File name:

f1642209292.zip

Full analysis: https://app.any.run/tasks/977397cd-2f82-4b6a-ae8c-0a89fb5aae80
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 15, 2022, 01:15:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
trojan
loader
rat
redline
stealer
vidar
opendir
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

D1B2855320289D34316F45C6E3D59065

SHA1:

6A976AC887AC14AC67B9B8CCDAC7B5D7C97D1F9E

SHA256:

EFF7FD5659A327D68293C30DF9FED1D633877A722E02D2F534108939CA3A7099

SSDEEP:

3072:9Dt49qUqvyQdPv/rN+EKleG+RJ22v7TFK89qu2HfbcRJey2Inx05vbo:9Dt4gJvy+xU+RTOu2Dc3T2Ix05Do

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • WinRAR.exe (PID: 2260)
      • svchost.exe (PID: 860)
      • ZivKTnAr7w9xt_7BHdO2JPFf.exe (PID: 436)
      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)
      • Xm0yK3Tw8ek6TSvGMQ5WOvIe.exe (PID: 1028)
      • HHzWRgvwqwAKbkBsVddhjkLm.exe (PID: 2608)
      • RegAsm.exe (PID: 3528)
      • AppLaunch.exe (PID: 3540)
      • AppLaunch.exe (PID: 1496)
      • SoDmuHhPgBhjtrV6DA70hbpi.exe (PID: 1436)

    • Application was dropped or rewritten from another process

      • Setup.exe (PID: 1420)
      • Setup.exe (PID: 1160)
      • OracleSearch.exe (PID: 2672)
      • 4WQLnK0dCeR3Lp2xf6O1LiM7.exe (PID: 3568)
      • zn2PumNkov9MCRtUxcQg3Flk.exe (PID: 2848)
      • ixT1donAxy7TlWzoGnObbGUw.exe (PID: 296)
      • iBvCPKCX4yF3fECm3p7Tp_z_.exe (PID: 3024)
      • ToLqlgs1rpsOEiFHgRpk6mpt.exe (PID: 3504)
      • ESFzVcMTPpIcNkWLxBGKxN8d.exe (PID: 2908)
      • ZivKTnAr7w9xt_7BHdO2JPFf.exe (PID: 436)
      • ESFzVcMTPpIcNkWLxBGKxN8d.exe (PID: 3324)
      • zn2PumNkov9MCRtUxcQg3Flk.exe (PID: 2444)
      • ixT1donAxy7TlWzoGnObbGUw.exe (PID: 3232)
      • siM5bGjFdchjpSExIcQ7Hulf.exe (PID: 3144)
      • cYySv7jIZuzYN7jvMJsmH6th.exe (PID: 4000)
      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)
      • RcqOZ1U7z3966WgnhYJg6MHl.exe (PID: 4036)
      • Xm0yK3Tw8ek6TSvGMQ5WOvIe.exe (PID: 1028)
      • 8CgpJYDLzmist6SEAgq4vr5O.exe (PID: 3060)
      • HHzWRgvwqwAKbkBsVddhjkLm.exe (PID: 2608)
      • 63845806180.exe (PID: 2468)
      • Tlhakssf9zE42egCEU2YcXUO.exe (PID: 2060)
      • SqbfIqWLpO4v9JfnHirTRtlb.exe (PID: 1080)
      • 5433.tmp.exe (PID: 3172)
      • 53275277524.exe (PID: 2496)
      • 0Yv7neEiD8yLhGgYkAuPjaxC.exe (PID: 2024)
      • Laecuvafyky.exe (PID: 908)
      • Koxumaecuma.exe (PID: 3616)
      • 6DC8.tmp.exe (PID: 1524)
      • neofim.exe (PID: 3168)
      • aOrr6NrqysUW1Apt6G1SE8FZ.exe (PID: 3548)
      • 98CJ2d1mGyVg7FkMS2eEq2K1.exe (PID: 4336)
      • 020Z8fSK1Qh9_iQHhRTQhAmD.exe (PID: 3236)
      • ckDmBlL8bRc8mIsi5nPa21JZ.exe (PID: 1468)
      • FXxmbZ9n9PwHAiKKMZEiv253.exe (PID: 1364)
      • SoDmuHhPgBhjtrV6DA70hbpi.exe (PID: 1436)
      • Install.exe (PID: 2820)
      • 1JhulqmnSlCmSKe6YwR3OOBI.exe (PID: 3300)
      • foldershare.exe (PID: 2960)
      • NAXx7bbat0YZHl8CxIeGp8ZB.exe (PID: 1340)
      • Install.exe (PID: 3156)

    • Drops executable file immediately after starts

      • Setup.exe (PID: 1160)
      • 4WQLnK0dCeR3Lp2xf6O1LiM7.exe (PID: 3568)
      • Tlhakssf9zE42egCEU2YcXUO.exe (PID: 2060)
      • Tlhakssf9zE42egCEU2YcXUO.tmp (PID: 412)

    • Changes settings of System certificates

      • OracleSearch.exe (PID: 2672)
      • iBvCPKCX4yF3fECm3p7Tp_z_.exe (PID: 3024)
      • ESFzVcMTPpIcNkWLxBGKxN8d.exe (PID: 3324)
      • Koxumaecuma.exe (PID: 3616)

    • Disables Windows Defender

      • OracleSearch.exe (PID: 2672)
      • cYySv7jIZuzYN7jvMJsmH6th.exe (PID: 4000)

    • Connects to CnC server

      • OracleSearch.exe (PID: 2672)
      • ZivKTnAr7w9xt_7BHdO2JPFf.exe (PID: 436)
      • Xm0yK3Tw8ek6TSvGMQ5WOvIe.exe (PID: 1028)
      • HHzWRgvwqwAKbkBsVddhjkLm.exe (PID: 2608)
      • RegAsm.exe (PID: 3528)
      • iBvCPKCX4yF3fECm3p7Tp_z_.exe (PID: 3024)
      • AppLaunch.exe (PID: 3540)
      • AppLaunch.exe (PID: 1496)
      • cYySv7jIZuzYN7jvMJsmH6th.exe (PID: 4000)
      • 1JhulqmnSlCmSKe6YwR3OOBI.exe (PID: 3300)
      • neofim.exe (PID: 3168)

    • REDLINE was detected

      • ZivKTnAr7w9xt_7BHdO2JPFf.exe (PID: 436)
      • HHzWRgvwqwAKbkBsVddhjkLm.exe (PID: 2608)
      • Xm0yK3Tw8ek6TSvGMQ5WOvIe.exe (PID: 1028)
      • RegAsm.exe (PID: 3528)
      • AppLaunch.exe (PID: 3540)
      • AppLaunch.exe (PID: 1496)
      • 1JhulqmnSlCmSKe6YwR3OOBI.exe (PID: 3300)
      • neofim.exe (PID: 3168)

    • Runs injected code in another process

      • rundll32.exe (PID: 2016)

    • Application was injected by another process

      • svchost.exe (PID: 860)

    • Steals credentials from Web Browsers

      • ZivKTnAr7w9xt_7BHdO2JPFf.exe (PID: 436)
      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)
      • Xm0yK3Tw8ek6TSvGMQ5WOvIe.exe (PID: 1028)
      • HHzWRgvwqwAKbkBsVddhjkLm.exe (PID: 2608)
      • AppLaunch.exe (PID: 3540)
      • AppLaunch.exe (PID: 1496)
      • RegAsm.exe (PID: 3528)
      • SoDmuHhPgBhjtrV6DA70hbpi.exe (PID: 1436)

    • Uses Task Scheduler to autorun other applications

      • iBvCPKCX4yF3fECm3p7Tp_z_.exe (PID: 3024)

    • Uses Task Scheduler to run other applications

      • iBvCPKCX4yF3fECm3p7Tp_z_.exe (PID: 3024)
      • Install.exe (PID: 3156)

    • Loads the Task Scheduler COM API

      • schtasks.exe (PID: 2176)
      • schtasks.exe (PID: 1248)

    • VIDAR was detected

      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)
      • SoDmuHhPgBhjtrV6DA70hbpi.exe (PID: 1436)

    • Stealing of credential data

      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)

    • Loads dropped or rewritten executable

      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)
      • rundll32.exe (PID: 2016)
      • SoDmuHhPgBhjtrV6DA70hbpi.exe (PID: 1436)

    • Changes the autorun value in the registry

      • ________djskjT76(((.exe (PID: 2312)

    • Unusual execution from Microsoft Office

      • foldershare.exe (PID: 2960)

    • Writes to a start menu file

      • 6DC8.tmp.exe (PID: 1524)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 2172)
      • WinRAR.exe (PID: 2260)
      • OracleSearch.exe (PID: 2672)
      • Setup.exe (PID: 1160)
      • 4WQLnK0dCeR3Lp2xf6O1LiM7.exe (PID: 3568)
      • zn2PumNkov9MCRtUxcQg3Flk.exe (PID: 2848)
      • ixT1donAxy7TlWzoGnObbGUw.exe (PID: 296)
      • iBvCPKCX4yF3fECm3p7Tp_z_.exe (PID: 3024)
      • ToLqlgs1rpsOEiFHgRpk6mpt.exe (PID: 3504)
      • ZivKTnAr7w9xt_7BHdO2JPFf.exe (PID: 436)
      • ESFzVcMTPpIcNkWLxBGKxN8d.exe (PID: 2908)
      • ESFzVcMTPpIcNkWLxBGKxN8d.exe (PID: 3324)
      • siM5bGjFdchjpSExIcQ7Hulf.exe (PID: 3144)
      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)
      • RcqOZ1U7z3966WgnhYJg6MHl.exe (PID: 4036)
      • zn2PumNkov9MCRtUxcQg3Flk.exe (PID: 2444)
      • Xm0yK3Tw8ek6TSvGMQ5WOvIe.exe (PID: 1028)
      • 8CgpJYDLzmist6SEAgq4vr5O.exe (PID: 3060)
      • HHzWRgvwqwAKbkBsVddhjkLm.exe (PID: 2608)
      • RegAsm.exe (PID: 3528)
      • Tlhakssf9zE42egCEU2YcXUO.exe (PID: 2060)
      • Tlhakssf9zE42egCEU2YcXUO.tmp (PID: 412)
      • ixT1donAxy7TlWzoGnObbGUw.exe (PID: 3232)
      • 5433.tmp.exe (PID: 3172)
      • ________djskjT76(((.exe (PID: 2312)
      • cmd.exe (PID: 3156)
      • cYySv7jIZuzYN7jvMJsmH6th.exe (PID: 4000)
      • svchost.exe (PID: 860)
      • 0Yv7neEiD8yLhGgYkAuPjaxC.exe (PID: 2024)
      • 53275277524.exe (PID: 2496)
      • AppLaunch.exe (PID: 3540)
      • Laecuvafyky.exe (PID: 908)
      • Koxumaecuma.exe (PID: 3616)
      • 6DC8.tmp.exe (PID: 1524)
      • cmd.exe (PID: 3876)
      • foldershare.exe (PID: 2960)
      • foldershare.tmp (PID: 1400)
      • ckDmBlL8bRc8mIsi5nPa21JZ.exe (PID: 1468)
      • FolderShare.exe (PID: 3776)
      • cmd.exe (PID: 1864)
      • AppLaunch.exe (PID: 1496)
      • 63845806180.exe (PID: 2468)
      • FXxmbZ9n9PwHAiKKMZEiv253.exe (PID: 1364)
      • SoDmuHhPgBhjtrV6DA70hbpi.exe (PID: 1436)
      • cmd.exe (PID: 784)
      • Install.exe (PID: 2820)
      • SqbfIqWLpO4v9JfnHirTRtlb.exe (PID: 1080)
      • Install.exe (PID: 3156)
      • 1JhulqmnSlCmSKe6YwR3OOBI.exe (PID: 3300)
      • aOrr6NrqysUW1Apt6G1SE8FZ.exe (PID: 3548)
      • 020Z8fSK1Qh9_iQHhRTQhAmD.exe (PID: 3236)
      • NAXx7bbat0YZHl8CxIeGp8ZB.exe (PID: 1340)
      • e5dde5c0-3314-4329-be40-a6574f7a9485.exe (PID: 8000)

    • Application launched itself

      • WinRAR.exe (PID: 2172)
      • ESFzVcMTPpIcNkWLxBGKxN8d.exe (PID: 2908)
      • zn2PumNkov9MCRtUxcQg3Flk.exe (PID: 2848)
      • ixT1donAxy7TlWzoGnObbGUw.exe (PID: 296)

    • Reads the computer name

      • WinRAR.exe (PID: 2172)
      • WinRAR.exe (PID: 2260)
      • Setup.exe (PID: 1160)
      • OracleSearch.exe (PID: 2672)
      • iBvCPKCX4yF3fECm3p7Tp_z_.exe (PID: 3024)
      • ESFzVcMTPpIcNkWLxBGKxN8d.exe (PID: 2908)
      • ESFzVcMTPpIcNkWLxBGKxN8d.exe (PID: 3324)
      • siM5bGjFdchjpSExIcQ7Hulf.exe (PID: 3144)
      • ZivKTnAr7w9xt_7BHdO2JPFf.exe (PID: 436)
      • Xm0yK3Tw8ek6TSvGMQ5WOvIe.exe (PID: 1028)
      • RcqOZ1U7z3966WgnhYJg6MHl.exe (PID: 4036)
      • HHzWRgvwqwAKbkBsVddhjkLm.exe (PID: 2608)
      • RegAsm.exe (PID: 3528)
      • 8CgpJYDLzmist6SEAgq4vr5O.exe (PID: 3060)
      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)
      • Tlhakssf9zE42egCEU2YcXUO.tmp (PID: 412)
      • 5433.tmp.exe (PID: 3172)
      • ________djskjT76(((.exe (PID: 2312)
      • AppLaunch.exe (PID: 3540)
      • cYySv7jIZuzYN7jvMJsmH6th.exe (PID: 4000)
      • Laecuvafyky.exe (PID: 908)
      • Koxumaecuma.exe (PID: 3616)
      • 53275277524.exe (PID: 2496)
      • foldershare.tmp (PID: 1400)
      • FolderShare.exe (PID: 3776)
      • AppLaunch.exe (PID: 1496)
      • SoDmuHhPgBhjtrV6DA70hbpi.exe (PID: 1436)
      • 63845806180.exe (PID: 2468)
      • Install.exe (PID: 3156)
      • 1JhulqmnSlCmSKe6YwR3OOBI.exe (PID: 3300)
      • aOrr6NrqysUW1Apt6G1SE8FZ.exe (PID: 3548)
      • 020Z8fSK1Qh9_iQHhRTQhAmD.exe (PID: 3236)
      • NAXx7bbat0YZHl8CxIeGp8ZB.exe (PID: 1340)
      • e5dde5c0-3314-4329-be40-a6574f7a9485.exe (PID: 8000)

    • Drops a file with a compile date too recent

      • Setup.exe (PID: 1160)
      • WinRAR.exe (PID: 2260)
      • OracleSearch.exe (PID: 2672)
      • ESFzVcMTPpIcNkWLxBGKxN8d.exe (PID: 3324)
      • RcqOZ1U7z3966WgnhYJg6MHl.exe (PID: 4036)
      • Tlhakssf9zE42egCEU2YcXUO.tmp (PID: 412)
      • iBvCPKCX4yF3fECm3p7Tp_z_.exe (PID: 3024)
      • ________djskjT76(((.exe (PID: 2312)
      • 8CgpJYDLzmist6SEAgq4vr5O.exe (PID: 3060)
      • cYySv7jIZuzYN7jvMJsmH6th.exe (PID: 4000)
      • 020Z8fSK1Qh9_iQHhRTQhAmD.exe (PID: 3236)
      • aOrr6NrqysUW1Apt6G1SE8FZ.exe (PID: 3548)
      • AppLaunch.exe (PID: 3540)
      • AppLaunch.exe (PID: 1496)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2260)
      • Setup.exe (PID: 1160)
      • OracleSearch.exe (PID: 2672)
      • 4WQLnK0dCeR3Lp2xf6O1LiM7.exe (PID: 3568)
      • ESFzVcMTPpIcNkWLxBGKxN8d.exe (PID: 3324)
      • iBvCPKCX4yF3fECm3p7Tp_z_.exe (PID: 3024)
      • Tlhakssf9zE42egCEU2YcXUO.exe (PID: 2060)
      • Tlhakssf9zE42egCEU2YcXUO.tmp (PID: 412)
      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)
      • 8CgpJYDLzmist6SEAgq4vr5O.exe (PID: 3060)
      • RcqOZ1U7z3966WgnhYJg6MHl.exe (PID: 4036)
      • ________djskjT76(((.exe (PID: 2312)
      • 6DC8.tmp.exe (PID: 1524)
      • 63845806180.exe (PID: 2468)
      • cYySv7jIZuzYN7jvMJsmH6th.exe (PID: 4000)
      • Koxumaecuma.exe (PID: 3616)
      • 020Z8fSK1Qh9_iQHhRTQhAmD.exe (PID: 3236)
      • AppLaunch.exe (PID: 3540)
      • AppLaunch.exe (PID: 1496)
      • Install.exe (PID: 3156)
      • NAXx7bbat0YZHl8CxIeGp8ZB.exe (PID: 1340)
      • aOrr6NrqysUW1Apt6G1SE8FZ.exe (PID: 3548)

    • Adds / modifies Windows certificates

      • OracleSearch.exe (PID: 2672)
      • iBvCPKCX4yF3fECm3p7Tp_z_.exe (PID: 3024)
      • ESFzVcMTPpIcNkWLxBGKxN8d.exe (PID: 3324)
      • Koxumaecuma.exe (PID: 3616)

    • Drops a file that was compiled in debug mode

      • OracleSearch.exe (PID: 2672)
      • Tlhakssf9zE42egCEU2YcXUO.tmp (PID: 412)
      • 8CgpJYDLzmist6SEAgq4vr5O.exe (PID: 3060)
      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)
      • RcqOZ1U7z3966WgnhYJg6MHl.exe (PID: 4036)
      • ________djskjT76(((.exe (PID: 2312)
      • 6DC8.tmp.exe (PID: 1524)
      • 63845806180.exe (PID: 2468)
      • cYySv7jIZuzYN7jvMJsmH6th.exe (PID: 4000)
      • Koxumaecuma.exe (PID: 3616)

    • Checks for external IP

      • OracleSearch.exe (PID: 2672)
      • iBvCPKCX4yF3fECm3p7Tp_z_.exe (PID: 3024)
      • cYySv7jIZuzYN7jvMJsmH6th.exe (PID: 4000)

    • Creates files in the user directory

      • RcqOZ1U7z3966WgnhYJg6MHl.exe (PID: 4036)
      • 6DC8.tmp.exe (PID: 1524)
      • 63845806180.exe (PID: 2468)

    • Executed via WMI

      • rundll32.exe (PID: 2016)

    • Creates a directory in Program Files

      • iBvCPKCX4yF3fECm3p7Tp_z_.exe (PID: 3024)
      • ________djskjT76(((.exe (PID: 2312)
      • foldershare.tmp (PID: 1400)

    • Drops a file with too old compile date

      • OracleSearch.exe (PID: 2672)
      • Tlhakssf9zE42egCEU2YcXUO.exe (PID: 2060)
      • Tlhakssf9zE42egCEU2YcXUO.tmp (PID: 412)
      • ________djskjT76(((.exe (PID: 2312)
      • cYySv7jIZuzYN7jvMJsmH6th.exe (PID: 4000)

    • Creates files in the program directory

      • iBvCPKCX4yF3fECm3p7Tp_z_.exe (PID: 3024)
      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)
      • SoDmuHhPgBhjtrV6DA70hbpi.exe (PID: 1436)

    • Reads the Windows organization settings

      • Tlhakssf9zE42egCEU2YcXUO.tmp (PID: 412)
      • foldershare.tmp (PID: 1400)

    • Reads Windows owner or organization settings

      • Tlhakssf9zE42egCEU2YcXUO.tmp (PID: 412)
      • foldershare.tmp (PID: 1400)

    • Reads Environment values

      • ZivKTnAr7w9xt_7BHdO2JPFf.exe (PID: 436)
      • Xm0yK3Tw8ek6TSvGMQ5WOvIe.exe (PID: 1028)
      • 5433.tmp.exe (PID: 3172)
      • HHzWRgvwqwAKbkBsVddhjkLm.exe (PID: 2608)
      • ________djskjT76(((.exe (PID: 2312)
      • RegAsm.exe (PID: 3528)
      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)
      • Laecuvafyky.exe (PID: 908)
      • Koxumaecuma.exe (PID: 3616)
      • AppLaunch.exe (PID: 3540)
      • 63845806180.exe (PID: 2468)
      • aOrr6NrqysUW1Apt6G1SE8FZ.exe (PID: 3548)
      • AppLaunch.exe (PID: 1496)
      • 020Z8fSK1Qh9_iQHhRTQhAmD.exe (PID: 3236)
      • SoDmuHhPgBhjtrV6DA70hbpi.exe (PID: 1436)

    • Reads the cookies of Google Chrome

      • ZivKTnAr7w9xt_7BHdO2JPFf.exe (PID: 436)
      • HHzWRgvwqwAKbkBsVddhjkLm.exe (PID: 2608)
      • Xm0yK3Tw8ek6TSvGMQ5WOvIe.exe (PID: 1028)
      • AppLaunch.exe (PID: 3540)
      • AppLaunch.exe (PID: 1496)
      • RegAsm.exe (PID: 3528)

    • Reads the cookies of Mozilla Firefox

      • ZivKTnAr7w9xt_7BHdO2JPFf.exe (PID: 436)
      • HHzWRgvwqwAKbkBsVddhjkLm.exe (PID: 2608)
      • Xm0yK3Tw8ek6TSvGMQ5WOvIe.exe (PID: 1028)
      • AppLaunch.exe (PID: 3540)
      • AppLaunch.exe (PID: 1496)
      • RegAsm.exe (PID: 3528)

    • Searches for installed software

      • ZivKTnAr7w9xt_7BHdO2JPFf.exe (PID: 436)
      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)
      • Xm0yK3Tw8ek6TSvGMQ5WOvIe.exe (PID: 1028)
      • HHzWRgvwqwAKbkBsVddhjkLm.exe (PID: 2608)
      • RegAsm.exe (PID: 3528)
      • AppLaunch.exe (PID: 1496)
      • AppLaunch.exe (PID: 3540)
      • SoDmuHhPgBhjtrV6DA70hbpi.exe (PID: 1436)

    • Starts CMD.EXE for commands execution

      • 8CgpJYDLzmist6SEAgq4vr5O.exe (PID: 3060)
      • RcqOZ1U7z3966WgnhYJg6MHl.exe (PID: 4036)
      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)
      • forfiles.exe (PID: 2248)
      • forfiles.exe (PID: 2208)

    • Creates files in the Windows directory

      • svchost.exe (PID: 860)

    • Reads CPU info

      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)
      • 63845806180.exe (PID: 2468)
      • SoDmuHhPgBhjtrV6DA70hbpi.exe (PID: 1436)

    • Starts CMD.EXE for self-deleting

      • RcqOZ1U7z3966WgnhYJg6MHl.exe (PID: 4036)
      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)

    • Starts Internet Explorer

      • Laecuvafyky.exe (PID: 908)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 1820)

    • Starts Microsoft Office Application

      • ________djskjT76(((.exe (PID: 2312)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 784)

    • Starts itself from another location

      • FXxmbZ9n9PwHAiKKMZEiv253.exe (PID: 1364)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 3068)
      • cmd.exe (PID: 3688)

  • INFO

    • Checks supported languages

      • NOTEPAD.EXE (PID: 824)
      • rundll32.exe (PID: 2016)
      • schtasks.exe (PID: 1248)
      • schtasks.exe (PID: 2176)
      • PING.EXE (PID: 348)
      • iexplore.exe (PID: 3792)
      • iexplore.exe (PID: 1820)
      • taskkill.exe (PID: 3164)
      • forfiles.exe (PID: 2208)
      • timeout.exe (PID: 2768)
      • cmd.exe (PID: 3068)
      • forfiles.exe (PID: 2248)
      • reg.exe (PID: 3052)
      • cmd.exe (PID: 3688)
      • reg.exe (PID: 2368)

    • Reads settings of System Certificates

      • OracleSearch.exe (PID: 2672)
      • iBvCPKCX4yF3fECm3p7Tp_z_.exe (PID: 3024)
      • ESFzVcMTPpIcNkWLxBGKxN8d.exe (PID: 3324)
      • RcqOZ1U7z3966WgnhYJg6MHl.exe (PID: 4036)
      • 8CgpJYDLzmist6SEAgq4vr5O.exe (PID: 3060)
      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)
      • ________djskjT76(((.exe (PID: 2312)
      • cYySv7jIZuzYN7jvMJsmH6th.exe (PID: 4000)
      • Laecuvafyky.exe (PID: 908)
      • Koxumaecuma.exe (PID: 3616)
      • iexplore.exe (PID: 1820)
      • SoDmuHhPgBhjtrV6DA70hbpi.exe (PID: 1436)
      • iexplore.exe (PID: 3792)
      • 020Z8fSK1Qh9_iQHhRTQhAmD.exe (PID: 3236)
      • aOrr6NrqysUW1Apt6G1SE8FZ.exe (PID: 3548)
      • NAXx7bbat0YZHl8CxIeGp8ZB.exe (PID: 1340)
      • AppLaunch.exe (PID: 1496)
      • AppLaunch.exe (PID: 3540)

    • Checks Windows Trust Settings

      • OracleSearch.exe (PID: 2672)
      • RcqOZ1U7z3966WgnhYJg6MHl.exe (PID: 4036)
      • hXFG2sTVCSFyj7FdxtuRywcI.exe (PID: 1236)
      • 8CgpJYDLzmist6SEAgq4vr5O.exe (PID: 3060)
      • cYySv7jIZuzYN7jvMJsmH6th.exe (PID: 4000)
      • iexplore.exe (PID: 1820)
      • SoDmuHhPgBhjtrV6DA70hbpi.exe (PID: 1436)
      • iexplore.exe (PID: 3792)
      • NAXx7bbat0YZHl8CxIeGp8ZB.exe (PID: 1340)

    • Reads the computer name

      • rundll32.exe (PID: 2016)
      • schtasks.exe (PID: 1248)
      • schtasks.exe (PID: 2176)
      • PING.EXE (PID: 348)
      • iexplore.exe (PID: 3792)
      • iexplore.exe (PID: 1820)
      • taskkill.exe (PID: 3164)

    • Application was dropped or rewritten from another process

      • ________djskjT76(((.exe (PID: 2312)
      • Tlhakssf9zE42egCEU2YcXUO.tmp (PID: 412)

    • Creates files in the program directory

      • ________djskjT76(((.exe (PID: 2312)
      • foldershare.tmp (PID: 1400)

    • Changes internet zones settings

      • iexplore.exe (PID: 3792)

    • Application launched itself

      • iexplore.exe (PID: 3792)

    • Creates a software uninstall entry

      • foldershare.tmp (PID: 1400)

    • Reads internet explorer settings

      • iexplore.exe (PID: 1820)

    • Creates files in the user directory

      • iexplore.exe (PID: 1820)

    • Dropped object may contain Bitcoin addresses

      • OracleSearch.exe (PID: 2672)

    • Loads dropped or rewritten executable

      • Tlhakssf9zE42egCEU2YcXUO.tmp (PID: 412)
      • foldershare.tmp (PID: 1400)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: Setup.zip
ZipUncompressedSize: 137088
ZipCompressedSize: 137141
ZipCRC: 0x51fa9d48
ZipModifyDate: 2022:01:15 04:01:01
ZipCompression: Unknown (99)
ZipBitFlag: 0x0003
ZipRequiredVersion: 20
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
75
Malicious processes
29
Suspicious processes
12

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start inject drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe no specs notepad.exe no specs winrar.exe setup.exe no specs setup.exe oraclesearch.exe 4wqlnk0dcer3lp2xf6o1lim7.exe zn2pumnkov9mcrtuxcqg3flk.exe no specs ixt1donaxy7tlwzognobbguw.exe no specs ibvcpkcx4yf3fecm3p7tp_z_.exe #REDLINE zivktnar7w9xt_7bhdo2jpff.exe tolqlgs1rpsoeifhgrpk6mpt.exe esfzvcmtppicnkwlxbgkxn8d.exe no specs esfzvcmtppicnkwlxbgkxn8d.exe sim5bgjfdchjpsexicq7hulf.exe no specs zn2pumnkov9mcrtuxcqg3flk.exe no specs #VIDAR hxfg2stvcsfyj7fdxturywci.exe #REDLINE xm0yk3tw8ek6tsvgmq5wovie.exe rcqoz1u7z3966wgnhyjg6mhl.exe 8cgpjydlzmist6seagq4vr5o.exe #REDLINE hhzwrgvwqwakbkbsvddhjklm.exe #REDLINE regasm.exe rundll32.exe svchost.exe tlhakssf9ze42egceu2ycxuo.exe tlhakssf9ze42egceu2ycxuo.tmp ixt1donaxy7tlwzognobbguw.exe no specs 5433.tmp.exe no specs ________djskjt76(((.exe cmd.exe no specs 53275277524.exe cyysv7jizuzyn7jvmjsmh6th.exe schtasks.exe no specs schtasks.exe no specs 0yv7neeid8ylhggykaupjaxc.exe no specs #REDLINE applaunch.exe laecuvafyky.exe koxumaecuma.exe 6dc8.tmp.exe cmd.exe no specs ping.exe no specs iexplore.exe iexplore.exe foldershare.exe no specs foldershare.tmp no specs ckdmbll8brc8misi5npa21jz.exe no specs foldershare.exe no specs cmd.exe no specs #REDLINE applaunch.exe 63845806180.exe fxxmbz9n9pwhaikkmzeiv253.exe no specs #VIDAR sodmuhhpgbhjtrv6da70hbpi.exe cmd.exe no specs taskkill.exe no specs install.exe no specs sqbfiqwlpo4v9jfnhirtrtlb.exe no specs install.exe #REDLINE 1jhulqmnslcmske6ywr3oobi.exe forfiles.exe no specs forfiles.exe no specs timeout.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs 020z8fsk1qh9_iqhhrtqhamd.exe aorr6nrqysuw1apt6g1se8fz.exe reg.exe no specs naxx7bbat0yzhl8cxiegp8zb.exe e5dde5c0-3314-4329-be40-a6574f7a9485.exe no specs #REDLINE neofim.exe 17e09b54-912d-491f-8ac7-f4dfd9fe255f.exe no specs 98cj2d1mgyvg7fkms2eeq2k1.exe schtasks.exe no specs bc25hvakfqeitmwjfzidlixd.exe no specs rdavolifkuhwvqlopscyeu8l.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
296"C:\Users\admin\Pictures\Adobe Films\ixT1donAxy7TlWzoGnObbGUw.exe" C:\Users\admin\Pictures\Adobe Films\ixT1donAxy7TlWzoGnObbGUw.exe—OracleSearch.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\pictures\adobe films\ixt1donaxy7tlwzognobbguw.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imm32.dll
296"C:\Users\admin\AppData\Local\Temp\17e09b54-912d-491f-8ac7-f4dfd9fe255f.exe" C:\Users\admin\AppData\Local\Temp\17e09b54-912d-491f-8ac7-f4dfd9fe255f.exe—aOrr6NrqysUW1Apt6G1SE8FZ.exe
User:
admin
Company:
bydfuigsdf
Integrity Level:
HIGH
Description:
bydfuigsdf
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\17e09b54-912d-491f-8ac7-f4dfd9fe255f.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
348ping 127.0.0.1 C:\Windows\system32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\nsi.dll
412"C:\Users\admin\AppData\Local\Temp\is-OLQL8.tmp\Tlhakssf9zE42egCEU2YcXUO.tmp" /SL5="$4013C,312591,228864,C:\Users\admin\Pictures\Adobe Films\Tlhakssf9zE42egCEU2YcXUO.exe" C:\Users\admin\AppData\Local\Temp\is-OLQL8.tmp\Tlhakssf9zE42egCEU2YcXUO.tmp
Tlhakssf9zE42egCEU2YcXUO.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
1
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-olql8.tmp\tlhakssf9ze42egceu2ycxuo.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
436"C:\Users\admin\Pictures\Adobe Films\ZivKTnAr7w9xt_7BHdO2JPFf.exe" C:\Users\admin\Pictures\Adobe Films\ZivKTnAr7w9xt_7BHdO2JPFf.exe
OracleSearch.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\pictures\adobe films\zivktnar7w9xt_7bhdo2jpff.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
784"C:\Windows\System32\cmd.exe" /c taskkill /im hXFG2sTVCSFyj7FdxtuRywcI.exe /f & timeout /t 6 & del /f /q "C:\Users\admin\Pictures\Adobe Films\hXFG2sTVCSFyj7FdxtuRywcI.exe" & del C:\ProgramData\*.dll & exitC:\Windows\System32\cmd.exe—hXFG2sTVCSFyj7FdxtuRywcI.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\taskkill.exe
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
824"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\AppData\Local\Temp\Rar$DIb2172.47376\password-is-485136.txtC:\Windows\system32\NOTEPAD.EXE—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
860C:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
908"C:\Users\admin\AppData\Local\Temp\4e-5eb24-03a-4d8aa-6e4178c175955\Laecuvafyky.exe" C:\Users\admin\AppData\Local\Temp\4e-5eb24-03a-4d8aa-6e4178c175955\Laecuvafyky.exe
________djskjT76(((.exe
User:
admin
Company:
firefox__update__
Integrity Level:
HIGH
Description:
firefox__update__
Exit code:
0
Version:
1.1.1.1
Modules
Images
c:\users\admin\appdata\local\temp\4e-5eb24-03a-4d8aa-6e4178c175955\laecuvafyky.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\rpcrt4.dll
1028"C:\Users\admin\Pictures\Adobe Films\Xm0yK3Tw8ek6TSvGMQ5WOvIe.exe" C:\Users\admin\Pictures\Adobe Films\Xm0yK3Tw8ek6TSvGMQ5WOvIe.exe
OracleSearch.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\pictures\adobe films\xm0yk3tw8ek6tsvgmq5wovie.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
99 093
Read events
98 134
Write events
944
Delete events
15

Modification events

(PID) Process:(2172) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2172) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2172) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2172) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2172) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2172) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\f1642209292.zip
(PID) Process:(2172) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2172) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2172) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2172) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
Executable files
116
Suspicious files
67
Text files
48
Unknown types
31

Dropped files

PID
Process
Filename
Type
2260WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2260.48760\bin0binary
MD5:—
SHA256:—
2672OracleSearch.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
2172WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb2172.47376\password-is-485136.txttext
MD5:—
SHA256:—
2672OracleSearch.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\PL_Client[1].bmpbinary
MD5:—
SHA256:—
2172WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb2172.48236\Setup.zipcompressed
MD5:—
SHA256:—
2672OracleSearch.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27binary
MD5:—
SHA256:—
2260WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb2260.48760\Setup.exeexecutable
MD5:—
SHA256:—
1160Setup.exeC:\Users\admin\AppData\Local\Temp\OracleSearch.exeexecutable
MD5:—
SHA256:—
2672OracleSearch.exeC:\Users\admin\Pictures\Adobe Films\jB2QcMvdAOsTouCoHZxVWBfr.exehtml
MD5:—
SHA256:—
860svchost.exeC:\Windows\appcompat\programs\RecentFileCache.bcftxt
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
142
TCP/UDP connections
301
DNS requests
129
Threats
559

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2672
OracleSearch.exe
HEAD
200
45.144.225.57:80
http://45.144.225.57/download/NiceProcessX32.bmp
unknown
—
—
malicious
2672
OracleSearch.exe
HEAD
200
45.144.225.57:80
http://45.144.225.57/WW/search_target1kpd.exe
unknown
—
—
malicious
2672
OracleSearch.exe
HEAD
404
212.193.30.45:80
http://212.193.30.45/WW/file5.exe
RU
—
—
malicious
2672
OracleSearch.exe
HEAD
200
85.209.157.230:80
http://stylesheet.faseaegasdfase.com/hp8/g1/rtst1053.exe
unknown
—
—
malicious
2672
OracleSearch.exe
HEAD
404
45.144.225.57:80
http://45.144.225.57/WW/sfx_123_310.exe
unknown
—
—
malicious
2672
OracleSearch.exe
HEAD
200
185.215.113.208:80
http://185.215.113.208/ferrari.exe
PT
—
—
malicious
2672
OracleSearch.exe
HEAD
200
212.193.30.29:80
http://212.193.30.29/WW/file4.exe
RU
—
—
malicious
2672
OracleSearch.exe
HEAD
404
212.193.30.29:80
http://212.193.30.29/WW/file1.exe
RU
—
—
malicious
2672
OracleSearch.exe
HEAD
200
91.224.22.193:80
http://xmtbsj.com/setup.exe
RU
—
—
suspicious
2672
OracleSearch.exe
HEAD
404
212.193.30.45:80
http://212.193.30.45/WW/file7.exe
RU
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2672
OracleSearch.exe
212.193.30.45:80
—
—
RU
malicious
—
—
45.144.225.57:80
—
—
—
malicious
2672
OracleSearch.exe
104.23.98.190:443
pastebin.com
Cloudflare Inc
US
malicious
2672
OracleSearch.exe
172.67.133.215:80
wfsdragon.ru
—
US
malicious
2672
OracleSearch.exe
162.159.129.233:80
cdn.discordapp.com
Cloudflare Inc
—
shared
2672
OracleSearch.exe
2.56.59.42:80
—
—
—
malicious
2672
OracleSearch.exe
162.159.129.233:443
cdn.discordapp.com
Cloudflare Inc
—
shared
2672
OracleSearch.exe
162.159.130.233:443
cdn.discordapp.com
Cloudflare Inc
—
shared
2672
OracleSearch.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2672
OracleSearch.exe
34.117.59.81:443
ipinfo.io
—
US
whitelisted

DNS requests

Domain
IP
Reputation
pastebin.com
  • 104.23.98.190
  • 104.23.99.190
malicious
wfsdragon.ru
  • 172.67.133.215
  • 104.21.5.208
malicious
cdn.discordapp.com
  • 162.159.129.233
  • 162.159.130.233
  • 162.159.135.233
  • 162.159.133.233
  • 162.159.134.233
shared
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
ipinfo.io
  • 34.117.59.81
shared
db-ip.com
  • 172.67.75.166
  • 104.26.4.15
  • 104.26.5.15
whitelisted
api.db-ip.com
  • 104.26.5.15
  • 104.26.4.15
  • 172.67.75.166
shared
stylesheet.faseaegasdfase.com
  • 85.209.157.230
malicious
xmtbsj.com
  • 91.224.22.193
suspicious

Threats

PID
Process
Class
Message
2672
OracleSearch.exe
A Network Trojan was detected
ET MALWARE User-Agent (???)
2672
OracleSearch.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
2672
OracleSearch.exe
Potentially Bad Traffic
ET INFO Terse Request for .txt - Likely Hostile
2672
OracleSearch.exe
A Network Trojan was detected
ET MALWARE User-Agent (???)
2672
OracleSearch.exe
Generic Protocol Command Decode
SURICATA Applayer Mismatch protocol both directions
2672
OracleSearch.exe
Generic Protocol Command Decode
SURICATA Applayer Mismatch protocol both directions
2672
OracleSearch.exe
A Network Trojan was detected
ET POLICY Possible External IP Lookup Domain Observed in SNI (ipinfo. io)
2672
OracleSearch.exe
Potential Corporate Privacy Violation
ET POLICY Possible External IP Lookup SSL Cert Observed (ipinfo.io)
2672
OracleSearch.exe
A Network Trojan was detected
ET TROJAN Win32/Unk.HRESQ! MultiDownloader Checkin
2672
OracleSearch.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
324 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
f1642209292.zip