYPtT.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
872"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4032 --field-trial-handle=2392,i,4627503804096449797,243132848262666850,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
892powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files (x86)'"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—mjlery9804bcSAbQpVKnYPtT.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1044"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Downloads\get7543.7z" C:\Users\admin\Downloads\C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1076C:\WINDOWS\system32\sc.exe delete "VIFLJRPW"C:\Windows\System32\sc.exe—Q1xWs2ck7FZDoxVcK8VXWwks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1172"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2300 --field-trial-handle=2392,i,4627503804096449797,243132848262666850,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1232"C:\Users\adminJKEHIIJJEC.exe" C:\Users\adminJKEHIIJJEC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Auto File System Format Utility
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\users\adminjkehiijjec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1436"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\adminJKEHIIJJEC.exe"C:\Windows\SysWOW64\cmd.exe—RegAsm.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
101 931
Read events
101 656
Write events
252
Delete events
23

Modification events

(PID) Process:(304) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(304) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(304) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(304) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(304) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(304) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:dr
Value:
1
(PID) Process:(304) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(304) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge
Operation:writeName:UsageStatsInSample
Value:
1
(PID) Process:(304) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:usagestats
Value:
0
(PID) Process:(304) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:writeName:urlstats
Value:
0
Executable files
70
Suspicious files
308
Text files
294
Unknown types
15

Dropped files

PID
Process
Filename
Type
304msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF12a9b5.TMP —
MD5:—
SHA256:—
304msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
304msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF12aa03.TMP —
MD5:—
SHA256:—
304msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF12aa03.TMP —
MD5:—
SHA256:—
304msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
304msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF12aa03.TMP —
MD5:—
SHA256:—
304msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
304msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
304msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF12aa03.TMP —
MD5:—
SHA256:—
304msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
119
TCP/UDP connections
95
DNS requests
66
Threats
119

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2108
svchost.exe
GET
—
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
—
—
whitelisted
5172
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
DE
binary
419 b
whitelisted
7700
RegAsm.exe
GET
200
62.133.61.172:80
http://62.133.61.172/api/crazyfish.php
RU
text
6 b
unknown
4976
svchost.exe
HEAD
200
23.48.23.42:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ec3f42ff-db07-4960-b560-3fa136bcb5d5?P1=1725611103&P2=404&P3=2&P4=cMk9Ol0vwXVynVVCmOdj9SS7wpBMndEXj1kBI6cR%2f8RAfZZFpCJMd6rYprDe56r8URxZ4zn%2fX38%2bKmGlgv0ZcQ%3d%3d
DE
—
—
whitelisted
5172
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
DE
binary
407 b
whitelisted
4976
svchost.exe
GET
206
23.48.23.42:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ec3f42ff-db07-4960-b560-3fa136bcb5d5?P1=1725611103&P2=404&P3=2&P4=cMk9Ol0vwXVynVVCmOdj9SS7wpBMndEXj1kBI6cR%2f8RAfZZFpCJMd6rYprDe56r8URxZ4zn%2fX38%2bKmGlgv0ZcQ%3d%3d
DE
binary
1.09 Kb
whitelisted
4976
svchost.exe
GET
206
23.48.23.42:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ec3f42ff-db07-4960-b560-3fa136bcb5d5?P1=1725611103&P2=404&P3=2&P4=cMk9Ol0vwXVynVVCmOdj9SS7wpBMndEXj1kBI6cR%2f8RAfZZFpCJMd6rYprDe56r8URxZ4zn%2fX38%2bKmGlgv0ZcQ%3d%3d
DE
binary
9.01 Kb
whitelisted
4976
svchost.exe
GET
206
23.48.23.42:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ec3f42ff-db07-4960-b560-3fa136bcb5d5?P1=1725611103&P2=404&P3=2&P4=cMk9Ol0vwXVynVVCmOdj9SS7wpBMndEXj1kBI6cR%2f8RAfZZFpCJMd6rYprDe56r8URxZ4zn%2fX38%2bKmGlgv0ZcQ%3d%3d
DE
binary
33.0 Kb
whitelisted
4976
svchost.exe
GET
206
23.48.23.42:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ec3f42ff-db07-4960-b560-3fa136bcb5d5?P1=1725611103&P2=404&P3=2&P4=cMk9Ol0vwXVynVVCmOdj9SS7wpBMndEXj1kBI6cR%2f8RAfZZFpCJMd6rYprDe56r8URxZ4zn%2fX38%2bKmGlgv0ZcQ%3d%3d
DE
binary
10.4 Kb
whitelisted
4976
svchost.exe
GET
206
23.48.23.42:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/ec3f42ff-db07-4960-b560-3fa136bcb5d5?P1=1725611103&P2=404&P3=2&P4=cMk9Ol0vwXVynVVCmOdj9SS7wpBMndEXj1kBI6cR%2f8RAfZZFpCJMd6rYprDe56r8URxZ4zn%2fX38%2bKmGlgv0ZcQ%3d%3d
DE
binary
84.8 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
6892
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
304
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
6892
msedge.exe
204.79.197.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6892
msedge.exe
52.153.155.231:443
api.edgeoffer.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6892
msedge.exe
188.114.96.3:443
versaclean.com.br
—
—
malicious
3260
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6892
msedge.exe
13.107.6.158:443
business.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 172.217.16.206
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
versaclean.com.br
  • 188.114.96.3
  • 188.114.97.3
unknown
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
api.edgeoffer.microsoft.com
  • 52.153.155.231
whitelisted
client.wns.windows.com
  • 40.113.103.199
  • 40.113.110.67
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
bzib.nelreports.net
  • 23.48.23.51
  • 23.48.23.46
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.253.67
whitelisted

Threats

PID
Process
Class
Message
2256
svchost.exe
Misc activity
ET INFO External IP Lookup Domain (ipify .org) in DNS Lookup
7700
RegAsm.exe
A Network Trojan was detected
ET MALWARE PrivateLoader CnC Activity (GET)
7700
RegAsm.exe
Misc activity
ET INFO External IP Address Lookup Domain (ipify .org) in TLS SNI
7700
RegAsm.exe
Device Retrieving External IP Address Detected
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
7700
RegAsm.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup SSL Cert Observed (ipinfo .io)
2256
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ipinfo .io)
7700
RegAsm.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7700
RegAsm.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7700
RegAsm.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
7700
RegAsm.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
5 ETPRO signatures available at the full report
Process
Message
SPfiLqebchPP9k4C00Ot3v9m.exe
%s------------------------------------------------ --- Themida Professional --- --- (c)2012 Oreans Technologies --- ------------------------------------------------
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://versaclean.com.br/wp-content/uploads/2024/archt843.7z